test(dogfood): identify the demotion history row by what it records, not its position (#4586)

The Dogfood Regression Gate failed on this file's own new assertion:

    expected '{"role":"admin"}' to contain 'member'

Not a defect in what `trackHistory` stores — the audit writer's `update` leg
writes a CHANGED-FIELDS DIFF, `old_value` the before-state and `new_value` the
after-state (`diff()` in `audit-writers.ts` fills both halves), so a demotion
really is recorded as `{"role":"admin"}` → `{"role":"member"}`. The audit
question "who changed X from member to admin" was already answerable; #4586
adds WHO to a row that already knew WHAT.

The defect was the TEST's row SELECTION. It took `rows[rows.length - 1]` as
"the newest row", which is wrong twice over:

  1. `find` without an explicit sort is unordered, so the last element is not
     the newest anything;
  2. the audit row lands ASYNCHRONOUSLY after the endpoint returns, so at the
     moment the demotion test polled, the only `update` row present was the
     PROMOTION from the earlier test — and it asserted the demotion's
     expectation against it.

Locally green, red in CI, because `packages/qa/dogfood` sits outside the
`--filter` scope the change was verified under.

`waitForHistoryMatching` now waits for the row that says the thing under test,
so both hazards are gone. The demotion case additionally pins the pair
(`old_value` admin → `new_value` member) and asserts the promotion survives as
a DISTINCT row keeping its own actor.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012C2cd7tL8QDoZ2QKN3djJ5

Author: claude

packages/qa/dogfood/test/membership-actor-attribution.dogfood.test.ts

@@ -57,7 +57,7 @@ async function waitForMembership(ql: any, userId: string): Promise<any> {
   throw new Error(`no sys_member row appeared for ${userId}`);
 }
 
-/** Audit rows this stack wrote for one `sys_member` row, newest last. */
+/** Audit rows this stack wrote for one `sys_member` row. */
 async function memberHistory(ql: any, memberId: string, action?: string): Promise<any[]> {
   const rows = await findRows(
     ql,
@@ -68,13 +68,38 @@ async function memberHistory(ql: any, memberId: string, action?: string): Promis
   return action ? rows.filter((r: any) => r.action === action) : rows;
 }
 
-async function waitForHistory(ql: any, memberId: string, action: string): Promise<any> {
+/**
+ * Wait for the history row that records a SPECIFIC transition, identified by
+ * what it says rather than by its position.
+ *
+ * Selecting "the last row" is wrong twice over here: `find` is unordered
+ * without an explicit sort, and — the trap this file walked into — the audit
+ * row lands ASYNCHRONOUSLY after the endpoint returns, so a promote/demote
+ * pair polled by count alone happily returns the *previous* transition and
+ * asserts against it. Matching on the row's own `new_value` is immune to both.
+ *
+ * On `action: 'update'` the audit writer stores a CHANGED-FIELDS DIFF: the
+ * before-state in `old_value`, the after-state in `new_value` (a demotion is
+ * `old_value {"role":"admin"}` → `new_value {"role":"member"}`). Both halves
+ * are recorded — this change adds WHO to a row that already knew WHAT.
+ */
+async function waitForHistoryMatching(
+  ql: any,
+  memberId: string,
+  action: string,
+  matches: (row: any) => boolean,
+  what = action,
+): Promise<any> {
   for (let i = 0; i < 20; i++) {
-    const rows = await memberHistory(ql, memberId, action);
-    if (rows.length > 0) return rows[rows.length - 1];
+    const hit = (await memberHistory(ql, memberId, action)).find(matches);
+    if (hit) return hit;
     await new Promise((r) => setTimeout(r, 250));
   }
-  throw new Error(`no '${action}' history row appeared for sys_member ${memberId}`);
+  throw new Error(`no '${what}' history row appeared for sys_member ${memberId}`);
+}
+
+async function waitForHistory(ql: any, memberId: string, action: string): Promise<any> {
+  return waitForHistoryMatching(ql, memberId, action, () => true);
 }
 
 describe('#4586: the better-auth actor reaches sys_member history and the grant', () => {
@@ -246,12 +271,31 @@ describe('#4586: the better-auth actor reaches sys_member history and the grant'
     const [row] = await findRows(ql, 'sys_member', { id: memberRowId }, 1);
     expect(row.role).toBe('member');
 
-    const updates = await memberHistory(ql, memberRowId, 'update');
-    const demotion = updates[updates.length - 1];
+    // Identify the demotion row by what it RECORDS, not by its position: the
+    // promotion row is already there, and the new row lands asynchronously.
+    const demotion = await waitForHistoryMatching(
+      ql,
+      memberRowId,
+      'update',
+      (r) => String(r.new_value).includes('member'),
+      'demotion',
+    );
+    // The pair the diff actually stores: admin → member.
+    expect(String(demotion.old_value)).toContain('admin');
     expect(String(demotion.new_value)).toContain('member');
     // Attribution works in both directions — taking authority away is exactly
     // as answerable as handing it out.
     expect(demotion.user_id).toBe(adminUserId);
+    // …and it is a DISTINCT row from the promotion, which keeps its own actor.
+    const promotion = await waitForHistoryMatching(
+      ql,
+      memberRowId,
+      'update',
+      (r) => String(r.new_value).includes('admin'),
+      'promotion',
+    );
+    expect(String(promotion.id)).not.toBe(String(demotion.id));
+    expect(promotion.user_id).toBe(adminUserId);
 
     // NOTE: whether the org-admin GRANT is revoked on demotion is deliberately
     // not asserted here. It currently is not — `auto-org-admin-grant`'s only