@vibes.diy/prompts 6.2.4 → 6.2.5

package/llms/fireproof.md

@@ -506,17 +506,14 @@ export function announcements(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields (so a viewer's <ImgGen> append passes)
-    // — every other key must match oldDoc (an allowlist; unlisted fields stay author-owned).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     ctx.requireAccess(doc.channel);
     return { channels: [doc.channel] };
@@ -643,17 +640,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist; unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     // Any signed-in author may post to this open channel. Do NOT call
     // ctx.requireAccess(doc.channel) here: the channel is grant.public
@@ -798,7 +792,7 @@ Access functions live in `/access.js`, a separate file in the vibe's filesystem
 
 **`requireAccess` checks _membership_, not public read — don't gate an open channel's writes on it.** `ctx.requireAccess(channelId)` passes only for a channel the user is a member of: granted directly through `grant.users[handle]`, or through a `grant.roles` role they hold. **`grant.public` does NOT satisfy `requireAccess`** — public is read-only ("anyone through the door can _read_"), it never confers write membership. So a channel that is only `grant.public` and gated on `ctx.requireAccess` can be written by **nobody** but the owner-in-admin-mode — every other write returns `not in channel`, silently hiding the form (`useVibe().can` faithfully reflects this). Choose by intent:
 
-- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author on create — `if (!oldDoc && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` — keep ownership immutable on update (`else if (doc.authorHandle !== oldDoc.authorHandle) throw`), and let a non-author's `<ImgGen>` version append through via the field-allowlist in "Author-equality gates create and ownership change" below; `return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
+- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author on create — `if (oldDoc === null && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` — keep ownership immutable on update (`else if (doc.authorHandle !== oldDoc.authorHandle) throw`), and let a non-author's `<ImgGen>` version append through via `ctx.isImgGenVersionAppend(doc, oldDoc)` as shown in "Author-equality gates create and ownership change" below; `return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
 - **Restricted channel — only members may post**: gate the write on `ctx.requireAccess(doc.channelId)` **and** grant writers membership explicitly — `grant.users` (direct) or `grant.roles` + a `members`/role-grant doc. `public` alongside is read-only and is fine for letting non-members read, but it is never what lets a member write.
 
 ### AccessDescriptor return type
@@ -807,22 +801,19 @@ All fields are optional, but a stored document must be routed to at least one ch
 
 **Grant/member/meta docs need a channel too.** A role grant, membership, or config singleton that returns only `members`/`grant` with **no `channels`** is refused exactly like any other channel-less write — so the owner can't even create it. Route these to an owner-readable **admin channel** (e.g. `channels: ["admin:grants"]` with `grant: { users: { [user.userHandle]: ["admin:grants"] } }`), not a public channel. The `members`/`grant` still take effect globally; the channel just makes the doc persist and lets the owner read the roster back.
 
-**Author-equality gates create and ownership change, not every update.** Checking the new author field on create isn't enough — also pin ownership with `oldDoc`. But a blanket `if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw` denies `<ImgGen>` version appends on a shared/public-read doc: a version append runs as the VIEWING user, and denying it after the platform already billed it arms a billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to match `oldDoc` — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of a few named content fields silently unprotects the rest):
+**Author-equality gates create and ownership change, not every update.** Checking the new author field on create isn't enough — also pin ownership with `oldDoc`. But a blanket `if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw` denies `<ImgGen>` version appends on a shared/public-read doc: a version append runs as the VIEWING user, and denying it after the platform already billed it arms a billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changed = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changed && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-`<authorField>` is whatever your doc uses (`authorHandle`, `userHandle`, `senderHandle`, …); `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes. Write-once docs can simply `if (oldDoc) throw`; a genuinely private per-user doc no other viewer can reach may stay author-only on update.
+`<authorField>` is whatever your doc uses (`authorHandle`, `userHandle`, `senderHandle`, …). The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default; deletes stay author-only. Because `versions`/`currentVersion` are among the version fields it allows, a non-author can also advance the DISPLAYED version (the shared-generation feature); guard `currentVersion` specifically for author-only display control. Write-once docs can simply `if (oldDoc === null) {} else throw`; a genuinely private per-user doc no other viewer can reach may stay author-only on update.
 
 ```ts
 type AccessDescriptor = {
@@ -882,16 +873,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "message") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc.
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.userHandle !== oldDoc.userHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.userHandle !== oldDoc.userHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.userHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     ctx.requireAccess(doc.channelId);
     return { channels: [doc.channelId] };

package/llms/image-gen.md

@@ -148,22 +148,19 @@ Prefer attaching images to the host doc whose access you already grant; reach fo
 
 **ImgGen does not stamp your app's author field.** The doc ImgGen writes (a standalone `type: "image"` doc, or the version it appends to a host doc) carries no `authorHandle`/`userHandle`/`senderHandle` of yours — that field is `null`/`undefined`. So an access-fn branch that author-gates the type ImgGen writes (`if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }`) **rejects the write**: `null !== user.userHandle`, the signed-in maker included, and the image silently fails to persist as the doc you meant (`Failed to put document:`). Two fixes: (1) **attach the image to a host doc you created with the author field already stamped** — `<ImgGen _id={hostDoc._id} database={db} />` inherits the host's `type` and access, so the author check already passed when you wrote the host; this is the preferred shape. (2) For a genuinely **standalone** image doc, do NOT author-gate the `"image"` branch on strict author equality — route it to the channel you want and skip the author check (the platform's ImgGen write is server-authoritative, so there's no spoof to guard against). Never author-gate a type whose docs ImgGen originates without stamping the author yourself first.
 
-**A version append (regenerate, or an img2img edit on an existing `_id`) arrives as the VIEWING user, not the original author.** So even when you DID stamp the author on the host doc, an `if (oldDoc && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` on that type denies any _other_ signed-in viewer's generation on a shared/public-read doc — after the platform already billed it, arming an unbounded billed-retry loop (#3784/#3832). Author-equality belongs on **create and ownership change**, not on every update. Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to match `oldDoc` — an allowlist, so a field you didn't anticipate stays author-protected by default:
+**A version append (regenerate, or an img2img edit on an existing `_id`) arrives as the VIEWING user, not the original author.** So even when you DID stamp the author on the host doc, an `if (oldDoc && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` on that type denies any _other_ signed-in viewer's generation on a shared/public-read doc — after the platform already billed it, arming an unbounded billed-retry loop (#3784/#3832). Author-equality belongs on **create and ownership change**, not on every update. Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changed = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changed && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-`IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes, so a viewer's version append passes while any other field stays author-owned.
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default; deletes stay author-only. Because `versions`/`currentVersion` are among the version fields it allows, a non-author can also advance the DISPLAYED version (the shared-generation feature); guard `currentVersion` specifically if you need author-only display control.
 
 ## Choosing a Model
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "6.2.4",
+  "version": "6.2.5",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -24,9 +24,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "^6.2.4",
-    "@vibes.diy/identity": "^6.2.4",
-    "@vibes.diy/use-vibes-types": "^6.2.4",
+    "@vibes.diy/call-ai-v2": "^6.2.5",
+    "@vibes.diy/identity": "^6.2.5",
+    "@vibes.diy/use-vibes-types": "^6.2.5",
     "arktype": "~2.2.3",
     "json-schema-faker": "~0.6.2"
   },

package/system-prompt-initial-oneshot.md

@@ -75,17 +75,14 @@ export function wall(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist, so unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     return { channels: [doc.channelId] };
   }
@@ -121,11 +118,36 @@ export function board(doc, oldDoc, user, ctx) {
 }
 ```
 
