- Shipped
- August 11, 2026 at 12:57 AM UTC
- Author
- Kamo
- Commit
- ba53a27
kamo.entitlement.fail-open grants any app the plan matrix never mentions. It is documented as a temporary valve for the catalog backfill — turn it off once the matrix is seeded — but nothing could answer the question that decides whether turning it off is safe: which tenants are holding which apps only because of it. Flipping it blind would have taken apps away from live organizations, with the first support ticket as the notification. failOpenGrants resolves each organization twice, once granting unmentioned apps and once denying them, and reports the difference. It does not read the live flag, so it gives the same answer before and after the flip. The re-resolution goes through resolvePlan rather than the plan id directly, mirroring the real path's fallback to a planCode lookup — otherwise a grant that would in fact survive gets reported as a loss.