chore: satisfy the gate families the #16608 diff derives

- the changeset carries its ADR-0087 disposition: an enforcement-ORDER change
  moves no authorable key, spelling or stored shape, so no conversion entry
  and nothing for an upgrader to hand-edit (check:adr-0087-registration);
- the fail-closed leg's engine double routes delete/update/findOne through the
  real dispatch predicates, so it cannot be looser than ObjectQL
  (check:engine-double-contract);
- `@objectstack/driver-sqlite-wasm` — the conformance cell's second driver
  family — is read from the producer's SOURCE on both axes: a vitest alias
  (check:test-source-alias) and a bare-key tsconfig `paths` rule
  (check:type-source-resolution). Measured: the paths route adds zero
  diagnostics from other packages here; the test layer still compiles at 0.

Refs #16608.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Author: claude

.changeset/insert-check-post-image.md

@@ -5,6 +5,8 @@
 
 fix(plugin-security)!: the insert-side RLS `check` is evaluated on the row that will be STORED — after `beforeInsert` — instead of on the caller's raw payload (#16608)
 
+<!-- adr-0087: not-required (no-migration-prescription) an enforcement-ORDER change: no authorable key, spelling or stored shape moves, so a stored `sys_metadata` row needs no conversion and an upgrader has nothing to hand-edit. What changes is which image the existing `check` predicate is evaluated against; the remedy for a newly-refused insert is to fix the policy or the data, not to migrate metadata. -->
+
 **BREAKING** — an accept-set narrowing on the write gate's refusal behaviour. An insert that is admitted today can be refused after this change.
 
 `check` validates the row a write produces — the PostgreSQL `WITH CHECK` analog. `update` reached that row by merging the caller's pre-image with the change set. `insert` could not: it has no pre-image, and the security middleware runs BEFORE the engine's operation, so its post-image was `opCtx.data` — the caller's payload as it arrived, ahead of `applyFieldDefaults` and ahead of every `beforeInsert` hook.

packages/plugins/plugin-security/src/insert-check-post-image.test.ts

@@ -76,6 +76,15 @@
  */
 
 import { describe, it, expect, afterEach, vi } from 'vitest';
+import {
+  assertEngineDeleteDispatch,
+  assertEngineUpdateDispatch,
+  assertEngineFindOnePredicate,
+  type EngineFindOneQueryInput,
+  type EngineUpdateDispatchData,
+  type EngineUpdateDispatchInput,
+  type EngineDeleteDispatchInput,
+} from '@objectstack/metadata-core';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';
@@ -480,10 +489,23 @@ describe('[#16608] fail-closed — an engine that does not run the installed che
       registerMiddleware: (mw: (opCtx: unknown, next: () => Promise<void>) => Promise<void>) => middlewares.push(mw),
       getSchema: (name: string) => OBJECTS.find((o) => o.name === name),
       async find() { return []; },
-      async findOne() { return null; },
+      // The write verbs route through the real engine's dispatch predicates —
+      // a double looser than `ObjectQL` turns a green suite into no suite
+      // (`check:engine-double-contract`, from #4434). This double refuses a
+      // call the engine refuses even though the leg below never makes one.
+      async findOne(object: string, query: EngineFindOneQueryInput) {
+        assertEngineFindOnePredicate(object, query);
+        return null;
+      },
       async insert(_object: string, data: Record<string, unknown>) { rows.push({ ...data }); return data; },
-      async update(_object: string, data: unknown) { return data; },
-      async delete() { return true; },
+      async update(_object: string, data: EngineUpdateDispatchData, options?: EngineUpdateDispatchInput | null) {
+        assertEngineUpdateDispatch(data, options);
+        return data;
+      },
+      async delete(_object: string, options?: EngineDeleteDispatchInput | null) {
+        assertEngineDeleteDispatch(options);
+        return true;
+      },
     };
     const services: Record<string, unknown> = {
       manifest: { register: vi.fn() },

packages/plugins/plugin-security/tsconfig.json

@@ -25,8 +25,17 @@
     // `@objectstack/types/*` subpath, and a `paths` target that matches
     // nothing on disk would silently fall back to node resolution (see the
     // rest package's block for the measured traps).
+    // [#16608] `@objectstack/driver-sqlite-wasm` is imported as a VALUE by
+    // `src/insert-check-post-image.test.ts`, whose conformance cell runs on two
+    // driver families. Same rule, same reason and the same bare (star-free)
+    // key shape as the entry above — an exact match, so it cannot swallow a
+    // subpath, and this package imports none. It is declared HERE and not in
+    // `tsconfig.test.json` because a child that declared its own `paths` would
+    // REPLACE this map rather than merge into it, silently sending
+    // `@objectstack/types` back to `dist/`.
     "paths": {
-      "@objectstack/types": ["../../types/src/index.ts"]
+      "@objectstack/types": ["../../types/src/index.ts"],
+      "@objectstack/driver-sqlite-wasm": ["../../drivers/driver-sqlite-wasm/src/index.ts"]
     }
   },
   "include": [

packages/plugins/plugin-security/vitest.config.ts

@@ -71,6 +71,19 @@ export default defineConfig({
         find: /^@objectstack\/metadata-protocol$/,
         replacement: path.resolve(__dirname, '../../metadata-protocol/src/index.ts'),
       },
+      // [#16608] `insert-check-post-image.test.ts` imports `SqliteWasmDriver`
+      // as a VALUE: its conformance cell runs on two driver families, because
+      // "the check judges the row that will be stored" is a claim about the
+      // write gate that must not turn out to depend on which backend a
+      // deployment happens to run. Same reason as `driver-sql` above — left
+      // unaliased the specifier resolves through the workspace link to `dist/`,
+      // a BUILD ARTIFACT, and a dist merely BEHIND runs GREEN against the
+      // driver's old behaviour while saying nothing (`check:test-source-alias`
+      // refuses exactly that).
+      {
+        find: /^@objectstack\/driver-sqlite-wasm$/,
+        replacement: path.resolve(__dirname, '../../drivers/driver-sqlite-wasm/src/index.ts'),
+      },
     ],
   },
 });