@@ -2,24 +2,27 @@
 '@objectstack/metadata-protocol': minor
 ---
 
-fix(metadata-protocol)!: the direct metadata save refuses an object whose name lacks its package's namespace prefix, as the package draft publish already does
+fix(metadata-protocol)!: the direct metadata save and the per-item publish refuse an object whose name lacks its package's namespace prefix, as the package draft publish already does
 
 Clause-②: no (narrowing)
 
-<!-- adr-0087: not-required (no-migration-prescription) a refusal at the direct (publish-mode) metadata save door of an object name that the package draft publish pre-flight, `os validate` and `os build` already refuse under ADR-0129 D2: no authorable key, spelling, export, error code or stored shape moves, and no stored row is read, rewritten or converted. A stored object whose name lacks its package's prefix keeps loading and serving; the repair is a new object under the prefixed name, which moves its table and so is the author's decision, not something a ledger entry can derive. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers this door (not already-registered); and the change is a door verdict, not a declaration or an export (not runtime-interface-only or type-surface-only). -->
+<!-- adr-0087: not-required (no-migration-prescription) a refusal at the direct (publish-mode) metadata save door and at the per-item publish door of an object name that the package draft publish pre-flight, `os validate` and `os build` already refuse under ADR-0129 D2: no authorable key, spelling, export, error code or stored shape moves, and no stored row is read, rewritten or converted. A stored object whose name lacks its package's prefix keeps loading and serving; the repair is a new object under the prefixed name, which moves its table and so is the author's decision, not something a ledger entry can derive. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers these doors (not already-registered); and the change is a door verdict, not a declaration or an export (not runtime-interface-only or type-surface-only). -->
 
-**BREAKING** (an accept-set narrowing on the metadata save door), shipped as `minor` under the launch-window convention for breaking changes.
+**BREAKING** (an accept-set narrowing on the metadata save and publish doors), shipped as `minor` under the launch-window convention for breaking changes.
 
-ADR-0129 D2: a package declares its prefix once (`manifest.namespace`), and every object it defines is named `${namespace}_${shortName}`. The package draft publish (`POST /api/v1/packages/:id/publish-drafts`) refused an object draft without that prefix with `NAMESPACE_PREFIX`, while a direct save of the very same name under the very same package was stored `active` and went live. That left an object whose own package could never publish a draft of it again, and two doors giving opposite verdicts on one name.
+ADR-0129 D2: a package declares its prefix once (`manifest.namespace`), and every object it defines is named `${namespace}_${shortName}`. The package draft publish (`POST /api/v1/packages/:id/publish-drafts`) refused an object draft without that prefix with `NAMESPACE_PREFIX`. Two other doors made that very same name `active` under the very same package: a direct save, and the publish of the single draft. That left an object whose own package could never publish a draft of it again, and three doors giving opposite verdicts on one name.
 
-- FROM: a publish-mode object save bound to a package that declares a namespace answered `200` and stored the object `active` when its name lacked the `${namespace}_` prefix. This covers `PUT /api/v1/meta/object/:name?package=:id` (and `saveMetaItem` in publish mode), including a save naming no package that the door writes into such a package because the object's stored rows are bound to it.
-- TO: it answers `422`, code `NAMESPACE_PREFIX`, with the sentence the draft publish gives for the same name, for example "Object 'v1_report' is missing the package namespace prefix. Rename it to 'rollup_v1_report' (namespace = 'rollup')." Nothing is written.
+- FROM: an object made `active` under a package that declares a namespace was accepted with `200` when its name lacked the `${namespace}_` prefix. Two doors did this:
+  - a publish-mode save: `PUT /api/v1/meta/object/:name?package=:id` (and `saveMetaItem` in publish mode), including a save naming no package that the door writes into such a package because the object's stored rows are bound to it;
+  - the promotion of a single draft: `POST /api/v1/meta/object/:name/publish?package=:id` (and `publishMetaItem`), including a publish naming no package whose draft the door promotes into such a package.
+- TO: both doors answer `422`, code `NAMESPACE_PREFIX`. The sentence is the one the draft publish gives for the same name, for example "Object 'v1_report' is missing the package namespace prefix. Rename it to 'rollup_v1_report' (namespace = 'rollup')."
+  - The save writes nothing.
+  - The publish promotes nothing, and the draft stays a draft.
 - Fix: name the object `${namespace}_${shortName}` (here `rollup_v1_report`), as `os validate`, `os build` and the draft publish already require. A package's namespace is the one it declares, or the one derived from its id when it was installed without one (`com.v1.rollup` is `rollup`).
 
