test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T)

[objectstack-fleet]

Clause-②: no

Part of #15204 (C3 stage 8, the test half: S8-T). The code half (S8, branch claude/issue-15204-s8-catalog-objects) opens after #22900 (D) is on main; this PR lands after D and just before S8. #15204 remains open.

What this changes

Test files only. Every edit keeps the suite green on today's main and on main + D + S8, where the four security-catalog row objects (sys_position, sys_permission_set, sys_position_permission_set, sys_capability) are no longer registered (ADR-0131 D3).

• A testkit for the retired tables. plugin-security/src/__tests__/legacy-catalog-objects.testkit.ts holds the four tables' shapes (fields, indexes, validations only), for suites that model an existing database whose rows outlive the object declarations until the organization-ownership migration (ADR-0131 D10). 42 suites point their imports at it instead of ./objects/sys-*.object.js. withLegacyCatalogTables() adds the shapes a plugin no longer declares.
• Deleted, because they pin what S8 removes: the object-declaration pins (sys-*.organization-unique, sys-capability-deactivation-claim, clone-carryover, the junction/position cases of rbac-objects, reserved-identity-names, managed-by-system-data, sys-security-assignment-display-title, rbac-objects-bulk-exposure), position-write-through.test.ts (S8 unwires that middleware; 7b deletes the module), bootstrap-platform-admin-refused-existence-read.test.ts (the legacy-row read S8 removes), row-active.test.ts (S8 deletes isRowActive), pin 6 of packaged-permission-set-lock.test.ts (the retired object's clone action), and the dogfood files for the data-door write-throughs, the projection, the row lock and the junction gates: two-doors-permission, declared-position-provenance, permission-set-lock-row-provenance, permission-set-write-through-package-binding, showcase-permission-projection, position-environment-write-through, position-held-name-setup-create.
• Fixtures moved off the rows: dogfood suites that authored a permission set through POST /api/v1/data/sys_permission_set now use PUT /api/v1/meta/permission/:name (or protocol.saveMetaItem); checks that a set "was seeded" read the engine registry; vestigial sys_position row inserts are gone; censuses of a retired table answer "no rows" when the object is not registered.
• Pins made to span the change: the clone-route refusal prose (POST /api/v1/data/sys_permission_set → the catalog's clone door) is pinned around the route; the uninstall-cleanup runner request may carry declared; page/registry floors drop by the retired page and the four names; the tenancy-inventory and dangling-reference fixtures use surviving security tables; cleanup-package-permissions.test.ts passes the package's declared set names and asserts what holds both ways (grants naming the sets revoked, suggestion rows removed).
• New pins:
  • bootstrap-platform-admin-fresh-boot.golden.test.ts — a fresh single-posture engine holding only the plugin's own objects promotes its first human (E6's first pin). Ablation on the integration tree: with D's bootstrap-platform-admin.ts (the legacy-row read) put back, both cases go red (adminPromoted: false); restored, green; git diff HEAD empty after restore. E6's second pin (an unnamed legacy admin grant mints no second administrator) is the existing grant-readers-unnamed-grant.test.ts case, green on both sides.
  • permission-metadata-door-reaches-catalog.dogfood.test.ts — a create, an edit and a delete through /api/v1/meta/permission each reach the security catalog the resolver reads, and a grant naming the set is accepted exactly while the catalog holds it. Green on main (projector wired) and on main + D + S8 (projector unwired): the premise E1 → A rested on.

After D lands

D rewrites several of the same files, so this branch takes a main merge before it lands. The resolutions were made and run on a local integration tree (main + D + this PR + S8): take this PR's deletions over D's edits; in activity-text-predicate, approval-snapshot-masked-field, sharing-rule-org-less-caller and showcase-crud-persona-matrix keep D's catalogPermissionSet reads; in showcase-fls-read-mask-strip and showcase-permission-zoo take this PR's side; delete ensureLegacyPermissionSetRow from D's catalog-permission-set.ts (no caller left); guard the row census in D's showcase-permission-seeding with getObject('sys_permission_set').

Verification

• On main (eab7236ff7), this branch alone: every touched or added test file, 71 files in 11 packages, green (plugin-security 44 files / 752 tests, dogfood 13 / 146, metadata-protocol 3 / 89, objectql 2 / 58, cli unit 2 / 35, others 1 file each). Typecheck of the touched packages green.
• On main + D (fcaedfdaa1) + this PR + S8: plugin-security full suite, the dogfood suite in full, and the suites of core, spec, lint, metadata-protocol, cloud-connection, objectql, plugin-sharing, platform-objects, service-settings, plugin-auth, rest, runtime, verify, organizations, plugin-approvals, plugin-hono-server, client, example-showcase, example-crm and cli (unit) — see the report on refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 for the numbers.
• Size: 88 files, +1,122 / −3,946 = 5,068 changed lines — over the 3,000 line, almost all deletion; see the report on refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204.

skip-changeset: only test files, a test-only testkit under src/__tests__ (no entry imports it; files ships dist only) and the private dogfood package change.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 02bec6ca86e9f1237a3f82a9efff9cb3a53562ef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from aae5d625ae4506d9877e33bb05d94f5080d5e1a7 — the merge of head d426f922eda9787b28bea0274138bb3fecb84ef0 into base 02bec6ca86e9f1237a3f82a9efff9cb3a53562ef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin aae5d625ae4506d9877e33bb05d94f5080d5e1a7 && git checkout aae5d625ae4506d9877e33bb05d94f5080d5e1a7
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 02bec6ca86e9f1237a3f82a9efff9cb3a53562ef d426f922eda9787b28bea0274138bb3fecb84ef0 && git checkout -B drift-repro 02bec6ca86e9f1237a3f82a9efff9cb3a53562ef && git merge --no-ff d426f922eda9787b28bea0274138bb3fecb84ef0

node scripts/docs-audit/affected-docs.mjs --json 02bec6ca86e9f1237a3f82a9efff9cb3a53562ef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.