Convert even more classes to auditedOfy() (#1157)

* Convert even more classes to auditedOfy()

This covers almost all of the classes in the second round of the sheet.
There are still some classes that need conversion but this is the vast
majority of them.

https://docs.google.com/spreadsheets/d/1aFEFuyH6vVW6b-h71O9f5CuUc6Y7YjZ2kdRL3lwXcVk/edit?resourcekey=0-guwZVKfSH-pntER1tUit6w#gid=1355213322
for notes

core/src/main/java/google/registry/backup/BackupUtils.java

@@ -14,7 +14,7 @@
 
 package google.registry.backup;
 
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.EntityTranslator;
 import com.google.common.collect.AbstractIterator;
@@ -45,7 +45,7 @@ public class BackupUtils {
    * {@link OutputStream} in delimited protocol buffer format.
    */
   static void serializeEntity(ImmutableObject entity, OutputStream stream) throws IOException {
-    EntityTranslator.convertToPb(ofy().save().toEntity(entity)).writeDelimitedTo(stream);
+    EntityTranslator.convertToPb(auditedOfy().save().toEntity(entity)).writeDelimitedTo(stream);
   }
 
   /**
@@ -61,11 +61,12 @@ public class BackupUtils {
       @Override
       protected ImmutableObject computeNext() {
         EntityProto proto = new EntityProto();
-        if (proto.parseDelimitedFrom(input)) {  // False means end of stream; other errors throw.
+        if (proto.parseDelimitedFrom(input)) { // False means end of stream; other errors throw.
-          return ofy().load().fromEntity(EntityTranslator.createFromPb(proto));
+          return auditedOfy().load().fromEntity(EntityTranslator.createFromPb(proto));
         }
         return endOfData();
-      }};
+      }
+    };
   }
 
   public static ImmutableList<ImmutableObject> deserializeEntities(byte[] bytes) {

core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java

@@ -18,7 +18,7 @@ import static com.google.appengine.api.taskqueue.QueueFactory.getQueue;
 import static com.google.appengine.api.taskqueue.TaskOptions.Builder.withUrl;
 import static google.registry.backup.ExportCommitLogDiffAction.LOWER_CHECKPOINT_TIME_PARAM;
 import static google.registry.backup.ExportCommitLogDiffAction.UPPER_CHECKPOINT_TIME_PARAM;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 
@@ -64,8 +64,7 @@ public final class CommitLogCheckpointAction implements Runnable {
     final CommitLogCheckpoint checkpoint = strategy.computeCheckpoint();
     logger.atInfo().log(
         "Generated candidate checkpoint for time: %s", checkpoint.getCheckpointTime());
-    tm()
+    tm().transact(
-        .transact(
             () -> {
               DateTime lastWrittenTime = CommitLogCheckpointRoot.loadRoot().getLastWrittenTime();
               if (isBeforeOrAt(checkpoint.getCheckpointTime(), lastWrittenTime)) {
@@ -73,7 +72,7 @@ public final class CommitLogCheckpointAction implements Runnable {
                     "Newer checkpoint already written at time: %s", lastWrittenTime);
                 return;
               }
-              ofy()
+              auditedOfy()
                   .saveWithoutBackup()
                   .entities(
                       checkpoint, CommitLogCheckpointRoot.create(checkpoint.getCheckpointTime()));

core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java

@@ -17,7 +17,7 @@ package google.registry.backup;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static java.lang.Boolean.FALSE;
 import static java.lang.Boolean.TRUE;
@@ -75,9 +75,17 @@ public final class DeleteOldCommitLogsAction implements Runnable {
   @Inject MapreduceRunner mrRunner;
   @Inject Response response;
   @Inject Clock clock;
-  @Inject @Config("commitLogDatastoreRetention") Duration maxAge;
+
-  @Inject @Parameter(PARAM_DRY_RUN) boolean isDryRun;
+  @Inject
-  @Inject DeleteOldCommitLogsAction() {}
+  @Config("commitLogDatastoreRetention")
+  Duration maxAge;
+
+  @Inject
+  @Parameter(PARAM_DRY_RUN)
+  boolean isDryRun;
+
+  @Inject
+  DeleteOldCommitLogsAction() {}
 
   @Override
   public void run() {
@@ -138,12 +146,12 @@ public final class DeleteOldCommitLogsAction implements Runnable {
       // If it isn't a Key<CommitLogManifest> then it should be an EppResource, which we need to
       // load to emit the revisions.
       //
-      Object object = ofy().load().key(key).now();
+      Object object = auditedOfy().load().key(key).now();
       checkNotNull(object, "Received a key to a missing object. key: %s", key);
       checkState(
           object instanceof EppResource,
           "Received a key to an object that isn't EppResource nor CommitLogManifest."
-          + " Key: %s object type: %s",
+              + " Key: %s object type: %s",
           key,
           object.getClass().getName());
 
@@ -224,8 +232,7 @@ public final class DeleteOldCommitLogsAction implements Runnable {
    * OK to delete this manifestKey. If even one source returns "false" (meaning "it's not OK to
    * delete this manifest") then it won't be deleted.
    */
-  static class DeleteOldCommitLogsReducer
+  static class DeleteOldCommitLogsReducer extends Reducer<Key<CommitLogManifest>, Boolean, Void> {
-      extends Reducer<Key<CommitLogManifest>, Boolean, Void> {
 
     private static final long serialVersionUID = -4918760187627937268L;
 
@@ -241,12 +248,12 @@ public final class DeleteOldCommitLogsAction implements Runnable {
       }
 
       public abstract Status status();
+
       public abstract int numDeleted();
 
       static DeletionResult create(Status status, int numDeleted) {
-        return
+        return new AutoValue_DeleteOldCommitLogsAction_DeleteOldCommitLogsReducer_DeletionResult(
-            new AutoValue_DeleteOldCommitLogsAction_DeleteOldCommitLogsReducer_DeletionResult(
+            status, numDeleted);
-                status, numDeleted);
       }
     }
 
@@ -257,8 +264,7 @@ public final class DeleteOldCommitLogsAction implements Runnable {
 
     @Override
     public void reduce(
-        final Key<CommitLogManifest> manifestKey,
+        final Key<CommitLogManifest> manifestKey, ReducerInput<Boolean> canDeleteVerdicts) {
-        ReducerInput<Boolean> canDeleteVerdicts) {
       ImmutableMultiset<Boolean> canDeleteMultiset = ImmutableMultiset.copyOf(canDeleteVerdicts);
       if (canDeleteMultiset.count(TRUE) > 1) {
         getContext().incrementCounter("commit log manifests incorrectly mapped multiple times");
@@ -267,47 +273,54 @@ public final class DeleteOldCommitLogsAction implements Runnable {
         getContext().incrementCounter("commit log manifests referenced multiple times");
       }
       if (canDeleteMultiset.contains(FALSE)) {
-        getContext().incrementCounter(
+        getContext()
-            canDeleteMultiset.contains(TRUE)
+            .incrementCounter(
-            ? "old commit log manifests still referenced"
+                canDeleteMultiset.contains(TRUE)
-            : "new (or nonexistent) commit log manifests referenced");
+                    ? "old commit log manifests still referenced"
-        getContext().incrementCounter(
+                    : "new (or nonexistent) commit log manifests referenced");
-            "EPP resource revisions handled",
+        getContext()
-            canDeleteMultiset.count(FALSE));
+            .incrementCounter("EPP resource revisions handled", canDeleteMultiset.count(FALSE));
         return;
       }
 
-      DeletionResult deletionResult = tm().transactNew(() -> {
+      DeletionResult deletionResult =
-        CommitLogManifest manifest = ofy().load().key(manifestKey).now();
+          tm().transactNew(
-        // It is possible that the same manifestKey was run twice, if a shard had to be restarted
+                  () -> {
-        // or some weird failure. If this happens, we want to exit immediately.
+                    CommitLogManifest manifest = auditedOfy().load().key(manifestKey).now();
-        // Note that this can never happen in dryRun.
+                    // It is possible that the same manifestKey was run twice, if a shard had to be
-        if (manifest == null) {
+                    // restarted or some weird failure. If this happens, we want to exit
-          return DeletionResult.create(DeletionResult.Status.ALREADY_DELETED, 0);
+                    // immediately. Note that this can never happen in dryRun.
-        }
+                    if (manifest == null) {
-        // Doing a sanity check on the date. This is the only place we use the CommitLogManifest,
+                      return DeletionResult.create(DeletionResult.Status.ALREADY_DELETED, 0);
-        // so maybe removing this test will improve performance. However, unless it's proven that
+                    }
-        // the performance boost is significant (and we've tested this enough to be sure it never
+                    // Doing a sanity check on the date. This is the only place we use the
-        // happens)- the safty of "let's not delete stuff we need from prod" is more important.
+                    // CommitLogManifest, so maybe removing this test will improve performance.
-        if (manifest.getCommitTime().isAfter(deletionThreshold)) {
+                    // However, unless it's proven that the performance boost is significant (and
-          return DeletionResult.create(DeletionResult.Status.AFTER_THRESHOLD, 0);
+                    // we've tested this enough to be sure it never happens)- the safety of "let's
-        }
+                    // not delete stuff we need from prod" is more important.
-        Iterable<Key<CommitLogMutation>> commitLogMutationKeys = ofy().load()
+                    if (manifest.getCommitTime().isAfter(deletionThreshold)) {
-            .type(CommitLogMutation.class)
+                      return DeletionResult.create(DeletionResult.Status.AFTER_THRESHOLD, 0);
-            .ancestor(manifestKey)
+                    }
-            .keys()
+                    Iterable<Key<CommitLogMutation>> commitLogMutationKeys =
-            .iterable();
+                        auditedOfy()
-        ImmutableList<Key<?>> keysToDelete = ImmutableList.<Key<?>>builder()
+                            .load()
-            .addAll(commitLogMutationKeys)
+                            .type(CommitLogMutation.class)
-            .add(manifestKey)
+                            .ancestor(manifestKey)
-            .build();
+                            .keys()
-        // Normally in a dry run we would log the entities that would be deleted, but those can
+                            .iterable();
-        // number in the millions so we skip the logging.
+                    ImmutableList<Key<?>> keysToDelete =
-        if (!isDryRun) {
+                        ImmutableList.<Key<?>>builder()
-          ofy().deleteWithoutBackup().keys(keysToDelete);
+                            .addAll(commitLogMutationKeys)
-        }
+                            .add(manifestKey)
-        return DeletionResult.create(DeletionResult.Status.SUCCESS, keysToDelete.size());
+                            .build();
-      });
+                    // Normally in a dry run we would log the entities that would be deleted, but
+                    // those can number in the millions so we skip the logging.
+                    if (!isDryRun) {
+                      auditedOfy().deleteWithoutBackup().keys(keysToDelete);
+                    }
+                    return DeletionResult.create(
+                        DeletionResult.Status.SUCCESS, keysToDelete.size());
+                  });
 
       switch (deletionResult.status()) {
         case SUCCESS:

core/src/main/java/google/registry/backup/ExportCommitLogDiffAction.java

@@ -25,7 +25,7 @@ import static google.registry.backup.BackupUtils.GcsMetadataKeys.NUM_TRANSACTION
 import static google.registry.backup.BackupUtils.GcsMetadataKeys.UPPER_BOUND_CHECKPOINT;
 import static google.registry.backup.BackupUtils.serializeEntity;
 import static google.registry.model.ofy.CommitLogBucket.getBucketKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.DateTimeUtils.isAtOrAfter;
 import static java.nio.channels.Channels.newOutputStream;
@@ -89,11 +89,14 @@ public final class ExportCommitLogDiffAction implements Runnable {
     checkArgument(lowerCheckpointTime.isBefore(upperCheckpointTime));
     // Load the boundary checkpoints - lower is exclusive and may not exist (on the first export,
     // when lowerCheckpointTime is START_OF_TIME), whereas the upper is inclusive and must exist.
-    CommitLogCheckpoint lowerCheckpoint = lowerCheckpointTime.isAfter(START_OF_TIME)
+    CommitLogCheckpoint lowerCheckpoint =
-        ? verifyNotNull(ofy().load().key(CommitLogCheckpoint.createKey(lowerCheckpointTime)).now())
+        lowerCheckpointTime.isAfter(START_OF_TIME)
-        : null;
+            ? verifyNotNull(
+                auditedOfy().load().key(CommitLogCheckpoint.createKey(lowerCheckpointTime)).now())
+            : null;
     CommitLogCheckpoint upperCheckpoint =
-        verifyNotNull(ofy().load().key(CommitLogCheckpoint.createKey(upperCheckpointTime)).now());
+        verifyNotNull(
+            auditedOfy().load().key(CommitLogCheckpoint.createKey(upperCheckpointTime)).now());
 
     // Load the keys of all the manifests to include in this diff.
     List<Key<CommitLogManifest>> sortedKeys = loadAllDiffKeys(lowerCheckpoint, upperCheckpoint);
@@ -117,7 +120,7 @@ public final class ExportCommitLogDiffAction implements Runnable {
       // asynchronously load the entities for the next one.
       List<List<Key<CommitLogManifest>>> keyChunks = partition(sortedKeys, batchSize);
       // Objectify's map return type is asynchronous. Calling .values() will block until it loads.
-      Map<?, CommitLogManifest> nextChunkToExport = ofy().load().keys(keyChunks.get(0));
+      Map<?, CommitLogManifest> nextChunkToExport = auditedOfy().load().keys(keyChunks.get(0));
       for (int i = 0; i < keyChunks.size(); i++) {
         // Force the async load to finish.
         Collection<CommitLogManifest> chunkValues = nextChunkToExport.values();
@@ -125,10 +128,10 @@ public final class ExportCommitLogDiffAction implements Runnable {
         // Since there is no hard bound on how much data this might be, take care not to let the
         // Objectify session cache fill up and potentially run out of memory. This is the only safe
         // point to do this since at this point there is no async load in progress.
-        ofy().clearSessionCache();
+        auditedOfy().clearSessionCache();
         // Kick off the next async load, which can happen in parallel to the current GCS export.
         if (i + 1 < keyChunks.size()) {
-          nextChunkToExport = ofy().load().keys(keyChunks.get(i + 1));
+          nextChunkToExport = auditedOfy().load().keys(keyChunks.get(i + 1));
         }
         exportChunk(gcsStream, chunkValues);
         logger.atInfo().log("Exported %d manifests", chunkValues.size());
@@ -192,7 +195,8 @@ public final class ExportCommitLogDiffAction implements Runnable {
       return ImmutableSet.of();
     }
     Key<CommitLogBucket> bucketKey = getBucketKey(bucketNum);
-    return ofy().load()
+    return auditedOfy()
+        .load()
         .type(CommitLogManifest.class)
         .ancestor(bucketKey)
         .filterKey(">=", CommitLogManifest.createKey(bucketKey, lowerBound))
@@ -208,7 +212,7 @@ public final class ExportCommitLogDiffAction implements Runnable {
         new ImmutableList.Builder<>();
     for (CommitLogManifest manifest : chunk) {
       entities.add(ImmutableList.of(manifest));
-      entities.add(ofy().load().type(CommitLogMutation.class).ancestor(manifest));
+      entities.add(auditedOfy().load().type(CommitLogMutation.class).ancestor(manifest));
     }
     for (ImmutableObject entity : concat(entities.build())) {
       serializeEntity(entity, gcsStream);

core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java

@@ -16,7 +16,7 @@ package google.registry.backup;
 
 import static google.registry.backup.ExportCommitLogDiffAction.DIFF_FILE_PREFIX;
 import static google.registry.model.ofy.EntityWritePriorities.getEntityPriority;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
 import static org.joda.time.Duration.standardHours;
@@ -151,7 +151,7 @@ public class ReplayCommitLogsToSqlAction implements Runnable {
   }
 
   private void handleEntityPut(Entity entity) {
-    Object ofyPojo = ofy().toPojo(entity);
+    Object ofyPojo = auditedOfy().toPojo(entity);
     if (ofyPojo instanceof DatastoreEntity) {
       DatastoreEntity datastoreEntity = (DatastoreEntity) ofyPojo;
       datastoreEntity

core/src/main/java/google/registry/backup/RestoreCommitLogsAction.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.Iterators.peekingIterator;
 import static google.registry.backup.BackupUtils.createDeserializingIterator;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.DatastoreService;
 import com.google.appengine.api.datastore.Entity;
@@ -146,10 +146,10 @@ public class RestoreCommitLogsAction implements Runnable {
   private CommitLogManifest restoreOneTransaction(PeekingIterator<ImmutableObject> commitLogs) {
     final CommitLogManifest manifest = (CommitLogManifest) commitLogs.next();
     Result<?> deleteResult = deleteAsync(manifest.getDeletions());
-    List<Entity> entitiesToSave = Lists.newArrayList(ofy().save().toEntity(manifest));
+    List<Entity> entitiesToSave = Lists.newArrayList(auditedOfy().save().toEntity(manifest));
     while (commitLogs.hasNext() && commitLogs.peek() instanceof CommitLogMutation) {
       CommitLogMutation mutation = (CommitLogMutation) commitLogs.next();
-      entitiesToSave.add(ofy().save().toEntity(mutation));
+      entitiesToSave.add(auditedOfy().save().toEntity(mutation));
       entitiesToSave.add(EntityTranslator.createFromPbBytes(mutation.getEntityProtoBytes()));
     }
     saveRaw(entitiesToSave);
@@ -176,7 +176,8 @@ public class RestoreCommitLogsAction implements Runnable {
       return;
     }
     retrier.callWithRetry(
-        () -> ofy().saveWithoutBackup().entities(objectsToSave).now(), RuntimeException.class);
+        () -> auditedOfy().saveWithoutBackup().entities(objectsToSave).now(),
+        RuntimeException.class);
   }
 
   private Result<?> deleteAsync(Set<Key<?>> keysToDelete) {
@@ -185,7 +186,7 @@ public class RestoreCommitLogsAction implements Runnable {
     }
     return dryRun || keysToDelete.isEmpty()
         ? new ResultNow<Void>(null)
-        : ofy().deleteWithoutBackup().keys(keysToDelete);
+        : auditedOfy().deleteWithoutBackup().keys(keysToDelete);
   }
 
 }

core/src/main/java/google/registry/backup/VersionedEntity.java

@@ -47,7 +47,7 @@ import javax.annotation.Nullable;
  *
  * <ul>
  *   <li>Convert an Objectify entity to a Datastore {@link Entity}: {@code
- *       ofy().save().toEntity(..)}
+ *       auditedOfy().save().toEntity(..)}
  *   <li>Entity is serializable, but the more efficient approach is to convert an Entity to a
  *       ProtocolBuffer ({@link com.google.storage.onestore.v3.OnestoreEntity.EntityProto}) and then
  *       to raw bytes.

