diff --git a/appinfo/info.xml b/appinfo/info.xml
index c296c0ece..a0bf88214 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -50,7 +50,7 @@ Vrij en open source onder de EUPL-licentie.
 
 **Ondersteuning:** Voor ondersteuning, neem contact op via support@conduction.nl. Voor een Service Level Agreement (SLA), neem contact op via sales@conduction.nl.
     ]]></description>
-    <version>0.2.3-unstable.20260912202721</version>
+    <version>0.2.4-unstable.20261001120000</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Stackiq</namespace>
@@ -224,6 +224,7 @@ Vrij en open source onder de EUPL-licentie.
 			<step>OCA\Stackiq\Repair\InitializeSettings</step>
 			<step>OCA\Stackiq\Repair\MigrateContactsToNc</step>
 			<step>OCA\Stackiq\Repair\BackfillContractApprovalState</step>
+			<step>OCA\Stackiq\Repair\BackfillModuleVersionPublication</step>
 			<!--
 				Must run AFTER the register sync that adds the English columns, so it
 				can tell the rename case from the back-fill case. Scoped by SCHEMA,
diff --git a/l10n/en.js b/l10n/en.js
index d125ec5cf..579aecf1b 100644
--- a/l10n/en.js
+++ b/l10n/en.js
@@ -1069,7 +1069,11 @@ OC.L10N.register(
         "Created in source": "Created in source",
         "The date the application was registered in the source system.": "The date the application was registered in the source system.",
         "Changed in source": "Changed in source",
-        "The date the application was last changed in the source system.": "The date the application was last changed in the source system."
+        "The date the application was last changed in the source system.": "The date the application was last changed in the source system.",
+        "Application published": "Application published",
+        "The publication date of the application this version belongs to, copied from it. A version is public only while its application is.": "The publication date of the application this version belongs to, copied from it. A version is public only while its application is.",
+        "Application registered by": "Application registered by",
+        "Who registered the application this version belongs to, copied from it. A supplier's application is public, and so are its versions.": "Who registered the application this version belongs to, copied from it. A supplier's application is public, and so are its versions."
     },
     "nplurals=2; plural=(n != 1);"
 )
diff --git a/l10n/en.json b/l10n/en.json
index 4ec00a0f9..494792fa9 100644
--- a/l10n/en.json
+++ b/l10n/en.json
@@ -1068,6 +1068,10 @@
         "Created in source": "Created in source",
         "The date the application was registered in the source system.": "The date the application was registered in the source system.",
         "Changed in source": "Changed in source",
-        "The date the application was last changed in the source system.": "The date the application was last changed in the source system."
+        "The date the application was last changed in the source system.": "The date the application was last changed in the source system.",
+        "Application published": "Application published",
+        "The publication date of the application this version belongs to, copied from it. A version is public only while its application is.": "The publication date of the application this version belongs to, copied from it. A version is public only while its application is.",
+        "Application registered by": "Application registered by",
+        "Who registered the application this version belongs to, copied from it. A supplier's application is public, and so are its versions.": "Who registered the application this version belongs to, copied from it. A supplier's application is public, and so are its versions."
     }
 }
diff --git a/l10n/nl.js b/l10n/nl.js
index 563c72e95..77d23a5e6 100644
--- a/l10n/nl.js
+++ b/l10n/nl.js
@@ -1139,7 +1139,11 @@ OC.L10N.register(
         "Created in source": "Aangemaakt in de bron",
         "The date the application was registered in the source system.": "De datum waarop de applicatie in het bronsysteem is geregistreerd.",
         "Changed in source": "Gewijzigd in de bron",
-        "The date the application was last changed in the source system.": "De datum waarop de applicatie in het bronsysteem het laatst is gewijzigd."
+        "The date the application was last changed in the source system.": "De datum waarop de applicatie in het bronsysteem het laatst is gewijzigd.",
+        "Application published": "Applicatie gepubliceerd",
+        "The publication date of the application this version belongs to, copied from it. A version is public only while its application is.": "De publicatiedatum van de applicatie waar deze versie bij hoort, daarvan overgenomen. Een versie is alleen openbaar zolang haar applicatie dat is.",
+        "Application registered by": "Applicatie geregistreerd door",
+        "Who registered the application this version belongs to, copied from it. A supplier's application is public, and so are its versions.": "Wie de applicatie registreerde waar deze versie bij hoort, daarvan overgenomen. De applicatie van een leverancier is openbaar, en haar versies ook."
     },
     "nplurals=2; plural=(n != 1);"
 )
diff --git a/l10n/nl.json b/l10n/nl.json
index f26e94423..7de3e9617 100644
--- a/l10n/nl.json
+++ b/l10n/nl.json
@@ -1138,6 +1138,10 @@
         "Created in source": "Aangemaakt in de bron",
         "The date the application was registered in the source system.": "De datum waarop de applicatie in het bronsysteem is geregistreerd.",
         "Changed in source": "Gewijzigd in de bron",
-        "The date the application was last changed in the source system.": "De datum waarop de applicatie in het bronsysteem het laatst is gewijzigd."
+        "The date the application was last changed in the source system.": "De datum waarop de applicatie in het bronsysteem het laatst is gewijzigd.",
+        "Application published": "Applicatie gepubliceerd",
+        "The publication date of the application this version belongs to, copied from it. A version is public only while its application is.": "De publicatiedatum van de applicatie waar deze versie bij hoort, daarvan overgenomen. Een versie is alleen openbaar zolang haar applicatie dat is.",
+        "Application registered by": "Applicatie geregistreerd door",
+        "Who registered the application this version belongs to, copied from it. A supplier's application is public, and so are its versions.": "Wie de applicatie registreerde waar deze versie bij hoort, daarvan overgenomen. De applicatie van een leverancier is openbaar, en haar versies ook."
     }
 }
diff --git a/lib/AppInfo/Application.php b/lib/AppInfo/Application.php
index 57e9303b2..7e31c1f78 100644
--- a/lib/AppInfo/Application.php
+++ b/lib/AppInfo/Application.php
@@ -33,6 +33,7 @@
 use OCA\Stackiq\Dashboard\ConceptOrganisatiesWidget;
 use OCA\Stackiq\EventListener\DecisionConcludedListener;
 use OCA\Stackiq\EventListener\MaintenanceRecipientsListener;
+use OCA\Stackiq\EventListener\ModuleVersionPublicationListener;
 use OCA\Stackiq\EventListener\ModuleComplianceSubscriber;
 use OCA\Stackiq\EventListener\ModuleRegistrationSubscriber;
 use OCA\Stackiq\EventListener\TestEventListener;
@@ -811,6 +812,10 @@ private function registerEventListeners(IRegistrationContext $context): void {
 		// Queue the owner resolution when a supplier announces maintenance (lifecycle-maintenance-and-supplier-roadmap).
 		$context->registerEventListener(ObjectCreatedEvent::class, MaintenanceRecipientsListener::class);
 
+		// A module version is public only while its application is (publication-field-rules).
+		$context->registerEventListener(ObjectCreatedEvent::class, ModuleVersionPublicationListener::class);
+		$context->registerEventListener(ObjectUpdatedEvent::class, ModuleVersionPublicationListener::class);
+
 		// Sync user profile updates into the contactpersoon mirror.
 		$context->registerEventListener(UserProfileUpdatedEvent::class, UserProfileUpdatedEventListener::class);
 
diff --git a/lib/EventListener/ModuleVersionPublicationListener.php b/lib/EventListener/ModuleVersionPublicationListener.php
new file mode 100644
index 000000000..581ba7335
--- /dev/null
+++ b/lib/EventListener/ModuleVersionPublicationListener.php
@@ -0,0 +1,81 @@
+<?php
+
+/**
+ * Copies a module's publication onto its versions whenever either is saved.
