feat(chain): alert on first SafeMode use, and mark Sudo as historically dormant

[JSONbored]

What prompted this

A check of whether metagraphed tracks "governance proposals". It does not, and it should not — the premise is wrong, which is worth recording so it doesn't get re-raised:

Decoding live finney metadata (state_getMetadata, decoded with @polkadot/api, 2026-07-29) gives 28 pallets:

System, RandomnessCollectiveFlip, Timestamp, Aura, Grandpa, Balances,
TransactionPayment, SubtensorModule, Utility, Sudo, Multisig, Preimage,
Scheduler, Proxy, Commitments, AdminUtils, SafeMode, Ethereum, EVM,
EVMChainId, BaseFee, Drand, Crowdloan, Swap, Contracts, MevShield,
AlphaAssets, LimitOrders

No Triumvirate, no Senate, no Collective, no Democracy, no Referenda. There are no on-chain proposals or votes to display. This confirms #4310's original audit finding.

⚠️ A raw substring grep of the metadata blob does hit Triumvirate and Senate — those are residual type paths, not pallet instances. Anyone re-checking this must decode the pallet list properly (md.asLatest.pallets), not grep the hex.

Governance that does exist is already covered: /api/v1/sudo, /api/v1/sudo/key,
/api/v1/governance/config-changes (AdminUtils), per-subnet hyperparameter history, and
the SubnetOwnerHotkeySet / BurnSet / SubnetLease* events already classified
"governance" in src/account-events.ts.

The actual gap

Four live pallets have zero references anywhere in src/, workers/, or schemas-src/:

Pallet	Why it matters	Priority
SafeMode	Emergency chain pause/unpause. The single most consequential governance action available on this chain, and we would not show it at all.	highest
Scheduler + Preimage	How root-origin calls are queued. Today we only surface governance actions after they execute — a scheduled sudo call is invisible until it lands.	high
Crowdloan	Capital formation for subnets. We already claim to cover subnet ownership/funding (SubnetLease*, get_subnet_lease); this is the same story with a gap in it.	medium
AlphaAssets, LimitOrders	Newer economic pallets adjacent to the OHLC/volume/stake-quote data we already serve.	medium

Scheduler/Preimage is the sharpest: it is the difference between "here is what
happened" and "here is what is about to happen". For a registry whose value is
operational awareness, pending root calls are arguably the highest-signal thing on
the chain.

Requirements

1. Confirm each pallet is actually in use, not merely present in the runtime. A pallet
   with zero historical extrinsics is not worth a route. Report the extrinsic count per
   pallet over the indexed range before building anything — if Crowdloan has never been
   called, say so and drop it from scope rather than shipping an endpoint that returns [].
2. SafeMode first, independent of the rest: enter/exit events, current state, and
   history. Small surface, highest consequence.
3. Scheduler/Preimage: surface pending scheduled calls with their target block,
   plus the decoded preimage where available. This is the one that needs real design work —
   a scheduled call is only meaningful if the call itself is decoded, so it must compose
   with the existing call_args decoding (src/postgres-call-args.ts).
4. Reuse the existing extrinsics D1/Postgres tier and the handleSudo /
   handleGovernanceConfigChanges shape rather than inventing a new one — those are already
   "the extrinsics feed hardcoded to one call_module", which is exactly what these need.
5. Contract + schema regenerated and committed (npm run build), per the repo's
   contract-drift gate.

Deliverables

Ships as one PR per pallet group, not one giant PR — these are independent:

• Pallet-usage census (extrinsic counts per pallet over the indexed range), posted as a
  comment here, gating what actually gets built
• SafeMode state + history route, contract entry, tests
• Scheduler/Preimage pending-call route with decoded call args, contract entry, tests
• Crowdloan + AlphaAssets/LimitOrders — only if the census shows real usage

Expected outcome

Every pallet in the live runtime is either surfaced, or has a recorded reason it is not
worth surfacing. No governance-relevant chain activity is invisible to the registry —
and specifically, a scheduled root call is visible before it executes, not after.

Do NOT

Do not add a "proposals" or "votes" surface. There is no pallet backing it. If a future
runtime upgrade adds one, this issue's metadata-decode snippet is the way to detect that.

[linear-code]

JSO-6897

[JSONbored]

Census done — and it cancels most of this issue's scope

Requirement 1 (pallet-usage census gating the build) is complete. Result: do not build most of what this issue proposed.

