wip(tests): dogfood grant fixtures by name; junction rows keep their id; no new query-option casts

Claude-Session: https://claude.ai/code/session_01MZuVPXoYeF1Pa3G4ERmTPz
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/grant-permission-set-name.test.ts

@@ -170,7 +170,7 @@ describe('the data door (a non-system writer)', () => {
     const [row] = await grantsOf(h, 'u_1');
     expect(row).toMatchObject({ permission_set: 'qa_alpha' });
     expect(row.permission_set_id ?? null).toBeNull();
-    expect(await h.engine.find('sys_permission_set', { context: SYS } as any)).toEqual([]);
+    expect(await h.engine.find('sys_permission_set', { context: SYS })).toEqual([]);
   });
 
   it('NEGATIVE — a name the catalog does not hold is refused 400 VALIDATION_FAILED, reference_not_found at permission_set; nothing is stored', async () => {

packages/plugins/plugin-security/src/grant-permission-set-name.writers.test.ts

@@ -94,8 +94,8 @@ describe('[ADR-0131 D4] the grant writers in plugin-security write the set by na
     expectNamedOnly(grants[0], 'admin_full_access');
 
     // The holder is read by name: with every catalog row gone it still answers.
-    await engine.delete('sys_permission_set', { where: {}, multi: true, context: SYS } as any);
-    expect(await engine.find('sys_permission_set', { context: SYS } as any)).toEqual([]);
+    await engine.delete('sys_permission_set', { where: {}, multi: true, context: SYS });
+    expect(await engine.find('sys_permission_set', { context: SYS })).toEqual([]);
     expect(await findExistingPlatformAdmin(engine, defaultPermissionSets)).toBe('usr_first');
   });
 
@@ -118,7 +118,7 @@ describe('[ADR-0131 D4] the grant writers in plugin-security write the set by na
       const grants = await grantsOf(engine, 'u_owner');
       expect(grants).toHaveLength(1);
       expectNamedOnly(grants[0], setName);
-      expect(await engine.find('sys_permission_set', { context: SYS } as any)).toEqual([]);
+      expect(await engine.find('sys_permission_set', { context: SYS })).toEqual([]);
     });
   }
 });

packages/qa/dogfood/test/activity-field-values.dogfood.test.ts

@@ -179,7 +179,7 @@ describe('[#21081] activity rows serve a parent field value only to a reader ser
       for (const name of sets) {
         const setId = await idOf('sys_permission_set', { name });
         expect(setId, `fixture permission set ${name} seeded`).toBeTruthy();
-        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set_id: setId }, SYS);
+        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set: name }, SYS);
       }
     }
 

packages/qa/dogfood/test/activity-label-display-field.dogfood.test.ts

@@ -144,7 +144,7 @@ describe('[#21878] an activity row names its record by the ADR-0079 title, with
       for (const name of PRINCIPALS[who]) {
         const setId = await idOf('sys_permission_set', { name });
         expect(setId, `fixture permission set ${name} seeded`).toBeTruthy();
-        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set_id: setId }, SYS);
+        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set: name }, SYS);
       }
     }
 

packages/qa/dogfood/test/activity-text-predicate.dogfood.test.ts

@@ -258,8 +258,7 @@ describe('[#21154] a query over activity text or the approval snapshot, by a rea
     const adminId = await idOf('sys_user', { email: 'admin@objectos.ai' });
     expect(adminId, 'the harness admin is seeded').toBeTruthy();
     for (const name of READERS.control) {
-      const setId = await idOf('sys_permission_set', { name });
-      await ql.insert('sys_user_permission_set', { user_id: adminId, permission_set_id: setId }, SYS);
+      await ql.insert('sys_user_permission_set', { user_id: adminId, permission_set: name }, SYS);
     }
 
     for (const who of [...Object.keys(READERS), 'writer']) {
@@ -270,7 +269,7 @@ describe('[#21154] a query over activity text or the approval snapshot, by a rea
       for (const name of sets) {
         const setId = await idOf('sys_permission_set', { name });
         expect(setId, `fixture permission set ${name} seeded`).toBeTruthy();
-        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set_id: setId }, SYS);
+        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set: name }, SYS);
       }
       if (who === 'control') {
         // Staff the position BEFORE the subject exists: the slate resolves at request creation.

packages/qa/dogfood/test/admin-ledger-decision-metadata.dogfood.test.ts

@@ -266,7 +266,7 @@ describe('the admin identity rows on the compliance ledger carry decisions, neve
       for (const name of READERS[who]) {
         const setId = await idOf('sys_permission_set', { name });
         expect(setId, `fixture permission set ${name} seeded`).toBeTruthy();
-        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set_id: setId }, SYS);
+        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set: name }, SYS);
       }
     }
 

packages/qa/dogfood/test/audit-log-field-values.dogfood.test.ts

@@ -190,7 +190,7 @@ describe('[#21155] the compliance ledger serves a parent field value only to a r
       for (const name of sets) {
         const setId = await idOf('sys_permission_set', { name });
         expect(setId, `fixture permission set ${name} seeded`).toBeTruthy();
-        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set_id: setId }, SYS);
+        await ql.insert('sys_user_permission_set', { user_id: userId, permission_set: name }, SYS);
       }
     }
 

