From b6423975f94a82e22aca3f587d0dfc80d493060d Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 18:12:11 +0000 Subject: [PATCH] docs(runtime): correct the app-flip read comment falsified by the read gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `packages/runtime/src/domains/packages.ts` justified the publish-drafts app list read with "left org-aware on purpose — a layered read is a superset, never a loss". Since `getMetaItems` began resolving `organizationIdForMetaRead` on `request.type` itself, that read is env-wide for `app`: the registry declares `app` `allowOrgOverride: false`, so the predicate answers `undefined` and the `organizationId` this route still passes is dropped at the gate. The behaviour is correct and unchanged here — an org-scoped `app` row is an unhydratable phantom that `loadMetaFromDb` walks past, so dropping the organization is the repair. Only the justification was wrong, and it was wrong in the direction that invites the next reader to restore the organization and resurrect those rows. Comment only: the read, the gate and `organizationIdForMetaWrite` are untouched. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza --- packages/runtime/src/domains/packages.ts | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/packages/runtime/src/domains/packages.ts b/packages/runtime/src/domains/packages.ts index cf0772d166..e7e7bf8503 100644 --- a/packages/runtime/src/domains/packages.ts +++ b/packages/runtime/src/domains/packages.ts @@ -590,9 +590,25 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin // org-scoped flip was a phantom: the app looked published for // the life of the process and went back to `_unpublished: // true` on the next restart, because the env-wide row it left - // untouched is the only one cold boot loads. The READ above is - // left org-aware on purpose — a layered read is a superset, - // never a loss. + // untouched is the only one cold boot loads. The + // `getMetaItems` read below is env-wide for the same + // reason, and since #14683 it is so by construction: that + // method applies `organizationIdForMetaRead` to + // `request.type` itself, and the predicate answers + // `undefined` for every type the registry declares + // non-overridable — `app` among them, rolled back to + // `allowOrgOverride: false` in #6483. The `organizationId` + // this route still hands that call is dropped at the gate. + // + // ⛔ Dropping it is the REPAIR, not an oversight to undo. + // An org-scoped `app` row is an unhydratable phantom — + // `loadMetaFromDb` walks past it, and + // `reportUnhydratableOrgScopedRows` exists to say so — so + // an org-aware read here would resurrect rows that vanish + // at the next restart and flip `_unpublished` on them + // instead of on the row cold boot hydrates. Read scope and + // write scope now answer one question through one registry + // flag; ⛔ never "restore" the organization to this read. const flipped: string[] = []; const flipOrganizationId = organizationIdForMetaWrite('app', organizationId); try {