objectui: the Unpublished banner and per-app publish read `_unpublished`; the App Switcher keeps filtering on `hidden` (#4829 A1 objectui half)

[os-zhuang]

Blocked-by: #4829

Part of #4829 (maintainer ruling A1). Filed by the domain:spec seat at ACCEPT time from PR #6942's measured mandatory-answer contract; routing label left to the triage seat (lands in objectstack-ai/objectui).

The contract, verbatim from the framework half

After PR #6942, app.hidden means navigation presentation only ("Hidden apps stay fully routable and permission-checked") and the ADR-0045 publish gate lives on the machine-managed _unpublished key.

Surface	Before	After
Unpublished banner	app.hidden === true	app._unpublished === true
Publish button	POST /packages/:id/publish-drafts	unchanged — the flip now clears _unpublished server-side
Direct per-app publish	PUT /meta/app/{name} body {"hidden": false}	PUT /meta/app/{name} body {"_unpublished": false}
App Switcher / launcher	filters on hidden	keeps filtering on hidden — which now means only what it says. ⛔ Must NOT filter on _unpublished: the server already withholds those apps

Wire fields unhiddenApps / unhideError in the publish-drafts response are deliberately unchanged by PR #6942 — renaming a contract the framework repo cannot verify would be the same class of silent break that card exists to fix. Rename them in lockstep with this card, or not at all; state which in the PR.

Sequencing

The framework half is an ADR PR reserved for maintainer hand-merge (AGENTS.md PD #14). Land this after it merges and after objectui's @objectstack/spec pin advances past that release — before the pin bump, _unpublished does not exist in objectui's types.

Note for whoever prices this: the account-app 404 that #4829 fixes is server-side and needs no objectui change; this card is only about the publish-state UI reading the right key.

Refs: #4829 (ruling chain), PR #6942 (framework half), #6954 (cloud half), ADR-0045.

[os-zhuang]

Maintainer-directed execution (2026-08-09 ~08:4xZ): target:v17 added. The maintainer instructed the spec seat to put both #4829 follow-up halves on the v17 release board and track them together — an executed ruling, not this seat self-producing the label (the repo:objectui routing label remains the triage seat's to apply).

Board rationale, for the record: the framework half (PR #6942) is merged, so Blocked-by: #4829 is satisfied. Until this card lands, the objectui banner still keys on app.hidden — after the next console bump against a framework ≥ 97b0798 that read goes stale in both directions: the Unpublished banner would show on nav-hidden published apps (e.g. Account, wrongly) and fail to show on _unpublished builds (the server withholds those from non-builders, so the main exposure is the builder's own preview losing its watermark). Rides the same v17 console line as #6954; the two halves land in lockstep with the pin/console bumps.

Tracked by the domain:spec seat (#6017) in its round reports until claimed by the objectui seat.

---

Generated by Claude Code

[os-zhuang]

Maintainer-directed execution (2026-08-09): repo:objectui routing label applied directly — the maintainer instructed the spec seat not to wait for the triage sweep. Landing repo was already stated in the card body (objectui: Unpublished banner, Publish button, App Switcher filter discipline). This card is now fully routed and visible to the repo:objectui seat's backlog sweep: pm:queue + repo:objectui + target:v17, unassigned = ready to dispatch. Lockstep note stands — lands on the same v17 console line as #6954.

---

Generated by Claude Code