feat(plugin-security)!: under single, Setup positions are written through to the environment ledger, and row-only positions are backfilled once (ADR-0131 D3, C2 stage S7) (#22388)

Part of #15196
Clause-②: no (narrowing)

ADR-0131 D3, C2 stage S7. Built on the seat's re-rule of the card
(comment 6070208925: Q1 = A, Q2 = A, Q3 = A) after the measurement round
(os-dev-report 6070148106), and on the seat note that keeps the Q2
stand-down while #22360 changes the declared-position seeder.

Not touched: every position reader (the read switch is S8),
`packages/core`, `packages/spec`, the row `active` flag, S2's built-in
declarations, the permission-set write-through, and
`bootstrap-declared-positions.ts`. Walled postures behave exactly as
before; the walled gap is #22361.

## What changes, under `single`

| Setup write on `sys_position` | Before | After |
|:--|:--|:--|
| create | row only; the catalog read does not resolve it | row first,
then the definition `{ name, label, description, delegatable }` saved
through the metadata door at environment scope; the catalog read
resolves it at once |
| edit (label, description, delegatable) | row only | row, then the
definition saved again from the row |
| `active` / `is_default` only | row only | unchanged: row only |
| rename | row only | row, then the new name's definition saved and the
old name's deleted |
| delete | row only | row, then the definition; a failed definition
delete is logged at `error` with its remedy |
| create, or rename into, a name the metadata door refuses | `201` /
`200` | the door's own refusal (`400 INVALID_REQUEST` at the item-name
grammar, `422 INVALID_METADATA` at `PositionSchema.name`); the row write
is undone, nothing is kept (Q1 = A) |
| edit of a row already carrying such a name | `200` | unchanged: a row
write, no definition (Q1 = A's control) |
| a name a package or a built-in holds | row only | unchanged: the
write-through stands down and writes nothing to metadata, read from the
engine registry's artifact provenance (Q2 = A) |
| system write, walled posture, kernel without a metadata door | row
only | unchanged |

A metadata refusal of a legal name also undoes the row write (create) or
restores the patched columns (edit), and the refusal is the answer. No
reader changes, so a user holding a position is granted exactly what
they were granted before (pinned below against a kernel with no metadata
door).

**The package door (Q3 = A, within Q4 = A).** Once a Setup position is
defined in the environment ledger, a package registering a position of
the same name is refused `422 NAMESPACE_CONFLICT`, naming both holders.
Before this change the same registration was accepted. The changeset
says so.

**The one-time backfill.** `runOneTimePositionEnvironmentBackfill`, at
`kernel:bootstrapped` beside the S4b grant-name backfill, under `single`
only. Every position name the security catalog read does not resolve
gets a definition from its row through the metadata door, verified
through the catalog read afterwards. A name the environment ledger, a
package or a built-in declares is left alone. A name the door refuses is
a final class, reported at `warn` and never written. Rows of one name
that disagree are reported at `error` and not written. The verdict row
(`sys_migration`, id `adr-0131-position-environment-backfill`) is
written only when every name is decided; a failure leaves it unrecorded
and the next boot retries. Its writer `persistPositionBackfillRecord`
joins the durability gate's critical list. The hook is
`kernel:bootstrapped` because an environment definition minted ahead of
a package's declaration of the same name would refuse that package
(measured at the registry item seam).

## Measured before the build (objectstack `1cb0edb82d`, showcase,
`single`)

- A Setup create answered `201` and wrote a row and nothing else: no
`sys_metadata` row, and the catalog read did not resolve it. Edit,
rename, deactivate and delete likewise touched only the row. The data
door accepted names in seven classes (uppercase, a space, a hyphen, a
leading digit, a leading underscore, one character, a dot) that the
metadata door refuses.
- No position projector exists: a metadata-door save of a position gets
its row only at the next boot, from the declared-position seeder.
- A fresh showcase has no row-only position after S2; one Setup create
adds exactly that one.

