@@ -0,0 +1,15 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime): cloning a flow, and publishing a package's drafts, no longer fail on a `protection` block left in a row stored before the metadata save door refused it
+
+Clause-②: no
+
+Two runtime doors re-save a body the server builds from a stored row: the flow clone (`POST /api/v1/automation/:name/clone`), and the visibility flip of `POST /api/v1/packages/:id/publish-drafts`, which re-saves each of the package's apps still stored with `_unpublished: true`. The metadata save door now refuses a `protection` block with `400 VALIDATION_ERROR` (entry `23096-save-door-protection`). A row stored before that refusal can still carry a block, and both doors copied it into the body they saved.
+
+**FROM.** A clone of such a flow answered `400 VALIDATION_ERROR` about a block the admin never sent. The flip of such an app was refused the same way: the publish still answered `200`, the app stayed `_unpublished`, and the refusal was reported only under `unhideError`.
+
+**TO.** Both doors drop the `protection` block from the body they save, as the permission-set clone already does. The clone and the flip save, and the saved row carries no block. Nothing else in either body changes, and neither door states a `source`, so every other save-door check still applies. The block never bound anything: only a code package's loader translates `protection` into a lock, so dropping it changes no lock and no verdict.
+
+**Unchanged.** A flow or an app with no block is saved exactly as before.
@@ -17,7 +17,10 @@
  *  - `POST /:name/clone` asks the same rule of the copy, registers it, and saves
  *    it through the protocol's own save as a tenant row: no provenance on the
  *    saved body, env-wide; a save that fails withdraws the registration and
- *    relays the failure, so no clone is reported that would not survive.
+ *    relays the failure, so no clone is reported that would not survive;
+ *  - [#23120] a clone of a flow whose stored row still carries a `protection`
+ *    block saves a body without it (the save door refuses the block), and a
+ *    source with no block saves the body it always did.
  *
  * Harness as in `automation-packaged-base-lock.test.ts`: a REAL protocol over a
  * REAL `SchemaRegistry` answers every verdict, with the packaged flow
@@ -32,13 +35,18 @@ import { describe, it, expect, vi } from 'vitest';
 import { ObjectStackProtocolImplementation } from '@objectstack/metadata-protocol';
 import { SchemaRegistry } from '@objectstack/objectql';
 import { isCodeArtifactBody } from '@objectstack/metadata-core';
+import { FlowSchema } from '@objectstack/spec/automation';
 
 import { HttpDispatcher } from '../http-dispatcher.js';
 import type { HttpProtocolContext } from '../http-dispatcher.js';
 
 const PACKAGED = 'pkg_alert_flow';
 const PACKAGE_ID = 'com.example.pkg';
 const CUSTOMER = 'customer_flow';
+/** A tenant flow whose stored row predates the save door's `protection` refusal. */
+const LEGACY = 'legacy_locked_flow';
+/** The block such a row still carries: the save door now refuses it, and it never bound. */
+const LEGACY_BLOCK = { lock: 'full', reason: 'Stored before the metadata save door refused this block.' };
 
 /** The stamps a caller would send to claim the real package's provenance. */
 const ASSERTED = { _packageId: PACKAGE_ID, _provenance: 'package' };
@@ -60,6 +68,9 @@ function boot() {
     const flows = new Map<string, unknown>([
         [PACKAGED, { ...definitionOf(PACKAGED), ...ASSERTED }],
         [CUSTOMER, definitionOf(CUSTOMER)],
+        // As the engine binds a stored tenant row: `FlowSchema.parse` output,
+        // and `FlowSchema` declares `protection`, so the block rides along.
+        [LEGACY, FlowSchema.parse({ ...definitionOf(LEGACY), protection: LEGACY_BLOCK })],
     ]);
     const registerFlow = vi.fn((name: string, definition: unknown) => {
         flows.set(name, definition);
@@ -178,3 +189,56 @@ describe('[#20761, ADR-0126 §7.1] the clone door saves its copy as a tenant row
         expect(h.held('my_alert_copy')).toBeUndefined();
     });
 });
+
+/**
+ * [#23120, ADR-0010 §3.5] The body the clone door saves is composed by the
+ * server from a stored row, so it drops the `protection` block before it
+ * reaches `saveMetaItem`. The save door refuses the block on an
+ * environment-authored write (`400 VALIDATION_ERROR`); a row stored before
+ * that refusal still carries one, and only the package loader ever translated
+ * it into a lock, so dropping it changes no verdict.