+ *
+ * @category  EventListener
+ * @package   OCA\Stackiq\EventListener
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @link      https://github.com/ConductionNL/stackiq
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Stackiq\EventListener;
+
+use OCA\OpenRegister\Event\ObjectCreatedEvent;
+use OCA\OpenRegister\Event\ObjectUpdatedEvent;
+use OCA\Stackiq\Service\ModuleVersionPublicationService;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * Hands every created or updated object to the publication mirror.
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+ *
+ * @template-implements IEventListener<Event>
+ */
+class ModuleVersionPublicationListener implements IEventListener {
+
+	/**
+	 * Constructor.
+	 *
+	 * @param ModuleVersionPublicationService $publication The mirror.
+	 * @param LoggerInterface                 $logger      The logger.
+	 */
+	public function __construct(
+		private readonly ModuleVersionPublicationService $publication,
+		private readonly LoggerInterface $logger,
+	) {
+	}//end __construct()
+
+	/**
+	 * Handle an object event.
+	 *
+	 * @param Event $event The event.
+	 *
+	 * @return void
+	 *
+	 * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+	 */
+	public function handle(Event $event): void {
+		$object = null;
+		if ($event instanceof ObjectUpdatedEvent) {
+			$object = $event->getNewObject();
+		}
+
+		if ($event instanceof ObjectCreatedEvent) {
+			$object = $event->getObject();
+		}
+
+		if ($object === null) {
+			return;
+		}
+
+		try {
+			$this->publication->objectSaved(object: $object);
+		} catch (Throwable $e) {
+			$this->logger->error('ModuleVersionPublicationListener: could not mirror the publication', ['error' => $e->getMessage()]);
+		}
+	}//end handle()
+}//end class
diff --git a/lib/Repair/BackfillModuleVersionPublication.php b/lib/Repair/BackfillModuleVersionPublication.php
new file mode 100644
index 000000000..9a0b9b28f
--- /dev/null
+++ b/lib/Repair/BackfillModuleVersionPublication.php
@@ -0,0 +1,106 @@
+<?php
+
+/**
+ * Copies every module's publication onto its versions, once, on upgrade.
+ *
+ * Versions saved before publication-field-rules carry no mirrored publication,
+ * so for anonymous readers they read as unpublished until their module is
+ * saved again. That is the safe direction; this step makes the published ones
+ * public again without waiting for an edit. It is idempotent: a version that
+ * already holds its module's values is not written.
+ *
+ * @category  Repair
+ * @package   OCA\Stackiq\Repair
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @link      https://github.com/ConductionNL/stackiq
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Stackiq\Repair;
+
+use OCA\OpenRegister\Contract\ObjectEntityInterface;
+use OCA\Stackiq\Service\ModuleVersionPublicationService;
+use OCA\Stackiq\Service\SettingsService;
+use OCP\App\IAppManager;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+use Throwable;
+
+/**
+ * Backfills the mirrored publication on module versions.
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+ */
+class BackfillModuleVersionPublication implements IRepairStep {
+
+	/**
+	 * Constructor.
+	 *
+	 * @param IAppManager                     $appManager      Tells whether OpenRegister is installed.
+	 * @param SettingsService                 $settingsService Resolves the module schema and the object service.
+	 * @param ModuleVersionPublicationService $publication     The mirror.
+	 */
+	public function __construct(
+		private readonly IAppManager $appManager,
+		private readonly SettingsService $settingsService,
+		private readonly ModuleVersionPublicationService $publication,
+	) {
+	}//end __construct()
+
+	/**
+	 * The step's name.
+	 *
+	 * @return string The name.
+	 */
+	public function getName(): string {
+		return 'Copy each application\'s publication onto its versions';
+	}//end getName()
+
+	/**
+	 * Run the backfill.
+	 *
+	 * @param IOutput $output The output.
+	 *
+	 * @return void
+	 *
+	 * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+	 */
+	public function run(IOutput $output): void {
+		if (in_array('openregister', $this->appManager->getInstalledApps(), true) === false) {
+			$output->info('OpenRegister not installed, so there are no versions to update.');
+			return;
+		}
+
+		$register = $this->settingsService->getRegisterIdForObjectType('module');
+		$schema   = $this->settingsService->getSchemaIdForObjectType('module');
+		$objects  = $this->settingsService->getObjectService();
+		if ($register === null || $schema === null || $objects === null) {
+			$output->info('The module schema is not configured yet, so there are no versions to update.');
+			return;
+		}
+
+		try {
+			$modules = $objects->setRegister($register)->setSchema($schema)->findAll([], false, false);
+		} catch (Throwable $e) {
+			$output->warning('Could not read the applications: ' . $e->getMessage());
+			return;
+		}
+
+		$written = 0;
+		foreach ((array) $modules as $module) {
+			if (($module instanceof ObjectEntityInterface) === true) {
+				$written += $this->publication->moduleSaved(module: $module);
+			}
+		}
+
+		$output->info($written . ' versions now follow their application\'s publication.');
+	}//end run()
+}//end class
diff --git a/lib/Service/ModuleVersionPublicationService.php b/lib/Service/ModuleVersionPublicationService.php
new file mode 100644
index 000000000..0126dfb5d
--- /dev/null
+++ b/lib/Service/ModuleVersionPublicationService.php
@@ -0,0 +1,267 @@
+<?php
+
+/**
+ * Keeps a module version as public as its application, and no more.
+ *
+ * OpenRegister decides read access per object, and a read rule can only match
+ * fields of the object itself. A version's public rule therefore needs its
+ * application's publication on the version: `modulePublicationDate` and
+ * `moduleRegisteredBy`, copied from the module. This service copies them when
+ * a module is saved (onto all its versions) and when a version is saved (from
+ * its module). It writes only when a value differs, so the writes it causes
+ * end at the next event.
+ *
+ * @category  Service
+ * @package   OCA\Stackiq\Service
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @link      https://github.com/ConductionNL/stackiq
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Stackiq\Service;
+
+use OCA\OpenRegister\Contract\ObjectEntityInterface;
+use OCA\OpenRegister\Contract\ObjectServiceInterface;
+use Psr\Container\ContainerInterface;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * Copies a module's publication onto its versions.
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+ */
+class ModuleVersionPublicationService {
+
+	/**
+	 * The most versions one module save updates.
+	 *
+	 * @var integer
+	 */
+	public const VERSION_LIMIT = 500;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param SettingsService    $settingsService Resolves the module and moduleVersion schemas.
+	 * @param ContainerInterface $container       Resolves OpenRegister's object service.
+	 * @param LoggerInterface    $logger          The logger.
+	 */
+	public function __construct(
+		private readonly SettingsService $settingsService,
+		private readonly ContainerInterface $container,
+		private readonly LoggerInterface $logger,
+	) {
+	}//end __construct()
+
+	/**
+	 * The two fields a version mirrors from its module.
+	 *
+	 * @param array<string, mixed> $module The module's data.
+	 *
+	 * @return array{modulePublicationDate: string|null, moduleRegisteredBy: string|null}
+	 *
+	 * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+	 */
+	public static function mirrorOf(array $module): array {
+		return [
+			'modulePublicationDate' => self::text(value: ($module['publicationDate'] ?? null)),
+			'moduleRegisteredBy'    => self::text(value: ($module['registeredBy'] ?? null)),
+		];
+	}//end mirrorOf()
+
+	/**
+	 * A non-empty string, or null.
+	 *
+	 * @param mixed $value The value.
+	 *
+	 * @return string|null The string, or null when it is empty or not a string.
+	 */
+	private static function text(mixed $value): ?string {
+		if (is_string($value) === false || $value === '') {
+			return null;
+		}
+
+		return $value;
+	}//end text()
+
+	/**
+	 * React to a saved object: a module updates its versions, a version reads its module.
+	 *
+	 * @param ObjectEntityInterface $object The saved object.