 **Unchanged.**
 
-- A package that declares no namespace, and a save bound to no package, are not judged.
-- A draft save (`mode=draft`) stores as before; the draft publish judges the draft, as before, now with the same sentence the direct save gives.
+- A package that declares no namespace, and a save or publish bound to no package, are not judged.
+- A draft save (`mode=draft`) stores as before. The door that promotes the draft judges it, now with one sentence on all three doors.
 - `sys_*` names are exempt, as everywhere the rule runs.
-- Stored rows are not migrated and not refused on read. The next direct save of a stored object whose name lacks its package's prefix is refused.
-- Not judged by this change: the promotion of a single draft (`POST /api/v1/meta/object/:name/publish`, `publishMetaItem`).
+- Stored rows are not migrated and not refused on read. The next direct save or single-draft publish of a stored object whose name lacks its package's prefix is refused.
@@ -9,8 +9,9 @@ import { assertEngineDeleteDispatch, assertEngineUpdateDispatch, assertEngineFin
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 /**
- * [#24547 · ADR-0129 D2] The package namespace-prefix rule holds at BOTH
- * runtime doors that make an object live.
+ * [#24547 · ADR-0129 D2] The package namespace-prefix rule holds at ALL THREE
+ * runtime doors that make an object live under a package: the direct save,
+ * the package draft publish, and the per-item publish.
  *
  * ADR-0129 D2: a package declares its prefix once (`manifest.namespace`), and
  * every object it defines MUST be named `${namespace}_${shortName}`. The
@@ -38,7 +39,10 @@ import { ObjectStackProtocolImplementation } from './protocol.js';
  *  - a package-less publish save the door resolves INTO a namespaced package
  *    is judged as a save naming that package;
  *  - a draft save is unchanged, and the publish door still refuses its draft —
- *    with the same sentence the active door now answers.
+ *    with the same sentence the active door now answers;
+ *  - the per-item publish (`POST /meta/object/:name/publish`), which promoted
+ *    that draft `active` as well, refuses it with the same envelope and
+ *    sentence and promotes nothing, while a prefixed draft still publishes.
  */
 
 interface Row {
@@ -272,8 +276,8 @@ describe('[#24547 · ADR-0129 D2] the active save door refuses an object without
             packageId: PKG,
         }).then(() => undefined, (e: Error) => e);
 
-        // The draft save stores, as before — the publish pre-flight is the
-        // gate a draft answers to.
+        // The draft save stores, as before — the door that promotes a draft
+        // is the gate it answers to.
         await protocol.saveMetaItem({
             type: 'object',
             name: 'v1_report',
@@ -284,14 +288,67 @@ describe('[#24547 · ADR-0129 D2] the active save door refuses an object without
         expect(rowsFor(rows, 'v1_report')).toEqual([{ state: 'draft', package_id: PKG }]);
 
         const res = await protocol.publishPackageDrafts({ packageId: PKG } as any);
+        const itemRefusal = await protocol.publishMetaItem({
+            type: 'object',
+            name: 'v1_report',
+            packageId: PKG,
+        }).then(() => undefined, (e: Error) => e);
 