+ *
+ * `protection` is spelled here, not read from `FLOW_CLONE_DROPPED_KEYS`: the
+ * key the save door refuses is the contract this pins, so removing it from
+ * that constant has to turn this red.
+ */
+describe('[#23120] a clone does not carry its source\'s stored `protection` block into the save', () => {
+    const COPY = { name: 'legacy_locked_flow_copy', label: 'Legacy copy' };
+    const MUTATED = ['name', 'label', 'status'];
+    const without = (body: Record<string, unknown>, keys: readonly string[]) => {
+        const copy = { ...body };
+        for (const key of keys) delete copy[key];
+        return copy;
+    };
+
+    it('a clone of a flow whose stored row carries the block saves, and the body it saves carries none', async () => {
+        const h = boot();
+        const source = h.held(LEGACY) as Record<string, unknown>;
+        // The fixture really carries the block, so this measures a drop and not an absence.
+        expect(source.protection).toEqual(LEGACY_BLOCK);
+
+        const { response } = await h.dispatcher.handleAutomation(`/${LEGACY}/clone`, 'POST', COPY, AUTHOR(), undefined);
+
+        expect(statusOf(response)).toBe(200);
+        expect(h.saveMetaItem).toHaveBeenCalledTimes(1);
+        const saved = h.saveMetaItem.mock.calls[0]![0] as { type: string; name: string; item: Record<string, unknown>; source?: unknown };
+        expect(saved).toMatchObject({ type: 'flow', name: COPY.name });
+        expect(saved.item).not.toHaveProperty('protection');
+        // No server-stated `source`: the clone stays an authoring write, judged by every gate.
+        expect(saved.source).toBeUndefined();
+        // Only the block went: everything else the source carries is saved.
+        expect(without(saved.item, MUTATED)).toEqual(without(source, [...MUTATED, 'protection']));
+        expect(h.registerFlow).toHaveBeenCalledWith(COPY.name, saved.item);
+        expect(dataOf(response)?.flow).not.toHaveProperty('protection');
+    });
+
+    it('control: a clone of a flow with no block saves the same body it always did', async () => {
+        const h = boot();
+        const { response } = await h.dispatcher.handleAutomation(`/${CUSTOMER}/clone`, 'POST', COPY, AUTHOR(), undefined);
+
+        expect(statusOf(response)).toBe(200);
+        expect(h.saveMetaItem).toHaveBeenCalledTimes(1);
+        const saved = h.saveMetaItem.mock.calls[0]![0] as { item: Record<string, unknown> };
+        expect(saved.item).toEqual({ ...definitionOf(CUSTOMER), name: COPY.name, label: COPY.label, status: 'draft' });
+    });
+});
@@ -0,0 +1,110 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#23120, ADR-0010 §3.5] The ADR-0045 visibility flip of
+ * `POST /packages/:id/publish-drafts` re-saves each `_unpublished` app of the
+ * package through `saveMetaItem`, and the body it re-saves is composed by the
+ * server from the stored row the app read returned. That body drops the
+ * `protection` block before it reaches the save door.
+ *
+ * The save door refuses a `protection` block on an environment-authored write
+ * with `400 VALIDATION_ERROR`, and the flip states no `source`, so it is one.
+ * A row stored before that refusal can still carry a block, and the flip used
+ * to copy it through: the save was refused, the app stayed `_unpublished`, and
+ * the publish answered 200 with the refusal under `unhideError` — a message the
+ * publisher cannot act on. The block binds nothing (only the package loader
+ * translates it into a lock, through `applyProtection`), so dropping it
+ * changes no verdict.