## Pins and ablations

`packages/plugins/plugin-security/src/position-write-through.test.ts`,
30 tests. They use a real ObjectQL engine over the SQL driver, the real
`SecurityPlugin`, and the real `ObjectStackProtocolImplementation`
(aliased to source) writing real `sys_metadata` rows.

- **Red on main.** `security-plugin.ts` restored to the base
(`3f80f17167`), so nothing is registered: 18 red, 12 green. The 12 green
are the controls (walled posture, system write, no door, a built-in
refused at the admin door, the permission-set write-through unchanged,
the Q1 edit control, the door's own `NOT_OVERRIDABLE`) and the
backfill's module-level cases. The restore was proven: blob equals HEAD,
and `git diff HEAD` is empty.
- **Ablations.** Each was run through `scripts/ablation-replace.mjs`,
with the anchor hit once, the blob changed and the restore proven. Each
turned exactly its own pins red:
  - backfill wiring removed: the census pin and the rerun pin;
  - the stand-down removed: the Q2 stand-down pin;
- insert undo removed: the six refused-name creates and the refused
legal create;
  - Q1 control removed: the illegal-name edit control;
- the definition delete removed: the delete pin and the delete-failure
pin;
  - the rename's old-name delete removed: the rename pin;
  - the row-state carve-out removed: the edit/deactivate pin;
- update undo removed: the refused rename pin and the edit-refusal
restore pin;
  - the refused-name class removed: the census, rerun and retry pins;
  - the conflict check removed: the conflict pin.
- **The Q2 stand-down is pinned at the write-through's own level.** It
calls the middleware with a package-held edit, a built-in create and a
package-held delete; all three are passed on, and nothing reaches
metadata. A control holds that a Setup-only name is written. The data
door's answer for a declared-position edit is not pinned, because #22360
flips it.
- **Dogfood.**
`packages/qa/dogfood/test/position-environment-write-through.dogfood.test.ts`,
6 tests on the real showcase. It covers a create that resolves, rename
and delete, the Q1 door refusals (`400 INVALID_REQUEST`, `422
INVALID_METADATA`), the Q3 `NAMESPACE_CONFLICT`, and the backfill across
three boots of one database.
- Ablation, the backfill skipped: wiring replaced, `plugin-security`
rebuilt, the marker proven present in `dist/` by
`ablation-dist-preflight`. The backfill pin goes red. The restore was
rebuilt, and the marker was proven absent with the tree clean.
- Red on main (`security-plugin.ts` at base, rebuilt, write-through
proven absent from `dist/`): every behaviour pin is red. The
precondition stays green, as does a Q2 data-door case that has since
been removed.
- **Goldens.** S5b's `grant-readers-by-name.golden.test.ts` is green in
`plugin-security` (also at `42f9c68085`) and in `plugin-auth`.

## Verification at HEAD `dbef39ca41`

This head merges `origin/main` after #22364 landed. It runs `pnpm
install --frozen-lockfile`, then rebuilds the dogfood closure (63
tasks).

- `pnpm --filter @objectstack/plugin-security run typecheck`: exit 0
(`check:test-typecheck: OK`).
- `plugin-security`, full suite: 188 files, 3925 passed, 45 skipped.
This includes the pin file, the S4b backfill file and S5b's
`grant-readers-by-name.golden.test.ts`.
- `plugin-auth`, full suite: 132 files, 2672 passed, 10 skipped. This
includes its `grant-readers-by-name.golden.test.ts`.
- The 22 dogfood files that write or read positions: 214 passed.
- `pnpm check:durability-log-level`: 44 critical seams, all loud. With
the verdict writer's `error` downgraded, it goes red, naming
`persistPositionBackfillRecord`.
- `node scripts/check-adr-0087-registration.mjs --base origin/main`: one
declared-breaking changeset, `not-required (no-migration-prescription)`.
- `check-changeset-no-major`, with this body as the event: `✓ LEVEL
AXIS: this PR declares clause-② no (narrowing), and no package whose
packages/**/src/** it moves is graded patch.`
- `check-tenant-audit-census` and `check-system-context-census`: OK at
this head.
- Lint, narrowed: `eslint --no-inline-config` over the 8 changed TS/MJS
files gives 0 errors and 0 warnings.
  - The 4 Markdown changes are outside eslint's globs.
- `eslint.config.mjs` enables no type-aware linting, so this diff cannot
move a verdict on an untouched file.
- Derived gates: 117 (`dispatch-gates --commands`). All 117 exited 0 at
`42f9c68085`, and `--ran` reconciled to 117 run, 0 unrun. They are
re-running at this head; the card report carries the verdict lines.