-`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author change ONLY the ImgGen version fields and require every other field to match `oldDoc` (an allowlist, as `wall.post` above shows — never a denylist of a few named content fields).
+`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author through only when `ctx.isImgGenVersionAppend(doc, oldDoc)` accepts the write (as `wall.post` above shows) — it permits exactly one legitimate ImgGen version append and requires every other field unchanged.
 
 **Build the permission model around what a newcomer should be able to do.** When a stranger opens the app, they should immediately be able to do the thing it's _for_ — add their own todos, post a note, drop a pin, join a shared canvas. So the default is: every signed-in visitor is a first-class participant who creates their own objects and edits what they created (`doc.authorHandle === user.userHandle`, checking `oldDoc` on updates), from first load, with no one needing to let them in.
 
-**Most apps are collaborative even when they sound solo — give each person their own, and let them invite others in.** A todo list, a habit tracker, a journal, a notes app, a workout log, or a budget belongs to its creator by default: route each list/log/board to its **own object channel** (`list:<id>`/`log:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the owner invite a chosen friend in: a `share` doc the owner authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. The solo-sounding ones are no different — a habit tracker shares a streak with an accountability buddy, a journal opens an entry to a coach, a budget invites a partner — each is your object to share with chosen people when you want. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
+**A personal list, tracker, journal, or notes app — one the prompt frames as the user's own, with no sharing asked for — gives every visitor their own private space on a single per-user channel.** A todo list, a daily habit tracker, a reading list, a diary, a notes app, a workout log, or a budget where the data is one person's own routes every doc that visitor creates to the one channel keyed on their handle — `user:${user.userHandle}` — self-granted so only they read it, with `authorHandle: user.userHandle` fixed at create and held immutable on update (`oldDoc.authorHandle === user.userHandle`). Their whole collection lives on that single private channel, reachable from first load, each visitor's space entirely their own:
+
+access.js
+
+```js
+export function notes(doc, oldDoc, user, ctx) {
+  if (!user) throw { forbidden: "sign in" };
+  const ch = `user:${user.userHandle}`; // this visitor's own private space
+
+  if (doc.type === "note") {
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], grant: { users: { [user.userHandle]: [ch] } } };
+  }
+
+  throw { forbidden: "unknown document type" };
+}
+```
+
+Every item a visitor creates lands on their own `user:<handle>` channel, private to them from the first load. Pair it with a small "Only you can see this" cue near their content. This is the shape whenever the app is one person's own collection kept for themselves — the whole space is one private channel, no membership step in the way. The word "personal" routes on what the data is FOR: a personal tracker/journal/notes app is this private per-user shape, while a personal blog or portfolio exists to be READ — that one is the publication shape below (public read + author-owned posts, a roster of one), not a private channel.
+
+**When the prompt asks to share, invite, or collaborate — bring in a partner, a buddy, a friend, a team, or a group that co-edits — each shared thing becomes its own object others can be invited into.** A shopping list you invite your partner to, a board a group co-edits, a document you open to a collaborator: route that shared thing to its **own object channel** (`list:<id>`/`board:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the creator invite a chosen friend in: a `share` doc the creator authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
 
 **When a user's work is private by default, show it — and offer a way to publish.** If everything a user does routes to a channel only they can read (a per-user `user:<handle>`, a private journal/notes/tracker with no `grant.public`), the UI must say so: a small, persistent "Only you can see this" / "Private to you" cue near their content, so no one wonders who's watching their unfinished work. Then, where sharing fits the app, give them a publish control — but publish at the granularity of a **channel**, not a doc: channels are the unit of read isolation, so adding `grant.public` to the shared `user:<handle>` channel would expose _every_ private item on it, not just the one they meant to share. To publish a single item, route it to its **own** channel and flip only that channel's read-grant from a `visibility` field the access fn reads — exactly the per-item-channel shape the worked example below uses (`const ch = \`entry:${doc._id}\`; const grant = { users: { [user.userHandle]: [ch] } }; if (doc.visibility === "public") grant.public = [ch];`) — for anonymous visitors, or grant a shared app channel for all granted members. Gate the control on `useVibe(dbName).can`, and reflect the result back in the affordance ("Published — anyone can see this", with an unpublish to flip it back). Making the user's _whole_ space public is fine when that's the intent; silently leaking their other private items by publishing one is the trap to avoid. **If the app brief is private-only/confidential — a journal, private notes, a health tracker — do not add publish/share controls.** Keep publish opt-in: for private-only apps, omit the publish UI entirely; for share-capable apps, make publish one tap for user-selected items.
 