+	 *
+	 * @return integer The number of versions written.
+	 *
+	 * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+	 */
+	public function objectSaved(ObjectEntityInterface $object): int {
+		$schema = (string) $object->getSchema();
+		if ($schema === (string) $this->settingsService->getSchemaIdForObjectType('module')) {
+			return $this->moduleSaved(module: $object);
+		}
+
+		if ($schema === (string) $this->settingsService->getSchemaIdForObjectType('moduleVersion')) {
+			return $this->versionSaved(version: $object);
+		}
+
+		return 0;
+	}//end objectSaved()
+
+	/**
+	 * Copy a module's publication onto every version of it that differs.
+	 *
+	 * @param ObjectEntityInterface $module The saved module.
+	 *
+	 * @return integer The number of versions written.
+	 *
+	 * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+	 */
+	public function moduleSaved(ObjectEntityInterface $module): int {
+		$objects  = $this->objectService();
+		$register = $this->settingsService->getRegisterIdForObjectType('moduleVersion');
+		$schema   = $this->settingsService->getSchemaIdForObjectType('moduleVersion');
+		if ($objects === null || $register === null || $schema === null) {
+			return 0;
+		}
+
+		try {
+			$versions = $objects->searchObjects(
+				query: ['register' => $register, 'schema' => $schema, 'module' => $module->getUuid(), '_limit' => self::VERSION_LIMIT],
+				_rbac: false,
+				_multitenancy: false
+			);
+		} catch (Throwable $e) {
+			$this->logger->error('ModuleVersionPublicationService: could not read the versions', ['error' => $e->getMessage()]);
+			return 0;
+		}
+
+		$mirror  = self::mirrorOf(module: (array) $module->getObject());
+		$written = 0;
+		foreach ((array) $versions as $version) {
+			if (($version instanceof ObjectEntityInterface) === true && $this->write(objects: $objects, version: $version, mirror: $mirror) === true) {
+				$written++;
+			}
+		}
+
+		return $written;
+	}//end moduleSaved()
+
+	/**
+	 * Copy the module's publication onto a saved version, when it differs.
+	 *
+	 * @param ObjectEntityInterface $version The saved version.
+	 *
+	 * @return integer 1 when the version was written, else 0.
+	 *
+	 * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+	 */
+	public function versionSaved(ObjectEntityInterface $version): int {
+		$objects  = $this->objectService();
+		$moduleId = self::referenceOf(value: (((array) $version->getObject())['module'] ?? null));
+		if ($objects === null || $moduleId === null) {
+			return 0;
+		}
+
+		try {
+			$module = $objects->find(
+				id: $moduleId,
+				register: $this->settingsService->getRegisterIdForObjectType('module'),
+				schema: $this->settingsService->getSchemaIdForObjectType('module'),
+				_rbac: false,
+				_multitenancy: false
+			);
+		} catch (Throwable $e) {
+			$module = null;
+		}
+
+		$data = [];
+		if ($module !== null) {
+			$data = (array) $module->getObject();
+		}
+
+		if ($this->write(objects: $objects, version: $version, mirror: self::mirrorOf(module: $data)) === true) {
+			return 1;
+		}
+
+		return 0;
+	}//end versionSaved()
+
+	/**
+	 * The id a reference holds: a uuid string, or an object with `id` or `uuid`.
+	 *
+	 * @param mixed $value The reference.
+	 *
+	 * @return string|null The id, or null when there is none.
+	 */
+	private static function referenceOf(mixed $value): ?string {
+		if (is_array($value) === true) {
+			$value = ($value['id'] ?? ($value['uuid'] ?? null));
+		}
+
+		return self::text(value: $value);
+	}//end referenceOf()
+
+	/**
+	 * Write the mirror onto a version when it differs from what the version holds.
+	 *
+	 * @param ObjectServiceInterface                                                   $objects The object service.
+	 * @param ObjectEntityInterface                                                    $version The version.
+	 * @param array{modulePublicationDate: string|null, moduleRegisteredBy: string|null} $mirror  The values to hold.
+	 *
+	 * @return boolean True when it was written.
+	 */
+	private function write(ObjectServiceInterface $objects, ObjectEntityInterface $version, array $mirror): bool {
+		$data = (array) $version->getObject();
+		if (($data['modulePublicationDate'] ?? null) === $mirror['modulePublicationDate']
+			&& ($data['moduleRegisteredBy'] ?? null) === $mirror['moduleRegisteredBy']
+		) {
+			return false;
+		}
+
+		try {
+			$objects->saveObject(
+				object: array_merge($data, $mirror),
+				extend: [],
+				register: $version->getRegister(),
+				schema: $version->getSchema(),
+				uuid: $version->getUuid(),
+				_rbac: false,
+				_multitenancy: false
+			);
+		} catch (Throwable $e) {
+			$this->logger->error(
+				'ModuleVersionPublicationService: could not copy the publication onto a version',
+				['uuid' => $version->getUuid(), 'error' => $e->getMessage()]
+			);
+			return false;
+		}
+
+		return true;
+	}//end write()
+
+	/**
+	 * Lazily resolve OpenRegister's object service.
+	 *
+	 * @return ObjectServiceInterface|null The service, or null when OpenRegister is absent.
+	 */
+	private function objectService(): ?ObjectServiceInterface {
+		try {
+			$service = $this->container->get(ObjectServiceInterface::class);
+			if ($service instanceof ObjectServiceInterface) {
+				return $service;
+			}
+		} catch (Throwable $e) {
+			$this->logger->debug('ModuleVersionPublicationService: ObjectService not resolvable', ['error' => $e->getMessage()]);
+		}
+
+		return null;
+	}//end objectService()
+}//end class
diff --git a/lib/Service/SettingsService.php b/lib/Service/SettingsService.php
index 3195de0f1..b8fa30d18 100644
--- a/lib/Service/SettingsService.php
+++ b/lib/Service/SettingsService.php
@@ -1677,7 +1677,10 @@ public function loadSettings(bool $force = false): array {
 								continue;
 							}
 
-							$softwareCatalogSettings = self::deepMergeConfig(base: $softwareCatalogSettings, overlay: $fragmentData);
+							$softwareCatalogSettings = self::keepHighestSchemaVersions(
+								before: $softwareCatalogSettings,
+								after: self::deepMergeConfig(base: $softwareCatalogSettings, overlay: $fragmentData)
+							);
 							$fragmentSig .= basename($fragmentFile) . ':' . md5($fragmentContent) . ';';
 						}
 					}//end if
@@ -7345,6 +7348,35 @@ public function setEolSyncStatus(array $status): void {
 		$this->config->setValueString($this->appName, self::EOL_SYNC_STATUS_KEY, json_encode($status));
 	}//end setEolSyncStatus()
 
+	/**
+	 * After a fragment merge, give every schema the highest version any file declared.
+	 *
+	 * A fragment's scalar `version` overwrites the one before it, so with plain
+	 * merging the fragment that sorts LAST decides a schema's version. A later
+	 * fragment that raised a version lost it to an earlier-named one that set a
+	 * lower number, and OpenRegister skips a schema whose version did not go up,
+	 * so the later fragment's properties never deployed. The highest number wins
+	 * instead, whatever the file names.
+	 *
+	 * @param array<string, mixed> $before The register before this fragment.
+	 * @param array<string, mixed> $after  The register after merging it.
+	 *
+	 * @return array<string, mixed> The merged register with the highest version per schema.
+	 *
+	 * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-003-a-fragment-never-lowers-a-schema-version
+	 */
+	private static function keepHighestSchemaVersions(array $before, array $after): array {
+		foreach (($after['components']['schemas'] ?? []) as $key => $schema) {
+			$previous = (string) ($before['components']['schemas'][$key]['version'] ?? '');
+			$current  = (string) ($schema['version'] ?? '');
+			if ($previous !== '' && ($current === '' || version_compare($previous, $current, '>') === true)) {
+				$after['components']['schemas'][$key]['version'] = $previous;
+			}
+		}
+
+		return $after;
+	}//end keepHighestSchemaVersions()
+
 	/**
 	 * Deep-merge a register fragment onto the base config (ADR-037).
