@vantageos/backend-doctor 0.1.0 → 0.1.1

package/dist/registry.js

@@ -8,6 +8,7 @@ import { makeOracleDetector } from "./detectors/shared.js";
 import { SOURCE_BACKFILL_DETECTORS } from "./detectors/source/backfill.js";
 import { SOURCE_CONTRACT_DETECTORS } from "./detectors/source/contract.js";
 import { IDENTITY_DETECTORS } from "./detectors/source/identity.js";
+import { SOURCE_ISOLATION_DETECTORS } from "./detectors/source/isolation.js";
 import { SOURCE_JOBS_DETECTORS } from "./detectors/source/jobs.js";
 import { SOURCE_LIFECYCLE_DETECTORS } from "./detectors/source/lifecycle.js";
 import { SOURCE_READBUDGET_DETECTORS } from "./detectors/source/readbudget.js";
@@ -19,7 +20,7 @@ import { R46_STANDARD_PIN, STANDARD_SOURCE_DETECTORS, } from "./detectors/standa
 import { STANDARD_DOC_DETECTORS } from "./detectors/standard/standard-doc.js";
 import { makeR14, makeR38 } from "./detectors/structural.js";
 /** The standard both pins the whole wave against. */
-export const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ a9d7877b4947ed8ae61d234433debb2182a2ba44 (elpiarthera/ElPi-Corp)";
+export const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ 4265226eb6698c7dfbae3ced77df564e877908ad (elpiarthera/ElPi-Corp)";
 export const REGISTRY = [
     ...PER_ROW_PREDICATES.map((spec) => ({
         detector: makeOracleDetector(spec),
@@ -98,6 +99,15 @@ export const REGISTRY = [
         // site (the human decides refusal vs a tighter index vs a declared bound),
         // present on a wide scan that DOES refuse (the tasks.list SCAN_CAP shape).
         ...SOURCE_REFUSAL_DETECTORS,
+        // R-50 — org isolation on a reactively-subscribed read must be a TYPED EMPTY /
+        // UNAUTHORIZED RESULT, never an uncaught throw. Reads the convex source: a
+        // public `query` (subscribed via useQuery) whose no-org path throws an
+        // org-keyed ConvexError / a throw-on-no-org helper, with no fail-closed
+        // resolver (`withOrgScope`) or documented contract, hands the subscribing
+        // client an uncaught Server Error (the 2026-08-30 vCRM-Preview incident:
+        // workspaces:ensureCurrent + prefs:sidebar). Extends the R-11 isolation
+        // family; a mutation refusing an unauthorized write (R-16) is out of scope.
+        ...SOURCE_ISOLATION_DETECTORS,
         ...SOURCE_CONTRACT_DETECTORS,
         ...IDENTITY_DETECTORS,
         // The four STANDARD-DOCUMENT detectors (R-42/R-15/R-32/R-39): each reads the