changelog.d/4867-admin-private-panel-reads.md

Rama main · réplica de lectura del repositorio original.

- **Workspace admins can read the panel actions and history of a private Page (#4867).** A workspace ADMIN who opened another member's private Page received the Page but `404` for its panels' declared actions (`GET /api/v1/pages/{slug}/panels/{panelId}/actions`, `crewship page actions`) and application panel history (`GET /api/v1/pages/{slug}/application/panels/{panelId}/history`, `crewship page project panel-history`), because both reads used the dispatch permission check. They now use the read audience of the administrator read rule: the ADMIN reads them, each read writes one `artifact.private_owner_accessed` audit entry before anything is returned, and nothing is returned if that entry cannot be written. Dispatching a panel action, application action status and the restricted action catalog are unchanged, so the ADMIN still cannot run those actions. The action listing gains `can_dispatch`, which is `true` only when dispatch would admit the caller (MANAGER or above and, on a private Page, its owner or the workspace owner), so it is `false` for that ADMIN and for members; the Page application and the CLI no longer offer to run an action the server would refuse. Members outside the Page's audience, including members of the panel's crew, still get `404`.