id(world-manifest): PR #801 — plan() treats omitted grants/ceiling/schedules as authoritative, contradicting 'empty fields are left alone' (omitted ceiling widens to whole catalog) #817

Problem

PR #801's new world.toml manifest model (pkgs/id/src/world_manifest.rs, branch id/phase-12) documents partial-manifest semantics that its own plan() does not implement — and the mismatch is destructive in one direction and privilege-widening in the other.

The struct doc (world_manifest.rs:23-24) says:

A declarative description of a world. Empty fields are left alone by plan, so a minimal manifest drifts nothing.

That is only true for module/seed, and only against an already-empty world. plan() (world_manifest.rs:179ff) treats every other empty field as authoritative:

• Grants (world_manifest.rs:197-205): grants is a plain Vec<String> with no way to express "unspecified". An omitted/empty grants against a world with grants produces SetGrants { grants: [] } — id world apply revokes every grant.
• Ceiling (world_manifest.rs:208-212): an omitted ceiling is None, which the model defines as "the whole catalog". Against a world with a narrowed ceiling, a minimal manifest produces SetCeiling { ceiling: None } — apply widens the ceiling to the entire catalog. This is the security-sensitive direction: a manifest that never mentions the ceiling silently removes it.
• Schedules (world_manifest.rs:224-233): an omitted/empty schedules map produces a CancelSchedule step for every pending schedule in the current state.
• Profile: an omitted profile is the all-None default and replaces the current profile whenever it differs.

The PR's own test demonstrates the contradiction: an_empty_manifest_drifts_nothing (world_manifest.rs, tests) asserts an empty manifest against a default state drifts nothing, then asserts the same empty manifest against a state with grants + a ceiling produces exactly 2 steps (SetGrants + SetCeiling). The test's name and the struct doc claim the opposite of its second half.

A related rendering bug in the same file: diff() (world_manifest.rs:321) renders a SetCeiling step as ~ ceiling [{names}] with ceiling.as_deref().unwrap_or(&[]) — so None (whole catalog, the widening case) and Some([]) (no capability allowed, the most restrictive case) both render as ~ ceiling []. The two opposite operations are indistinguishable in id world diff output.

Why it matters

id world apply is an admin operation meant to be safe to run with a partial manifest ("a minimal manifest drifts nothing" is the documented contract a user will rely on). Today, running it with a manifest that only sets, say, a module hash against a live world would also revoke all grants, remove the capability ceiling, and (once schedule state is exposed over the wire) cancel all schedules — none of which the manifest mentions.

Evidence

• PR id: Phase 12 — world doctor + world.toml manifest (F12.16, F12.1) #801 (OPEN, branch id/phase-12), commits 408e664c3a50, 0616553c34cd; file:line on the PR branch as fetched this run. Not on main yet — fix-before-merge.
• Dedup: id: F12.1 apply wiring — module install + schedules reconciliation #807 tracks wiring module/schedule apply steps over the wire; it does not cover plan-level empty-field semantics or the diff rendering. No other open/closed issue mentions manifest empty-field behaviour (searched "manifest empty grants").

Acceptance

• The manifest can distinguish "field unspecified — leave alone" from "field explicitly empty — clear it" for at least grants, ceiling, and schedules (e.g. Option<Vec<String>> / Option<BTreeMap<..>>, or an equivalent explicit design), and plan() leaves unspecified fields alone.
• The struct doc, the an_empty_manifest_drifts_nothing test name, and plan()'s actual behaviour agree; a regression test shows a minimal manifest (e.g. only module_hash) against a fully populated state produces only the module step.
• In particular, a manifest that omits ceiling can never widen an existing ceiling.
• diff() renders None (whole catalog) and Some([]) (none allowed) distinctly.