fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else

[objectstack-fleet]

Fixes #20156
Clause-②: no

Executes maintainer ruling 5856774816 on the card (batch 227 item 1, letter B), confirmed in 5856866273. The ruling, verbatim:

Ruled: B — author exemption, in ADR-0106 D4's shape. On the three stored-version doors (/layers, ?layers=true, /diff) a caller who may write the app reads the full stored version; every other caller who may open the app reads exactly what the plain read gives them, pruned.

This is the second half of the card. The first half landed as a Part of PR (the landing record is comment 5855055724 on the card). It left the partial app cells of the stored-version doors as a declared pending-decision exemption. This PR replaces that exemption with the ruled answer.

What changed

The shared read gate (packages/rest/src/meta-item-read-gate.ts)

• MetaReadGatePolicy.app becomes 'gate' | 'author-exempt', and 'pending-decision' is retired. 'author-exempt' serves the stored app whole to a caller whose MetaReadGateCaller.mayWriteItem is true. Every other caller gets 'gate''s answer: the plain read's refusal, or the pruned app.
• The exemption is a caller property (ADR-0106 D4). The caller carries the verdict, and the policy says only whether a door honours it. The gate tests no route.
• An app the plain read refuses whole (an app-level requiredPermissions the caller lacks, or an unpublished app to a caller with neither Studio nor Setup access) is refused on every door, to an author as to anyone.
• An exempt author skips the docs-audience entry arm, because that arm only prunes entries. A non-author on a stored-version door now resolves it, as the plain read does. It fails closed on a book-read fault by dropping doc entries, exactly as the plain read does.

The REST transport (packages/rest/src/rest-server.ts)

• RestServer.metaSaveVerdict(ctx, rawType) is the admission of PUT /meta/:type/:name, spelled once. The PUT door now calls it, and the exemption asks it too. That follows ruling item 1: the predicate is metaWriteCapabilityVerdict, the save door's own answer, not a "platform administrator" reading.
• The exemption asks the whole save-door question, not a capability name: the type is folded at the boundary and the organization is ctx.tenantId, as the door threads it. manage_org_presentation therefore admits a view save but not an app save, so it does not make its holder an app author. A census edge pins that.
• STORED_VERSION_DOOR_POLICY is { arms: 'per-caller', app: 'author-exempt' }. Only doors whose policy honours the exemption put mayWriteItem on the caller. It is a pure verdict over the already-memoised exec ctx and the static type registry, so it costs no read. The memoised ctx is copied, never written.
• The two doors now serve what the gate serves. The layered view and /diff used to act on a refusal verdict and discard a serve verdict's document, so they could not answer "pruned" at all.
  • The layered view replaces each layer with the gate's document, after judging every layer.
  • /diff emits each bucket's values from the judged sides. It adds or drops no entry, and the comparison stays the protocol's over the stored bodies. This follows the redaction precedent one frame down (diffMetaItem: diff raw, emit projected values, ruling 5299845282 option B) and the ADR-0106 mask beside it.
• No runtime change. The runtime dispatcher runs only { arms: 'all', app: 'gate' } and serves no stored-version door.

Unchanged, per the ruling: the plain read and /published prune for every caller, authors included. /history, /audit, every whole-refusal cell, and the book, doc and dashboard arms are unchanged.

Verification (head 9d955a369 unless stated)

