@@ -681,11 +681,13 @@ export const CEILINGS = new Map([
   // headings); the row carried 2,727 tokens of headroom left by an earlier
   // shrink that nobody re-locked, so the TOC needed no raise. Pinned AT the
   // measurement — zero headroom, the ratchet's steady state.
-  // 10066 -> 10011: re-locked at the landed count. A `ctx.notice` row in the sandbox
-  // table and a `notice?` member in the HookContext listing (+95), paid by three
-  // same-file restatements: the reverse-engineering aside in the `body` intro, the
-  // `tenantId` blockquote (the listing comment and the two-axes note say both
-  // halves) and the `ctx.user` paragraph under the `??` line that shows it (-141).
+  // 10066 -> 10011: re-locked at the landed count (main measured 10056; the
+  // move is -45). A `ctx.notice` row in the sandbox table and a `notice?` member
+  // in the HookContext listing, paid by same-file restatements: the
+  // reverse-engineering aside in the `body` intro, the `tenantId` blockquote
+  // (its two halves live in the listing comment and the two-axes note, which
+  // now names the two `tenantId` symbols), the `ctx.user` paragraph under the
+  // `??` line that shows it, and the `session.roles` history clause.
   ['skills/objectstack-data/references/data-hooks.md', 10011],
   ['skills/objectstack-data/rules/datasources.md', 911],
   // -552 (was 3584): re-locked at the landed count (#16374) after PR #16187
 
@@ -358,13 +358,13 @@ The sandbox is handed a **JSON snapshot** of these (built by
 | `ctx.previous` | object \| `undefined` | Pre-write record on update/delete. **`undefined` on insert** → use `!ctx.previous` to detect *create*. |
 | `ctx.result` | object \| `undefined` | `after*` only. ⚠️ **partial** on afterUpdate — see gotcha 1. |
 | `ctx.user` | object \| `undefined` | `{ id, name, email, organizationId }`. `undefined` for system / unauthenticated writes. |
-| `ctx.session` | object \| `undefined` | `{ userId, organizationId, isSystem, … }`. **No role list** — `session.roles` was retired in 17.0.0: it was declared but never produced, so every read was `undefined`. |
+| `ctx.session` | object \| `undefined` | `{ userId, organizationId, isSystem, … }`. **No role list** — `session.roles` was retired in 17.0.0 (declared, never produced). |
 | `ctx.event` | string | e.g. `'afterUpdate'` — dispatch on it when one hook subscribes to several events. |
 | `ctx.object` | string | The target object name. |
 | `ctx.api` | object | Cross-object CRUD. Gated by `api.read` / `api.write` — see below. |
 | `ctx.log` | `{ debug, info, warn, error }` | Gated by `log`. Call **`ctx.log.info(msg, data?)`** — `ctx.log` is an **object, not** callable as `ctx.log(msg)`. Emission is **best-effort** (see Troubleshooting). |
 | `ctx.crypto` | `{ randomUUID }` | Gated by `crypto.uuid`. |
-| `ctx.notice` | `(message) => void` | **Tell the saver what this save set in motion** — answered as the create/update `notice`, shown on the save toast. No capability; insert/update only; last call wins. Rules: [`rules/lifecycle.md` § Save Notice](../rules/lifecycle.md#save-notice). |
+| `ctx.notice` | `(message) => void` | **Tell the saver what this save set in motion** — answered as the create/update `notice`, shown on the save toast. No capability; insert/update only; last call wins. [`rules/lifecycle.md` § Save Notice](../rules/lifecycle.md#save-notice). |
 | `ctx.title` | `(field?) => Promise<string \| null>` | **Name the record, not its id.** `ctx.title()` resolves this object's `nameField`, a **formula** included (no extra read); `ctx.title('account_id')` resolves a lookup's title (needs `api.read`). `null` when there is no title, never the id. **Per door:** `body` has it; a deprecated `handler` gets it at runtime, undeclared on `HookContext` (TS2339 when annotated) — use `body`; `ql.registerHook` and a bare `ObjectQL` `bindHooks` lack it. |
 
 (Action bodies additionally receive `ctx.recordId` and `ctx.record`, and their
@@ -598,7 +598,7 @@ interface HookContext {
   // Engine access
   ql: IDataEngine;       // ObjectQL engine instance
   api?: ScopedContext;   // Cross-object CRUD API
-  notice?: (message: string) => void; // Save notice — rules/lifecycle.md § Save Notice
+  notice?: (message: string) => void; // Save notice: rules/lifecycle.md § Save Notice
 
   // User info shortcut (undefined for system / unauthenticated writes)
   user?: {
@@ -630,7 +630,8 @@ const org = ctx.user?.organizationId ?? ctx.session?.organizationId;
 > ADR-0132). That is different from
 > **environment / database-per-tenant** isolation (`service-tenant`,
 > `driver-turso`), where "tenant" means an entire environment/database and the
-> generic driver-layer `tenantId` knob can carry that environment id. The
+> generic driver-layer `tenantId` knob (`execCtx.tenantId` / `DriverOptions.tenantId`)
+> can carry that environment id. The
 > object-metadata `tenancy.*` knob configures the *mechanism* (isolation on/off
 > + which column); the *value* you read and write is your `organization_id`
 > column. Under `single` the bootstrapped Default Organization is the only