# ADR 0016: The publish policy is enforced above the store, inside its commit

Status: accepted (2026-09-21).

## Context

Publish policy evaluation lived inside `bucketstore`, so the two backends were
not observably equivalent, conformance could not cover policy, and the store
carried a phase flag (`requirePolicy`) that `Open` flipped after seeding so
the seeding write would not be judged by the policy it created.

The obvious repair, a decorator above `backend.Store`, reads the policy in one
view and writes in a later commit. A write judged under policy P1 could then
land after a stricter P2. `bucketstore` does not have that window today: it
reads the policy inside each commit attempt and judges the write again after
every rebase.

## Decision

- `backend.WriteRequest` carries an optional `Precondition`. A backend runs it
  inside its own commit, after the conflict, archive and no-op checks and
  before anything is stored, with a `PreparedWrite`: canonical path, final
  body (joined for APPEND), persisted metadata, and a `Reader` over the state
  the write commits against. Its error refuses the write and is returned as
  is. `filestore` runs it under its write lock through
  `protocol/store.WriteChecked`; `bucketstore` runs it in the mutation
  builder, so a rebased attempt is judged again.
- `server/internal/writepolicy` owns the policy logic once. `Enforce(store,
  Options{Require})` is a decorator that sets the precondition on PUBLISH and
  APPEND and refuses to archive a required policy document. `Validate` checks
  that a world holds a usable policy before a server starts enforcing.
  `PolicyError` and the policy sentinels live there.
- `bucketstore` enforces no policy. Its `RequirePolicy` option and the
  `requirePolicy` phase flag are gone; `PolicySeed` still seeds at open, and
  the write is ungated simply because the store is not yet decorated.
- The knowledge server wraps every world with `Enforce`, requiring a policy
  unless the world is provisioned by the broker. The file server is not
  wrapped: a file world that already holds a policy document would start
  refusing writes, which is a product decision, not a refactor.

## Consequences

- Conformance case `Precondition` and rejection conformance run on both
  backends; the rebase test that proves a changed policy is re-evaluated still
  passes, now through the decorator.
- A refused write on the file backend leaves no version and no per document
  directory behind.
- `MutationResult` no longer reports the strictness and result of a warn
  decision; nothing consumed them.
- The precondition is a general seam. Quotas are still inside `bucketstore`.