docs(permissions): re-certify the tenant-audit census at 218 write call sites (#14333)

`ObjectStoreSuspendedRunStore.claimSuspension` adds exactly one write call
site on the application surface — the conditional `delete` that decides the
cross-replica advance — so the shrink-only census the gate holds the tree to
moves 217 -> 218. Regenerated with `node scripts/tenant-audit-census.mjs
--write`, and the nine hand-written prose figures the generator does not own
updated by hand to match.

Measured pre-existing state, so the delta is attributable: with these three
sources reverted to the merge base and the census restored to HEAD, the gate
is green at 217 — this PR moves it by exactly one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Author: claude

content/docs/permissions/tenant-audit-census.mdx

@@ -98,7 +98,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **67 of the 217 sites are spelled that way**. A
+forwarding shim cannot, and **67 of the 218 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -147,10 +147,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **217** |
+| 175 write call sites | quoted in the merged changeset | **218** |
 | 24 carrying no tenant context | quoted in the merged changeset | **9** provable and tenancy-enabled; **32** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **145 of 217** decidable, **72** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 99 decidably elevated, 0 decidably not, 101 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **146 of 218** decidable, **72** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 100 decidably elevated, 0 decidably not, 101 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -161,17 +161,17 @@ at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
 one, and both are counted in the generated tables below: the 45 sites reached
-through an erased (`any`) receiver, and the 37 that name their object through a
+through an erased (`any`) receiver, and the 38 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-99 of 217 (45%) as decidably elevated, with 101 more whose elevation is a
+100 of 218 (46%) as decidably elevated, with 101 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `9 / 217`, and say what it is**: the sites whose options argument was
+⇒ **Cite `9 / 218`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **32 further sites** have an options argument this
@@ -183,29 +183,29 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **217** |
-| …whose object name is statically decidable | 145 |
+| write call sites on the application surface | **218** |
+| …whose object name is statically decidable | 146 |
 | …whose object name is chosen at run time | 72 |
-| …against an object with tenancy ENABLED | 145 |
+| …against an object with tenancy ENABLED | 146 |
 | …against an object that declares tenancy off | 0 |
-| threading a tenant context | 133 |
+| threading a tenant context | 134 |
 | PROVABLY carrying none (options read, no context key) | **17** |
 | …of those, against a decidably tenancy-enabled object | **9** |
 | options argument UNREADABLE — may or may not carry one | 67 |
 | …of those, against a decidably tenancy-enabled object | 32 |
-| threading a decidably ELEVATED (`isSystem`) context | 99 |
+| threading a decidably ELEVATED (`isSystem`) context | 100 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 101 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 172 |
+| receiver carried a readable engine type | 173 |
 | receiver erased, placed by the object NAME | 19 |
 | receiver erased, placed by an `object: string` PARAMETER | 15 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 11 |
 
 | object name spelled inline | 108 |
-| object name spelled through a `const` | 37 |
+| object name spelled through a `const` | 38 |
 | object name is an `object: string` parameter | 19 |
 | object name is some other run-time expression | 53 |
 
@@ -224,13 +224,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-01 at `d3ebf3b55`.
+Measured on 2026-09-02 at `5daab8df0`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 534 |
+| tracked non-test sources scanned | 539 |
 | engine-shaped types recognised | 56 |
 | declared objects in the registry | 297 |
-| same-named calls subtracted as non-engine | 119 |
+| same-named calls subtracted as non-engine | 130 |
 
 {/* END GENERATED: tenant-audit-census */}

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -29,17 +29,17 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 217 |
-| Object name statically decidable | 145 |
+| Write call sites | 218 |
+| Object name statically decidable | 146 |
 | Object name chosen at run time | 72 |
-| Against a tenancy-enabled object | 145 |
+| Against a tenancy-enabled object | 146 |
 | Against an object declaring tenancy off | 0 |
-| Threading a tenant context | 133 |
+| Threading a tenant context | 134 |
 | Provably carrying none | 17 |
 | …and decidably tenancy-enabled | 9 |
 | Options argument unreadable | 67 |
 | …and decidably tenancy-enabled | 32 |
-| Threading a decidably elevated context | 99 |
+| Threading a decidably elevated context | 100 |
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 101 |
 
@@ -52,14 +52,14 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-01 at `d3ebf3b55`.
+Measured on 2026-09-02 at `5daab8df0`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 534 |
+| tracked non-test sources scanned | 539 |
 | engine-shaped types recognised | 56 |
 | declared objects in the registry | 297 |
-| same-named calls subtracted as non-engine | 119 |
+| same-named calls subtracted as non-engine | 130 |
 
 ## Every site
 
@@ -158,7 +158,7 @@ Measured on 2026-09-01 at `d3ebf3b55`.
 | `packages/services/service-automation/src/builtin/crud-nodes.ts` | `insert` | `objectName` | undecidable | context, elevation undecidable | 1 |
 | `packages/services/service-automation/src/builtin/crud-nodes.ts` | `update` | `objectName` | undecidable | context, elevation undecidable | 1 |
 | `packages/services/service-automation/src/flow-dispatch-store.ts` | `insert` | `sys_flow_dispatch` | enabled | elevated | 1 |
-| `packages/services/service-automation/src/suspended-run-store.ts` | `delete` | `sys_automation_run` | enabled | elevated | 2 |
+| `packages/services/service-automation/src/suspended-run-store.ts` | `delete` | `sys_automation_run` | enabled | elevated | 3 |
 | `packages/services/service-automation/src/suspended-run-store.ts` | `insert` | `sys_automation_run` | enabled | elevated | 2 |
 | `packages/services/service-automation/src/suspended-run-store.ts` | `update` | `sys_automation_run` | enabled | elevated | 2 |
 | `packages/services/service-datasource/src/datasource-admin-plugin.ts` | `delete` | `sys_metadata` | enabled | PROVABLY NONE | 1 |