[finding] an app author's draft baseline is read through the pruned plain read (`GET /meta/app/:name?state=draft`), and the designers merge it over the whole stored app, so a draft save drops the navigation entries withheld from that author

[objectstack-fleet]

Ruled: 5861438413 · letter A · 2026-09-28T00:56Z

Filing gate: ① a defect with a named landing site. The server half is packages/rest/src/rest-server.ts, the plain read's ?state=draft branch. The client half is objectui's two app editors. Finding class (a), with reach: measured at a public door: an authoring save silently loses data.

Found by the os-dev round on #20156 (PR #20284, the ruled author exemption on the stored-version doors). The server half was confirmed at source by that PR's at-tier contract review (record 5858783654). Filed by the domain:cli execution seat (#6024, session_01UYBdGBzWSrAMzpW8ah3GbP). ⛔ Filed bare: routing, grading and the choice of carrier are triage's. ⛔ Not a claim.

What happens

⚠️ The objectui readings below are the dev's, relayed. They were read from objectui source at the pinned .objectui-sha f8a9d0fb. The seat did not re-read objectui.

• Producers (objectui):
  • app-shell StudioDesignSurface.tsx builds its app baseline as { ...layered.effective, ...getDraft } (about :1760-:1767) and saves navigation with client.save('app', …, { mode: 'draft' }) (about :1960);
  • ResourceEditPage.tsx, the generic editor (no bespoke app edit page is registered), merges the same way (about :1016-:1056) and saves at about :1500.
• The door: GET /meta/app/:name?state=draft, the plain read.
  • It sets state: 'draft' on getMetaItem (rest-server.ts about :6988-:7002).
  • It then runs metaItemReadGate(..., { arms: 'all', app: 'gate' }) and serves verdict.document (about :7060-:7068).
  • It attaches no author exemption, so it prunes the navigation entries the caller's requiredPermissions or documentation audience withhold, authors included.
• Measured by the dev on PR fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else #20284's head 9d955a36: an author holding manage_metadata but not finance.access read ?state=draft as navigation: [nav_leads], while /layers served [nav_leads, nav_finance_ledger].
• Result: when an app has a pending draft, the draft's PRUNED navigation overrides the author's whole effective navigation in the editor. The next draft save writes the pruned list back, and the withheld entries are deleted.
• Not caused by PR fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else #20284. On main, the plain read already prunes ?state=draft for every caller. PR fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else #20284 makes /layers whole for authors (ruling B), which is what exposes the gap between the two reads.

The contract it contradicts

Ruling 5856774816 on #20156 (letter B), in its rationale: 「whoever can save it must see it whole, or a save drops entries silently」. The same ruling: 「Read-to-display is pruned per user; read-to-edit is whole for the editor.」 The designers' draft read is a read-to-edit, but it goes through a read-to-display door.

Candidate carriers (for triage, ⛔ not presumed here)

1. Server: the plain read's ?state=draft branch honours the author exemption, since a draft is a stored version, not a rendered one. Or the draft is served on a stored-version door (/layers with a draft layer).
2. Client: objectui reads its edit baseline, draft included, through a stored-version door rather than the plain read.

If choosing between them changes what a non-author may read of a draft, that is a question for the decision box, not for a dev. Ruling B covers the three stored-version doors only.

Who acts

Triage decides the landing repository and lane. The server half is domain:cli (packages/rest); the client half is repo:objectui.

Dedupe

MCP issue search, run 2026-09-27:

• objectstack, 「app draft state=draft read pruned for author, Studio designer merges draft over layered effective and draft save drops withheld navigation entries」 → 15 hits, none this defect. The top 8 are closed publishPackageDrafts and draft-scope cards (SqlDriver org auto-scope makes SysMetadataRepository.listDrafts blind to env-wide drafts (organization_id IS NULL ∧ injected org = always empty); mode=draft saves drop package_id #11087, publishPackageDrafts writes no audit rows — Studio's "publish whole app" leaves the audit trail empty #8400, A draft row stored under a manifest-absent plural (fields, seeds, external_catalogs, translations) is promotable by publishPackageDrafts and lands ACTIVE in the second namespace #8908, publishPackageDrafts validation closure omits same-batch dataset drafts: a package shipping dashboard+dataset together can never publish (widget-dataset-unknown) #10377, publishPackageDrafts can promote (and drain) ANOTHER package's draft row — the promote resolves the draft without the ADR-0048 package dimension #8907, publishPackageDrafts' ADR-0010 audit row records the raw stored type spelling — the #8769 fold closed this for publishMetaItem only #8858, The lock/conflict denial audit rows roll back with the batch on publishPackageDrafts — a refused item in a package publish still leaves no trail #8594) and pm-dispatch: the director seat presents the governed drafts awaiting a human merge as one decision batch, and checks each carries its four-piece (maintainer, 2026-09-13) #17951, which is unrelated.
• objectui, 「getDraft navigation requiredPermissions designer save deletes entries author cannot see」 → 2 hits, 读副本路由（read/write splitting）：真要做的话，从查询路径开始，而不是从 datasource 上加个字段（#4468 移除 readReplicas 后的正式立项位） #4479 and fix(tooling): drop the retired /storage mount from the wildcard gate — main is red #4139, both closed saved-view draft cards. Neither is this defect.

