Skip to content

Commit 6d5cd47

Browse files
claudeclaude
committed
chore: regenerate tenancy and tenant-audit censuses, erasure baseline; the es-ES ledger drops the retired leaf
Claude-Session: https://claude.ai/code/session_01LAi5BVvQNiYzepSAcsoFLK Co-authored-by: Claude <noreply@anthropic.com>
1 parent 1137107 commit 6d5cd47

6 files changed

Lines changed: 41 additions & 26 deletions

File tree

‎content/docs/permissions/tenant-audit-census.mdx‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ are reported as `undecidable` rather than assumed either way.
122122

123123
The same holds twice over for the context. An options argument spelled as a
124124
literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
125-
forwarding shim cannot, and **54 of the 233 sites are spelled that way**. A
125+
forwarding shim cannot, and **52 of the 233 sites are spelled that way**. A
126126
context resolved from an inline literal or a local `const` can be tested for
127127
`isSystem`; one arriving from a helper call cannot.
128128

@@ -150,8 +150,8 @@ now **0**: nothing on this surface threads a context that provably lacks the fla
150150

151151
**"No tenant context" counted sites it had not read.** An options argument the
152152
walker could not parse was folded into the same bucket as one it had read and
153-
found empty. That published **62 sites "carrying no tenant context at all"**
154-
when 8 said so and 54 were simply unread — an over-claim in the *alarming*
153+
found empty. That published **60 sites "carrying no tenant context at all"**
154+
when 8 said so and 52 were simply unread — an over-claim in the *alarming*
155155
direction, on the very figure this page tells other cards to cite. `carries` is
156156
now three-valued, and an unreadable argument can never contribute to the
157157
provable count.
@@ -228,10 +228,10 @@ cannot read, and they are neither in nor out.
228228
| …whose object name is chosen at run time | 78 |
229229
| …against an object with tenancy ENABLED | 154 |
230230
| …against an object that declares tenancy off | 1 |
231-
| threading a tenant context | 171 |
231+
| threading a tenant context | 173 |
232232
| PROVABLY carrying none (options read, no context key) | **8** |
233233
| …of those, against a decidably tenancy-enabled object | **2** |
234-
| options argument UNREADABLE — may or may not carry one | 54 |
234+
| options argument UNREADABLE — may or may not carry one | 52 |
235235
| …of those, against a decidably tenancy-enabled object | 31 |
236236
| threading a decidably ELEVATED (`isSystem`) context | 123 |
237237
| threading a context that is decidably NOT elevated | 0 |
@@ -297,13 +297,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
297297
their values are not compared. The reasoning, and the measurement behind it,
298298
are in `scripts/check-tenant-audit-census.mjs`.
299299

300-
Measured on 2026-10-07 at `e1171ca48`.
300+
Measured on 2026-10-08 at `113710735`.
301301

302302
| corpus scale (not enforced) | count |
303303
| :--- | ---: |
304-
| tracked non-test sources scanned | 612 |
304+
| tracked non-test sources scanned | 613 |
305305
| engine-shaped types recognised | 70 |
306-
| declared objects in the registry | 116 |
306+
| declared objects in the registry | 117 |
307307
| same-named calls subtracted as non-engine | 160 |
308308

309309
{/* END GENERATED: tenant-audit-census */}

‎docs/audits/2026-08-tenant-audit-write-call-sites.counts.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
3838
| Object name chosen at run time | 78 |
3939
| Against a tenancy-enabled object | 154 |
4040
| Against an object declaring tenancy off | 1 |
41-
| Threading a tenant context | 171 |
41+
| Threading a tenant context | 173 |
4242
| Provably carrying none | 8 |
4343
| …and decidably tenancy-enabled | 2 |
44-
| Options argument unreadable | 54 |
44+
| Options argument unreadable | 52 |
4545
| …and decidably tenancy-enabled | 31 |
4646
| Threading a decidably elevated context | 123 |
4747
| Threading a decidably non-elevated context | 0 |
@@ -90,13 +90,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
9090
their values are not compared. The reasoning, and the measurement behind it,
9191
are in `scripts/check-tenant-audit-census.mjs`.
9292

