Say in the class contract that the gate can fall open

Shipped

August 28, 2026 at 8:38 PM UTC

Author

Kamo

Commit

8e9454e

The header promised "a blocked app's endpoints all 403" without qualification, which is now true only while the entitlement tables can be read. The exception is reasoned out in EntitlementGateReads and pointed at from preHandle, but the class header is where a reader forms their model of the gate, so it should not overstate it.