test: pin sys_user's one default on every user-context producer, and the baseline unchanged on the real declarations

- service-automation: a booted stack with no baseline and one authored
  '*' read set reads sys_user under its declared default on a request, a
  runAs:'user' flow run and a runAs:'user' hook fired from a hand-built
  system context: its own row plus the acting organisation's members, and
  exactly the rows the two shipped literals admit on that same context.
  On the same composition, plugin-auth's sys_sso_provider extension (the
  one shipped extend of a platform object) still registers, and an extend
  that sets defaultRowScope is refused by name.
- plugin-security: with the shipped baseline, every persona (member,
  viewer, organization admin, a user in no organisation, the platform
  admin, and an MCP agent for each of three delegators) reads all 23
  declarers exactly as without the declarations; the census names where
  a default is now collected: on the agent ceilings' legs only.
- The declarations' comments now say the collection applies the key.

Claude-Session: https://claude.ai/code/session_01FatVyDAFEST48jZDQcbheU
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/platform-objects/src/identity/sys-account.object.ts

@@ -114,14 +114,14 @@ export const SysAccount = ObjectSchema.create({
     },
   },
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_account_self',
     operation: 'select',

packages/platform-objects/src/identity/sys-api-key.object.ts

@@ -227,14 +227,14 @@ export const SysApiKey = ObjectSchema.create({
     },
   },
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_api_key_self',
     operation: 'all',

packages/platform-objects/src/identity/sys-device-code.object.ts

@@ -51,14 +51,14 @@ export const SysDeviceCode = ObjectSchema.create({
   titleFormat: '{user_code}',
   highlightFields: ['user_code', 'status', 'client_id', 'expires_at'],
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_device_code_self',
     operation: 'all',

packages/platform-objects/src/identity/sys-jwks.object.ts

@@ -39,13 +39,13 @@ export const SysJwks = ObjectSchema.create({
   description: 'Asymmetric key pairs used to sign and verify issued JWTs',
   highlightFields: ['id', 'created_at', 'expires_at'],
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (`privateCredentialRowScope` in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today
+  // (`privateCredentialRowScope` in `default-permission-sets.ts`), moved here verbatim.
+  // Layer 0 is inert on this table (no organization column), so Layer 1 silence means
+  // this scope, not no filter. The security plugin's row-policy collection applies it
+  // when no set the caller holds carries a row policy for the object and operation; the
+  // shipped sets still carry it, so their holders read as before. An `extend`
   // contribution cannot set or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_jwks_none',

packages/platform-objects/src/identity/sys-oauth-access-token.object.ts

@@ -38,14 +38,14 @@ export const SysOauthAccessToken = ObjectSchema.create({
   description: 'Opaque OAuth access tokens issued to client applications',
   highlightFields: ['client_id', 'user_id', 'expires_at'],
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_oauth_access_token_self',
     operation: 'select',

packages/platform-objects/src/identity/sys-oauth-application.object.ts

@@ -284,14 +284,14 @@ export const SysOauthApplication = ObjectSchema.create({
     },
   },
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_oauth_application_self',
     operation: 'all',

packages/platform-objects/src/identity/sys-oauth-consent.object.ts

@@ -34,14 +34,14 @@ export const SysOauthConsent = ObjectSchema.create({
   description: 'User consent records for OAuth client applications',
   highlightFields: ['client_id', 'user_id', 'scopes'],
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_oauth_consent_self',
     operation: 'all',

packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts

@@ -37,14 +37,14 @@ export const SysOauthRefreshToken = ObjectSchema.create({
   description: 'Opaque OAuth refresh tokens (linked to a session)',
   highlightFields: ['client_id', 'user_id', 'expires_at'],
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_oauth_refresh_token_self',
     operation: 'select',

packages/platform-objects/src/identity/sys-organization.object.ts

@@ -299,14 +299,14 @@ export const SysOrganization = ObjectSchema.create({
     },
   },
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (the `_self` carve-outs in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
-  // contribution cannot set or loosen it (refused at registration).
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today (the `_self`
+  // carve-outs in `default-permission-sets.ts`), moved here verbatim. Layer 0 is inert
+  // on this table (no organization column), so Layer 1 silence means this scope, not no
+  // filter. The security plugin's row-policy collection applies it when no set the
+  // caller holds carries a row policy for the object and operation; the shipped sets
+  // still carry it, so their holders read as before. An `extend` contribution cannot set
+  // or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_organization_self',
     operation: 'all',

packages/platform-objects/src/identity/sys-scim-connection-binding.object.ts

@@ -51,13 +51,13 @@ export const SysScimConnectionBinding = ObjectSchema.create({
     },
   },
 
-  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one
-  // policy plugin-security's shipped permission sets spread for it today
-  // (`scimProjectionRowScope` in `default-permission-sets.ts`), moved here
-  // verbatim. Layer 0 is inert on this table (no organization column), so Layer 1
-  // silence is to mean this scope, not no filter. Not read yet: the sets keep
-  // carrying the same literal, and the security plugin's collection is to apply
-  // this key when no held set carries a policy for the object. An `extend`
+  // [ADR-0095 D1, 2026-10-18 note] This object's default row scope: the one policy
+  // plugin-security's shipped permission sets spread for it today
+  // (`scimProjectionRowScope` in `default-permission-sets.ts`), moved here verbatim.
+  // Layer 0 is inert on this table (no organization column), so Layer 1 silence means
+  // this scope, not no filter. The security plugin's row-policy collection applies it
+  // when no set the caller holds carries a row policy for the object and operation; the
+  // shipped sets still carry it, so their holders read as before. An `extend`
   // contribution cannot set or loosen it (refused at registration).
   defaultRowScope: {
     name: 'sys_scim_connection_binding_none',