wip(tests): fake stored grants keep their legacy id beside the name; no duplicate keys

Claude-Session: https://claude.ai/code/session_01MZuVPXoYeF1Pa3G4ERmTPz
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-hono-server/src/current-user-endpoints-delegated-resolution.test.ts

@@ -89,7 +89,7 @@ const TABLES: Record<string, Row[]> = {
     sys_member: [{ user_id: USER, organization_id: ACTIVE_ORG, role: 'member' }],
     sys_user_position: [],
     sys_user_permission_set: [
-        { id: 'ups1', user_id: USER, permission_set: GRANTED, permission_set: GRANTED, organization_id: ACTIVE_ORG },
+        { id: 'ups1', user_id: USER, permission_set: GRANTED, organization_id: ACTIVE_ORG },
     ],
     sys_position: [],
     sys_position_permission_set: [],

packages/plugins/plugin-hono-server/src/current-user-endpoints-execution-context-envelope.test.ts

@@ -90,7 +90,7 @@ const TABLES: Record<string, Row[]> = {
     sys_member: [{ user_id: USER, organization_id: ACTIVE_ORG, role: 'member' }],
     sys_user_position: [],
     sys_user_permission_set: [
-        { id: 'ups1', user_id: USER, permission_set: GRANTED, permission_set: GRANTED, organization_id: ACTIVE_ORG },
+        { id: 'ups1', user_id: USER, permission_set: GRANTED, organization_id: ACTIVE_ORG },
     ],
     sys_position: [],
     sys_position_permission_set: [],

packages/plugins/plugin-security/src/delegated-admin-gate.test.ts

@@ -366,27 +366,27 @@ describe('DelegatedAdminGate — direct grants (sys_user_permission_set)', () =>
     });
 
     it('a grant naming an allowlisted set may be revoked by the delegate — whatever its id says', async () => {
-      storedGrant({ permission_set: 'finance_admin', permission_set: 'sales_user' });
+      storedGrant({ permission_set_id: 'ps_fin', permission_set: 'sales_user' });
       await expect(remove()).resolves.toBeUndefined();
     });
 
     it('a grant naming a set outside the allowlist is refused — whatever its id says', async () => {
-      storedGrant({ permission_set: 'sales_user', permission_set: 'finance_admin' });
+      storedGrant({ permission_set_id: 'ps_sales', permission_set: 'finance_admin' });
       await expect(remove()).rejects.toThrow(/'finance_admin' is not in the scope's allowlist/);
     });
 
     it('a grant that names NO set is refused: the delegate cannot be shown to hold authority over it', async () => {
-      storedGrant({ permission_set: 'sales_user', permission_set: null });
+      storedGrant({ permission_set_id: 'ps_sales', permission_set: null });
       await expect(remove()).rejects.toThrow(/names no permission set/);
     });
 
     it('a grant naming a set the security catalog does not hold is refused', async () => {
-      storedGrant({ permission_set: 'sales_user', permission_set: 'sales_user_retired' });
+      storedGrant({ permission_set_id: 'ps_sales', permission_set: 'sales_user_retired' });
       await expect(remove()).rejects.toThrow(/is not in the security catalog/);
     });
 
     it('an update keeping the set is judged by the stored name; one re-pointing the id by the new id', async () => {
-      storedGrant({ permission_set: 'sales_user', permission_set: 'sales_user' });
+      storedGrant({ permission_set_id: 'ps_sales', permission_set: 'sales_user' });
       await expect(h.gate.assert({
         object: 'sys_user_permission_set', operation: 'update',
         data: { id: 'g1', reason: 'renewed' }, context: h.ctxOf('delegate'),

packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts

@@ -183,8 +183,8 @@ function makeQl() {
         // reading's discipline. With one shared grant, only the organization
         // claim can separate the arms.
         sys_user_permission_set: [
-            { user_id: 'u_member', permission_set: 'shared_access', permission_set: 'shared_access' },
-            { user_id: 'u_exmember', permission_set: 'shared_access', permission_set: 'shared_access' },
+            { user_id: 'u_member', permission_set_id: 'ps_shared', permission_set: 'shared_access' },
+            { user_id: 'u_exmember', permission_set_id: 'ps_shared', permission_set: 'shared_access' },
         ],
         sys_permission_set: [
             { id: 'ps_shared', name: 'shared_access', system_permissions: ['manage_metadata', 'studio.access'] },