Tenant-audit census — tenancy write call sites

SqlDriver.auditMissingTenant() is the platform's one diagnostic on write-side tenancy. It warns when a write lands on a tenancy-enabled object without options.tenantId — the shape of a seed, migration or background path that forgot to thread the acting session.

This page is the authority for the population that control acts on: every write call site on the application surface, what object it targets, and what execution context it threads. The figures below are generated, not written — rebuilt from the tree by scripts/tenant-audit-census.mjs, and scripts/check-tenant-audit-census.mjs fails the build when what is committed and what the tree says disagree.

The per-site rows live next door, in docs/audits/2026-08-tenant-audit-write-call-sites.counts.md, and are written by the same command. The split is the one packages/spec's strictness ledger already uses and is there for the same reason: this page has prose worth preserving and the row table has none, so the table is regenerated whole while the page keeps a small generated region for the figures its prose reasons about.

⚠️ Why this page exists at all

The measurement this page carries used to live in a comment on an issue. That issue became unreachable — it returns 404 on unauthenticated REST, on the rendered web page and on authenticated API access alike, while its immediate neighbours answer 200 — and it took the census with it. Three open cards named that comment as their input, and nothing anywhere noticed that their input had gone.

What survived did so by luck. A changeset author had happened to quote two of the figures in prose, so "175 write call sites, 24 of them carrying no tenant context" is still readable on main in .changeset/tenant-audit-update-delete-half-repairs.md — while the list of 24 that a downstream card was briefed to classify is not recoverable at all.

⇒ A census that decides a repair family's severity and a ruling's scope is not a comment. It is a re-runnable instrument plus a committed page. Losing any issue now costs nothing, and the population is re-derivable rather than quoted.

What the control does, and what a call site controls

auditMissingTenant(object, op, options) is gated in this order:

1. OS_TENANT_AUDIT=0 — off entirely;
2. options.bypassTenantAudit — the engine sets this for every ExecutionContext.isSystem write (ObjectQL's buildDriverOptions);
3. a present options.tenantId — the engine fills it from execCtx.tenantId;
4. the deployment posture — the warning is only meaningful on a walled install;
5. the object having a tenant field.

Both of the guards a caller can move are downstream of one decision at the call site: whether it threads an execution context at all. Thread an elevated one and guard 2 silences the warning; thread a tenant-bearing one and guard 3 does; thread none and the site is what this census counts.

How the population is decided

A site is a call to one of the three IDataEngine write doors — insert, update, delete — on a receiver whose declared type is an engine, in tracked non-test sources under packages/services/ and packages/plugins/.

The verb name is not the signal. .delete() alone answers some 250 call sites in this corpus, and most of them are Map.delete, Set.delete, Headers.delete, a crypto Hash.update, a blob-storage delete-by-key and a search-index de-index. So the receiver is typed structurally: a declared interface or type literal counts as an engine when it declares a write door whose first parameter is named object / objectName / objectApiName / name and typed string — the IDataEngine door signature. Interfaces that extend one inherit it; aliases that narrow one (Partial<Pick<IDataEngine, …>>) carry it.

That rule is read off the TYPE, not off the type's name. The engine type index is keyed on declaration names, so a receiver whose declared type is an inline type literal has no name to look up — and for two sites, both writing under { context: { isSystem: true } }, that alone subtracted a real engine write from this population while the census printed the type text and said the subtraction was probably wrong. The same door rule is now read off the type text itself, so an unnamed type that states a write door places its site. That is what moved this page's population from 225 to 227; nothing about the two sites changed, only whether this instrument could see them.

The expensive failure direction is a keyword. Sites whose receiver the author typed any have no type to read, and there are 38 of them — just under a fifth of the population, concentrated in exactly the seed and bootstrap paths this control exists for. Scoring an unreadable receiver as "not an engine" would have dropped every one of them silently, with a clean exit and a smaller number that reads exactly like a smaller truth. So any is not a classification here: it goes to the unreadable pile, and the unreadable pile is placed by facts about the tree (the argument names a declared object; the argument is a parameter declared object: string) or by a written UNTYPED_RECEIVERS row. An unreadable receiver that none of the three place is an error, never a default.

