# Activated App consumer views

`catalogconsumer.New(db, store)` uses the existing content-addressed Catalog
snapshot store. It serves AppMetadata V1/V2/V3 and IntegrationBinding from one
read path; the store must be the same durable store used by Reconcile.

A repeatable-read transaction verifies the active AppInstallation, its unique
ACTIVATED operation, and the complete ConsumerGrantSet. It then reads that
operation's unique `METADATA_SELECTION_COMMITTED` journal entry and the org's
committed writer lineage. The exact stored snapshot must match the digest,
Org and activated installation revision. Schema and engine generations come
from that snapshot. Effective metadata must match the same operation and
snapshot digest. Missing, corrupt, ambiguous or mixed selections fail closed.

The Layout publication graph is a separate authority. Consumer reads neither
select nor mutate it. Reconcile already commits the App's snapshot selection
and effective component set before atomic operation activation; consumer reads
do not require an additional publication table or a post-activation repair.

Each `(Org, AppInstallation, App)` stream advances when that App activates a
new selection. A different App's update does not relabel an unchanged App with
a newer revision or a different snapshot. A requested minimum above the App's
own revision remains stale. Watch polls the installation revision as a cheap
hint and uses the same fully verified Get path before emitting a view.

SecurityEpoch is a receipt, not immutable content lineage. It comes from the
org writer's committed `LastSecurityEpoch` in the same transaction and must be
at least the selected operation's epoch. The Runtime host remains responsible
for current workload/security admission; this reader does not replace it.
Security-only commits can reissue the same content digest with a newer receipt.

Full Get reads and validates the immutable snapshot. Unchanged watch polls do
not load it. No cache or second current-selection authority is introduced.

`reader_integration_test.go` exercises real TiDB activation, distinct App A/B
selections, repeated completion, reader reconstruction, security-only writer
receipts and grant revocation. The security-only fixture proves receipt
lineage; the Core API/worker/SFCRM walking slice proves actual Runtime security
projection and service restart. `selection_test.go` covers missing, corrupt,
duplicate and mixed selection failures.