Alpha. The app sub-resource may change shape without a deprecation cycle while apps mature. The document routes are stable.

Create (or reuse) the document's main draft and replace the app on it in one call — the app-side counterpart of PATCH …/draft's create-or-reuse behavior, with the same body, validation, and gates as PUT …/draft/{draftIdentifier}/app. No auto-publish; the response carries the draftIdentifier for POST …/draft/publish. Removing the app has no create-or-reuse counterpart — DELETE stays draft-explicit.

Last-write-wins, like every app write in the UI: the body is applied as given, with no expected-version precondition.

app is a reserved literal under …/draft/ — the router ranks it above the dynamic {draftIdentifier} segment. A draft named app would be unaddressable on the draft-scoped app routes; avoid it.

A document carries at most one of a dashboard or an app — never both; workbook-only is valid. The app HTML and settings live only at the app sub-resource routes; the document read carries an app slice pointing here, and the whole-document PATCH accepts that slice back only as it was read.

An organization key may pass userId to act as that member: reads answer with their access, and writes are authorized and recorded as them. A user-scoped key may only name its own user (403); a user outside the organization is a 404, as is a write naming a member who has not accepted their invitation. Naming an embed user who has no live embed session is a 403. Only the operations that document userId take it — the draft-explicit …/draft/{draftIdentifier}/… routes act as the key itself.