docs(plugin-auth): 用实测结论替换「清空能力=管理员失效」的推断 (#6084)

`resolveAuthzContext` 的 `hasPlatformAdminGrant` 只看 `ps.name === 'admin_full_access'`
(resolve-authz-context.ts:390),`derivePosture` 就凭这个布尔返回 PLATFORM_ADMIN ——
清空 `system_permissions` 并不会让 platform admin 失效,posture 与 superuser bypass
都挂在**名字**上。原注释把它写成一处 break-glass 缺口是错的;改为记录实测结论,顺带
把「只读 name」这条静态跳过键的依据说实。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JwwiU9bjhwy2SWj13ho8uv

Author: claude

packages/plugins/plugin-auth/src/last-admin-guard.ts

@@ -215,12 +215,17 @@
  *
  * Scope in the other direction: this guard watches writes to the four tables
  * the administrator population is derived from, and stops there. It has no
- * opinion on what a permission set CONTAINS — emptying `admin_full_access`'s
- * `system_permissions` would leave administrators who administer nothing, but
- * that is a capability question (ADR-0086), and answering it here would make
- * every permission-set edit in Setup a break-glass decision. "Who is an
- * administrator" is resolved by NAME in this codebase (`resolveAuthzContext`,
- * ADR-0068 D2), so the guard reads exactly the name.
+ * opinion on what a permission set CONTAINS, and that is not a gap being left
+ * open — it was measured. `resolveAuthzContext` sets `hasPlatformAdminGrant`
+ * from `ps.name === 'admin_full_access'` alone and `derivePosture` returns
+ * `PLATFORM_ADMIN` off that boolean, so emptying the set's
+ * `system_permissions` does NOT un-make a platform admin: the posture rung and
+ * the superuser bypass ride on the NAME (ADR-0068 D2 / ADR-0095 D3). Such an
+ * edit costs the holder `setup.access` / `studio.access` — Setup and Studio go
+ * invisible — while the data plane still answers, so it is recoverable from
+ * inside the product and is a capability question (ADR-0086), not a break-glass
+ * one. The name is the whole of what makes an administrator here, so the name
+ * is the whole of what this guard reads.
  *
  * ## Relationship to the ADR-0092 identity write guard
  *
@@ -544,9 +549,10 @@ const GRANT_STANDING_KEYS = [
  * because the platform-admin half of the enumeration reads exactly one column
  * of that table: the `name` it looks the set up by. Everything else a
  * permission-set write touches (`label`, `description`, the four permission
- * JSON blobs, `active`, provenance) is invisible to "who is an administrator",
- * so those writes — which is every projection pass and every Setup edit — cost
- * this guard no reads at all.
+ * JSON blobs, `active`, provenance) is invisible to "who is an administrator" —
+ * `resolveAuthzContext` derives `platform_admin` from the NAME, not from the
+ * capabilities the set carries — so those writes, which is every projection
+ * pass and every Setup edit, cost this guard no reads at all.
  *
  * `id` is deliberately NOT here even though the enumeration reads it. On this
  * engine `data.id` on an update ADDRESSES the row (it is what