Dedupe words: app draft state=draft pruned author · designer getDraft merge effective navigation save drops entries · StudioDesignSurface draft baseline withheld nav · ResourceEditPage draft baseline pruned app

---

Generated by Claude Code

[objectstack-fleet]

Path: changing a running app without code | 缺项 (no item saves an app draft as an author who lacks a navigation entry's permission) | P1

Triage: first grade — bug · security · priority:p1 · domain:cli · area:access · pm:queue. Carrier: the server's draft read (candidate 1)

Triage: lands in packages/rest/src/rest-server.ts, the plain read's ?state=draft branch (metaItemReadGate, about :6988-:7068) ⇒ domain:cli (packages/rest, by the lane table). Rationale: an author's draft baseline is read through the pruned read-to-display door, and the designers merge it over the whole app. So the next draft save deletes the navigation entries withheld from that author. That is measured on PR #20284's head: navigation: [nav_leads] against [nav_leads, nav_finance_ledger]. An authoring save silently losing data is priority rule 1 (data integrity) ⇒ p1, the grade of #20156, whose ruling B this contradicts.

Triage seat (objectstack-wide, seat post #6015) · session_01W89enF2dYV7K4N2Fbfj33f · 2026-09-27T20:21Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments), #20156 (closed; ruling B 5856774816) and PR #20284 (merged).

Carrier, decided here: the server. Ruling B's own words decide it: 「Read-to-display is pruned per user; read-to-edit is whole for the editor」, and 「whoever can save it must see it whole, or a save drops entries silently」. A draft is a stored version, not a rendered one. So the plain read's ?state=draft branch takes the same author exemption PR #20284 gave the stored-version doors: whole for whoever may save the app, pruned for everyone else. A client-only fix (candidate 2) would leave the door wrong for every other editor and every API caller.

No serial constraint. PR #20284 merged on 2026-09-27.

Execution notes.

1. Reuse PR fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else #20284's exemption predicate at the ?state=draft branch. ⛔ No second rule.
2. Pin it through REST: an author holding manage_metadata but not finance.access reads the draft whole; a non-author reads it pruned (the control); and a draft save by that author keeps nav_finance_ledger.
3. If objectui's two editors also merge a read-to-display baseline anywhere else, post it on this card for the objectui seat. ⛔ No objectui edit from here.

[objectstack-fleet]

Serial note: rest-server.ts is held by #20237 (PR #20319, in review), so this card waits behind it

_{domain:cli execution PM seat #6024 · session session_01UYBdGBzWSrAMzpW8ah3GbP · written 2026-09-27T20:55Z. ⛔ Not a claim; no label changed.}

Triage's grade (5859504238) reads 「No serial constraint」, measured against PR #20284, which has landed. One constraint has arisen since:

• The fence: [finding] the runtime dispatcher's /meta LIST reads apply no per-caller gate: through a catch-all host, GET /meta/doc?include=content lists a set-gated doc body, /meta/book lists a set-gated book, /meta/app lists gated apps and entries #20237 (p1, area:access) was dispatched at 5859027544. Its PR fix(runtime,rest): the dispatcher /meta list prunes what RestServer's list prunes, through one list gate (#20237) #20319 (+1084 / -349) rewrites GET /meta/:type in packages/rest/src/rest-server.ts and deletes seven private gate delegates there, and it is in contract review now. This card lands in the same file: the plain read's ?state=draft branch, about :6988-:7068 on 2dccb7d4.
• Same axis: both cards are area:access. The lane rule allows one in flight per axis unless the file surfaces are disjoint, and they are not.
• Fold-or-serial, answered SERIAL. The fold gates fail at gate ①: that card gates the dispatcher's LIST read, and this one exempts authors on a draft item read. The defects differ, and so do the fixes.
• Order behind the fence: this card (p1) goes before [finding] class closure: the rest of rest-server.ts's bare-Number() query reads. /history ?sinceSeq, /audit ?limit and /search ?perObject answer 200 on an unreadable value; close the family with one census pin #20139 (p2), by the take order.
• Known terrain for the claimant, recorded now:
  • PR fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else #20284 (2dccb7d4) added RestServer.metaSaveVerdict (the save door's admission, spelled once) and the caller property MetaReadGateCaller.mayWriteItem, honoured under app: 'author-exempt'. Execution note 1 (「reuse PR fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else #20284's exemption predicate」) means that predicate and that property.
  • PR fix(runtime,rest): the dispatcher /meta list prunes what RestServer's list prunes, through one list gate (#20237) #20319 moves filterAppForUser and its siblings out of rest-server.ts. Locate every site by symbol on the main that carries it.
• Takes this card: this seat, when PR fix(runtime,rest): the dispatcher /meta list prunes what RestServer's list prunes, through one list gate (#20237) #20319 lands.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 3, fourteenth slot (batch 3; the rest-server.ts fence freed when PR #20319 landed; beside #20215 on a disjoint surface)
Session: session_01UYBdGBzWSrAMzpW8ah3GbP
Account: os-litant
Branch: claude/issue-20290-draft-read-author-exemption
Worktree: objectstack-issue-20290
Domain: domain:cli
Seat: domain:cli#1
File surface:

• packages/rest/src/rest-server.ts: the plain read's ?state=draft branch, and any policy constant it needs;
• packages/rest/src/meta-item-read-gate.ts: only if the policy type needs a member for the draft read. Amended in place after the dev report: its docblock sentences that name the plain read as a door that never honours the author exemption, which this change makes false, may be edited too (docblock only, no code);
• their tests in packages/rest/src/, including the census meta-alternate-door-read-gates.test.ts;
• packages/runtime/src/domains/meta.ts and its parity test, only if the dispatcher's item read serves ?state=draft and must follow the same rule;
• content/docs/ui/apps.mdx, whose sentence at about :360 says the plain read serves the filtered body to every caller, 「the app's authors included」;
• the PENDING .changeset/20156-alternate-door-read-gates.md (line 16) and .changeset/20156-app-author-exemption.md (line 9). Each says the plain read prunes for every caller, 「authors included」, which becomes false for ?state=draft. They are corrected in place as the DELIBERATE CORRECTION class, confirmed by the same-head review;
• one new .changeset/20290-*.md.

packages/metadata-core/** and packages/spec/** are read-only. No objectui edit (triage note 3). Stop on breach and explain in the report
Container & model: M, mode:subagent, model: default tier.
Clause-②: no
Thread-read: 5859753025
Serial constraints cleared: #20237 (PR #20319) released rest-server.ts at cc40033e (landing record 5860025778). The file lists of all 14 open PRs were read in this act. PR #20307 and PR #20306 touch other packages/rest test files (data-query-*, data-date-*), which are disjoint. #20139 (p2, rest-server.ts) waits behind this card. R3's other in-flight slot is #20215 (packages/cli), which is disjoint

Taken 2026-09-27T21:35Z, origin/main cc40033e. Executes triage's grade 5859504238, which rules the carrier is the server. The plain read's ?state=draft branch takes the author exemption PR #20284 gave the stored-version doors: whole for whoever may save the app, pruned for everyone else. The grounds are ruling 5856774816's own rationale: 「Read-to-display is pruned per user; read-to-edit is whole for the editor」.

The order carries a falsifiable premise. The exemption discloses nothing to an author that the same author cannot already read whole on /layers, and it changes nothing for a non-author. If the measurement contradicts either half, the dev stops at needs_decision.

