RFC-0045: release purge gate-read failure with a draft that dropped reference fields sends the closure-less stored plan #213

Found in the final verification of #212 (RFC-0045 step 3b). Not reachable today: the reference and repeater types stay refused on every write path until step 7. It must be fixed before step 7.

State. The live site node defines a reference field, for example events.venue. The working copy has dropped every reference definition and is not published yet; for instance, remove_field has finished.

Failure.

1. A release retitles a target, hall, that a live entry shows as a card.
2. After the release batch commits, the gate read of the published site node (release-purge.ts, about line 142) fails with a transient R2 error.
3. The fallback reads definesReferences on the working row, finds nothing, and sends the stored pin-time plan.
4. That plan was built with references: false. It holds hall's tag but not the referrer's, so the referrer's page stays cached until MAX_EDGE_AGE.

The behaviour is documented in RFC-0045 "Amended in 3b" ("If it fails, the working row decides"), but it leaves a page stale.

Fix, preferred. Retry the gate read once, then purge everything. Sites without references would then over-purge only when R2 itself failed.

Fix, alternative. At pin time, store a flag with the plan saying whether the live site node defined references. On a read failure, purge everything when either that flag or the working row says references.

Fold the fix into step 4 or step 7 of RFC-0045, and add it to the RFC's implementation watch list.

🤖 Generated with Claude Code