diff --git a/packages/harness/src/server/auth-mcp-wiring.test.ts b/packages/harness/src/server/auth-mcp-wiring.test.ts
index d4be43e26..57c73c51e 100644
--- a/packages/harness/src/server/auth-mcp-wiring.test.ts
+++ b/packages/harness/src/server/auth-mcp-wiring.test.ts
@@ -30,7 +30,10 @@ const authFixture = vi.hoisted(() => ({
   },
 }));
 
-vi.mock("@sapiom/mcp/auth", () => {
+// Partial mock: every export not listed below stays real, so a new auth
+// import in the server cannot fail here as a missing mock export.
+vi.mock("@sapiom/mcp/auth", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@sapiom/mcp/auth")>();
   const resolveEnvironment = vi.fn(async (environment?: string) => {
     const requested = environment ?? "production";
     const name =
@@ -57,6 +60,7 @@ vi.mock("@sapiom/mcp/auth", () => {
   });
 
   return {
+    ...actual,
     resolveEnvironment,
     readCredentials: vi.fn(async () => authFixture.credential),
     readCredentialsOrThrow: vi.fn(async () => {
diff --git a/packages/harness/src/server/definition-list-enrichment.test.ts b/packages/harness/src/server/definition-list-enrichment.test.ts
index ad05e99c0..c0cc6853f 100644
--- a/packages/harness/src/server/definition-list-enrichment.test.ts
+++ b/packages/harness/src/server/definition-list-enrichment.test.ts
@@ -1,8 +1,10 @@
 /**
  * Wiring regression for SAP-3214: one tenant-scoped list request per pass,
  * never a by-id request for a definition the account can't see. Fake Agents
- * API counting list and detail requests; `@sapiom/mcp/auth` mocked so the
- * disconnect route never touches ~/.sapiom.
+ * API counting list and detail requests. `@sapiom/mcp/auth` is a PARTIAL
+ * mock: the credential store and the browser flow are replaced, every other
+ * export runs for real, and the home directory is redirected to a temp dir
+ * so nothing real can reach ~/.sapiom.
  */
 import {
   createServer as createHttpServer,
@@ -14,7 +16,21 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-vi.mock("@sapiom/mcp/auth", () => ({
+// The real module resolves every path through `os.homedir()` internally, so
+// a mocked `credentialsFilePath` export alone would not contain a new real
+// export. Redirect the home directory instead: the credential store then
+// lives under a temp dir that does not exist, the observer sees ENOENT and
+// stays quiet, and nothing under the real ~/.sapiom is watched or written.
+vi.mock("node:os", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("node:os")>()),
+  homedir: () => "/tmp/sap3214-enrichment-home",
+}));
+
+// Every other export stays real so a new import in the server cannot turn
+// this fake into a missing-export failure; with the home redirected above,
+// whatever runs for real stays inside the temp home.
+vi.mock("@sapiom/mcp/auth", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@sapiom/mcp/auth")>()),
   resolveEnvironment: vi.fn(async (environment?: string) => ({
     name: environment === "dev" ? "staging" : "production",
     appURL: "https://app.example.test",