plugin-security: pin the invalid duplicate permission-set grant (400 → 409) and the activation 409 sentence's condition (follow-up of #32164 P2) #32675

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

立卡门 ① · 已落地工作欠的后续：#32164 P2（PR #32306）专题红线 delta 读 6819720516 的 F1 与可选项，以及契约复审 r3 的两条 nit。按 Bill「简单的问题后续单独立卡」从 PR 中拆出。Part of #31527 (ADR-0150)。Blocked-by #32306.

What

PR #32306's changeset (lines 18 and 68) declares a moved answer that no test pins: a second grant of a permission set whose row would ALSO fail record validation moves from 400 VALIDATION_FAILED to 409 DUPLICATE_RECORD. The epic seat measured it as real (a 600-character reason answers 409 for system and non-system writers).

Do

1. In grant-permission-set-package.test.ts, [E2] block (around :206): pin the invalid duplicate grant → 409, red against a 400 BASE, with a CONTROL where the invalid row alone (no duplicate) still answers 400. Ablate once.
2. Pin the condition of the corrected 409 sentence at catalog-activation.ts (~:562): an environment beside a package, a row naming no package and an inactive sentinel row. Today restoring holders.length > 1 keeps every door test green, so the condition is unpinned.
3. Changeset/doc wording: the one-grant check at hook priority 50 answers before default-priority (100) app-authored hooks on the grant table; the module doc says so, the changeset does not. Add one sentence (a follow-up .changeset/ note, or an edit of feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306's changeset before release).

Acceptance

• Pins 1 and 2 red under ablation, CONTROLs green.
• Clause-②: no (tests and wording only); no behaviour change.

业务理由

谁受益：维护权限集授予门的开发者。场景：有人改动校验顺序，第二次无效授予悄悄退回 400，或 409 句的条件被放宽，没有测试会红。不做：已声明的答案和条件可被无声回退。

读者

server 车道，PR #32306 合并后；起点上列两个文件与 #32306 的 changeset。

查重

repo:objectstack-ai/objectstack is:issue DUPLICATE_RECORD permission set grant VALIDATION_FAILED → #32164 only. No duplicate.