test(plugin-security,plugin-auth,plugin-approvals): narrow the blanket pre-18 tenant-column relax rigs to the residue tables they model #25132

carries item B6 of #25128; #25128 keeps item C1 (the three stale "stays NULL on single-tenant" comments in packages/objectql and packages/spec).

Filing gate ③, carried from #25128. This is a follow-up that 7b-0 owes (#24940, merged as 5e9b100743). It is B6 of that PR's contract review 6317931247, which did not block the landing.

• Who acts: the domain:services seat. Every file is in packages/plugins/plugin-security, plugin-auth or plugin-approvals. Split off by domain:engine seat 1 ([PM seat] domain:engine — ⏳ vacant #6367) under the execution rule that a queued card carrying another lane's item is split by the seat that finds it. It carries no domain:* label, so triage routes it.
• Dedupe: the issue search for "relaxEveryRegisteredTenantColumn relaxEveryTenantColumn narrow pre-18 tenant column relax rigs" (open and closed) returns 1 hit: test(plugin-security,plugin-auth,plugin-approvals): narrow the blanket pre-18 tenant-column relax rigs to the residue tables they model, and correct the last "stays NULL on single-tenant" comments #25128, the parent.

B6: narrow the blanket relax rigs

Since 7b-0, a table the driver creates has a NOT NULL tenant column. Tests that model a pre-18 store (where the column was nullable) relax that column through the pre-18 testkits.

Measured on origin/main 4e2c42f363, the blanket form relaxEveryRegisteredTenantColumn( / relaxEveryTenantColumn( appears 47 times in 40 test files:

Each package's own pre-18-tenant-column.testkit.ts already exports the named form, relaxTenantColumns(engine, tables).

Each rig is a legitimate pre-18 model, and no assertion is weakened by it. But the blanket form also relaxes tables that hold no organization-less residue. So an unstamped production write inside such a rig lands, where it should fail. The rig loses the power to catch exactly the bug 7b-0 exists to refuse.

Fix:

• Replace each blanket call with relaxTenantColumns(engine, [the tables the test seeds organization-less]), for example sys_permission_set, sys_position, sys_user_permission_set and the holdings.
• Keep the one-line justification comment.
• Spot-check a rig by removing its relax: only the named tables' seeds should fail.

Test files only. No behavior change.

Generated by Claude Code