## Acceptance notes

- `content/docs/permissions/system-context.mdx` gains row 11b for the
write-through's `isSystem` read, and its counts were regenerated (`pnpm
gen:system-context-census`).
- The tenant-audit census was regenerated (`node
scripts/tenant-audit-census.mjs --write`). The page's hand-written prose
figures were updated to the census, as the census gate demands.
- `measure-durability-swallow-family.mjs` carries the vocabulary copy
for the new critical seam.
- S4b's boot-wiring pin now counts two `kernel:bootstrapped` handlers:
the grant-name backfill, then this one.
- Under `single` with several organizations, two Setup rows of one name
share one environment definition. The backfill refuses to guess when
they disagree. The write-through saves the definition from the row being
written.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01WkL6Eijt432S1Y7ekb6ovQ)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/15196-position-environment-write-through.md

@@ -0,0 +1,36 @@
+---
+'@objectstack/plugin-security': minor
+---
+
+feat(plugin-security)!: under `single`, a position created or edited in Setup is also written to the environment ledger, and positions Setup wrote earlier are backfilled into it once (ADR-0131 D3)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, export, type or stored shape is added, removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is a runtime write door: under the single posture, a sys_position create or rename whose name the metadata door refuses is now refused at the data door too, and the remedy is a different data value (the position's name), not a rewrite of anyone's code or metadata. The backfill writes environment definitions from rows; it converts no stored metadata shape. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and no TypeScript declaration moves (not runtime-interface-only or type-surface-only). -->
+
+**BREAKING** (an accept-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+ADR-0131 D3 gives positions one home, the environment registry. Under `single`, a position an administrator creates in Setup used to be a `sys_position` row only: no environment definition, so the security catalog read did not find it. Under `single`, every Setup create, edit, rename and delete of a position now also writes the position's definition through the metadata door, at environment scope.
+
+**What a Setup position write does now, under `single`.**
+
+- **Create.** The row is written as before, with the same checks: a required label, the reserved built-in names, and one name per organization. The definition `{ name, label, description, delegatable }` is then saved from that row as an environment item, and the security catalog read resolves it at once. `active` and `is_default` stay on the row only.
+- **Edit.** The row is updated, and the definition is saved again from it. A patch that touches only `active` or `is_default` writes the row and nothing else.
+- **Rename.** The new name's definition is saved, and the old name's definition is deleted.
+- **Delete.** The row is deleted, then the definition. If the definition delete fails, an error is logged that names the remedy, because the next boot would bring the position back from the surviving definition.
+- **Unchanged.** Under a walled posture, every write behaves as before. System writes (the seeders and the package door) are never translated. On a kernel without a metadata door, the row is written as before. For a position a package or a built-in declares, a Setup edit is written to the row exactly as before, and nothing is written to metadata.
+- **No grant changes.** Every reader still reads the row, so a user holding a position is granted exactly what they were granted before.
+
+**What stops being accepted.** Under `single`, the data door now refuses a create, or a rename into, a position name that the metadata door refuses. The refusal is the metadata door's own: `400 INVALID_REQUEST` for a name outside the item-name grammar (uppercase, a space, a hyphen, a leading digit or underscore), or `422 INVALID_METADATA` for a name `PositionSchema.name` refuses (a single character, a dot). No row is kept. `PositionSchema` already declared such names rejected, and a position named that way could never have a definition.
+
+- An edit of an existing row that already carries such a name is still accepted. It stays a row write, with no definition.
+- **Remedy.** Name the position in lowercase `snake_case`: it starts with a letter, is at least two characters, and holds letters, digits and underscores only. For example, write `sales_manager` instead of `Sales Manager`. Then re-point any assignment that names the old spelling.
+
+**One more refusal follows from the new definitions.** Positions, permission sets and capabilities hold one name per deployment. Once a Setup position is defined in the environment ledger, a package that registers a position under the same name is refused with `422 NAMESPACE_CONFLICT`, and the refusal names both holders. Before this change, the same registration was accepted.
+
+**The one-time backfill.** At `kernel:bootstrapped`, under `single`, every position whose name the security catalog read does not resolve gets an environment definition from its row. This covers positions Setup wrote before this release.
+
+- A name the environment ledger, a package or a built-in already declares is left alone.
+- A name the metadata door refuses is not written. It is reported at `warn`, with its remedy, as a final class.
+- If two rows of one name disagree, the name is reported at `error` and nothing is written for it.
+- When every name is decided, the verdict is recorded in `sys_migration` (`adr-0131-position-environment-backfill`). If a write fails or two rows disagree, the verdict is not recorded, and the next boot runs the pass again.

