Root Documents Are Created Through an Interim Browser Door

Decision

Owner ruling, 2026-09-06 (folio unification plan, Stage D gate D; unblocks row 7, "create a root Document"). The repository has no authenticated authority: no identity provider is wired, the only authority the backend recognises is a bearer session bound to an existing Document, and browserClientId is an unverified browser id that scopes the recent list and authorises nothing. Three options were put: wait for sign-in, an interim Builder-first rule, or choose the identity provider now. The owner chose the interim rule.

1. An interim rule for the pre-sign-in MVP. A new Document is created for this browser — the same browserClientId that already scopes the recent list — and opens for it.
2. One narrow bootstrap, one transaction. The door mints the Document's folio with its routeKey, its sealed baseline (version 1), its live head cloned from it, and one session bound to the Document, together or not at all — the rows the seed already produces for a seeded Document, produced at runtime. It is the only public write that takes no authSessionId, and the executor guard names it as that one exemption rather than growing a list.
3. Its posture is stated, not hidden. Anyone with the app open can create documents. That is the posture the recent list already has, and it is accepted for the MVP on the sample-data footing the plan records.
4. It is temporary. Sign-in (GB-10, the claim step) replaces this door; when an identity provider lands, root creation is authorised by the signed-in user and the browser rule is deleted, not kept beside it.
5. Whole-document Duplicate uses the same door (gate C's root question): the copy is filed for this browser exactly as a new document is.

In plain terms: until the office has a sign-in book, anyone at the counter can open a new file, and the file is theirs on that computer. The rule is written down as a stopgap, and the sign-in book replaces it rather than sitting next to it.

Consequences

• Row 7 lands one bootstrap under convex/folio/ that produces the four rows in one transaction, and Document Home's New document button binds to it; the navigation object blankDocumentNavigation stops being inert.
• The executor guard's exemption is the bootstrap by name; every other public mutation under convex/ stays a builder-declared executor.
• GB-10 gains the reversal as a criterion: delete the browser door when sign-in lands.