+ *
+ * Pinned at the flip itself: the protocol is a double whose `getMetaItems`
+ * answers the stored rows and whose `saveMetaItem` records the body it is
+ * handed. The save door's own refusal is pinned where it lives
+ * (`metadata-protocol`'s `protocol.save-door-protection.test.ts`). The
+ * `protection` key is spelled here, so removing the drop turns this red.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import { HttpDispatcher } from '../http-dispatcher.js';
+
+const PACKAGE_ID = 'com.workspace';
+
+/** The block a row stored before the save door's refusal still carries. */
+const LEGACY_BLOCK = { lock: 'full', reason: 'Stored before the metadata save door refused this block.' };
+
+const PKG_ADMIN = () => ({
+    request: {},
+    executionContext: {
+        userId: 'u_pkg_admin',
+        systemPermissions: ['manage_metadata', 'studio.access', 'setup.access'],
+    },
+}) as any;
+
+/**
+ * The publish-drafts door over a protocol double holding `apps` as stored
+ * rows. `seedApplied` is answered so the route's own seed fallback stays out
+ * of the way: this file reads the flip and nothing else.
+ */
+function makeDoor(apps: Array<Record<string, unknown>>) {
+    const publishPackageDrafts = vi.fn().mockResolvedValue({
+        success: true, publishedCount: 0, failedCount: 0, published: [], failed: [],
+        seedApplied: { success: true, inserted: 0 },
+    });
+    const getMetaItems = vi.fn().mockResolvedValue({ items: apps });
+    const saveMetaItem = vi.fn().mockResolvedValue({ success: true });
+    // The `/packages` domain answers 503 without a registry, so `objectql` is a
+    // registry and nothing else: the flip reads and writes through the protocol.
+    const services: Record<string, unknown> = {
+        protocol: { publishPackageDrafts, getMetaItems, saveMetaItem },
+        objectql: { registry: { getAllPackages: () => [] } },
+    };
+    const kernel: any = {
+        getService: (name: string) => (name in services ? Promise.resolve(services[name]) : null),
+        context: { getService: () => null, trigger: vi.fn() },
+    };
+    return { dispatcher: new HttpDispatcher(kernel), getMetaItems, saveMetaItem };
+}
+
+async function publishDrafts(apps: Array<Record<string, unknown>>) {
+    const door = makeDoor(apps);
+    const { response } = await door.dispatcher.handlePackages(
+        `/${PACKAGE_ID}/publish-drafts`, 'POST', {}, {}, PKG_ADMIN(),
+    );
+    const saved = door.saveMetaItem.mock.calls.map(
+        (call) => call[0] as { type: string; name: string; item: Record<string, unknown>; packageId?: unknown; source?: unknown },
+    );
+    return { response: response as any, saved, door };
+}
+
+describe('[#23120] the publish-drafts visibility flip re-saves no stored `protection` block', () => {
+    it('an app whose stored row carries the block flips, and the body it re-saves carries none', async () => {
+        const stored = { name: 'legacy_app', label: 'Legacy App', hidden: false, _unpublished: true, protection: LEGACY_BLOCK };
+        const { response, saved } = await publishDrafts([stored]);
+
+        expect(response?.status).toBe(200);
+        const data = response?.body?.data ?? response?.body;
+        expect(data?.unhiddenApps).toEqual(['legacy_app']);
+        expect(data).not.toHaveProperty('unhideError');
+
+        expect(saved).toHaveLength(1);
+        expect(saved[0]).toMatchObject({ type: 'app', name: 'legacy_app', packageId: PACKAGE_ID });
+        expect(saved[0]!.item).not.toHaveProperty('protection');
+        // No server-stated `source`: the flip stays a write every gate judges.
+        expect(saved[0]!.source).toBeUndefined();
+        // Only the block went, and the gate flipped.
+        const expected: Record<string, unknown> = { ...stored, _unpublished: false };
+        delete expected.protection;
+        expect(saved[0]!.item).toEqual(expected);
+        // The row the read answered is not mutated: it may be a cached object.