 	 *
diff --git a/lib/Settings/register.d/publication-field-rules.json b/lib/Settings/register.d/publication-field-rules.json
new file mode 100644
index 000000000..ffe8456c4
--- /dev/null
+++ b/lib/Settings/register.d/publication-field-rules.json
@@ -0,0 +1,486 @@
+{
+  "$comment": "publication-field-rules: what of stackiq stays private when lane oc-pub publishes the landscape through OpenCatalogi. Property read rules keep contacts, owners, costs, service desk references and internal assessments for signed-in users; anonymous readers never get them. usage becomes public only from its publicationDate. moduleVersion follows its application's publication through two mirrored fields. A fragment REPLACES an authorization list, so usage carries all its existing read rules plus the public one; usage.interneAnnotation and organization.contactpersonen keep the rules they already have.",
+  "components": {
+    "schemas": {
+      "module": {
+        "version": "0.3.6",
+        "properties": {
+          "contactPerson": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "usages": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "dpiaDocumentRef": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "verwerkingsregisterRef": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          }
+        }
+      },
+      "moduleVersion": {
+        "version": "0.1.6",
+        "properties": {
+          "usages": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "modulePublicationDate": {
+            "type": "string",
+            "format": "date-time",
+            "title": "Application published",
+            "description": "The publication date of the application this version belongs to, copied from it. A version is public only while its application is.",
+            "visible": true,
+            "hideOnForm": true,
+            "facetable": false,
+            "order": 90
+          },
+          "moduleRegisteredBy": {
+            "type": "string",
+            "enum": [
+              "Municipality",
+              "Application",
+              "Collaboration",
+              "Supplier"
+            ],
+            "title": "Application registered by",
+            "description": "Who registered the application this version belongs to, copied from it. A supplier's application is public, and so are its versions.",
+            "visible": true,
+            "hideOnForm": true,
+            "facetable": false,
+            "order": 91
+          }
+        },
+        "authorization": {
+          "read": [
+            "authenticated",
+            {
+              "group": "public",
+              "match": {
+                "modulePublicationDate": {
+                  "$lte": "$now"
+                }
+              }
+            },
+            {
+              "group": "public",
+              "match": {
+                "moduleRegisteredBy": "Supplier"
+              }
+            }
+          ]
+        }
+      },
+      "suite": {
+        "version": "0.1.5",
+        "properties": {
+          "contactPerson": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          }
+        }
+      },
+      "catalogService": {
+        "version": "0.2.2",
+        "properties": {
+          "contactPerson": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          }
+        }
+      },
+      "connection": {
+        "version": "0.3.5",
+        "properties": {
+          "longDescription": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "dateInDevelopment": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "dateInUse": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "dateEndSupport": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "dateWithdrawn": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "nonMunicipalProvision": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "realisedWithIntermediaryModule": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "provider": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "service": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "registeredBy": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskSystem": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskRecordId": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskUrl": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskSyncedAt": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          }
+        }
+      },
+      "usage": {
+        "version": "1.5.5",
+        "properties": {
+          "provider": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "contactPerson": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "businessOwner": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "technicalOwner": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "participants": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "startDateAcquisition": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "startDatePlanned": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "startDateOutPhasing": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "startDateOutPhased": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "amefElements": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "elementRef": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "plannedReplacement": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "plannedReplacementDate": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "timeClassification": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "timeRationale": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "timeReviewDate": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "installedVersion": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskSystem": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskRecordId": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskUrl": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "serviceDeskSyncedAt": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "businessValue": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "technicalFit": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "riskScore": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "scoredOn": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "suggestedTimeClassification": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          }
+        },
+        "authorization": {
+          "read": [
+            {
+              "group": "gebruik-beheerder",
+              "match": {
+                "_organisation": "$organisation"
+              }
+            },
+            {
+              "group": "gebruik-beheerder",
+              "match": {
+                "consumer": "$organisation"
+              }
+            },
+            {
+              "group": "aanbod-beheerder",
+              "match": {
+                "_organisation": "$organisation"
+              }
+            },
+            {
+              "group": "aanbod-beheerder",
+              "match": {
+                "provider": "$organisation"
+              }
+            },
+            {
+              "group": "public",
+              "match": {
+                "publicationDate": {
+                  "$lte": "$now"
+                }
+              }
+            }
+          ]
+        }
+      },
+      "organization": {
+        "version": "0.5.3",
+        "properties": {
+          "contactsUid": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "xml": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "pki": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "registrationStatus": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          },
+          "mergedInto": {
+            "authorization": {
+              "read": [
+                "authenticated"
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/openspec/changes/publication-field-rules/design.md b/openspec/changes/publication-field-rules/design.md
new file mode 100644
index 000000000..0dce8d5f0
--- /dev/null
+++ b/openspec/changes/publication-field-rules/design.md
@@ -0,0 +1,42 @@
+# Design: publication-field-rules
+
+## D1. Field rules
+
+Each rule is `{"authorization": {"read": ["authenticated"]}}` on the property. OpenRegister's property RBAC strips the field from the rendered object for a reader outside the list, and withholds it from facets. Signed-in users keep reading them, as today.
+
+| Schema | Private fields |
+|---|---|
+| module | contactPerson, usages, dpiaDocumentRef, verwerkingsregisterRef |
+| moduleVersion | usages |
+| suite | contactPerson |
+| catalogService | contactPerson |
+| connection | longDescription, the four date fields, nonMunicipalProvision, realisedWithIntermediaryModule, provider, service, registeredBy, the four serviceDesk fields |
+| usage | provider, contactPerson, businessOwner, technicalOwner, participants, the four non-production dates, amefElements, elementRef, plannedReplacement(Date), the TIME fields, installedVersion, the four serviceDesk fields, the value assessment fields |
+| organization | contactsUid, xml, pki, registrationStatus, mergedInto |
+
+`publicationDate` stays readable on every schema, because the object read rules match on it.
+
+## D2. usage is public from its publication date
+
+`usage.authorization.read` is the four organisation rules it has today plus `{"group": "public", "match": {"publicationDate": {"$lte": "$now"}}}`. A fragment replaces an `authorization` list (`SettingsService::deepMergeConfig`, `replaceLists` for that key). Lane oc-pub's draft listed only the public rule. That would have removed every organisation's own read access.
+
+## D3. moduleVersion follows its application
+
+A read rule matches the object's own fields only. So the version gets `modulePublicationDate` and `moduleRegisteredBy`, and its rule becomes:
+
+`["authenticated", {public, modulePublicationDate <= now}, {public, moduleRegisteredBy = Supplier}]`
+
+These are the same two conditions as `module`'s public rules.
+
+`ModuleVersionPublicationService` copies the values:
+
+- when a module is saved, onto each of its versions;
+- when a version is saved, from its module.
+
+It writes only when a value differs, so its own writes stop after one event. `BackfillModuleVersionPublication` runs it for every module on upgrade.
+
+Until the backfill runs, an existing version is not public. That is the safe direction.
+
+## D4. The highest version wins
+
+`SettingsService::keepHighestSchemaVersions()` runs after each fragment merge. It gives every schema the highest `version` any file declared, so file names no longer decide.
diff --git a/openspec/changes/publication-field-rules/proposal.md b/openspec/changes/publication-field-rules/proposal.md
new file mode 100644
index 000000000..5db2f2eb3
--- /dev/null
+++ b/openspec/changes/publication-field-rules/proposal.md
@@ -0,0 +1,36 @@
+---
+kind: code
+depends_on:
+  - sharing-itsm-exchange
+---
+
+# Publish the landscape without its contacts, costs and internal judgements
+
+## Summary
+
+OpenCatalogi publishes stackiq's landscape (opencatalogi#1708, change `publish-from-stackiq`). OpenRegister then answers anonymous readers with whole objects, so a published application also shows its contact person, its DPIA document, and the organisations that use it. This change ships per-field read rules in stackiq, so those fields reach only signed-in users. It makes an organisation's applications in use public only from their publication date. It also stops a version of an unpublished application from being public.