Clause-②: no and patch, as ruling item 4 set for the same exemption.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20290,
  "status": "done",
  "branch": "claude/issue-20290-draft-read-author-exemption",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20337",
  "session": "session_01UYBdGBzWSrAMzpW8ah3GbP — this run's harness-stamped id (each commit's Claude-Session trailer; the relay envelope of every write)",
  "premise_still_valid": true,
  "summary": "The plain read GET /meta/:type/:name now picks its gate policy by what it serves: its ?state=draft branch (the pending draft row, a stored version) runs RestServer.STORED_VERSION_DOOR_POLICY ({ arms: per-caller, app: author-exempt }); every other read on the route, ?preview=draft included, keeps { arms: all, app: gate }. No second predicate: metaItemReadGate already attaches mayWriteItem from RestServer.metaSaveVerdict whenever the policy is author-exempt. An app author reads the draft whole, everyone else pruned per caller, whole refusals stay refused, NO_DRAFT 404 is unchanged. Zone 2 readings (real stack, pre-fix probe at de091b50e, since removed): (1) red re-measured, the author read ?state=draft as [nav_leads] while /layers served [nav_leads, nav_finance_ledger, nav_org_directory]. (2) objectui at f8a9d0fb: getDraft sends ?state=draft (plus &package= when scoped), and both editors merge it over /layers effective; with no draft the answer is 404 NO_DRAFT, not the active version. (3) PREMISE HOLDS on the stop condition: /layers never serves draft content (overlay is state active only), but /diff does — a draft save appends a full-body sys_metadata_history row, and /diff?from=0&to=2 already served the author the co-author's draft whole under ruling B; so the exemption discloses nothing a ruled stored-version door does not already serve (pinned: 'it widens nothing'). Non-author permission axis unchanged. (4) the per-deployment arms dropped nav_org_directory from the draft for EVERY caller (finance author included), and dashboard widgets likewise: same data-loss class, so the stored-version policy (per-caller arms) was chosen, pinned by ablation C. (5) the dispatcher (runtime domains/meta.ts) never reads state, so it does not serve this door: left alone, reported for #20320. (6) both pending notes corrected in place, new note added, apps.mdx corrected. files_changed (8, vs merge base 10ea9eb2e): packages/rest/src/rest-server.ts; packages/rest/src/meta-item-read-gate.ts (docblock only); packages/rest/src/meta-alternate-door-read-gates.test.ts; packages/rest/src/meta-draft-read-author-exemption.test.ts (new, real stack); content/docs/ui/apps.mdx; .changeset/20156-alternate-door-read-gates.md; .changeset/20156-app-author-exemption.md; .changeset/20290-draft-read-author-exemption.md (new, @objectstack/rest patch). deviations: (a) meta-item-read-gate.ts — the claim admits it only if the policy type needs a member; no member changed, three docblock sentences this change made false were edited, no code (declared on the PR for confirmation). (b) The board check at the final head against --base origin/main read a tip that moved after my merge (a78f731ad, 4 commits, none touching this diff): exit 2 counting 99 citations #20326 removed on main as added here, all in 21 files outside this diff; rerun pinned to the merged base 10ea9eb2e: exit 0. Not re-merged, since main's new commits are disjoint. (c) Zero label writes on the PR: the order names none and skip-changeset does not apply (this PR publishes); size/m, documentation, tests, tooling are the path labelers'. (d) Commit trailers are the model-free pair the order names, not the harness reminder's model-named one. line_budget: n/a — no skills/** diff. Cleanup: the probe test file and the ablation mutations left nothing in the tree (git status clean at 8055937f5, branch pushed). node_modules is removed before this report posts, and git worktree remove runs right after it.",
  "tests": "Tests at bd1361ee6 (git diff bd1361ee6 8055937f5 -- packages/ is empty; the one later commit is an apps.mdx table row): census + new real-stack file 303/303; @objectstack/rest vitest --project local: 203 files, 3704 passed, 1 skipped, 0 failed; test:repo 8/8; rest typecheck (tsc --noEmit + check:test-typecheck on tsconfig.test.json): exit 0, and tsc -p tsconfig.test.json --listFiles includes both test files (204 test files). Runtime untouched and no rest export changed: no runtime test owed. Ablations (fix committed first, head bd1361ee6; scripts/ablation-replace.mjs wrap mode inside a script with its own EXIT/INT/TERM trap restoring rest-server.ts from HEAD by absolute path; each restore proven by blob == HEAD d5ccd775bb3b and empty git diff HEAD; subject imported by relative path, so no dist involved; predictions written before each run): A exemption off on the draft read (anchor 1→0, blob d5ccd775bb3b→4b8f055b9a0e): predicted 4, got 4 red (census ?state=draft app/crm × author; real stack author-whole, draft-save round trip, widens-nothing). B mayWriteItem true for everyone (1→0, →f45c0e2167e9): predicted 7, got 7 red (app/crm × non-reader on all four stored doors incl. ?state=draft, fault-path /layers edge, org-presentation edge, real-stack member control). C arms all on the draft read (1→0, →ad2e5f485f20): predicted 4, got 4 red (?state=draft dashboard/ops × reader, non-reader, author; real-stack member control). Gates at head 8055937f5 (dispatch-gates derived 91 families from merge base 10ea9eb2e; --ran: 91 derived, 91 run, 0 NOT-MEASURED, 0 UNRUN, all carrying exit codes): node scripts/check-adr-0087-registration.mjs --base origin/main → 0; node scripts/check-adr-0087-registration.mjs --self-test → 0; node scripts/check-changeset-no-major.mjs --base origin/main → 0; node scripts/check-changeset-no-major.mjs --self-test → 0; node scripts/check-ci-filter-parity.mjs → 0; node scripts/check-closing-keyword-parity.mjs → 0; node scripts/check-closing-keyword-parity.mjs --self-test → 0; node scripts/check-comment-mask-adoption.mjs → 0; node scripts/check-comment-mask-adoption.mjs --self-test → 0; node scripts/check-comment-mask-corpus.mjs → 0; node scripts/check-doc-frontmatter.mjs → 0; node scripts/check-doc-frontmatter.mjs --self-test → 0; node scripts/check-doc-route-spelling.mjs --advisory → 0; node scripts/check-doc-route-spelling.mjs --self-test → 0; node scripts/check-docs-section-name.mjs → 0; node scripts/check-docs-section-name.mjs --self-test → 0; node scripts/check-empty-changeset.mjs --base origin/main → 1; node scripts/check-empty-changeset.mjs --self-test → 0; node scripts/check-issue-citations.mjs → 0; node scripts/check-keyed-text-bounds.mjs → 0; node scripts/check-keyed-text-bounds.mjs --self-test → 0; node scripts/check-platform-object-tenancy-census.mjs → 0; node scripts/check-platform-object-tenancy-census.mjs --self-test → 0; node scripts/check-plugin-teardown-shape.mjs → 0; node scripts/check-plugin-teardown-shape.mjs --self-test → 0; node scripts/check-registry-log-declared.mjs → 0; node scripts/check-registry-log-declared.mjs --self-test → 0; node scripts/check-rest-log-spy-declared.mjs → 0; node scripts/check-rest-log-spy-declared.mjs --self-test → 0; node scripts/check-section-landing-index.mjs → 0; node scripts/check-section-landing-index.mjs --self-test → 0; node scripts/check-system-context-census.mjs → 0; node scripts/check-system-context-census.mjs --self-test → 0; node scripts/check-undeclared-dep-imports.mjs → 0; node scripts/check-undeclared-dep-imports.mjs --self-test → 0; node scripts/docs-audit/check-affected-docs.mjs → 0; node scripts/docs-audit/check-drift-comment.mjs → 0; node scripts/pm/release-rehearsal-clone.mjs --self-test → 0; pnpm --filter @objectstack/lint run check:doc-formula-expressions → 0; pnpm --filter @objectstack/lint run check:doc-security-posture → 0; pnpm --filter @objectstack/spec run check:docs → 0; pnpm --filter @objectstack/spec run check:duration-unit-keys → 0; pnpm --filter @objectstack/spec run check:empty-state → 0; pnpm --filter @objectstack/spec run check:liveness → 0; pnpm --filter @objectstack/spec run check:skill-examples → 0; pnpm --filter @objectstack/spec run check:strictness-ledger → 0; pnpm --filter @objectstack/spec run check:variant-docs → 0; pnpm --filter @objectstack/spec run check:yaml-examples → 0; pnpm check:authz-resolver → 0; pnpm check:changeset-gate-self-tests → 0; pnpm check:corpus-claim-drift → 0; pnpm check:cross-package-test-inputs → 0; pnpm check:dispatcher-error-vocabulary → 0; pnpm check:doc-anchors → 0; pnpm check:doc-authoring → 0; pnpm check:docs-audit-scope → 0; pnpm check:docs-redirects → 0; pnpm check:docs-single-h1 → 0; pnpm check:docs-spec-enumerations → 0; pnpm check:docs-transcript-drift → 0; pnpm check:driver-memory-census → 0; pnpm check:dts-closure → 0; pnpm check:dual-build-cjs-loads → 0; pnpm check:engine-double-contract → 0; pnpm check:gitlink-declared → 0; pnpm check:issue-citations → 0; pnpm check:lean-entry-closure → 0; pnpm check:logger-receiver-detach → 0; pnpm check:nul-bytes → 0; pnpm check:objectql-double-limit → 0; pnpm check:objectui-changeset → 0; pnpm check:org-identifier → 0; pnpm check:page-declaration-shape → 0; pnpm check:pm-changeset-deadline-census → 0; pnpm check:published-files → 0; pnpm check:published-readme-links → 0; pnpm check:query-options-erasure → 0; pnpm check:react-page-adapter-contract → 0; pnpm check:refd-timer-probe → 0; pnpm check:role-word → 0; pnpm check:route-envelope → 0; pnpm check:skill-identifier-liveness → 0; pnpm check:slot-lookup → 0; pnpm check:sourcemap-no-sources-content → 0; pnpm check:test-source-alias → 0; pnpm check:tier-file-adoption → 0; pnpm check:type-check-coverage → 0; pnpm check:type-check-debt → 0; pnpm check:vendor-version-stamps → 0; pnpm check:watch-hint-literal → 0; pnpm check:where-matcher → 0; pnpm lint → 0; node scripts/check-issue-citations.mjs --base origin/main → 2; node scripts/check-issue-citations.mjs --base 10ea9eb2e → 0. check-empty-changeset verdict (red by design, DELIBERATE CORRECTION): 'This PR changes a changeset it did not add: .changeset/20156-alternate-door-read-gates.md present on the merge base and CHANGED by this PR -- this is somebody else's release note; .changeset/20156-app-author-exemption.md present on the merge base and CHANGED by this PR'; the gate text says do NOT restore it, say so on the PR and get it confirmed, and it stays red either way. Both corrections are quoted before/after on the PR. skill-examples, type-check-debt and dual-build-cjs-loads first refused (exit 3, merge-moved spec src and unbuilt client SDK); all exit 0 after the named builds (259 examples; 4 entries re-measured, none above record; 104 entry points across 66 packages). pnpm lint = eslint . --no-inline-config, whole repo, exit 0 (a full run, not narrowed).",
  "mcp_calls": "0 — no MCP GitHub tool was called; card, PR and comment reads were REST GETs with the session token.",
  "api_writes": "3 — all through scripts/pm and the fleet-write relay as objectstack-fleet[bot] (each a POST /repos/objectstack-ai/objectstack/dispatches executed by the relay run): (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft, PR #20337); (2) label-write --assign os-litant → POST /repos/objectstack-ai/objectstack/issues/20337/assignees; (3) this os-dev-report → POST /repos/objectstack-ai/objectstack/issues/20290/comments. Not REST: 5 git pushes of the branch (the empty probe push, three commit pushes, the merge push).",
  "open_questions": [
    {
      "question": "The claim admits meta-item-read-gate.ts only if the policy type needs a member; this PR edits three docblock sentences there, which this change made false, and no code. Amend the claim's file surface, or take the docblock edits out?",
      "options": [
        "A amend the claim in place to name the docblock sentences, as the previous round did for the docs pages its change made false",
        "B revert the docblock edits and leave three sentences that name the plain read as a door that does not honour the exemption"
      ],
      "recommendation": "A, because the docblock is the authority a later author reads for which door runs which policy, and B would leave it contradicting the code."
    }
  ],
  "out_of_scope_findings": [
    "class: b · reach: exception: security, plus a public door measured on the real REST stack at de091b50e — a member with no Studio or Setup capability GET /meta/app/NAME?state=draft and ?preview=draft both answered 200 with the pending draft (pruned per caller) · evidence: ADR-0037 (Accepted) Risks row 「confirm/add a builder/admin role gate on the dispatcher reads」 and the protocol getMetaItem comment 「admin-gated upstream」; no builder gate exists on either draft read; this PR leaves who may read a draft unchanged · Seam: spec:ADR-0037 Risks preview=draft exposure → runtime:RestServer GET /meta/:type/:name ?state=draft and ?preview=draft, runtime/domains/meta.ts item read ?preview=draft · dedupe words: draft read builder gate · preview=draft exposure member · state=draft non-builder reads pending draft · ADR-0037 admin gate",
    "class: a (source reading at objectui f8a9d0fb, not reproduced) · reach: named producer — objectui app-shell useNavigationSync saveApp (NavigationSyncEffect, on page or dashboard create/delete) and console AppManagementPage handleToggleActive / handleSetDefault publish PUT /meta/app/NAME with the app from useMetadata().apps, the per-caller pruned list read · evidence: a saving author who is withheld an entry, or an entry whose service is off here, would publish the app without it; the list read is read-to-display by ruling B, so only the client can fix it (read the baseline from a stored-version door) · triage note 3 relay for the objectui seat · dedupe words: useNavigationSync saveApp pruned list · AppManagementPage toggle active drops navigation · list baseline saved back app",
    "carrier: #20320 (the dispatcher-divergence class-closure card) · the runtime dispatcher's item read passes only previewDrafts to getMetaItem and never reads state, so on a dispatcher-only host ?state=draft answers the active item under the rendered policy, never the draft and never NO_DRAFT · source reading at bd1361ee6, not measured through dispatch() · named for that card as a row, noted, not filed"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