Tests

• The census, packages/rest/src/meta-alternate-door-read-gates.test.ts: 261/261.
  • It has a new author caller (manage_metadata, without finance.access or crm_admin), so the plain read serves them only part of crm.
  • The author's three stored-door cells for crm pin the full stored version. The non-author cells for crm pin the plain read's pruned navigation on every layer and in /diff's emitted values, with the same bucket paths as the raw diff.
  • The rendered doors are controls: the plain read and /published still prune crm for the author.
  • The author is refused payroll (403) and launchpad (404) on every door.
• Retired: PENDING_DECISION, isPendingDecision and their docblock. AUTHOR_EXEMPTION cites the ruling. Three pins replace them:
  • the exemption names exactly /layers, ?layers=true and /diff, which is every stored-version door and no other;
  • the cells whose answer it changes are exactly the author's three partial crm cells, and the six author whole-refusal cells stay refused;
  • its predicate is the save door: each caller's declared savesApps equals what PUT /meta/app/crm answers them. The author gets 200 and the protocol is called once; reader and non-reader get 403 FORBIDDEN; the anonymous caller gets 401. For every refused caller, the protocol is never called.
• @objectstack/rest, vitest run --project local: 3655 tests, 3654 passed, 1 skipped, 0 failed. This ran at 6780cd777, and the only packages/ delta since is one docblock line in rest-server.ts (git diff 6780cd777 9d955a369 -- packages/).
• @objectstack/rest typecheck (tsc, plus the test layer under tsconfig.test.json): exit 0.
• @objectstack/runtime typecheck: exit 0. domains/meta-item-read-gate-parity.test.ts: 77/77. Both ran at bad8baa63; the delta since is the same docblock line.

Reverse verification and ablations

Each mutation used scripts/ablation-replace.mjs in wrap mode inside a script that traps EXIT, INT and TERM. Each restore was proven: the blob equals HEAD and git diff HEAD is empty.

mutation	where	landed	result
A: the exemption forced off (serve(gated.app) for everyone)	the gate	anchor 1 → 0, blob 817024027bb2 → 6feda3867a6c	261 run, 3 red: exactly ?layers=true, /layers and /diff × app/crm × author
B: the predicate forced on for everyone (mayWriteItem: true)	the transport	anchor 1 → 0, blob 5942f7eb57de → 43523e878b86	261 run, 5 red: the three app/crm × non-reader stored-door cells, the fault-path /layers pin, and the org-presentation pin
C: the retired 'pending-decision' put back into the runtime's policy	packages/runtime/src/domains/meta.ts	anchor 1 → 0, blob c47473b9dcdd → 543aa6707030	runtime tsc: 1 error, TS2322 … 'pending-decision' … not assignable to type 'MetaReadGatePolicy' at meta.ts(297,7). So the importer reads the rebuilt rest declarations.

No test file stays behind: the ablations and the one-shot probe below were run and then removed.

Gates

node scripts/pm/dispatch-gates.mjs --commands derived 92 families from merge base a9fb83ef0. Every command ran at 9d955a369 with its exit code captured before any pipe. --ran reconciled the run: 92 derived, 91 run, 1 NOT-MEASURED, 0 unrun.

• 90 exit 0.
• node scripts/check-empty-changeset.mjs --base origin/main exits 1 by design; see the next section.
• pnpm check:dual-build-cjs-loads: NOT MEASURED. It exits 3 (PREREQUISITE NOT MET) because 42 packages have no dist/, and this gate needs the whole repo built. That is CI's Build Core run.
• Added by this lane:
  • pnpm lint (eslint . --no-inline-config, the whole repo): exit 0 in 121s. It ran on the tree that became 9d955a369, so this is a full run, not a narrowed one.
  • The board check node scripts/check-issue-citations.mjs --base origin/main, after the merge: exit 0, 17 citations judged, 17 resolve.
  • pnpm --filter @objectstack/spec run check:liveness: exit 0.
• check:system-context-census was red after the refactor: metaSaveVerdict holds the save door's isSystem read now. Row 49 of content/docs/permissions/system-context.mdx now anchors it and names the read exemption it feeds. The declared count was regenerated by the gate's own --fix (87 → 88 symbols).
• check:skill-examples and check:type-check-debt first refused on missing builds (exit 3). Both exit 0 at 9d955a369 once their named prerequisites were built.

