@@ -0,0 +1,11 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): creating a record page no longer adds it to every app's navigation, and no navigation write goes to a sealed managed app
+
+Clause-②: no
+Metadata-protocol: none
+
+- **A page that needs a record joins no app.** When a page is published for the first time, the Console adds it to app navigation only if it renders without a record. A `record` page (and a page body that leaves `type` out, which `PageSchema` defaults to `record`) gets no navigation entry, because a page entry opens the page with no record id. `home`, `app`, `utility` and `list` pages are still added to every app that can take them. When the publishing screen holds no page body (Publish all), the page is read by name once to learn its type; if that read fails, the page is left out of navigation and the error toast says navigation was not updated.
+- **A sealed managed app is not written.** An app a managed package ships (`_provenance: 'package'` on the app read, as the stock showcase serves `showcase_app`) is sealed: the server refuses a package-less write with `403 NOT_OVERRIDABLE`. Navigation writes now skip such an app, so publishing a page no longer shows a red "Failed to update navigation" toast for it. Apps stored at runtime, including apps of a package authored at runtime, are written as before. Any other failure of an app write still shows the error toast.
@@ -76,7 +76,9 @@ describe('objectui#9868 — the create sites write unnamed entries with NO label
       const { created } = useNavigationWrites();
       useEffect(() => {
         void (async () => {
-          await created('page', 'my_page', { name: 'my_page' });
+          // A page kind that renders without a record: a record page joins no
+          // app's navigation (objectstack#29182).
+          await created('page', 'my_page', { name: 'my_page', type: 'app' });
           await created('dashboard', 'my_dash', { name: 'my_dash', label: 'My Dashboard' });
         })();
         // Once, on mount: the two creates are the case.
 
@@ -30,6 +30,7 @@ import {
   isPlatformArtifact,
   isNavigationSyncableApp,
   isNavigationTargetType,
+  isNavigablePage,
   navigationReferences,
 } from '../useNavigationSync';
 import { MemoryRouter } from 'react-router-dom';
@@ -85,6 +86,20 @@ describe('isNavigationSyncableApp', () => {
     expect(isNavigationSyncableApp({ name: 'crm', _lock: 'no-delete' })).toBe(true);
   });
 
+  it('rejects an app a managed package ships, which the server seals (objectstack#29182)', () => {
+    // The artifact loader's ADR-0010 stamp, as the stock showcase serves `showcase_app`.
+    expect(isNavigationSyncableApp({ name: 'showcase_app', _provenance: 'package', _packageId: 'com.example.showcase' })).toBe(false);
+    expect(isNavigationSyncableApp({ name: 'showcase_app', _provenance: 'package' })).toBe(false);
+  });
+
+  it('accepts a stored app, a package-bound one included: provenance decides, not _packageId', () => {
+    // As the stock showcase serves them: an app of a package authored at
+    // runtime carries `_packageId` alone, a package-less app no stamp at all.
+    expect(isNavigationSyncableApp({ name: 'rthree_app', _packageId: 'com.probe.rthree' })).toBe(true);
+    expect(isNavigationSyncableApp({ name: 'probe_app' })).toBe(true);
+    expect(isNavigationSyncableApp({ name: 'mine', _provenance: 'org' })).toBe(true);
+  });
+
   it('rejects non-objects', () => {
     expect(isNavigationSyncableApp(null)).toBe(false);
     expect(isNavigationSyncableApp('crm')).toBe(false);
@@ -101,6 +116,25 @@ describe('isNavigationTargetType', () => {
   });
 });
 
