Keep platform bootstrap permissions additive

tests/test_me_bootstrap.py

@@ -218,6 +218,21 @@ def test_platform_admin_uses_admin_profiles_without_relying_on_profile_super_adm
     assert payload["permissions"]["can_create_school"] is True
 
 
+def test_platform_admin_membership_role_does_not_reduce_platform_permissions():
+    payload = build(credentials={"sub": USER_ID, "email": "[email protected]"}, tables={
+        "profiles": [profile(user_type="student")],
+        "admin_profiles": [{"id": USER_ID, "admin_role": "owner", "is_super_admin": True}],
+        "institute_memberships": [membership(INST_A, "student")],
+        "institutes": [institute()],
+    })
+
+    assert payload["school_status"] == "platform_admin"
+    assert payload["permissions"]["platform_admin"] is True
+    assert payload["permissions"]["can_manage_school"] is True
+    assert payload["permissions"]["can_manage_calendar"] is True
+    assert payload["permissions"]["can_view_student_data"] is True
+
+
 def test_neo4j_probe_failure_does_not_block_supabase_bootstrap_state():
     def failing_probe(**_kwargs):
         raise RuntimeError("connection refused with host details that must not leak")