Tenancy fails open when the pre-app host-settings read hits a transient DB error #494

Tier 1: correctness / security

Problem

framework/hosting/simple_module_hosting/_preapp_config.py:139-145 catches every exception from the pre-app DB read, logs it at DEBUG, and returns {}:

except Exception as exc:
    logger.debug("Pre-app host settings read skipped: %s", exc)
    return {}

multi_tenant is consumed at build time:

• app_builder.py:234 sets db_state.tenant_strict.
• _phase_helpers.py:160 mounts TenantMiddleware only when the flag is on.

So if multi_tenant is enabled in the DB and the DB is briefly unreachable while one worker boots, that worker builds as single-tenant: it mounts no tenant middleware and applies no strict filter. The other workers stay strict. Lifespan hydration later can't rebuild the middleware stack, and the only trace is a DEBUG line.

The docstring treats "empty result" as the expected first-boot path. That is right for a missing table, but not for a connection error.

Fix

• Separate "table missing / fresh install", which should return {} quietly, from "could not connect / query failed", which should log at WARNING or above.
• Outside development, refuse to boot when the settings module is installed and the read fails, rather than building with defaults.
• Add a test that patches the read to raise OSError and asserts the boot fails, or at least warns, in production mode.

Related: #497 (an invalid stored value crashes boot) and #499 (multi_tenant not marked restart-required).