Skip to content

Commit 466d88e

Browse files
committed
docs(architecture): accept content type quota accounting
Record the maintainer's explicit choice before implementing the shared registration guard. Count distinct nondeleted custom keys, share revision slots, exclude the built-in card and serialize tenant-wide admission. ADR: 0021
1 parent 617ed08 commit 466d88e

3 files changed

Lines changed: 18 additions & 12 deletions

File tree

‎docs/architecture/32-tenant-customization-model.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -664,8 +664,8 @@ limit that was exceeded. They are deliberately generous — they exist to stop
664664
pathological documents, not to constrain reasonable authoring. The content-type
665665
count is an outstanding exception: its entitlement keys exist, but registration
666666
does not yet enforce them. The
667-
[quota accounting proposal](../roadmap/phase-04-cms-media-pages.md#content-type-quota-accounting--proposal-2026-10-19)
668-
states the pending counting decision and required concurrency proof.
667+
[accepted quota accounting](../roadmap/phase-04-cms-media-pages.md#content-type-quota-accounting--accepted-2026-10-19)
668+
states the maintainer's counting decision and required concurrency proof.
669669

670670
| Limit | Value | Why this one |
671671
|---|---|---|

‎docs/roadmap/phase-02b-events-auth.md‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11132,7 +11132,7 @@ these test corrections.
1113211132
### Additional verification and evidence reconciliation (2026-10-19)
1113311133

1113411134
**Status: local corrections and both independent review rounds complete;
11135-
quota accounting choice and renewed source qualification pending.**
11135+
approved quota implementation and renewed source qualification pending.**
1113611136
This pass retains existing ADRs, durable-state authority and phase boundaries.
1113711137

1113811138
#### Previously qualified source and retained evidence
@@ -11182,7 +11182,7 @@ subsequent corrections.
1118211182
| Dependency/comment drift | Remove the unused audit-adapter MediatR reference; align its catalogue/coordinator description, Next patch comment, middleware XML summary and P02b-5 authentication owner. |
1118311183
| Moving CI action tags and scanner admission | Pin all 39 uses to seven reviewed upstream commits; future updates require review. Go already uses its checksum database; additionally require exact module and go.mod hashes before scanner installation. Keep aggregate upload identity exact and reject a tag or substituted commit. |
1118411184
| ADR comparison silently skips an unresolved base | Require the actual PR base SHA, push predecessor or explicit manual base, and refuse an unresolved base or failed diff. Require the SARIF artifact instead of warning when absent. |
11185-
| Plan-gated content-type count is unenforced | Confirmed pre-existing gap. Correct the absolute enforcement claim; the linked quota proposal makes revision/default/deletion accounting and a tenant-wide concurrency proof explicit before implementing a commercial rule. |
11185+
| Plan-gated content-type count is unenforced | Confirmed pre-existing gap. The maintainer approves distinct nondeleted custom keys, shared revision slots, excluded card default and last-live-revision deletion releasing capacity; the shared writer must serialize count/insert tenant-wide. Approval precedes implementation. |
1118611186
| Broken ADR-0038 anchor | Standards 13 already provides the exact `adr-amendments` HTML alias. The accepted record is not edited. |
1118711187
| Historical SQL copies or loose-then-tightened policies should be folded | Up/Down snapshots preserve versioned rollout and reversal. Current canonical bodies have parity proofs; no historical migration is folded or made dependent on mutable SQL. |
1118811188
| Vendor installer leaves search_path set | Pinned Install.v23.sql ends with RESET search_path. No session-setting change. |
@@ -11209,7 +11209,7 @@ does the actual production-manifest test. The 51 combined shard controls, seven
1120911209
ADR lifecycle controls and seven new supply-chain controls pass. The real scanner
1121011210
installation verifies both pinned sums and its resulting Go module metadata;
1121111211
actionlint accepts the pinned workflow. The quota proposal remains non-runtime
11212-
and awaits the maintainer's accounting choice.
11212+
and was awaiting the maintainer's accounting choice at this source.
1121311213

1121411214
**Additional review round 1.** Two fresh independent reviewers examine
1121511215
`62ad318c..cd69bbc6` across backend/contract tests and CI/dependency/evidence
@@ -11234,6 +11234,12 @@ SHA admission and its mutation controls remain. Parent verification also passes
1123411234
All 512 relative links in the changed documents resolve, including HTML aliases.
1123511235
No reviewer claims full hosted qualification for this corrected source.
1123611236

11237+
**Quota acceptance.** The maintainer explicitly selects the proposed accounting
11238+
on 2026-10-19; its
11239+
[accepted rule](phase-04-cms-media-pages.md#content-type-quota-accounting--accepted-2026-10-19)
11240+
precedes the shared-writer change. No new ADR or unapproved counting policy is
11241+
introduced. Runtime implementation and its two independent review rounds follow.
11242+
1123711243
## Completion Criteria
1123811244

1123911245
Each criterion below is observable: a named test can pass or fail on it. Criteria whose

‎docs/roadmap/phase-04-cms-media-pages.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -113,24 +113,24 @@ Also in scope:
113113
- Whether a customization change owes an integration event, per
114114
[the Customization spec § Integration-event catalogue](../modules/customization/README.md#integration-event-catalogue).
115115

116-
### Content-type quota accounting — proposal (2026-10-19)
116+
### Content-type quota accounting — accepted (2026-10-19)
117117

118-
**Decision pending.** The existing registration command does not enforce
118+
**Accepted — 2026-10-19, @cemil.** The maintainer approved the accounting below
119+
before implementation. The existing registration command does not yet enforce
119120
`LimitKeys.MaxCustomContentTypes`; the registered key alone is not a write-time
120-
quota. Resolve this accounting rule before adding enforcement to that command,
121-
rather than letting an implementation silently choose its commercial meaning.
121+
quota. The correction implements this rule in that shared writer.
122122

123-
The proposed rule counts distinct, nondeleted, tenant-authored content-type keys.
123+
The rule counts distinct, nondeleted, tenant-authored content-type keys.
124124
Schema revisions share one slot; the built-in `card` definition uses none. A soft
125125
deletion frees a slot only when no nondeleted revision of that custom key remains.
126126
The unlimited entitlement or a limit of `-1` removes the ceiling; zero permits
127127
no new custom key. Existing revisions remain writable at the ceiling. A new key's
128128
count and insert serialize under one tenant-wide transaction advisory lock;
129129
per-key locks alone cannot prevent two different keys exceeding the quota.
130130

131-
Acceptance must include refusal/allowance controls, revision/default/deletion
131+
Implementation must include refusal/allowance controls, revision/default/deletion
132132
accounting, tenant isolation and a real concurrent PostgreSQL count/insert proof.
133-
This proposal changes no runtime behavior or accepted entitlement decision.
133+
Approval alone does not claim runtime enforcement or passing qualification.
134134

135135
### Customization Key Shape and Immutable Schema Versions
136136

0 commit comments

Comments
 (0)