fix(plugin-auth): state the Case D refusal cost, pin the org-stamped wrong grant, correct two counts

- changeset: name the family that now gets a refusal where it previously got a
  grant (an active, correctly-named row with a missing/blank id — including a
  malformed GLOBAL row beside a well-formed org-scoped one), what it now sees,
  and that repairing or deleting the row restores the grant with no code change.
- the wrong-GRANT pin now RESOLVES an organization via `getTenancy`, so it drives
  the shape that actually bit: `ps_global` stamped `organization_id: 'org_1'`.
  Asserted by column, not only by row count.
- counts corrected: four guard-clause spellings (not five — the fifth match was
  `member-role-canonical`'s `raw.join(',')`, a different helper); and this
  package has 47 `.find(` sites in non-test source, a count that already
  includes `Array#find` (the earlier "~140" was unmeasured). Also "four local
  engine ports" -> "three", which is what that sentence names.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Author: claude

.changeset/plugin-auth-find-envelope-limbs.md

@@ -4,11 +4,13 @@
 
 A self-registration grant is refused, not silently redirected, when a permission-set row is malformed — and the fourteen dead `{ records }` / `{ data }` normalizer limbs behind that code are gone.
 
-`plugin-auth` carried fourteen array-or-envelope normalizer blocks of the shape `Array.isArray(x) ? x : x.records ?? []` (thirteen on a `records` limb, one on a `data` limb, five of them written as a guard clause rather than a ternary). All fourteen read the same concrete engine — the `ObjectQL` instance the kernel registers as the `objectql` / `data` service — which answers a bare array on every path, populated or empty. The envelope limb was unreachable code that read as a contract, so the next author writing a defensive normalizer here believed an envelope was possible. The limbs are removed, and the four local engine ports that declared `Promise<unknown>` (`BootProbeEngine`, `DevAdminSeedProbeEngine`, `PhoneSmsTemplateEngine`) now declare the array they always returned.
+`plugin-auth` carried fourteen array-or-envelope normalizer blocks of the shape `Array.isArray(x) ? x : x.records ?? []` (thirteen on a `records` limb, one on a `data` limb, four of them written as a guard clause rather than a ternary). All fourteen read the same concrete engine — the `ObjectQL` instance the kernel registers as the `objectql` / `data` service — which answers a bare array on every path, populated or empty. The envelope limb was unreachable code that read as a contract, so the next author writing a defensive normalizer here believed an envelope was possible. The limbs are removed, and the three local engine ports that declared `Promise<unknown>` (`BootProbeEngine`, `DevAdminSeedProbeEngine`, `PhoneSmsTemplateEngine`) now declare the array they always returned.
 
 The user-visible change is in `settleSelfRegistrationGrant`, which carried the opposite defect. Its candidate filter dropped any permission-set row whose `id` was missing or blank, silently, before choosing which row to grant:
 
 - When the malformed row was the only one, the operator was told `no active sys_permission_set row named 'X' resolves` — false, since an active row named exactly that was present. That report is the only signal this path emits, and nothing retries it.
 - When the malformed row was the **organization-scoped** one and a global row also carried the declared name, dropping it let the `organization_id == null` arm match instead, and the self-registrant was granted the **global** permission set their organization never declared — with a success log and no other trace.
 
 `active !== false` remains a selection predicate: a deactivated set still reports the ordinary "does not resolve". A malformed row is no longer a selection at all — the grant is refused and the report names the malformed row, so the ambiguity is surfaced instead of resolved by accident. A well-formed family grants exactly as before.
+
+**Upgrade note — one family now gets a refusal where it previously got a grant.** If a deployment's `sys_permission_set` already contains a row that is active and carries the declared name but whose `id` is missing or blank, self-registration grants against that name now stop and report, including the case where the malformed row is one nobody was relying on: a malformed **global** row sitting alongside a well-formed **organization-scoped** row used to be dropped silently, letting the org row be granted, and is now refused. This is deliberate — the old behaviour could not tell that family apart from the one where the silent drop granted the *wrong* set — and it is fully reversible without a code change: repair or delete the malformed row and the grant proceeds exactly as before. The refusal is loud and names the row, so it is visible rather than something to discover later; nothing is written while it stands.

