Second pilot of the cluster rollout. Tenants-edit follows the same
pattern as departments-edit (step 2): the CONTEXT-stage vorspiel
collapses into one declarative actionEditContext call, the POST branch
(CSRF → SUBMIT-authorize → can_update gate → service call → PRG) stays
callsite-specific.
Confirms the analyst hypothesis from this run: actionEditContext is
strong enough for a second standard edit action without any further
API extension. The notFoundFlashScopeKey arg added during step 2 is
the only hook needed; helpers stay 0-diff.
The three drift decisions from step 2 are reproduced verbatim:
* notFoundFlashScopeKey: 'tenant_not_found' to preserve the existing
Flash dedup-scope-key.
* t() consistency: both Flash::success('Tenant updated', …) calls now
flow through t(), so German users see fully translated success
messages rather than a German/English mix.
* Defensive scope consumption: $canManageAllTenants reads
$tenantScope['scope'] === 'all'. Tenants-edit has no tenant-scope
filtering of its own (the action edits tenants themselves), so
$tenantScope['ids'] is intentionally not consumed; an inline
comment documents that.
ActionContextCsrfPairingContractTest now covers two callers
(departments-edit, tenants-edit) and stays green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fs
d0544d3428