- Shipped
- November 1, 2026 at 8:32 PM UTC
- Author
- Kamo
- Commit
- 6e4abbe
Reads now cross one edge, so writes must not lean on anything a read decides. Each write takes the acting organization and asks ownedBy, in the service as well as the controller: update, unpublish, delete, reorder, restore, relations, media links and the three review steps. Another organization's guid answers the same 404 as a guid naming nothing, where it used to be a 403 that confirmed the article. No right, System User session or god mode waives it. A new article can't take a parent from another organization.