Tenancy itself is enabled by default — isTenancyDisabled() reads tenancy.enabled === false and nothing else — so the object registry only has to find the opt-outs. Across 117 declared objects — the dated, ⛔ unenforced corpus-scale figure below — exactly two opt out (sys_api_key, sys_sso_provider), and exactly one write call site on this surface targets either — plugin-auth's legacy client-secret migration writes sys_sso_provider under an elevated context. That is the declares tenancy off row below reading 1 rather than 0: the object is outside this control's reach by its own declaration, not by the census failing to see the write.

A declared object here is a top-level object declaration in a *.object.ts(x) file — export const X = ObjectSchema.create({ name: … }) — and ⛔ never a literal nested inside one. The distinction is not cosmetic: the same name: key spells a grid column identity (inlineColumns), a validation rule id, an action, a list view and an index, and this name set is what places an any-typed receiver's write call, so counting those would widen the predicate that decides whether a site is placed at all.

⛔ What this instrument cannot decide

A site whose object name is an inline literal or a local const is statically decidable. A site whose name is a parameter or a field — ql.insert(object, …) inside a shared seed helper, this.objectName on a per-object service — is not, and no amount of AST work makes it so: the object is chosen at run time. Those are reported as undecidable rather than assumed either way.

The same holds twice over for the context. An options argument spelled as a literal can be read; one spelled options, { ...opts }, or handed through a forwarding shim cannot, and 53 of the 225 sites are spelled that way. A context resolved from an inline literal or a local const can be tested for isSystem; one arriving from a helper call cannot.

⇒ A third of this population is undecidable in one dimension or another, and that is reported rather than smoothed over. A census that quietly guessed on those sites would publish a number in the one direction this page cannot survive — claiming completeness while short — and a gate seeded from it would then hold the page to it.

⚠️ Two over-claims this instrument made, and what they cost

Both were found by the drift gate firing on this page's own artifact, and both are recorded here rather than quietly corrected, because the numbers they moved were published first.

The elevation classifier read a spread as a denial. It walked an object literal's named properties looking for isSystem and returned "not elevated" when the loop ended — so { ...SYSTEM_CTX } was scored decidably NOT elevated while every SYSTEM_CTX in the tree is { isSystem: true, … }. It also never unwrapped as const, so a bare context: SYSTEM_CTX read as undecidable. Fixing both moved 51 sites' verdicts: 45 from undecidable to elevated, and 6 from decidably not elevated to elevated — an inversion, on a security-relevant classification. The count of decidably-not-elevated sites is now 0: nothing on this surface threads a context that provably lacks the flag.

"No tenant context" counted sites it had not read. An options argument the walker could not parse was folded into the same bucket as one it had read and found empty. That published 61 sites "carrying no tenant context at all" when 8 said so and 53 were simply unread — an over-claim in the alarming direction, on the very figure this page tells other cards to cite. carries is now three-valued, and an unreadable argument can never contribute to the provable count.

A door rule keyed on names read an unnamed door as no door. Two receivers typed with an inline type literal that spells insert / update with an object: string first parameter were subtracted from the population — by the same instrument that printed their type text on every run and called the subtraction probably wrong. Placing them moved the population 225 → 227 and the elevated count 106 → 108. ⭐ It moved the provable yield surface (9) not at all: both sites thread an elevated context, and one of them targets a tenancy-opt-out object. The repair is to the denominator and to what this page can be read as having examined — ⛔ not to the count anything cites as a violation. It is pinned in both directions, because a rule that placed every inline literal would be the same failure mirrored: an unnamed type that states a write door places its site, one that states none is still a subtraction that says why, and an indexed type name beside an inline literal still wins and reports itself.

