Answer stability round 1: 0 🔴, 6 🟡 (0 misread); pin which tuples a group delete keeps, test the self-refusal reasons and the failed save, one refuseForm comment

examples/plugins/auth-admin/admin-groups.ts

@@ -431,20 +431,20 @@ export const groupsDeleteConfirm = withGroupName(async (deps, name) => {
   }) }, view: "confirm" };
 }, "write");
 
-// POST /auth-admin/groups/:name/delete — remove every member tuple and held grant in one Keto
-// transaction (the group ceases to exist, and a failure leaves it whole).
+// POST /auth-admin/groups/:name/delete — one Keto transaction removes the group's member tuples
+// and the grants it holds, so a Keto failure leaves the group as it was.
 export const groupsDelete = withGroupName(async (deps, name) => {
   const { ctx, keto, user } = deps;
   await guardedForm(ctx); // CSRF-verify the POST
   const lost = await lostOnDelete(deps, name);
   if (lost.length > 0) return refuseSelfLockout(deps, name, "delete", lost);
-  // Drop what the group *holds* along with what it *contains*: a Keto set exists only through its
-  // tuples, so leaving the grants behind would resurrect every permission the moment someone
-  // re-created a group with the same name.
+  // A Keto set exists only through its tuples, so leaving the grants behind would resurrect every
+  // permission the moment someone re-created a group with the same name.
   const subject = groupSubject(name);
   const held = await heldPermissions(keto, subject);
+  const grants = held.map((permission) => grantTuple(permission, subject));
   const members = await pagedTuples(keto, { namespace: GROUP_NS, object: name, relation: MEMBERS });
-  await keto.transactTuples({ delete: [...held.map((permission) => grantTuple(permission, subject)), ...members], insert: [] });
+  await keto.transactTuples({ delete: [...grants, ...members], insert: [] });
   ctx.log.info("admin: group deleted", { actor: user.id, group: name, revoked: held.join(",") });
   return { redirect: ADMIN_GROUPS_BASE };
 });