# Organization Store Boundary Map

`internal/store/organization` owns organization, member, team, workspace,
provider, route, grant, and organization membership persistence. Keep boundary
refactors semantic-preserving unless a canonical organization/provider spec
requires behavior changes.

## `service.go` decomposition

`service.go` should stay focused on the `Store` / `TxStore` construction surface,
request errors, and the high-level organization service methods that have not yet
moved to a narrower file. Shared helpers that are reused across those workflows
live outside `service.go`:

- `service_shared_metadata.go` owns package-wide metadata, quota, sync-mode,
  slug/name, transaction rollback, and unique-violation helpers.
- `service_shared_auth.go` owns reusable organization membership/admin/member
  authorization gates and workspace/provider grant authorization checks.
- `service_shared_load.go` owns reusable organization team, workspace, member,
  provider, route, route-group, and managed-route loader helpers.
- `service_shared_scan.go` owns scanner helpers plus provider endpoint,
  capability, route model, provider status/driver, and JSON list normalization/encoding helpers.

When adding organization service logic, keep request-bounded SQL in the owning
workflow file and reuse these helpers only when they preserve the same explicit
organization/workspace/provider/member IDs. Do not hide broad organization-wide
hydration inside shared helpers.

Package structure is a maintainability convention, not runtime behavior.
Executable tests should protect authorization, query bounds, and returned
organization/provider semantics rather than pinning helper declarations to
specific files.