[amyjko]

Problem

Logged-out visitors to a public process in a non-public org (e.g. /org/uwischool/process/TeachingEvaluations) get "Oops… Internal Error".

The server render succeeds; the failure is during client hydration:

1. Since a2d6c79, anonymous viewers can't read roles of non-public orgs, so role references in step text (e.g. "the AOM notifies…") don't resolve.
2. ReferenceView falls back to <Oops inline>, which always rendered a <div> — inside a markup <p>.
3. <div> in <p> is invalid HTML; the browser re-parses it, the DOM no longer matches what Svelte expects, hydration fails, and SvelteKit shows its error page.

Members never hit this because their references resolve to links.

Changes

• Oops.svelte: render a <span> when inline (fixes every inline use, including RoleLink).
• ReferenceView.svelte: non-members see the text the author wrote for an unresolved reference (the dean in <the dean@Dean>) rather than an error badge; members still see the badge for genuinely broken references.
• Process +page.svelte: when no role is accountable for a process, the page let anyone logged in edit it, but RLS only allows members of the org. Outsiders saw edit controls whose changes would fail. It now requires membership, matching RLS.
• Process +page.ts: queryProcessChanges was passed the org id instead of the process id, so the Changes section was always empty.

Testing

• Reproduced in headless Chromium against production, logged out: hydration_mismatch then an uncaught {} (Svelte's hydration sentinel).

• With the fix, on a local dev server against production data, the page renders with no hydration warnings or errors.

• svelte-check: 0 errors. Unit tests: 288 passed.

• Against the local Supabase stack, using a non-public org with a role AOM and a public process whose step reads Each year, the <AOM@AOM> notifies faculty. Ask the <bogus@NOPE> for help., I loaded the page in Chromium as each kind of viewer:

  Viewer	AOM	NOPE (doesn't exist)	Hydration warnings or errors
  Logged out	plain text	plain text (bogus)	none
  Logged in, not a member	plain text	plain text (bogus)	none
  Member	link to the role	red "Unknown role or process" badge (now a <span>)	none

  With main's Oops/ReferenceView, the same page logs node_invalid_placement_ssr (<div> inside <p>) and hydration_mismatch for all three viewers, members included, because of the broken reference. So on main, members could also hit the crash on any page with a broken reference.

• Edit controls (title pencil and Delete button), checked on a process with no accountable role and on one owned by AOM, which the member doesn't hold:

  Viewer	No one accountable	AOM accountable
  Logged out	no	no
  Logged in, not a member	no (was yes on main)	no
  Member	yes	no
  Admin	yes	yes

🤖 Generated with Claude Code