@@ -52,7 +52,7 @@ import {
 import { useRecordSearch } from '@object-ui/react';
 import { usePermissions } from '@object-ui/permissions';
 import { useTheme } from './ThemeProvider.js';
-import { useNavVisibility } from '../hooks/useNavMemberGates.js';
+import { navEntriesShownToMember, useNavMemberGates, type NavMemberGates } from '../hooks/useNavMemberGates.js';
 import { useObjectTranslation } from '@object-ui/i18n';
 import { resolveKeyedI18nLabel, getRecordDisplayName, appRouteSegment } from '../utils/index.js';
 import { getIcon } from '../utils/getIcon.js';
@@ -144,23 +144,36 @@ export function CommandPalette(props: CommandPaletteProps) {
         setOpen(false);
       }}
     >
-      <CommandPaletteBody {...props} />
+      {props.scope === 'studio' ? <CommandPaletteBody {...props} gates={null} /> : <AppCommandPaletteBody {...props} />}
     </ErrorBoundary>
   );
 }
 
-function CommandPaletteBody(props: CommandPaletteProps) {
+/**
+ * The app scope's palette, with the member's navigation gates, the sidebar's
+ * (objectstack#26892), for the app it lists: inside an app that is the
+ * frame's app; on Home, whose expression scope binds none, it is the host app.
+ * Built here, not in the body: the `studio` scope has no app, so it asks for
+ * no gate and reads nothing until it opens.
+ */
+function AppCommandPaletteBody(props: AppCommandPaletteProps) {
+  const gates = useNavMemberGates(props.activeApp ?? undefined);
+  return <CommandPaletteBody {...props} gates={gates} />;
+}
+
+/**
+ * `gates`: the member's navigation gates in the app scope, `null` in the
+ * `studio` scope, which has no navigation and lists no app report.
+ */
+function CommandPaletteBody(props: CommandPaletteProps & { gates: NavMemberGates | null }) {
+  const { gates } = props;
   const inStudio = props.scope === 'studio';
   const { apps, activeApp, objects, onAppChange, dataSource } = inStudio ? NO_APP : props;
   const { open, setOpen } = useCommandPalette();
   const [inputValue, setInputValue] = useState('');
   const navigate = useNavigate();
   const { appName } = useParams();
   const { setTheme } = useTheme();
-  // The shell's one navigation `visible` evaluator, the sidebar's and
-  // `nav:menu`'s: an entry that declares an API `dataSource` reads its bound
-  // value as `data`, and is hidden until that read answers (objectui#13029).
-  const evalVis = useNavVisibility(activeApp);
   const { t, language } = useObjectTranslation();
   // A nav entry's text, the way the sidebar and `nav:menu` name it: an entry
   // with NO `label` shows its target's current label, else its target's machine
@@ -204,14 +217,17 @@ function CommandPaletteBody(props: CommandPaletteProps) {
   // its edits; OK, or a clean page, goes at once.
   const leaveTo = (to: string) => runCommand(() => confirmUnsavedLeave(() => navigate(to)));
 
-  // Extract navigation items from active app, filtering by the spec's one
-  // navigation gate, `visible`. The `?? item.visibleOn` fallback this read
-  // once carried was a consumer-side alias of a key the spec never declared on
-  // a navigation entry (`NavigationItem.visible` is the gate) — dropped with the
-  // node-level dialects.
-  const navItems = flattenNavigation(activeApp?.navigation || []).filter(
-    (item) => evalVis(item.visible, item)
-  );
+  // The active app's navigation entries as the sidebar shows them to this
+  // member (objectstack#26892): `navEntriesShownToMember` under the sidebar's
+  // gates, the ones `UnifiedSidebar` draws with (the object-read prune, and per
+  // entry its `visible`, through the shell's one evaluator, so an entry that
+  // declares an API `dataSource` is hidden until its read answers,
+  // objectui#13029; its `requiredPermissions`; its runtime-capability gates),
+  // then flattened. Filtering the flattened leaves by their own `visible`
+  // alone, as this once did, offered an entry the sidebar hides by
+  // `requiredPermissions`, by a runtime-capability gate, or by its group's
+  // `visible`, and opened it empty.
+  const navItems = gates ? flattenNavigation(navEntriesShownToMember(activeApp?.navigation || [], gates)) : [];
 
   // The entries the palette shows for the query: a navigation entry or app by
   // its label and its machine name, a built-in command by its value. They are
@@ -232,7 +248,7 @@ function CommandPaletteBody(props: CommandPaletteProps) {
   const navReportNames = new Set(
     navItems.filter((item) => item.type === 'report').map((item) => item.reportName as string),
   );
-  const appReports = useAppReportEntries(activeApp, open && !inStudio).entries.filter(
+  const appReports = useAppReportEntries(activeApp, open && !inStudio, gates).entries.filter(
     (entry) => !navReportNames.has(entry.name) && matches(entry.label, entry.name),
   );
   const switchableApps = apps.filter((a) => a.active !== false);
 
