wip: retired slot at four test callers; census and package counts follow the tree

Claude-Session: https://claude.ai/code/session_013RWUA7bNq5bRhehLPqXwMg
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/permissions/tenant-audit-census.mdx

@@ -121,7 +121,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **67 of the 227 sites are spelled that way**. A
+forwarding shim cannot, and **67 of the 218 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -186,10 +186,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **227** |
+| 175 write call sites | quoted in the merged changeset | **218** |
 | 24 carrying no tenant context | quoted in the merged changeset | **9** provable and tenancy-enabled; **34** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **153 of 227** decidable, **74** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 108 decidably elevated, 0 decidably not, 102 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **144 of 218** decidable, **74** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 99 decidably elevated, 0 decidably not, 102 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -206,11 +206,11 @@ would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-108 of 227 (48%) as decidably elevated, with 102 more whose elevation is a
+99 of 218 (45%) as decidably elevated, with 102 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `9 / 227`, and say what it is**: the sites whose options argument was
+⇒ **Cite `9 / 218`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **34 further sites** have an options argument this
@@ -222,28 +222,28 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **227** |
-| …whose object name is statically decidable | 153 |
+| write call sites on the application surface | **218** |
+| …whose object name is statically decidable | 144 |
 | …whose object name is chosen at run time | 74 |
-| …against an object with tenancy ENABLED | 152 |
+| …against an object with tenancy ENABLED | 143 |
 | …against an object that declares tenancy off | 1 |
-| threading a tenant context | 143 |
+| threading a tenant context | 134 |
 | PROVABLY carrying none (options read, no context key) | **17** |
 | …of those, against a decidably tenancy-enabled object | **9** |
 | options argument UNREADABLE — may or may not carry one | 67 |
 | …of those, against a decidably tenancy-enabled object | 34 |
-| threading a decidably ELEVATED (`isSystem`) context | 108 |
+| threading a decidably ELEVATED (`isSystem`) context | 99 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 102 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 183 |
+| receiver carried a readable engine type | 174 |
 | receiver erased, placed by the object NAME | 24 |
 | receiver erased, placed by an `object: string` PARAMETER | 15 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
-| object name spelled inline | 110 |
+| object name spelled inline | 101 |
 | object name spelled through a `const` | 43 |
 | object name is an `object: string` parameter | 17 |
 | object name is some other run-time expression | 57 |
@@ -296,13 +296,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-23 at `8f8828bf6`.
+Measured on 2026-09-25 at `62171c25e`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 576 |
-| engine-shaped types recognised | 63 |
-| declared objects in the registry | 117 |
+| tracked non-test sources scanned | 572 |
+| engine-shaped types recognised | 61 |
+| declared objects in the registry | 115 |
 | same-named calls subtracted as non-engine | 144 |
 
 {/* END GENERATED: tenant-audit-census */}

content/docs/protocol/backward-compatibility.mdx

@@ -111,7 +111,7 @@ Read the **Breaking?** column, not the version number: during the launch window
 1. **RFC (Request for Comments)** — Breaking changes are proposed as GitHub issues with the `protocol:breaking` label.
 2. **Deprecation** — The old behavior is deprecated in a MINOR release (see timeline above).
 3. **Migration Guide** — A detailed migration guide is published before the removal lands, in the release notes for the version that carries it.
-4. **Release** — During the launch window the breaking change ships in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`. `scripts/check-changeset-no-major.mjs` fails any pull request that declares a `major` bump, because under lockstep one `major` would promote all 70 published packages.
+4. **Release** — During the launch window the breaking change ships in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`. `scripts/check-changeset-no-major.mjs` fails any pull request that declares a `major` bump, because under lockstep one `major` would promote all 69 published packages.
 
 ---
 
@@ -189,7 +189,7 @@ The `@objectstack/spec` package provides additional stability guarantees:
 
 ### Which surfaces this covers
 
-**All of them.** This is not scoped to an experimental corner or a pre-release channel: all **70** packages published from this repository belong to a single Changesets `fixed` group, so they share one version number and one policy. No published surface is exempt.
+**All of them.** This is not scoped to an experimental corner or a pre-release channel: all **69** packages published from this repository belong to a single Changesets `fixed` group, so they share one version number and one policy. No published surface is exempt.
 
 The convention is enforced rather than informal — `scripts/check-changeset-no-major.mjs` fails any pull request that introduces a `major` bump, because under lockstep a single `major` on one package would promote the entire stack.
 

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -33,17 +33,17 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 227 |
-| Object name statically decidable | 153 |
+| Write call sites | 218 |
+| Object name statically decidable | 144 |
 | Object name chosen at run time | 74 |
-| Against a tenancy-enabled object | 152 |
+| Against a tenancy-enabled object | 143 |
 | Against an object declaring tenancy off | 1 |
-| Threading a tenant context | 143 |
+| Threading a tenant context | 134 |
 | Provably carrying none | 17 |
 | …and decidably tenancy-enabled | 9 |
 | Options argument unreadable | 67 |
 | …and decidably tenancy-enabled | 34 |
-| Threading a decidably elevated context | 108 |
+| Threading a decidably elevated context | 99 |
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 102 |
 
@@ -90,13 +90,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-23 at `8f8828bf6`.
+Measured on 2026-09-25 at `62171c25e`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 576 |
-| engine-shaped types recognised | 63 |
-| declared objects in the registry | 117 |
+| tracked non-test sources scanned | 572 |
+| engine-shaped types recognised | 61 |
+| declared objects in the registry | 115 |
 | same-named calls subtracted as non-engine | 144 |
 