+describe('isNavigablePage (objectstack#29182)', () => {
+  it('rejects a page that needs a record, and a body that leaves type out (PageSchema defaults it to record)', () => {
+    expect(isNavigablePage({ name: 'p', type: 'record', object: 'task' })).toBe(false);
+    expect(isNavigablePage({ name: 'p' })).toBe(false);
+  });
+
+  it('accepts every page kind that renders without a record', () => {
+    for (const type of ['home', 'app', 'utility', 'list']) {
+      expect(isNavigablePage({ name: 'p', type })).toBe(true);
+    }
+  });
+
+  it('rejects a body it cannot read', () => {
+    expect(isNavigablePage(undefined)).toBe(false);
+    expect(isNavigablePage(null)).toBe(false);
+    expect(isNavigablePage({ name: 'p', type: 7 })).toBe(false);
+  });
+});
+
 describe('navigationReferences', () => {
   const tree = [
     { id: 'a', type: 'object', objectName: 'task' },
@@ -155,13 +189,15 @@ function metaValue(world: World, read: Set<string> = new Set()): MetadataContext
   } as unknown as MetadataContextValue;
 }
 
-function makeAdapter(saveItem: ReturnType<typeof vi.fn>) {
-  return { getClient: () => ({ meta: { saveItem } }) } as any;
+function makeAdapter(saveItem: ReturnType<typeof vi.fn>, getItem?: ReturnType<typeof vi.fn>) {
+  return { getClient: () => ({ meta: { saveItem, ...(getItem ? { getItem } : {}) } }) } as any;
 }
 
 const flush = () => new Promise((r) => setTimeout(r, 0));
 
 const crm = { name: 'crm', label: 'CRM', navigation: [] };
+/** A published page body that renders without a record. */
+const appPage = { name: 'my_page', type: 'app' };
 
 // ---------------------------------------------------------------------------
 // useNavigationWrites — the create / delete sites' door
@@ -176,9 +212,12 @@ type Writes = ReturnType<typeof useNavigationWrites>;
 async function withWrites(
   world: World,
   act: (writes: Writes) => Promise<void>,
-  { preview = false }: { preview?: boolean } = {},
+  {
+    preview = false,
+    saveItem = vi.fn().mockResolvedValue({}),
+    getItem,
+  }: { preview?: boolean; saveItem?: ReturnType<typeof vi.fn>; getItem?: ReturnType<typeof vi.fn> } = {},
 ) {
-  const saveItem = vi.fn().mockResolvedValue({});
   const read = new Set<string>();
   let done = false;
   function Caller() {
@@ -195,7 +234,7 @@ async function withWrites(
   render(
     <MemoryRouter>
       <PreviewModeProvider force={preview}>
-        <AdapterCtx.Provider value={makeAdapter(saveItem)}>
+        <AdapterCtx.Provider value={makeAdapter(saveItem, getItem)}>
           <MetadataCtx.Provider value={metaValue(world, read)}>
             <Caller />
           </MetadataCtx.Provider>
@@ -216,7 +255,7 @@ describe('useNavigationWrites keeps the diff\'s rules at the site (objectstack#2
   it('a created page and dashboard land label-less in every writable app, and no list is read', async () => {
     const sales = { name: 'sales', label: 'Sales', navigation: [] };
     const { saveItem, read } = await withWrites({ apps: [crm, sales] }, async (w) => {
-      await w.created('page', 'my_page', { name: 'my_page', label: 'My Page' });
+      await w.created('page', 'my_page', { name: 'my_page', label: 'My Page', type: 'app' });
       await w.created('dashboard', 'my_dash');
     });
 
@@ -279,7 +318,7 @@ describe('useNavigationWrites keeps the diff\'s rules at the site (objectstack#2
       { name: 'setup', label: 'Setup', navigation: [], _lock: 'full' },
       { name: 'studio', label: 'Studio', navigation: [], protection: { lock: 'no-overlay' } },
     ];
-    const { saveItem } = await withWrites({ apps }, (w) => w.created('page', 'my_page'));
+    const { saveItem } = await withWrites({ apps }, (w) => w.created('page', 'my_page', appPage));
 
     expect(saveItem).toHaveBeenCalledTimes(1);
     expect(saveItem.mock.calls[0][1]).toBe('crm');
@@ -294,7 +333,7 @@ describe('useNavigationWrites keeps the diff\'s rules at the site (objectstack#2
     };
     const withDash = { name: 'ops', navigation: [{ id: 'n2', type: 'dashboard', dashboardName: 'my_dash' }] };
     const { saveItem } = await withWrites({ apps: [withPage, withDash] }, async (w) => {
-      await w.created('page', 'my_page');
+      await w.created('page', 'my_page', appPage);
       await w.created('dashboard', 'my_dash');
     });
 