+
+## Why
+
+Lane oc-pub found it live on the second Rotterdam stack (`oc-pub-STATE.md`). Anonymous search returned contact persons and internal fields of published applications. It also returned a version of an application that was not published.
+
+The fields belong to stackiq's schemas, so the rules ship in stackiq.
+
+## What stackiq has today
+
+- Schema read rules: `module` and `catalogService` are public from their `publicationDate`. `module` is also public when a supplier registered it. `moduleVersion`, `suite`, `compliancy` and the GEMMA schemas read `public` without a condition. `usage` and `connection` are readable by their organisations only. `catalogContract`, `contactPerson` and `aiSystem` are never public.
+- No property carries a read rule, except `usage.interneAnnotation` and `organization.contactpersonen`.
+- `moduleVersion` has no field that says whether its application is published. OpenRegister read rules match only fields of the object itself.
+- Fragments merge in file name order, and the last one decides a schema's `version` even when it is lower. A fragment that sorts early can then lose its version bump to one that sorts later, and OpenRegister skips the change (`sharing-itsm-exchange` design D1 met this).
+
+## What this change builds
+
+1. `lib/Settings/register.d/publication-field-rules.json`: `authorization.read: ["authenticated"]` on 52 properties of `module`, `moduleVersion`, `suite`, `catalogService`, `connection`, `usage` and `organization`. It covers contacts, owners, the service desk reference, internal assessments, planned replacement and the DPIA and processing register references.
+2. On `usage`, a public read rule from `publicationDate`. A fragment replaces an authorization list, so the fragment repeats `usage`'s existing read rules in full.
+3. On `moduleVersion`, two mirrored fields, `modulePublicationDate` and `moduleRegisteredBy`. A listener copies them from the module whenever either is saved, and a repair step backfills existing versions. The version's read rule becomes "signed in", or "public" under the same two conditions as its module.
+4. `SettingsService` keeps the highest schema version across fragments, whatever the file names.
+
+## Out of scope
+
+- OpenRegister still puts property-ruled values in `@self.relations` and `@self.description`, and in explicit `_facets` buckets. Lane or-gh fixes that in OpenRegister. These rules are proven on the object body.
+- `usage.interneAnnotation` and `organization.contactpersonen` keep their own rules. A fragment rule would replace them with a wider one.
diff --git a/openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md b/openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md
new file mode 100644
index 000000000..2f3097798
--- /dev/null
+++ b/openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md
@@ -0,0 +1,48 @@
+# publication-field-rules specification
+
+**Status**: proposed
+**Scope**: stackiq
+**OpenSpec changes**:
+- publication-field-rules
+
+## Purpose
+
+What OpenCatalogi publishes from stackiq contains no contacts, owners, service desk references, costs or internal judgements.
+
+## ADDED Requirements
+
+### Requirement: REQ-PFR-001 Contacts, costs and internal judgements stay with signed-in users
+
+The fields listed in the design SHALL be readable only by signed-in users. An anonymous reader SHALL get the published object without them. An organisation's application in use SHALL be public only from its publication date, and the organisation's own read access SHALL stay as it was.
+
+#### Scenario: An anonymous reader opens a published application
+@e2e exclude Read rules are enforced by OpenRegister on the API; verified by tests/Unit/Settings/PublicationFieldRulesTest.php and an anonymous API read on the test instance recorded in the PR.
+
+- **GIVEN** a published application with a contact person and a DPIA document
+- **WHEN** an anonymous reader reads it through the API
+- **THEN** the answer has its name and description
+- **AND** it has no contact person and no DPIA document
+
+### Requirement: REQ-PFR-002 A module version is public only while its application is
+
+A module version SHALL be readable by anonymous readers only when its application is: published by date, or registered by a supplier. Saving the application or the version SHALL keep the version in step.
+
+#### Scenario: A version of an unpublished application stays private
+@e2e exclude Verified by tests/Unit/Service/ModuleVersionPublicationServiceTest.php and an anonymous API read on the test instance recorded in the PR.
+
+- **GIVEN** an application without a publication date, registered by a municipality, with one version
+- **WHEN** an anonymous reader lists module versions
+- **THEN** that version is not in the answer
+- **WHEN** the application gets a publication date in the past
+- **THEN** the version is in the answer
+
+### Requirement: REQ-PFR-003 A fragment never lowers a schema version
+
+When register fragments are merged, every schema SHALL get the highest version any file declares, whatever the file names.
+
+#### Scenario: An earlier-named fragment raised the version
+@e2e exclude Merge logic; verified by tests/Unit/Settings/PublicationFieldRulesTest.php.
+
+- **GIVEN** fragment a.json sets usage 1.5.5 and fragment b.json sets usage 1.5.4
+- **WHEN** the register is merged
+- **THEN** usage is 1.5.5
diff --git a/openspec/changes/publication-field-rules/tasks.md b/openspec/changes/publication-field-rules/tasks.md
new file mode 100644
index 000000000..ad864e042
--- /dev/null
+++ b/openspec/changes/publication-field-rules/tasks.md
@@ -0,0 +1,32 @@
+# Tasks: publication-field-rules
+
+## Implementation tasks
+
+### Task 1: Field rules and the usage public rule
+- **spec_ref**: openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-001-contacts-costs-and-internal-judgements-stay-with-signed-in-users
+- **files**: `lib/Settings/register.d/publication-field-rules.json`, `tests/Unit/Settings/PublicationFieldRulesTest.php`
+- **acceptance_criteria**:
+  - GIVEN the merged register WHEN it is read THEN each listed property reads `authenticated` only, and usage keeps its organisation rules plus the public rule
+  - GIVEN interneAnnotation and contactpersonen WHEN merged THEN their rules are unchanged
+- [x] Implement
+- [x] Test
+
+### Task 2: moduleVersion follows its application
+- **spec_ref**: openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+- **files**: `lib/Service/ModuleVersionPublicationService.php`, `lib/EventListener/ModuleVersionPublicationListener.php`, `lib/Repair/BackfillModuleVersionPublication.php`, `lib/AppInfo/Application.php`, `appinfo/info.xml`, `tests/Unit/Service/ModuleVersionPublicationServiceTest.php`
+- **acceptance_criteria**:
+  - GIVEN a module saved with a publication date WHEN the listener runs THEN each version differing gets it; an equal one is not written
+  - GIVEN an anonymous reader WHEN a version of an unpublished application is read THEN it is not returned
+- [x] Implement
+- [x] Test
+
+### Task 3: The highest version wins
+- **spec_ref**: openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-003-a-fragment-never-lowers-a-schema-version
+- **files**: `lib/Service/SettingsService.php`, `tests/Unit/Settings/PublicationFieldRulesTest.php`
+- [x] Implement
+- [x] Test
+
+## Verification
+
+- `openspec validate publication-field-rules --strict`.
+- Live: anonymous read of a published application, a published usage and versions, on :8096.
diff --git a/tests/Unit/Service/ModuleVersionPublicationServiceTest.php b/tests/Unit/Service/ModuleVersionPublicationServiceTest.php
new file mode 100644
index 000000000..6795db18d
--- /dev/null
+++ b/tests/Unit/Service/ModuleVersionPublicationServiceTest.php
@@ -0,0 +1,212 @@
+<?php
+
+/**
+ * A module's publication copied onto its versions, and only when it differs.
