Ok I think I misunderstood your suggestion.

So the event will provide a flag like $event->processChildren() or something with a better name and if that is false then the ContentAwareFactory will NOT add the children.

So the publish workflow listener would set this to false and it would add the published children.

What if you had another listener that wanted to only add children if the user had permissions to view them for other reasons (say documents are assigned permission and we only let users in the 'Staff' group modify documents in the 'Staff' group). This listener would then go through and add any viewable documents but it wouldnt know about the publish issue so it could potentially add document it shouldnt.

I saw you mentioned publish workflow could be used for this permission-based but I am just wondering how to avoid the event listeners stepping on each other's toes.