cloud: the AI materialization path stamps `_unpublished: true` instead of `hidden: true` (#4829 A1 cloud half)

[os-zhuang]

Blocked-by: #4829

Part of #4829 (maintainer ruling A1, 2026-08-04 + v17 window re-ruling 2026-08-07). Filed by the domain:spec seat at ACCEPT time from PR #6942's measured mandatory-answer contract; routing label left to the triage seat (lands in objectstack-ai/cloud).

The contract, verbatim from the framework half

The ADR-0045 publish gate no longer reads app.hidden — it reads the machine-managed _unpublished key declared on AppSchema in PR #6942.

What the cloud side must do (service-ai-studio, blueprint tools — the additive-materialization write point):

• Stamp _unpublished: true on the built app wherever it stamps hidden: true today.
• Stop writing hidden — after the framework half lands, writing it only affects App Switcher placement and gates nothing.
• Nothing else in apply_blueprint's envelope changes.

Who writes/clears/reads, in one line: written by the cloud AI materialization path (this card), cleared by POST /packages/:id/publish-drafts (framework, PR #6942), read by filterAppForUser (framework, PR #6942). No author, no UI, ever writes it.

Sequencing

The framework half is an ADR PR reserved for maintainer hand-merge (AGENTS.md PD #14). Until it lands, cloud keeps writing hidden and the current behavior is unchanged; after it lands, a materialized app that still carries only hidden: true becomes visible to normal users while still unpublished — so this card should follow the framework merge closely rather than drift.

Stored rows written the old way are handled by the framework's ADR-0087 D2 conversion app-hidden-to-unpublished (stored population only — retiredFromLoadPath: true), so this card is about the writer, not about existing data.

Refs: #4829 (ruling chain), PR #6942 (framework half incl. the naming rationale for the _ prefix), ADR-0045, ADR-0010 (the _-prefix machine-managed precedent).

[os-zhuang]

Maintainer-directed execution (2026-08-09 ~08:4xZ): target:v17 added. The maintainer instructed the spec seat to put both #4829 follow-up halves on the v17 release board and track them together — this is an executed ruling, not this seat self-producing the label (single-producer discipline otherwise unchanged; the repo:cloud routing label remains the triage seat's to apply).

Board rationale, for the record: the framework half (PR #6942) is merged, so this card's Blocked-by: #4829 is now satisfied and the sequencing note in the body is live — once cloud bumps its .objectstack-sha past 97b0798, a materialized app whose writer still stamps only hidden: true becomes visible to normal users while unpublished (fail-open). Landing this card rides with (or immediately after) that pin bump; shipping v17's console/cloud line without it re-opens the gate #4829 closed.

Tracked by the domain:spec seat (#6017) in its round reports until claimed by the cloud seat.

---

Generated by Claude Code

[os-zhuang]

Maintainer-directed execution (2026-08-09): repo:cloud routing label applied directly — the maintainer instructed the spec seat not to wait for the triage sweep. Landing repo was already stated in the card body (objectstack-ai/cloud, service-ai-studio blueprint tools). This card is now fully routed and visible to the repo:cloud seat's backlog sweep: pm:queue + repo:cloud + target:v17, unassigned = ready to dispatch. Sequencing note in the body stands — land with or immediately after cloud's next .objectstack-sha bump past 97b0798.

---

Generated by Claude Code