core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java

@@ -34,7 +34,7 @@ import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
 import static google.registry.model.ResourceTransferUtils.handlePendingTransferOnDelete;
 import static google.registry.model.ResourceTransferUtils.updateForeignKeyIndexDeletionTime;
 import static google.registry.model.eppcommon.StatusValue.PENDING_DELETE;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE_FAILURE;
 import static google.registry.model.reporting.HistoryEntry.Type.HOST_DELETE;
@@ -336,7 +336,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
         DeletionRequest deletionRequest, boolean hasNoActiveReferences) {
       DateTime now = tm().getTransactionTime();
       EppResource resource =
-          ofy().load().key(deletionRequest.key()).now().cloneProjectedAtTime(now);
+          auditedOfy().load().key(deletionRequest.key()).now().cloneProjectedAtTime(now);
       // Double-check transactionally that the resource is still active and in PENDING_DELETE.
       if (!doesResourceStateAllowDeletion(resource, now)) {
         return DeletionResult.create(Type.ERRORED, "");
@@ -409,7 +409,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
       } else {
         resourceToSave = resource.asBuilder().removeStatusValue(PENDING_DELETE).build();
       }
-      ofy().save().<ImmutableObject>entities(resourceToSave, historyEntry, pollMessage);
+      auditedOfy().save().<ImmutableObject>entities(resourceToSave, historyEntry, pollMessage);
       return DeletionResult.create(
           deleteAllowed ? Type.DELETED : Type.NOT_DELETED, pollMessageText);
     }
@@ -526,7 +526,8 @@ public class DeleteContactsAndHostsAction implements Runnable {
           Key.create(
               checkNotNull(params.get(PARAM_RESOURCE_KEY), "Resource to delete not specified"));
       EppResource resource =
-          checkNotNull(ofy().load().key(resourceKey).now(), "Resource to delete doesn't exist");
+          checkNotNull(
+              auditedOfy().load().key(resourceKey).now(), "Resource to delete doesn't exist");
       checkState(
           resource instanceof ContactResource || resource instanceof HostResource,
           "Cannot delete a %s via this action",

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkState;
 import static google.registry.config.RegistryEnvironment.PRODUCTION;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.mapreduce.inputs.EppResourceInputs.createEntityInput;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 
@@ -125,12 +125,11 @@ public class DeleteLoadTestDataAction implements Runnable {
           Key.create(EppResourceIndex.create(Key.create(resource)));
       final Key<? extends ForeignKeyIndex<?>> fki = ForeignKeyIndex.createKey(resource);
       int numEntitiesDeleted =
-          tm()
+          tm().transact(
-              .transact(
                   () -> {
                     // This ancestor query selects all descendant entities.
                     List<Key<Object>> resourceAndDependentKeys =
-                        ofy().load().ancestor(resource).keys().list();
+                        auditedOfy().load().ancestor(resource).keys().list();
                     ImmutableSet<Key<?>> allKeys =
                         new ImmutableSet.Builder<Key<?>>()
                             .add(fki)
@@ -140,7 +139,7 @@ public class DeleteLoadTestDataAction implements Runnable {
                     if (isDryRun) {
                       logger.atInfo().log("Would hard-delete the following entities: %s", allKeys);
                     } else {
-                      ofy().deleteWithoutBackup().keys(allKeys);
+                      auditedOfy().deleteWithoutBackup().keys(allKeys);
                     }
                     return allKeys.size();
                   });

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -20,7 +20,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryEnvironment.PRODUCTION;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.model.ResourceTransferUtils.updateForeignKeyIndexDeletionTime;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.Registries.getTldsOfType;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_DELETE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -166,7 +166,7 @@ public class DeleteProberDataAction implements Runnable {
     }
 
     private void deleteDomain(final Key<DomainBase> domainKey) {
-      final DomainBase domain = ofy().load().key(domainKey).now();
+      final DomainBase domain = auditedOfy().load().key(domainKey).now();
 
       DateTime now = DateTime.now(UTC);
 
@@ -220,14 +220,13 @@ public class DeleteProberDataAction implements Runnable {
       final Key<? extends ForeignKeyIndex<?>> fki = ForeignKeyIndex.createKey(domain);
 
       int entitiesDeleted =
-          tm()
+          tm().transact(
-              .transact(
                   () -> {
                     // This ancestor query selects all descendant HistoryEntries, BillingEvents,
                     // PollMessages,
                     // and TLD-specific entities, as well as the domain itself.
                     List<Key<Object>> domainAndDependentKeys =
-                        ofy().load().ancestor(domainKey).keys().list();
+                        auditedOfy().load().ancestor(domainKey).keys().list();
                     ImmutableSet<Key<?>> allKeys =
                         new ImmutableSet.Builder<Key<?>>()
                             .add(fki)
@@ -237,7 +236,7 @@ public class DeleteProberDataAction implements Runnable {
                     if (isDryRun) {
                       logger.atInfo().log("Would hard-delete the following entities: %s", allKeys);
                     } else {
-                      ofy().deleteWithoutBackup().keys(allKeys);
+                      auditedOfy().deleteWithoutBackup().keys(allKeys);
                     }
                     return allKeys.size();
                   });
@@ -268,7 +267,7 @@ public class DeleteProberDataAction implements Runnable {
                 // poll messages, or auto-renews because these will all be hard-deleted the next
                 // time the
                 // mapreduce runs anyway.
-                ofy().save().entities(deletedDomain, historyEntry);
+                auditedOfy().save().entities(deletedDomain, historyEntry);
                 updateForeignKeyIndexDeletionTime(deletedDomain);
                 dnsQueue.addDomainRefreshTask(deletedDomain.getDomainName());
               });

core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java

@@ -91,7 +91,8 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
 
   @Override
   public void run() {
-    Cursor cursor = ofy().load().key(Cursor.createGlobalKey(RECURRING_BILLING)).now();
+    Cursor cursor =
+        tm().loadByKeyIfPresent(Cursor.createGlobalVKey(RECURRING_BILLING)).orElse(null);
     DateTime executeTime = clock.nowUtc();
     DateTime persistedCursorTime = (cursor == null ? START_OF_TIME : cursor.getCursorTime());
     DateTime cursorTime = cursorTimeParam.orElse(persistedCursorTime);

core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java

@@ -15,7 +15,7 @@
 package google.registry.batch;
 
 import static google.registry.mapreduce.MapreduceRunner.PARAM_FAST;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.appengine.tools.mapreduce.Mapper;
@@ -104,13 +104,13 @@ public class ResaveAllEppResourcesAction implements Runnable {
       boolean resaved =
           tm().transact(
                   () -> {
-                    EppResource originalResource = ofy().load().key(resourceKey).now();
+                    EppResource originalResource = auditedOfy().load().key(resourceKey).now();
                     EppResource projectedResource =
                         originalResource.cloneProjectedAtTime(tm().getTransactionTime());
                     if (isFast && originalResource.equals(projectedResource)) {
                       return false;
                     } else {
-                      ofy().save().entity(projectedResource).now();
+                      auditedOfy().save().entity(projectedResource).now();
                       return true;
                     }
                   });

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -25,11 +25,8 @@ import static com.google.common.collect.Iterables.any;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
-import static google.registry.model.DatabaseMigrationUtils.getPrimaryDatabase;
-import static google.registry.model.common.DatabaseTransitionSchedule.PrimaryDatabase.DATASTORE;
-import static google.registry.model.common.DatabaseTransitionSchedule.TransitionId.REPLAYED_ENTITIES;
 import static google.registry.model.domain.DomainBase.MAX_REGISTRATION_YEARS;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.Registries.findTldForName;
 import static google.registry.model.registry.Registries.getTlds;
 import static google.registry.model.registry.Registry.TldState.GENERAL_AVAILABILITY;
@@ -1083,8 +1080,8 @@ public class DomainFlowUtils {
 
   private static List<? extends HistoryEntry> findRecentHistoryEntries(
       DomainBase domainBase, DateTime now, Duration maxSearchPeriod) {
-    if (getPrimaryDatabase(REPLAYED_ENTITIES).equals(DATASTORE)) {
+    if (tm().isOfy()) {
-      return ofy()
+      return auditedOfy()
           .load()
           .type(HistoryEntry.class)
           .ancestor(domainBase)

core/src/main/java/google/registry/keyring/kms/KmsKeyring.java

@@ -18,7 +18,7 @@ import static com.google.common.base.CaseFormat.LOWER_HYPHEN;
 import static com.google.common.base.CaseFormat.UPPER_UNDERSCORE;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.common.flogger.FluentLogger;
@@ -205,9 +205,9 @@ public class KmsKeyring implements Keyring {
     String encryptedData;
     if (tm().isOfy()) {
       KmsSecret secret =
-          ofy().load().key(Key.create(getCrossTldKey(), KmsSecret.class, keyName)).now();
+          auditedOfy().load().key(Key.create(getCrossTldKey(), KmsSecret.class, keyName)).now();
       checkState(secret != null, "Requested secret '%s' does not exist.", keyName);
-      encryptedData = ofy().load().key(secret.getLatestRevision()).now().getEncryptedValue();
+      encryptedData = auditedOfy().load().key(secret.getLatestRevision()).now().getEncryptedValue();
     } else {
       Optional<KmsSecretRevision> revision =
           tm().transact(() -> KmsSecretRevisionSqlDao.getLatestRevision(keyName));

core/src/main/java/google/registry/model/ImmutableObject.java

@@ -16,7 +16,7 @@ package google.registry.model;
 
 import static com.google.common.collect.Iterables.transform;
 import static com.google.common.collect.Maps.transformValues;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static java.lang.annotation.ElementType.FIELD;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
@@ -189,7 +189,7 @@ public abstract class ImmutableObject implements Cloneable {
   private static Object hydrate(Object value) {
     if (value instanceof Key) {
       if (tm().isOfy()) {
-        return hydrate(ofy().load().key((Key<?>) value).now());
+        return hydrate(auditedOfy().load().key((Key<?>) value).now());
       }
       return value;
     } else if (value instanceof Map) {

core/src/main/java/google/registry/model/index/ForeignKeyIndex.java

@@ -19,7 +19,7 @@ import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryConfig.getEppResourceCachingDuration;
 import static google.registry.config.RegistryConfig.getEppResourceMaxCachedEntries;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.entriesToImmutableMap;
@@ -220,8 +220,8 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
       Class<ForeignKeyIndex<E>> fkiClass = mapToFkiClass(clazz);
       return ImmutableMap.copyOf(
           inTransaction
-              ? ofy().load().type(fkiClass).ids(foreignKeys)
+              ? auditedOfy().load().type(fkiClass).ids(foreignKeys)
-              : tm().doTransactionless(() -> ofy().load().type(fkiClass).ids(foreignKeys)));
+              : tm().doTransactionless(() -> auditedOfy().load().type(fkiClass).ids(foreignKeys)));
     } else {
       String property = RESOURCE_CLASS_TO_FKI_PROPERTY.get(clazz);
       ImmutableList<ForeignKeyIndex<E>> indexes =
@@ -276,7 +276,7 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
           ImmutableSet<VKey<ForeignKeyIndex<?>>> typedKeys = ImmutableSet.copyOf(keys);
           ImmutableMap<String, ? extends ForeignKeyIndex<? extends EppResource>> existingFkis =
               loadIndexesFromStore(resourceClass, foreignKeys, false);
-          // ofy() omits keys that don't have values in Datastore, so re-add them in
+          // ofy omits keys that don't have values in Datastore, so re-add them in
           // here with Optional.empty() values.
           return Maps.asMap(
               typedKeys,

core/src/main/java/google/registry/model/ofy/AugmentedDeleter.java

@@ -27,7 +27,7 @@ import java.util.Arrays;
 import java.util.stream.Stream;
 
 /**
- * A Deleter that forwards to {@code ofy().delete()}, but can be augmented via subclassing to
+ * A Deleter that forwards to {@code auditedOfy().delete()}, but can be augmented via subclassing to
  * do custom processing on the keys to be deleted prior to their deletion.
  */
 abstract class AugmentedDeleter implements Deleter {

core/src/main/java/google/registry/model/ofy/CommitLogBucket.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.DiscreteDomain.integers;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryConfig.getCommitLogBucketCount;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
 import com.google.common.collect.ContiguousSet;
@@ -118,7 +118,7 @@ public class CommitLogBucket extends ImmutableObject implements Buildable, Datas
 
   /** Returns the loaded bucket for the given key, or a new object if the bucket doesn't exist. */
   public static CommitLogBucket loadBucket(Key<CommitLogBucket> bucketKey) {
-    CommitLogBucket bucket = ofy().load().key(bucketKey).now();
+    CommitLogBucket bucket = auditedOfy().load().key(bucketKey).now();
     return (bucket == null)
         ? new CommitLogBucket.Builder().setBucketNum(bucketKey.getId()).build()
         : bucket;
@@ -126,7 +126,7 @@ public class CommitLogBucket extends ImmutableObject implements Buildable, Datas
 
   /** Returns the set of all loaded commit log buckets, filling in missing buckets with new ones. */
   public static ImmutableSet<CommitLogBucket> loadAllBuckets() {
-    ofy().load().keys(getAllBucketKeys());  // Load all buckets into session cache at once.
+    auditedOfy().load().keys(getAllBucketKeys()); // Load all buckets into session cache at once.
     ImmutableSet.Builder<CommitLogBucket> allBuckets = new ImmutableSet.Builder<>();
     for (Key<CommitLogBucket> key : getAllBucketKeys()) {
       allBuckets.add(loadBucket(key));

core/src/main/java/google/registry/model/ofy/CommitLogCheckpointRoot.java

@@ -14,7 +14,7 @@
 
 package google.registry.model.ofy;
 
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
 import com.googlecode.objectify.Key;
@@ -49,7 +49,7 @@ public class CommitLogCheckpointRoot extends ImmutableObject implements Datastor
   }
 
   public static CommitLogCheckpointRoot loadRoot() {
-    CommitLogCheckpointRoot root = ofy().load().key(getKey()).now();
+    CommitLogCheckpointRoot root = auditedOfy().load().key(getKey()).now();
     return root == null ? new CommitLogCheckpointRoot() : root;
   }
 

core/src/main/java/google/registry/model/ofy/CommitLogMutation.java

@@ -14,10 +14,11 @@
 
 package google.registry.model.ofy;
 
+
 import static com.google.appengine.api.datastore.EntityTranslator.convertToPb;
 import static com.google.appengine.api.datastore.EntityTranslator.createFromPbBytes;
 import static com.google.common.base.Preconditions.checkNotNull;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.appengine.api.datastore.KeyFactory;
 import com.google.common.annotations.VisibleForTesting;
@@ -66,7 +67,7 @@ public class CommitLogMutation extends ImmutableObject implements DatastoreOnlyE
    * converted to a raw Datastore Entity, serialized to bytes, and stored within the mutation.
    */
   public static CommitLogMutation create(Key<CommitLogManifest> parent, Object entity) {
-    return createFromRaw(parent, ofy().save().toEntity(entity));
+    return createFromRaw(parent, auditedOfy().save().toEntity(entity));
   }
 
   /**

core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java

@@ -22,7 +22,7 @@ import static com.google.common.collect.Maps.filterKeys;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.union;
 import static google.registry.model.ofy.CommitLogBucket.loadBucket;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 
 import com.google.common.collect.ImmutableMap;
@@ -134,7 +134,7 @@ class CommitLoggedWork<R> implements Runnable {
     // asynchronous save and delete operations that haven't been reaped, but that's ok because we
     // already logged all of those keys in {@link TransactionInfo} and now just need to figure out
     // what was loaded.
-    ImmutableSet<Key<?>> keysInSessionCache = ofy().getSessionKeys();
+    ImmutableSet<Key<?>> keysInSessionCache = auditedOfy().getSessionKeys();
     Map<Key<BackupGroupRoot>, BackupGroupRoot> rootsForTouchedKeys =
         getBackupGroupRoots(touchedKeys);
     Map<Key<BackupGroupRoot>, BackupGroupRoot> rootsForUntouchedKeys =
@@ -153,14 +153,16 @@ class CommitLoggedWork<R> implements Runnable {
             .stream()
             .map(entity -> (ImmutableObject) CommitLogMutation.create(manifestKey, entity))
             .collect(toImmutableSet());
-    ofy().saveWithoutBackup()
+    auditedOfy()
-      .entities(new ImmutableSet.Builder<>()
+        .saveWithoutBackup()
-          .add(manifest)
+        .entities(
-          .add(bucket.asBuilder().setLastWrittenTime(info.transactionTime).build())
+            new ImmutableSet.Builder<>()
-          .addAll(mutations)
+                .add(manifest)
-          .addAll(untouchedRootsWithTouchedChildren)
+                .add(bucket.asBuilder().setLastWrittenTime(info.transactionTime).build())
-          .build())
+                .addAll(mutations)
-      .now();
+                .addAll(untouchedRootsWithTouchedChildren)
+                .build())
+        .now();
     ReplayQueue.addInTests(info);
   }
 
@@ -185,8 +187,8 @@ class CommitLoggedWork<R> implements Runnable {
     Set<Key<BackupGroupRoot>> rootKeys = new HashSet<>();
     for (Key<?> key : keys) {
       while (key != null
-          && !BackupGroupRoot.class
+          && !BackupGroupRoot.class.isAssignableFrom(
-              .isAssignableFrom(ofy().factory().getMetadata(key).getEntityClass())) {
+              auditedOfy().factory().getMetadata(key).getEntityClass())) {
         key = key.getParent();
       }
       if (key != null) {
@@ -195,6 +197,6 @@ class CommitLoggedWork<R> implements Runnable {
         rootKeys.add(rootKey);
       }
     }
-    return ImmutableMap.copyOf(ofy().load().keys(rootKeys));
+    return ImmutableMap.copyOf(auditedOfy().load().keys(rootKeys));
   }
 }

core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java

@@ -19,7 +19,7 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
 import com.google.common.base.Functions;
@@ -64,7 +64,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   private Ofy getOfy() {
-    return injectedOfy == null ? ofy() : injectedOfy;
+    return injectedOfy == null ? auditedOfy() : injectedOfy;
   }
 
   @Override
@@ -247,7 +247,7 @@ public class DatastoreTransactionManager implements TransactionManager {
 
   @Override
   public <T> T loadByEntity(T entity) {
-    return (T) toSqlEntity(ofy().load().entity(toDatastoreEntity(entity)).now());
+    return (T) toSqlEntity(auditedOfy().load().entity(toDatastoreEntity(entity)).now());
   }
 
   @Override
@@ -409,7 +409,7 @@ public class DatastoreTransactionManager implements TransactionManager {
 
