fix(plugin-sharing): withdraw through SharingService.revoke; bound the test double

The user-scoped withdrawal reuses the sharing service's revoke, as the
whole-rule pass does, so the change adds no new engine write call site.
The position-graph equivalence double applies the caller's limit.

Claude-Session: https://claude.ai/code/session_01KqkTQNLcxVc588eZpJmp1r
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-sharing/src/position-graph.test.ts

@@ -119,7 +119,7 @@ describe('PositionGraphService.holdsPosition — the user-scoped twin of the exp
     async find(object: string, options: any) {
       const f = options?.filter ?? options?.where ?? {};
       const rows: any[] = object === 'sys_user_position' ? ASSIGN : object === 'sys_member' ? MEMBER : [];
-      return rows.filter((r) => Object.entries(f).every(([k, v]) => r[k] === v));
+      return rows.filter((r) => Object.entries(f).every(([k, v]) => r[k] === v)).slice(0, options?.limit ?? rows.length);
     },
   } as any;
   const USERS = ['u_a', 'u_b', 'u_global', 'u_expired', 'u_pending', 'u_mixed', 'u_role_a', 'u_role_b', 'u_none'];

packages/plugins/plugin-sharing/src/sharing-rule-service.ts

@@ -1644,9 +1644,10 @@ export class SharingRuleService implements ISharingRuleService {
    * with how many OTHER users hold the recipient, so a bulk import of N rows
    * costs N user-scoped passes, never N whole-rule passes.
    *
-   * Withdrawal is one set-based delete, scoped by rule and recipient, for the
-   * reason {@link revokeRuleGrantsForRetiredRecipients} gives: under a system
-   * context `SharingService.revoke` is itself a plain delete by id.
+   * Withdrawal goes through `SharingService.revoke`, one grant at a time, as
+   * the whole-rule pass's own withdrawal does ({@link reconcile}); a user holds
+   * at most one grant per matched record, so the count is bounded by the
+   * rule's matched set.
    *
    * A `field` rule has no rule-wide recipient to check a user against; its
    * recipients live on each record and are re-derived by that record's write
@@ -1676,13 +1677,10 @@ export class SharingRuleService implements ISharingRuleService {
     for (const row of (existing ?? [])) held.set(String((row as any).record_id), row);
 
     if (!(await this.ruleReachesUser(rule, userId, {}))) {
-      if (held.size === 0) return pass;
-      await this.engine.delete('sys_record_share', {
-        where: scope,
-        multi: true,
-        context: SYSTEM_CTX,
-      } as any);
-      pass.grantsRevoked = held.size;
+      for (const [, row] of held.entries()) {
+        await this.sharing.revoke(String(row.id), SYSTEM_CTX);
+        pass.grantsRevoked += 1;
+      }
       return pass;
     }