test(plugin-security): main's delegated-membership, update-seam and every-row-master fixtures meet a NOT NULL tenant column

Their organization-less permission-set (and, for the update seam, position) catalogue rows are legacy residue, so each suite relaxes only those tables to the pre-18 shape. No assertion changed.

Claude-Session: https://claude.ai/code/session_018EszgtA3V2KXBX5tf59Hi4
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/controlled-by-parent-every-row-master.test.ts

@@ -61,6 +61,7 @@ import { SysUserPosition } from './objects/sys-user-position.object.js';
 import { SysUserPermissionSet } from './objects/sys-user-permission-set.object.js';
 import { SecurityPlugin } from './security-plugin.js';
 import { defaultPermissionSets } from './objects/default-permission-sets.js';
+import { relaxTenantColumns } from './pre-18-tenant-column.testkit.js';
 
 const SYS = { context: { isSystem: true } } as never;
 const ORG = 'org_cbp_erm';
@@ -164,6 +165,10 @@ async function boot() {
     ],
   } as never);
   await engine.syncSchemas();
+  // The organization-less permission-set catalogue row below exists only on a
+  // store built before 18.x (ADR-0131 D1 makes a fresh tenant column NOT
+  // NULL): that table is this store's.
+  await relaxTenantColumns(engine as never, ['sys_permission_set']);
 
   const e = engine as unknown as {
     insert: (o: string, row: Record<string, unknown>, opts: never) => Promise<unknown>;

packages/plugins/plugin-security/src/delegated-organization-membership.test.ts

@@ -50,6 +50,7 @@ import { SysOrganization, SysUser, SysMember } from '@objectstack/platform-objec
 import { SysPosition, SysPermissionSet, SysPositionPermissionSet } from './__tests__/legacy-catalog-objects.testkit.js';
 import { SysUserPosition } from './objects/sys-user-position.object.js';
 import { SysUserPermissionSet } from './objects/sys-user-permission-set.object.js';
+import { relaxTenantColumns } from './pre-18-tenant-column.testkit.js';
 
 const ORG_A = 'org_a';
 const ORG_C = 'org_c';
@@ -134,6 +135,10 @@ async function boot(posture: Posture) {
     ],
   } as never);
   await engine.syncSchemas();
+  // The organization-less permission-set catalogue row below exists only on a
+  // store built before 18.x (ADR-0131 D1 makes a fresh tenant column NOT
+  // NULL): that table is this store's.
+  await relaxTenantColumns(engine as never, ['sys_permission_set']);
   engines.push(engine);
 
   for (const id of [ORG_A, ORG_C, ORG_D]) {

packages/plugins/plugin-security/src/update-seam-judges-organization.test.ts

@@ -50,6 +50,7 @@ import { SysOrganization, SysUser, SysMember } from '@objectstack/platform-objec
 import { SysPosition, SysPermissionSet, SysPositionPermissionSet } from './__tests__/legacy-catalog-objects.testkit.js';
 import { SysUserPosition } from './objects/sys-user-position.object.js';
 import { SysUserPermissionSet } from './objects/sys-user-permission-set.object.js';
+import { relaxTenantColumns } from './pre-18-tenant-column.testkit.js';
 
 const OWN_ORG = 'org_a';
 const SISTER_ORG = 'org_c';
@@ -145,6 +146,10 @@ async function boot(posture: Posture) {
     ],
   } as never);
   await engine.syncSchemas();
+  // The organization-less permission-set and position catalogue rows below
+  // exist only on a store built before 18.x (ADR-0131 D1 makes a fresh tenant
+  // column NOT NULL): those tables are this store's.
+  await relaxTenantColumns(engine as never, ['sys_permission_set', 'sys_position']);
   engines.push(engine);
 
   for (const id of [OWN_ORG, SISTER_ORG, FOREIGN_ORG]) {