@@ -306,3 +345,100 @@ describe('useNavigationWrites keeps the diff\'s rules at the site (objectstack#2
     ]);
   });
 });
+
+describe('useNavigationWrites writes no record page and no sealed app (objectstack#29182)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const sales = { name: 'sales', label: 'Sales', navigation: [] };
+
+  it('creating a record page writes no app', async () => {
+    const { saveItem } = await withWrites({ apps: [crm, sales] }, async (w) => {
+      await w.created('page', 'task_record', { name: 'task_record', type: 'record', object: 'task' });
+      await w.created('page', 'untyped', { name: 'untyped' });
+    });
+    expect(saveItem).not.toHaveBeenCalled();
+    const { toast } = await import('sonner');
+    expect(toast.error).not.toHaveBeenCalled();
+    expect(toast.success).not.toHaveBeenCalled();
+  });
+
+  it('creating a navigable page still writes each syncable app', async () => {
+    const { saveItem } = await withWrites({ apps: [crm, sales] }, async (w) => {
+      await w.created('page', 'landing', { name: 'landing', type: 'home' });
+      await w.created('page', 'tasks', { name: 'tasks', type: 'list', object: 'task' });
+    });
+    expect(saveItem.mock.calls.map((c) => [c[1], c[2].navigation.at(-1).pageName])).toEqual([
+      ['crm', 'landing'],
+      ['sales', 'landing'],
+      ['crm', 'tasks'],
+      ['sales', 'tasks'],
+    ]);
+  });
+
+  it('a caller holding no body has the page read by name, and its type decides', async () => {
+    const getItem = vi.fn(async (_type: string, name: string) => ({
+      type: 'page',
+      name,
+      item: { name, type: name === 'rec' ? 'record' : 'app' },
+    }));
+    const { saveItem } = await withWrites(
+      { apps: [crm] },
+      async (w) => {
+        await w.created('page', 'rec');
+        await w.created('page', 'nav');
+      },
+      { getItem },
+    );
+    expect(getItem.mock.calls).toEqual([
+      ['page', 'rec'],
+      ['page', 'nav'],
+    ]);
+    expect(saveItem.mock.calls.map((c) => c[2].navigation.at(-1).pageName)).toEqual(['nav']);
+  });
+
+  it('a page read that fails writes no app and says navigation was not updated', async () => {
+    const getItem = vi.fn().mockRejectedValue(new Error('down'));
+    const { saveItem } = await withWrites({ apps: [crm] }, (w) => w.created('page', 'nav'), { getItem });
+    expect(saveItem).not.toHaveBeenCalled();
+    const { toast } = await import('sonner');
+    expect(toast.error).toHaveBeenCalledTimes(1);
+    expect(toast.error).toHaveBeenCalledWith('navigationSync.updateFailed');
+  });
+
+  it('a sealed managed app gets no write and no red toast, in every direction', async () => {
+    const sealed = {
+      name: 'showcase_app',
+      _provenance: 'package',
+      _packageId: 'com.example.showcase',
+      navigation: [{ id: 'n1', type: 'page', pageName: 'gone' }],
+    };
+    const runtimePkgApp = { name: 'rthree_app', _packageId: 'com.probe.rthree', navigation: [] };
+    const { saveItem } = await withWrites({ apps: [sealed, runtimePkgApp] }, async (w) => {
+      await w.created('page', 'landing', { name: 'landing', type: 'app' });
+      await w.created('dashboard', 'kpis');
+      await w.deleted('page', 'gone');
+    });
+    expect(saveItem.mock.calls.map((c) => c[1])).toEqual(['rthree_app', 'rthree_app']);
+    const { toast } = await import('sonner');
+    expect(toast.error).not.toHaveBeenCalled();
+  });
+
+  it('any other app write failure still shows the error toast', async () => {
+    const saveItem = vi.fn(async (_t: string, app: string) => {
+      if (app === 'sales') throw Object.assign(new Error('boom'), { status: 500 });
+      return {};
+    });
+    await withWrites(
+      { apps: [crm, sales] },
+      (w) => w.created('page', 'landing', { name: 'landing', type: 'app' }),
+      { saveItem },
+    );
+    expect(saveItem.mock.calls.map((c) => c[1])).toEqual(['crm', 'sales']);
+    const { toast } = await import('sonner');
+    expect(toast.success).toHaveBeenCalledTimes(1);
+    expect(toast.error).toHaveBeenCalledTimes(1);
+    expect(toast.error).toHaveBeenCalledWith('navigationSync.updateFailed');
+  });
+});
@@ -201,10 +201,22 @@ export function isPlatformArtifact(item: unknown): boolean {
  * 'no-overlay' reject PUT with 403 — a navigation write into such an app can
  * never succeed, so don't attempt it (each attempt surfaced as a red
  * "Failed to update navigation" toast).
+ *
+ * ADR-0131 D6: an app a managed package ships is sealed. `app` has no per-org
+ * overlay channel (`allowEnvironmentOverlay: false`), so the server refuses
+ * every package-less write onto a packaged app with `403 NOT_OVERRIDABLE`,
+ * whatever its lock (objectstack#29182). The app read marks such an app by its
+ * ADR-0010 provenance: the artifact loader stamps `_provenance: 'package'`
+ * (the stock showcase serves `showcase_app` so, with no `_lock`). A stored row
+ * carries no such stamp: a package-less app is served with no provenance keys,
+ * and an app of a package authored at runtime with `_packageId` alone, and the
+ * server takes a navigation write into either. So provenance decides, never
+ * `_packageId`.
  */
 export function isNavigationSyncableApp(app: unknown): boolean {
   if (!app || typeof app !== 'object') return false;
-  const a = app as { _lock?: string; protection?: { lock?: string } };
+  const a = app as { _lock?: string; protection?: { lock?: string }; _provenance?: unknown };
+  if (a._provenance === 'package') return false;
   const lock = a._lock ?? a.protection?.lock;
   return lock !== 'full' && lock !== 'no-overlay';
 }
@@ -601,6 +613,38 @@ export function isNavigationTargetType(type: unknown): type is NavigationTargetT
   return type === 'page' || type === 'dashboard';
 }
 
