test(runtime): withhold and assert the expected error noise in two passing pins

[os-elon]

Fixes#10380

Two passing @objectstack/runtime tests printed ERROR-shaped lines into the shared Test Core log, where turbo interleaves package output without attribution. They were lifted verbatim into a p1 flake signature and cost a full dispatch cycle aimed at the wrong mechanism. This withholds that output — and asserts it, so the pins get stronger, not quieter.

Not a mute — the hazard this is built against

Silencing console output is one step from swallowing a real error: a naive capture makes the log quiet and the test blind, and a live pin becomes a decoration. Every sink here does two things instead of one.

• Scoped to the expected fault only. Each predicate names both the table and the reason. The ambient pin withholds a refusal only when it names sys_metadataand carries knex's Timeout acquiring a connection; the conformance suite withholds one only when the envelope and the dialect detail name the same absent table (no such table: X). Any other table, any other reason, any other driver, any other logger method — forwarded to the console untouched.
• Counted and asserted. BARE asserts all three channels fired; AMBIENT asserts that none did, which is a new false-negative guard in its own right — an ambient read that silently started stalling would otherwise have had its evidence swallowed by the sinks installed for the bare case. The conformance suite asserts in afterAll that each of the five per-request authz reads still failed.
• The engine frame is gated on the driver refusal. An engine error is withheld only when it sits directly above a driver refusal the capture already recognised. A DATABASE_ERROR on one of those tables from any other cause is not recognised by the driver sink, so its frame is not withheld either — it reaches the log with both halves intact.

⛔ The #7842 pin's assertions are untouched. No expect was edited, none relaxed, no threshold moved, nothing skipped or retry-wrapped. The added assertions are additions only.

Three channels, not the two the card named

The card named Acquire connection error and refused a read on. Re-deriving both paths at head found a third emitter on the same fault in the same two files: the engine's ERROR Find operation failed frame (objectql/src/engine.ts), which carries the same error as a full stack. It is the loudest of the three and the only one that bypasses the reporter, so quieting only the two named features would have left the worst line in place. Named here rather than folded in silently.

channel	emitter	how it is scoped
Acquire connection error	knex Logger.warn → console.log	knex log.warn via the driver config; debug/error/deprecate keep their defaults
refused a read on	SqlDriver.backendStatementFault → console.warn	the logger field's own documented "tests inject a spy" idiom, mirroring the default { warn, error } shape
Find operation failed	ObjectQL engine logger → raw stdout	a Proxy on error alone, the idiom engine-readonly-when-parent.test.ts established

Measured, not asserted

Counts are matching log lines per suite, taken with --reporter=default. That flag is load-bearing: vitest 4 picks MinimalReporter when stdout is not a TTY and it defaults to silent: 'passed-only', so a piped local run drops console.* from passing tests entirely — while turbo gives CI's task a pty and prints every line. Measuring without it yields a false zero in both directions. Filed as part of #10629.

suite	Acquire connection error	refused a read on	Find operation failed	log lines
metadata-list-ambient-vs-bare-transaction before	1	1	1	45
metadata-list-ambient-vs-bare-transaction after	0	0	0	33
notification-schema-conformance before	0	63	63	380
notification-schema-conformance after	0	0	0	128

The second leg: the assertions fail when the expected error is prevented

A green run alone is uninformative — it cannot tell a pin from a mute. Both were ablated.

Conformance suite — tryFind short-circuited for the six tables, so the expected reads never fail. @objectstack/core is aliased to source in this package's vitest config, so the mutation took effect without a rebuild, demonstrated by the verdict changing:

AssertionError: the expected 'sys_user' read failure was never emitted — resolveUserAuthzGrants
no longer reads it, or it no longer fails, and this capture has stopped measuring it
Test Files 1 failed (1)
Tests 8 passed (8)

All eight conformance tests still pass. Nothing but the new assertion notices — which is exactly the blindness the card was written against.

Ambient pin — the this.logger.warn call dropped from SqlDriver.backendStatementFault, so the fault still occurs but one channel goes silent. @objectstack/driver-sql resolves through dist here, so this leg was rebuilt and proven to reach the artifact both ways (scripts/ablation-dist-preflight.mjs, marker present after the mutation, absent after restore — the first marker spelling was tree-shaken into the sourcemaps only and the preflight correctly voided that run):

× BARE — ... the loader read stalls out connection acquisition
AssertionError: the driver's read refusal for 'sys_metadata' was never emitted: expected 0 to be greater than 0
Test Files 1 failed (1)
Tests 1 failed | 1 passed (2)

Every original pin assertion passed; only the new one failed.

Verification at 2779695860

Gate set re-derived with node scripts/pm/dispatch-gates.mjs (no path arguments) after the final commit; every family it named was run, each verdict line quoted.

• pnpm --filter @objectstack/runtime exec vitest run — Test Files 178 passed (178) · Tests 2670 passed (2670)
• pnpm --filter @objectstack/runtime typecheck — tsc --noEmit, exit 0
• check-cross-package-test-inputs — OK: 12 package(s) read outside themselves, all declared
• check-affected-docs — exit 0
• check:query-options-erasure — ✓ query-options-erasure ratchet holds: 67 unswept non-test site(s) ... none new
• check:engine-double-contract — OK — 350 pinned, 133 in the DEBT ledger, 2 exempt
• check:where-matcher — ✓ where-matcher conformance holds: 271 matcher(s) discovered ... none new
• check:nul-bytes — OK (scanned 6203 text file(s) ... no raw ASCII control bytes)
• check:type-check-coverage — OK — 64/77 workspace packages type-checked
• check:type-check-debt — ✓ ... OK — 33 ledger entr(ies) re-measured in 237.1s, 1924 raw tsc error(s) total, none above its recorded number

check:type-check-debt first refused (exit 1, not measured) on an unbuilt worktree; re-run after turbo run build --filter='./packages/*' --filter='./packages/*/*', which is the verdict quoted.

skip-changeset

Test-only. Two *.test.ts files, no production source touched, nothing published changes and no request is answered differently.

Out of scope, filed not fixed

• [finding] 15 more PASSING @objectstack/runtime tests print the same refused a read on feature — 134 lines after #10380 quiets its two, led by notifications.hono.integration.test.ts (52) #10629 — 15 other passing @objectstack/runtime tests print the same refused a read on feature (134 lines, led by notifications.hono.integration.test.ts at 52). Same defect class, different file surface than this card claims.

#10293 is deliberately not addressed here — this removes the cause of that misreading; re-grading it is not this card's.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.