A pending release note is corrected in place, so check-empty-changeset stays red

.changeset/20156-alternate-door-read-gates.md exists on the merge base and was not added by this PR. The gate classes this edit as the deliberate correction case. Its own remedy text says not to restore the note, because restoring it would republish a sentence this PR makes false. Instead, this PR says so here, for confirmation:

• The note: the bullet that began "One case is unchanged in this release: an app the plain read would serve a caller only in part…", which said the partial app cells were "pending a decision". The note's closing sentence, "…except the app row of /layers, ?layers=true and /diff for a caller the plain read serves only part of the app", also changed.
• What changed under it: this PR executes the ruling, so both sentences now state the ruled answer. A caller who may save the app reads it whole on those doors; every other caller reads it pruned. If the note shipped unchanged beside this PR's own changeset, the release notes would contradict themselves.
• This PR's own changeset: .changeset/20156-app-author-exemption.md, @objectstack/rest patch. The Check Changeset job counts only ADDED changesets, so the corrected note alone would not satisfy it.
• skip-changeset is not applied: this PR publishes.

Acceptance notes

Dispatch item 4: the exported types are unreleased. MetaReadGatePolicy and MetaReadGateCaller became @objectstack/rest exports under the pending .changeset/20193-dispatcher-meta-read-gate.md (minor). That file is still on origin/main 89f87f234, checked just before this PR opened. The published @objectstack/rest@17.4.0 tarball was also checked. Its dist/index.d.ts has RestServer 21 times (the positive control) and MetaReadGatePolicy|MetaReadGateCaller|createMetaItemReadGate 0 times. Its dist/index.js has createMetaItemReadGate|pending-decision 0 times. So changing these members moves no published surface, which is what patch and Clause-②: no rest on (ruling item 4).

Dispatch item 6: the pending release note. It is corrected in place (see the section above) and has not been consumed by a Version Packages PR. This PR's own changeset sits beside it.

Dispatch item 7: which objectui surfaces read these doors. Measured before the fix, in objectui source at the pinned .objectui-sha f8a9d0fb0596, from a read-only clone:

• /diff: 0 source readers. MetadataClient.diff is defined but never called.
• ?layers=: 0 source readers. objectui's own ratchet test forbids that spelling.
• /layers for an app has two save-back readers, and both save through client.save, which is PUT /meta/:type/:name:
  • app-shell/src/views/studio-design/StudioDesignSurface.tsx: the app navigation editor loads the layered view at :1760 and saves navigation at :1960;
  • app-shell/src/views/metadata-admin/ResourceEditPage.tsx: the generic editor, since no bespoke editor is registered for app. It loads at :1017 and saves at :1500.
• A non-author who loads the pruned app cannot save it, because that door refuses them with the same verdict the exemption asks. No reader saves under a non-author identity.
• DesignerEditorWrapper, the reader the ruling named, is not in objectui source at the pin; only CHANGELOG entries mention it.
• Other /layers readers never load an app: PermissionMatrixEditor (permission), PackageOwdOverviewPanel (object), EmbeddedItemEditor (object sub-items), and StudioDesignSurface at :2880 (object) and :3931 (flow).

The claim's file surface, amended in two places. Both edits correct published text this change would otherwise make false or red:

• content/docs/ui/apps.mdx, about lines 359-373: the paragraph said the stored-version doors "do not yet prune … pending a decision". It now states the ruled answer.
• content/docs/permissions/system-context.mdx, row 49, plus the regenerated count.

Out of scope, reported for the seat (not fixed here).

• Authors can still lose entries through the draft read. Studio's app editors build their edit baseline as { ...layered.effective, ...draft }, where the draft comes from client.getDraft, the plain read with ?state=draft. The editors save that result back:

  • StudioDesignSurface.tsx: the merge is at :1760-1767 and the save at :1960;
  • ResourceEditPage.tsx: the merge is at :1016-1056 and the save at :1500.

  The plain read prunes for authors too, and the ruling keeps it that way. So when an app has a pending draft, the draft's pruned navigation overrides the whole effective for an author who lacks an entry's permission, and the next draft save drops that entry.

  A one-shot probe of the real handler at 9d955a369 measured the server half. For an author with manage_metadata but not finance.access, GET /meta/app/crm?state=draft answered 200 with navigation ["nav_leads"] (the protocol saw state: draft). /layers answered ["nav_leads","nav_finance_ledger"].

  Where to fix it (objectui reading the draft through a stored-version door, or the server serving the draft layer there) is not this card's call.

