Task: Read the whole grid

The grid belongs to the installation: one set of hosts runs every tenant's work, and the samples describe the fleet, not a tenant's slice of it. The reads filter by the session's tenant anyway — latest_node_samples selects DISTINCT ON (host_id) ... WHERE tenant_id = $1, and the grid summary read follows the session — so an administrator reads a shorter table and cannot tell it is short (The grid read is scoped to the session tenant). This task drops the tenant filter from the grid reads and guards them with the permission the journey records; the stored tenant_id stays on the sample as attribution, so the whole grid and who may see it stay two separate decisions.

• latest_node_samples and the newest grid sample carry no tenant filter, and a test proves a session the permission admits reads every node the installation reports. The policy admits the session's own tenant's rows plus the system tenant's, so a third tenant's rows stay invisible: the fleet comes back because the installation's samples are the system tenant's.
• The work counts are superseded: they are the installation's observed ledger, which Account for the grid's usage owns. This task no longer claims them.
• The shell's grid stats command reaches the same read.
• The capture The grid read is scoped to the session tenant moves out of the inbox with this task's evidence.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

The implementation was reviewed with PR #2761, on the standards and spec axes.

The read is whole and the record is closed.

latest_node_samples states no tenant predicate, and both sample models state :tenant_read_scope: shared with :rls_own_or_system_tenant_rows:, the codegen feature that emits the installation's policy shape: a session reads its own tenant's rows plus the system tenant's, and writes stay confined to its own tenant. The newest grid sample loses its predicate through the same shared scope.

The fleet comes back because the installation's own samples are the system tenant's, not because the read was widened to everything. The test states that honestly: it proves a permitted session reads every node the installation reports, and proves a third tenant's rows stay invisible. It would fail if the predicate came back, which is the property a test for this change needs.

Two of the four acceptance items needed no work here. The read already checks compute::grid_samples:read on origin/main, and the shell's compute grid-stats command already sends get_grid_stats_request, so it reaches the same read. Both are recorded rather than re-implemented.

The work counts are not this task's and never were, once the design settled: they are the installation's own ledger, which Account for the grid's usage builds. The acceptance now says so, and the capture moves out of the inbox with this evidence.

Verified in #2761: build exit 0; 94 of 94 ctest targets, 0 failed; the codegen pytest suite 1288 passed with 2 pre-existing failures that are main's; the RLS guard unchanged at 10 widenings, all listed; and no component drift. The ER diagram was regenerated rather than hand-merged when main moved twice under the branch.