+/**
+ * The page kinds (`PageSchema.type`) that cannot render without a record, so a
+ * `type: 'page'` navigation entry, which opens `/apps/{app}/page/{name}` with
+ * no record id, can never open one. Today that is `record` alone: the nav
+ * target picker leaves it out for the same reason (`isStaticPageOption` in
+ * `views/metadata-admin/inspectors/nav-target.ts`). `home`, `app`, `utility`
+ * and `list` render without one.
+ */
+const RECORD_BOUND_PAGE_TYPES: ReadonlySet<string> = new Set(['record']);
+
+/**
+ * The page kind a page body states. A body that leaves `type` out is a record
+ * page: `PageSchema` declares `type` with the default `PAGE_TYPE_DEFAULT`
+ * (`'record'`, `@objectstack/spec` `ui/default-record-page.ts`), which judges
+ * an unparsed body the same way.
+ */
+function pageTypeOf(body: Record<string, unknown>): unknown {
+  return body.type === undefined ? 'record' : body.type;
+}
+
+/**
+ * Whether a page body may be written into app navigation: a page whose kind
+ * renders without a record. A page that needs one (a `record` page) is never
+ * navigable on its own, so a navigation entry for it opens a page with no
+ * record (objectstack#29182).
+ */
+export function isNavigablePage(body: unknown): boolean {
+  if (!body || typeof body !== 'object') return false;
+  const type = pageTypeOf(body as Record<string, unknown>);
+  return typeof type === 'string' && !RECORD_BOUND_PAGE_TYPES.has(type);
+}
+
 export interface UseNavigationWritesReturn {
   /**
    * A page or dashboard was just published for the FIRST time (it held no
@@ -609,7 +653,9 @@ export interface UseNavigationWritesReturn {
    *
    * `item` is the published body when the caller holds one: its provenance
    * (`_packageId`, `_provenance`) decides, with the name, whether it is a
-   * platform artifact, which never writes navigation.
+   * platform artifact, which never writes navigation. A page's `type` decides
+   * whether it is navigable at all; a caller that holds no body has the page
+   * read by name.
    */
   created: (type: string, name: string, item?: unknown) => Promise<void>;
   /** A page or dashboard was just deleted, leaving no baseline behind. Removes its entries from every app that may be written. */
@@ -626,6 +672,9 @@ export interface UseNavigationWritesReturn {
  * that diff's rules, so the same items reach navigation from the console:
  *
  *  - only a `page` or a `dashboard`;
+ *  - on create, only a page that renders without a record
+ *    ({@link isNavigablePage}, objectstack#29182): a `record` page joins no
+ *    app's navigation;
  *  - never a platform artifact ({@link isPlatformArtifact}): an item a package
  *    install or a CLI deploy brings carries `_packageId`, and its package ships
  *    the navigation that exposes it;
@@ -641,6 +690,10 @@ export interface UseNavigationWritesReturn {
  */
 export function useNavigationWrites(): UseNavigationWritesReturn {
   const previewDrafts = usePreviewDrafts();
+  const adapter = useAdapter();
+  const adapterRef = useRef(adapter);
+  adapterRef.current = adapter;
+  const { t } = useObjectTranslation();
   const {
     syncPageCreatedAllApps,
     syncDashboardCreatedAllApps,
@@ -657,15 +710,42 @@ export function useNavigationWrites(): UseNavigationWritesReturn {
     [previewDrafts],
   );
 
