* feat(apps): the app API admits a person's delegated token (fresh person, membership and credential checks, the lesser of consented and offered access), attributes their writes to them, and opens delegated sign-in (TASK-3399, U5b-2)
* test(apps): the app API for a person: identity, the lesser access, per-request person checks, the person's visibility, and the fresh-context re-check; the delegated author is the person (TASK-3399, U5b-2)
* test(apps): a delegated upload re-admits the person before its row, and records them as the uploader (TASK-3399, U5b-2)
* fix(apps): U5b-2 codex r1: every app write re-admits its actor after reading its body and before its write (one helper the upload shares); a move during the body refuses the write (TASK-3399, U5b-2)
* fix(apps): U5b-2 codex r2: the app item list windows over rows the actor may see, filtered in SQL like the human list, so has_more and next_offset count nothing hidden (TASK-3399, U5b-2)
* fix(apps): U5b-2 codex r3: re-admission's final step re-checks the workspace and the actor's role, not only the credential (TASK-3399, U5b-2)
* test(apps): a delegated app write's event names the install (U10d) and credits the person, never the bot (TASK-3399, U5b-2 x U10d)
* feat(apps): app attachment routes: item-scoped upload, metadata and a streamed download re-admitted before its first byte (TASK-3401, SPEC-6 U6c)
* test(server): an app attachment read refuses a subject whose membership no longer reaches the item (TASK-3401, U6c)
* test(server): U6c tests reach the item re-check, the upload's edit right and the download's type decision (TASK-3401, U6c)
* test(server): a deletion before the first byte reaches the attachment re-check (TASK-3401, U6c)
* fix(apps): U6c codex r1: authorize before storage, a transport write deadline, the credential last in re-admission, and a live companion check in the fence (TASK-3401, U6c)
* fix(apps): U6c codex r2: a truncated upload is 400, a re-admission fault is 500 not 401, HEAD on the download, and unknown variants refused (TASK-3401, U6c)
* fix(apps): U6c codex r3: the upload re-admits the subject before its row (StageUpload/Insert, no store callback), and variant is null on originals (TASK-3401, U6c)
* fix(apps): U6c codex r4: a token-state or settings read failure during admission is a fault (500), not a denial (TASK-3401, U6c)
* fix(apps): U6c codex r5: a credential that dies mid-upload answers 401 invalid_token, a permission change 403 (TASK-3401, U6c)
* fix(apps): U6c codex r6: the served variant is re-checked at the gate, and a settings read fault at the first gate is a 500 (TASK-3401, U6c)
* test(server): a viewer's upload is refused before its body is read (TASK-3401, U6c)
* test(server): account for the app upload's raw body reader in the body-reader census (TASK-3401, U6c)
* feat(store): a bot's visibility is its install's ceiling, at every caller (TASK-3401)
* feat(server): the app API door, route table, ceiling, and read routes (TASK-3401, U6a)
* test(server): U6a door, ceiling, DTO census and visibility-caller census (TASK-3401)
* test(server): controls for the cross-workspace refusals; role follows access; cross-item parent projects null (TASK-3401)
* fix(server): app responses are re-validated against revocation before they are sent; one users read in the bot ceiling (TASK-3401, codex r1)
* fix(server): re-admit an app request and replay its authorizations before the response is sent (TASK-3401, codex r2)
* fix(server): re-admission rechecks apps availability and fails closed without a re-check holder; collection re-checks memoized (TASK-3401, codex r3)
* test(server): re-validation fails closed without a re-check holder (TASK-3401)
* docs(server): the re-check memo is sequential, not a snapshot (TASK-3401, codex r4)
* chore(server): drop the unused write-rule helper until U6b's first caller (TASK-3401)
* style(server): gofmt after dropping the helper (TASK-3401)
* fix(server): app item lists page by window (has_more, next_offset), not by page length (TASK-3401, Rook review)
xarmian