         expect(res).toMatchObject({ success: false, outcome: 'refused', publishedCount: 0, failedCount: 1 });
         expect(res.failed[0]).toMatchObject({ type: 'object', name: 'v1_report', code: 'NAMESPACE_PREFIX' });
-        // ONE rule, ONE sentence: the two doors cannot disagree on the verdict
-        // or on what the author is told to do about it.
+        // ONE rule, ONE sentence: the three doors cannot disagree on the
+        // verdict or on what the author is told to do about it.
         expect(activeRefusal).toBeInstanceOf(Error);
+        expect(itemRefusal).toBeInstanceOf(Error);
         expect(res.failed[0].error).toBe(activeRefusal!.message);
+        expect(itemRefusal!.message).toBe(activeRefusal!.message);
         // Nothing went live.
         expect(rowsFor(rows, 'v1_report')).toEqual([{ state: 'draft', package_id: PKG }]);
     });
+
+    it('the per-item publish refuses an unprefixed object draft under a namespaced package — NAMESPACE_PREFIX / 422, the draft stays a draft', async () => {
+        const { engine, rows } = makeStubEngine();
+        const protocol = new ObjectStackProtocolImplementation(engine);
+        await protocol.saveMetaItem({
+            type: 'object',
+            name: 'v1_report',
+            item: objectBody('v1_report'),
+            packageId: PKG,
+            mode: 'draft',
+        });
+
+        const outcome = await protocol.publishMetaItem({
+            type: 'object',
+            name: 'v1_report',
+            packageId: PKG,
+        }).then(() => 'published', (e: unknown) => e);
+
+        expect(outcome).toMatchObject({ code: 'NAMESPACE_PREFIX', status: 422 });
+        expect((outcome as Error).message).toMatch(/^Object 'v1_report' is missing the package namespace prefix\. /);
+        expect((outcome as Error).message).toContain(`Rename it to '${NS}_v1_report'`);
+        // Nothing promoted: no active row, the draft untouched.
+        expect(rowsFor(rows, 'v1_report')).toEqual([{ state: 'draft', package_id: PKG }]);
+    });
+
+    it('control: the per-item publish promotes a prefixed object draft under the same package', async () => {
+        const { engine, rows } = makeStubEngine();
+        const protocol = new ObjectStackProtocolImplementation(engine);
+        await protocol.saveMetaItem({
+            type: 'object',
+            name: `${NS}_v1_report`,
+            item: objectBody(`${NS}_v1_report`),
+            packageId: PKG,
+            mode: 'draft',
+        });
+
+        const res = await protocol.publishMetaItem({
+            type: 'object',
+            name: `${NS}_v1_report`,
+            packageId: PKG,
+        });
+
+        expect(res.success).toBe(true);
+        expect(rowsFor(rows, `${NS}_v1_report`)).toContainEqual({ state: 'active', package_id: PKG });
+        expect(rowsFor(rows, `${NS}_v1_report`)).not.toContainEqual({ state: 'draft', package_id: PKG });
+    });
 });
@@ -22900,11 +22900,13 @@ export class ObjectStackProtocolImplementation implements
      * `name` lacks the `${namespace}_` prefix of the package it is written
      * under, else `null`.
      *
-     * ONE judge for both runtime doors that ask the rule — the publish
-     * pre-flight of {@link publishPackageDrafts} and the direct (publish-mode)
-     * save of {@link saveMetaItem} — so they cannot give opposite verdicts on
-     * one name in one package again, nor tell the author two different things
-     * about it.
+     * ONE judge for the three runtime doors that make an object live under a
+     * package — the publish pre-flight of {@link publishPackageDrafts}, the
+     * direct (publish-mode) save of {@link saveMetaItem}, and the per-item
+     * publish of {@link publishMetaItem} (asked in
+     * {@link promoteDraftForPublish}, on the package the promotion writes
+     * under) — so they cannot give opposite verdicts on one name in one
+     * package again, nor tell the author different things about it.
      *
      * The namespace is the one the package DECLARES: its installed manifest,
      * where {@link installPackage} derives and persists one when the author
@@ -23376,9 +23378,12 @@ export class ObjectStackProtocolImplementation implements
         // ({@link publishPackageDrafts}) refused an unprefixed object draft
         // with `NAMESPACE_PREFIX`, while this save stored the very same name
         // `active` under the very same package — an object live under a name
