Summary: Ref T4345. This error is per object-type in the query implementations, not a mail/permissions issue. Without `didRejectResult()`, we can't distinguish between "restricted" and "unknown" for objects filtered by `willFilterPage()`. - Call `didRejectResult()` on commits. - Make `didRejectResult()` handle both existing policy exceptions and filtering. - Recover from partial objects (like commits) which are missing attached data required to figure out policies. Test Plan: Saw "Restricted Diffusion Commit" instead of "Unknown Object (Diffusion Commit)" when viewing nonvisible commit handle in Maniphest. Reviewers: btrahan, joshuaspence Reviewed By: joshuaspence Subscribers: epriestley Maniphest Tasks: T4345 Differential Revision: https://secure.phabricator.com/D13289