feat(studio): render the publish door's advisory findings

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });

.changeset/render-publish-advisory-findings-5026.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/data-objectstack': minor
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+Studio surfaces the runtime authoring gate's advisory findings after a **publish**, not only after a save
+
+objectui#4133 / PR #4236 wired the gate's advisories to the save door and recorded, honestly, what that left unsurfaced: Studio's designer stages every edit as a `mode: 'draft'` save, drafts are never gated (the framework returns at its D1 early-return before a single rule runs), and the publish step that *is* gated returned no `advisories` field at all. So on the flow most tenants actually use, the author was told nothing at either door — for two different reasons, only one of which was objectui's.
+
+The second reason has expired. `PublishMetaItemResponseSchema` now declares the same optional, omitted-when-empty `advisories` key that `SaveMetaItemResponseSchema` has carried since #4717, and `publishMetaItem` populates it. Measured against the installed `@objectstack/spec` (17.2.0) rather than inferred from the version number: the key survives a `safeParse`, a half-shaped finding is rejected, and a clean publish omits the key entirely. That reading is now a test rather than a note, so a spec drift fails CI instead of silently re-muting the door.
+
+`MetadataClient.publish` and `MetadataClient.publishDraft` — the two methods over the single-item publish route `POST /meta/:type/:name/publish` — now report through the **same** sink, the same event and the same renderer the save door already used. No new UI shape: same warning tier, same 10s duration, same per-finding `rule` + `message` + `hint` formatting, findings still rendered verbatim as server prose. The wiring lands in the data layer rather than at the call sites, so `ResourceEditPage`'s Publish button and the runtime `RuntimeDraftBar` promotion (ObjectView / ReportView / DashboardView) are covered by one change, as are future ones.
+
+One thing had to differ, and it is the frame's verb. Save and Publish are two different buttons in this product, so a toast that says "Saved" after a Publish tells the author their change is still a draft — the opposite of what happened. `MetadataSaveAdvisoryEvent` therefore gains a required `door: 'save' | 'publish'` and the renderer picks `console.publishAdvisoryTitle` (added to all ten locale packs) accordingly. `door` exists because `mode` cannot answer this: a direct active save and a draft promotion both report `mode: 'publish'`, since both land the body in the active overlay. It is required rather than optional so a future third door cannot be wired without saying which one it is, and the renderer branches on it through an exhaustive switch with a `never` check, so adding a third member is a compile error rather than a silently wrong verb.
+
+**BREAKING for event constructors — `MetadataSaveAdvisoryEvent.door` is required.** Reading the event is unaffected: a listener that ignores `door` behaves exactly as before, and every other member is unchanged. Constructing one is a compile break — a door-less event literal that type-checked before now fails with TS2741, `Property 'door' is missing`. Measured on the emitted `dist/index.d.ts` of `@object-ui/data-objectstack` on both sides: that single required member is the entire non-comment delta of the package's published surface. **Migration:** add `door: 'save'` or `door: 'publish'` to the literal, whichever write it models — `'save'` for `PUT /meta/:type/:name`, `'publish'` for `POST /meta/:type/:name/publish`. Scored `minor` rather than `major` per the repo's version policy: objectui's major is pinned to `@objectstack`'s so that "same major means compatible" holds across the two repos, so objectui's own breaking changes ship as `minor` with the break named here (`scripts/check-changeset-no-major.mjs`). Every publishable package sits in one `fixed` group, so this entry carries the group.
+
+Unchanged, deliberately: the **batch** door. "Publish whole app" (`POST /packages/:id/publish-drafts`) still discards per-draft advisories server-side — objectstack#9343, open and unruled — and nothing here compensates for that from the client side. A test pins the absence, so a later traversal of a batch-shaped `published[]` cannot be added without turning it red.