• Docs drift. content/docs/plugins/adding-a-metadata-type.mdx, about lines 164-196, documents DesignerEditorWrapper and a ?layers=true read. Neither exists in objectui source at the pin. No carrier.

• Observation, not measured. The layered view serves the protocol's _diagnostics beside the layers. The plain read's pruned document carries the same _diagnostics, computed over the unpruned document, so the layered view discloses nothing the plain read does not. Whether any diagnostic message names a withheld entry was not measured.

Not addressed here

#20237 remains open: the dispatcher's list branch. #20139 remains open: the bare-number query reads in rest-server.ts. Both are queued behind this card.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 27 documentable anchor(s).

20 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 89f87f23440d61f8fcd10b2c2991c663a917181e.

⛔ 8 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 89f87f23440d61f8fcd10b2c2991c663a917181e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from aacf0c7ba0db3d16428246bc1ed82f8241b0b98d — the merge of head 9d955a369a86c13a7047d2852fba3a9bda85f728 into base 89f87f23440d61f8fcd10b2c2991c663a917181e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin aacf0c7ba0db3d16428246bc1ed82f8241b0b98d && git checkout aacf0c7ba0db3d16428246bc1ed82f8241b0b98d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 89f87f23440d61f8fcd10b2c2991c663a917181e 9d955a369a86c13a7047d2852fba3a9bda85f728 && git checkout -B drift-repro 89f87f23440d61f8fcd10b2c2991c663a917181e && git merge --no-ff 9d955a369a86c13a7047d2852fba3a9bda85f728

node scripts/docs-audit/affected-docs.mjs --json 89f87f23440d61f8fcd10b2c2991c663a917181e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 89f87f23440d61f8fcd10b2c2991c663a917181e → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9d955a369a86c13a7047d2852fba3a9bda85f728