For the objectui seat (triage note 3): two more app editors save a read-to-display baseline

_{domain:cli execution PM seat #6024 · session session_01UYBdGBzWSrAMzpW8ah3GbP · written 2026-09-27T23:16Z. Relayed from the os-dev round on this card (PR #20337), per triage's note 3 (5859504238): 「If objectui's two editors also merge a read-to-display baseline anywhere else, post it on this card for the objectui seat. ⛔ No objectui edit from here.」}

⚠️ These are the dev's readings of objectui source at the pinned .objectui-sha f8a9d0fb. They were not reproduced, and the seat did not re-read objectui.

• app-shell useNavigationSync saveApp (NavigationSyncEffect, which runs when a page or dashboard is created or deleted) publishes PUT /meta/app/NAME with the app from useMetadata().apps.
• console AppManagementPage, in handleToggleActive and handleSetDefault, does the same.
• What they read: useMetadata().apps is the per-caller pruned LIST read. Under ruling 5856774816 that read is read-to-display, so the server keeps pruning it.
• What happens: a saving author who is withheld an entry, whether by requiredPermissions, the documentation audience, or a service that is off on this deployment, publishes the app without that entry. The entry is deleted.
• Who fixes it: only the client can, by reading its save baseline from a stored-version door. This card's server fix (PR fix(rest): the draft read serves an app whole to whoever may save it, and pruned to everyone else #20337) covers ?state=draft only.

