[antosubash]

Tech-debt batch 11 — framework/db correctness fixes from the 2026-10-24 scan.

• db: sessions bound to a Connection lose the tenant policy and audit config #630 engine_policy() now resolves a Connection bind to its engine, so sessions created with bind=connection keep strict tenancy (TenantIsolationError) and the audit callback instead of silently turning both off.
• db: on_commit callbacks survive a savepoint rollback #631 on_commit callbacks remember the savepoints they were registered in; rolling back a savepoint discards them, and a root rollback discards everything (no leak into the session's next transaction).
• db audit: soft-deletes are not recorded as soft_deleted #632 The soft-delete listener re-adds persistent rows as dirty, so the audit snapshot now classifies them from session.dirty as soft_deleted and carries any field edits made in the same flush (review follow-up), instead of auditing them as plain updated. The old test faked the path with make_transient(); it now deletes for real.

Verification

• Red/green per issue: each new test failed on main and passes on the branch.
• make lint ✓ · make test-py (8 workers) ✓ 6005 passed (one env-only failure, the known /tmp/.git placeholder, re-run green) · make test-js ✓ 770 passed.
• Postgres: framework/db/tests + modules/audit_log/tests ✓ 685 passed.
• /ship: optimize (nothing to remove) → code review (pass 1: 1 finding fixed — soft-delete diffs; pass 2 clean) → QA smoke: upload + delete a file → audit log shows created then soft_deleted; double delete 404; admin pages 200 (verified over HTTP — the shared Playwright browser was unavailable).

Closes #630
Closes #631
Closes #632

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	24fb375
Status:	✅  Deploy successful!
Preview URL:	https://8b9e1d84.simple-module-python.pages.dev
Branch Preview URL:	https://fix-debt-batch-11.simple-module-python.pages.dev

View logs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-24T10:58:18.689980Z	24fb375	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.