① Derived judgments

• The exemption predicate is "who may save this app": correct. RestServer.metaSaveVerdict(ctx, rawType) (packages/rest/src/rest-server.ts:3525) calls metaWriteCapabilityVerdict({ isSystem, systemPermissions, canonicalType: canonicalMetaUrlType(rawType), activeOrganizationId: ctx?.tenantId, operation: 'save' }). That is byte-for-byte the argument set the PUT door built inline at the merge base. The read doors attach it as mayWriteItem in metaReadAudienceSources (:3336), from the same memoised resolveExecCtx result and the same req.params.type.
• It is the PUT door's FULL caller admission: correct. After the verdict, the handler (:7244 onward) resolves the protocol (501 if there is no saveMetaItem), unwraps the body, and reads If-Match, resolveMetaWriteActor, ?force/?package/?mode=draft and organizationIdForMetaWrite(canonicalType, ctx?.tenantId). None of these refuses on a caller property.
  • NOT_OVERRIDABLE is saveMetaItem's item/scope refusal, identical for every admitted caller.
  • manage_org_presentation is already folded into the verdict (an org-overridable type plus an active org, packages/metadata-core/src/meta-write-capability.ts), and app is not org-overridable. The census presenter edge drives the real PUT: view 200, app 403.
  • endpoints.item switches PUT, /layers (inside the item !== false block) and /diff (registerPerItemRoute) together, so it cannot turn an exempt reader into a refused saver.
• The save door's own behaviour is unchanged: correct. The diff replaces the inline call with RestServer.metaSaveVerdict(ctx, req.params.type): the same inputs, and the same refusal envelope (403 FORBIDDEN, verdict.message). There is no unannounced write-path change.
• The exemption applies only on the three stored-version doors, and only to app: correct.
  • mayWriteItem has exactly three sites at head: the interface (meta-item-read-gate.ts:65), the app arm (:1264) and the transport (rest-server.ts:3336).
  • The transport supplies it only when policy.app === 'author-exempt' (:3250), and only STORED_VERSION_DOOR_POLICY (:3502) carries that.
  • The plain read and /published run { arms: 'all', app: 'gate' } (:7072, :8673). /history and /audit run eventDoorRefusal's { arms: 'per-caller', app: 'gate' } (:3407).
  • The doc, book and dashboard arms never read mayWriteItem.
• No author is served what the plain read refuses WHOLE: correct. In the app arm, the gated.app == null refusals run before serve(gateInputs.authorExempt ? document : gated.app) (:1300): permission answers 403, and unpublished answers absent to a non-builder (ADR-0045 §3). In the census, author × payroll is 403 and author × launchpad is 404 on all six doors, and the scope pin enumerates those six cells as stillRefused.
• The layered-view mechanism fix is correct, and neutral for other types.
  • serveMetaItemLayered judges every present layer first, then assigns served (:3949-3959).
  • serve(document) returns the same reference for doc, book, dashboard (the per-caller skip), object and the default arm (meta-item-read-gate.ts:1312-1361), so the replacement is a no-op for them. The ADR-0106 mask runs afterwards, unchanged.
  • For app, a caller the plain read serves in full gets filterAppForUserWithReason's copy (census reader × crm: every layer toEqual(stored)).
  • A residual nuance, not a defect: that filter also drops declared-empty group entries, so non-authors now get that tidy on stored doors, as the plain read already gives them.
• The /diff mechanism fix is correct: it discloses less and reports no phantom deletions.
  • diffEmittedFrom (:3459) maps each bucket in place, substituting only value/from/to from the judged sides. Bucket paths are preserved: the census asserts bucketPaths(res.body) === bucketPaths(raw).
  • For unpruned sides, diffSides sets to[path] = e.value and so on, so the emitted values are identical.
  • A non-author loses the withheld entries' values on both sides. A changed entry can now show equal pruned values, which hides a change but never reports a deletion.
  • object is not gatesPerCaller, so its diff path is untouched.
• The non-author fault path on stored doors is new, but identical to the plain read. resolveNavDocAudience is now resolved for non-authors on stored doors, which it was not under pending-decision. A book-read fault drops doc entries (fail closed), which is the plain read's own composite answer. An edge pin covers it on /layers.
• The runtime dispatcher is untouched, compiles, and behaves the same. packages/runtime/src/domains/meta.ts:297 RENDERED_DOCUMENT_POLICY = { arms: 'all', app: 'gate' } is a member of the new union. The gate reads ctx.mayWriteItem only under author-exempt, which the runtime never passes. git grep finds no pending-decision anywhere at head.
• The census reddens in every direction.
  • Widened to /published for an author: the pruned row requires navIds === plain and no secret.
  • Widened to a non-author: non-reader × crm × stored doors requires no secret (PR ablation B: 5 red).
  • Widened to doc/book: the author rows are refused, with secrets forbidden.
  • Narrowed: the exempt cells require the secrets present and toEqual(stored) / toEqual(raw diff) (ablation A: 3 red).
  • savesApps is checked against the registered PUT handler with the real metaSaveVerdict: author 200 with saveMetaItem called once; reader/non-reader 403 FORBIDDEN; anonymous 401; the protocol is never called on a refusal.
  • The case count, 1+36+3+216+5 = 261, matches the file.

② Semver level

patch for @objectstack/rest with Clause-②: no is correct, as ruling item 4 set.

• Published surface: the @objectstack/rest@17.4.0 tarball, read from the registry, has RestServer 21 times in dist/index.d.ts and MetaReadGatePolicy|MetaReadGateCaller|createMetaItemReadGate 0 times. No file under dist/ mentions pending-decision or author-exempt, and dist/index.js has 0 hits. The types enter the surface only through the still-pending .changeset/20193-dispatcher-meta-read-gate.md (@objectstack/rest: minor, on origin/main). So the combined release first publishes 'gate' | 'author-exempt', and nothing released moves.
• Narrowing: non-authors whom the plain read serves only part of an app now get it pruned on the three doors, where before they got it whole. That pulls a door back to a gate the contract already declares (apps.mdx "the entry is never served"; ADR-0046 §6.7; ADR-0045 §3). It is the same class three reviews upheld on PR fix(rest): one per-caller read gate for GET /meta/:type/:name and every door beside it #20190 as outside clause ②. No authorable accept set narrows, so no (narrowing) + BREAKING marker is owed.