     Query<T> buildQuery() {
       checkOnlyOneInequalityField();
-      Query<T> result = ofy().load().type(entityClass);
+      Query<T> result = auditedOfy().load().type(entityClass);
       for (WhereClause pred : predicates) {
         result = result.filter(pred.fieldName + pred.comparator.getDatastoreString(), pred.value);
       }

core/src/main/java/google/registry/model/ofy/ReplayQueue.java

@@ -15,7 +15,7 @@
 package google.registry.model.ofy;
 
 import static google.registry.model.ofy.EntityWritePriorities.getEntityPriority;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 
 import com.google.common.collect.ImmutableMap;
@@ -53,7 +53,7 @@ public class ReplayQueue {
           // not been applied.  Converting the object to an entity and then back again performs
           // those transformations so that we persist the same values to SQL that we have in
           // Datastore.
-          builder.put(entry.getKey(), ofy().toPojo(ofy().toEntity(entry.getValue())));
+          builder.put(entry.getKey(), auditedOfy().toPojo(auditedOfy().toEntity(entry.getValue())));
         }
       }
       queue.add(builder.build());

core/src/main/java/google/registry/model/ofy/TransactionInfo.java

@@ -20,7 +20,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Maps.filterValues;
 import static com.google.common.collect.Maps.toMap;
 import static google.registry.model.ofy.CommitLogBucket.getArbitraryBucketId;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableMap;
@@ -57,7 +57,7 @@ public class TransactionInfo {
 
   TransactionInfo(DateTime now) {
     this.transactionTime = now;
-    ofy().load().key(bucketKey); // Asynchronously load value into session cache.
+    auditedOfy().load().key(bucketKey); // Asynchronously load value into session cache.
   }
 
   TransactionInfo setReadOnly() {

core/src/main/java/google/registry/model/registrar/Registrar.java

@@ -30,7 +30,7 @@ import static com.google.common.io.BaseEncoding.base64;
 import static google.registry.config.RegistryConfig.getDefaultRegistrarWhoisServer;
 import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.Registries.assertTldsExist;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -648,7 +648,7 @@ public class Registrar extends ImmutableObject
 
   private Iterable<RegistrarContact> getContactsIterable() {
     if (tm().isOfy()) {
-      return ofy().load().type(RegistrarContact.class).ancestor(Registrar.this);
+      return auditedOfy().load().type(RegistrarContact.class).ancestor(Registrar.this);
     } else {
       return tm().transact(
               () ->

core/src/main/java/google/registry/model/registrar/RegistrarContact.java

@@ -21,7 +21,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.io.BaseEncoding.base64;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registrar.Registrar.checkValidEmail;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -207,7 +207,11 @@ public class RegistrarContact extends ImmutableObject
               if (tm().isOfy()) {
                 ImmutableSet<Key<RegistrarContact>> existingKeys =
                     ImmutableSet.copyOf(
-                        ofy().load().type(RegistrarContact.class).ancestor(registrar).keys());
+                        auditedOfy()
+                            .load()
+                            .type(RegistrarContact.class)
+                            .ancestor(registrar)
+                            .keys());
                 tm().delete(
                         difference(
                                 existingKeys,

core/src/main/java/google/registry/model/registry/Registries.java

@@ -23,7 +23,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Maps.filterValues;
 import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.entriesToImmutableMap;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
@@ -60,7 +60,7 @@ public final class Registries {
                     () -> {
                       ImmutableSet<String> tlds =
                           tm().isOfy()
-                              ? ofy()
+                              ? auditedOfy()
                                   .load()
                                   .type(Registry.class)
                                   .ancestor(getCrossTldKey())

core/src/main/java/google/registry/model/registry/label/PremiumListDatastoreDao.java

@@ -21,7 +21,7 @@ import static google.registry.config.RegistryConfig.getDomainLabelListCacheDurat
 import static google.registry.config.RegistryConfig.getSingletonCachePersistDuration;
 import static google.registry.config.RegistryConfig.getStaticPremiumListMaxCachedEntries;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.BLOOM_FILTER_NEGATIVE;
 import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_NEGATIVE;
 import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_POSITIVE;
@@ -117,7 +117,8 @@ public class PremiumListDatastoreDao {
                   new CacheLoader<Key<PremiumListRevision>, PremiumListRevision>() {
                     @Override
                     public PremiumListRevision load(final Key<PremiumListRevision> revisionKey) {
-                      return ofyTm().doTransactionless(() -> ofy().load().key(revisionKey).now());
+                      return ofyTm()
+                          .doTransactionless(() -> auditedOfy().load().key(revisionKey).now());
                     }
                   });
 
@@ -158,7 +159,8 @@ public class PremiumListDatastoreDao {
               @Override
               public Optional<PremiumListEntry> load(final Key<PremiumListEntry> entryKey) {
                 return ofyTm()
-                    .doTransactionless(() -> Optional.ofNullable(ofy().load().key(entryKey).now()));
+                    .doTransactionless(
+                        () -> Optional.ofNullable(auditedOfy().load().key(entryKey).now()));
               }
             });
   }
@@ -232,7 +234,7 @@ public class PremiumListDatastoreDao {
 
     // Save the new child entities in a series of transactions.
     for (final List<PremiumListEntry> batch : partition(parentedEntries, TRANSACTION_BATCH_SIZE)) {
-      ofyTm().transactNew(() -> ofy().save().entities(batch));
+      ofyTm().transactNew(() -> auditedOfy().save().entities(batch));
     }
 
     // Save the new PremiumList and revision itself.
@@ -254,25 +256,29 @@ public class PremiumListDatastoreDao {
                           oldPremiumList.isPresent() ? oldPremiumList.get().creationTime : now)
                       .setRevision(newRevisionKey)
                       .build();
-              ofy().save().entities(newList, newRevision);
+              auditedOfy().save().entities(newList, newRevision);
               premiumListCache.invalidate(premiumList.getName());
               return newList;
             });
   }
 
   public static void delete(PremiumList premiumList) {
-    ofyTm().transactNew(() -> ofy().delete().entity(premiumList));
+    ofyTm().transactNew(() -> auditedOfy().delete().entity(premiumList));
     if (premiumList.getRevisionKey() == null) {
       return;
     }
     for (final List<Key<PremiumListEntry>> batch :
         partition(
-            ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).keys(),
+            auditedOfy()
+                .load()
+                .type(PremiumListEntry.class)
+                .ancestor(premiumList.revisionKey)
+                .keys(),
             TRANSACTION_BATCH_SIZE)) {
-      ofyTm().transactNew(() -> ofy().delete().keys(batch));
+      ofyTm().transactNew(() -> auditedOfy().delete().keys(batch));
       batch.forEach(premiumListEntriesCache::invalidate);
     }
-    ofyTm().transactNew(() -> ofy().delete().key(premiumList.getRevisionKey()));
+    ofyTm().transactNew(() -> auditedOfy().delete().key(premiumList.getRevisionKey()));
     premiumListCache.invalidate(premiumList.getName());
     premiumListRevisionsCache.invalidate(premiumList.getRevisionKey());
   }
@@ -292,12 +298,16 @@ public class PremiumListDatastoreDao {
    * <p>This is an expensive operation and should only be used when the entire list is required.
    */
   public static Iterable<PremiumListEntry> loadPremiumListEntriesUncached(PremiumList premiumList) {
-    return ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).iterable();
+    return auditedOfy()
+        .load()
+        .type(PremiumListEntry.class)
+        .ancestor(premiumList.revisionKey)
+        .iterable();
   }
 
   private static Optional<PremiumList> getLatestRevisionUncached(String name) {
     return Optional.ofNullable(
-        ofy().load().key(Key.create(getCrossTldKey(), PremiumList.class, name)).now());
+        auditedOfy().load().key(Key.create(getCrossTldKey(), PremiumList.class, name)).now());
   }
 
   private static void checkOfyFieldsEqual(

core/src/main/java/google/registry/model/reporting/HistoryEntryDao.java

@@ -15,7 +15,7 @@
 package google.registry.model.reporting;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
@@ -53,7 +53,7 @@ public class HistoryEntryDao {
       DateTime afterTime, DateTime beforeTime) {
     if (tm().isOfy()) {
       return Streams.stream(
-              ofy()
+              auditedOfy()
                   .load()
                   .type(HistoryEntry.class)
                   .order("modificationTime")
@@ -87,7 +87,7 @@ public class HistoryEntryDao {
       VKey<? extends EppResource> parentKey, DateTime afterTime, DateTime beforeTime) {
     if (tm().isOfy()) {
       return Streams.stream(
-              ofy()
+              auditedOfy()
                   .load()
                   .type(HistoryEntry.class)
                   .ancestor(parentKey.getOfyKey())
@@ -106,7 +106,7 @@ public class HistoryEntryDao {
   public static Iterable<? extends HistoryEntry> loadHistoryObjectsByRegistrars(
       ImmutableCollection<String> registrarIds) {
     if (tm().isOfy()) {
-      return ofy()
+      return auditedOfy()
           .load()
           .type(HistoryEntry.class)
           .filter("clientId in", registrarIds)

core/src/main/java/google/registry/model/tmch/ClaimsListShard.java

@@ -19,7 +19,7 @@ import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Throwables.throwIfUnchecked;
 import static com.google.common.base.Verify.verify;
 import static google.registry.model.ofy.ObjectifyService.allocateId;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
@@ -148,7 +148,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
     DateTime creationTime = START_OF_TIME;
     // Grab all of the keys for the shards that belong to the current revision.
     final List<Key<ClaimsListShard>> shardKeys =
-        ofy().load().type(ClaimsListShard.class).ancestor(revisionKey).keys().list();
+        auditedOfy().load().type(ClaimsListShard.class).ancestor(revisionKey).keys().list();
 
     List<ClaimsListShard> shards;
     try {
@@ -160,7 +160,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
                   ofyTm()
                       .transactNewReadOnly(
                           () -> {
-                            ClaimsListShard claimsListShard = ofy().load().key(key).now();
+                            ClaimsListShard claimsListShard = auditedOfy().load().key(key).now();
                             checkState(
                                 claimsListShard != null,
                                 "Key not found when loading claims list shards.");
@@ -251,7 +251,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
                       ClaimsListShard shard = create(creationTime, labelsToKeysShard);
                       shard.isShard = true;
                       shard.parent = parentKey;
-                      ofy().saveWithoutBackup().entity(shard);
+                      auditedOfy().saveWithoutBackup().entity(shard);
                       return shard;
                     }));
 
@@ -263,12 +263,17 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
                   (getCurrentRevision() == null && oldRevision == null)
                       || getCurrentRevision().equals(oldRevision),
                   "Registries' ClaimsList was updated by someone else while attempting to update.");
-              ofy().saveWithoutBackup().entity(ClaimsListSingleton.create(parentKey));
+              auditedOfy().saveWithoutBackup().entity(ClaimsListSingleton.create(parentKey));
               // Delete the old ClaimsListShard entities.
               if (oldRevision != null) {
-                ofy()
+                auditedOfy()
                     .deleteWithoutBackup()
-                    .keys(ofy().load().type(ClaimsListShard.class).ancestor(oldRevision).keys());
+                    .keys(
+                        auditedOfy()
+                            .load()
+                            .type(ClaimsListShard.class)
+                            .ancestor(oldRevision)
+                            .keys());
               }
             });
   }
@@ -345,7 +350,7 @@ public class ClaimsListShard extends ImmutableObject implements NonReplicatedEnt
    */
   @Nullable
   public static Key<ClaimsListRevision> getCurrentRevision() {
-    ClaimsListSingleton singleton = ofy().load().entity(new ClaimsListSingleton()).now();
+    ClaimsListSingleton singleton = auditedOfy().load().entity(new ClaimsListSingleton()).now();
     return singleton == null ? null : singleton.activeRevision;
   }
 

core/src/main/java/google/registry/model/translators/CommitLogRevisionsTranslatorFactory.java

@@ -16,7 +16,7 @@ package google.registry.model.translators;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static google.registry.config.RegistryConfig.getCommitLogDatastoreRetention;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
@@ -68,7 +68,7 @@ public final class CommitLogRevisionsTranslatorFactory
     DateTime preThresholdTime = firstNonNull(revisions.floorKey(threshold), START_OF_TIME);
     return new ImmutableSortedMap.Builder<DateTime, Key<CommitLogManifest>>(Ordering.natural())
         .putAll(revisions.subMap(preThresholdTime, true, now.withTimeAtStartOfDay(), false))
-        .put(now, ofy().getCommitLogManifestKey())
+        .put(now, auditedOfy().getCommitLogManifestKey())
         .build();
   }
 }

core/src/main/java/google/registry/rde/RdeStagingMapper.java

@@ -17,7 +17,6 @@ package google.registry.rde;
 import static com.google.common.base.Strings.nullToEmpty;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.model.EppResourceUtils.loadAtPointInTime;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.appengine.tools.mapreduce.Mapper;
@@ -154,7 +153,7 @@ public final class RdeStagingMapper extends Mapper<EppResource, PendingDeposit,
     getContext().incrementCounter("fragmenter resources found", fragmenter.resourcesFound);
 
     // Avoid running out of memory.
-    ofy().clearSessionCache();
+    tm().clearSessionCache();
   }
 
   /** Loading cache that turns a resource into XML for the various points in time and modes. */

core/src/main/java/google/registry/request/auth/AuthenticatedRegistrarAccessor.java

@@ -18,7 +18,7 @@ import static com.google.common.base.MoreObjects.toStringHelper;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.Streams.stream;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.persistence.transaction.TransactionManagerUtil.transactIfJpaTm;
@@ -321,11 +321,15 @@ public class AuthenticatedRegistrarAccessor {
     // Find all registrars that have a registrar contact with this user's ID.
     if (tm().isOfy()) {
       ImmutableList<Key<Registrar>> accessibleClientIds =
-          stream(ofy().load().type(RegistrarContact.class).filter("gaeUserId", user.getUserId()))
+          stream(
+                  auditedOfy()
+                      .load()
+                      .type(RegistrarContact.class)
+                      .filter("gaeUserId", user.getUserId()))
               .map(RegistrarContact::getParent)
               .collect(toImmutableList());
       // Filter out disabled registrars (note that pending registrars still allow console login).
-      ofy().load().keys(accessibleClientIds).values().stream()
+      auditedOfy().load().keys(accessibleClientIds).values().stream()
           .filter(registrar -> registrar.getState() != State.DISABLED)
           .forEach(registrar -> builder.put(registrar.getClientId(), Role.OWNER));
     } else {

core/src/main/java/google/registry/schema/replay/LastSqlTransaction.java

@@ -15,7 +15,7 @@
 package google.registry.schema.replay;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.googlecode.objectify.Key;
@@ -64,8 +64,8 @@ public class LastSqlTransaction extends ImmutableObject implements DatastoreOnly
    * <p>Creates a new instance of the singleton if it is not already present in Cloud Datastore,
    */
   static LastSqlTransaction load() {
-    ofy().assertInTransaction();
+    auditedOfy().assertInTransaction();
-    LastSqlTransaction result = ofy().load().key(KEY).now();
+    LastSqlTransaction result = auditedOfy().load().key(KEY).now();
     return result == null ? new LastSqlTransaction() : result;
   }
 }

core/src/main/java/google/registry/schema/replay/ReplicateToDatastoreAction.java

@@ -14,7 +14,7 @@
 
 package google.registry.schema.replay;
 
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
 import static google.registry.request.Action.Method.GET;
@@ -113,7 +113,7 @@ class ReplicateToDatastoreAction implements Runnable {
 
               // Write the updated last transaction id to datastore as part of this datastore
               // transaction.
-              ofy().save().entity(lastSqlTxn.cloneWithNewTransactionId(nextTxnId));
+              auditedOfy().save().entity(lastSqlTxn.cloneWithNewTransactionId(nextTxnId));
               logger.atInfo().log(
                   "Finished applying single transaction Cloud SQL -> Cloud Datastore");
               return false;

core/src/main/java/google/registry/tools/server/KillAllCommitLogsAction.java

@@ -16,7 +16,7 @@ package google.registry.tools.server;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableList.toImmutableList;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.request.Action.Method.POST;
 
 import com.google.appengine.tools.mapreduce.Input;
@@ -98,7 +98,7 @@ public class KillAllCommitLogsAction implements Runnable {
 
     @Override
     public void map(Key<?> bucketOrRoot) {
-      for (Key<Object> key : ofy().load().ancestor(bucketOrRoot).keys()) {
+      for (Key<Object> key : auditedOfy().load().ancestor(bucketOrRoot).keys()) {
         emit(bucketOrRoot, key);
         getContext().incrementCounter("entities emitted");
         getContext().incrementCounter(String.format("%s emitted", key.getKind()));

core/src/main/java/google/registry/whois/NameserverLookupByIpCommand.java

@@ -16,7 +16,7 @@ package google.registry.whois;
 
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.collect.ImmutableList.toImmutableList;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
@@ -54,7 +54,7 @@ final class NameserverLookupByIpCommand implements WhoisCommand {
     Iterable<HostResource> hostsFromDb;
     if (tm().isOfy()) {
       hostsFromDb =
-          ofy()
+          auditedOfy()
               .load()
               .type(HostResource.class)
               .filter("inetAddresses", ipAddress)

core/src/test/java/google/registry/backup/DeleteOldCommitLogsActionTest.java

@@ -15,7 +15,7 @@
 package google.registry.backup;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 
 import com.google.common.collect.ImmutableList;
 import google.registry.model.contact.ContactResource;
@@ -63,18 +63,20 @@ public class DeleteOldCommitLogsActionTest
     action.maxAge = maxAge;
     action.run();
     executeTasksUntilEmpty("mapreduce");
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
   }
 
   private void mutateContact(String email) {
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
-    ContactResource contact = ofy().load()
+    ContactResource contact =
-        .type(ContactResource.class)
+        auditedOfy()
-        .first()
+            .load()
-        .now()
+            .type(ContactResource.class)
-        .asBuilder()
+            .first()
-        .setEmailAddress(email)
+            .now()
-        .build();
+            .asBuilder()
+            .setEmailAddress(email)
+            .build();
     DatabaseHelper.persistResourceWithCommitLog(contact);
   }
 
@@ -85,22 +87,22 @@ public class DeleteOldCommitLogsActionTest
       String email = String.format("pumpkin_%d@cat.test", i);
       mutateContact(email);
     }
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
 
-    contact = ofy().load().type(ContactResource.class).first().now();
+    contact = auditedOfy().load().type(ContactResource.class).first().now();
 
     // The following value might change if {@link CommitLogRevisionsTranslatorFactory} changes.
     assertThat(contact.getRevisions().size()).isEqualTo(6);
 