@@ -167,12 +189,25 @@ export function habits(doc, oldDoc, user, ctx) {
 }
 ```
 
-The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. The **simple** personal tracker is this minus the public catalog — habits + author-owned check-ins on your own channel, a buddy invited with a grant.
+The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. A **plain daily habit tracker** — one framed as the user's own, with no catalog, leaderboard, or buddy asked for — is instead the per-visitor shape shown above: every visitor's habits and check-ins on their single `user:${user.userHandle}` channel, self-granted and private to them.
 
 **"Invite", "join", "people can join", "collaborate", "share with", "together", "with my partner/team", or a board/canvas/room/whiteboard a group co-edits → per-object collaboration** (the second worked example above) — each shared thing is ONE object its members reach directly; it needs no owner. Use the per-object recipe: a channel per object (`board:<id>`/`list:<id>`); the creator self-grants at creation (`grant: { users: { [user.userHandle]: [ch] } }`); child docs gate on `ctx.requireAccess(ch)` so any member edits any child in it (not just their own); a member-authored `share` doc grants a peer the same channel; a `request` doc — which takes **no** `requireAccess` — lets a not-yet-member ask to join. Keep the _object's own_ creator field write-once (`if (oldDoc && doc.author !== oldDoc.author) throw`) and a child's object-id immutable. **Two traps to avoid:** don't build it as an open public feed where each person only owns their own items (that abandons the shared membership), and don't gate it behind a single writer (members self-serve via share/request).
 
 **Ownership is just the object graph** — whoever authored or created a doc owns it (`doc.authorHandle === user.userHandle`, checked against `oldDoc` on updates). There's no broadcaster shape to reach for by default, and **owner-only publishing is a dead end** — never gate the content itself on `requireRole("owner")`. **A blog, magazine, or publication is public read + author-owned posts, with the owner controlling the _author roster_:** the owner approves authors with a grant doc (`if (doc.type === "author") { ctx.requireRole("owner"); return { channels: ["blog:authors"], grant: { users: { [doc.authorHandle]: ["blog:authors"] }, roles: { owner: ["blog:authors"] } } }; }` — the **one** place `requireRole("owner")` belongs, gating who may author, never the posts); a post then gates on `ctx.requireAccess("blog:authors")` (membership) and is author-owned (`doc.authorHandle === user.userHandle` + the `oldDoc` check), so once approved each author's post is _their own_ object — only they edit it, and they moderate the comments on it (a comment is allowed if it's your comment **or** you own the post: `doc.authorHandle === user.userHandle || doc.postAuthorHandle === user.userHandle`). A personal blog is just this with a roster of one. Always gate write UI on `useVibe(dbName).can`.
 
+The personal blog's post branch is small — public read is the blog's resting state, declared inline on every post result (readers are the point of publishing):
+
+```js
+if (doc.type === "post") {
+  if (!oldDoc) {
+    if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+  } else if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+  return { channels: ["posts"], grant: { public: ["posts"] } };
+}
+```
+
+When the prompt also asks for drafts, keep the same public resting state for posts and give drafts their own author-only channel (`draft:<handle>`, granted just to the author) — publishing moves the doc to the public `posts` channel.
+
 **Sharing objects: channels carry objects, roles carry types.** A channel is one shareable thing (`list:<id>`) — membership in it means "can reach this object." A role is a _kind_ of participant (`author`, `editor`), a small reusable vocabulary. To let people collaborate on _their own_ objects with no admin in the loop: the creator routes the object to its channel and grants themselves access; any member shares it by granting a peer into the same channel; child docs gate on `ctx.requireAccess("list:<id>")`. The reserved `owner` role is the only one auto-seeded — every _other_ role is populated by the app's own grant docs (a member writes a doc whose access-fn output adds another user to a role or channel). So to put someone in a role, write a grant; don't expect a role to be pre-filled. Give newcomers a way in too: a `request` doc a not-yet-member authors (taking **no** `requireRole`) lets them ask for a role, and an owner or member welcomes them by writing the grant — so a role-based workspace invites people in the same way a shared object does.
 ## Social: followers see your stuff (platform graph)
 
@@ -190,11 +225,57 @@ docs in your database, and never build follow UI state machines.
   follow again later (blocking is harsher and lives in Settings, not in your app).
   Following a private account sits at `state:"requested"` and grants no reads until
   approved — filter to `state === "active"` when deciding whose content to show.
-- Make a doc follower-visible from access.js by ADDING `audience` to a normal result:
-  `return { channels: ["share-" + owner], audience: { followersOf: owner } };`
-  (`mutualsOf` for both-directions-only). Resolution is live: new followers instantly see
-  history; unfollow/removeFollower/block instantly revokes. The owner is always in their
-  own audience — no self-grant needed. Keep at least one real channel; keep PRIVATE data
+- Make a doc follower-visible from access.js by ADDING `audience` to a normal result, keyed on the
+  writer's own handle `user.userHandle`. Write the access function for a follower-visible app as
+  `export default function (doc, oldDoc, user, ctx)` — the platform reads the writer from that default
+  export's third positional parameter `user`, so `user.userHandle` names the live writer and the
+  audience resolves against that writer's own graph:
+
+  ```js
+  export default function (doc, oldDoc, user, ctx) {
+    if (!user) throw { forbidden: "sign in" };
+    const ch = "picks:" + user.userHandle; // the writer's own channel
+    if (doc._deleted) {
+      // A tombstone carries no fields — authorize AND route it off oldDoc.
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "your own docs" };
+      if (oldDoc.type === "reaction" || oldDoc.type === "comment")
+        return { channels: ["picks:" + oldDoc.pickOwnerHandle] };
+      return { channels: [ch], audience: { followersOf: user.userHandle } };
+    }
+    if (doc.type === "reaction" || doc.type === "comment") {
+      // A reaction/comment on SOMEONE ELSE'S pick rides that pick's channel — the
+      // pick's own audience already carries it to the right readers, so it returns
+      // channels only. Audience belongs to the doc types the WRITER shares.
+      // Author and target are fixed at create.
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+      if (oldDoc) {
+        if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+        if (doc.pickOwnerHandle !== oldDoc.pickOwnerHandle) throw { forbidden: "stays on its pick" };
+      }
+      return { channels: ["picks:" + doc.pickOwnerHandle] };
+    }
+    // A pick is the writer's own per-user doc: author fixed at create, and only
+    // the author updates it — so the channel and audience stay the author's own.
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], audience: { followersOf: user.userHandle } };
+  }
+  ```
+
+  (`mutualsOf: user.userHandle` for both-directions-only). The subject is always
+  `user.userHandle` — the handle writing this doc — in EVERY branch that returns an audience: the
+  create, the update, and the delete tombstone alike (a delete runs as the author, so
+  `user.userHandle` is the right subject there too — reach for `user.userHandle`, the live writer,
+  rather than `oldDoc.authorHandle` or a stored field). The platform resolves that subject live
+  against the writer's own graph: new followers instantly see history; unfollow/removeFollower/block
+  instantly revokes. The writer is always in their own audience — no self-grant needed. When a
+  reaction or comment should appear to a DIFFERENT person's audience, route it to that item's shared
+  channel and let the item's own audience carry it, keeping each `followersOf`/`mutualsOf` subject
+  `user.userHandle`. Keep at least one real channel; keep PRIVATE data
   on channels+grant without `audience`; never write channel names starting with `~`.
 - Copy: "followers can see your picks" / "people you follow" — never "friends".
   Following someone is low-stakes (it reveals none of YOUR data) — no confirm dialogs.
@@ -225,23 +306,19 @@ docs in your database, and never build follow UI state machines.
 
 **The owner must never be locked out of their own app.** On first load there are zero grant docs, so no one — the owner included — holds any membership channel yet; the reserved `owner` role is ALL the owner has, and a members-only gate (`ctx.requireAccess(ch)`) denies the owner exactly like a stranger. Two rules keep the owner in. In `access.js`: when a grant branch is itself owner-gated (`ctx.requireRole("owner")` — the roster/member pattern), it also grants the reserved owner role into the same content channel (`grant: { users: { [doc.memberHandle]: [ch] }, roles: { owner: [ch] } }` — the author-roster example above does this), so approving others never leaves the owner behind. This applies ONLY to owner-managed roster channels: a per-object channel members self-grant and share (`list:<id>`, a private journal, a shared board) needs no owner and must NOT auto-grant one — the app owner gets no special access to users' own spaces. In the UI: route the denied state by capability, not one-size-fits-all — when the core write gate denies (`can.create({ type: "post", ... }).ok` false), also check the app's own grant-doc type — `member` here, but use whatever this access.js names it (`author`, `share`, `approve`): `can.create({ type: "member", userHandle: me?.userHandle }).ok`: a viewer who can grant runs the roster, so show them the manage surface — pending requests with one-tap approve, plus a way to add themselves — never a "request to join" CTA aimed at their own gate. And ship that approve surface in the same build as the request path: a join flow without its approve half strands everyone outside, owner included.
 
-**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to be unchanged — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of named content fields silently unprotects anything not listed — the exact miss to avoid):
+**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-// ImgGen owns exactly these keys on a host doc; everything else is author-owned.
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changedAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changedAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-Deletes may stay author-only. `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes (`versions`/`currentVersion`/`currentPromptKey`/`prompts`/`prompt`/`_files` — it preserves `type`/`created`), so a non-author's version append touches only these and everything else must match `oldDoc`. Note `_files` merges: a non-author append can also replace a named source file under this shape, so if the app stores author-owned uploads in `_files`, compare those entries too or accept it. (A private per-user channel that no other viewer can reach is exempt — this bites the shared/public-read shapes.)
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default. Deletes stay author-only, and a non-author advancing `currentVersion` is the shared-generation display behavior (an app wanting author-only display control must guard `currentVersion` specifically; a private per-user channel no other viewer can reach is exempt).
 
 **Public vs private is the owner's ACL envelope, not your code.** Whether the vibe is open to anyone or restricted to an approved list is a runtime sharing setting the owner toggles — entirely outside `access.js`. Keep `access.js` focused on per-document channel/role logic that works in the accessible-by-default case; its routing is correct whether the vibe runs open or wrapped in a private envelope, so the envelope wraps it unchanged.
 

package/system-prompt-initial.md

@@ -76,17 +76,14 @@ export function wall(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist, so unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     return { channels: [doc.channelId] };
   }
@@ -122,11 +119,36 @@ export function board(doc, oldDoc, user, ctx) {
 }
 ```
 
