test(plugin-security): retire the declared-permission seeder suites (#15204 stage 6b-2, T1)

[objectstack-fleet]

Part of #15204
Clause-②: no

T1 of stage 6b-2: tests only. It deletes the suites that pin the declared-permission seeder, drift, the managed_by normalizer and the seed-refusal diagnostics, and trims the cases in shared suites that pin them. It is split off the 6b-2 code PR (#22900) so that PR falls under 3,000 changed lines (the ruling: tests land inside or before their code PR). No production file changes. The modules these suites pinned are deleted by #22900.

Landing, as sequenced by the seat: T1, T2 and the 6b-2 code PR (#22900) stay drafts until #22900's own gates clear (the #22865 pickers and objectui PR-4), then land back to back, T1 → T2 → #22900. That way the publish materializer and the seeders are never live on main with their pins gone. 6b-2a (#22899) is independent and goes to the maintainer separately.

Deleted (whole files)

• bootstrap-declared-permissions.test.ts
• walled-platform-bucket-diagnostic.test.ts
• permission-set-drift.test.ts
• bootstrap-seed-round-trips.test.ts
• declared-permission-reload-projection.test.ts
• normalize-managed-by.test.ts

Trimmed (only the cases that pin a deleted module)

• per-organization-catalog.test.ts: case 6 (resolver bleed) is kept.
• permission-set-name-collision.test.ts: the shared-derivation describe is kept.
• read-fault-distinguishability.test.ts: reading 1 goes.
• engine-find-bare-array.pin.test.ts: blocks 3 and 6 go.
• seed-name-lookup-degradation-audible.test.ts: the lit control reports through seed-refusal-sink directly, not through the retiring diagnostics module.
• builtin-capabilities.boot.test.ts: the platform-name-refusal constant goes.
• objects/rbac-objects.test.ts: the drift_status pin goes (the field leaves in 6b-2).

Re-pinned here

The #11451 fence (a caller that passes no predicate emits only the where key name) rode bootstrap-seed-round-trips.test.ts, but the behaviour it pins outlives the seeder: permission-set-projection.ts' overlay pass calls buildExistingByName with no predicate. It is now pinned at the function in seed-name-lookup-degradation-audible.test.ts, on both the batched read and the per-item degradation read, with a predicate-carrying positive control. Ablation: making both reads spread { managed_by: undefined } turned both fences red ("expected [ 'name', 'managed_by' ] to deeply equal [ 'name' ]"), the control stayed green, and restoring the file (same sha) brought 8/8 back.

Gate ledgers

The double-contract ledgers (engine-double-contract.{baseline,pinned}.json, objectql-double-limit.baseline.json) drop the deleted suites' entries.

Size

16 files, +86 / −2,749 (2,835 changed lines).

Verification

On this branch: check:engine-double-contract and check:objectql-double-limit green. The 7 trimmed suites: 7 files, 60 passed; with the new fence, seed-name-lookup-degradation-audible is 8 passed. check:where-matcher green. plugin-security typecheck green. check:adr-0087-registration, check:changeset-no-major, check:cli-command-ids, check:nul-bytes green. Not covered after this PR: no retained test imports bootstrap-declared-permissions, permission-set-drift, normalize-managed-by or seed-refusal-diagnostics. Only the boot-level suites exercise them in passing. They run unpinned until #22900 removes them, which is why the seat lands this PR directly before #22900.

Merge note: this PR and #22899 delete adjacent entries in scripts/engine-double-contract.baseline.json and scripts/objectql-double-limit.baseline.json, so whichever lands second meets a textual conflict there. The resolution is to drop both entries.

Test-only: skip-changeset.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_013XKtmoR5QCUSTMjiQ3os49

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 63739521d854d49dbb08dbc5370c99fde8a7555c → packageMentionDocs.