-        // its own package's drafts could never publish again. Both doors now
-        // ask one judge ({@link objectNamespacePrefixViolation}) and answer
-        // its one authored prescription.
+        // its own package's drafts could never publish again. The three doors
+        // that make an object live under a package — this save, the publish
+        // pre-flight and the per-item publish ({@link publishMetaItem}, asked
+        // in {@link promoteDraftForPublish}) — ask one judge
+        // ({@link objectNamespacePrefixViolation}) and answer its one authored
+        // prescription.
         //
         // Judged against the package this save WRITES: the one it names, or
         // the one a package-less publish save resolved to above — the save IS
@@ -23388,9 +23393,10 @@ export class ObjectStackProtocolImplementation implements
         // wrong one. Before every gate that reads or reshapes the body, so a
         // refused name costs no parse and writes nothing.
         //
-        // Asked of a publish-mode save only. A draft is not live: the publish
-        // pre-flight judges it, batch-atomically and in one report with every
-        // other violation, which is that door's contract. Not asked of the
+        // Asked of a publish-mode save only. A draft is not live: whichever
+        // door promotes it judges it — the publish pre-flight batch-atomically
+        // and in one report with every other violation, the per-item publish
+        // before its promotion writes. Not asked of the
         // server-stated rewrites of a row this store already holds (`source`
         // set: the stored-metadata migration, the stored flow-credential move)
         // — they define no object, and refusing one would strand a repair of a
@@ -25618,6 +25624,31 @@ export class ObjectStackProtocolImplementation implements
                 );
             }
         }
+        // [#24547 · ADR-0129 D2] …and the namespace-prefix rule, the third
+        // door's turn: the per-item publish (`POST /meta/object/:name/publish`)
+        // made an object `active` under a namespaced package although its name
+        // lacks the `${namespace}_` prefix — the name the direct save and the
+        // publish pre-flight refuse. Asked with their judge
+        // ({@link objectNamespacePrefixViolation}) and their envelope
+        // (`NAMESPACE_PREFIX` / 422, the judge's sentence), on `promoteInto` —
+        // the package the active row is written under, as the D9.9 refusal
+        // above is — and before `repo.promoteDraft` writes, so nothing is
+        // promoted and the draft stays a draft. A promotion into no package,
+        // or into a package that declares no namespace, is not judged; nor is
+        // sealed managed content, for the D9.9 block's reason (its store
+        // refusal is that row's one answer). `publishPackageDrafts` also
+        // promotes through here, but its pre-flight has refused the same name
+        // with the same judge before any promotion runs, so this answers the
+        // per-item publish alone.
+        if (draftForGate && singularType === 'object' && !this.isSealedManagedItem(singularType, request.name)) {
+            const prefixViolation = this.objectNamespacePrefixViolation(request.name, promoteInto);
+            if (prefixViolation) {
+                const err: any = new Error(prefixViolation);
+                err.code = 'NAMESPACE_PREFIX';
+                err.status = 422;
+                throw err;
+            }
+        }
         // [#21470] …and the divergent `name` refusal, on the same body and for
         // the same reason: a draft stored before `saveMetaItem` judged every
         // type can carry a `name` that is not its row's, and promoting it
@@ -26598,8 +26629,9 @@ export class ObjectStackProtocolImplementation implements
         // one by the time they publish.
         //
         // [#24547] The verdict is {@link objectNamespacePrefixViolation}'s, the
-        // judge the direct save in {@link saveMetaItem} asks too, so the two
-        // doors give one verdict and one sentence for one name in one package.
+        // judge the direct save in {@link saveMetaItem} and the per-item
+        // publish ({@link promoteDraftForPublish}) ask too, so the three doors
+        // give one verdict and one sentence for one name in one package.
         /**
          * Every PRE-FLIGHT refusal of this batch, in one report.
          *