content/docs/permissions/system-context.mdx

@@ -10,7 +10,7 @@ the seed loader replaying package fixtures, a plugin's boot reconciler, a
 service self-write, a migration.
 
 This page is **the authority** for what that flag actually does. It exists
-because the flag is not one concept: it is a single boolean read at **120
+because the flag is not one concept: it is a single boolean read at **121
 distinct sites across 20 packages**, and knowing three of those behaviours gives
 no hint that the other hundred-and-four exist. Every documented app-side bug
 traced to `isSystem` had the same shape — the metadata was complete and correct,
@@ -108,6 +108,7 @@ that silently does not happen.
 | 9 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `packages/plugins/plugin-security/src/security-plugin.ts#explainAccessForCaller` |
 | 10 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `packages/core/src/security/anonymous-deny.ts#shouldDenyAnonymous` |
 | 11 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `packages/plugins/plugin-security/src/permission-set-projection.ts#createPermissionSetWriteThrough` |
+| 11b | Position write-through skipped — a `sys_position` write is not mirrored into the environment ledger | plugin-security | Get: the seeders and the package door write rows for definitions that already have their home, untouched. Lose: a system-written row has no environment definition, so the security catalog read does not resolve it until a data-door edit, or the one-time row-only position backfill, gives it one | `packages/plugins/plugin-security/src/position-write-through.ts#createPositionWriteThrough` |
 | 12 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `packages/plugins/plugin-auth/src/auth-plugin.ts#start` |
 | 13 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `packages/observability/src/perf-timing.ts#isPerfDisclosurePrincipal` |
 | 14 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `packages/plugins/plugin-security/src/permission-set-overlay-discard.ts#assertTenantAdmin` |
@@ -141,7 +142,7 @@ that silently does not happen.
 
 ### 3. Sharing (`plugin-sharing`)
 
-The largest single consumer — **17 of the 120 sites**.
+The largest single consumer — **17 of the 121 sites**.
 
 | # | Behaviour when `isSystem` | What you get / what you lose | Anchor |
 |:--|:---|:---|:---|
@@ -284,7 +285,7 @@ Ownership injection, `readonly` bypass and sharing materialisation are
 independent decisions, and a seed loader plausibly wants the first two but not
 the third. The concept is nevertheless **staying as one boolean**:
 
