Addresses the second review round on PR #12189 (pabloalba).
The re-checks only asked whether the profile could read. The membership
legs of sql:file-permissions filter soft-deleted rows since the F2 fix,
but the organization-owner fallback grants read-only access over HTTP
without looking at deleted_at, so a soft-deleted file or team kept an
expelled org owner subscribed indefinitely. The re-checks now gate on
existence as well: file-readable? and team-readable? require a live row
(db/get*, non-throwing, soft-deleted rows excluded) plus the read
permission, mirroring the :subscribe-file gates and extending them to
teams. Both relays and revalidate-profile-subscriptions use them; the
subscribe handlers keep their exact behavior.
Also from the same review:
- watcher-consumes-revocation-events-from-the-bus no longer races the
command's after-commit announcement: it takes access away with a
direct row delete and drives the watcher with a synthetic bus event,
instead of deleting through the command and publishing a second
notify-* that would mask a broken command announcement.
- moving-a-project-closes-source-team-subscriptions pins the
move-project e2e: the file subscription drops, the source-team
subscription survives (membership unchanged).
- soft-deleted-file/team-closes-org-owner-subscription cover the new
gate with red-before/green-after tests.
mem:backend/websocket-subscriptions updated.
Closes#12155
AI-assisted-by: inkling-2-small-free
87ca7aca53