     // Before deleting the unneeded manifests - we have 11 of them (one for the first
     // creation, and 10 more for the mutateContacts)
-    assertThat(ofy().load().type(CommitLogManifest.class).count()).isEqualTo(11);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).count()).isEqualTo(11);
     // And each DatabaseHelper.persistResourceWithCommitLog creates 3 mutations
-    assertThat(ofy().load().type(CommitLogMutation.class).count()).isEqualTo(33);
+    assertThat(auditedOfy().load().type(CommitLogMutation.class).count()).isEqualTo(33);
   }
 
   private <T> ImmutableList<T> ofyLoadType(Class<T> clazz) {
-    return ImmutableList.copyOf(ofy().load().type(clazz).iterable());
+    return ImmutableList.copyOf(auditedOfy().load().type(clazz).iterable());
   }
 
   /** Check that with very short maxAge, only the referenced elements remain. */
@@ -108,7 +110,9 @@ public class DeleteOldCommitLogsActionTest
   void test_shortMaxAge() throws Exception {
     runMapreduce(Duration.millis(1));
 
-    assertThat(ImmutableList.copyOf(ofy().load().type(CommitLogManifest.class).keys().iterable()))
+    assertThat(
+            ImmutableList.copyOf(
+                auditedOfy().load().type(CommitLogManifest.class).keys().iterable()))
         .containsExactlyElementsIn(contact.getRevisions().values());
 
     // And each DatabaseHelper.persistResourceWithCommitLog creates 3 mutations

core/src/test/java/google/registry/backup/RestoreCommitLogsActionTest.java

@@ -24,7 +24,7 @@ import static google.registry.backup.BackupUtils.serializeEntity;
 import static google.registry.backup.ExportCommitLogDiffAction.DIFF_FILE_PREFIX;
 import static google.registry.model.ofy.CommitLogBucket.getBucketIds;
 import static google.registry.model.ofy.CommitLogBucket.getBucketKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.appengine.api.datastore.DatastoreServiceFactory;
@@ -89,7 +89,7 @@ public class RestoreCommitLogsActionTest {
 
   @Test
   void testRestore_multipleDiffFiles() throws Exception {
-    ofy()
+    auditedOfy()
         .saveWithoutBackup()
         .entities(TestObject.create("previous to keep"), TestObject.create("previous to delete"))
         .now();
@@ -134,7 +134,7 @@ public class RestoreCommitLogsActionTest {
             CommitLogMutation.create(manifest2Key, TestObject.create("f")));
     action.fromTime = now.minusMinutes(1).minusMillis(1);
     action.run();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertExpectedIds("previous to keep", "b", "d", "e", "f");
     assertInDatastore(file1CommitLogs);
     assertInDatastore(file2CommitLogs);
@@ -144,11 +144,11 @@ public class RestoreCommitLogsActionTest {
 
   @Test
   void testRestore_noManifests() throws Exception {
-    ofy().saveWithoutBackup().entity(TestObject.create("previous to keep")).now();
+    auditedOfy().saveWithoutBackup().entity(TestObject.create("previous to keep")).now();
     saveDiffFileNotToRestore(gcsService, now.minusMinutes(1));
     Iterable<ImmutableObject> commitLogs = saveDiffFile(gcsService, createCheckpoint(now));
     action.run();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertExpectedIds("previous to keep");
     assertInDatastore(commitLogs);
     assertInDatastore(CommitLogCheckpointRoot.create(now));
@@ -157,7 +157,7 @@ public class RestoreCommitLogsActionTest {
 
   @Test
   void testRestore_manifestWithNoDeletions() throws Exception {
-    ofy().saveWithoutBackup().entity(TestObject.create("previous to keep")).now();
+    auditedOfy().saveWithoutBackup().entity(TestObject.create("previous to keep")).now();
     Key<CommitLogBucket> bucketKey = getBucketKey(1);
     Key<CommitLogManifest> manifestKey = CommitLogManifest.createKey(bucketKey, now);
     saveDiffFileNotToRestore(gcsService, now.minusMinutes(1));
@@ -169,7 +169,7 @@ public class RestoreCommitLogsActionTest {
             CommitLogMutation.create(manifestKey, TestObject.create("a")),
             CommitLogMutation.create(manifestKey, TestObject.create("b")));
     action.run();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertExpectedIds("previous to keep", "a", "b");
     assertInDatastore(commitLogs);
     assertInDatastore(CommitLogCheckpointRoot.create(now));
@@ -178,7 +178,7 @@ public class RestoreCommitLogsActionTest {
 
   @Test
   void testRestore_manifestWithNoMutations() throws Exception {
-    ofy()
+    auditedOfy()
         .saveWithoutBackup()
         .entities(TestObject.create("previous to keep"), TestObject.create("previous to delete"))
         .now();
@@ -192,7 +192,7 @@ public class RestoreCommitLogsActionTest {
                 now,
                 ImmutableSet.of(Key.create(TestObject.create("previous to delete")))));
     action.run();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertExpectedIds("previous to keep");
     assertInDatastore(commitLogs);
     assertInDatastore(CommitLogCheckpointRoot.create(now));
@@ -202,7 +202,7 @@ public class RestoreCommitLogsActionTest {
   // This is a pathological case that shouldn't be possible, but we should be robust to it.
   @Test
   void testRestore_manifestWithNoMutationsOrDeletions() throws Exception {
-    ofy().saveWithoutBackup().entities(TestObject.create("previous to keep")).now();
+    auditedOfy().saveWithoutBackup().entities(TestObject.create("previous to keep")).now();
     saveDiffFileNotToRestore(gcsService, now.minusMinutes(1));
     Iterable<ImmutableObject> commitLogs =
         saveDiffFile(
@@ -210,7 +210,7 @@ public class RestoreCommitLogsActionTest {
             createCheckpoint(now),
             CommitLogManifest.create(getBucketKey(1), now, null));
     action.run();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertExpectedIds("previous to keep");
     assertInDatastore(commitLogs);
     assertInDatastore(CommitLogCheckpointRoot.create(now));
@@ -219,7 +219,7 @@ public class RestoreCommitLogsActionTest {
 
   @Test
   void testRestore_mutateExistingEntity() throws Exception {
-    ofy().saveWithoutBackup().entity(TestObject.create("existing", "a")).now();
+    auditedOfy().saveWithoutBackup().entity(TestObject.create("existing", "a")).now();
     Key<CommitLogManifest> manifestKey = CommitLogManifest.createKey(getBucketKey(1), now);
     saveDiffFileNotToRestore(gcsService, now.minusMinutes(1));
     Iterable<ImmutableObject> commitLogs =
@@ -229,8 +229,9 @@ public class RestoreCommitLogsActionTest {
             CommitLogManifest.create(getBucketKey(1), now, null),
             CommitLogMutation.create(manifestKey, TestObject.create("existing", "b")));
     action.run();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
-    assertThat(ofy().load().entity(TestObject.create("existing")).now().getField()).isEqualTo("b");
+    assertThat(auditedOfy().load().entity(TestObject.create("existing")).now().getField())
+        .isEqualTo("b");
     assertInDatastore(commitLogs);
     assertInDatastore(CommitLogCheckpointRoot.create(now));
     assertCommitLogBuckets(ImmutableMap.of(1, now));
@@ -239,7 +240,7 @@ public class RestoreCommitLogsActionTest {
   // This should be harmless; deletes are idempotent.
   @Test
   void testRestore_deleteMissingEntity() throws Exception {
-    ofy().saveWithoutBackup().entity(TestObject.create("previous to keep", "a")).now();
+    auditedOfy().saveWithoutBackup().entity(TestObject.create("previous to keep", "a")).now();
     saveDiffFileNotToRestore(gcsService, now.minusMinutes(1));
     Iterable<ImmutableObject> commitLogs =
         saveDiffFile(
@@ -250,7 +251,7 @@ public class RestoreCommitLogsActionTest {
                 now,
                 ImmutableSet.of(Key.create(TestObject.create("previous to delete")))));
     action.run();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertExpectedIds("previous to keep");
     assertInDatastore(commitLogs);
     assertCommitLogBuckets(ImmutableMap.of(1, now));
@@ -290,22 +291,24 @@ public class RestoreCommitLogsActionTest {
   }
 
   private void assertExpectedIds(String... ids) {
-    assertThat(transform(ofy().load().type(TestObject.class), TestObject::getId))
+    assertThat(transform(auditedOfy().load().type(TestObject.class), TestObject::getId))
         .containsExactly((Object[]) ids);
   }
 
   private void assertInDatastore(ImmutableObject entity) {
-    assertThat(ofy().load().entity(entity).now()).isEqualTo(entity);
+    assertThat(auditedOfy().load().entity(entity).now()).isEqualTo(entity);
   }
 
   private void assertInDatastore(Iterable<? extends ImmutableObject> entities) {
-    assertThat(ofy().load().entities(entities).values()).containsExactlyElementsIn(entities);
+    assertThat(auditedOfy().load().entities(entities).values()).containsExactlyElementsIn(entities);
   }
 
   private void assertCommitLogBuckets(Map<Integer, DateTime> bucketIdsAndTimestamps) {
-    Map<Long, CommitLogBucket> buckets = ofy().load()
+    Map<Long, CommitLogBucket> buckets =
-        .type(CommitLogBucket.class)
+        auditedOfy()
-        .ids(Longs.asList(Longs.toArray(CommitLogBucket.getBucketIds())));
+            .load()
+            .type(CommitLogBucket.class)
+            .ids(Longs.asList(Longs.toArray(CommitLogBucket.getBucketIds())));
     assertThat(buckets).hasSize(bucketIdsAndTimestamps.size());
     for (Entry<Integer, DateTime> bucketIdAndTimestamp : bucketIdsAndTimestamps.entrySet()) {
       assertThat(buckets.get((long) bucketIdAndTimestamp.getKey()).getLastWrittenTime())

core/src/test/java/google/registry/batch/DeleteContactsAndHostsActionTest.java

@@ -22,7 +22,7 @@ import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_DELETE;
 import static google.registry.batch.AsyncTaskMetrics.OperationResult.STALE;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.model.eppcommon.StatusValue.PENDING_DELETE;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE_FAILURE;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_TRANSFER_REQUEST;
@@ -132,7 +132,7 @@ public class DeleteContactsAndHostsActionTest
     executeTasksUntilEmpty("mapreduce", clock);
     sleeper.sleep(millis(50));
     clock.advanceBy(standardSeconds(5));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
   }
 
   /** Kicks off, but does not run, the mapreduce tasks. Useful for testing validation/setup. */
@@ -140,7 +140,7 @@ public class DeleteContactsAndHostsActionTest
     clock.advanceBy(standardSeconds(5));
     action.run();
     clock.advanceBy(standardSeconds(5));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
   }
 
   @BeforeEach
@@ -258,7 +258,7 @@ public class DeleteContactsAndHostsActionTest
         false);
     runMapreduce();
     assertThat(loadByForeignKey(ContactResource.class, "jim919", clock.nowUtc())).isEmpty();
-    ContactResource contactAfterDeletion = ofy().load().entity(contact).now();
+    ContactResource contactAfterDeletion = auditedOfy().load().entity(contact).now();
     assertAboutContacts()
         .that(contactAfterDeletion)
         .isNotActiveAt(clock.nowUtc())
@@ -299,7 +299,7 @@ public class DeleteContactsAndHostsActionTest
         Trid.create("fakeClientTrid", "fakeServerTrid"),
         false);
     runMapreduce();
-    ContactResource contactAfterDeletion = ofy().load().entity(contact).now();
+    ContactResource contactAfterDeletion = auditedOfy().load().entity(contact).now();
     assertThat(contactAfterDeletion.getTransferData()).isEqualTo(ContactTransferData.EMPTY);
   }
 
@@ -444,7 +444,7 @@ public class DeleteContactsAndHostsActionTest
         true);
     runMapreduce();
     assertThat(loadByForeignKey(ContactResource.class, "nate007", clock.nowUtc())).isEmpty();
-    ContactResource contactAfterDeletion = ofy().load().entity(contact).now();
+    ContactResource contactAfterDeletion = auditedOfy().load().entity(contact).now();
     assertAboutContacts()
         .that(contactAfterDeletion)
         .isNotActiveAt(clock.nowUtc())
@@ -579,8 +579,8 @@ public class DeleteContactsAndHostsActionTest
         Trid.create("fakeClientTrid", "fakeServerTrid"),
         false);
     enqueueMapreduceOnly();
-    assertThat(ofy().load().entity(contactDeleted).now()).isEqualTo(contactDeleted);
+    assertThat(auditedOfy().load().entity(contactDeleted).now()).isEqualTo(contactDeleted);
-    assertThat(ofy().load().entity(hostDeleted).now()).isEqualTo(hostDeleted);
+    assertThat(auditedOfy().load().entity(hostDeleted).now()).isEqualTo(hostDeleted);
     assertNoTasksEnqueued(QUEUE_ASYNC_DELETE);
     assertThat(acquireLock()).isPresent();
   }
@@ -844,12 +844,12 @@ public class DeleteContactsAndHostsActionTest
     }
     runMapreduce();
     for (EppResource resource : ImmutableList.<EppResource>of(c1, c2, c3, h1, h2, h3)) {
-      EppResource loaded = ofy().load().entity(resource).now();
+      EppResource loaded = auditedOfy().load().entity(resource).now();
       assertThat(loaded.getDeletionTime()).isLessThan(DateTime.now(UTC));
       assertThat(loaded.getStatusValues()).doesNotContain(PENDING_DELETE);
     }
     for (EppResource resource : ImmutableList.<EppResource>of(c4, h4)) {
-      EppResource loaded = ofy().load().entity(resource).now();
+      EppResource loaded = auditedOfy().load().entity(resource).now();
       assertThat(loaded.getDeletionTime()).isEqualTo(END_OF_TIME);
       assertThat(loaded.getStatusValues()).doesNotContain(PENDING_DELETE);
     }

core/src/test/java/google/registry/batch/DeleteProberDataActionTest.java

@@ -17,7 +17,7 @@ package google.registry.batch;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.newDomainBase;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
@@ -195,7 +195,8 @@ class DeleteProberDataActionTest extends MapreduceTestCase<DeleteProberDataActio
     DateTime timeAfterDeletion = DateTime.now(UTC);
     assertThat(loadByForeignKey(DomainBase.class, "blah.ib-any.test", timeAfterDeletion))
         .isEmpty();
-    assertThat(ofy().load().entity(domain).now().getDeletionTime()).isLessThan(timeAfterDeletion);
+    assertThat(auditedOfy().load().entity(domain).now().getDeletionTime())
+        .isLessThan(timeAfterDeletion);
     assertDnsTasksEnqueued("blah.ib-any.test");
   }
 
@@ -212,7 +213,8 @@ class DeleteProberDataActionTest extends MapreduceTestCase<DeleteProberDataActio
     runMapreduce();
     assertThat(loadByForeignKey(DomainBase.class, "blah.ib-any.test", timeAfterDeletion))
         .isEmpty();
-    assertThat(ofy().load().entity(domain).now().getDeletionTime()).isLessThan(timeAfterDeletion);
+    assertThat(auditedOfy().load().entity(domain).now().getDeletionTime())
+        .isLessThan(timeAfterDeletion);
     assertDnsTasksEnqueued("blah.ib-any.test");
   }
 
@@ -239,7 +241,7 @@ class DeleteProberDataActionTest extends MapreduceTestCase<DeleteProberDataActio
             .build());
     action.isDryRun = true;
     runMapreduce();
-    assertThat(ofy().load().entity(domain).now().getDeletionTime()).isEqualTo(END_OF_TIME);
+    assertThat(auditedOfy().load().entity(domain).now().getDeletionTime()).isEqualTo(END_OF_TIME);
   }
 
   @Test
@@ -255,8 +257,8 @@ class DeleteProberDataActionTest extends MapreduceTestCase<DeleteProberDataActio
                 .build(),
             DateTime.now(UTC).minusYears(1));
     runMapreduce();
-    assertThat(ofy().load().entity(domainWithSubord).now()).isNotNull();
+    assertThat(auditedOfy().load().entity(domainWithSubord).now()).isNotNull();
-    assertThat(ofy().load().entity(nakedDomain).now()).isNull();
+    assertThat(auditedOfy().load().entity(nakedDomain).now()).isNull();
   }
 
   @Test
@@ -303,7 +305,7 @@ class DeleteProberDataActionTest extends MapreduceTestCase<DeleteProberDataActio
     ForeignKeyIndex<DomainBase> fki =
         ForeignKeyIndex.load(DomainBase.class, fqdn, START_OF_TIME);
     EppResourceIndex eppIndex =
-        ofy().load().entity(EppResourceIndex.create(Key.create(domain))).now();
+        auditedOfy().load().entity(EppResourceIndex.create(Key.create(domain))).now();
     return ImmutableSet.of(
         domain, historyEntry, billingEvent, pollMessage, fki, eppIndex);
   }
@@ -318,13 +320,13 @@ class DeleteProberDataActionTest extends MapreduceTestCase<DeleteProberDataActio
 
   private static void assertNotDeleted(Iterable<ImmutableObject> entities) {
     for (ImmutableObject entity : entities) {
-      assertThat(ofy().load().entity(entity).now()).isNotNull();
+      assertThat(auditedOfy().load().entity(entity).now()).isNotNull();
     }
   }
 
   private static void assertDeleted(Iterable<ImmutableObject> entities) {
     for (ImmutableObject entity : entities) {
-      assertThat(ofy().load().entity(entity).now()).isNull();
+      assertThat(auditedOfy().load().entity(entity).now()).isNull();
     }
   }
 }

core/src/test/java/google/registry/batch/ExpandRecurringBillingEventsActionTest.java

@@ -17,7 +17,7 @@ package google.registry.batch;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
 import static google.registry.model.domain.Period.Unit.YEARS;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_AUTORENEW;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.assertBillingEvents;
@@ -108,11 +108,11 @@ public class ExpandRecurringBillingEventsActionTest
     action.response = new FakeResponse();
     action.run();
     executeTasksUntilEmpty("mapreduce", clock);
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
   }
 
   private void assertCursorAt(DateTime expectedCursorTime) {
-    Cursor cursor = ofy().load().key(Cursor.createGlobalKey(RECURRING_BILLING)).now();
+    Cursor cursor = auditedOfy().load().key(Cursor.createGlobalKey(RECURRING_BILLING)).now();
     assertThat(cursor).isNotNull();
     assertThat(cursor.getCursorTime()).isEqualTo(expectedCursorTime);
   }

core/src/test/java/google/registry/batch/ResaveAllEppResourcesActionTest.java

@@ -15,7 +15,7 @@
 package google.registry.batch;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 import static google.registry.testing.DatabaseHelper.persistContactWithPendingTransfer;
 import static org.joda.time.DateTimeZone.UTC;
@@ -47,11 +47,11 @@ class ResaveAllEppResourcesActionTest extends MapreduceTestCase<ResaveAllEppReso
   void test_mapreduceSuccessfullyResavesEntity() throws Exception {
     ContactResource contact = persistActiveContact("test123");
     DateTime creationTime = contact.getUpdateTimestamp().getTimestamp();
-    assertThat(ofy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
+    assertThat(auditedOfy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
         .isEqualTo(creationTime);
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     runMapreduce();
-    assertThat(ofy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
+    assertThat(auditedOfy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
         .isGreaterThan(creationTime);
   }
 
