chore(census): tenant-audit census and route-ledger count for the device registry

The registry adds five engine write call sites (260, from 255) and the
route ledger ten rows (126, from 116); both regenerated by their writers,
with the hand-written figures on the census page moved to match.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ADHkmRD9KKqvTU3THnute6

Author: claude

content/docs/permissions/tenant-audit-census.mdx

@@ -132,7 +132,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **51 of the 255 sites are spelled that way**. A
+forwarding shim cannot, and **55 of the 260 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -160,8 +160,8 @@ now **0**: nothing on this surface threads a context that provably lacks the fla
 
 **"No tenant context" counted sites it had not read.** An options argument the
 walker could not parse was folded into the same bucket as one it had read and
-found empty. That published **59 sites "carrying no tenant context at all"**
-when 8 said so and 51 were simply unread — an over-claim in the *alarming*
+found empty. That published **63 sites "carrying no tenant context at all"**
+when 8 said so and 55 were simply unread — an over-claim in the *alarming*
 direction, on the very figure this page tells other cards to cite. `carries` is
 now three-valued, and an unreadable argument can never contribute to the
 provable count.
@@ -197,10 +197,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **255** |
+| 175 write call sites | quoted in the merged changeset | **260** |
 | 24 carrying no tenant context | quoted in the merged changeset | **2** provable and tenancy-enabled; **29** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **177 of 255** decidable, **78** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 145 decidably elevated, 0 decidably not, 102 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **182 of 260** decidable, **78** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 146 decidably elevated, 0 decidably not, 106 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -211,17 +211,17 @@ at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
 one, and both are counted in the generated tables below: the 62 sites reached
-through an erased (`any`) receiver, and the 61 that name their object through a
+through an erased (`any`) receiver, and the 66 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-145 of 255 (57%) as decidably elevated, with 102 more whose elevation is a
+146 of 260 (56%) as decidably elevated, with 106 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `2 / 255`, and say what it is**: the sites whose options argument was
+⇒ **Cite `2 / 260`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **29 further sites** have an options argument this
@@ -233,29 +233,29 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **255** |
-| …whose object name is statically decidable | 177 |
+| write call sites on the application surface | **260** |
+| …whose object name is statically decidable | 182 |
 | …whose object name is chosen at run time | 78 |
 | …against an object with tenancy ENABLED | 176 |
-| …against an object that declares tenancy off | 1 |
-| threading a tenant context | 196 |
+| …against an object that declares tenancy off | 6 |
+| threading a tenant context | 197 |
 | PROVABLY carrying none (options read, no context key) | **8** |
 | …of those, against a decidably tenancy-enabled object | **2** |
-| options argument UNREADABLE — may or may not carry one | 51 |
+| options argument UNREADABLE — may or may not carry one | 55 |
 | …of those, against a decidably tenancy-enabled object | 29 |
-| threading a decidably ELEVATED (`isSystem`) context | 145 |
+| threading a decidably ELEVATED (`isSystem`) context | 146 |
 | threading a context that is decidably NOT elevated | 0 |
-| threading a context whose elevation is a run-time fact | 102 |
+| threading a context whose elevation is a run-time fact | 106 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 193 |
+| receiver carried a readable engine type | 198 |
 | receiver erased, placed by the object NAME | 52 |
 | receiver erased, placed by an `object: string` PARAMETER | 5 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
 | object name spelled inline | 116 |
-| object name spelled through a `const` | 61 |
+| object name spelled through a `const` | 66 |
 | object name is an `object: string` parameter | 7 |
 | object name is some other run-time expression | 71 |
 
@@ -307,13 +307,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-31 at `d06a02507`.
+Measured on 2026-11-02 at `9a369d6ed`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 830 |
-| engine-shaped types recognised | 96 |
-| declared objects in the registry | 124 |
-| same-named calls subtracted as non-engine | 214 |
+| tracked non-test sources scanned | 851 |
+| engine-shaped types recognised | 98 |
+| declared objects in the registry | 125 |
+| same-named calls subtracted as non-engine | 227 |
 
 {/* END GENERATED: tenant-audit-census */}

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -33,19 +33,19 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 255 |
-| Object name statically decidable | 177 |
+| Write call sites | 260 |
+| Object name statically decidable | 182 |
 | Object name chosen at run time | 78 |
 | Against a tenancy-enabled object | 176 |
-| Against an object declaring tenancy off | 1 |
-| Threading a tenant context | 196 |
+| Against an object declaring tenancy off | 6 |
+| Threading a tenant context | 197 |
 | Provably carrying none | 8 |
 | …and decidably tenancy-enabled | 2 |
-| Options argument unreadable | 51 |
+| Options argument unreadable | 55 |
 | …and decidably tenancy-enabled | 29 |
-| Threading a decidably elevated context | 145 |
+| Threading a decidably elevated context | 146 |
 | Threading a decidably non-elevated context | 0 |
-| Threading a context of undecidable elevation | 102 |
+| Threading a context of undecidable elevation | 106 |
 
 ## Subtractions the census could NOT defend — enforced
 
@@ -90,14 +90,14 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-31 at `d06a02507`.
+Measured on 2026-11-02 at `9a369d6ed`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 830 |
-| engine-shaped types recognised | 96 |
-| declared objects in the registry | 124 |
-| same-named calls subtracted as non-engine | 214 |
+| tracked non-test sources scanned | 851 |
+| engine-shaped types recognised | 98 |
+| declared objects in the registry | 125 |
+| same-named calls subtracted as non-engine | 227 |
 
 ## Every site
 
@@ -232,6 +232,9 @@ Measured on 2026-10-31 at `d06a02507`.
 | `packages/services/service-mailbox/src/ingest/mail-ingest-service.ts` | `insert` | `MAIL_MESSAGE_OBJECT` | undecidable | elevated | 1 |
 | `packages/services/service-mailbox/src/ingest/mail-ingest-service.ts` | `update` | `MAIL_MESSAGE_OBJECT` | undecidable | elevated | 1 |
 | `packages/services/service-mailbox/src/sync/mailbox-sync-service.ts` | `update` | `MAILBOX_OBJECT` | undecidable | elevated | 1 |
+| `packages/services/service-messaging/src/device-registry.ts` | `delete` | `sys_user_device` | disabled | options unreadable | 2 |
+| `packages/services/service-messaging/src/device-registry.ts` | `insert` | `sys_user_device` | disabled | elevated | 1 |
+| `packages/services/service-messaging/src/device-registry.ts` | `update` | `sys_user_device` | disabled | options unreadable | 2 |
 | `packages/services/service-messaging/src/inbox-channel.ts` | `insert` | `objectName` | undecidable | context, elevation undecidable | 1 |
 | `packages/services/service-messaging/src/inbox-channel.ts` | `insert` | `receiptObject` | undecidable | context, elevation undecidable | 1 |
 | `packages/services/service-messaging/src/messaging-service.ts` | `insert` | `RECEIPT_OBJECT` | undecidable | context, elevation undecidable | 1 |

packages/runtime/src/route-ledger.ts

@@ -301,7 +301,7 @@ export const NON_DISPATCH_MOUNT_PREFIXES = [
 /**
  * The ledger.
  *
- * CENSUS (generated): this list holds 116 rows.
+ * CENSUS (generated): this list holds 126 rows.
  *
  * ⛔ THAT NUMBER IS WRITTEN BY A TOOL — never by hand.
  * `pnpm check:route-ledger-census` counts the rows below and fails when the two