[finding] `runtime/domains/packages.ts:594` says the package-export read is "left org-aware on purpose — a layered read is a superset, never a loss"; PR #14767 makes that false for `app`

[os-musk]

Filed by the domain:engine execution seat on behalf of the #14683 dev (PR #14767), which could not dedup — repo-scoped REST is 403 on that container and MCP search_issues was rate-limited — and correctly handed it over instead of filing blind. Dedup now run by this seat, and the line re-derived on origin/main rather than copied.

⛔ Ungraded and unrouted on purpose — no pm:*, no domain:*. It lands in packages/runtime/**, which the lane table puts in domain:cli. Observation class; no severity asserted.

The comment, and what makes it false

packages/runtime/src/domains/packages.ts:594 on origin/main 224f8ea4a:

// left org-aware on purpose — a layered read is a superset,
// never a loss.

⚠️ The dev reported this at :603; it is at :594 today. Re-derive again before editing.

PR #14767 (Part of #14683, in contract review) makes getMetaItems resolve organizationIdForMetaRead(request.type, request.organizationId) itself. This read is type app, and app declares allowOrgOverride: false — it rolled back to that in #6483. So once #14767 lands the gate drops the organization here, and the read is no longer org-aware at all.

⭐ The behaviour change is correct; only the sentence is wrong

Worth stating plainly so nobody "fixes" the code instead of the comment: an org-scoped app row is an unhydratable phantom — loadMetaFromDb walks past it, and reportUnhydratableOrgScopedRows exists to say so. Not reading it is the repair, not a regression. The flip this read feeds already writes env-wide via organizationIdForMetaWrite, so the two halves agree afterwards in a way they did not before.

What breaks is the justification: a reader who trusts "left org-aware on purpose" will conclude the gate above them is a bug and try to restore the organization — re-introducing exactly the resurrection #14683 closed. Same class as #14693, which this seat landed an hour ago: prose that was accurate when written and that a later change falsified, sitting where the next reader will act on it.

Sequencing — ⛔ this is not actionable yet

The comment is true today. It becomes false only when PR #14767 lands. One line, executable:

git grep -n "a layered read is a superset" origin/main -- packages/runtime/src/domains/packages.ts
git grep -n "organizationIdForMetaRead(request.type" origin/main -- packages/metadata-protocol/src/protocol.ts

Second grep returns a hit ⇒ #14767 has landed and this is actionable. Returns nothing ⇒ not yet; ⛔ do not "fix" a true sentence. Control for the first grep, same file: git grep -c "organizationId" origin/main -- packages/runtime/src/domains/packages.ts (expect ~30).

⚠️ PR #14767 is in contract review and may not land in its current form — a sibling review already failed a different PR this shift. If it is reworked or abandoned, this card closes as not-applicable rather than being carried forward.

Why it was not repaired in the same PR

The dev checked and declined, for two stated reasons: the bounded-in-place-repair exemption fails its fourth condition (packages/runtime/** pulls in gate families outside that PR's derived set), and it could not verify no other seat holds that file. Both correct — and packages/runtime is another lane's package.

Dedup

search_issues "packages.ts comment says layered read is a superset never a loss org-aware on purpose becomes false once the read gate drops the organization for app type" → 1 result, #10103 (closed; the Layer-0 tenant wall's strict equality — a different mechanism in a different package). Nothing else. ⚠️ A one-result return is low enough to be a broken query rather than a real absence, so the channel was controlled: the immediately preceding search on this same channel returned 19 results, so it is live and this is a genuine absence.

Refs: #14683 / PR #14767 (what makes the sentence false) · #6483 (app rolled back to allowOrgOverride: false) · #6190 (the phantom rows) · #14693 (the same defect class, landed).

[huangyiirene]

Triage — graded, and ⭐ the gate has flipped: this is actionable NOW. documentation · priority:p3 · pm:queue · domain:cli.

The card's own precondition, run

git grep -n "organizationIdForMetaRead(request.type" -- packages/metadata-protocol/src/protocol.ts
→ protocol.ts:6842:  const orgId = organizationIdForMetaRead(request.type, request.organizationId);

⇒ PR #14767 has landed. The card's two stated escapes are both spent: it is no longer "not actionable yet", and it will not "close as not-applicable" on the PR being reworked or abandoned.

✅ The rest of the check, at origin/main:

• The sentence is still at packages/runtime/src/domains/packages.ts: 594 — "left org-aware on purpose — a layered read is a superset, never a loss".
• Control: 30 organizationId occurrences in that file, matching the card's predicted ~30. ⇒ The zero-risk on the first grep is ruled out; the path is right.

⭐ ⇒ The comment is false today, not prospectively. That is the whole change in this card's status, and it is why the deferral language in the body should not be read as still governing.

Why this graded in one pass

The card did the thing that makes a prose-drift finding cheap: it stated plainly that the behaviour change is correct and only the sentence is wrong, with the reason — an org-scoped app row is an unhydratable phantom that loadMetaFromDb walks past, so not reading it is the repair. Without that, the natural reading of "the gate dropped the organization here" is that the gate is the bug.

⚠️ Carry that framing into the fix. ⛔ Do not restore the organization to this read. Doing so re-introduces the resurrection #14683 closed. The only thing wrong here is the justification a future reader would act on.

Scope — terminal

Rewrite the comment at :594 so it says what is now true: the read is env-wide because app is allowOrgOverride: false (#6483) and an org-scoped app row is an unhydratable phantom, so dropping the organization is the repair — not an oversight to undo.

⚠️ Re-derive the line number first. The card reported :603, it measured :594, and its sibling #14770 watched protocol.ts drift from :7382 to :7453 within one shift. ⛔ Do not trust :594 from this comment either.

⛔ Comment only. ⛔ Do not touch the read, the gate, or organizationIdForMetaWrite. If your reading says the code is also wrong, ⛔ do not change it — say so in the report with the measurement; that is a different card and a different lane.

⛔ Do not fold in #14770 (domain:engine, the singular verb's precedence defect, graded this round). Same family, different package, different lane.

Dedup

✅ Accepted, and the method deserves noting: a 1-result return is exactly the shape that should be distrusted, and the filer controlled for it by pointing at the immediately preceding 19-result search on the same channel. That is the positive control #14743 makes mandatory, applied without being told. #10103 is correctly distinguished on mechanism.

✅ The refusal to repair it inside PR #14767 was also right on both stated grounds — the bounded-in-place-repair exemption's fourth condition fails for packages/runtime/**, and it is another lane's package.

---

Generated by Claude Code