@@ -59,12 +59,12 @@ class ResaveAllEppResourcesActionTest extends MapreduceTestCase<ResaveAllEppReso
   void test_fastMode_doesNotResaveEntityWithNoChanges() throws Exception {
     ContactResource contact = persistActiveContact("test123");
     DateTime creationTime = contact.getUpdateTimestamp().getTimestamp();
-    assertThat(ofy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
+    assertThat(auditedOfy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
         .isEqualTo(creationTime);
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     action.isFast = true;
     runMapreduce();
-    assertThat(ofy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
+    assertThat(auditedOfy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
         .isEqualTo(creationTime);
   }
 
@@ -81,10 +81,10 @@ class ResaveAllEppResourcesActionTest extends MapreduceTestCase<ResaveAllEppReso
     assertThat(contact.getTransferData().getTransferStatus()).isEqualTo(TransferStatus.PENDING);
     runMapreduce();
 
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     // The transfer should be effective after the contact is re-saved, as it should've been
     // projected to the current time.
-    ContactResource resavedContact = ofy().load().entity(contact).now();
+    ContactResource resavedContact = auditedOfy().load().entity(contact).now();
     assertThat(resavedContact.getTransferData().getTransferStatus())
         .isEqualTo(TransferStatus.SERVER_APPROVED);
   }

core/src/test/java/google/registry/beam/initsql/BackupTestStore.java

@@ -15,7 +15,7 @@
 package google.registry.beam.initsql;
 
 import static com.google.common.base.Preconditions.checkState;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.appengine.api.datastore.DatastoreService;
@@ -76,8 +76,8 @@ public final class BackupTestStore implements AutoCloseable {
     long timestamp = fakeClock.nowUtc().getMillis();
     tm().transact(
             () -> {
-              ofy().delete().entities(deletes);
+              auditedOfy().delete().entities(deletes);
-              ofy().save().entities(newOrUpdated);
+              auditedOfy().save().entities(newOrUpdated);
             });
     fakeClock.advanceOneMilli();
     return timestamp;
@@ -90,7 +90,7 @@ public final class BackupTestStore implements AutoCloseable {
   @SafeVarargs
   public final long insertOrUpdate(Object... entities) {
     long timestamp = fakeClock.nowUtc().getMillis();
-    tm().transact(() -> ofy().save().entities(entities).now());
+    tm().transact(() -> auditedOfy().save().entities(entities).now());
     fakeClock.advanceOneMilli();
     return timestamp;
   }
@@ -99,7 +99,7 @@ public final class BackupTestStore implements AutoCloseable {
   @SafeVarargs
   public final long delete(Object... entities) {
     long timestamp = fakeClock.nowUtc().getMillis();
-    tm().transact(() -> ofy().delete().entities(entities).now());
+    tm().transact(() -> auditedOfy().delete().entities(entities).now());
     fakeClock.advanceOneMilli();
     return timestamp;
   }
@@ -126,7 +126,7 @@ public final class BackupTestStore implements AutoCloseable {
    */
   public Object loadAsOfyEntity(Object ofyEntity) {
     try {
-      return ofy().load().fromEntity(datastoreService.get(Key.create(ofyEntity).getRaw()));
+      return auditedOfy().load().fromEntity(datastoreService.get(Key.create(ofyEntity).getRaw()));
     } catch (EntityNotFoundException e) {
       throw new NoSuchElementException(e.getMessage());
     }
@@ -161,10 +161,10 @@ public final class BackupTestStore implements AutoCloseable {
   private void exportOneKind(File perKindFile, Class<?> pojoType, Set<Key<?>> excludes)
       throws IOException {
     LevelDbFileBuilder builder = new LevelDbFileBuilder(perKindFile);
-    for (Object pojo : ofy().load().type(pojoType).iterable()) {
+    for (Object pojo : auditedOfy().load().type(pojoType).iterable()) {
       if (!excludes.contains(Key.create(pojo))) {
         try {
-          // Must preserve UpdateTimestamp. Do not use ofy().save().toEntity(pojo)!
+          // Must preserve UpdateTimestamp. Do not use auditedOfy().save().toEntity(pojo)!
           builder.addEntity(datastoreService.get(Key.create(pojo).getRaw()));
         } catch (Exception e) {
           throw new RuntimeException(e);

core/src/test/java/google/registry/beam/initsql/DomainBaseUtilTest.java

@@ -15,7 +15,7 @@
 package google.registry.beam.initsql;
 
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.cloneAndSetAutoTimestamps;
 import static google.registry.testing.DatabaseHelper.createTld;
@@ -166,7 +166,7 @@ public class DomainBaseUtilTest {
                             "registrar",
                             null))
                     .build()));
-    domainEntity = tm().transact(() -> ofy().toEntity(domain));
+    domainEntity = tm().transact(() -> auditedOfy().toEntity(domain));
   }
 
   @Test
@@ -182,7 +182,7 @@ public class DomainBaseUtilTest {
             .setGracePeriods(ImmutableSet.of())
             .build();
     DomainBase domainTransformedByUtil =
-        (DomainBase) ofy().toPojo(DomainBaseUtil.removeBillingAndPollAndHosts(domainEntity));
+        (DomainBase) auditedOfy().toPojo(DomainBaseUtil.removeBillingAndPollAndHosts(domainEntity));
     // Compensates for the missing INACTIVE status.
     domainTransformedByUtil = domainTransformedByUtil.asBuilder().build();
     assertAboutImmutableObjects()
@@ -202,9 +202,10 @@ public class DomainBaseUtilTest {
             .setTransferData(null)
             .setGracePeriods(ImmutableSet.of())
             .build();
-    Entity entityWithoutFkeys = tm().transact(() -> ofy().toEntity(domainWithoutFKeys));
+    Entity entityWithoutFkeys = tm().transact(() -> auditedOfy().toEntity(domainWithoutFKeys));
     DomainBase domainTransformedByUtil =
-        (DomainBase) ofy().toPojo(DomainBaseUtil.removeBillingAndPollAndHosts(entityWithoutFkeys));
+        (DomainBase)
+            auditedOfy().toPojo(DomainBaseUtil.removeBillingAndPollAndHosts(entityWithoutFkeys));
     // Compensates for the missing INACTIVE status.
     domainTransformedByUtil = domainTransformedByUtil.asBuilder().build();
     assertAboutImmutableObjects()
@@ -215,7 +216,7 @@ public class DomainBaseUtilTest {
   @Test
   void removeBillingAndPollAndHosts_notDomainBase() {
     Entity contactEntity =
-        tm().transact(() -> ofy().toEntity(DatabaseHelper.newContactResource("contact")));
+        tm().transact(() -> auditedOfy().toEntity(DatabaseHelper.newContactResource("contact")));
 
     assertThrows(
         IllegalArgumentException.class,

core/src/test/java/google/registry/beam/initsql/InitSqlTestUtils.java

@@ -15,7 +15,7 @@
 package google.registry.beam.initsql;
 
 import static com.google.common.truth.Truth8.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static org.apache.beam.sdk.values.TypeDescriptors.kvs;
 import static org.apache.beam.sdk.values.TypeDescriptors.strings;
 
@@ -49,7 +49,7 @@ public final class InitSqlTestUtils {
 
   /** Converts a Datastore {@link Entity} to an Objectify entity. */
   public static Object datastoreToOfyEntity(Entity entity) {
-    return ofy().load().fromEntity(entity);
+    return auditedOfy().load().fromEntity(entity);
   }
 
   /** Serializes a Datastore {@link Entity} to byte array. */

core/src/test/java/google/registry/flows/EppCommitLogsTest.java

@@ -16,7 +16,7 @@ package google.registry.flows;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.EppResourceUtils.loadAtPointInTime;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
@@ -95,64 +95,64 @@ class EppCommitLogsTest {
     clock.setTo(timeAtCreate);
     eppLoader = new EppLoader(this, "domain_create.xml", ImmutableMap.of("DOMAIN", "example.tld"));
     runFlow();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
-    Key<DomainBase> key = Key.create(ofy().load().type(DomainBase.class).first().now());
+    Key<DomainBase> key = Key.create(auditedOfy().load().type(DomainBase.class).first().now());
-    DomainBase domainAfterCreate = ofy().load().key(key).now();
+    DomainBase domainAfterCreate = auditedOfy().load().key(key).now();
     assertThat(domainAfterCreate.getDomainName()).isEqualTo("example.tld");
 
     clock.advanceBy(standardDays(2));
     DateTime timeAtFirstUpdate = clock.nowUtc();
     eppLoader = new EppLoader(this, "domain_update_dsdata_add.xml");
     runFlow();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
 
-    DomainBase domainAfterFirstUpdate = ofy().load().key(key).now();
+    DomainBase domainAfterFirstUpdate = auditedOfy().load().key(key).now();
     assertThat(domainAfterCreate).isNotEqualTo(domainAfterFirstUpdate);
 
     clock.advanceOneMilli(); // same day as first update
     DateTime timeAtSecondUpdate = clock.nowUtc();
     eppLoader = new EppLoader(this, "domain_update_dsdata_rem.xml");
     runFlow();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
-    DomainBase domainAfterSecondUpdate = ofy().load().key(key).now();
+    DomainBase domainAfterSecondUpdate = auditedOfy().load().key(key).now();
 
     clock.advanceBy(standardDays(2));
     DateTime timeAtDelete = clock.nowUtc(); // before 'add' grace period ends
     eppLoader = new EppLoader(this, "domain_delete.xml", ImmutableMap.of("DOMAIN", "example.tld"));
     runFlow();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
 
     assertThat(domainAfterFirstUpdate).isNotEqualTo(domainAfterSecondUpdate);
 
     // Point-in-time can only rewind an object from the current version, not roll forward.
-    DomainBase latest = ofy().load().key(key).now();
+    DomainBase latest = auditedOfy().load().key(key).now();
 
     // Creation time has millisecond granularity due to isActive() check.
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(loadAtPointInTime(latest, timeAtCreate.minusMillis(1)).now()).isNull();
     assertThat(loadAtPointInTime(latest, timeAtCreate).now()).isNotNull();
     assertThat(loadAtPointInTime(latest, timeAtCreate.plusMillis(1)).now()).isNotNull();
 
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(loadAtPointInTime(latest, timeAtCreate.plusDays(1)).now())
         .isEqualTo(domainAfterCreate);
 
     // Both updates happened on the same day. Since the revisions field has day granularity, the
     // key to the first update should have been overwritten by the second, and its timestamp rolled
     // forward. So we have to fall back to the last revision before midnight.
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(loadAtPointInTime(latest, timeAtFirstUpdate).now()).isEqualTo(domainAfterCreate);
 
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(loadAtPointInTime(latest, timeAtSecondUpdate).now())
         .isEqualTo(domainAfterSecondUpdate);
 
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(loadAtPointInTime(latest, timeAtSecondUpdate.plusDays(1)).now())
         .isEqualTo(domainAfterSecondUpdate);
 
     // Deletion time has millisecond granularity due to isActive() check.
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(loadAtPointInTime(latest, timeAtDelete.minusMillis(1)).now()).isNotNull();
     assertThat(loadAtPointInTime(latest, timeAtDelete).now()).isNull();
     assertThat(loadAtPointInTime(latest, timeAtDelete.plusMillis(1)).now()).isNull();

core/src/test/java/google/registry/flows/ResourceFlowTestCase.java

@@ -18,7 +18,7 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.persistence.transaction.TransactionManagerUtil.transactIfJpaTm;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
@@ -137,14 +137,14 @@ public abstract class ResourceFlowTestCase<F extends Flow, R extends EppResource
     }
     ImmutableList<EppResourceIndex> indices =
         Streams.stream(
-                ofy()
+                auditedOfy()
                     .load()
                     .type(EppResourceIndex.class)
                     .filter("kind", Key.getKind(resource.getClass())))
             .filter(
                 index ->
                     Key.create(resource).equals(index.getKey())
-                        && ofy().load().key(index.getKey()).now().equals(resource))
+                        && auditedOfy().load().key(index.getKey()).now().equals(resource))
             .collect(toImmutableList());
     assertThat(indices).hasSize(1);
     assertThat(indices.get(0).getBucket())

core/src/test/java/google/registry/model/EntityTestCase.java

@@ -16,7 +16,7 @@ package google.registry.model;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.common.base.Splitter;
@@ -135,7 +135,7 @@ public abstract class EntityTestCase {
       try {
         // Objectify happily filters on an unindexed field, and just returns zero results.
         // Do a query for that value and verify that the expected number of results are returned.
-        Query<?> query = ofy().load().type(obj.getClass());
+        Query<?> query = auditedOfy().load().type(obj.getClass());
         int results = query.filter(fieldPath, fieldValue).count();
         assertWithMessage(String.format("%s was %sindexed", fieldPath, indexed ? "not " : ""))
             .that(indexed)

core/src/test/java/google/registry/model/billing/BillingEventTest.java

@@ -16,7 +16,7 @@ package google.registry.model.billing;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.domain.token.AllocationToken.TokenType.UNLIMITED_USE;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.persistence.transaction.TransactionManagerUtil.ofyTmOrDoNothing;
 import static google.registry.testing.DatabaseHelper.createTld;
@@ -197,21 +197,32 @@ public class BillingEventTest extends EntityTestCase {
   void testParenting() {
     // Note that these are all tested separately because BillingEvent is an abstract base class that
     // lacks the @Entity annotation, and thus we cannot call .type(BillingEvent.class)
-    assertThat(ofy().load().type(BillingEvent.OneTime.class).ancestor(domain).list())
+    assertThat(auditedOfy().load().type(BillingEvent.OneTime.class).ancestor(domain).list())
         .containsExactly(oneTime, oneTimeSynthetic);
-    assertThat(ofy().load().type(BillingEvent.Recurring.class).ancestor(domain).list())
+    assertThat(auditedOfy().load().type(BillingEvent.Recurring.class).ancestor(domain).list())
         .containsExactly(recurring);
-    assertThat(ofy().load().type(BillingEvent.Cancellation.class).ancestor(domain).list())
+    assertThat(auditedOfy().load().type(BillingEvent.Cancellation.class).ancestor(domain).list())
         .containsExactly(cancellationOneTime, cancellationRecurring);
-    assertThat(ofy().load().type(BillingEvent.Modification.class).ancestor(domain).list())
+    assertThat(auditedOfy().load().type(BillingEvent.Modification.class).ancestor(domain).list())
         .containsExactly(modification);
-    assertThat(ofy().load().type(BillingEvent.OneTime.class).ancestor(domainHistory).list())
+    assertThat(auditedOfy().load().type(BillingEvent.OneTime.class).ancestor(domainHistory).list())
         .containsExactly(oneTime, oneTimeSynthetic);
-    assertThat(ofy().load().type(BillingEvent.Recurring.class).ancestor(domainHistory).list())
+    assertThat(
+            auditedOfy().load().type(BillingEvent.Recurring.class).ancestor(domainHistory).list())
         .containsExactly(recurring);
-    assertThat(ofy().load().type(BillingEvent.Cancellation.class).ancestor(domainHistory2).list())
+    assertThat(
+            auditedOfy()
+                .load()
+                .type(BillingEvent.Cancellation.class)
+                .ancestor(domainHistory2)
+                .list())
         .containsExactly(cancellationOneTime, cancellationRecurring);
-    assertThat(ofy().load().type(BillingEvent.Modification.class).ancestor(domainHistory2).list())
+    assertThat(
+            auditedOfy()
+                .load()
+                .type(BillingEvent.Modification.class)
+                .ancestor(domainHistory2)
+                .list())
         .containsExactly(modification);
   }
 

core/src/test/java/google/registry/model/common/GaeUserIdConverterTest.java

@@ -15,7 +15,7 @@
 package google.registry.model.common;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import google.registry.testing.AppEngineExtension;
@@ -32,7 +32,7 @@ public class GaeUserIdConverterTest {
 
   @AfterEach
   void verifyNoLingeringEntities() {
-    assertThat(ofy().load().type(GaeUserIdConverter.class).count()).isEqualTo(0);
+    assertThat(ofyTm().loadAllOf(GaeUserIdConverter.class)).hasSize(0);
   }
 
   @Test
@@ -43,8 +43,7 @@ public class GaeUserIdConverterTest {
 
   @Test
   void testSuccess_inTransaction() {
-    tm()
+    tm().transactNew(
-        .transactNew(
             () ->
                 assertThat(GaeUserIdConverter.convertEmailAddressToGaeUserId("example@example.com"))
                     .matches("[0-9]+"));

core/src/test/java/google/registry/model/ofy/CommitLogMutationTest.java

@@ -15,7 +15,7 @@
 package google.registry.model.ofy;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTld;
 
@@ -86,6 +86,6 @@ public class CommitLogMutationTest {
   }
 
   private static Entity convertToEntityInTxn(final ImmutableObject object) {
-    return tm().transact(() -> ofy().save().toEntity(object));
+    return tm().transact(() -> auditedOfy().save().toEntity(object));
   }
 }

core/src/test/java/google/registry/model/ofy/OfyCommitLogTest.java

@@ -18,7 +18,7 @@ import static com.google.appengine.api.datastore.EntityTranslator.convertToPb;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
 import static google.registry.model.ofy.CommitLogBucket.getBucketKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
@@ -61,94 +61,96 @@ public class OfyCommitLogTest {
   @Test
   void testTransact_doesNothing_noCommitLogIsSaved() {
     tm().transact(() -> {});
-    assertThat(ofy().load().type(CommitLogManifest.class)).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogManifest.class)).isEmpty();
   }
 
   @Test
   void testTransact_savesDataAndCommitLog() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())).now());
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())).now());
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now().value)
+    assertThat(auditedOfy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now().value)
         .isEqualTo("value");
-    assertThat(ofy().load().type(CommitLogManifest.class)).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class)).hasSize(1);
-    assertThat(ofy().load().type(CommitLogMutation.class)).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogMutation.class)).hasSize(1);
   }
 