93-
Measured on 2026-10-07 at `e1171ca48`.
93+
Measured on 2026-10-08 at `113710735`.
9494

9595
| corpus scale (not enforced) | count |
9696
| :--- | ---: |
97-
| tracked non-test sources scanned | 612 |
97+
| tracked non-test sources scanned | 613 |
9898
| engine-shaped types recognised | 70 |
99-
| declared objects in the registry | 116 |
99+
| declared objects in the registry | 117 |
100100
| same-named calls subtracted as non-engine | 160 |
101101

102102
## Every site
@@ -238,8 +238,8 @@ Measured on 2026-10-07 at `e1171ca48`.
238238
| `packages/services/service-settings/src/settings-service-plugin.ts` | `insert` | `sys_secret` | enabled | elevated | 1 |
239239
| `packages/services/service-settings/src/settings-service-plugin.ts` | `update` | `sys_secret` | enabled | elevated | 1 |
240240
| `packages/services/service-settings/src/settings-service-plugin.ts` | `insert` | `sys_setting_audit` | enabled | elevated | 1 |
241-
| `packages/services/service-settings/src/settings-service.ts` | `insert` | `this.objectName` | undecidable | options unreadable | 1 |
242-
| `packages/services/service-settings/src/settings-service.ts` | `update` | `this.objectName` | undecidable | options unreadable | 1 |
241+
| `packages/services/service-settings/src/settings-service.ts` | `insert` | `object` | undecidable | context, elevation undecidable | 1 |
242+
| `packages/services/service-settings/src/settings-service.ts` | `update` | `object` | undecidable | context, elevation undecidable | 1 |
243243
| `packages/services/service-storage/src/attachment-lifecycle.ts` | `update` | `sys_file` | enabled | elevated | 3 |
244244
| `packages/services/service-storage/src/backfill-file-references.ts` | `update` | `object` | undecidable | options unreadable | 1 |
245245
| `packages/services/service-storage/src/backfill-file-references.ts` | `update` | `object` | undecidable | elevated | 1 |

‎packages/platform-objects/src/apps/translations/objects-es-es-echo-decisions.test.ts‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,9 @@
5151
// Since that walk, the seven `sys_account._actions.link_social` provider-brand
5252
// rows (Google through Discord) left this ledger together with the action,
5353
// retired under ADR-0049 enforce-or-remove (#21849): the bundle no longer
54-
// carries those leaves, so the ledger below holds 47 echoes.
54+
// carries those leaves, so the ledger held 47 echoes. Then the `global` option
55+
// of `sys_setting.scope` left with the settings cascade's global rung
56+
// (ADR-0131 D7): the ledger below holds 46.
5557
//
5658
// ## What this file deliberately does NOT assert
5759
//
@@ -178,7 +180,6 @@ const DECISIONS: readonly Decision[] = [
178180
echo('sys_notification.fields.actor_id.label', 'Actor', SAME_WORD_ACTOR),
179181
echo('sys_metadata_audit.fields.actor.label', 'Actor', SAME_WORD_ACTOR),
180182
echo('sys_setting_audit.fields.actor_id.label', 'Actor', SAME_WORD_ACTOR),
181-
echo('sys_setting.fields.scope.options.global', 'Global', SAME_WORD_GLOBAL),
182183
echo('sys_setting_audit.fields.scope.options.global', 'Global', SAME_WORD_GLOBAL),
183184
echo('sys_email_template.fields.variables_json.label', 'Variables (JSON)', SAME_WORD_VARIABLES),
184185

@@ -237,10 +238,13 @@ function undeclaredEchoes(rows: readonly Decision[]): string[] {
237238
}
238239