 ## Every site
@@ -153,12 +153,6 @@ Measured on 2026-09-23 at `8f8828bf6`.
 | `packages/plugins/plugin-email/src/email-plugin.ts` | `insert` | `sys_email_template` | enabled | elevated | 1 |
 | `packages/plugins/plugin-email/src/email-plugin.ts` | `update` | `sys_email_template` | enabled | elevated | 1 |
 | `packages/plugins/plugin-pinyin-search/src/companion-projection.ts` | `update` | `schema.name` | undecidable | elevated | 1 |
-| `packages/plugins/plugin-reports/src/report-service.ts` | `delete` | `sys_report_schedule` | enabled | elevated | 2 |
-| `packages/plugins/plugin-reports/src/report-service.ts` | `insert` | `sys_report_schedule` | enabled | elevated | 1 |
-| `packages/plugins/plugin-reports/src/report-service.ts` | `update` | `sys_report_schedule` | enabled | elevated | 2 |
-| `packages/plugins/plugin-reports/src/report-service.ts` | `delete` | `sys_saved_report` | enabled | elevated | 1 |
-| `packages/plugins/plugin-reports/src/report-service.ts` | `insert` | `sys_saved_report` | enabled | elevated | 1 |
-| `packages/plugins/plugin-reports/src/report-service.ts` | `update` | `sys_saved_report` | enabled | elevated | 2 |
 | `packages/plugins/plugin-security/src/auto-org-admin-grant.ts` | `delete` | `object` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-security/src/auto-org-admin-grant.ts` | `insert` | `object` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-security/src/bootstrap-builtin-positions.ts` | `insert` | `object` | undecidable | context, elevation undecidable | 1 |

packages/rest/src/execctx-consumer-census.test.ts

@@ -190,7 +190,8 @@ function makeServer(protocol: any) {
     const provider = async () => anyService();
     const rs: any = new RestServer(
         server, protocol as any, {} as any, undefined, undefined, () => 'env_census',
-        provider, provider, provider, provider, provider, provider, provider,
+        // index 10 is the retired saved-report slot (#20102): typed `undefined`.
+        provider, provider, provider, provider, undefined, provider, provider,
         provider, provider, provider, () => true, provider, undefined, provider,
     );
     return { rs, table: server.table as Map<string, Handler> };

packages/rest/src/ui-view-environment-ownership.test.ts

@@ -186,7 +186,7 @@ function makeServer(kernelManager: RestKernelManager, defaultEnvironmentId: stri
         /*  8 objectQLProvider             */ provider,
         /*  9 emailServiceProvider         */ provider,
         /* 10 sharingServiceProvider       */ provider,
-        /* 11 reportsServiceProvider       */ provider,
+        /* 11 (retired saved-report slot)  */ undefined,
         /* 12 approvalsServiceProvider     */ provider,
         /* 13 sharingRulesServiceProvider  */ provider,
         /* 14 i18nServiceProvider          */ provider,

packages/rest/src/ui-view-route-identity.measurement.test.ts

@@ -118,7 +118,8 @@ function makeServer(protocol: any) {
         // covers this file, which is what turned that into a compile error
         // rather than a quietly different harness.
         server, protocol as any, {} as any, undefined, undefined, () => 'env_13214',
-        provider, provider, provider, provider, provider, provider, provider,
+        // index 10 is the retired saved-report slot (#20102): typed `undefined`.
+        provider, provider, provider, provider, undefined, provider, provider,
         provider, provider, provider, () => true, provider, undefined, provider,
     );
     return { rs, table: server.table as Map<string, Handler> };

packages/rest/src/ui-view-route-tenancy.measurement.test.ts

@@ -261,7 +261,7 @@ function makeServer(wiring: Wiring) {
         /*  8 objectQLProvider             */ provider,
         /*  9 emailServiceProvider         */ provider,
         /* 10 sharingServiceProvider       */ provider,
-        /* 11 reportsServiceProvider       */ provider,
+        /* 11 (retired saved-report slot)  */ undefined,
         /* 12 approvalsServiceProvider     */ provider,
         /* 13 sharingRulesServiceProvider  */ provider,
         /* 14 i18nServiceProvider          */ provider,

packages/spec/llms.txt

@@ -178,9 +178,9 @@ function registerObject(rawConfig: unknown) {
 
 ---
 
-## 7. Package Ecosystem (69 packages)
+## 7. Package Ecosystem (68 packages)
 
-The workspace publishes 69 packages under the `@objectstack` scope. The table
+The workspace publishes 68 packages under the `@objectstack` scope. The table
 below is a curated entry-point list, not the full set — drivers, connectors,
 triggers, plugins and kernel-managed services each form their own family.
 

scripts/publish-smoke-pack.mjs

@@ -33,7 +33,7 @@
  * a future exclusion cannot re-open the hole silently.
  *
  * Source of truth: the workspace itself. The Changesets `fixed` group in
- * .changeset/config.json enumerates the same 70 names, but it is a DERIVED
+ * .changeset/config.json enumerates the same 69 names, but it is a DERIVED
  * declaration validated against the workspace by scripts/check-changeset-fixed.mjs
  * (which reddens both when a public package is missing from the group and
  * when a group name no longer exists) — deriving from the group would mean