The nested include gap is a great catch. Putting tenant-scoped foreign keys in one registry and checking them at write time means the eighth endpoint is safe by default. Did you also add a test that fails if a new relation gets added without a registry entry?