+ *
+ * @category  Tests
+ * @package   OCA\Stackiq\Tests\Unit\Service
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @version   GIT: <git_id>
+ * @link      https://github.com/ConductionNL/stackiq
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md#requirement-req-pfr-002-a-module-version-is-public-only-while-its-application-is
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Stackiq\Tests\Unit\Service;
+
+use OCA\OpenRegister\Contract\ObjectEntityInterface;
+use OCA\OpenRegister\Contract\ObjectServiceInterface;
+use OCA\OpenRegister\Event\ObjectCreatedEvent;
+use OCA\Stackiq\EventListener\ModuleVersionPublicationListener;
+use OCA\Stackiq\Service\ModuleVersionPublicationService;
+use OCA\Stackiq\Service\SettingsService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Container\ContainerInterface;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Asserts what the mirror writes, and that the listener reaches it.
+ */
+class ModuleVersionPublicationServiceTest extends TestCase {
+
+	/**
+	 * The object service double.
+	 *
+	 * @var ObjectServiceInterface&MockObject
+	 */
+	private ObjectServiceInterface&MockObject $objects;
+
+	/**
+	 * An object with the six accessors of OpenRegister's entity contract.
+	 *
+	 * @param string               $uuid   The id.
+	 * @param string               $schema The schema id.
+	 * @param array<string, mixed> $data   The data.
+	 *
+	 * @return ObjectEntityInterface
+	 */
+	private static function entity(string $uuid, string $schema, array $data): ObjectEntityInterface {
+		return new class ($uuid, $schema, $data) implements ObjectEntityInterface {
+
+			/**
+			 * Constructor.
+			 *
+			 * @param string               $uuid   The id.
+			 * @param string               $schema The schema id.
+			 * @param array<string, mixed> $data   The data.
+			 */
+			public function __construct(private string $uuid, private string $schema, private array $data) {
+			}//end __construct()
+
+			/**
+			 * @return string|null
+			 */
+			public function getUuid(): ?string {
+				return $this->uuid;
+			}//end getUuid()
+
+			/**
+			 * @return array<string, mixed>
+			 */
+			public function getObject(): array {
+				return $this->data;
+			}//end getObject()
+
+			/**
+			 * @return string|null
+			 */
+			public function getRegister(): ?string {
+				return '20';
+			}//end getRegister()
+
+			/**
+			 * @return string|null
+			 */
+			public function getSchema(): ?string {
+				return $this->schema;
+			}//end getSchema()
+
+			/**
+			 * @return string|null
+			 */
+			public function getOrganisation(): ?string {
+				return null;
+			}//end getOrganisation()
+
+			/**
+			 * @return string|null
+			 */
+			public function getOwner(): ?string {
+				return null;
+			}//end getOwner()
+
+			/**
+			 * @return array<string, mixed>
+			 */
+			public function jsonSerialize(): array {
+				return $this->data;
+			}//end jsonSerialize()
+		};
+	}//end entity()
+
+	/**
+	 * The service, with module schema 43 and moduleVersion schema 46.
+	 *
+	 * @return ModuleVersionPublicationService
+	 */
+	private function service(): ModuleVersionPublicationService {
+		$settings = $this->getMockBuilder(SettingsService::class)
+			->disableOriginalConstructor()
+			->onlyMethods(['getSchemaIdForObjectType', 'getRegisterIdForObjectType'])
+			->getMock();
+		$settings->method('getSchemaIdForObjectType')->willReturnMap([['module', 43], ['moduleVersion', 46]]);
+		$settings->method('getRegisterIdForObjectType')->willReturn(20);
+
+		$this->objects = $this->createMock(ObjectServiceInterface::class);
+		$container     = $this->createMock(ContainerInterface::class);
+		$container->method('get')->willReturn($this->objects);
+
+		return new ModuleVersionPublicationService(settingsService: $settings, container: $container, logger: $this->createMock(LoggerInterface::class));
+	}//end service()
+
+	/**
+	 * Publishing a module writes its date onto the versions that differ, and leaves the one already in step.
+	 *
+	 * @return void
+	 */
+	public function testAPublishedModuleReachesTheVersionsThatDiffer(): void {
+		$service = $this->service();
+		$stale   = self::entity('v-1', '46', ['module' => 'm-1', 'version' => '1.0']);
+		$current = self::entity('v-2', '46', ['module' => 'm-1', 'version' => '2.0', 'modulePublicationDate' => '2026-09-01T00:00:00+00:00', 'moduleRegisteredBy' => 'Municipality']);
+		$this->objects->method('searchObjects')->willReturn([$stale, $current]);
+
+		$written = [];
+		$this->objects->expects($this->once())->method('saveObject')->willReturnCallback(
+			function (...$args) use (&$written, $stale) {
+				$written[] = $args;
+				return $stale;
+			}
+		);
+
+		$module = self::entity('m-1', '43', ['name' => 'Zaaksysteem', 'publicationDate' => '2026-09-01T00:00:00+00:00', 'registeredBy' => 'Municipality']);
+		$this->assertSame(1, $service->objectSaved(object: $module));
+		$this->assertSame('v-1', $written[0][4], 'only the stale version is written');
+		$this->assertSame('2026-09-01T00:00:00+00:00', $written[0][0]['modulePublicationDate']);
+		$this->assertSame('Municipality', $written[0][0]['moduleRegisteredBy']);
+		$this->assertSame('1.0', $written[0][0]['version'], 'the version keeps its own data');
+	}//end testAPublishedModuleReachesTheVersionsThatDiffer()
+
+	/**
+	 * Depublishing a module clears the date on its versions, so they stop being public.
+	 *
+	 * @return void
+	 */
+	public function testADepublishedModuleClearsItsVersions(): void {
+		$service = $this->service();
+		$this->objects->method('searchObjects')->willReturn([self::entity('v-1', '46', ['module' => 'm-1', 'modulePublicationDate' => '2026-09-01T00:00:00+00:00', 'moduleRegisteredBy' => 'Municipality'])]);
+		$this->objects->expects($this->once())->method('saveObject')->with($this->callback(static fn (array $data): bool => $data['modulePublicationDate'] === null));
+
+		$service->objectSaved(object: self::entity('m-1', '43', ['registeredBy' => 'Municipality']));
+	}//end testADepublishedModuleClearsItsVersions()
+
+	/**
+	 * A new version reads its module; a version already in step is not written, which ends the event chain.
+	 *
+	 * @return void
+	 */
+	public function testAVersionReadsItsModuleAndStopsWhenInStep(): void {
+		$service = $this->service();
+		$this->objects->method('find')->willReturn(self::entity('m-1', '43', ['registeredBy' => 'Supplier']));
+		$this->objects->expects($this->once())->method('saveObject')->with($this->callback(static fn (array $data): bool => $data['moduleRegisteredBy'] === 'Supplier'));
+
+		$this->assertSame(1, $service->objectSaved(object: self::entity('v-9', '46', ['module' => 'm-1'])));
+		$this->assertSame(0, $service->objectSaved(object: self::entity('v-9', '46', ['module' => 'm-1', 'modulePublicationDate' => null, 'moduleRegisteredBy' => 'Supplier'])));
+		$this->assertSame(0, $service->objectSaved(object: self::entity('x-1', '99', ['module' => 'm-1'])), 'other schemas are ignored');
+	}//end testAVersionReadsItsModuleAndStopsWhenInStep()
+
+	/**
+	 * The listener hands a created object to the service: the wiring from the caller.
