fix(studio): hoist the draft-envelope reader and strip read decorations at every consumer - #8211

Part of objectui#8181. Draft on purpose — the PM lands it.

Deliverable 1 first: the measurement the card deliberately did not claim

The card established only "no strip is present at these sites". It did not establish whether a
decorated body reaches a gate or a write. Measured before any code was written, and the population was
re-derived rather than taken from the card — it turned out to be ten readers, not four.

No gate is reached

validateMetadataDraft( and hasClientValidator( each have exactly one production call site in the
whole repo, both in ResourceEditPage, which PR #8182 already fixed. On the PM's stated criterion —
re-grade to p2 the moment a decorated body is shown reaching a gate — the answer is no.

A write IS reached, at five sites, on the success path

…and the write does not fail today only because the server launders it. saveMetaItem calls
stripReadDecorations(request.item) at the top of the method, with a comment saying it is placed first
so "the destructive-change diff, the schema gate, the authoring gate and the persisted body all see the
same document" (objectstack#4326). PUT /meta/TYPE/NAME hands the body straight to it. So: no 400.

That is a mitigation on the far side of the wire, not a licence. Measured against the bundled spec
17.2.0, for every type these sites write:

type          bare body    + read decorations                          after stripReadDecorations
object        ACCEPT       REJECT  unrecognized_keys ["_diagnostics","_draft"]   ACCEPT
app           ACCEPT       REJECT  unrecognized_keys ["_diagnostics","_draft"]   ACCEPT
flow          ACCEPT       REJECT  unrecognized_keys ["_diagnostics","_draft"]   ACCEPT
hook          ACCEPT       REJECT  unrecognized_keys ["_diagnostics","_draft"]   ACCEPT
permission    ACCEPT       REJECT  unrecognized_keys ["_diagnostics","_draft"]   ACCEPT
page          ACCEPT       REJECT  unrecognized_keys ["_diagnostics","_draft"]   ACCEPT

(view is absent because I could not build a fixture its union accepts, not because it behaves
differently — its bare body already REJECTs, so the leg does not isolate. Stated rather than papered over.)

One site IS a live, user-visible defect — and it is site 7, which nobody had listed

DraftChangesPanel fetches each entry twice, published then state=draft, and computeChangeDetail
reports every top-level key whose value differs. The framework decorates those two reads
asymmetrically: inside getMetaItem, the draft branch stamps _draft: true on the row before
decorateMetadataItem runs, and the published branch stamps nothing. So the pending-changes sheet
listed _draft under "Also changed:" on every entry that has a published counterpart, with
_diagnostics alongside whenever the two read-time verdicts differed.

A framework-internal key rendered to the author as one of their own edits, on the screen where they
decide whether to publish. No failure arm, no schema gate, no rare path — wrong on the happy path,
every time.

⚠️ I checked _packageId as a candidate second asymmetry and disproved it: getMetaItem stamps it
on both branches, and it is deliberately not a read decoration (the closed schemas declare it), so it
must not be stripped and it does not pollute the diff.

Two sites measured NOT to matter

validateSecurityPosture and validateCapabilityReferences return byte-identical findings with and
without decorations. Control that fires: an object with no sharingModel produces
error security-owd-unset in both directions, so the rules really ran. Stripped anyway — see below.

The fix: one reader, not ten strips

Zone 3's framing is right, and the measurement supports it: this is not "N consumers forgot". One
helper was copy-pasted and only one copy learned the rule. Adding a tenth strip leaves the eleventh copy
free to omit it.

extractDraftBody now lives in @object-ui/data-objectstack — beside the getDraft whose envelope it
decodes, because the unwrap is part of that method's contract, not a detail of any one view. The four
byte-identical strict copies (rows 1-4) were deleted and now import it; getDraft's own docblock points
at it and says not to hand .item to a gate or a write yourself.

Rows 5-10 keep their own presence semantics and gain the spec strip. Their tolerance is load-bearing,
not defensive, and the split is principled rather than arbitrary: unwrapDraftBody and
unwrapViewDraft are fed by MetadataClient.get(), which already unwrapped the envelope
(objectui#4271), so the bare-body limb is their normal path. They split on which client method feeds
them, not on what they mean — and all of them strip now.