   @Test
   void testTransact_saveWithoutBackup_noCommitLogIsSaved() {
-    tm().transact(() -> ofy().saveWithoutBackup().entity(Root.create(1, getCrossTldKey())).now());
+    tm().transact(
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now().value)
+            () -> auditedOfy().saveWithoutBackup().entity(Root.create(1, getCrossTldKey())).now());
+    assertThat(auditedOfy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now().value)
         .isEqualTo("value");
-    assertThat(ofy().load().type(CommitLogManifest.class)).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogManifest.class)).isEmpty();
-    assertThat(ofy().load().type(CommitLogMutation.class)).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class)).isEmpty();
   }
 
   @Test
   void testTransact_deleteWithoutBackup_noCommitLogIsSaved() {
-    tm().transact(() -> ofy().saveWithoutBackup().entity(Root.create(1, getCrossTldKey())).now());
+    tm().transact(
-    tm().transact(() -> ofy().deleteWithoutBackup().key(Key.create(Root.class, 1)));
+            () -> auditedOfy().saveWithoutBackup().entity(Root.create(1, getCrossTldKey())).now());
-    assertThat(ofy().load().key(Key.create(Root.class, 1)).now()).isNull();
+    tm().transact(() -> auditedOfy().deleteWithoutBackup().key(Key.create(Root.class, 1)));
-    assertThat(ofy().load().type(CommitLogManifest.class)).isEmpty();
+    assertThat(auditedOfy().load().key(Key.create(Root.class, 1)).now()).isNull();
-    assertThat(ofy().load().type(CommitLogMutation.class)).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogManifest.class)).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class)).isEmpty();
   }
 
   @Test
   void testTransact_savesEntity_itsProtobufFormIsStoredInCommitLog() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())).now());
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())).now());
     final byte[] entityProtoBytes =
-        ofy().load().type(CommitLogMutation.class).first().now().entityProtoBytes;
+        auditedOfy().load().type(CommitLogMutation.class).first().now().entityProtoBytes;
-    // This transaction is needed so that save().toEntity() can access ofy().getTransactionTime()
+    // This transaction is needed so that save().toEntity() can access
+    // auditedOfy().getTransactionTime()
     // when it attempts to set the update timestamp.
-    tm()
+    tm().transact(
-        .transact(
             () ->
                 assertThat(entityProtoBytes)
                     .isEqualTo(
-                        convertToPb(ofy().save().toEntity(Root.create(1, getCrossTldKey())))
+                        convertToPb(auditedOfy().save().toEntity(Root.create(1, getCrossTldKey())))
                             .toByteArray()));
   }
 
   @Test
   void testTransact_savesEntity_mutationIsChildOfManifest() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())).now());
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())).now());
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .type(CommitLogMutation.class)
-                .ancestor(ofy().load().type(CommitLogManifest.class).first().now()))
+                .ancestor(auditedOfy().load().type(CommitLogManifest.class).first().now()))
         .hasSize(1);
   }
 
   @Test
   void testTransactNew_savesDataAndCommitLog() {
-    tm().transactNew(() -> ofy().save().entity(Root.create(1, getCrossTldKey())).now());
+    tm().transactNew(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())).now());
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now().value)
+    assertThat(auditedOfy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now().value)
         .isEqualTo("value");
-    assertThat(ofy().load().type(CommitLogManifest.class)).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class)).hasSize(1);
-    assertThat(ofy().load().type(CommitLogMutation.class)).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogMutation.class)).hasSize(1);
   }
 
   @Test
   void testTransact_multipleSaves_logsMultipleMutations() {
-    tm()
+    tm().transact(
-        .transact(
             () -> {
-              ofy().save().entity(Root.create(1, getCrossTldKey())).now();
+              auditedOfy().save().entity(Root.create(1, getCrossTldKey())).now();
-              ofy().save().entity(Root.create(2, getCrossTldKey())).now();
+              auditedOfy().save().entity(Root.create(2, getCrossTldKey())).now();
             });
-    assertThat(ofy().load().type(CommitLogManifest.class)).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class)).hasSize(1);
-    assertThat(ofy().load().type(CommitLogMutation.class)).hasSize(2);
+    assertThat(auditedOfy().load().type(CommitLogMutation.class)).hasSize(2);
   }
 
   @Test
   void testTransact_deletion_deletesAndLogsWithoutMutation() {
-    tm().transact(() -> ofy().saveWithoutBackup().entity(Root.create(1, getCrossTldKey())).now());
+    tm().transact(
+            () -> auditedOfy().saveWithoutBackup().entity(Root.create(1, getCrossTldKey())).now());
     clock.advanceOneMilli();
     final Key<Root> otherTldKey = Key.create(getCrossTldKey(), Root.class, 1);
-    tm().transact(() -> ofy().delete().key(otherTldKey));
+    tm().transact(() -> auditedOfy().delete().key(otherTldKey));
-    assertThat(ofy().load().key(otherTldKey).now()).isNull();
+    assertThat(auditedOfy().load().key(otherTldKey).now()).isNull();
-    assertThat(ofy().load().type(CommitLogManifest.class)).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class)).hasSize(1);
-    assertThat(ofy().load().type(CommitLogMutation.class)).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class)).isEmpty();
-    assertThat(ofy().load().type(CommitLogManifest.class).first().now().getDeletions())
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).first().now().getDeletions())
         .containsExactly(otherTldKey);
   }
 
@@ -159,7 +161,7 @@ public class OfyCommitLogTest {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () -> tm().transactNew(() -> ofy().delete().entity(backupsArentAllowedOnMe)));
+            () -> tm().transactNew(() -> auditedOfy().delete().entity(backupsArentAllowedOnMe)));
     assertThat(thrown).hasMessageThat().contains("Can't save/delete a @NotBackedUp");
   }
 
@@ -170,7 +172,7 @@ public class OfyCommitLogTest {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () -> tm().transactNew(() -> ofy().save().entity(backupsArentAllowedOnMe)));
+            () -> tm().transactNew(() -> auditedOfy().save().entity(backupsArentAllowedOnMe)));
     assertThat(thrown).hasMessageThat().contains("Can't save/delete a @NotBackedUp");
   }
 
@@ -180,7 +182,7 @@ public class OfyCommitLogTest {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () -> tm().transactNew(() -> ofy().delete().key(virtualEntityKey)));
+            () -> tm().transactNew(() -> auditedOfy().delete().key(virtualEntityKey)));
     assertThat(thrown).hasMessageThat().contains("Can't save/delete a @VirtualEntity");
   }
 
@@ -190,7 +192,7 @@ public class OfyCommitLogTest {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () -> tm().transactNew(() -> ofy().save().entity(virtualEntity)));
+            () -> tm().transactNew(() -> auditedOfy().save().entity(virtualEntity)));
     assertThat(thrown).hasMessageThat().contains("Can't save/delete a @VirtualEntity");
   }
 
@@ -200,7 +202,7 @@ public class OfyCommitLogTest {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () -> ofy().deleteWithoutBackup().key(virtualEntityKey));
+            () -> auditedOfy().deleteWithoutBackup().key(virtualEntityKey));
     assertThat(thrown).hasMessageThat().contains("Can't save/delete a @VirtualEntity");
   }
 
@@ -209,7 +211,8 @@ public class OfyCommitLogTest {
     final TestVirtualObject virtualEntity = TestVirtualObject.create("virtual");
     IllegalArgumentException thrown =
         assertThrows(
-            IllegalArgumentException.class, () -> ofy().saveWithoutBackup().entity(virtualEntity));
+            IllegalArgumentException.class,
+            () -> auditedOfy().saveWithoutBackup().entity(virtualEntity));
     assertThat(thrown).hasMessageThat().contains("Can't save/delete a @VirtualEntity");
   }
 
@@ -219,11 +222,10 @@ public class OfyCommitLogTest {
         assertThrows(
             IllegalArgumentException.class,
             () ->
-                tm()
+                tm().transact(
-                    .transact(
                         () -> {
-                          ofy().save().entity(Root.create(1, getCrossTldKey()));
+                          auditedOfy().save().entity(Root.create(1, getCrossTldKey()));
-                          ofy().save().entity(Root.create(1, getCrossTldKey()));
+                          auditedOfy().save().entity(Root.create(1, getCrossTldKey()));
                         }));
     assertThat(thrown).hasMessageThat().contains("Multiple entries with same key");
   }
@@ -234,21 +236,20 @@ public class OfyCommitLogTest {
         assertThrows(
             IllegalArgumentException.class,
             () ->
-                tm()
+                tm().transact(
-                    .transact(
                         () -> {
-                          ofy().save().entity(Root.create(1, getCrossTldKey()));
+                          auditedOfy().save().entity(Root.create(1, getCrossTldKey()));
-                          ofy().delete().entity(Root.create(1, getCrossTldKey()));
+                          auditedOfy().delete().entity(Root.create(1, getCrossTldKey()));
                         }));
     assertThat(thrown).hasMessageThat().contains("Multiple entries with same key");
   }
 
   @Test
   void testSavingRootAndChild_updatesTimestampOnBackupGroupRoot() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -256,15 +257,14 @@ public class OfyCommitLogTest {
                 .getTimestamp())
         .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
-    tm()
+    tm().transact(
-        .transact(
             () -> {
-              ofy().save().entity(Root.create(1, getCrossTldKey()));
+              auditedOfy().save().entity(Root.create(1, getCrossTldKey()));
-              ofy().save().entity(new Child());
+              auditedOfy().save().entity(new Child());
             });
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -275,10 +275,10 @@ public class OfyCommitLogTest {
 
   @Test
   void testSavingOnlyChild_updatesTimestampOnBackupGroupRoot() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -286,10 +286,10 @@ public class OfyCommitLogTest {
                 .getTimestamp())
         .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
-    tm().transact(() -> ofy().save().entity(new Child()));
+    tm().transact(() -> auditedOfy().save().entity(new Child()));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -300,10 +300,10 @@ public class OfyCommitLogTest {
 
   @Test
   void testDeletingChild_updatesTimestampOnBackupGroupRoot() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -312,10 +312,10 @@ public class OfyCommitLogTest {
         .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
     // The fact that the child was never persisted is irrelevant.
-    tm().transact(() -> ofy().delete().entity(new Child()));
+    tm().transact(() -> auditedOfy().delete().entity(new Child()));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -326,10 +326,10 @@ public class OfyCommitLogTest {
 
   @Test
   void testReadingRoot_doesntUpdateTimestamp() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -337,17 +337,16 @@ public class OfyCommitLogTest {
                 .getTimestamp())
         .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
-    tm()
+    tm().transact(
-        .transact(
             () -> {
               // Don't remove this line, as without saving *something* the commit log code will
               // never be invoked and the test will trivially pass.
-              ofy().save().entity(Root.create(2, getCrossTldKey()));
+              auditedOfy().save().entity(Root.create(2, getCrossTldKey()));
-              ofy().load().entity(Root.create(1, getCrossTldKey()));
+              auditedOfy().load().entity(Root.create(1, getCrossTldKey()));
             });
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -358,10 +357,10 @@ public class OfyCommitLogTest {
 
   @Test
   void testReadingChild_doesntUpdateTimestampOnBackupGroupRoot() {
-    tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
+    tm().transact(() -> auditedOfy().save().entity(Root.create(1, getCrossTldKey())));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -369,17 +368,16 @@ public class OfyCommitLogTest {
                 .getTimestamp())
         .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
-    tm()
+    tm().transact(
-        .transact(
             () -> {
               // Don't remove this line, as without saving *something* the commit log code will
               // never be invoked and the test will trivially pass
-              ofy().save().entity(Root.create(2, getCrossTldKey()));
+              auditedOfy().save().entity(Root.create(2, getCrossTldKey()));
-              ofy().load().entity(new Child()); // All Child objects are under Root(1).
+              auditedOfy().load().entity(new Child()); // All Child objects are under Root(1).
             });
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -391,17 +389,16 @@ public class OfyCommitLogTest {
   @Test
   void testSavingAcrossBackupGroupRoots_updatesCorrectTimestamps() {
     // Create three roots.
-    tm()
+    tm().transact(
-        .transact(
             () -> {
-              ofy().save().entity(Root.create(1, getCrossTldKey()));
+              auditedOfy().save().entity(Root.create(1, getCrossTldKey()));
-              ofy().save().entity(Root.create(2, getCrossTldKey()));
+              auditedOfy().save().entity(Root.create(2, getCrossTldKey()));
-              ofy().save().entity(Root.create(3, getCrossTldKey()));
+              auditedOfy().save().entity(Root.create(3, getCrossTldKey()));
             });
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     for (int i = 1; i <= 3; i++) {
       assertThat(
-              ofy()
+              auditedOfy()
                   .load()
                   .key(Key.create(getCrossTldKey(), Root.class, i))
                   .now()
@@ -411,16 +408,15 @@ public class OfyCommitLogTest {
     }
     clock.advanceOneMilli();
     // Mutate one root, and a child of a second, ignoring the third.
-    tm()
+    tm().transact(
-        .transact(
             () -> {
-              ofy().save().entity(new Child()); // All Child objects are under Root(1).
+              auditedOfy().save().entity(new Child()); // All Child objects are under Root(1).
-              ofy().save().entity(Root.create(2, getCrossTldKey()));
+              auditedOfy().save().entity(Root.create(2, getCrossTldKey()));
             });
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     // Child was touched.
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 1))
                 .now()
@@ -429,7 +425,7 @@ public class OfyCommitLogTest {
         .isEqualTo(clock.nowUtc());
     // Directly touched.
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 2))
                 .now()
@@ -438,7 +434,7 @@ public class OfyCommitLogTest {
         .isEqualTo(clock.nowUtc());
     // Wasn't touched.
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Key.create(getCrossTldKey(), Root.class, 3))
                 .now()

core/src/test/java/google/registry/model/ofy/OfyTest.java

@@ -18,7 +18,7 @@ import static com.google.appengine.api.datastore.DatastoreServiceFactory.getData
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.util.concurrent.Uninterruptibles.sleepUninterruptibly;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.ofy.Ofy.getBaseEntityClassFromEntityOrKey;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTld;
@@ -82,7 +82,7 @@ public class OfyTest {
 
   private void doBackupGroupRootTimestampInversionTest(Runnable runnable) {
     DateTime groupTimestamp =
-        ofy().load().key(someObject.getParent()).now().getUpdateTimestamp().getTimestamp();
+        auditedOfy().load().key(someObject.getParent()).now().getUpdateTimestamp().getTimestamp();
     // Set the clock in Ofy to the same time as the backup group root's save time.
     Ofy ofy = new Ofy(new FakeClock(groupTimestamp));
     TimestampInversionException thrown =
@@ -98,12 +98,12 @@ public class OfyTest {
 
   @Test
   void testBackupGroupRootTimestampsMustIncreaseOnSave() {
-    doBackupGroupRootTimestampInversionTest(() -> ofy().save().entity(someObject));
+    doBackupGroupRootTimestampInversionTest(() -> auditedOfy().save().entity(someObject));
   }
 
   @Test
   void testBackupGroupRootTimestampsMustIncreaseOnDelete() {
-    doBackupGroupRootTimestampInversionTest(() -> ofy().delete().entity(someObject));
+    doBackupGroupRootTimestampInversionTest(() -> auditedOfy().delete().entity(someObject));
   }
 
   @Test
@@ -114,8 +114,8 @@ public class OfyTest {
             () ->
                 tm().transact(
                         () -> {
-                          ofy().save().entity(someObject);
+                          auditedOfy().save().entity(someObject);
-                          ofy().save().entity(someObject);
+                          auditedOfy().save().entity(someObject);
                         }));
     assertThat(thrown).hasMessageThat().contains("Multiple entries with same key");
   }
@@ -128,8 +128,8 @@ public class OfyTest {
             () ->
                 tm().transact(
                         () -> {
-                          ofy().delete().entity(someObject);
+                          auditedOfy().delete().entity(someObject);
-                          ofy().delete().entity(someObject);
+                          auditedOfy().delete().entity(someObject);
                         }));
     assertThat(thrown).hasMessageThat().contains("Multiple entries with same key");
   }
@@ -142,8 +142,8 @@ public class OfyTest {
             () ->
                 tm().transact(
                         () -> {
-                          ofy().save().entity(someObject);
+                          auditedOfy().save().entity(someObject);
-                          ofy().delete().entity(someObject);
+                          auditedOfy().delete().entity(someObject);
                         }));
     assertThat(thrown).hasMessageThat().contains("Multiple entries with same key");
   }
@@ -156,8 +156,8 @@ public class OfyTest {
             () ->
                 tm().transact(
                         () -> {
-                          ofy().delete().entity(someObject);
+                          auditedOfy().delete().entity(someObject);
-                          ofy().save().entity(someObject);
+                          auditedOfy().save().entity(someObject);
                         }));
     assertThat(thrown).hasMessageThat().contains("Multiple entries with same key");
   }
@@ -166,7 +166,7 @@ public class OfyTest {
   void testSavingKeyTwiceInOneCall() {
     assertThrows(
         IllegalArgumentException.class,
-        () -> tm().transact(() -> ofy().save().entities(someObject, someObject)));
+        () -> tm().transact(() -> auditedOfy().save().entities(someObject, someObject)));
   }
 
   /** Simple entity class with lifecycle callbacks. */
@@ -194,21 +194,21 @@ public class OfyTest {
 
   @Test
   void testLifecycleCallbacks_loadFromEntity() {
-    ofy().factory().register(LifecycleObject.class);
+    auditedOfy().factory().register(LifecycleObject.class);
     LifecycleObject object = new LifecycleObject();
-    Entity entity = ofy().save().toEntity(object);
+    Entity entity = auditedOfy().save().toEntity(object);
     assertThat(object.onSaveCalled).isTrue();
-    assertThat(ofy().load().<LifecycleObject>fromEntity(entity).onLoadCalled).isTrue();
+    assertThat(auditedOfy().load().<LifecycleObject>fromEntity(entity).onLoadCalled).isTrue();
   }
 
   @Test
   void testLifecycleCallbacks_loadFromDatastore() {
-    ofy().factory().register(LifecycleObject.class);
+    auditedOfy().factory().register(LifecycleObject.class);
     final LifecycleObject object = new LifecycleObject();
-    tm().transact(() -> ofy().save().entity(object).now());
+    tm().transact(() -> auditedOfy().save().entity(object).now());
     assertThat(object.onSaveCalled).isTrue();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
-    assertThat(ofy().load().entity(object).now().onLoadCalled).isTrue();
+    assertThat(auditedOfy().load().entity(object).now().onLoadCalled).isTrue();
   }
 