-`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author change ONLY the ImgGen version fields and require every other field to match `oldDoc` (an allowlist, as `wall.post` above shows — never a denylist of a few named content fields).
+`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author through only when `ctx.isImgGenVersionAppend(doc, oldDoc)` accepts the write (as `wall.post` above shows) — it permits exactly one legitimate ImgGen version append and requires every other field unchanged.
 
 **Build the permission model around what a newcomer should be able to do.** When a stranger opens the app, they should immediately be able to do the thing it's _for_ — add their own todos, post a note, drop a pin, join a shared canvas. So the default is: every signed-in visitor is a first-class participant who creates their own objects and edits what they created (`doc.authorHandle === user.userHandle`, checking `oldDoc` on updates), from first load, with no one needing to let them in.
 
-**Most apps are collaborative even when they sound solo — give each person their own, and let them invite others in.** A todo list, a habit tracker, a journal, a notes app, a workout log, or a budget belongs to its creator by default: route each list/log/board to its **own object channel** (`list:<id>`/`log:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the owner invite a chosen friend in: a `share` doc the owner authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. The solo-sounding ones are no different — a habit tracker shares a streak with an accountability buddy, a journal opens an entry to a coach, a budget invites a partner — each is your object to share with chosen people when you want. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
+**A personal list, tracker, journal, or notes app — one the prompt frames as the user's own, with no sharing asked for — gives every visitor their own private space on a single per-user channel.** A todo list, a daily habit tracker, a reading list, a diary, a notes app, a workout log, or a budget where the data is one person's own routes every doc that visitor creates to the one channel keyed on their handle — `user:${user.userHandle}` — self-granted so only they read it, with `authorHandle: user.userHandle` fixed at create and held immutable on update (`oldDoc.authorHandle === user.userHandle`). Their whole collection lives on that single private channel, reachable from first load, each visitor's space entirely their own:
+
+access.js
+
+```js
+export function notes(doc, oldDoc, user, ctx) {
+  if (!user) throw { forbidden: "sign in" };
+  const ch = `user:${user.userHandle}`; // this visitor's own private space
+
+  if (doc.type === "note") {
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], grant: { users: { [user.userHandle]: [ch] } } };
+  }
+
+  throw { forbidden: "unknown document type" };
+}
+```
+
+Every item a visitor creates lands on their own `user:<handle>` channel, private to them from the first load. Pair it with a small "Only you can see this" cue near their content. This is the shape whenever the app is one person's own collection kept for themselves — the whole space is one private channel, no membership step in the way. The word "personal" routes on what the data is FOR: a personal tracker/journal/notes app is this private per-user shape, while a personal blog or portfolio exists to be READ — that one is the publication shape below (public read + author-owned posts, a roster of one), not a private channel.
+
+**When the prompt asks to share, invite, or collaborate — bring in a partner, a buddy, a friend, a team, or a group that co-edits — each shared thing becomes its own object others can be invited into.** A shopping list you invite your partner to, a board a group co-edits, a document you open to a collaborator: route that shared thing to its **own object channel** (`list:<id>`/`board:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the creator invite a chosen friend in: a `share` doc the creator authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
 
 **When a user's work is private by default, show it — and offer a way to publish.** If everything a user does routes to a channel only they can read (a per-user `user:<handle>`, a private journal/notes/tracker with no `grant.public`), the UI must say so: a small, persistent "Only you can see this" / "Private to you" cue near their content, so no one wonders who's watching their unfinished work. Then, where sharing fits the app, give them a publish control — but publish at the granularity of a **channel**, not a doc: channels are the unit of read isolation, so adding `grant.public` to the shared `user:<handle>` channel would expose _every_ private item on it, not just the one they meant to share. To publish a single item, route it to its **own** channel and flip only that channel's read-grant from a `visibility` field the access fn reads — exactly the per-item-channel shape the worked example below uses (`const ch = \`entry:${doc._id}\`; const grant = { users: { [user.userHandle]: [ch] } }; if (doc.visibility === "public") grant.public = [ch];`) — for anonymous visitors, or grant a shared app channel for all granted members. Gate the control on `useVibe(dbName).can`, and reflect the result back in the affordance ("Published — anyone can see this", with an unpublish to flip it back). Making the user's _whole_ space public is fine when that's the intent; silently leaking their other private items by publishing one is the trap to avoid. **If the app brief is private-only/confidential — a journal, private notes, a health tracker — do not add publish/share controls.** Keep publish opt-in: for private-only apps, omit the publish UI entirely; for share-capable apps, make publish one tap for user-selected items.
 
