docs(runtime): correct the app-flip read comment falsified by the read gate (#15063)

`packages/runtime/src/domains/packages.ts` justified the publish-drafts app
list read with "left org-aware on purpose — a layered read is a superset,
never a loss". Since `getMetaItems` began resolving `organizationIdForMetaRead`
on `request.type` itself, that read is env-wide for `app`: the registry
declares `app` `allowOrgOverride: false`, so the predicate answers `undefined`
and the `organizationId` this route still passes is dropped at the gate.

The behaviour is correct and unchanged here — an org-scoped `app` row is an
unhydratable phantom that `loadMetaFromDb` walks past, so dropping the
organization is the repair. Only the justification was wrong, and it was wrong
in the direction that invites the next reader to restore the organization and
resurrect those rows. Comment only: the read, the gate and
`organizationIdForMetaWrite` are untouched.


Claude-Session: https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-trump

packages/runtime/src/domains/packages.ts

@@ -590,9 +590,25 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
                     // org-scoped flip was a phantom: the app looked published for
                     // the life of the process and went back to `_unpublished:
                     // true` on the next restart, because the env-wide row it left
-                    // untouched is the only one cold boot loads. The READ above is
-                    // left org-aware on purpose — a layered read is a superset,
-                    // never a loss.
+                    // untouched is the only one cold boot loads. The
+                    // `getMetaItems` read below is env-wide for the same
+                    // reason, and since #14683 it is so by construction: that
+                    // method applies `organizationIdForMetaRead` to
+                    // `request.type` itself, and the predicate answers
+                    // `undefined` for every type the registry declares
+                    // non-overridable — `app` among them, rolled back to
+                    // `allowOrgOverride: false` in #6483. The `organizationId`
+                    // this route still hands that call is dropped at the gate.
+                    //
+                    // ⛔ Dropping it is the REPAIR, not an oversight to undo.
+                    // An org-scoped `app` row is an unhydratable phantom —
+                    // `loadMetaFromDb` walks past it, and
+                    // `reportUnhydratableOrgScopedRows` exists to say so — so
+                    // an org-aware read here would resurrect rows that vanish
+                    // at the next restart and flip `_unpublished` on them
+                    // instead of on the row cold boot hydrates. Read scope and
+                    // write scope now answer one question through one registry
+                    // flag; ⛔ never "restore" the organization to this read.
                     const flipped: string[] = [];
                     const flipOrganizationId = organizationIdForMetaWrite('app', organizationId);
                     try {