packages/qa/dogfood/test/me-apps-and-everyone-baseline.dogfood.test.ts

@@ -121,7 +121,7 @@ describe('ADR-0090 D5 closures: /me/apps + anchor-bindable baseline', () => {
     expect(hideSet.status, 'set authored through the data door').toBeLessThan(300);
     const hideSetId = (await ql.findOne('sys_permission_set', { where: { name: 'tab_probe_hide' }, context: SYS }))?.id;
     expect(hideSetId, 'hide set stored').toBeTruthy();
-    await ql.insert('sys_user_permission_set', { user_id: tabUser.id, permission_set_id: hideSetId }, { context: SYS });
+    await ql.insert('sys_user_permission_set', { user_id: tabUser.id, permission_set: 'tab_probe_hide' }, { context: SYS });
 
     const hidden = await stack.apiAs(tabTok, 'GET', '/me/apps');
     const hiddenNames = (((await hidden.json()) as any)?.apps ?? []).map((a: any) => a?.name);
@@ -135,8 +135,7 @@ describe('ADR-0090 D5 closures: /me/apps + anchor-bindable baseline', () => {
         tab_permissions: JSON.stringify({ showcase_app: 'visible' }),
       });
     expect(showSet.status, 'set authored through the data door').toBeLessThan(300);
-    const showSetId = (await ql.findOne('sys_permission_set', { where: { name: 'tab_probe_show' }, context: SYS }))?.id;
-    await ql.insert('sys_user_permission_set', { user_id: tabUser.id, permission_set_id: showSetId }, { context: SYS });
+    await ql.insert('sys_user_permission_set', { user_id: tabUser.id, permission_set: 'tab_probe_show' }, { context: SYS });
 
     const merged = await stack.apiAs(tabTok, 'GET', '/me/apps');
     const mergedNames = (((await merged.json()) as any)?.apps ?? []).map((a: any) => a?.name);
@@ -187,7 +186,7 @@ describe('ADR-0090 D5 closures: /me/apps + anchor-bindable baseline', () => {
     expect(inquirySetId, 'probe set stored').toBeTruthy();
     await ql.insert(
       'sys_user_permission_set',
-      { user_id: memberUser.id, permission_set_id: inquirySetId },
+      { user_id: memberUser.id, permission_set: 'baseline_inquiry_probe' },
       { context: SYS },
     );
 

packages/qa/dogfood/test/permission-set-assignment-window.dogfood.test.ts

@@ -60,7 +60,6 @@ describe('a permission-set assignment grants only inside its validity window (AD
   let stack: VerifyStack;
   let ql: any;
   let adminTok: string;
-  let setId: string;
   const tok: Record<string, string> = {};
   const uid: Record<string, string> = {};
 
@@ -72,7 +71,7 @@ describe('a permission-set assignment grants only inside its validity window (AD
     expect(uid[who], `${who} signed up`).toBeTruthy();
   };
   const grant = async (who: string, window: { valid_from?: string; valid_until?: string } = {}) => {
-    await ql.insert(GRANTS, { user_id: uid[who], permission_set_id: setId, ...window }, { context: SYS });
+    await ql.insert(GRANTS, { user_id: uid[who], permission_set: SET, ...window }, { context: SYS });
   };
   const door = async (who: string) => (await stack.apiAs(tok[who], 'GET', `${DOOR}?$top=1`)).status;
 
@@ -83,7 +82,6 @@ describe('a permission-set assignment grants only inside its validity window (AD
 
     const set = await ql.findOne('sys_permission_set', { where: { name: SET }, context: SYS });
     expect(set?.id, `the showcase seeded ${SET}`).toBeTruthy();
-    setId = String(set.id);
 
     for (const who of ['bare', 'open', 'before', 'inside', 'after', 'edited', 'falls', 'rises']) await sign(who);
     const now = Date.now();
@@ -172,7 +170,7 @@ describe('a permission-set assignment grants only inside its validity window (AD
 
     const at = Date.now() + DAY;
     const res = await stack.apiAs(adminTok, 'POST', `/data/${GRANTS}`, {
-      user_id: uid.bare, permission_set_id: setId, valid_from: iso(at), valid_until: iso(at - HOUR),
+      user_id: uid.bare, permission_set: SET, valid_from: iso(at), valid_until: iso(at - HOUR),
     });
     const body = (await res.json()) as any;
     expect([res.status, body?.code]).toEqual([400, 'VALIDATION_FAILED']);

packages/qa/dogfood/test/search-companion-field-scope.dogfood.test.ts

@@ -174,7 +174,7 @@ describe('dogfood: with the pinyin search companion on, a member searches only w
     const setId = await idOf('sys_permission_set', { name: memberSet.name });
     expect(userId, 'member user seeded').toBeTruthy();
     expect(setId, 'member permission set seeded').toBeTruthy();
-    await ql.insert('sys_user_permission_set', { user_id: userId, permission_set_id: setId }, SYS);
+    await ql.insert('sys_user_permission_set', { user_id: userId, permission_set: memberSet.name }, SYS);
 
     memberRowId = await create(memberToken, ROWS, { name: CJK_NAME });
     adminRowId = await create(adminToken, ROWS, { name: CJK_NAME });