@@ -168,12 +190,25 @@ export function habits(doc, oldDoc, user, ctx) {
 }
 ```
 
-The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. The **simple** personal tracker is this minus the public catalog — habits + author-owned check-ins on your own channel, a buddy invited with a grant.
+The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. A **plain daily habit tracker** — one framed as the user's own, with no catalog, leaderboard, or buddy asked for — is instead the per-visitor shape shown above: every visitor's habits and check-ins on their single `user:${user.userHandle}` channel, self-granted and private to them.
 
 **"Invite", "join", "people can join", "collaborate", "share with", "together", "with my partner/team", or a board/canvas/room/whiteboard a group co-edits → per-object collaboration** (the second worked example above) — each shared thing is ONE object its members reach directly; it needs no owner. Use the per-object recipe: a channel per object (`board:<id>`/`list:<id>`); the creator self-grants at creation (`grant: { users: { [user.userHandle]: [ch] } }`); child docs gate on `ctx.requireAccess(ch)` so any member edits any child in it (not just their own); a member-authored `share` doc grants a peer the same channel; a `request` doc — which takes **no** `requireAccess` — lets a not-yet-member ask to join. Keep the _object's own_ creator field write-once (`if (oldDoc && doc.author !== oldDoc.author) throw`) and a child's object-id immutable. **Two traps to avoid:** don't build it as an open public feed where each person only owns their own items (that abandons the shared membership), and don't gate it behind a single writer (members self-serve via share/request).
 
 **Ownership is just the object graph** — whoever authored or created a doc owns it (`doc.authorHandle === user.userHandle`, checked against `oldDoc` on updates). There's no broadcaster shape to reach for by default, and **owner-only publishing is a dead end** — never gate the content itself on `requireRole("owner")`. **A blog, magazine, or publication is public read + author-owned posts, with the owner controlling the _author roster_:** the owner approves authors with a grant doc (`if (doc.type === "author") { ctx.requireRole("owner"); return { channels: ["blog:authors"], grant: { users: { [doc.authorHandle]: ["blog:authors"] }, roles: { owner: ["blog:authors"] } } }; }` — the **one** place `requireRole("owner")` belongs, gating who may author, never the posts); a post then gates on `ctx.requireAccess("blog:authors")` (membership) and is author-owned (`doc.authorHandle === user.userHandle` + the `oldDoc` check), so once approved each author's post is _their own_ object — only they edit it, and they moderate the comments on it (a comment is allowed if it's your comment **or** you own the post: `doc.authorHandle === user.userHandle || doc.postAuthorHandle === user.userHandle`). A personal blog is just this with a roster of one. Always gate write UI on `useVibe(dbName).can`.
 
+The personal blog's post branch is small — public read is the blog's resting state, declared inline on every post result (readers are the point of publishing):
+
+```js
+if (doc.type === "post") {
+  if (!oldDoc) {
+    if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+  } else if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+  return { channels: ["posts"], grant: { public: ["posts"] } };
+}
+```
+
+When the prompt also asks for drafts, keep the same public resting state for posts and give drafts their own author-only channel (`draft:<handle>`, granted just to the author) — publishing moves the doc to the public `posts` channel.
+
 **Sharing objects: channels carry objects, roles carry types.** A channel is one shareable thing (`list:<id>`) — membership in it means "can reach this object." A role is a _kind_ of participant (`author`, `editor`), a small reusable vocabulary. To let people collaborate on _their own_ objects with no admin in the loop: the creator routes the object to its channel and grants themselves access; any member shares it by granting a peer into the same channel; child docs gate on `ctx.requireAccess("list:<id>")`. The reserved `owner` role is the only one auto-seeded — every _other_ role is populated by the app's own grant docs (a member writes a doc whose access-fn output adds another user to a role or channel). So to put someone in a role, write a grant; don't expect a role to be pre-filled. Give newcomers a way in too: a `request` doc a not-yet-member authors (taking **no** `requireRole`) lets them ask for a role, and an owner or member welcomes them by writing the grant — so a role-based workspace invites people in the same way a shared object does.
 ## Social: followers see your stuff (platform graph)
 
@@ -191,11 +226,57 @@ docs in your database, and never build follow UI state machines.
   follow again later (blocking is harsher and lives in Settings, not in your app).
   Following a private account sits at `state:"requested"` and grants no reads until
   approved — filter to `state === "active"` when deciding whose content to show.
-- Make a doc follower-visible from access.js by ADDING `audience` to a normal result:
-  `return { channels: ["share-" + owner], audience: { followersOf: owner } };`
-  (`mutualsOf` for both-directions-only). Resolution is live: new followers instantly see
-  history; unfollow/removeFollower/block instantly revokes. The owner is always in their
-  own audience — no self-grant needed. Keep at least one real channel; keep PRIVATE data
+- Make a doc follower-visible from access.js by ADDING `audience` to a normal result, keyed on the
+  writer's own handle `user.userHandle`. Write the access function for a follower-visible app as
+  `export default function (doc, oldDoc, user, ctx)` — the platform reads the writer from that default
+  export's third positional parameter `user`, so `user.userHandle` names the live writer and the
+  audience resolves against that writer's own graph:
+
+  ```js
+  export default function (doc, oldDoc, user, ctx) {
+    if (!user) throw { forbidden: "sign in" };
+    const ch = "picks:" + user.userHandle; // the writer's own channel
+    if (doc._deleted) {
+      // A tombstone carries no fields — authorize AND route it off oldDoc.
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "your own docs" };
+      if (oldDoc.type === "reaction" || oldDoc.type === "comment")
+        return { channels: ["picks:" + oldDoc.pickOwnerHandle] };
