- Shipped
- August 8, 2026 at 9:31 PM UTC
- Author
- Kamo
- Commit
- b05eadd
The repair matched on the string alone and ran on every boot, so it stopped being idempotent the moment anyone granted the personal-loan app: a row holding 'LOS' means mortgage only if it was written before the rename. Worse, the collision branch deletes rather than rewrites, so a security model that already holds an MLOS row would have its personal-loan grant destroyed rather than merely mistranslated. That was not hypothetical. Security model 0c4c2f7e already holds MLOS plus a FORCE_ENABLED personal-loan grant written at 14:15 today, and it matched the DELETE clause exactly — one KI run away from silently vanishing. Verified against prod: the old predicate selects 1 row to delete, the bounded one selects 0. Rows are now only touched when CREATED_AT precedes the instant kamo-shared-library c906e8e landed.