Found while repairing the four tenant-audit half-repairs in StorageMetadataStore (PR #13527). Recorded rather than acted on: it is outside that card's ruled scope, and it is an observation about reachability, not a defect with a known repair.
Measured, on origin/main at bcef1cfac
StorageMetadataStore exports six write/read methods and is public surface (packages/services/service-storage/src/index.ts re-exports the class). Four of the six have shipped-source callers. Two do not:deleteFile and deleteSession are reached only from metadata-store.test.ts.
git grep -n "\.deleteFile(\|\.deleteSession(" -- 'packages/**/*.ts' 'apps/**/*.ts' 'examples/**/*.ts'
Every non-test hit that command returns is internalAdapter.deleteSession(token) in plugin-auth — better-auth's own session adapter, an unrelated object that happens to share the method name. There is no store.deleteFile( or store.deleteSession( anywhere outside packages/services/service-storage/src/metadata-store.test.ts.
Positive control, so the reading is not a grep artifact: the same command shape over store.updateFile( / store.updateSession( returns 7 shipped-source call sites, all in storage-routes.ts. The scan finds callers when callers exist.
Why it is worth recording
sys_file rows are removed in this tree by the ADR-0057 lifecycle sweep and the tombstone path, not through this store — so the two methods may simply be surface that outlived its caller. That is the ADR-0049 enforce-or-remove shape: a published method nothing in the tree exercises, whose behaviour is therefore pinned only by the test that calls it.
It also has a concrete consequence for the change that found it: the delete halves of that repair now thread a tenant context that no production door supplies, because no production door calls them at all. The repair is still right — the parameter is the store's contract and the two verbs are the ruled scope — but the reach it buys is exercised only by tests today.
Not established here
- ⛔ No claim that either method should be removed. Whether the storage API is meant to offer a direct delete for embedders (the class is exported, so an out-of-tree caller is possible and invisible to this scan) is a product question, not a measurement.
- ⛔ No claim about the sibling
updateFile / updateSession, which are live. - ⛔ Not swept beyond this repo. The sibling checkouts were not scanned.
Dedup
Listed all 383 open issues over the REST issues endpoint and grepped locally for deleteFile, deleteSession, StorageMetadataStore, dead/unused-export phrasings and the storage family. The only storage hit is #5266, which is about IStorageService.list(prefix) adapter semantics and unrelated. Positive control on the grep: the word tenant returns 5 rows from the same capture.
Generated by Claude Code
Found while repairing the four tenant-audit half-repairs in
StorageMetadataStore(PR #13527). Recorded rather than acted on: it is outside that card's ruled scope, and it is an observation about reachability, not a defect with a known repair.Measured, on
origin/mainatbcef1cfacStorageMetadataStoreexports six write/read methods and is public surface (packages/services/service-storage/src/index.tsre-exports the class). Four of the six have shipped-source callers. Two do not:deleteFileanddeleteSessionare reached only frommetadata-store.test.ts.Every non-test hit that command returns is
internalAdapter.deleteSession(token)inplugin-auth— better-auth's own session adapter, an unrelated object that happens to share the method name. There is nostore.deleteFile(orstore.deleteSession(anywhere outsidepackages/services/service-storage/src/metadata-store.test.ts.Positive control, so the reading is not a grep artifact: the same command shape over
store.updateFile(/store.updateSession(returns 7 shipped-source call sites, all instorage-routes.ts. The scan finds callers when callers exist.Why it is worth recording
sys_filerows are removed in this tree by the ADR-0057 lifecycle sweep and the tombstone path, not through this store — so the two methods may simply be surface that outlived its caller. That is the ADR-0049 enforce-or-remove shape: a published method nothing in the tree exercises, whose behaviour is therefore pinned only by the test that calls it.It also has a concrete consequence for the change that found it: the
deletehalves of that repair now thread a tenant context that no production door supplies, because no production door calls them at all. The repair is still right — the parameter is the store's contract and the two verbs are the ruled scope — but the reach it buys is exercised only by tests today.Not established here
updateFile/updateSession, which are live.Dedup
Listed all 383 open issues over the REST issues endpoint and grepped locally for
deleteFile,deleteSession,StorageMetadataStore, dead/unused-export phrasings and the storage family. The only storage hit is #5266, which is aboutIStorageService.list(prefix)adapter semantics and unrelated. Positive control on the grep: the wordtenantreturns 5 rows from the same capture.Generated by Claude Code