+      return { channels: [ch], audience: { followersOf: user.userHandle } };
+    }
+    if (doc.type === "reaction" || doc.type === "comment") {
+      // A reaction/comment on SOMEONE ELSE'S pick rides that pick's channel — the
+      // pick's own audience already carries it to the right readers, so it returns
+      // channels only. Audience belongs to the doc types the WRITER shares.
+      // Author and target are fixed at create.
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+      if (oldDoc) {
+        if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+        if (doc.pickOwnerHandle !== oldDoc.pickOwnerHandle) throw { forbidden: "stays on its pick" };
+      }
+      return { channels: ["picks:" + doc.pickOwnerHandle] };
+    }
+    // A pick is the writer's own per-user doc: author fixed at create, and only
+    // the author updates it — so the channel and audience stay the author's own.
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], audience: { followersOf: user.userHandle } };
+  }
+  ```
+
+  (`mutualsOf: user.userHandle` for both-directions-only). The subject is always
+  `user.userHandle` — the handle writing this doc — in EVERY branch that returns an audience: the
+  create, the update, and the delete tombstone alike (a delete runs as the author, so
+  `user.userHandle` is the right subject there too — reach for `user.userHandle`, the live writer,
+  rather than `oldDoc.authorHandle` or a stored field). The platform resolves that subject live
+  against the writer's own graph: new followers instantly see history; unfollow/removeFollower/block
+  instantly revokes. The writer is always in their own audience — no self-grant needed. When a
+  reaction or comment should appear to a DIFFERENT person's audience, route it to that item's shared
+  channel and let the item's own audience carry it, keeping each `followersOf`/`mutualsOf` subject
+  `user.userHandle`. Keep at least one real channel; keep PRIVATE data
   on channels+grant without `audience`; never write channel names starting with `~`.
 - Copy: "followers can see your picks" / "people you follow" — never "friends".
   Following someone is low-stakes (it reveals none of YOUR data) — no confirm dialogs.
@@ -226,23 +307,19 @@ docs in your database, and never build follow UI state machines.
 
 **The owner must never be locked out of their own app.** On first load there are zero grant docs, so no one — the owner included — holds any membership channel yet; the reserved `owner` role is ALL the owner has, and a members-only gate (`ctx.requireAccess(ch)`) denies the owner exactly like a stranger. Two rules keep the owner in. In `access.js`: when a grant branch is itself owner-gated (`ctx.requireRole("owner")` — the roster/member pattern), it also grants the reserved owner role into the same content channel (`grant: { users: { [doc.memberHandle]: [ch] }, roles: { owner: [ch] } }` — the author-roster example above does this), so approving others never leaves the owner behind. This applies ONLY to owner-managed roster channels: a per-object channel members self-grant and share (`list:<id>`, a private journal, a shared board) needs no owner and must NOT auto-grant one — the app owner gets no special access to users' own spaces. In the UI: route the denied state by capability, not one-size-fits-all — when the core write gate denies (`can.create({ type: "post", ... }).ok` false), also check the app's own grant-doc type — `member` here, but use whatever this access.js names it (`author`, `share`, `approve`): `can.create({ type: "member", userHandle: me?.userHandle }).ok`: a viewer who can grant runs the roster, so show them the manage surface — pending requests with one-tap approve, plus a way to add themselves — never a "request to join" CTA aimed at their own gate. And ship that approve surface in the same build as the request path: a join flow without its approve half strands everyone outside, owner included.
 
-**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to be unchanged — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of named content fields silently unprotects anything not listed — the exact miss to avoid):
+**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-// ImgGen owns exactly these keys on a host doc; everything else is author-owned.
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changedAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changedAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-Deletes may stay author-only. `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes (`versions`/`currentVersion`/`currentPromptKey`/`prompts`/`prompt`/`_files` — it preserves `type`/`created`), so a non-author's version append touches only these and everything else must match `oldDoc`. Note `_files` merges: a non-author append can also replace a named source file under this shape, so if the app stores author-owned uploads in `_files`, compare those entries too or accept it. (A private per-user channel that no other viewer can reach is exempt — this bites the shared/public-read shapes.)
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default. Deletes stay author-only, and a non-author advancing `currentVersion` is the shared-generation display behavior (an app wanting author-only display control must guard `currentVersion` specifically; a private per-user channel no other viewer can reach is exempt).
 
 **Public vs private is the owner's ACL envelope, not your code.** Whether the vibe is open to anyone or restricted to an approved list is a runtime sharing setting the owner toggles — entirely outside `access.js`. Keep `access.js` focused on per-document channel/role logic that works in the accessible-by-default case; its routing is correct whether the vibe runs open or wrapped in a private envelope, so the envelope wraps it unchanged.
 

package/system-prompt.md

@@ -286,17 +286,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "message") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist, so unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.userHandle !== oldDoc.userHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.userHandle !== oldDoc.userHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.userHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     ctx.requireAccess(doc.channelId);
     return { channels: [doc.channelId] };
@@ -306,7 +303,7 @@ export function chat(doc, oldDoc, user, ctx) {
 }
 ```
 
