test: the suites main's D and wall changes touched span stage 8 as well

Measured on a local main + S8-T + S8 tree:
- plugin-auth's two grant-reader suites seed the legacy platform-bucket
  rows only where sys_permission_set is still registered;
- builtin-positions expects the walled tenant create refusal while the
  plugin declares the sys_position row object, which stage 8 retires
  together with that refusal;
- the record-page label-map floor is 38, the count with B2's two maps and
  the retired position page gone.

Claude-Session: https://claude.ai/code/session_01ADzJtzYTLUfgrRZHxkagkX
Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

packages/cli/test/platform-page-i18n-parity.test.ts

@@ -842,7 +842,7 @@ describe('shipped platform record pages -- i18n ownership (#14817)', () => {
     // that the pages went monolingual. [#15204 B2] The user page's two grant
     // lists dropped their `add` pickers, and with them two label maps.
     // (`sys_position_detail` retired with the `sys_position` object, C3 stage 8.)
-    expect(maps.length).toBeGreaterThanOrEqual(39);
+    expect(maps.length).toBeGreaterThanOrEqual(38);
 
     const incomplete = maps
       .filter((m) => SHIPPED_LOCALES.some((locale) => !m.locales.includes(locale)))

packages/plugins/plugin-auth/src/grant-readers-by-name.golden.test.ts

@@ -154,8 +154,9 @@ async function standingByReader(posture: Posture): Promise<Record<string, unknow
   await user('usr_member', 'member@gra.example', '2025-03-01T00:00:00.000Z');
   await user('usr_agent', 'agent@gra.example', '2025-04-01T00:00:00.000Z');
 
-  // An existing database: the platform-bucket rows an earlier release seeded.
-  await seedLegacyPlatformBucket(engine, bootstrapSets);
+  // An existing database: the platform-bucket rows an earlier release seeded,
+  // where the row object is still registered (C3 stage 8 retires it).
+  if (engine.getObject?.('sys_permission_set')) await seedLegacyPlatformBucket(engine, bootstrapSets);
   const boot = await bootstrapPlatformAdmin(engine, bootstrapSets);
   expect(boot.adminPromoted).toBe(posture === 'single');
   // The organization's own copies of the sets, where the row object is still

packages/plugins/plugin-auth/src/grant-readers-unnamed-grant.test.ts

@@ -123,8 +123,11 @@ async function soleGrantAnchoredAdmin(): Promise<Rig> {
       'sys_account', { id: `acc_${id}`, user_id: id, account_id: `${id}@un.example`, provider_id: 'credential' }, SYS,
     );
   }
-  // An existing database: the platform-bucket rows an earlier release seeded.
-  await seedLegacyPlatformBucket(engine, (manifest.permissions ?? []) as any[]);
+  // An existing database: the platform-bucket rows an earlier release seeded,
+  // where the row object is still registered (C3 stage 8 retires it).
+  if (engine.getObject?.('sys_permission_set')) {
+    await seedLegacyPlatformBucket(engine, (manifest.permissions ?? []) as any[]);
+  }
   const boot = await bootstrapPlatformAdmin(engine, (manifest.permissions ?? []) as any[]);
   expect(boot).toMatchObject({ adminPromoted: true });
   return { engine };

packages/plugins/plugin-security/src/builtin-positions.boot.test.ts

@@ -573,15 +573,23 @@ const REFUSAL_GOLDEN: Record<string, WriteOutcome> = {
   },
 };
 
+/**
+ * Whether the plugin still declares the `sys_position` row object. C3 stage 8
+ * retires it (ADR-0131 D3) and unregisters the walled data-door refusal with
+ * it; this harness registers the legacy table itself either way.
+ */
+const PLUGIN_DECLARES_POSITION_ROWS = securityObjects.some((o) => o.name === 'sys_position');
+
 /**
  * {@link REFUSAL_GOLDEN} for a scenario: the built-in row cases need an existing
  * database's rows. [ADR-0131 D3] Under a wall the tenant's position CREATE is
- * refused (`walled-catalog-data-door.ts`): the catalog is the platform
- * operator's, and a tenant may only assign it. The assignment cases do not
- * move, and the built-in row refusals keep their `403 PERMISSION_DENIED`.
+ * refused (`walled-catalog-data-door.ts`) while the plugin declares the row
+ * object: the catalog is the platform operator's, and a tenant may only assign
+ * it. The assignment cases do not move, and the built-in row refusals keep
+ * their `403 PERMISSION_DENIED`.
  */
 function refusalGoldenFor(scenario: Scenario): Record<string, WriteOutcome> {
-  const golden: Record<string, WriteOutcome> = scenario.posture === 'single'
+  const golden: Record<string, WriteOutcome> = scenario.posture === 'single' || !PLUGIN_DECLARES_POSITION_ROWS
     ? REFUSAL_GOLDEN
     : { ...REFUSAL_GOLDEN, 'control: create a position row': { ok: false, code: 'PERMISSION_DENIED', status: 403 } };
   if (scenario.existingRows) return golden;