-- **Shipped semantics.** `isSystem` is a published contract with 120 read sites
+- **Shipped semantics.** `isSystem` is a published contract with 121 read sites
   in 20 packages. Splitting it is a breaking contract change across all of them.
   (The ruling was taken when the census read 80 sites in 18 packages; the count
   has grown, which strengthens rather than weakens the argument.)
@@ -358,16 +359,16 @@ still holds equal to the census on every pull request:
 | Appearances of the bare identifier `isSystem` in non-test sources | 813 | — |
 | — parsed as a declaration | 28 | ✅ |
 | — parsed as an object-literal / type key (producers and option objects) | 310 | — |
-| — parsed as a property **read** | 126 | ✅ |
+| — parsed as a property **read** | 127 | ✅ |
 | — parsed in some other syntactic position (a local, a cast, a conditional) | 9 | ✅ |
 | — the remainder: text inside comments and string literals | 358 | — |
 | Of those reads: reads of one of the unrelated metadata fields | 6 | ✅ |
-| Of those reads: reads of `ExecutionContext.isSystem` | **120** | ✅ |
-| — behaviour-bearing (rows 1–61 above) | 117 | ✅ |
+| Of those reads: reads of `ExecutionContext.isSystem` | **121** | ✅ |
+| — behaviour-bearing (rows 1–61 above) | 118 | ✅ |
 | — carry the flag onward only (rows 62–64 above) | 3 | ✅ |
 | Packages containing at least one elevation read | **20** | ✅ |
-| Files containing at least one elevation read | 56 | ✅ |
-| — the distinct symbols those reads live in — what this page anchors | 102 | ✅ |
+| Files containing at least one elevation read | 57 | ✅ |
+| — the distinct symbols those reads live in — what this page anchors | 103 | ✅ |
 | — of those files, the ones holding more than one read in one symbol | 8 | ✅ |
 
 The six rows marked — are a **dated decomposition, not a live claim**: they were
@@ -431,7 +432,7 @@ same resolver, and the same registration shape, that holds `docs/adr/**`.
 Renaming a symbol is now a loud red instead of a silent misdirection.
 
 ⚠️ **The precision that costs, priced here rather than buried.** A symbol anchor
-cannot say WHICH read inside a function it means, and **8** of the **56**
+cannot say WHICH read inside a function it means, and **8** of the **57**
 anchored files hold more than one read inside a single symbol. So the population
 check runs per file at symbol granularity: every file the census finds a read in
 must be anchored, and the set of symbols this page cites into that file must

content/docs/permissions/tenant-audit-census.mdx

@@ -83,7 +83,7 @@ what moved this page's population from 225 to 227; nothing about the two sites
 changed, only whether this instrument could see them.
 
 **The expensive failure direction is a keyword.** Sites whose receiver the author
-typed `any` have no type to read, and there are 51 of them — just over a fifth
+typed `any` have no type to read, and there are 53 of them — just over a fifth
 of the population, concentrated in exactly the seed and bootstrap paths this
 control exists for. Scoring an unreadable receiver as "not an engine" would have
 dropped every one of them silently, with a clean exit and a smaller number that
@@ -122,7 +122,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **53 of the 237 sites are spelled that way**. A
+forwarding shim cannot, and **53 of the 240 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -187,10 +187,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **237** |
+| 175 write call sites | quoted in the merged changeset | **240** |
 | 24 carrying no tenant context | quoted in the merged changeset | **2** provable and tenancy-enabled; **32** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **157 of 237** decidable, **80** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 125 decidably elevated, 0 decidably not, 104 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **159 of 240** decidable, **81** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 128 decidably elevated, 0 decidably not, 104 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -200,18 +200,18 @@ be stated is what this instrument counts, which is written above and re-runnable
 at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
-one, and both are counted in the generated tables below: the 51 sites reached
-through an erased (`any`) receiver, and the 50 that name their object through a
+one, and both are counted in the generated tables below: the 53 sites reached
+through an erased (`any`) receiver, and the 52 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-125 of 237 (53%) as decidably elevated, with 104 more whose elevation is a
+128 of 240 (53%) as decidably elevated, with 104 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `2 / 237`, and say what it is**: the sites whose options argument was
+⇒ **Cite `2 / 240`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **32 further sites** have an options argument this
@@ -223,31 +223,31 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **237** |
-| …whose object name is statically decidable | 157 |
-| …whose object name is chosen at run time | 80 |
-| …against an object with tenancy ENABLED | 156 |
+| write call sites on the application surface | **240** |
+| …whose object name is statically decidable | 159 |
+| …whose object name is chosen at run time | 81 |
+| …against an object with tenancy ENABLED | 158 |
 | …against an object that declares tenancy off | 1 |
-| threading a tenant context | 176 |
+| threading a tenant context | 179 |
 | PROVABLY carrying none (options read, no context key) | **8** |
 | …of those, against a decidably tenancy-enabled object | **2** |
 | options argument UNREADABLE — may or may not carry one | 53 |
 | …of those, against a decidably tenancy-enabled object | 32 |
-| threading a decidably ELEVATED (`isSystem`) context | 125 |
+| threading a decidably ELEVATED (`isSystem`) context | 128 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 104 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 186 |
-| receiver erased, placed by the object NAME | 31 |
+| receiver carried a readable engine type | 187 |
+| receiver erased, placed by the object NAME | 33 |
 | receiver erased, placed by an `object: string` PARAMETER | 15 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
 | object name spelled inline | 107 |
-| object name spelled through a `const` | 50 |
+| object name spelled through a `const` | 52 |
 | object name is an `object: string` parameter | 19 |
-| object name is some other run-time expression | 61 |
+| object name is some other run-time expression | 62 |
 