-`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member/role doc must also return `channels` (route it to an owner-readable admin channel like `["admin:grants"]`) — a channel-less result is rejected as "unreadable write". On updates of shared-visible docs, keep ownership immutable (`if (oldDoc && doc.<authorField> !== oldDoc.<authorField>) throw`, where `<authorField>` is your doc's author field — `authorHandle`/`userHandle`/`senderHandle`) rather than requiring the updater to BE the author — image version appends run as the VIEWING user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author change ONLY the ImgGen version fields and require every other field to match `oldDoc` (an allowlist, as `chat.message` above shows — never a denylist of a few named content fields). See the fireproof access docs.
+`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member/role doc must also return `channels` (route it to an owner-readable admin channel like `["admin:grants"]`) — a channel-less result is rejected as "unreadable write". On updates of shared-visible docs, keep ownership immutable (`if (oldDoc && doc.<authorField> !== oldDoc.<authorField>) throw`, where `<authorField>` is your doc's author field — `authorHandle`/`userHandle`/`senderHandle`) rather than requiring the updater to BE the author — image version appends run as the VIEWING user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author through only when `ctx.isImgGenVersionAppend(doc, oldDoc)` accepts the write (as `chat.message` above shows) — it permits exactly one legitimate ImgGen version append and requires every other field unchanged. See the fireproof access docs.
 
 **A follow-up edit that adds a NEW doc type updates `access.js` FIRST.** The app runs live while your edits stream in, and writes are enforced against the access.js that was in force before this turn until the whole turn completes — so a `db.put` of a doc type the old function rejects fails immediately (`unknown document type`), even though your access.js update lands later in the same reply. Emit the access.js edit adding the new type's branch before the App.jsx edits that write it. And never fire-and-forget background writes of a newly added type: gate seed/auto-write effects on `useVibe(dbName)` — `if (!ready || !can.create(sampleDoc).ok) return;` with `ready`/`can` in the effect deps, checking a representative sample of **each** doc type the effect writes — so a not-yet-allowed write is skipped quietly instead of surfacing rejection errors the user didn't cause.
 
