Pointing everything at one registry wasn't the fix
After the last scare, every build was pointed at a single internal registry. One endpoint, one source of truth, no public registry in any config file. The review closed.
That internal registry is also a pass-through for the public one. It answers for both, and by the time a build sees a result the two sets have already been flattened into one list. The client cannot tell which side a package came from, because the merge happened before it asked.
Outside every boundary: Public registry (anyone may publish), Build (installs by name), Internal registry (and a pass-through; FAILED: one flat answer), Anyone else (publishes freely), Your packages (the names you own), an empty slot for the who holds the name upstream, an empty slot for the when upstream may answer Connections: Build calls Internal registry — one endpoint (step 1) Internal registry calls Your packages — names we publish (step 2) Internal registry calls when upstream may answer (step 3) when upstream may answer calls Public registry — only foreign names (step 4) who holds the name upstream controls Public registry — this scope is ours Anyone else must NOT reach Public registry — no name left to take