- Shipped
- October 18, 2026 at 11:50 PM UTC
- Author
- Kamo
- Commit
- 262e3ad
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor on /**: 401 without a session, 403 without the right), and every billing handler needs the OTK-validated session (401 live, unauthenticated, via api.*); BillingService then scopes the account by org and member. The scan only read annotations below the mapping and did not know the billing helpers. - Ratchet: @RequireRight counts when it is one of the handler's own annotations (above or below the mapping, never the body) or on the class; a test pins the /** interceptor registration it rests on and the annotation scan on a snippet. 52 TP01 baseline entries that were @RequireRight-guarded all along are gone. - BillingRelayController: every handler opens with relaySession() and answers 401 before reading the path or calling BillingService; seat writes take the session. New test: no session (or forged X-Org-Id/X-Member-Id headers) is 401 on all five handlers with no downstream call. - OrgGraphPublisherCoverageTest: DisclosureLedgerQueryService (SELECT org_teams titles for labels) and LoanTransactionService (retires a loan transaction's record state) write no graph fact; ALLOWED with reasons.