Filed unassigned and ungraded by the domain:engine execution seat. ⛔ domain:*, priority and type are triage's.
Replaces #14924, which was closed not planned: that card's thesis (the census had drifted) is false. This card carries the two grains from it that survive re-measurement, and ⭐ neither needs any drift to motivate it.
The census is currently CORRECT — that is the control, not a counter-argument
packages/objectql/src/tenancy/platform-object-tenancy.ts:32-37 states 84 total / 25 outside the machinery / 59 in reach. Measured twice independently (PR #14923's contract reviewer, and that PR's fix round using the engine's own resolveTenantFieldName against the registered schema — after applySystemFields, since the injected organization_id column is what the engine actually sees): 84 / 25 / 59. The header is right as it stands.
⇒ ⛔ Nothing here asks for the numbers to be changed.
Grain 1 — the parenthetical mis-attributes the exclusion
The header explains the 25 as "(24 managedBy: better-auth, plus sys_sso_provider's tenancy.enabled: false)". Measured: all 25 out-of-reach objects are managedBy: 'better-auth'. sys_sso_provider is one of them, not an addition on top — and sys_api_key also carries tenancy.enabled: false and is not named.
⚠️ The arithmetic 24 + 1 = 25 is nonetheless right, which is why no gate and no reader has caught it. It is a wrong reason producing a right total — the shape that survives longest.
Grain 2 — ⭐ the real finding: nothing holds this prose to the tree
The census is a count asserted in a comment. No gate re-derives it, so it is true only until the population moves, and it fails silently when it does. The repo already demonstrates the re-derivable shape for exactly this kind of claim: scripts/tenant-audit-census.mjs + its committed page + its gate.
⚠️ This card's own predecessor is the evidence. A hand-written census produced a confident, wrong, cited number, which then spawned #14924 against a correct file. Two independent re-measurements were spent establishing that the file was fine. That is the cost of an ungated count, paid once already:
- the wrong number reached a PR body and a filed card before anyone re-derived it;
- both the reviewer and the fix round had to re-measure from scratch to disprove it;
- and the mechanism that made it wrong (counting
managedBy as if the resolver read it) is invisible in the prose, because the prose states a conclusion and not a predicate.
⇒ A re-derivable census would have failed loudly on the first wrong count instead of being argued about across three documents.
What a fix would need to decide (⛔ not prescribed)
- Whether the census belongs in a script + committed artifact + gate (the
tenant-audit-census.mjs shape), or whether the header should stop asserting a count at all and point at the machine-readable source.
- ⚠️ Whichever is chosen, the predicate matters more than the total: the failure here was that "in the machinery's reach" is
resolveTenantFieldName answering non-null on the registered schema, and the prose does not say so. A gate that re-derives the number without stating the predicate would recreate the same trap with fresher digits.
Re-check
git show origin/main:packages/objectql/src/tenancy/platform-object-tenancy.ts | sed -n '25,45p'
git grep -n "managedBy: 'better-auth'" origin/main -- packages/platform-objects/src | wc -l
ls scripts/tenant-audit-census.mjs
Dedup — declared WEAK
⚠️ search_issues free-text is recorded in #14743 as returning 0 for terms present in open issue titles, with incomplete_results: false, so ⛔ a zero from it supports no negative. Re-run with a keyword pass before acting on absence.
Refs: #14924 (closed not planned — the false-premise predecessor) · #13636 / PR #14923 (where both re-measurements were taken) · #13491 (the classification the census describes).
Filed unassigned and ungraded by the
domain:engineexecution seat. ⛔domain:*, priority and type are triage's.Replaces #14924, which was closed not planned: that card's thesis (the census had drifted) is false. This card carries the two grains from it that survive re-measurement, and ⭐ neither needs any drift to motivate it.
The census is currently CORRECT — that is the control, not a counter-argument
packages/objectql/src/tenancy/platform-object-tenancy.ts:32-37states 84 total / 25 outside the machinery / 59 in reach. Measured twice independently (PR #14923's contract reviewer, and that PR's fix round using the engine's ownresolveTenantFieldNameagainst the registered schema — afterapplySystemFields, since the injectedorganization_idcolumn is what the engine actually sees): 84 / 25 / 59. The header is right as it stands.⇒ ⛔ Nothing here asks for the numbers to be changed.
Grain 1 — the parenthetical mis-attributes the exclusion
The header explains the 25 as "(24
managedBy: better-auth, plussys_sso_provider'stenancy.enabled: false)". Measured: all 25 out-of-reach objects aremanagedBy: 'better-auth'.sys_sso_provideris one of them, not an addition on top — andsys_api_keyalso carriestenancy.enabled: falseand is not named.24 + 1 = 25is nonetheless right, which is why no gate and no reader has caught it. It is a wrong reason producing a right total — the shape that survives longest.Grain 2 — ⭐ the real finding: nothing holds this prose to the tree
The census is a count asserted in a comment. No gate re-derives it, so it is true only until the population moves, and it fails silently when it does. The repo already demonstrates the re-derivable shape for exactly this kind of claim:
scripts/tenant-audit-census.mjs+ its committed page + its gate.managedByas if the resolver read it) is invisible in the prose, because the prose states a conclusion and not a predicate.⇒ A re-derivable census would have failed loudly on the first wrong count instead of being argued about across three documents.
What a fix would need to decide (⛔ not prescribed)
tenant-audit-census.mjsshape), or whether the header should stop asserting a count at all and point at the machine-readable source.resolveTenantFieldNameanswering non-null on the registered schema, and the prose does not say so. A gate that re-derives the number without stating the predicate would recreate the same trap with fresher digits.Re-check
Dedup — declared WEAK
search_issuesfree-text is recorded in #14743 as returning 0 for terms present in open issue titles, withincomplete_results: false, so ⛔ a zero from it supports no negative. Re-run with a keyword pass before acting on absence.Refs: #14924 (closed not planned — the false-premise predecessor) · #13636 / PR #14923 (where both re-measurements were taken) · #13491 (the classification the census describes).