239240
describe('#20493 es-ES — the ledger itself (controls before verdicts)', () => {
240-
it('is the size it claims: 3 pinned translations and 47 declared echoes, no path twice', () => {
241-
expect(DECISIONS.length).toBe(50);
241+
// [ADR-0131 D7] 47 → 46 echoes: `sys_setting.scope` no longer declares the
242+
// `global` option (the rung moved to `sys_platform_setting`), so its leaf left
243+
// the catalog with it. `sys_setting_audit.scope`'s `global` option stays.
244+
it('is the size it claims: 3 pinned translations and 46 declared echoes, no path twice', () => {
245+
expect(DECISIONS.length).toBe(49);
242246
expect(DECISIONS.filter((d) => d.verdict === 'translate').length).toBe(3);
243-
expect(DECISIONS.filter((d) => d.verdict === 'echo').length).toBe(47);
247+
expect(DECISIONS.filter((d) => d.verdict === 'echo').length).toBe(46);
244248
expect(new Set(DECISIONS.map((d) => d.path)).size).toBe(DECISIONS.length);
245249
});
246250

‎packages/services/service-settings/src/settings-global-rung.test.ts‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,10 @@ function makeMemoryDriver() {
8686
async connect() {}, async disconnect() {}, async checkHealth() { return true; },
8787
async execute() { return null; },
8888
async find(object: string, ast: any) {
89-
const hits = [...rowsOf(object).values()].filter((r) => matches(r, ast?.where)).map(copy);
90-
return typeof ast?.limit === 'number' ? hits.slice(0, ast.limit) : hits;
89+
// The caller's bound by PRESENCE, after the filter and before the copy.
90+
const hits = [...rowsOf(object).values()].filter((r) => matches(r, ast?.where));
91+
const page = typeof ast?.limit === 'number' ? hits.slice(0, ast.limit) : hits;
92+
return page.map(copy);
9193
},
9294
async findOne(object: string, ast: any) {
9395
for (const r of rowsOf(object).values()) if (matches(r, ast?.where)) return copy(r);

‎scripts/platform-object-tenancy-census.json‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,13 @@
2424
"predicate": "resolveTenantFieldName(registered schema) !== null, where the registered schema is the authored schema plus the columns resolveInjectedSystemColumns says the registration injects (the applySystemFields pass). Both functions are loaded from source and executed; neither is re-spelled here.",
2525
"population": "every object registered by a tracked packages/**/*.object.ts module whose name carries a platform prefix (sys_ / cloud_ / ai_). The cloud repository's own cloud_ objects are not in this tree and so not in this census.",
2626
"totals": {
27-
"registered": 83,
27+
"registered": 84,
2828
"inReach": 50,
29-
"outOfReach": 33
29+
"outOfReach": 34
3030
},
3131
"reasonTotals": {
3232
"managedBy: 'better-auth'": 25,
33-
"systemFields.tenant: false": 8,
33+
"systemFields.tenant: false": 9,
3434
"tenancy.enabled: false": 2
3535
},
3636
"unexplained": [],
@@ -449,6 +449,15 @@
449449
"tenantField": "organization_id",
450450
"reasons": []
451451
},
452+
{
453+
"name": "sys_platform_setting",
454+
"file": "packages/platform-objects/src/system/sys-platform-setting.object.ts",
455+
"reach": "out",
456+
"tenantField": null,
457+
"reasons": [
458+
"systemFields.tenant: false"
459+
]
460+
},
452461
{
453462
"name": "sys_position",
454463
"file": "packages/plugins/plugin-security/src/objects/sys-position.object.ts",

‎scripts/query-options-erasure-baseline.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
"packages/runtime/src/action-execution.ts": 1,
4848
"packages/runtime/src/domains/share-links.ts": 3,
4949
"packages/runtime/src/http-dispatcher.ts": 1,
50-
"packages/services/service-settings/src/settings-service.ts": 2
50+
"packages/services/service-settings/src/settings-service.ts": 1
5151
},
5252
"testSurface": {
5353
"sites": 236

0 commit comments

Comments
 (0)