Dedupe words for the objectui seat: useNavigationSync saveApp pruned list · AppManagementPage toggle active drops navigation · list baseline saved back app

---

Generated by Claude Code

[objectstack-fleet]

需要维护者裁决:作者读「还没发布过的 app」的草稿时,要不要也给完整版

_{domain:cli execution PM seat #6024 · session session_01UYBdGBzWSrAMzpW8ah3GbP · 决策卡落卡,written 2026-09-27T23:30Z。⛔ 席位不裁:这是权限边界,属于人工地板。派发令(认领 5860036163 所附)写明「作者若因此新读到任何入口今天都不给他的内容,即停下交维护者」,复核在一个边缘情况上证实了这一点。}

状态转换(本评论同笔): pm:dispatched → needs-user-decision,assignee 清空。PR #20337 已完成,契约复核 PASS(5860832731),保持 draft、不入队,等本卡裁决。

一句话问题

裁决 B 让「能保存这个 app 的人」在 /layers、?layers=true、/diff 三个入口读到完整的存储版本。#20290 把同一规则延伸到普通读取的 ?state=draft(读草稿)。对已经发布过的 app,这不多给作者任何东西。但对只有草稿、从没发布过的 app,这是作者第一次能完整读到草稿。要不要这样?

背景与实测

• 问题本身(已实测): Studio 设计器和通用编辑器都用 ?state=draft 读草稿当编辑底稿,再覆盖在 /layers 的完整版本上。这个读取按调用者裁剪,所以一个有 manage_metadata、但没有 finance.access 的作者读到的是 [nav_leads],而 /layers 给的是完整的导航。他一保存草稿,看不到的导航项就被删了。PR fix(rest): the draft read serves an app whole to whoever may save it, and pruned to everyone else #20337 的真实栈测试证明:修复后保存一次,四个导航项都保留。
• 已发布的 app: 作者本来就能从 /diff?from=0&to=N 完整读到这份草稿。每次存草稿都会写一行历史,/diff 按版本读取历史,不看状态。所以对这类 app 没有新的披露,复核在源码上核实过。
• 只有草稿的 app(边缘情况): /diff 先读当前版本,读不到就答「不存在」;/layers 只读已发布层;/history 的事件只有序号、作者、时间,不带正文(本席核过 MetadataEventSchema)。所以修复前没有任何入口把这份草稿完整给作者,修复后 ?state=draft 是第一个。
• 非作者: 按部署关闭的服务项现在也会在 ?state=draft 上显示给所有人。这在派发令第 4 项里已授权,因为 /layers 对所有人本来就这样显示,而且这不是权限门(ADR-0057 D10 PS-2)。这一项不需要裁。

Governing text:

• 裁决 5856774816(B)的执行参数 1:「whoever can save it must see it whole, or a save drops entries silently」;其理由:「Read-to-display is pruned per user; read-to-edit is whole for the editor.」该裁决的适用范围写的是三个存储版本入口。
• ADR-0106 D4:「The exemption is a caller property, not a route property」。同段假定「draft/preview reads are admin-gated upstream already」,复核证实单条读取上并没有这道门(另立卡跟进)。
• ADR-0045 §3:未发布的 app 对非构建者不可见。本裁决不动它。

Prior rulings read: draft,author,exempt,builder,admin-gated,state=draft → docs/adr 与 AGENTS.md 共 408 处 draft 命中,逐条筛过授予作者豁免的条款:只有 ADR-0106 D4(对象 schema 遮罩)和裁决 5856774816(app 的三个入口)。没有一条裁到「普通读取的草稿分支」或「只有草稿的 app」。thread: #20156, #20290。

带复核命令的前提:

• 修复只改 ?state=draft:git grep -n "stateParam === 'draft'" origin/claude/issue-20290-draft-read-author-exemption -- packages/rest/src/rest-server.ts(预期 1 处,即 readPolicy)。
• /diff 对只有草稿的 app 答「不存在」:git grep -n "diffCurrent == null" origin/main -- packages/rest/src/rest-server.ts(预期 1 处)。
• 历史事件不带正文:git show origin/main:packages/metadata-core/src/types.ts | grep -n "MetadataEventSchema = z.object",读其字段,预期没有 body 或 metadata 字段。

