- Shipped
- August 26, 2026 at 4:07 AM UTC
- Author
- kamo
- Commit
- a0d6a11
Corrects two spec assumptions against real code: no RoleRightType uses **************** (all 36 commerce rights use POS, and the editors filter on exact equality, so tagging SERVICE would leave all 41 invisible), and RoleRightType.ts holds 169 of 255 rather than the spec's '146 of 232'. Includes a flagged scope addition: getSubscription accepts VIEW_OWN_SUBSCRIPTIONS then loads by uid with no org and no owner predicate, so the customer right reads any tenant's rows. The program design already names it as invariant 6's counter-example.