fix(drive): correct integration test

src/application/services/subject_group_service.rs

@@ -563,7 +563,15 @@ mod integration_tests {
         let pool = Arc::new(pool);
         let repo = Arc::new(SubjectGroupPgRepository::new(pool.clone()));
         let user_storage = Arc::new(UserPgRepository::new(pool.clone()));
-        SubjectGroupService::new(repo, pool, user_storage)
+        // The engine is wired so `add_member` / `remove_member` can invalidate
+        // their stale `user_groups_cache` entries (the production path).
+        // A stub engine is enough — these tests never trigger an authz SQL
+        // round-trip, only the in-memory cache invalidation calls. The stub's
+        // lazy invalid pool would panic if reached, surfacing any drift if a
+        // future test starts exercising real authz lookups.
+        let engine =
+            Arc::new(crate::infrastructure::services::pg_acl_engine::PgAclEngine::new_stub());
+        SubjectGroupService::new(repo, pool, user_storage, engine)
     }
 
     async fn first_admin(pool: &sqlx::PgPool) -> Uuid {

src/infrastructure/repositories/pg/file_blob_read_repository.rs

@@ -345,7 +345,11 @@ impl FileBlobReadRepository {
     }
 
     /// Creates a stub instance for testing — never hits PG.
-    #[cfg(test)]
+    /// Available in both standard unit-test (`cfg(test)`) and integration
+    /// (`cfg(integration_tests)`) builds; `PgAclEngine::new_stub` chains
+    /// into this stub and is needed from the integration-test module of
+    /// `subject_group_service`.
+    #[cfg(any(test, integration_tests))]
     pub fn new_stub() -> Self {
         use crate::infrastructure::services::dedup_service::DedupService;
         Self {

src/infrastructure/services/dedup_service.rs

@@ -291,7 +291,13 @@ impl DedupService {
     }
 
     /// Creates a stub instance for testing — never hits PG or the filesystem.
-    #[cfg(any(test, feature = "integration_tests"))]
+    ///
+    /// Gated for both build modes integration tests are reachable from:
+    /// the raw `cfg(integration_tests)` flag used by CI / justfile
+    /// (`RUSTFLAGS='--cfg integration_tests'`) and the
+    /// `feature = "integration_tests"` form for callers that flip the
+    /// cargo feature instead. Standard `cfg(test)` keeps unit-test use.
+    #[cfg(any(test, integration_tests, feature = "integration_tests"))]
     pub fn new_stub() -> Self {
         use crate::infrastructure::services::local_blob_backend::LocalBlobBackend;
         let stub_pool = Arc::new(

src/infrastructure/services/pg_acl_engine.rs

@@ -201,7 +201,13 @@ impl PgAclEngine {
     /// without a real PostgreSQL pool. Connecting to the lazy pool will
     /// fail at runtime — only safe in tests that exercise types, not actual
     /// authz queries.
-    #[cfg(test)]
+    ///
+    /// Visible under both `cfg(test)` (the standard unit-test build) and
+    /// `cfg(integration_tests)` (the gated-by-RUSTFLAGS integration
+    /// build). The `SubjectGroupService` integration tests construct the
+    /// service with a stub engine, since they only exercise the engine's
+    /// in-memory cache invalidation calls — never its SQL paths.
+    #[cfg(any(test, integration_tests))]
     pub fn new_stub() -> Self {
         let pool = sqlx::pool::PoolOptions::<sqlx::Postgres>::new()
             .max_connections(1)