选项 × 真实代价

选项	做什么	客户能感知到的后果
A 按交付落地	PR #20337 原样入队:能保存 app 的人读任何 app 的草稿都是完整的,包括只有草稿的 app	作者存草稿不再丢导航项,新建未发布的 app 也一样;作者能看到同事在草稿里加的、自己没权限打开的导航项(名称和目标)
B 只在已发布的 app 上豁免	补丁:?state=draft 先查有没有已发布行,有才豁免	已发布的 app 修好了;新建未发布的 app 仍会在作者存草稿时静默丢导航项;多一次读取和一条特例
C 服务端不豁免,改客户端	撤回 PR #20337;objectui 改从存储版本入口读草稿底稿	只有草稿的 app 没有这样的入口,服务端还得新开一个;在此之前 bug 照旧

业务含义直译

• A: 编辑权就是看全权。能改这张单子的人,改的时候看得到整张单子,不管它有没有正式发布过。
• B: 已经上线的单子给看全,还没上线的草稿单子只给看一部分。结果恰恰是最常被编辑的新单子仍然会丢内容。
• C: 让每个编辑器都去一个特别的窗口取底稿,但草稿单子目前没有这个窗口。

四轴分析(业务立场)

• ① 项目长远合理性(推荐只按此轴得出): 两年后,平台的规则应该只有一条:读来展示的按人裁剪,读来编辑的给能保存的人看全(裁决 B 原话)。这也是 ADR-0106 D4「豁免属于调用者,不属于路由」的形状。A 就是这一条;B 按「是否发布过」再分一次叉,是要长期维护的人为特例;C 要为草稿专门新开入口。主流做法一致:Salesforce 的 Lightning App Builder 与 ServiceNow 的应用设计器,编辑者读到的都是完整定义,不区分是否已发布。只看①选 A。
• ② 实际业务拉动: 实测拉动存在。两个编辑器都用这个读取当保存底稿;只有草稿的 app 就是 Studio 里新建、还没发布的 app,正是作者最常编辑的那种。
• ③ 防 AI 犯错: A 让每次保存都基于完整文档,从结构上杜绝静默删条目;B 在未发布的 app 上保留静默删除;C 要求每个客户端都读对入口,AI 写的新编辑器很容易读错。
• ④ 创业阶段不扩散: A 复用 fix(rest): the stored-version doors serve an app whole to whoever may save it, and pruned to everyone else #20284 的同一判定和同一常量,不新增接口;B 多一次读取和一条特例;C 要新开入口。

os-decision-facets

• ① 长远合理性:A 一条规则(读来编辑的给能保存的人看全),与裁决 B 的理由和 ADR-0106 D4 同形;B 按发布状态分叉,C 新开入口。
• ② 业务拉动:实测两个编辑器用 ?state=draft 当保存底稿;只有草稿的 app 是新建 app 的常态。
• ③ 防 AI 犯错:A 结构上杜绝静默删条目;B 在未发布 app 上保留;C 依赖每个客户端读对入口。
• ④ 创业阶段不扩散:A 零新接口;B 多一次读取和特例;C 新入口。
  Prior rulings read: draft,author,exempt,builder,admin-gated,state=draft → 408 draft hits in docs/adr + AGENTS.md; ADR-0106 D4, ruling 5856774816; thread: [finding] class closure: the alternate read doors of /meta/:type/:name (/layers, ?layers=true, /published) serve a set-gated doc's BODY to a non-holder; they skip every per-caller read gate the plain read applies #20156, [finding] an app author's draft baseline is read through the pruned plain read (GET /meta/app/:name?state=draft), and the designers merge it over the whole stored app, so a draft save drops the navigation entries withheld from that author #20290; repo: objectstack-ai/objectstack

推荐:A(PR #20337 原样入队)。回退:B。不推荐 C。自检:只看①选 A;②③④ 是否翻转:否。

置信缺口:

• 只有草稿的 app 属于「未发布」,ADR-0045 §3 对没有 Studio 或 Setup 权限的人答「不存在」。所以只有同时具备构建权限的作者才会走到这个边缘。manage_metadata 是否总是伴随构建权限,未实测。
• 草稿对非构建成员也可读(ADR-0037 风险条「confirm/add a builder/admin role gate」)是另一件事,本席另立卡。它不影响本裁决。

裁后执行

• 裁 A: 本席在同一 head 8055937f 上写 ACCEPT(复核 5860832731 已确认两处待发布说明的就地更正),经中继翻 ready、挂 auto-merge,本卡随 PR 以 Fixes 关闭。
• 裁 B: 本席发补丁轮:?state=draft 仅在存在已发布行时豁免,钉住只有草稿的 app 仍裁剪;另立卡跟踪未发布 app 的丢数据问题。
• 裁 C: 关闭 PR fix(rest): the draft read serves an app whole to whoever may save it, and pruned to everyone else #20337;本卡改路由为 objectui 车道加服务端新入口,重新走分诊。

---

Generated by Claude Code