test(plugin-security): retire the declared-permission seeder suites (#15204 stage 6b-2, T1)

packages/plugins/plugin-security/src/builtin-capabilities.boot.test.ts

@@ -44,7 +44,6 @@ import { SysUser, SysAccount, SysMember, SysOrganization } from '@objectstack/pl
 import { SecurityPlugin } from './security-plugin.js';
 import { securityObjects, SECURITY_PLUGIN_ID } from './manifest.js';
 import { defaultPermissionSets } from './objects/default-permission-sets.js';
-import { CAPABILITY_PLATFORM_NAME_REFUSED } from './seed-refusal-diagnostics.js';
 
 const SYS = { isSystem: true } as const;
 const POSTURE_ENV = 'OS_TENANCY_POSTURE';
@@ -255,7 +254,6 @@ describe.each(SCENARIOS)('a $posture boot, the stack capability $declared', ({ p
 
   it('no capability seeder refuses or reports the platform’s own declarations', () => {
     for (const booted of [fresh, reseeded]) {
-      expect(booted.warnings.filter((w) => w.includes(CAPABILITY_PLATFORM_NAME_REFUSED))).toEqual([]);
       expect(booted.warnings.filter((w) => w.includes('capabilit'))).toEqual([]);
     }
   });

packages/plugins/plugin-security/src/engine-find-bare-array.pin.test.ts

@@ -17,16 +17,18 @@
  * Every seam answered `[object Array]`, with no own `records` key, on a
  * populated page and an empty one alike.
  *
- * ⚠️ These are six pins, not one pin repeated. A single reading of "the engine
+ * ⚠️ These are four pins, not one pin repeated. A single reading of "the engine
  * returns an array" would say nothing about whether a given seam is even
- * reachable — six of them sit behind a trigger (a truncated page, a refused
- * bulk write, a publish-materializer call path), and a seam nothing reaches is
+ * reachable — some of them sit behind a trigger (a truncated page, a refused
+ * bulk write), and a seam nothing reaches is
  * precisely how a dead limb survives review. So each case DRIVES its own block
  * through the real function and asserts the answer that block produced, and
  * {@link assertBareArrayPage} then reads back the value the engine handed it.
  *
- * The seventh seam, `security-plugin.ts`'s `sys_permission_set` loader, is
- * gone: the plugin takes a set's body from the security catalog
+ * Blocks 3 and 6 (the declared-permission seeder's per-name read and the
+ * `managed_by` normalizer's scan) retired with their modules (ADR-0131 D3:
+ * the boot writes no catalog row). The seventh seam, `security-plugin.ts`'s
+ * `sys_permission_set` loader, is gone too: the plugin takes a set's body from the security catalog
  * (ADR-0131 D3/D4) and reads no `sys_permission_set` row, so it has no
  * engine page to pin. Its fault direction (a read that did not answer
  * propagates, and `PermissionEvaluator`'s #2565 warn fires) is pinned on the
@@ -51,10 +53,8 @@ import {
 } from '@objectstack/metadata-core';
 
 import { buildExistingByName } from './seed-name-lookup.js';
-import { upsertPackagePermissionSet } from './bootstrap-declared-permissions.js';
 import { reconcileOrgAdminGrant } from './auto-org-admin-grant.js';
 import { claimSeedOwnership } from './claim-seed-ownership.js';
-import { normalizeManagedByVocab } from './normalize-managed-by.js';
 
 const SYS = { context: { isSystem: true } } as any;
 const ORG = 'org_a';
@@ -243,29 +243,6 @@ describe('[#15598] block 2 — seed-name-lookup perItemIndex (the DEGRADATION re
   }, 120_000);
 });
 
-describe('[#15598] block 3 — bootstrap-declared-permissions defaultLookup', () => {
-  it('answers from one bare array on the publish-materializer path', async () => {
-    const engine = await boot();
-    const seen: Seen = [];
-
-    // No `existingByName` — the ADR-0086 P2 publish materializer path, which is
-    // the only caller that reaches `defaultLookup`'s own read.
-    const outcome = await upsertPackagePermissionSet(
-      observed(engine, seen),
-      { name: 'ps_published', label: 'Published', objects: {} } as any,
-      'com.acme.crm',
-      undefined,
-      {} as any,
-    );
-
-    assertBareArrayPage(seen, 'defaultLookup');
-    // `unreadable` is what a seam that cannot read its page reports, and it is
-    // one-hot with `seeded` — so this pair is the discriminator.
-    expect(outcome.unreadable).toBe(0);
-    expect(outcome.seeded).toBe(1);
-  }, 120_000);
-});
-
 describe('[#15598] block 4 — auto-org-admin-grant tryFind', () => {
   it('reads the set and the membership out of bare arrays, and grants on them', async () => {
     const engine = await boot();
@@ -321,19 +298,3 @@ describe('[#15598] block 5 — claim-seed-ownership idsFrom (the PAGING fallback
     expect(rows[0].owner_id).toBe(ADMIN);
   }, 120_000);
 });
-
-describe('[#15598] block 6 — normalize-managed-by tryFind', () => {
-  it('reads the legacy rows out of one bare array and rewrites them', async () => {
-    const engine = await boot();
-    await (engine as any).insert('sys_position', { name: 'pos_legacy', label: 'Legacy', managed_by: 'system' }, SYS);
-    const seen: Seen = [];
-
-    const counts = await normalizeManagedByVocab(observed(engine, seen), {});
-
-    assertBareArrayPage(seen, 'normalize-managed-by tryFind');
-    // The rewrite happened, which it cannot if the scan read nothing.
-    expect(counts.positions).toBe(1);
-    const rows = await (engine as any).find('sys_position', { where: { name: 'pos_legacy' } }, SYS);
-    expect(rows[0].managed_by).toBe('platform');
-  }, 120_000);
-});

packages/plugins/plugin-security/src/objects/rbac-objects.test.ts

@@ -208,20 +208,6 @@ describe('RBAC object canonical names + row actions', () => {
     ]);
   });
 
-  it('[field report — rc→GA declared≠enforced surfacing] SysPermissionSet.drift_status is a select naming the two detected causes, and appears in the "Needs Attention" list view', () => {
-    const f: any = (SysPermissionSet.fields as any).drift_status;
-    expect(f, 'drift_status field exists').toBeDefined();
-    expect(f.type).toBe('select');
-    expect(f.readonly).toBe(true);
-    const opts = (f.options ?? []).map((o: any) => o.value).sort();
-    expect(opts).toEqual(['other', 'overlay_shadow', 'provenance_skip']);
-
-    const views: any = SysPermissionSet.listViews;
-    expect(views.drifted, 'drifted list view exists').toBeDefined();
-    expect(views.drifted.columns).toContain('drift_status');
-    expect(views.all_permsets.columns).toContain('drift_status');
-  });
-
   it('[A4 #2920] SysPermissionSet.managed_by is a select on the unified platform/package/admin vocab', () => {
     const f: any = (SysPermissionSet.fields as any).managed_by;
     expect(f, 'managed_by field exists').toBeDefined();