+        expect(stored.protection).toEqual(LEGACY_BLOCK);
+    });
+
+    it('control: an app with no block re-saves the same body it always did', async () => {
+        const stored = { name: 'plain_app', label: 'Plain App', hidden: true, _unpublished: true };
+        const { response, saved } = await publishDrafts([stored]);
+
+        expect(response?.status).toBe(200);
+        expect((response?.body?.data ?? response?.body)?.unhiddenApps).toEqual(['plain_app']);
+        expect(saved).toHaveLength(1);
+        expect(saved[0]!.item).toEqual({ ...stored, _unpublished: false });
+    });
+});
@@ -1729,16 +1729,30 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
                                 : Array.isArray((appsRes as any)?.items) ? (appsRes as any).items : [];
                             for (const app of apps) {
                                 if (app && typeof app === 'object' && app._unpublished === true && typeof app.name === 'string') {
+                                    // `false`, not a delete: ADR-0045 §3 makes
+                                    // publish/unpublish symmetric ("unpublish =
+                                    // re-hide"), so the gate stays a two-state
+                                    // flag rather than a key whose absence has
+                                    // to be re-derived. Whatever `hidden` the
+                                    // app carries is copied through untouched.
+                                    const item: Record<string, unknown> = { ...app, _unpublished: false };
+                                    // [#23120, ADR-0010 §3.5] …but not a
+                                    // `protection` block. This body is the
+                                    // server's, built from the stored row, and
+                                    // a row stored before the metadata save door
+                                    // refused the block can still carry one: the
+                                    // save would be refused with
+                                    // `400 VALIDATION_ERROR` and the app left
+                                    // `_unpublished`. Only the package loader
+                                    // translates the block into a lock, so it
+                                    // never bound and dropping it changes no
+                                    // verdict. Dropped from this copy only — the
+                                    // row the read returned is not mutated.
+                                    delete item.protection;
                                     await protocol.saveMetaItem({
                                         type: 'app',
                                         name: app.name,
-                                        // `false`, not a delete: ADR-0045 §3 makes
-                                        // publish/unpublish symmetric ("unpublish =
-                                        // re-hide"), so the gate stays a two-state
-                                        // flag rather than a key whose absence has
-                                        // to be re-derived. Whatever `hidden` the
-                                        // app carries is copied through untouched.
-                                        item: { ...app, _unpublished: false },
+                                        item,
                                         packageId: id,
                                         ...(body?.actor ? { actor: body.actor } : {}),
                                     });
 
@@ -122,8 +122,8 @@ export const FLOW_CLONE_STATUS = 'draft' as const;
 export const FLOW_CLONE_MUTATED_FIELDS = ['name', 'label', 'status'] as const;
 
 /**
- * Keys that must NOT survive onto a clone — the ADR-0010 protection envelope
- * plus the read-time decorations.
+ * Keys that must NOT survive onto a clone — the ADR-0010 protection envelope,
+ * the read-time decorations, and the package author's `protection` block.
  *
  * DERIVED from the spec, never restated: `MetadataProtectionFields` is the
  * declaration `FlowSchema` itself spreads, and `METADATA_READ_DECORATIONS` is
@@ -135,10 +135,21 @@ export const FLOW_CLONE_MUTATED_FIELDS = ['name', 'label', 'status'] as const;
  * The read decorations would usually be absent here — a clone reads its source
  * from the engine's flow map, not over `/meta` — but the strip costs nothing
  * and closes the case where a caller's source came through a served read.
+ *
+ * [#23120, ADR-0010 §3.5] `protection` is named, not derived, exactly as
+ * `PERMISSION_SET_CLONE_DROPPED_KEYS` names it: no spec export lists the block
+ * on its own. Only the package loader translates it into a lock
+ * (`applyProtection`, ADR-0010 Phase 4.3), and the metadata save door refuses
+ * it on an environment-authored write with `400 VALIDATION_ERROR`. A flow the
+ * loader registered arrives with it already stripped, but a flow bound from a
+ * row stored before that refusal still carries it — `FlowSchema` declares the
+ * key, so the parse keeps it — and a copy that kept it would be refused over a
+ * block the admin never sent. Dropping it changes no verdict: it never bound.
  */
 export const FLOW_CLONE_DROPPED_KEYS: readonly string[] = Object.freeze([
     ...METADATA_READ_DECORATIONS,
     ...Object.keys(MetadataProtectionFields),
+    'protection',
 ]);
 
 /**