   /** Avoid regressions of b/21309102 where transaction time did not change on each retry. */
@@ -287,7 +287,7 @@ public class OfyTest {
                       public Integer get() {
                         // There will be something in the manifest now, but it won't be committed if
                         // we throw.
-                        ofy().save().entity(someObject);
+                        auditedOfy().save().entity(someObject);
                         count++;
                         if (count == 3) {
                           return count;
@@ -309,7 +309,7 @@ public class OfyTest {
           public Void get() {
             if (firstCallToVrun) {
               firstCallToVrun = false;
-              ofy().save().entity(someObject);
+              auditedOfy().save().entity(someObject);
               return null;
             }
             fail("Shouldn't have retried.");
@@ -332,7 +332,7 @@ public class OfyTest {
         };
     // Despite the DatastoreTimeoutException in the first call to getResult(), this should succeed
     // without retrying. If a retry is triggered, the test should fail due to the call to fail().
-    ofy().transactCommitLoggedWork(commitLoggedWork);
+    auditedOfy().transactCommitLoggedWork(commitLoggedWork);
   }
 
   void doReadOnlyRetryTest(final RuntimeException e) {
@@ -408,23 +408,24 @@ public class OfyTest {
 
   @Test
   void test_doWithFreshSessionCache() {
-    ofy().saveWithoutBackup().entity(someObject).now();
+    auditedOfy().saveWithoutBackup().entity(someObject).now();
     final HistoryEntry modifiedObject =
         someObject.asBuilder().setModificationTime(END_OF_TIME).build();
     // Mutate the saved objected, bypassing the Objectify session cache.
-    getDatastoreService().put(ofy().saveWithoutBackup().toEntity(modifiedObject));
+    getDatastoreService().put(auditedOfy().saveWithoutBackup().toEntity(modifiedObject));
     // Normal loading should come from the session cache and shouldn't reflect the mutation.
-    assertThat(ofy().load().entity(someObject).now()).isEqualTo(someObject);
+    assertThat(auditedOfy().load().entity(someObject).now()).isEqualTo(someObject);
     // Loading inside doWithFreshSessionCache() should reflect the mutation.
     boolean ran =
-        ofy()
+        auditedOfy()
             .doWithFreshSessionCache(
                 () -> {
-                  assertThat(ofy().load().entity(someObject).now()).isEqualTo(modifiedObject);
+                  assertThat(auditedOfy().load().entity(someObject).now())
+                      .isEqualTo(modifiedObject);
                   return true;
                 });
     assertThat(ran).isTrue();
     // Test the normal loading again to verify that we've restored the original session unchanged.
-    assertThat(ofy().load().entity(someObject).now()).isEqualTo(someObject);
+    assertThat(auditedOfy().load().entity(someObject).now()).isEqualTo(someObject);
   }
 }

core/src/test/java/google/registry/model/registrar/RegistrarTest.java

@@ -17,7 +17,7 @@ package google.registry.model.registrar;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.CertificateSamples.SAMPLE_CERT;
 import static google.registry.testing.CertificateSamples.SAMPLE_CERT2;
@@ -569,14 +569,14 @@ class RegistrarTest extends EntityTestCase {
               assertThat(Registrar.loadByClientIdCached("registrar")).isPresent();
               // Load something as a control to make sure we are seeing loaded keys in the
               // session cache.
-              ofy().load().entity(abuseAdminContact).now();
+              auditedOfy().load().entity(abuseAdminContact).now();
-              assertThat(ofy().getSessionKeys()).contains(Key.create(abuseAdminContact));
+              assertThat(auditedOfy().getSessionKeys()).contains(Key.create(abuseAdminContact));
-              assertThat(ofy().getSessionKeys()).doesNotContain(Key.create(registrar));
+              assertThat(auditedOfy().getSessionKeys()).doesNotContain(Key.create(registrar));
             });
     tm().clearSessionCache();
     // Conversely, loads outside of a transaction should end up in the session cache.
     assertThat(Registrar.loadByClientIdCached("registrar")).isPresent();
-    assertThat(ofy().getSessionKeys()).contains(Key.create(registrar));
+    assertThat(auditedOfy().getSessionKeys()).contains(Key.create(registrar));
   }
 
   @TestOfyAndSql

core/src/test/java/google/registry/model/registry/label/PremiumListDatastoreDaoTest.java

@@ -19,7 +19,7 @@ import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
 import static com.google.monitoring.metrics.contrib.DistributionMetricSubject.assertThat;
 import static com.google.monitoring.metrics.contrib.LongMetricSubject.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.BLOOM_FILTER_NEGATIVE;
 import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_NEGATIVE;
 import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_POSITIVE;
@@ -173,10 +173,10 @@ public class PremiumListDatastoreDaoTest {
     // Remove one of the premium list entries from behind the Bloom filter's back.
     tm().transactNew(
             () ->
-                ofy()
+                auditedOfy()
                     .delete()
                     .keys(Key.create(pl.getRevisionKey(), PremiumListEntry.class, "rich")));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
 
     assertThat(PremiumListDatastoreDao.getPremiumPrice("tld", "rich", "tld")).isEmpty();
     assertThat(PremiumListDatastoreDao.getPremiumPrice("tld", "rich", "tld")).isEmpty();
@@ -203,7 +203,7 @@ public class PremiumListDatastoreDaoTest {
     assertThat(PremiumListDatastoreDao.getPremiumPrice("tld", "dolt", "tld"))
         .hasValue(Money.parse("JPY 1000"));
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .type(PremiumListEntry.class)
                 .parent(pl.getRevisionKey())
@@ -279,7 +279,7 @@ public class PremiumListDatastoreDaoTest {
     assertThat(entries.keySet()).containsExactly("test");
     // Save again with no changes, and clear the cache to force a re-load from Datastore.
     PremiumList resaved = PremiumListDatastoreDao.save("tld", ImmutableList.of("test,USD 1"));
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     Map<String, PremiumListEntry> entriesReloaded =
         Streams.stream(PremiumListDatastoreDao.loadPremiumListEntriesUncached(resaved))
             .collect(toImmutableMap(PremiumListEntry::getLabel, Function.identity()));
@@ -296,7 +296,7 @@ public class PremiumListDatastoreDaoTest {
     Key<PremiumListRevision> parent = gtld1.get().getRevisionKey();
     PremiumListDatastoreDao.delete(gtld1.get());
     assertThat(PremiumListDatastoreDao.getLatestRevision("gtld1")).isEmpty();
-    assertThat(ofy().load().type(PremiumListEntry.class).ancestor(parent).list()).isEmpty();
+    assertThat(auditedOfy().load().type(PremiumListEntry.class).ancestor(parent).list()).isEmpty();
   }
 
   @Test

core/src/test/java/google/registry/model/tmch/ClaimsListShardTest.java

@@ -16,7 +16,7 @@ package google.registry.model.tmch;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static org.joda.time.DateTimeZone.UTC;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -54,7 +54,7 @@ public class ClaimsListShardTest {
                               tm().getTransactionTime(), ImmutableMap.of("a", "b"));
                       claimsList.id = 1; // Without an id this won't save anyways.
                       claimsList.parent = ClaimsListRevision.createKey();
-                      ofy().saveWithoutBackup().entity(claimsList).now();
+                      auditedOfy().saveWithoutBackup().entity(claimsList).now();
                     }));
   }
 
@@ -76,7 +76,7 @@ public class ClaimsListShardTest {
     unsharded.saveToDatastore(shardSize);
     assertThat(ClaimsListShard.getFromDatastore().get().labelsToKeys)
         .isEqualTo(unsharded.labelsToKeys);
-    List<ClaimsListShard> shards1 = ofy().load().type(ClaimsListShard.class).list();
+    List<ClaimsListShard> shards1 = auditedOfy().load().type(ClaimsListShard.class).list();
     assertThat(shards1).hasSize(4);
     assertThat(ClaimsListShard.getFromDatastore().get().getClaimKey("1")).hasValue("1");
     assertThat(ClaimsListShard.getFromDatastore().get().getClaimKey("a")).isEmpty();
@@ -89,12 +89,12 @@ public class ClaimsListShardTest {
     }
     unsharded = ClaimsListShard.create(now.plusDays(1), ImmutableMap.copyOf(labelsToKeys));
     unsharded.saveToDatastore(shardSize);
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(ClaimsListShard.getFromDatastore().get().labelsToKeys)
         .hasSize(unsharded.labelsToKeys.size());
     assertThat(ClaimsListShard.getFromDatastore().get().labelsToKeys)
         .isEqualTo(unsharded.labelsToKeys);
-    List<ClaimsListShard> shards2 = ofy().load().type(ClaimsListShard.class).list();
+    List<ClaimsListShard> shards2 = auditedOfy().load().type(ClaimsListShard.class).list();
     assertThat(shards2).hasSize(2);
 
     // Expect that the old revision is deleted.

core/src/test/java/google/registry/model/translators/CommitLogRevisionsTranslatorFactoryTest.java

@@ -15,7 +15,7 @@
 package google.registry.model.translators;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static org.joda.time.Duration.standardDays;
 import static org.joda.time.Duration.standardHours;
@@ -65,12 +65,12 @@ public class CommitLogRevisionsTranslatorFactoryTest {
   }
 
   private void save(final TestObject object) {
-    tm().transact(() -> ofy().save().entity(object));
+    tm().transact(() -> auditedOfy().save().entity(object));
   }
 
   private TestObject reload() {
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
-    return ofy().load().entity(new TestObject()).now();
+    return auditedOfy().load().entity(new TestObject()).now();
   }
 
   @Test
@@ -87,7 +87,8 @@ public class CommitLogRevisionsTranslatorFactoryTest {
     TestObject object = reload();
     assertThat(object.revisions).hasSize(1);
     assertThat(object.revisions).containsKey(START_TIME);
-    CommitLogManifest commitLogManifest = ofy().load().key(object.revisions.get(START_TIME)).now();
+    CommitLogManifest commitLogManifest =
+        auditedOfy().load().key(object.revisions.get(START_TIME)).now();
     assertThat(commitLogManifest.getCommitTime()).isEqualTo(START_TIME);
   }
 
@@ -149,7 +150,7 @@ public class CommitLogRevisionsTranslatorFactoryTest {
     save(new TestObject());
     clock.advanceBy(standardDays(1));
     com.google.appengine.api.datastore.Entity entity =
-        tm().transactNewReadOnly(() -> ofy().save().toEntity(reload()));
+        tm().transactNewReadOnly(() -> auditedOfy().save().toEntity(reload()));
     assertThat(entity.getProperties().keySet()).containsExactly("revisions.key", "revisions.value");
     assertThat(entity.getProperties())
         .containsEntry(
@@ -162,16 +163,16 @@ public class CommitLogRevisionsTranslatorFactoryTest {
 
   @Test
   void testLoad_neverSaved_returnsNull() {
-    assertThat(ofy().load().entity(new TestObject()).now()).isNull();
+    assertThat(auditedOfy().load().entity(new TestObject()).now()).isNull();
   }
 
   @Test
   void testLoad_missingRevisionRawProperties_createsEmptyObject() {
     com.google.appengine.api.datastore.Entity entity =
-        tm().transactNewReadOnly(() -> ofy().save().toEntity(new TestObject()));
+        tm().transactNewReadOnly(() -> auditedOfy().save().toEntity(new TestObject()));
     entity.removeProperty("revisions.key");
     entity.removeProperty("revisions.value");
-    TestObject object = ofy().load().fromEntity(entity);
+    TestObject object = auditedOfy().load().fromEntity(entity);
     assertThat(object.revisions).isNotNull();
     assertThat(object.revisions).isEmpty();
   }

core/src/test/java/google/registry/rde/RdeStagingActionTest.java

@@ -18,7 +18,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.common.Cursor.CursorType.BRDA;
 import static google.registry.model.common.Cursor.CursorType.RDE_STAGING;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.rde.RdeFixtures.makeContactResource;
 import static google.registry.rde.RdeFixtures.makeDomainBase;
@@ -421,13 +421,18 @@ public class RdeStagingActionTest extends MapreduceTestCase<RdeStagingAction> {
     action.run();
     executeTasksUntilEmpty("mapreduce", clock);
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Cursor.createKey(RDE_STAGING, Registry.get("lol")))
                 .now()
                 .getCursorTime())
         .isEqualTo(DateTime.parse("2000-01-02TZ"));
-    assertThat(ofy().load().key(Cursor.createKey(BRDA, Registry.get("lol"))).now().getCursorTime())
+    assertThat(
+            auditedOfy()
+                .load()
+                .key(Cursor.createKey(BRDA, Registry.get("lol")))
+                .now()
+                .getCursorTime())
         .isEqualTo(DateTime.parse("2000-01-04TZ"));
   }
 
@@ -442,13 +447,18 @@ public class RdeStagingActionTest extends MapreduceTestCase<RdeStagingAction> {
     action.run();
     executeTasksUntilEmpty("mapreduce", clock);
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Cursor.createKey(RDE_STAGING, Registry.get("lol")))
                 .now()
                 .getCursorTime())
         .isEqualTo(DateTime.parse("2000-01-05TZ"));
-    assertThat(ofy().load().key(Cursor.createKey(BRDA, Registry.get("lol"))).now().getCursorTime())
+    assertThat(
+            auditedOfy()
+                .load()
+                .key(Cursor.createKey(BRDA, Registry.get("lol")))
+                .now()
+                .getCursorTime())
         .isEqualTo(DateTime.parse("2000-01-11TZ"));
   }
 
@@ -500,11 +510,19 @@ public class RdeStagingActionTest extends MapreduceTestCase<RdeStagingAction> {
     }
 
     assertThat(
-            ofy().load().key(Cursor.createKey(RDE_STAGING, Registry.get("fop"))).now()
+            auditedOfy()
+                .load()
+                .key(Cursor.createKey(RDE_STAGING, Registry.get("fop")))
+                .now()
                 .getCursorTime())
         .isEqualTo(DateTime.parse("1971-01-02TZ"));
 
-    assertThat(ofy().load().key(Cursor.createKey(BRDA, Registry.get("fop"))).now().getCursorTime())
+    assertThat(
+            auditedOfy()
+                .load()
+                .key(Cursor.createKey(BRDA, Registry.get("fop")))
+                .now()
+                .getCursorTime())
         .isEqualTo(DateTime.parse("1971-01-12TZ"));
   }
 
@@ -702,7 +720,7 @@ public class RdeStagingActionTest extends MapreduceTestCase<RdeStagingAction> {
     String firstDeposit = readXml("lol_1984-12-18_full_S1_R0.xml.ghostryde");
     assertThat(firstDeposit).doesNotContain("ns1.justine.lol");
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Cursor.createKey(RDE_STAGING, Registry.get("lol")))
                 .now()
@@ -719,7 +737,7 @@ public class RdeStagingActionTest extends MapreduceTestCase<RdeStagingAction> {
     assertThat(secondDeposit).doesNotContain("dead:beef::cafe");
 
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Cursor.createKey(RDE_STAGING, Registry.get("lol")))
                 .now()
@@ -735,7 +753,7 @@ public class RdeStagingActionTest extends MapreduceTestCase<RdeStagingAction> {
     assertThat(thirdDeposit).doesNotContain("feed::a:bee");
     assertThat(thirdDeposit).contains("dead:beef::cafe");
     assertThat(
-            ofy()
+            auditedOfy()
                 .load()
                 .key(Cursor.createKey(RDE_STAGING, Registry.get("lol")))
                 .now()
@@ -782,13 +800,18 @@ public class RdeStagingActionTest extends MapreduceTestCase<RdeStagingAction> {
               "manual/test/" + tld + "_2000-01-02_thin_S1_R" + revision + ".xml.length");
 
       assertThat(
-              ofy()
+              auditedOfy()
                   .load()
                   .key(Cursor.createKey(RDE_STAGING, Registry.get(tld)))
                   .now()
                   .getCursorTime())
           .isEqualTo(DateTime.parse("1999-01-01TZ"));
-      assertThat(ofy().load().key(Cursor.createKey(BRDA, Registry.get(tld))).now().getCursorTime())
+      assertThat(
+              auditedOfy()
+                  .load()
+                  .key(Cursor.createKey(BRDA, Registry.get(tld)))
+                  .now()
+                  .getCursorTime())
           .isEqualTo(DateTime.parse("2001-01-01TZ"));
     }
   }

core/src/test/java/google/registry/rde/RdeStagingReducerTest.java

@@ -15,7 +15,7 @@
 package google.registry.rde;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.rde.RdeMode.FULL;
 import static google.registry.model.rde.RdeMode.THIN;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -215,11 +215,15 @@ class RdeStagingReducerTest {
   }
 
   private static DateTime loadCursorTime(CursorType type) {
-    return ofy().load().key(Cursor.createKey(type, Registry.get("soy"))).now().getCursorTime();
+    return auditedOfy()
+        .load()
+        .key(Cursor.createKey(type, Registry.get("soy")))
+        .now()
+        .getCursorTime();
   }
 
   private static int loadRevision(RdeMode mode) {
-    return ofy()
+    return auditedOfy()
         .load()
         .type(RdeRevision.class)
         .id("soy_2000-01-01_" + mode.getFilenameComponent())

core/src/test/java/google/registry/testing/AppEngineExtension.java

@@ -17,7 +17,7 @@ package google.registry.testing;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.io.Files.asCharSink;
 import static com.google.common.truth.Truth.assertWithMessage;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.persistSimpleResources;
 import static google.registry.testing.DualDatabaseTestInvocationContextProvider.injectTmForDualDatabaseTest;
@@ -410,7 +410,7 @@ public final class AppEngineExtension implements BeforeEachCallback, AfterEachCa
               TimedTransitionProperty.fromValueMap(
                   ImmutableSortedMap.of(START_OF_TIME, PrimaryDatabase.CLOUD_SQL),
                   PrimaryDatabaseTransition.class));
-      tm().transactNew(() -> ofy().saveWithoutBackup().entity(schedule).now());
+      tm().transactNew(() -> auditedOfy().saveWithoutBackup().entity(schedule).now());
       if (withCloudSql && !withJpaUnitTest && !withoutCannedData) {
         loadInitialData();
       }

core/src/test/java/google/registry/testing/DatabaseHelper.java

@@ -30,7 +30,7 @@ import static google.registry.model.EppResourceUtils.createRepoId;
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
 import static google.registry.model.ImmutableObjectSubject.immutableObjectCorrespondence;
 import static google.registry.model.ResourceTransferUtils.createTransferResponse;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.registry.Registry.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.registry.label.PremiumListDatastoreDao.parentPremiumListEntriesOnRevision;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
@@ -1226,7 +1226,9 @@ public class DatabaseHelper {
   public static <R> R cloneAndSetAutoTimestamps(final R resource) {
     R result;
     if (tm().isOfy()) {
-      result = tm().transact(() -> ofy().load().fromEntity(ofy().save().toEntity(resource)));
+      result =
+          tm().transact(
+                  () -> auditedOfy().load().fromEntity(auditedOfy().save().toEntity(resource)));
     } else {
       // We have to separate the read and write operation into different transactions
       // otherwise JPA would just return the input entity instead of actually creating a
@@ -1263,7 +1265,7 @@ public class DatabaseHelper {
    */
   public static List<Object> loadAllEntities() {
     if (tm().isOfy()) {
-      return ofy().load().list();
+      return auditedOfy().load().list();
     } else {
       return jpaTm()
           .transact(

core/src/test/java/google/registry/testing/mapreduce/MapreduceTestCase.java

@@ -15,7 +15,7 @@
 package google.registry.testing.mapreduce;
 
 import static google.registry.config.RegistryConfig.getEppResourceIndexBucketCount;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -213,7 +213,7 @@ public abstract class MapreduceTestCase<T> {
     for (int numTasksDeleted = 0;
         !maxTasks.isPresent() || (numTasksDeleted < maxTasks.get());
         numTasksDeleted++) {
-      ofy().clearSessionCache();
+      auditedOfy().clearSessionCache();
       // We have to re-acquire task list every time, because local implementation returns a copy.
       List<QueueStateInfo.TaskStateInfo> taskInfo =
           taskQueue.getQueueStateInfo().get(queueName).getTaskInfo();

core/src/test/java/google/registry/tools/DedupeRecurringBillingEventIdsCommandTest.java

