test(core): classify the moved reference check in the second-object read census

engine-referential-integrity.ts now holds the referenceTargetOf call that
assertReferencesResolve made in engine.ts, so the census in
second-object-read-exposure.pin.test.ts gets a not-a-served-read row for it,
and the engine.ts row's `also` text drops the reference-existence probe,
whose arbiter call no longer lives there.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiAsjPtReu1tmXvCEd8f7R

Author: claude

packages/core/src/security/second-object-read-exposure.pin.test.ts

@@ -138,7 +138,6 @@ const CALLERS: Record<string, Classification> = {
     read: "the expansion sub-read (`ObjectQL.expandRelatedRecords`), for the data door's `$expand`",
     decidedIn: 'packages/metadata-protocol/src/protocol-query-validation.ts',
     also:
-      'the write-path reference-existence probe (`referenceExists`: whether a stored id resolves, no field) and ' +
       'the validation-predicate reads (`resolvePredicateRelated`: a pass/fail verdict, the value never served). ' +
       "The engine's privileged callers (a flow's `config.expand`, a hook's read) never pass the door, by design.",
   },
@@ -210,6 +209,14 @@ const CALLERS: Record<string, Classification> = {
     kind: 'not-a-served-read',
     reason: "resolves a seed's references at install, under the system identity; serves nothing to a caller",
   },
+  // [#25522 cut 10] The write-path reference check, moved out of engine.ts.
+  'packages/objectql/src/engine-referential-integrity.ts': {
+    kind: 'not-a-served-read',
+    reason:
+      'the write-path reference-existence check (`assertReferencesResolve`): it asks whether a caller-supplied id ' +
+      "resolves on the target (the engine's `referenceExists` probe) and answers `reference_not_found` or nothing, " +
+      'never a field of the target',
+  },
   'packages/objectql/src/integrity/dangling-reference-audit.ts': {
     kind: 'not-a-served-read',
     reason: 'an integrity audit: it probes whether a stored id resolves and reports ids, never a field of the target',