@@ -399,11 +396,57 @@ docs in your database, and never build follow UI state machines.
   follow again later (blocking is harsher and lives in Settings, not in your app).
   Following a private account sits at `state:"requested"` and grants no reads until
   approved — filter to `state === "active"` when deciding whose content to show.
-- Make a doc follower-visible from access.js by ADDING `audience` to a normal result:
-  `return { channels: ["share-" + owner], audience: { followersOf: owner } };`
-  (`mutualsOf` for both-directions-only). Resolution is live: new followers instantly see
-  history; unfollow/removeFollower/block instantly revokes. The owner is always in their
-  own audience — no self-grant needed. Keep at least one real channel; keep PRIVATE data
+- Make a doc follower-visible from access.js by ADDING `audience` to a normal result, keyed on the
+  writer's own handle `user.userHandle`. Write the access function for a follower-visible app as
+  `export default function (doc, oldDoc, user, ctx)` — the platform reads the writer from that default
+  export's third positional parameter `user`, so `user.userHandle` names the live writer and the
+  audience resolves against that writer's own graph:
+
+  ```js
+  export default function (doc, oldDoc, user, ctx) {
+    if (!user) throw { forbidden: "sign in" };
+    const ch = "picks:" + user.userHandle; // the writer's own channel
+    if (doc._deleted) {
+      // A tombstone carries no fields — authorize AND route it off oldDoc.
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "your own docs" };
+      if (oldDoc.type === "reaction" || oldDoc.type === "comment")
+        return { channels: ["picks:" + oldDoc.pickOwnerHandle] };
+      return { channels: [ch], audience: { followersOf: user.userHandle } };
+    }
+    if (doc.type === "reaction" || doc.type === "comment") {
+      // A reaction/comment on SOMEONE ELSE'S pick rides that pick's channel — the
+      // pick's own audience already carries it to the right readers, so it returns
+      // channels only. Audience belongs to the doc types the WRITER shares.
+      // Author and target are fixed at create.
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+      if (oldDoc) {
+        if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+        if (doc.pickOwnerHandle !== oldDoc.pickOwnerHandle) throw { forbidden: "stays on its pick" };
+      }
+      return { channels: ["picks:" + doc.pickOwnerHandle] };
+    }
+    // A pick is the writer's own per-user doc: author fixed at create, and only
+    // the author updates it — so the channel and audience stay the author's own.
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], audience: { followersOf: user.userHandle } };
+  }
+  ```
+
+  (`mutualsOf: user.userHandle` for both-directions-only). The subject is always
+  `user.userHandle` — the handle writing this doc — in EVERY branch that returns an audience: the
+  create, the update, and the delete tombstone alike (a delete runs as the author, so
+  `user.userHandle` is the right subject there too — reach for `user.userHandle`, the live writer,
+  rather than `oldDoc.authorHandle` or a stored field). The platform resolves that subject live
+  against the writer's own graph: new followers instantly see history; unfollow/removeFollower/block
+  instantly revokes. The writer is always in their own audience — no self-grant needed. When a
+  reaction or comment should appear to a DIFFERENT person's audience, route it to that item's shared
+  channel and let the item's own audience carry it, keeping each `followersOf`/`mutualsOf` subject
+  `user.userHandle`. Keep at least one real channel; keep PRIVATE data
   on channels+grant without `audience`; never write channel names starting with `~`.
 - Copy: "followers can see your picks" / "people you follow" — never "friends".
   Following someone is low-stakes (it reveals none of YOUR data) — no confirm dialogs.
@@ -434,23 +477,19 @@ docs in your database, and never build follow UI state machines.
 
 **The owner must never be locked out of their own app.** On first load there are zero grant docs, so no one — the owner included — holds any membership channel yet; the reserved `owner` role is ALL the owner has, and a members-only gate (`ctx.requireAccess(ch)`) denies the owner exactly like a stranger. Two rules keep the owner in. In `access.js`: when a grant branch is itself owner-gated (`ctx.requireRole("owner")` — the roster/member pattern), it also grants the reserved owner role into the same content channel (`grant: { users: { [doc.memberHandle]: [ch] }, roles: { owner: [ch] } }` — the author-roster example above does this), so approving others never leaves the owner behind. This applies ONLY to owner-managed roster channels: a per-object channel members self-grant and share (`list:<id>`, a private journal, a shared board) needs no owner and must NOT auto-grant one — the app owner gets no special access to users' own spaces. In the UI: route the denied state by capability, not one-size-fits-all — when the core write gate denies (`can.create({ type: "post", ... }).ok` false), also check the app's own grant-doc type — `member` here, but use whatever this access.js names it (`author`, `share`, `approve`): `can.create({ type: "member", userHandle: me?.userHandle }).ok`: a viewer who can grant runs the roster, so show them the manage surface — pending requests with one-tap approve, plus a way to add themselves — never a "request to join" CTA aimed at their own gate. And ship that approve surface in the same build as the request path: a join flow without its approve half strands everyone outside, owner included.
 
-**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to be unchanged — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of named content fields silently unprotects anything not listed — the exact miss to avoid):
+**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-// ImgGen owns exactly these keys on a host doc; everything else is author-owned.
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changedAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changedAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-Deletes may stay author-only. `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes (`versions`/`currentVersion`/`currentPromptKey`/`prompts`/`prompt`/`_files` — it preserves `type`/`created`), so a non-author's version append touches only these and everything else must match `oldDoc`. Note `_files` merges: a non-author append can also replace a named source file under this shape, so if the app stores author-owned uploads in `_files`, compare those entries too or accept it. (A private per-user channel that no other viewer can reach is exempt — this bites the shared/public-read shapes.)
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default. Deletes stay author-only, and a non-author advancing `currentVersion` is the shared-generation display behavior (an app wanting author-only display control must guard `currentVersion` specifically; a private per-user channel no other viewer can reach is exempt).
 
 **Public vs private is the owner's ACL envelope, not your code.** Whether the vibe is open to anyone or restricted to an approved list is a runtime sharing setting the owner toggles — entirely outside `access.js`. Keep `access.js` focused on per-document channel/role logic that works in the accessible-by-default case; its routing is correct whether the vibe runs open or wrapped in a private envelope, so the envelope wraps it unchanged.
 
@@ -520,17 +559,14 @@ Example streamed output for a team board app:
 >   }
 >
 >   if (doc.type === "post") {
->     // Author fixed at create; on update a non-author may touch only the ImgGen
->     // version fields (every other key must match oldDoc).
->     const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
->     if (!oldDoc) {
+>     // Author fixed at create; on update a non-author may only append one
+>     // legitimate ImgGen version — the platform predicate ctx.isImgGenVersionAppend
+>     // decides that (oldDoc is null on create).
+>     if (oldDoc === null) {
 >       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
 >     } else if (doc.authorHandle !== oldDoc.authorHandle) {
 >       throw { forbidden: "cannot change author" };
->     } else if (
->       Object.keys({ ...doc, ...oldDoc }).some((k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])) &&
->       oldDoc.authorHandle !== user.userHandle
->     ) {
+>     } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
 >       throw { forbidden: "not author" };
 >     }
 >     return { channels: [doc.channelId] };