@@ -16,7 +16,7 @@ package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.loadByEntity;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
@@ -176,14 +176,14 @@ class DedupeRecurringBillingEventIdsCommandTest
           if (newRecurring.getTargetId().equals("foo.tld")) {
             assertSameRecurringEntityExceptId(newRecurring, recurring1);
 
-            BillingEvent.OneTime persistedOneTime = ofy().load().entity(oneTime).now();
+            BillingEvent.OneTime persistedOneTime = auditedOfy().load().entity(oneTime).now();
             assertAboutImmutableObjects()
                 .that(persistedOneTime)
                 .isEqualExceptFields(oneTime, "cancellationMatchingBillingEvent");
             assertThat(persistedOneTime.getCancellationMatchingBillingEvent())
                 .isEqualTo(newRecurring.createVKey());
 
-            DomainBase persistedDomain = ofy().load().entity(domain1).now();
+            DomainBase persistedDomain = auditedOfy().load().entity(domain1).now();
             assertAboutImmutableObjects()
                 .that(persistedDomain)
                 .isEqualExceptFields(
@@ -219,7 +219,7 @@ class DedupeRecurringBillingEventIdsCommandTest
 
   private static void assertNotInDatastore(ImmutableObject... entities) {
     for (ImmutableObject entity : entities) {
-      assertThat(ofy().load().entity(entity).now()).isNull();
+      assertThat(auditedOfy().load().entity(entity).now()).isNull();
     }
   }
 
@@ -237,7 +237,7 @@ class DedupeRecurringBillingEventIdsCommandTest
   }
 
   private static ImmutableList<BillingEvent.Recurring> loadAllRecurrings() {
-    return ImmutableList.copyOf(ofy().load().type(BillingEvent.Recurring.class));
+    return ImmutableList.copyOf(auditedOfy().load().type(BillingEvent.Recurring.class));
   }
 
   private static String getKeyPathLiteral(Object... entities) {

core/src/test/java/google/registry/tools/LevelDbFileBuilderTest.java

@@ -15,7 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.appengine.api.datastore.Entity;
@@ -96,7 +96,7 @@ public class LevelDbFileBuilderTest {
     LevelDbFileBuilder builder = new LevelDbFileBuilder(logFile);
 
     ContactResource contact = DatabaseHelper.newContactResource("contact");
-    builder.addEntity(tm().transact(() -> ofy().save().toEntity(contact)));
+    builder.addEntity(tm().transact(() -> auditedOfy().save().toEntity(contact)));
     builder.build();
 
     ImmutableList<byte[]> records = ImmutableList.copyOf(LevelDbLogReader.from(logFile.getPath()));
@@ -112,6 +112,6 @@ public class LevelDbFileBuilderTest {
   }
 
   private static <T> T rawRecordToOfyEntity(byte[] record, Class<T> expectedType) {
-    return expectedType.cast(ofy().load().fromEntity(rawRecordToEntity(record)));
+    return expectedType.cast(auditedOfy().load().fromEntity(rawRecordToEntity(record)));
   }
 }

core/src/test/java/google/registry/tools/RemoveRegistryOneKeyCommandTest.java

@@ -16,7 +16,7 @@ package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.ImmutableObjectSubject.immutableObjectCorrespondence;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.newDomainBase;
 import static google.registry.testing.DatabaseHelper.persistResource;
@@ -62,7 +62,7 @@ public class RemoveRegistryOneKeyCommandTest extends CommandTestCase<RemoveRegis
         "--key_paths_file",
         writeToNamedTmpFile("keypath.txt", getKeyPathLiteral(domain)));
 
-    DomainBase persisted = ofy().load().key(domain.createVKey().getOfyKey()).now();
+    DomainBase persisted = auditedOfy().load().key(domain.createVKey().getOfyKey()).now();
     assertThat(ImmutableList.of(persisted))
         .comparingElementsUsing(getDomainBaseCorrespondence())
         .containsExactly(origin);
@@ -86,7 +86,7 @@ public class RemoveRegistryOneKeyCommandTest extends CommandTestCase<RemoveRegis
         "--key_paths_file",
         writeToNamedTmpFile("keypath.txt", getKeyPathLiteral(domain)));
 
-    DomainBase persisted = ofy().load().key(domain.createVKey().getOfyKey()).now();
+    DomainBase persisted = auditedOfy().load().key(domain.createVKey().getOfyKey()).now();
     assertThat(ImmutableList.of(persisted))
         .comparingElementsUsing(getDomainBaseCorrespondence())
         .containsExactly(origin);

core/src/test/java/google/registry/tools/ResaveEntitiesCommandTest.java

@@ -16,7 +16,7 @@ package google.registry.tools;
 
 import static com.google.common.collect.Iterables.transform;
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 
 import com.google.appengine.api.datastore.KeyFactory;
@@ -35,27 +35,27 @@ class ResaveEntitiesCommandTest extends CommandTestCase<ResaveEntitiesCommand> {
     ContactResource contact1 = persistActiveContact("contact1");
     ContactResource contact2 = persistActiveContact("contact2");
     deleteEntitiesOfTypes(CommitLogManifest.class, CommitLogMutation.class);
-    assertThat(ofy().load().type(CommitLogManifest.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).isEmpty();
-    assertThat(ofy().load().type(CommitLogMutation.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class).keys()).isEmpty();
     runCommandForced(
         KeyFactory.keyToString(Key.create(contact1).getRaw()),
         KeyFactory.keyToString(Key.create(contact2).getRaw()));
 
-    assertThat(ofy().load().type(CommitLogManifest.class).keys()).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).hasSize(1);
     Iterable<ImmutableObject> savedEntities =
         transform(
-            ofy().load().type(CommitLogMutation.class).list(),
+            auditedOfy().load().type(CommitLogMutation.class).list(),
-            mutation -> ofy().load().fromEntity(mutation.getEntity()));
+            mutation -> auditedOfy().load().fromEntity(mutation.getEntity()));
     // Reload the contacts before asserting, since their update times will have changed.
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     assertThat(savedEntities)
-        .containsExactlyElementsIn(ofy().load().entities(contact1, contact2).values());
+        .containsExactlyElementsIn(auditedOfy().load().entities(contact1, contact2).values());
   }
 
   @SafeVarargs
   private static void deleteEntitiesOfTypes(Class<? extends ImmutableObject>... types) {
     for (Class<? extends ImmutableObject> type : types) {
-      ofy().deleteWithoutBackup().keys(ofy().load().type(type).keys()).now();
+      auditedOfy().deleteWithoutBackup().keys(auditedOfy().load().type(type).keys()).now();
     }
   }
 }

core/src/test/java/google/registry/tools/ResaveEnvironmentEntitiesCommandTest.java

@@ -17,7 +17,7 @@ package google.registry.tools;
 import static com.google.common.collect.Iterables.getOnlyElement;
 import static com.google.common.collect.Iterables.transform;
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
 
@@ -44,25 +44,25 @@ class ResaveEnvironmentEntitiesCommandTest
         CommitLogManifest.class,
         CommitLogMutation.class);
     runCommand();
-    assertThat(ofy().load().type(CommitLogManifest.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).isEmpty();
-    assertThat(ofy().load().type(CommitLogMutation.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class).keys()).isEmpty();
   }
 
   @Test
   void testSuccess_createsCommitLogs() throws Exception {
     createTld("tld");
     deleteEntitiesOfTypes(CommitLogManifest.class, CommitLogMutation.class);
-    assertThat(ofy().load().type(CommitLogManifest.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).isEmpty();
-    assertThat(ofy().load().type(CommitLogMutation.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class).keys()).isEmpty();
     runCommand();
 
     // There are 5 entities that have been re-saved at this point (in 3 transactions, one for each
     // type), so expect 3 manifests and 5 mutations.
-    assertThat(ofy().load().type(CommitLogManifest.class).keys()).hasSize(3);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).hasSize(3);
     Iterable<ImmutableObject> savedEntities =
         transform(
-            ofy().load().type(CommitLogMutation.class).list(),
+            auditedOfy().load().type(CommitLogMutation.class).list(),
-            mutation -> ofy().load().fromEntity(mutation.getEntity()));
+            mutation -> auditedOfy().load().fromEntity(mutation.getEntity()));
     ImmutableSortedSet<RegistrarContact> theRegistrarContacts =
         loadRegistrar("TheRegistrar").getContacts();
     assertThat(savedEntities)
@@ -79,7 +79,7 @@ class ResaveEnvironmentEntitiesCommandTest
   @SafeVarargs
   private static void deleteEntitiesOfTypes(Class<? extends ImmutableObject>... types) {
     for (Class<? extends ImmutableObject> type : types) {
-      ofy().deleteWithoutBackup().keys(ofy().load().type(type).keys()).now();
+      auditedOfy().deleteWithoutBackup().keys(auditedOfy().load().type(type).keys()).now();
     }
   }
 }

core/src/test/java/google/registry/tools/ResaveEppResourcesCommandTest.java

@@ -15,7 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 
 import google.registry.model.ImmutableObject;
@@ -31,23 +31,23 @@ class ResaveEppResourcesCommandTest extends CommandTestCase<ResaveEppResourceCom
   void testSuccess_createsCommitLogs() throws Exception {
     ContactResource contact = persistActiveContact("contact");
     deleteEntitiesOfTypes(CommitLogManifest.class, CommitLogMutation.class);
-    assertThat(ofy().load().type(CommitLogManifest.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).isEmpty();
-    assertThat(ofy().load().type(CommitLogMutation.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class).keys()).isEmpty();
     runCommandForced("--type=CONTACT", "--id=contact");
 
-    assertThat(ofy().load().type(CommitLogManifest.class).keys()).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).hasSize(1);
-    assertThat(ofy().load().type(CommitLogMutation.class).keys()).hasSize(1);
+    assertThat(auditedOfy().load().type(CommitLogMutation.class).keys()).hasSize(1);
-    CommitLogMutation mutation = ofy().load().type(CommitLogMutation.class).first().now();
+    CommitLogMutation mutation = auditedOfy().load().type(CommitLogMutation.class).first().now();
     // Reload the contact before asserting, since its update time will have changed.
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
-    assertThat(ofy().load().<Object>fromEntity(mutation.getEntity()))
+    assertThat(auditedOfy().load().<Object>fromEntity(mutation.getEntity()))
-        .isEqualTo(ofy().load().entity(contact).now());
+        .isEqualTo(auditedOfy().load().entity(contact).now());
   }
 
   @SafeVarargs
   private static void deleteEntitiesOfTypes(Class<? extends ImmutableObject>... types) {
     for (Class<? extends ImmutableObject> type : types) {
-      ofy().deleteWithoutBackup().keys(ofy().load().type(type).keys()).now();
+      auditedOfy().deleteWithoutBackup().keys(auditedOfy().load().type(type).keys()).now();
     }
   }
 }

core/src/test/java/google/registry/tools/server/DeleteEntityActionTest.java

@@ -17,7 +17,7 @@ package google.registry.tools.server;
 import static com.google.appengine.api.datastore.DatastoreServiceFactory.getDatastoreService;
 import static com.google.common.truth.Truth.assertThat;
 import static com.googlecode.objectify.Key.create;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.google.appengine.api.datastore.Entity;
@@ -49,7 +49,7 @@ class DeleteEntityActionTest {
   @Test
   void test_deleteSingleRegisteredEntitySuccessfully() {
     ReservedList ofyEntity = new ReservedList.Builder().setName("foo").build();
-    ofy().saveWithoutBackup().entity(ofyEntity).now();
+    auditedOfy().saveWithoutBackup().entity(ofyEntity).now();
     new DeleteEntityAction(KeyFactory.keyToString(create(ofyEntity).getRaw()), response).run();
     assertThat(response.getPayload()).isEqualTo("Deleted 0 raw entities and 1 registered entities");
   }
@@ -69,7 +69,7 @@ class DeleteEntityActionTest {
     getDatastoreService().put(entity);
     String rawKey = KeyFactory.keyToString(entity.getKey());
     ReservedList ofyEntity = new ReservedList.Builder().setName("registered").build();
-    ofy().saveWithoutBackup().entity(ofyEntity).now();
+    auditedOfy().saveWithoutBackup().entity(ofyEntity).now();
     String ofyKey = KeyFactory.keyToString(create(ofyEntity).getRaw());
     new DeleteEntityAction(String.format("%s,%s", rawKey, ofyKey), response).run();
     assertThat(response.getPayload()).isEqualTo("Deleted 1 raw entities and 1 registered entities");
@@ -88,7 +88,7 @@ class DeleteEntityActionTest {
   @Test
   void test_deleteOneEntityAndNonExistentEntityRepliesWithError() {
     ReservedList ofyEntity = new ReservedList.Builder().setName("first_registered").build();
-    ofy().saveWithoutBackup().entity(ofyEntity).now();
+    auditedOfy().saveWithoutBackup().entity(ofyEntity).now();
     String ofyKey = KeyFactory.keyToString(create(ofyEntity).getRaw());
     String rawKey = KeyFactory.keyToString(new Entity("non", "existent").getKey());
     BadRequestException thrown =

core/src/test/java/google/registry/tools/server/KillAllCommitLogsActionTest.java

@@ -20,6 +20,7 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.Iterables.filter;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.newContactResource;
@@ -80,16 +81,18 @@ class KillAllCommitLogsActionTest extends MapreduceTestCase<KillAllCommitLogsAct
       assertWithMessage("entities of type " + clazz).that(ofy().load().type(clazz)).isNotEmpty();
     }
     ImmutableList<?> otherStuff =
-        Streams.stream(ofy().load())
+        Streams.stream(auditedOfy().load())
             .filter(obj -> !AFFECTED_TYPES.contains(obj.getClass()))
             .collect(toImmutableList());
     assertThat(otherStuff).isNotEmpty();
     runMapreduce();
     for (Class<?> clazz : AFFECTED_TYPES) {
-      assertWithMessage("entities of type " + clazz).that(ofy().load().type(clazz)).isEmpty();
+      assertWithMessage("entities of type " + clazz)
+          .that(auditedOfy().load().type(clazz))
+          .isEmpty();
     }
     // Filter out raw Entity objects created by the mapreduce.
-    assertThat(filter(ofy().load(), not(instanceOf(Entity.class))))
+    assertThat(filter(auditedOfy().load(), not(instanceOf(Entity.class))))
         .containsExactlyElementsIn(otherStuff);
   }
 }

core/src/test/java/google/registry/tools/server/KillAllEppResourcesActionTest.java

@@ -21,7 +21,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Multimaps.filterKeys;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
@@ -130,7 +130,7 @@ class KillAllEppResourcesActionTest extends MapreduceTestCase<KillAllEppResource
     assertThat(beforeContents.keySet()).containsAtLeastElementsIn(AFFECTED_KINDS);
     assertThat(difference(beforeContents.keySet(), AFFECTED_KINDS)).isNotEmpty();
     runMapreduce();
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     ImmutableMultimap<String, Object> afterContents = getDatastoreContents();
     assertThat(afterContents.keySet()).containsNoneIn(AFFECTED_KINDS);
     assertThat(afterContents)
@@ -140,7 +140,7 @@ class KillAllEppResourcesActionTest extends MapreduceTestCase<KillAllEppResource
   private ImmutableMultimap<String, Object> getDatastoreContents() {
     ImmutableMultimap.Builder<String, Object> contentsBuilder = new ImmutableMultimap.Builder<>();
     // Filter out raw Entity objects created by the mapreduce.
-    for (Object obj : Iterables.filter(ofy().load(), not(instanceOf(Entity.class)))) {
+    for (Object obj : Iterables.filter(auditedOfy().load(), not(instanceOf(Entity.class)))) {
       contentsBuilder.put(Key.getKind(obj.getClass()), obj);
     }
     return contentsBuilder.build();

core/src/test/java/google/registry/tools/server/ResaveAllHistoryEntriesActionTest.java

@@ -15,7 +15,7 @@
 package google.registry.tools.server;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.ofy.ObjectifyService.auditedOfy;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
@@ -55,9 +55,9 @@ class ResaveAllHistoryEntriesActionTest extends MapreduceTestCase<ResaveAllHisto
     DomainBase domain = persistActiveDomain("test.tld");
     ContactResource contact = persistActiveContact("humanBeing");
     Entity domainEntry =
-        ofy().save().toEntity(new HistoryEntry.Builder().setParent(domain).build());
+        auditedOfy().save().toEntity(new HistoryEntry.Builder().setParent(domain).build());
     Entity contactEntry =
-        ofy().save().toEntity(new HistoryEntry.Builder().setParent(contact).build());
+        auditedOfy().save().toEntity(new HistoryEntry.Builder().setParent(contact).build());
 
     // Set raw properties outside the Objectify schema, which will be deleted upon re-save.
     domainEntry.setProperty("clientId", "validId");
@@ -66,7 +66,7 @@ class ResaveAllHistoryEntriesActionTest extends MapreduceTestCase<ResaveAllHisto
     contactEntry.setProperty("alsoShouldBeDeleted", "456nah");
     datastoreService.put(domainEntry);
     datastoreService.put(contactEntry);
-    ofy().clearSessionCache();
+    auditedOfy().clearSessionCache();
     runMapreduce();
 
     Entity updatedDomainEntry = datastoreService.get(domainEntry.getKey());