Rows 8-9 were fixed despite measuring clean, deliberately: the alternative is leaving two more verbatim
copies of the unwrap that omit the rule, which is exactly the shape this card exists to end. The comment
there says so, including that it is defence in depth and not a fix.

The reusable asset is the spec's exported stripReadDecorations, exactly as #8182 used it. No second
hand-maintained key list. No schema loosened. No gate taught to tolerate _diagnostics. The presence
verdict still runs before the strip, so removing our own annotations can never turn a served draft
into "nothing pending", and the ADR-0010 protection envelope (_lock, _provenance, _packageId,
_packageVersion) is untouched because the closed schemas declare it.

Clause-2: does this fire on the accept/reject leg?

Yes, and on the same leg as #8182 — but at a different door. #8182's leg was a client gate that
began accepting bodies it previously rejected. Here:

• The publish-review diff flips its verdict, which is this PR's accept/reject leg. Before: _draft
  reported as a changed key on every entry. After: reported only when the author actually changed
  something. The pin still reports nothing at all when only the decorations differ moves the sheet
  from Also changed: _diagnostics, _draft to No differences detected.
• The write side does not flip a verdict today, and I am saying so plainly rather than claiming a
  400 that does not happen: the server's ingress strip absorbs it. The leg that fires there is the
  spec's accept/reject verdict on the body this client emits, measured in the table above.

Tests

New / extended, all reddened by ablation:

• packages/data-objectstack/src/draft-envelope.test.ts — the hoisted reader: strips both decorations,
  keeps the ADR-0010 envelope, does not mutate the response, and a draft carrying only decorations
  still reads as pending ({}, truthy) rather than null.
• packages/app-shell/src/preview/__tests__/DraftChangesPanel.readDecorationStrip.test.tsx — the live
  defect. Drives the real panel through real fetch routes. Control: a genuine label change must still
  be reported, so the absences mean something.
• packages/app-shell/src/views/studio-design/PackageOwdOverviewPanel.readDecorationStrip.test.tsx —
  proves the hoist reaches a write, through the real component's real save.
• packages/data-objectstack/src/updateView.draft.test.ts — the adapter's read-edit-write round trip.
• packages/app-shell/src/views/runtime-metadata-persistence.test.ts — both limbs of the tolerant sibling.

Ablation

Mutated all five strip sites (removing the strip, keeping the unwrap), proved the mutation reached disk
with anchored grep -c before/after — five markers, zero strips left — ran the pins, restored with
git checkout HEAD -- PATH, and proved the restore by state: git hash-object equals
git rev-parse HEAD:PATH for all four files, git diff HEAD empty, git status empty. The script
carries trap RESTORE EXIT INT TERM with absolute paths.

Test Files  5 failed (5)
     Tests  11 failed | 37 passed (48)

Every new assertion fails without the strip; the 37 pre-existing assertions in those files still pass,
which is what shows the mutation was surgical.

Verification runs

Both changed packages were run in full — 1108 test files, 10798 tests, zero failures.

Declared narrowings, so review can see exactly what was and was not run here:

1. turbo ls --affected names 34 packages; the 32 transitive ones are reached only through
   data-objectstack, whose exported surface delta is a pure addition (extractDraftBody) — no
   existing export changed shape, and unwrapDraftBody is not re-exported from app-shell's public
   index. Their suites are CI's.
2. The ablation run itself was taken out of the shared verify lock after two consecutive
   exit 99 queue timeouts (a sibling held it 582s). It is five small test files, mutating only my own
   worktree, so nothing cross-agent depended on serialising it.

⚠️ Shared-box courtesy note for whoever schedules the next batch: the full app-shell run held the verify
lock 17m44s and the wrapper filed holder-side starvation against it. Splitting app-shell's suite would
help the queue.

Also worth the reviewer's eye

objectui#7612 — switch the sharing_rule edit-door client gate on — is filed and open, and its
recorded blocker was the _diagnostics ingress. #8182 closed that at the gate's own call site and this
PR closes it at the remaining nine. No new card filed; the existing one is simply unblocked. ⛔ Not
addressed here.

This PR deliberately carries no auto-close directive: objectui#8181 stays open until the PM decides
the grade, because the measurement above may move it.

Attribution, in prose because the footer block does not survive a body PATCH intact: generated by
Claude Code, session session_01YBWFb5YgMU5dw8p2VKj16S.