A node is public exactly when a live grant whose subject covers it has this audience and the node's access mode lets that grant apply. Public content takes the fast path on every server: it needs no authentication and may be cached. Revoking the grant stops future serves; bytes already served stay with their holders, which the disclosure ledger records. A space that wants to be public publishes one grant on root with this audience and the whole subtree inherits it.

Empty visibility on a Ref or Comment, propagated down to Changes and files. Stem makes the same fact a signed statement with a subject and a revocation path.