③ Boundary flags

• THE DELIBERATE CORRECTION: .changeset/20156-alternate-door-read-gates.md (on the merge base, M in this PR). Two spans are rewritten.
  • Span 1, the bullet.
    • Before (7 sentences): "One case is unchanged in this release: an app the plain read would serve a caller only in part. That is an app the caller may open, but with navigation entries withheld from them by requiredPermissions or the documentation audience. On /layers, ?layers=true and /diff, such a caller still receives the stored app with those entries included, as before. No other caller does: an app the plain read refuses whole is refused on these doors too. What these doors should answer a partial caller is pending a decision, because both ways of matching the plain read restrict authors. Pruning the stored app would delete the withheld entries when Studio's designer saves back what it loaded. Refusing it would lock out any author who lacks one entry's permission, platform admins included."
    • (a) Sentences 1, 3 and 5 became false through this PR's behaviour change: the case changed, non-authors are pruned, and the decision is ruled. Sentences 2, 4 and 6 are true, but they are orphaned rationale or definitions that the new text keeps. Sentence 7 argues a rejected option and describes nothing in the release.
    • After, judged one by one:
      1. "For an app the caller may open, /layers, ?layers=true and /diff answer by who is asking." (b) True: serve(authorExempt ? document : gated.app) under STORED_VERSION_DOOR_POLICY.
      2. "A caller who may save the app (the one PUT /meta/app/:name admits) receives the full stored version, including the navigation entries that requiredPermissions or the documentation audience withhold from them: Studio's designer saves back what it loads, so a pruned load would delete those entries." (b) True: mayWriteItem = metaSaveVerdict(...).allowed, the PUT door's admission; census author cells are toEqual(stored).
      3. "Every other caller receives the app without the entries withheld from them, left out as the plain read leaves them out, on every layer and on both sides of a diff." (b) True: the per-caller arms (requiredPermissions, docs audience) run on each layer and via diffEmittedFrom. The per-deployment arms stay off, as the preceding bullet of the same note says.
      4. "The plain read and /published prune for every caller, authors included." (b) True: { arms: 'all', app: 'gate' } at :7072 and :8673; the census author × crm cells for the plain read and /published are pruned.
      5. "An app the plain read refuses whole is refused on these doors to an author too." (b) True: the refusals precede the exemption, and six author whole-refusal cells are pinned.
  • Span 2, the closing sentence.
    • Before: "…now receives the plain read's answer, except the app row of /layers, ?layers=true and /diff for a caller the plain read serves only part of the app." (a) False now: only savers are excepted.
    • After: "…now receives the plain read's answer, except that a caller who may save an app reads it whole on /layers, ?layers=true and /diff." (b) True of the combined release (fix(rest): one per-caller read gate for GET /meta/:type/:name and every door beside it #20190's pull-backs plus this exemption).
  • (c) The rest of the note and the new changeset: nothing is false or contradictory.
    • These hold at head: the frontmatter; the doc/book/object/dashboard bullets; /history//audit; "dashboard is unchanged on every door except /published"; and "a caller the plain read serves in full gets the same answers as before".
    • The new .changeset/20156-app-author-exemption.md (@objectstack/rest: patch) agrees with the corrected note on every point, including that manage_org_presentation does not qualify (app is not org-overridable).
    • Observation only: the earlier bullet's clause "they show the stored version, which is what an author edits" is scoped to the per-deployment gates, and the corrected bullet refines it. It is not contradictory.
  • Deliberate correction of .changeset/20156-alternate-door-read-gates.md confirmed: 6 sentence(s) judged.
• content/docs/ui/apps.mdx (:359-373): every changed sentence is true at head:
  • "/published twin … to every caller, the app's authors included" (app: 'gate' on both);
  • "the one PUT /api/v1/meta/app/NAME admits: manage_metadata, or a system context" (the verdict is isSystem or manage_metadata, and manage_org_presentation is excluded for app);
  • "left out … on every layer and on both sides of a diff";
  • "lifts no whole refusal".
• content/docs/permissions/system-context.mdx row 49: true. metaSaveVerdict holds an isSystem read (ctx?.isSystem === true), so a system context is exempt on the three doors. The anchor is added, and the count is regenerated from 87 to 88. Lint & Repo Gates is green on head, so the census gate accepted it.
• Files outside the claimed surface: none. All 7 files are inside claim 5857413915 as amended in place: the gate, the transport, the census, the two changesets, apps.mdx and system-context.mdx. No runtime, metadata-core or spec file is touched.
• PR body vs diff: every mechanism claim is verified above: the copied ctx; the exemption gated on the policy, not the type; the layer replacement after judging all layers; diff emission preserving entries; PENDING_DECISION/isPendingDecision retired; the tarball's 0 hits; no runtime change. The first line is Fixes #20156, then a bare Clause-②: no. The objectui reader census and the ablation numbers are reported but not reproducible here (no repo attach was permitted), and they contradict nothing at source.
• CI on head (35 check-runs, all completed): 32 success; 2 skipped (Console Pin Gate and Packed-tarball smoke (opt-in), both rostered expected skips); 1 failure, Check Changeset.
  • The job log is not readable through the proxy (403).
  • By scripts/check-empty-changeset.mjs's diff-shape rule, the merge-base diff carries exactly one M row under .changeset/ (the pending note) and one A row with non-empty frontmatter. So the only refusal it can raise is the foreign-changeset rule on the pending note: the DELIBERATE CORRECTION class this record confirms.
  • There is no other red.
• Out-of-scope draft finding, server half: CONFIRMED at source.
  • GET /meta/:type/:name?state=draft sets state: 'draft' on getMetaItem (rest-server.ts:6988-7002), then runs metaItemReadGate(..., { arms: 'all', app: 'gate' }) with visible = verdict.document (:7060-7068).
  • No mayWriteItem is attached on that door. So an author lacking an entry's permission reads the draft pruned, while /layers serves it whole.
  • It is not this PR's required change; the carrier is the seat's decision.
• The ruling's confidence gap: the dev measured objectui's readers before the fix. It reports two /layers app readers, both of which save through PUT (the exemption's own predicate), and no /diff or ?layers= reader. This was reported, not tolerated.

