# Remaining-migration inventory

<!-- GENERATED by scripts/generate-migration-inventory.py - do not edit.
     Every number is measured by the census/check that enforces it. -->

Plan 76 closure artifact (milestone H). Each row is a cross-cutting
concern whose door exists and is guarded by an executable ratchet; the
"remaining" column is the measured legacy population that has not yet
walked through it. A row at 0 is a completed migration held as an
invariant. Rows marked REGISTERED EXCEPTION are deliberate policy, not
debt. Regenerate with `python scripts/generate-migration-inventory.py`.

| Concern | Door | Remaining | Ceiling | Policy |
|---|---|---:|---:|---|
| Identity lookups outside rbac.get_current_user() | rbac.get_current_user() | 68 | 68 | JWT-only routes; the API-key-capable population is held at 0 by a companion assertion |
| Routes on bare @jwt_required() | auth_required() / role decorators | 598 | 598 | REGISTERED EXCEPTION: JWT-only is the deliberate default; conversion grants API-key access and happens per route, on decision |
| HTTP statuses chosen by sniffing error text | typed errors from app.exceptions | 0 | 0 | INVARIANT at 0 - migration completed 2026-08-19 |
| API crashes swallowed without recording | app.error_reporting | 0 | 0 | INVARIANT at 0 |
| Hand-shaped {'error': ...} bodies in app/api | typed errors + the global handler | 849 | 850 | migrate when touched; new endpoints raise |
| Raw subprocess calls outside the runners | app/utils/system.py runners | 23 | 23 | migrate when touched |
| Controller-boundary violations (routes doing service work) | service layer extraction | 453 | 453 | migrate when touched (first-wave ratchet) |
| raw api.* calls in pages/ | E1: useServerQuery/useServerMutation | 374 | 398 | migrate when touched |
| per-page toast.error extractions in pages/ | E1: query-layer error presentation | 191 | 206 | migrate when touched |
| hand-rolled form-group blocks | F2: FormField/useForm | 314 | 321 | migrate when touched |
| unencoded ?k=${v} query interpolations in services/api | C4: buildQuery/encoding template | 0 | 0 | INVARIANT at 0 |
| raw setInterval pollers | E2: usePolling/refetchInterval | 7 | 7 | DELIBERATE RESIDUE: clock ticks, socket-fallback hooks, and sibling-repo extension timers - each listed per file |
| direct navigator.clipboard call sites | F3: copyToClipboard | 0 | 0 | INVARIANT at 0 |
| hex colour literals outside token files | G: var(--token) | 139 | 139 | migrate when touched |
| SCSS class names defined in multiple files | single-owner partials | 0 | 0 | needs eyes on pages (no byte-identical proof available) |