+	 *
+	 * @return void
+	 */
+	public function testTheListenerReachesTheService(): void {
+		$service = $this->getMockBuilder(ModuleVersionPublicationService::class)
+			->disableOriginalConstructor()
+			->onlyMethods(['objectSaved'])
+			->getMock();
+		$object = $this->getMockBuilder(\OCA\OpenRegister\Db\ObjectEntity::class)->disableOriginalConstructor()->getMockForAbstractClass();
+		$service->expects($this->once())->method('objectSaved')->with($object)->willReturn(0);
+
+		(new ModuleVersionPublicationListener(publication: $service, logger: $this->createMock(LoggerInterface::class)))->handle(new ObjectCreatedEvent($object));
+
+		$app = (string) file_get_contents(__DIR__ . '/../../../lib/AppInfo/Application.php');
+		$this->assertStringContainsString('registerEventListener(ObjectCreatedEvent::class, ModuleVersionPublicationListener::class)', $app);
+		$this->assertStringContainsString('registerEventListener(ObjectUpdatedEvent::class, ModuleVersionPublicationListener::class)', $app);
+		$this->assertStringContainsString('OCA\\Stackiq\\Repair\\BackfillModuleVersionPublication', (string) file_get_contents(__DIR__ . '/../../../appinfo/info.xml'));
+	}//end testTheListenerReachesTheService()
+}//end class
diff --git a/tests/Unit/Settings/PublicationFieldRulesTest.php b/tests/Unit/Settings/PublicationFieldRulesTest.php
new file mode 100644
index 000000000..26bbafd55
--- /dev/null
+++ b/tests/Unit/Settings/PublicationFieldRulesTest.php
@@ -0,0 +1,169 @@
+<?php
+
+/**
+ * The publication field rules, merged the way the app merges its register.
+ *
+ * @category  Tests
+ * @package   OCA\Stackiq\Tests\Unit\Settings
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @version   GIT: <git_id>
+ * @link      https://github.com/ConductionNL/stackiq
+ *
+ * @spec openspec/changes/publication-field-rules/specs/publication-field-rules/spec.md
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Stackiq\Tests\Unit\Settings;
+
+use OCA\Stackiq\Service\SettingsService;
+use PHPUnit\Framework\TestCase;
+use ReflectionMethod;
+
+/**
+ * Asserts the field rules, the usage and version read rules, and that no fragment lowers a version.
+ */
+class PublicationFieldRulesTest extends TestCase {
+
+	/**
+	 * Merge one fragment after another, as SettingsService::loadSettings does.
+	 *
+	 * @param array<string, mixed> $base      The register so far.
+	 * @param array<string, mixed> $fragment  The fragment.
+	 *
+	 * @return array<string, mixed>
+	 */
+	private static function merge(array $base, array $fragment): array {
+		$deep = new ReflectionMethod(SettingsService::class, 'deepMergeConfig');
+		$keep = new ReflectionMethod(SettingsService::class, 'keepHighestSchemaVersions');
+
+		return $keep->invoke(null, $base, $deep->invoke(null, $base, $fragment));
+	}//end merge()
+
+	/**
+	 * The base register.
+	 *
+	 * @return array<string, mixed>
+	 */
+	private function base(): array {
+		return json_decode((string) file_get_contents(__DIR__ . '/../../../lib/Settings/softwarecatalogus_register.json'), true);
+	}//end base()
+
+	/**
+	 * Every fragment merged in file name order.
+	 *
+	 * @return array<string, mixed>
+	 */
+	private function register(): array {
+		$merged = $this->base();
+		$files  = glob(__DIR__ . '/../../../lib/Settings/register.d/*.json');
+		sort($files);
+		foreach ($files as $file) {
+			$merged = self::merge(base: $merged, fragment: json_decode((string) file_get_contents($file), true));
+		}
+
+		return $merged;
+	}//end register()
+
+	/**
+	 * Contacts, owners, service desk references and internal judgements read for signed-in users only.
+	 *
+	 * @return void
+	 */
+	public function testPrivateFieldsReadForSignedInUsersOnly(): void {
+		$schemas = $this->register()['components']['schemas'];
+		$private = [
+			'module'         => ['contactPerson', 'usages', 'dpiaDocumentRef', 'verwerkingsregisterRef'],
+			'moduleVersion'  => ['usages'],
+			'catalogService' => ['contactPerson'],
+			'connection'     => ['provider', 'serviceDeskRecordId', 'serviceDeskUrl', 'longDescription'],
+			'usage'          => ['businessOwner', 'technicalOwner', 'contactPerson', 'timeClassification', 'businessValue', 'installedVersion', 'serviceDeskUrl'],
+			'organization'   => ['contactsUid', 'xml', 'pki', 'registrationStatus', 'mergedInto'],
+		];
+		foreach ($private as $schema => $fields) {
+			foreach ($fields as $field) {
+				$this->assertArrayHasKey($field, $schemas[$schema]['properties'], $schema . '.' . $field . ' exists');
+				$this->assertSame(['read' => ['authenticated']], $schemas[$schema]['properties'][$field]['authorization'] ?? null, $schema . '.' . $field);
+				$this->assertArrayHasKey('type', $schemas[$schema]['properties'][$field], $schema . '.' . $field . ' is a real property, not a rule on nothing');
+			}
+		}
+
+		foreach (['module', 'catalogService', 'usage', 'connection'] as $schema) {
+			$this->assertArrayNotHasKey('authorization', $schemas[$schema]['properties']['publicationDate'] ?? [], $schema . '.publicationDate stays readable: the read rules match on it');
+		}
+	}//end testPrivateFieldsReadForSignedInUsersOnly()
+
+	/**
+	 * The two fields that already had rules keep exactly those rules.
+	 *
+	 * @return void
+	 */
+	public function testExistingFieldRulesAreNotWidened(): void {
+		$base   = $this->base()['components']['schemas'];
+		$merged = $this->register()['components']['schemas'];
+
+		$this->assertSame($base['usage']['properties']['interneAnnotation']['authorization'], $merged['usage']['properties']['interneAnnotation']['authorization']);
+		$this->assertSame($base['organization']['properties']['contactpersonen']['authorization'], $merged['organization']['properties']['contactpersonen']['authorization']);
+	}//end testExistingFieldRulesAreNotWidened()
+
+	/**
+	 * A usage keeps every organisation read rule and becomes public from its publication date.
+	 *
+	 * @return void
+	 */
+	public function testAUsageIsPublicFromItsPublicationDateAndOrganisationsKeepReading(): void {
+		$before = $this->base()['components']['schemas']['usage']['authorization']['read'];
+		$after  = $this->register()['components']['schemas']['usage']['authorization']['read'];
+
+		foreach ($before as $rule) {
+			$this->assertContains($rule, $after, 'an organisation read rule survived: ' . json_encode($rule));
+		}
+
+		$this->assertContains(['group' => 'public', 'match' => ['publicationDate' => ['$lte' => '$now']]], $after);
+		$this->assertCount(count($before) + 1, $after);
+	}//end testAUsageIsPublicFromItsPublicationDateAndOrganisationsKeepReading()
+
+	/**
+	 * A version is public under the same two conditions as its module, and signed-in users read every version.
+	 *
+	 * @return void
+	 */
+	public function testAVersionFollowsItsApplication(): void {
+		$schemas = $this->register()['components']['schemas'];
+		$module  = $schemas['module']['authorization']['read'];
+		$version = $schemas['moduleVersion']['authorization']['read'];
+
+		$this->assertContains(['group' => 'public', 'match' => ['publicationDate' => ['$lte' => '$now']]], $module);
+		$this->assertContains(['group' => 'public', 'match' => ['registeredBy' => 'Supplier']], $module);
+		$this->assertSame(
+			[
+				'authenticated',
+				['group' => 'public', 'match' => ['modulePublicationDate' => ['$lte' => '$now']]],
+				['group' => 'public', 'match' => ['moduleRegisteredBy' => 'Supplier']],
+			],
+			$version
+		);
+		$this->assertNotContains('public', $version, 'no unconditional public read is left');
+		$this->assertSame($schemas['module']['properties']['registeredBy']['enum'], $schemas['moduleVersion']['properties']['moduleRegisteredBy']['enum']);
+		$this->assertSame('date-time', $schemas['moduleVersion']['properties']['modulePublicationDate']['format']);
+	}//end testAVersionFollowsItsApplication()
+
+	/**
+	 * The highest declared version wins, whatever the file names.
