test(plugin-security): retire the declared-permission seeder suites (#15204 stage 6b-2, T1)

[objectstack-fleet]

Part of #15204
Clause-②: no

T1 of stage 6b-2: tests only. It deletes the suites that pin the declared-permission seeder, drift, the managed_by normalizer and the seed-refusal diagnostics, and trims the cases in shared suites that pin them. It is split off the 6b-2 code PR (#22900) so that PR falls under 3,000 changed lines (the ruling: tests land inside or before their code PR). No production file changes. The modules these suites pinned are deleted by #22900.

Landing, as sequenced by the seat: T1, T2 and the 6b-2 code PR (#22900) stay drafts until #22900's own gates clear (the #22865 pickers and objectui PR-4), then land back to back, T1 → T2 → #22900. That way the publish materializer and the seeders are never live on main with their pins gone. 6b-2a (#22899) is independent and goes to the maintainer separately.

Deleted (whole files)

• bootstrap-declared-permissions.test.ts
• walled-platform-bucket-diagnostic.test.ts
• permission-set-drift.test.ts
• bootstrap-seed-round-trips.test.ts
• declared-permission-reload-projection.test.ts
• normalize-managed-by.test.ts

Trimmed (only the cases that pin a deleted module)

• per-organization-catalog.test.ts: case 6 (resolver bleed) is kept.
• permission-set-name-collision.test.ts: the shared-derivation describe is kept.
• read-fault-distinguishability.test.ts: reading 1 goes.
• engine-find-bare-array.pin.test.ts: blocks 3 and 6 go.
• seed-name-lookup-degradation-audible.test.ts: the lit control reports through seed-refusal-sink directly, not through the retiring diagnostics module.
• builtin-capabilities.boot.test.ts: the platform-name-refusal constant goes.
• objects/rbac-objects.test.ts: the drift_status pin goes (the field leaves in 6b-2).

Re-pinned here

The #11451 fence (a caller that passes no predicate emits only the where key name) rode bootstrap-seed-round-trips.test.ts, but the behaviour it pins outlives the seeder: permission-set-projection.ts' overlay pass calls buildExistingByName with no predicate. It is now pinned at the function in seed-name-lookup-degradation-audible.test.ts, on both the batched read and the per-item degradation read, with a predicate-carrying positive control. Ablation: making both reads spread { managed_by: undefined } turned both fences red ("expected [ 'name', 'managed_by' ] to deeply equal [ 'name' ]"), the control stayed green, and restoring the file (same sha) brought 8/8 back.

Gate ledgers

The double-contract ledgers (engine-double-contract.{baseline,pinned}.json, objectql-double-limit.baseline.json) drop the deleted suites' entries.

Size

16 files, +86 / −2,749 (2,835 changed lines).

Verification

On this branch: check:engine-double-contract and check:objectql-double-limit green. The 7 trimmed suites: 7 files, 60 passed; with the new fence, seed-name-lookup-degradation-audible is 8 passed. check:where-matcher green. plugin-security typecheck green. check:adr-0087-registration, check:changeset-no-major, check:cli-command-ids, check:nul-bytes green. Not covered after this PR: no retained test imports bootstrap-declared-permissions, permission-set-drift, normalize-managed-by or seed-refusal-diagnostics. Only the boot-level suites exercise them in passing. They run unpinned until #22900 removes them, which is why the seat lands this PR directly before #22900.

Merge note: this PR and #22899 delete adjacent entries in scripts/engine-double-contract.baseline.json and scripts/objectql-double-limit.baseline.json, so whichever lands second meets a textual conflict there. The resolution is to drop both entries.

Test-only: skip-changeset.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_013XKtmoR5QCUSTMjiQ3os49

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d0f1c5bfb97757274fb3cb85d05dfd875cdc522f → packageMentionDocs.

[objectstack-fleet]

Seat ACCEPT: PR #22897 (stage 6b-2 T1, retire the declared-permission seeder suites) at a1f618ce01; queued on green, first of T1 → T2 → D

Epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian), seat epic:#15194, 2026-10-12T22:06Z. Cloud dev session_013XKtmoR5QCUSTMjiQ3os49.

Why it lands now: D (#22900) is approved by os-zhuang (review 5496211171, on 320ce20b74), so the three PRs land back to back. Order and rationale are in the seat note 6114241228, and the 6b-2 split is 6114116727.

Checklist:

• PR form: base main; Part of #15204, then Clause-②: no; no closing keyword; assignee marchtian. Tests and gate ledgers only; no production file. No CHANGELOG.md, no content/docs/releases/.
• The seat's read-only audit (6114241228): every removed case pins a symbol or behaviour that D deletes. The one surviving-behaviour fence (bootstrapSystemCapabilities still reads sys_capability one name at a time — and it, not the declared seeder, is the loop whose size is the union of every systemPermissions string #11451, buildExistingByName's where key set) is re-pinned in seed-name-lookup-degradation-audible.test.ts, with a control that carries the predicate. D's full contract review 6128268740 ①(i) confirms this.
• T1's bytes in D: 13 of T1's 16 files are blob-identical at D's head. The other 3 are the two baseline ledgers (the union of T1's and T2's removals) and engine-double-contract.pinned.json (D's own 10 new lines). See 6128268740 ①(h).
• The re-merge: main merged at a1f618ce01 (a merge commit of origin/main 1badd31838 into bb7b4cef36; no conflict; no rebase or force push). Of T1's 16 files, 15 are blob-identical to bb7b4cef36. The 16th, scripts/engine-double-contract.pinned.json, gains exactly main's own 15 lines: its delta equals main's delta for that file, line for line. T1 against main is still 16 files, +86 / −2,749, unchanged. git merge-tree with today's main (d0f1c5bfb9) is clean.
• CI on a1f618ce01: running at the time of this record; auto-merge enqueues only on green. The developer's local runs at this head: plugin-security typecheck 0; its suite 192 files, 3,972 passed; dispatch-gates 62/62, 0 non-zero.

Then:

• pr_ready and automerge_enable in this stroke.
• On MERGED: a Landed record on refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204. T2 then merges main (which now carries T1) and follows. D comes last.

---

Generated by Claude Code