@@ -58,9 +58,9 @@
  * its `visible` reads the value the binding selects as `data`
  * (`data.total == 1`). Only `visible` reads it: not the label, not the target,
  * and not the entry's `children`. {@link useNavVisibility} is the one evaluator
- * every navigation surface of the shell hands its guard: the sidebar and the
- * landing through {@link useNavMemberGates}, the `nav:menu` block and the
- * command palette directly. It reads each binding an app's navigation declares
+ * every navigation surface of the shell hands its guard: the sidebar, the
+ * landing and the command palette through {@link useNavMemberGates}, the
+ * `nav:menu` block directly. It reads each binding an app's navigation declares
  * through `@object-ui/react`'s element reader (`readElementApi`, the request a
  * page element's binding makes, with the host's `apiFetch`), so there is no
  * second fetch; and in the open the read is asked in (`ElementApiOpenScope`,
@@ -254,8 +254,8 @@ export function navEntryVisible(
 /**
  * The `visible` evaluator for `app`'s navigation: {@link navEntryVisible} over
  * the shell's expression evaluator and the bindings `app` declares. The sidebar
- * (through {@link useNavMemberGates}), the `nav:menu` block and the command
- * palette each build theirs here, so they cannot disagree.
+ * and the command palette (through {@link useNavMemberGates}) and the `nav:menu`
+ * block each build theirs here, so they cannot disagree.
  */
 export function useNavVisibility(
   app: unknown,
@@ -308,9 +308,15 @@ export interface NavMemberGatesWithReads extends NavMemberGates {
 /**
  * The member's gates, built from the providers the console mounts: the
  * expression evaluator, `usePermissions()`, and the registered object list.
+ *
+ * `forApp` names the app whose navigation is gated when it is not the frame's
+ * own (objectstack#26892): Home binds no app in its expression scope yet hands
+ * the palette its host app, whose entries' API bindings and package object
+ * scope are that app's. Omitted, the frame's app is gated, as before.
  */
-export function useNavMemberGates(): NavMemberGatesWithReads {
-  const { app } = useExpressionContext();
+export function useNavMemberGates(forApp?: Record<string, unknown>): NavMemberGatesWithReads {
+  const { app: frameApp } = useExpressionContext();
+  const app: Record<string, unknown> = forApp ?? frameApp;
   // objectui#13029 — the entries of the app this frame renders may bind data.
   const { evaluate: evalVis, readEntry } = useNavVisibilityAndReads(app);
 
 
@@ -12,21 +12,25 @@
  * to its own route, `report/NAME`. Which reports, and under which read rule,
  * is `useAppReportEntries`'s answer (`appReportIndex.ts`); the ⌘K palette
  * reads the same one. The sidebar links here from every app, so a report the
- * app's navigation does not name still has a UI path.
+ * app's navigation does not name still has a UI path. A report it names is
+ * listed only when the sidebar's gates show the member an entry naming it
+ * (objectstack#26892).
  */
 
 import { Link, useParams } from 'react-router-dom';
 import { BarChart3, ChevronRight, Loader2 } from 'lucide-react';
 import { Empty, EmptyTitle, EmptyDescription } from '@object-ui/components';
 import { useObjectTranslation } from '@object-ui/i18n';
 import { useExpressionContext } from '../providers/ExpressionProvider.js';
+import { useNavMemberGates } from '../hooks/useNavMemberGates.js';
 import { useAppReportEntries } from './appReportIndex.js';
 
 export function AppReportIndexView() {
   const { t } = useObjectTranslation();
   const { appName } = useParams<{ appName: string }>();
   const { app } = useExpressionContext();
-  const { entries, loading } = useAppReportEntries(app, true);
+  const gates = useNavMemberGates();
+  const { entries, loading } = useAppReportEntries(app, true, gates);
   const title = t('console.reportIndex.title', { defaultValue: 'Reports' });
 
   if (loading) {
 
@@ -108,8 +108,11 @@ function adapterFor(reports: unknown[], asked: string[]) {
     },
     getClient: () => ({
       meta: {
-        getItems: (type: string) => {
-          asked.push(type);
+        // A package-scoped read is recorded with its scope: the navigation
+        // gates read the app's object scope, as the sidebar does
+        // (objectstack#26892), which is not the object registry.
+        getItems: (type: string, params?: { packageId?: string }) => {
+          asked.push(params?.packageId ? `${type}?packageId=${params.packageId}` : type);
           return Promise.resolve({ type, items: items[type] ?? [] });
         },
         getItem: () => Promise.resolve({ item: null }),
@@ -202,6 +205,8 @@ describe('the app report index (objectui#13020)', () => {
     expect(asked).toContain('report');
     expect(asked).toContain('dataset');
     expect(asked).not.toContain('object');
+    // The sidebar's own read, through its gates: the app's package scope.
+    expect(asked).toContain(`object?packageId=${PKG}`);
   });
 
   it('CONTROL: an app that ships no report shows the empty state', async () => {