 ### Subtractions the census could NOT defend — enforced
 
@@ -297,12 +297,12 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-08 at `8e432893f`.
+Measured on 2026-10-08 at `715ba6f44`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 621 |
-| engine-shaped types recognised | 70 |
+| tracked non-test sources scanned | 623 |
+| engine-shaped types recognised | 71 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 162 |
 

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -33,17 +33,17 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 237 |
-| Object name statically decidable | 157 |
-| Object name chosen at run time | 80 |
-| Against a tenancy-enabled object | 156 |
+| Write call sites | 240 |
+| Object name statically decidable | 159 |
+| Object name chosen at run time | 81 |
+| Against a tenancy-enabled object | 158 |
 | Against an object declaring tenancy off | 1 |
-| Threading a tenant context | 176 |
+| Threading a tenant context | 179 |
 | Provably carrying none | 8 |
 | …and decidably tenancy-enabled | 2 |
 | Options argument unreadable | 53 |
 | …and decidably tenancy-enabled | 32 |
-| Threading a decidably elevated context | 125 |
+| Threading a decidably elevated context | 128 |
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 104 |
 
@@ -90,12 +90,12 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-08 at `8e432893f`.
+Measured on 2026-10-08 at `715ba6f44`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 621 |
-| engine-shaped types recognised | 70 |
+| tracked non-test sources scanned | 623 |
+| engine-shaped types recognised | 71 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 162 |
 
@@ -177,6 +177,9 @@ Measured on 2026-10-08 at `8e432893f`.
 | `packages/plugins/plugin-security/src/permission-set-projection.ts` | `insert` | `object` | undecidable | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-security/src/permission-set-projection.ts` | `update` | `object` | undecidable | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-security/src/permission-set-projection.ts` | `delete` | `sys_permission_set` | enabled | elevated | 1 |
+| `packages/plugins/plugin-security/src/position-environment-backfill.ts` | `insert` | `DATA_MIGRATION_FLAG_OBJECT` | undecidable | elevated | 1 |
+| `packages/plugins/plugin-security/src/position-write-through.ts` | `delete` | `sys_position` | enabled | elevated | 1 |
+| `packages/plugins/plugin-security/src/position-write-through.ts` | `update` | `sys_position` | enabled | elevated | 1 |
 | `packages/plugins/plugin-security/src/security-plugin.ts` | `insert` | `sys_position_permission_set` | enabled | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-security/src/suggested-audience-bindings.ts` | `delete` | `sys_audience_binding_suggestion` | enabled | context, elevation undecidable | 2 |
 | `packages/plugins/plugin-security/src/suggested-audience-bindings.ts` | `insert` | `sys_audience_binding_suggestion` | enabled | context, elevation undecidable | 1 |