refac: debt on role backend

features/roles_permissions_enforcement.feature

@@ -29,6 +29,7 @@ Feature: Roles and permissions enforcement: permission checks replace the owner
       answers 500 "Internal server error"
     And enforcement honours any grant it finds, including an owner-only key placed on a custom role by hand. Refusing to
       grant owner-only keys belongs to slice 3 (ValidateGrants at write time)
+      (superseded by roles_permissions_content_scope: owner-only keys are effective only on a locked role, so a hand-placed one is ignored)
     And the users, tokens and cookies are the ones of the foundation feature: user 3 Owner, user 5 Admin, user 9 Writer,
       all verified with a valid jwt cookie and token_version 0
     And routes with no obvious catalogue key reuse existing keys: media rename = media.upload; purge settings GET = settings.view,
@@ -194,7 +195,7 @@ Feature: Roles and permissions enforcement: permission checks replace the owner
       | media.view=all                     | POST /v1/media               | 403    |
       | apikeys.create=all                 | GET /v1/api-key              | 403    |
       | settings.edit_general=all          | PATCH /v1/media/purge-settings | ok   |
-      | system.apply_updates=all           | POST /v1/system/update/check | ok     |
+      | system.apply_updates=all           | POST /v1/system/update/check | 403 system.apply_updates (superseded by roles_permissions_content_scope: owner-only keys count only on a locked role) |
       | (no grants)                        | GET /v1/author               | 403    |
 
   Scenario: A user whose role cannot be resolved is refused everywhere that is gated
@@ -367,6 +368,7 @@ Feature: Roles and permissions enforcement: permission checks replace the owner
   Scenario: Articles and entries are not gated in this slice
     Given user 20 has a custom role with no content grants
     Then the article and entry routes answer exactly as before this slice (own/all, publish and draft are slice 2b)
+    And this scenario is superseded by roles_permissions_content_scope: articles and entries are gated by the content.* keys
 
   Scenario Outline: Existing owner and admin behaviour does not regress
     Given the caller is <role>