Cover the incident, attachment and delegation rows a tenant deletion refuses on

TenantUsage::countScopedRows() lists nine entity types that record the tenant they belong to, and it is the single reader behind both surfaces that act on it: Tenant::preDelete() refuses the deletion, and TenantDeleteForm tells the administrator what is in the way. Six of the nine are exercised by a test. Three are not.

The list is a hardcoded constant, which is deliberate: the two shapes it covers are found in different places, a base field definition and an exported config property, so discovery would have to know both anyway. The cost of that choice is that nothing reports a type going missing from it. Drop one, or let an entity type stop carrying its tenant field, and a realm is deletable with those rows still scoped to it, while the guard and the confirmation agree with each other and are both wrong.

Not covered

• orchestra_incident, declared by orchestra, so a test reaches it with no extra module.
• orchestra_attachment, declared by orchestra_content, which a test has to install.
• orchestra_delegation, declared by orchestra_delegation, likewise.

The two that live in submodules are the ones worth having, because countScopedRows() skips a type whose module is not installed: that branch is what keeps the counter usable on a site without those submodules, and it is untested in both directions.

The work is a fixture per type in the existing coverage rather than a new class: TenantFormTest asserts the labels a blocked confirmation lists, and TenantDeletionTest asserts the guard refuses. The sibling reader WorkflowUsage has no equivalent gap; it counts two kinds of referrer and WorkflowDeletionTest exercises both.

AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it before posting; there is no code on this issue yet.)