+	 *
+	 * @return void
+	 */
+	public function testAFragmentNeverLowersAVersion(): void {
+		$base   = ['components' => ['schemas' => ['usage' => ['version' => '1.5.3', 'properties' => []]]]];
+		$merged = self::merge(base: $base, fragment: ['components' => ['schemas' => ['usage' => ['version' => '1.5.5']]]]);
+		$merged = self::merge(base: $merged, fragment: ['components' => ['schemas' => ['usage' => ['version' => '1.5.4']]]]);
+		$this->assertSame('1.5.5', $merged['components']['schemas']['usage']['version']);
+
+		$schemas = $this->register()['components']['schemas'];
+		$this->assertSame('1.5.5', $schemas['usage']['version'], 'publication-field-rules.json sorts before sharing-itsm-exchange.json and value-assessment.json');
+		$this->assertSame('0.3.5', $schemas['connection']['version']);
+		$this->assertSame('0.1.6', $schemas['moduleVersion']['version']);
+	}//end testAFragmentNeverLowersAVersion()
+}//end class
diff --git a/tests/live/publication-field-rules-live.sh b/tests/live/publication-field-rules-live.sh
new file mode 100755
index 000000000..c2a6ffcc8
--- /dev/null
+++ b/tests/live/publication-field-rules-live.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: EUPL-1.2
+# SPDX-FileCopyrightText: 2026 Conduction B.V.
+#
+# Live check of openspec/changes/publication-field-rules: what an anonymous
+# reader gets from OpenRegister's object API for stackiq's schemas.
+# It proves the rules on the object body. OpenRegister's own leaks through
+# @self.relations, @self.description and explicit _facets are lane or-gh's.
+#
+# Usage: NC=http://localhost tests/live/publication-field-rules-live.sh
+# (inside the Nextcloud container when the host port does not answer).
+# It creates its own objects, named "Publication check <stamp>".
+
+set -euo pipefail
+
+NC="${NC:-http://localhost:8096}"
+AUTH="${AUTH:-admin:admin}"
+OR="$NC/index.php/apps/openregister/api/objects/stackiq"
+FAIL=0
+STAMP=$(date +%s)
+
+ok() { printf '   ok    %s\n' "$*"; }
+bad() { printf '   FAIL  %s\n' "$*"; FAIL=1; }
+admin() { curl -s -u "$AUTH" -H 'OCS-APIRequest: true' -H 'Content-Type: application/json' "$@"; }
+anon() { curl -s -H 'Accept: application/json' "$@"; }
+id_of() { python3 -c 'import sys,json;print(json.load(sys.stdin)["@self"]["id"])'; }
+has() { python3 -c "import sys,json;d=json.load(sys.stdin);print('yes' if d.get('$1') not in (None,'',[]) else 'no')"; }
+listed() { python3 -c "import sys,json;d=json.load(sys.stdin);print('yes' if any(r.get('@self',{}).get('id')=='$1' for r in d.get('results',[])) else 'no')"; }
+
+PAST="2026-01-01T00:00:00+00:00"
+echo "== create a published and an unpublished application, each with one version"
+SUP=$(admin -X POST "$OR/organization" -d "{\"name\":\"Publication check $STAMP supplier\",\"type\":\"Supplier\"}" | id_of)
+MUN=$(admin -X POST "$OR/organization" -d "{\"name\":\"Publication check $STAMP municipality\",\"type\":\"Municipality\"}" | id_of)
+MA=$(admin -X POST "$OR/module" -d "{\"name\":\"Publication check $STAMP published\",\"provider\":\"$SUP\",\"registeredBy\":\"Municipality\",\"publicationDate\":\"$PAST\",\"dpiaDocumentRef\":\"/DPIA/secret.pdf\",\"verwerkingsregisterRef\":\"VR-77\"}" | id_of)
+MB=$(admin -X POST "$OR/module" -d "{\"name\":\"Publication check $STAMP unpublished\",\"provider\":\"$SUP\",\"registeredBy\":\"Municipality\"}" | id_of)
+VA=$(admin -X POST "$OR/moduleVersion" -d "{\"module\":\"$MA\",\"version\":\"1.0\"}" | id_of)
+VB=$(admin -X POST "$OR/moduleVersion" -d "{\"module\":\"$MB\",\"version\":\"1.0\"}" | id_of)
+
+echo "== the version carries its application's publication"
+[ "$(admin "$OR/moduleVersion/$VA" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("modulePublicationDate") or "")')" != "" ] && ok "published application's version holds its date" || bad "the version of the published application has no date"
+
+echo "== an anonymous reader gets the published application without its private fields"
+BODY=$(anon "$OR/module/$MA")
+[ "$(echo "$BODY" | has name)" = yes ] && ok "name is there" || bad "no name: $(echo "$BODY" | head -c 200)"
+[ "$(echo "$BODY" | has dpiaDocumentRef)" = no ] && ok "dpiaDocumentRef is not" || bad "dpiaDocumentRef leaks"
+[ "$(echo "$BODY" | has verwerkingsregisterRef)" = no ] && ok "verwerkingsregisterRef is not" || bad "verwerkingsregisterRef leaks"
+[ "$(admin "$OR/module/$MA" | has dpiaDocumentRef)" = yes ] && ok "a signed-in user still reads dpiaDocumentRef" || bad "the admin lost dpiaDocumentRef"
+
+echo "== an anonymous reader gets the version of the published application only"
+VERS=$(anon "$OR/moduleVersion?_limit=500")
+[ "$(echo "$VERS" | listed "$VA")" = yes ] && ok "version of the published application is listed" || bad "version of the published application is missing"
+[ "$(echo "$VERS" | listed "$VB")" = no ] && ok "version of the unpublished application is not" || bad "version of the unpublished application leaks"
+
+echo "== publishing the application publishes its version"
+admin -X PATCH "$OR/module/$MB" -d "{\"publicationDate\":\"$PAST\"}" >/dev/null
+[ "$(anon "$OR/moduleVersion?_limit=500" | listed "$VB")" = yes ] && ok "now listed" || bad "still hidden after publishing its application"
+
+echo "== an application in use is public only from its publication date, without its internal fields"
+UP=$(admin -X POST "$OR/usage" -d "{\"module\":\"$MA\",\"consumer\":\"$MUN\",\"status\":\"In production\",\"publicationDate\":\"$PAST\",\"timeClassification\":\"Invest\",\"installedVersion\":\"1.0\"}" | id_of)
+UN=$(admin -X POST "$OR/usage" -d "{\"module\":\"$MB\",\"consumer\":\"$MUN\",\"status\":\"Planned\",\"timeClassification\":\"Tolerate\"}" | id_of)
+USES=$(anon "$OR/usage?_limit=500")
+[ "$(echo "$USES" | listed "$UP")" = yes ] && ok "the published usage is listed" || bad "the published usage is missing"
+[ "$(echo "$USES" | listed "$UN")" = no ] && ok "the unpublished usage is not" || bad "the unpublished usage leaks"
+UBODY=$(anon "$OR/usage/$UP")
+[ "$(echo "$UBODY" | has status)" = yes ] && ok "status is there" || bad "no status"
+[ "$(echo "$UBODY" | has timeClassification)" = no ] && ok "timeClassification is not" || bad "timeClassification leaks"
+[ "$(echo "$UBODY" | has installedVersion)" = no ] && ok "installedVersion is not" || bad "installedVersion leaks"
+
+echo "== result"
+[ $FAIL = 0 ] && echo "   ALL PASSED" || echo "   FAILURES"
+exit $FAIL