+  /**
+   * The body of a page just created: the one the caller holds, else the
+   * published one, read by name (a publish of every pending draft holds only
+   * the draft list's rows). `undefined` when that read fails.
+   */
+  const createdPageBody = useCallback(
+    async (name: string, item: unknown): Promise<unknown> => {
+      if (item && typeof item === 'object') return item;
+      try {
+        const client = adapterRef.current?.getClient();
+        const res = (await client?.meta.getItem('page', name)) as { item?: unknown } | undefined;
+        return res?.item;
+      } catch {
+        return undefined;
+      }
+    },
+    [],
+  );
+
   const created = useCallback(
     async (type: string, name: string, item?: unknown) => {
       if (!writes(type, name, item)) return;
       // No author label: the entry inherits its target's label at render time
       // (objectui#9868), as the diff's entries did.
-      if (type === 'page') await syncPageCreatedAllApps(name);
-      else await syncDashboardCreatedAllApps(name);
+      if (type === 'page') {
+        // objectstack#29182 — a page that needs a record joins no app.
+        const body = await createdPageBody(name, item);
+        if (body === undefined) {
+          toast.error(t('navigationSync.updateFailed'));
+          return;
+        }
+        if (!isNavigablePage(body)) return;
+        await syncPageCreatedAllApps(name);
+      } else await syncDashboardCreatedAllApps(name);
     },
-    [writes, syncPageCreatedAllApps, syncDashboardCreatedAllApps],
+    [writes, createdPageBody, t, syncPageCreatedAllApps, syncDashboardCreatedAllApps],
   );
 
   const deleted = useCallback(