test(plugin-security,spec): pin the new engine double to the producer's dispatch predicates (#7414)

`check:engine-double-contract` caught the new fixture's `delete()`/`update()`
being looser than `ObjectQL`'s — a fake that accepts call shapes the engine
refuses collects greens the producer would not. Both verbs now open with
`assertEngineDeleteDispatch` / `assertEngineUpdateDispatch` from
`@objectstack/metadata-core`.

Also corrects the flag on the catalog's placeholder case: reverse verification
measured it going RED on a reverted catalog (it reads the ENTRY, not the
rendering), so the comment claiming it cannot bite was wrong.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BM1tNf5U3nEbHKR4fo5qVQ

Author: claude

packages/plugins/plugin-security/src/permission-denied-user-copy.test.ts

@@ -38,6 +38,7 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { FileI18nAdapter } from '@objectstack/service-i18n';
 import { PermissionSetSchema } from '@objectstack/spec/security';
 import type { PermissionSet } from '@objectstack/spec/security';
@@ -126,8 +127,29 @@ function makeEngine() {
       return (await this.find(object, options))[0] ?? null;
     },
     async insert(object: string, data: any) { (tables[object] ??= []).push({ ...data }); return data; },
-    async update(_object: string, data: any) { return data; },
-    async delete() { return true; },
+    // Both write verbs open with the PRODUCER's own dispatch predicate, never a
+    // hand-mirrored guard: a fake looser than `ObjectQL` collects greens from
+    // call shapes the engine would refuse. Nothing in this file reaches them
+    // (the gate refuses first, which is the point), so they exist to keep the
+    // double honest for whatever case is added next.
+    async update(object: string, data: any, options?: any) {
+      const dispatch = assertEngineUpdateDispatch(data, options);
+      const rows = (tables[object] ??= []);
+      const targets = dispatch.kind === 'by-id'
+        ? rows.filter((r) => r.id === dispatch.id)
+        : rows.filter((r) => matches(r, options?.where));
+      for (const r of targets) Object.assign(r, data);
+      return dispatch.kind === 'by-id' ? (targets[0] ?? null) : targets.length;
+    },
+    async delete(object: string, options?: any) {
+      const dispatch = assertEngineDeleteDispatch(options);
+      const rows = (tables[object] ??= []);
+      const targets = dispatch.kind === 'by-id'
+        ? rows.filter((r) => r.id === dispatch.id)
+        : rows.filter((r) => matches(r, options?.where));
+      tables[object] = rows.filter((r) => !targets.includes(r));
+      return dispatch.kind === 'by-id' ? targets.length > 0 : targets.length;
+    },
   };
 }
 

packages/spec/src/system/operation-message.test.ts

@@ -151,11 +151,14 @@ describe('operation message catalog — permission_denied (#7414)', () => {
   });
 
   it('ships no unfilled placeholder in any locale — the sentence takes no params', () => {
-    // ⚠️ This case is HYGIENE, not a revert-detector: it also passes on a
-    // catalog with the key removed entirely (the fallback is the bare
-    // messageKey, which has no braces either). Its value is catching a
-    // template that shipped a `{{name}}` / `{name}` nobody fills — the #7333
-    // class of bug, where the two brace conventions in this repo are mixed up.
+    // Asserts on the CATALOG ENTRY, not on the rendering, and that is the
+    // difference between a guard and a decoration. Rendering a removed key
+    // yields the bare messageKey — which has no braces either, so a
+    // rendering-based version of this case would stay green on a catalog that
+    // lost the key entirely. Reading the entry makes it bite twice: on a
+    // missing locale (the entry is `undefined`) and on a template that shipped
+    // a `{{name}}` / `{name}` nobody fills, which is the #7333 class of bug
+    // where this repo's two brace conventions get mixed up.
     for (const [locale, catalog] of Object.entries(BUILTIN_OPERATION_MESSAGES)) {
       expect(catalog.permission_denied, `${locale} defines permission_denied`).toBeTypeOf('string');
       expect(catalog.permission_denied, `${locale} placeholder-free`).not.toMatch(/[{}]/);