packages/plugins/plugin-auth/src/find-envelope-limb-removal.test.ts

@@ -6,7 +6,7 @@
  *
  * ## What was removed, and why a test is owed for it
  *
- * Every block looked like `Array.isArray(x) ? x : x.records ?? []` (five of them
+ * Every block looked like `Array.isArray(x) ? x : x.records ?? []` (four of them
  * in the guard-clause spelling, one on a `data` limb). The envelope limb was
  * dead: nothing in this tree ever produced that shape. But "dead" is a claim
  * about RUNTIME, and the declared type cannot establish it — `IDataEngine.find`
@@ -35,8 +35,10 @@
  * goes red). That is also the reason removal is right rather than merely safe:
  * a hook that corrupted `find()` into `{ records }` would be a contract
  * violation, and the limb did not repair it — it silently absorbed it at these
- * fourteen sites while the ~140 other `find()` call sites in this package broke
- * anyway. Fourteen sites of false immunity is worse than one visible failure.
+ * fourteen sites while this package's remaining `find()` call sites broke anyway
+ * (47 `.find(` sites in its non-test source in total, a count that already
+ * includes `Array#find`). Fourteen sites of false immunity is worse than one
+ * visible failure.
  *
  * ## The fifteenth case is a different defect
  *
@@ -398,11 +400,23 @@ describe('#15597 — the blocks driven through their real production entry point
 describe('#15597 — settleSelfRegistrationGrant refuses on a malformed row instead of dropping it', () => {
   const USER = { id: 'usr_new', name: 'New Person', email: 'new@corp.example' };
 
-  async function settle(engine: ObjectQL, setName: string, lines: string[]): Promise<void> {
+  async function settle(
+    engine: ObjectQL,
+    setName: string,
+    lines: string[],
+    /**
+     * The organization `settleSelfRegistrationGrant` resolves, read the way the
+     * method itself reads it — `this.config.getTenancy?.()` then `defaultOrgId()`.
+     * Omitted, nothing resolves and `organizationId` stays null; supplied, the
+     * org-scoped arm of the row selection is the one that runs.
+     */
+    orgId?: string,
+  ): Promise<void> {
     const manager = new AuthManager({
       secret: SECRET,
       baseUrl: 'http://localhost:3000',
       dataEngine: engine as never,
+      ...(orgId ? { getTenancy: () => ({ defaultOrgId: async () => orgId }) } : {}),
       logger: { error: (m: string) => lines.push(String(m)), warn: (m: string) => lines.push(String(m)), info: () => {} },
     } as never);
     (manager as never as { stageSelfRegistrationGrant: Function }).stageSelfRegistrationGrant(USER.email, setName);
@@ -450,14 +464,22 @@ describe('#15597 — settleSelfRegistrationGrant refuses on a malformed row inst
     // dropped the org row, `rows.find((r) => r.organization_id == null)` then
     // matched the GLOBAL row, and the self-registrant was granted a permission
     // set their organization never declared — silently, with a success log.
+    //
+    // The organization is RESOLVED here (`getTenancy`), which is the shape that
+    // actually bit and the reason this case does not lean on its sibling: with
+    // an org in hand the wrong grant is not merely "some global row", it is
+    // `ps_global` STAMPED `organization_id: 'org_1'` — the write spreads the
+    // resolved org onto the row — so the store ends up asserting that org_1
+    // granted a set org_1 never declared. Asserted by column below, not just by
+    // row count, so the stamp itself is pinned.
     const engine = await bootEngine();
     await engine.insert('sys_user', USER, SYSTEM);
     await engine.insert('sys_organization', { id: 'org_1', name: 'Default', slug: 'default' }, SYSTEM);
     await engine.insert('sys_permission_set', { id: '', name: 'portal_user', label: 'Org scoped', organization_id: 'org_1' }, SYSTEM);
     await engine.insert('sys_permission_set', { id: 'ps_global', name: 'portal_user', label: 'Global' }, SYSTEM);
 
     const lines: string[] = [];
-    await settle(engine, 'portal_user', lines);
+    await settle(engine, 'portal_user', lines, 'org_1');
 
     // Reverse-verified by ablation (recorded because the pre-fix behaviour is
     // the whole argument): with the old trailing filter restored and nothing
@@ -471,6 +493,15 @@ describe('#15597 — settleSelfRegistrationGrant refuses on a malformed row inst
     // Refused, and in particular NOT granted the global set.
     const rows = await grants(engine);
     expect(rows, `granted anyway: ${JSON.stringify(rows)}`).toEqual([]);
+    // The specific wrong write, named: no row may claim org_1 granted ps_global.
+    expect(
+      rows.some(
+        (r) =>
+          (r as { permission_set_id?: unknown }).permission_set_id === 'ps_global' &&
+          (r as { organization_id?: unknown }).organization_id === 'org_1',
+      ),
+      'ps_global was granted STAMPED with org_1 — the organization is now recorded as having granted a set it never declared',
+    ).toBe(false);
     expect(lines.join('\n')).toContain('no usable id');
   });