7-day activity (GET /api/v1/chain/calls, 1,190,739 extrinsics)

Only 14 of the 28 runtime pallets have any activity at all:

module	7d count	share
SubtensorModule	477,137	40.07%
Drand	201,584	16.93%
Ethereum	155,051	13.02%
MevShield	111,873	9.40%
Commitments	109,714	9.21%
Timestamp	50,373	4.23%
Utility	33,690	2.83%
Balances	29,319	2.46%
Proxy	12,858	1.08%
System	8,620	0.72%
Contracts	413	0.03%
Multisig	76	0.01%
EVM	16	0.00%
AdminUtils	15	0.00%

Whole-history check (?call_module=X&limit=1, full indexed range back to 2023)

pallet	ever called?
SafeMode	never
Scheduler	never
Preimage	never
Crowdloan	never
AlphaAssets	never
Swap	never
LimitOrders	yes
Sudo	yes — but zero in the last 7 days (oldest sampled: block 231589, 2023-04-21)

What this changes

Drop Scheduler/Preimage entirely. I argued above that pending scheduled root calls
were "the sharpest gap — the difference between what happened and what is about to happen."
That was wrong: root calls on this chain are never scheduled. Both pallets have zero
extrinsics in all of history. There is no pending-call phenomenon to surface. Building it
would have produced exactly the empty-forever endpoint this issue was written to prevent —
the same mistake as the "proposals page" that prompted it.

Drop Crowdloan, AlphaAssets, Swap. Never called. Revisit if that changes.

SafeMode is not a route — it is an alert. Zero uses is the correct state for an
emergency pause; it means nothing has gone wrong yet, not that it doesn't matter. If it ever
fires it is the single highest-signal event on the chain. The right shape is a monitor on
first use, not an endpoint that renders an empty table until the day it doesn't. Cheap:
no route, no artifact, no contract entry.

Sudo is dormant; AdminUtils is the live path. 15 AdminUtils calls in 7d versus zero
Sudo. Our existing split (/api/v1/sudo + /api/v1/governance/config-changes) already has
this right, but the framing in the contract descriptions implies both are live. Worth a
docs-level note that sudo is historical.

Revised deliverables

• Pallet-usage census
• SafeMode alert (fire on the first-ever extrinsic from that module) — not a route
• Note in the sudo/governance contract descriptions that Sudo is historically dormant
  and AdminUtils is the live config path
• Scheduler/Preimage pending calls — cancelled, zero usage in all history
• Crowdloan, AlphaAssets, LimitOrders, Swap — cancelled, no meaningful usage

One thing the census surfaced that this issue missed

Commitments is 9.21% of all chain traffic (109,714 calls in 7d) and has only 4
references in src/+workers/. That is a far larger surface than anything originally listed
here, and it is user-facing (commit-reveal weights). Worth its own investigation — filed
separately rather than folded in.

[JSONbored]

Correction — two pallets in the original list are already handled

My "zero references anywhere in src//workers//schemas-src/" table was measured with a
shell still cd'd into apps/ui, so it searched the frontend, not the Workers. Re-run
from the repo root, the picture changes:

pallet	refs (corrected)	verdict
SafeMode	0	genuinely untracked ✅ claim holds
Preimage	0	genuinely untracked ✅ claim holds
AlphaAssets	0	genuinely untracked ✅ claim holds
Scheduler	1	0 real — the hit is Cloudflare's own Scheduler type in workers/worker-configuration.d.ts, not the Substrate pallet. Claim holds, but by accident
Crowdloan	3	❌ already handled
LimitOrders	5	❌ already handled

Crowdloan is not a gap

It is tracked through two existing paths:

• src/subnet-lease-history.ts — "Contributed/Withdrew are Crowdloan-pallet events keyed by
  crowdloan_id", feeding the subnet-lease history
• src/evm-precompiles.ts — the Crowdloan precompile (getCrowdloan(uint32))

And Contributed / Withdrew are already classified "governance" in
src/account-events.ts — the very file I cited earlier as evidence of what we cover. I
listed it as a gap while quoting the code that handles it.

LimitOrders is not a gap

src/indexer-rs-ethereum-decode.ts decodes LimitOrders.execute_batched_orders, including
its per-order {Sr25519:"0x..."} shape (#4692).

Net remaining scope

Down from "four pallet groups" to one actionable item:

• SafeMode alert on first-ever use — no route, no artifact
• Docs note that Sudo is historically dormant, AdminUtils is the live config path

Preimage and AlphaAssets are genuinely unreferenced but have zero extrinsics in all
indexed history, so they stay cancelled on the same census logic as the rest.

Also withdrawn: the Commitments claim

I flagged Commitments as "9.21% of traffic with only 4 references" — that count was from
the same bad-cwd run. It has summarizers for both Commitments.set_commitment and
Commitments.Commitment in chain-summaries.ts, so it already flows through the generic
extrinsic/event feed with human-readable summaries. No separate investigation needed; I will
not be filing that.