Issue #2237: Cover acl update in partial payload

Add a test proving an acl carried by the partial document is kept
and merged: on update acl behaves like any other field, while the
default acl stays a creation-only concern. Correct the default-acl
test comment and drop the now-misleading acl note from the
buildBulkOperations javadoc.

Co-Authored-By: Claude Opus 4.8 from Anthropic via Claude Code

Author: mrk-vi

core/app/datasource/src/main/java/io/openk9/datasource/pipeline/actor/PartialUpdateWriter.java

@@ -118,8 +118,7 @@ public Receive<Writer.Command> createReceive() {
 
 	/**
 	 * Builds one update operation for each document id, all merging
-	 * the same partial document. No default acl is added: the acl
-	 * field is a creation-only concern.
+	 * the same partial document.
 	 *
 	 * @param indexName the index holding the documents
 	 * @param documentIds the ids of the documents to update

core/app/datasource/src/test/java/io/openk9/datasource/pipeline/actor/PartialUpdateWriterTest.java

@@ -46,6 +46,9 @@ class PartialUpdateWriterTest {
 
 	static byte[] jsonArray = "[]".getBytes();
 
+	static byte[] partialWithAcl =
+		"{\"contentId\":\"content-1\",\"acl\":{\"public\":false}}".getBytes();
+
 	@Test
 	void should_update_single_document_with_partial_fields() {
 		// classic enrich pipeline: one indexed document for the contentId
@@ -105,13 +108,21 @@ void should_build_no_operations_when_no_documents_match() {
 
 	@Test
 	void should_not_add_default_acl_on_update() {
-		// the default acl is a creation-only concern:
-		// a partial update must not touch it.
+		// the default acl is injected only at creation:
+		// when the payload omits acl, the update adds none.
 		var partial = PartialUpdateWriter.preparePartialDocument(partialDocument);
 
 		Assertions.assertFalse(partial.containsKey("acl"));
 	}
 
+	@Test
+	void should_update_acl_when_present_in_partial_document() {
+		// an acl carried by the partial document is applied, not stripped
+		var partial = PartialUpdateWriter.preparePartialDocument(partialWithAcl);
+
+		Assertions.assertEquals(Map.of("public", false), partial.get("acl"));
+	}
+
 	@Test
 	void should_strip_null_fields_and_type_from_partial_document() {
 		var partial = PartialUpdateWriter.preparePartialDocument(partialDocument);