test(plugin-auth): route the fake engine's update through the dispatch assert

Claude-Session: https://claude.ai/code/session_019srGWGCBBCBHqcDoRZpQRh
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/organization-metadata-decode.test.ts

@@ -27,6 +27,7 @@ import { describe, it, expect, vi } from 'vitest';
 import type { IDataEngine } from '@objectstack/core';
 import { SystemObjectName } from '@objectstack/spec/system';
 import { organization } from 'better-auth/plugins/organization';
+import { assertEngineUpdateDispatch } from '@objectstack/objectql';
 import { decodeOrganizationMetadataOnRead } from './organization-metadata-decode.js';
 import { createObjectQLAdapterFactory } from './objectql-adapter.js';
 import { buildOrganizationPluginSchema } from './auth-schema-config.js';
@@ -101,7 +102,12 @@ describe('⭐ the four read routes serve the decoded object, through the real ad
       findOne: vi.fn().mockResolvedValue(row ? { ...row } : null),
       find: vi.fn().mockResolvedValue(row ? [{ ...row }] : []),
       count: vi.fn().mockResolvedValue(0),
-      update: vi.fn().mockImplementation((_m: string, d: any) => Promise.resolve({ ...STORED_ROW, ...d })),
+      update: vi.fn().mockImplementation((_m: string, d: any, options?: any) => {
+        // The real engine's three-way dispatch — a double looser than this is
+        // no double at all (`check:engine-double-contract`).
+        assertEngineUpdateDispatch(d, options);
+        return Promise.resolve({ ...STORED_ROW, ...d });
+      }),
       delete: vi.fn().mockResolvedValue(undefined),
     } as unknown as IDataEngine;
     // The plugin must be mounted: better-auth's factory validates the model

scripts/engine-double-contract.pinned.json

@@ -2606,6 +2606,11 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/plugins/plugin-auth/src/organization-metadata-decode.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/plugins/plugin-auth/src/remove-member-permission-guard.test.ts",
       "verb": "delete",