⭐ All three are the same shape as the failure this artefact exists for, wearing different hats: one scored an unread thing as nothing to report, one scored an unread thing as a finding, and one scored a thing it had read and printed as outside its own population. node scripts/check-tenant-audit-census.mjs --self-test pins the first two — 18 classifier cases, 6 of which red against the old reading — driven from the gate's own self-test rather than from a flag on the generator.

⭐ Deviations from the carried figures, untrimmed

Four figures were carried forward from the lost census. They are control inputs for this re-derivation, not targets, and this instrument was not shaped to reproduce them. Where it disagrees, it disagrees on the page:

The differences are not reconciled, and deliberately so. The old census's population definition is not recoverable — that is the whole reason this page exists — so no honest reading can attribute the gap to a specific cause. What can be stated is what this instrument counts, which is written above and re-runnable at any commit.

Two structural facts do plausibly widen this reading against any hand or regex one, and both are counted in the generated tables below: the 38 sites reached through an erased (any) receiver, and the 50 that name their object through a const rather than inline. An instrument that read either the way a person does would report a smaller number and would not say so.

The fourth row is the one worth flagging to anyone citing it. The 135 / 77% figure has no surviving corroboration anywhere in the tree. This census reads 121 of 225 (54%) as decidably elevated, with 96 more whose elevation is a run-time fact — so the claim is neither confirmed nor refuted, and the honest answer is that a static reading cannot settle it.

⇒ Cite 2 / 225, and say what it is: the sites whose options argument was READ and holds no tenant context, against a decidably tenancy-enabled object. That is the control's provable yield surface. ⛔ Do not cite it as "the sites without tenant context" — 32 further sites have an options argument this cannot read, and they are neither in nor out.

The measurement

| object name spelled inline | 104 | | object name spelled through a const | 50 | | object name is an object: string parameter | 7 | | object name is some other run-time expression | 64 |

Subtractions the census could NOT defend — enforced

A same-named call on something that is not a data engine is subtracted, and the subtraction is DEFENSIBLE when this census can name why: the receiver is a node: builtin, a value it watched being constructed, a language global, a type THIS corpus declares and the door rule rejected, or an UNTYPED_RECEIVERS row.

⚠️ Counted below are the subtractions it can name no such fact for — the receiver carries a declared type the engine type index does not hold, and that index is built from TRACKED sources only, deliberately. An untracked, generated or dependency-owned declaration is one this census never saw, and «never saw it» must not be spelled the same way as «read it, not an engine».

⚠️ One arm here says something else again: type-text-not-round-trippable is a receiver whose declared type THIS TOOL derived and then could not read back — the source parsed, the re-serialisation of it did not, so the door rule could never be read off it. That is a fault in this tool rather than a fact about the corpus, and it is the one row here that also fails the gate.

⛔ The second row is 0 by construction, not a tally that happens to be low. An inline type literal stating a write door has no name for the engine type index to be keyed on, so the door rule is read off the type text itself and the site is PLACED — it is in the population above rather than subtracted here. A non-zero value on that row means a door-shaped receiver reached the subtraction anyway.

Every one of them is listed, by receiver and by the type text that could not be placed, in docs/audits/2026-08-tenant-audit-write-call-sites.counts.md.

The corpus walked is every tracked non-test source under packages/services/ and packages/plugins/; calls to a same-named method on something that is not a data engine were subtracted. Every site is listed in docs/audits/2026-08-tenant-audit-write-call-sites.counts.md, regenerated by the same command.

Corpus scale — present and dated, ⛔ NOT enforced

⛔ These four describe the CORPUS this census walked, not the population it certifies, and the gate deliberately does not hold them to the tree — a source file arriving anywhere under the two roots moves them while every verdict above holds still. They are required to be HERE and to say WHEN they were true; their values are not compared. The reasoning, and the measurement behind it, are in scripts/check-tenant-audit-census.mjs.

Measured on 2026-10-14 at 95898bba1.