Implemented-by: claude/issue-20156-app-author-exemption
Reviewed-by: session_01UYBdGBzWSrAMzpW8ah3GbP

Independence: INDEPENDENT AGENT (fed the card, the rulings and the PR only; not the dispatch order or the seat's conclusions)

VERDICT: PASS

[objectstack-fleet]

Check Changeset is red by design on this head: a confirmed DELIBERATE CORRECTION

_{domain:cli execution PM seat #6024 · session session_01UYBdGBzWSrAMzpW8ah3GbP · written 2026-09-27T18:58Z}

• The gate: Check Changeset (.github/workflows/pr-automation.yml, job changeset-check, which runs scripts/check-empty-changeset.mjs --base "$MERGE_BASE").
• The reason: this PR modifies .changeset/20156-alternate-door-read-gates.md, a PENDING release note that PR fix(rest): one per-caller read gate for GET /meta/:type/:name and every door beside it #20190 added. The note's statement that partial app callers are "unchanged … pending a decision" is false once this PR executes ruling 5856774816, so the PR corrected it in the same stroke. That is the gate's DELIBERATE CORRECTION class. Its own remedy text reads 「do NOT restore it -- say so on the PR and get it confirmed」 and 「this gate stays red either way」.
• The confirmation: the at-tier contract review on this same head (9d955a36), record 5858783654, names the note and judges each of its 6 rewritten sentences: 「Deliberate correction of .changeset/20156-alternate-door-read-gates.md confirmed: 6 sentence(s) judged.」 Under landing-operations.md, that record is the confirmation.
• Why it does not block the queue: pr-automation.yml triggers on pull_request only, with no merge_group, and Check Changeset is not a required context. Every other check on this head is success or a rostered expected skip.

---

Generated by Claude Code