docs: correct three statements the code contradicts

TenancyDbContext said `tenants` gets no query filter. It gets one of a different
shape — self-keyed, comparing `Id` rather than a `TenantId` column — which the
self-keyed branch in TenantQueryFilters has applied since Packet 7. One of the
eight entity types genuinely gets none, not two.

permissions.md named `tenancy.tenant.admin` as the key that will govern the host
mapping, while the matrix directly above gives `HostMapping` its own resource with
no `write`. The prose now names `tenancy.hostmapping.admin` and says why the
resource is separate: pointing a hostname at a tenant is an admin-scope act, not
something the everyday tenant-admin role should carry.

ADR-0036's Decision still prints the normalization order Amendment 1 measured as
wrong — rejecting IPv4 literals before stripping a port, which lets 1.2.3.4:8080
through because TryParse fails on the port-bearing string and never runs again.
The statement was false when it entered the record, so it takes the default
instrument: an inline erratum beside it, pointing at the amendment that corrects
it. The Decision is untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cemililik

backend/src/Modules/Tenancy/LearnStack.Modules.Tenancy.Infrastructure/Persistence/TenancyDbContext.cs

@@ -26,9 +26,12 @@ namespace LearnStack.Modules.Tenancy.Infrastructure.Persistence;
 /// <b>The global query filters come from the base.</b>
 /// <c>TenantScopedDbContext</c> owns the two members they close over and applies
 /// one to every entity implementing <c>ITenantOwned</c>; this context adds none
-/// of its own. Two of its eight entity types deliberately get no filter:
-/// <see cref="Tenants"/>, which is tenant-owned <b>self-keyed</b> — its <c>id</c>
-/// is the tenant id, and its policy says so — and
+/// of its own. <see cref="Tenants"/> gets a filter of a different SHAPE, not none:
+/// it is tenant-owned <b>self-keyed</b> — its <c>id</c> is the tenant id, and its
+/// policy says so — so the predicate compares <c>Id</c> rather than a
+/// <c>TenantId</c> column. An earlier version of this paragraph said it got no
+/// filter at all, which the self-keyed branch in <c>TenantQueryFilters</c>
+/// contradicts. One of the eight entity types genuinely gets none:
 /// <see cref="PlatformHostMappings"/>, which is <b>platform-scoped</b> and read
 /// in order to determine the tenant, so a tenant-keyed predicate on it would make
 /// host resolution return zero rows forever. Row Level Security remains the

docs/decisions/0036-tenant-resolution-trusted-inputs.md

@@ -174,6 +174,16 @@ Load-bearing details:
   token and does not carry bare `key`, so existing Serilog and error-tracker redaction
   covers the header for free.
 
+> **Erratum — 2026-09-04.** The order in the paragraph below rejects IPv4 literals
+> *before* stripping a port, and that is the order Packet 4 measured as wrong: it
+> lets `1.2.3.4:8080` through, because `IPAddress.TryParse` fails on the
+> port-bearing string and the check never runs again after the port is stripped.
+> The corrected order strips the port first and rejects the literal after; shown by
+> § Amendments, Amendment 1, and narrowed further by its own 2026-09-02 erratum.
+> The Decision is unchanged. Current authority:
+> [Amendment 1](#2026-08-20--amendment-1-the-normalization-order-corrected-by-measurement)
+> and `EffectiveHost.Normalize`.
+
 **Normalization is a total pure function.** `EffectiveHost.Normalize(string) → string?`
 is the sole producer of both the lookup key and the `app.resolving_host` value. Every
 failure returns `null` (⇒ unresolved ⇒ 404); nothing throws. Do **not** use

docs/modules/tenancy/permissions.md

@@ -31,9 +31,12 @@ refuses the write.
 
 **`MapHostToTenantCommand` is the one to gate first.** It writes the row that
 decides whose data an anonymous request sees, which makes it the highest-value
-write in the module and the reason `tenancy.tenant.admin` — not
-`tenancy.tenant.write` — is the key that will govern it. The three keys are
-registered with the rest in Phase 03.
+write in the module — and the reason the matrix above gives `HostMapping` its own
+resource with **no `write`**: pointing a hostname at a tenant is an admin-scope
+act, so `tenancy.hostmapping.admin` is the key that will govern it rather than any
+grant inside the everyday tenant-admin role. `tenancy.tenant.admin` governs
+provisioning and `tenancy.organization.write` the second organization. All three
+are registered with the rest in Phase 03.
 
 | Resource | read | write | delete | admin | Default role grants |
 |----------|:----:|:-----:|:------:|:-----:|---------------------|