packages/app-shell/src/providers/saveAdvisoryToast.test.ts

@@ -57,6 +57,7 @@ function event(overrides: Partial<MetadataSaveAdvisoryEvent> = {}): MetadataSave
  return {
  type: 'flow',
  name: 'nightly_purge',
+ door: 'save',
  mode: 'publish',
  advisories: [FINDING],
  ...overrides,
@@ -160,3 +161,109 @@ describe('emitSaveAdvisories (#4133)', () => {
  expect(description).toContain(FINDING.message);
  });
 });
+
+/**
+ * The publish door renders through this SAME function (objectui#5026) — same
+ * warning tier, same duration, same per-finding formatting. One source more,
+ * not one surface more. What must differ is the frame's verb, because in this
+ * product Save and Publish are two different buttons: a toast that says "Saved"
+ * after a Publish tells the author their change is still a draft, which is the
+ * opposite of what happened.
+ */
+describe('emitSaveAdvisories — the publish door (#5026)', () => {
+ const published = () => event({ door: 'publish' });
+
+ it('says "Published", not "Saved", when the findings came through the publish door', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ const [title] = sink.warning.mock.calls[0]!;
+ expect(title).toContain('Published');
+ expect(title).not.toContain('Saved');
+ });
+
+ it('keeps saying "Saved" for the save door — the existing wording is untouched', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save' }), t, sink);
+
+ expect(sink.warning.mock.calls[0]![0]).toContain('Saved');
+ });
+
+ it('reads the DOOR, not the mode — both doors report `mode: "publish"`', () => {
+ // The discriminating case: a direct active save also carries
+ // `mode: 'publish'`, so a renderer that branched on `mode` would call it a
+ // publish. Same mode on both events here; only `door` differs.
+ const saveSink = makeSink();
+ const publishSink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'save', mode: 'publish' }), t, saveSink);
+ emitSaveAdvisories(event({ door: 'publish', mode: 'publish' }), t, publishSink);
+
+ expect(saveSink.warning.mock.calls[0]![0]).toContain('Saved');
+ expect(publishSink.warning.mock.calls[0]![0]).toContain('Published');
+ });
+
+ it('is the same surface otherwise — warning tier, same body, same duration', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(published(), t, sink);
+
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ expect(sink.error).not.toHaveBeenCalled();
+ const [, opts] = sink.warning.mock.calls[0]!;
+ expect(opts!.description).toContain(FINDING.message);
+ expect(opts!.description).toContain(FINDING.hint);
+ expect(opts!.duration).toBeGreaterThanOrEqual(10_000);
+ });
+
+ it('says nothing on a clean publish', () => {
+ const sink = makeSink();
+
+ emitSaveAdvisories(event({ door: 'publish', advisories: [] }), t, sink);
+
+ expect(sink.warning).not.toHaveBeenCalled();
+ });
+});
+
+/**
+ * The exhaustiveness guarantee (#5026, contract-review condition 2).
+ *
+ * `door` being REQUIRED buys "every type-checked constructor must state a
+ * door". It does NOT by itself buy "the renderer handles the door it was
+ * given" — with a two-way ternary, a third union member would compile at its
+ * constructor, declare itself honestly, and still silently render "Saved",
+ * which is the exact class `door` exists to kill, reintroduced one level up.
+ *
+ * The compile-time half of the fix is the `never` check in `advisoryTitle`,
+ * enforced by `tsc` and not expressible here. What IS pinned here is its
+ * runtime consequence, which is what an untyped consumer would hit: an
+ * unhandled door must NOT come out wearing the save wording.
+ */
+describe('emitSaveAdvisories — the door union is handled exhaustively', () => {
+ it('refuses an unhandled door instead of silently calling it "Saved"', () => {
+ const sink = makeSink();
+ // An untyped consumer's event. The cast is the point: inside the type
+ // system this is unreachable, which is what the `never` check enforces.
+ const rogue = event({ door: 'rollback' as unknown as MetadataSaveAdvisoryEvent['door'] });
+
+ expect(() => emitSaveAdvisories(rogue, t, sink)).toThrow(/advisory door/);
+
+ // The load-bearing assertion: nothing was rendered. A wrong verb about a
+ // write that already touched the author's data is worse than no toast,
+ // and both emitters swallow this throw, so "no toast" is what ships.
+ expect(sink.warning).not.toHaveBeenCalled();
+ expect(sink.error).not.toHaveBeenCalled();
+ });
+
+ it('still handles every door the union actually declares', () => {
+ // The control for the case above: the refusal must be specific to an
+ // unhandled member, not a renderer that throws at everything.
+ for (const door of ['save', 'publish'] as const) {
+ const sink = makeSink();
+ emitSaveAdvisories(event({ door }), t, sink);
+ expect(sink.warning).toHaveBeenCalledTimes(1);
+ }
+ });
+});

packages/app-shell/src/providers/saveAdvisoryToast.ts

@@ -78,12 +78,66 @@ function formatFinding(f: MetadataSaveAdvisoryEvent['advisories'][number]): stri
 }
 
 /**
- * Announce the gate's advisory findings for a save that SUCCEEDED.
+ * The frame's verb, chosen by the door the write came through.
+ *
+ * An exhaustive `switch` with a `never` check rather than a two-way ternary,
+ * and the difference is the whole point of the field. A ternary answers
+ * "is it publish, else save" — so a THIRD door added to the union would
+ * compile everywhere, declare itself honestly at its constructor, and still
+ * silently render "Saved". That is precisely the silent-wrong-verb class
+ * `door` exists to kill, reintroduced one level up. Here a new member makes
+ * this function a compile error instead, which is the only form of the
+ * guarantee worth having: the type must not merely be STATED, it must be
+ * HANDLED.
+ *
+ * The `default` branch is unreachable for type-checked callers — it exists
+ * for an untyped one (the event type is published, and JS consumers are not
+ * bound by it). It throws rather than falling back to the save wording,
+ * because both emitters wrap the sink in a try/catch that swallows: the
+ * failure mode is therefore "no toast", never "a toast that says the wrong
+ * thing about what just happened to the author's data".
+ */
+function advisoryTitle(ev: MetadataSaveAdvisoryEvent, t: TranslateFn): string {
+ const count = ev.advisories.length;
+ switch (ev.door) {
+ case 'save':
+ return t('console.saveAdvisoryTitle', {
+ count,
+ defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
+ });
+ case 'publish':
+ return t('console.publishAdvisoryTitle', {
+ count,
+ defaultValue: 'Published — the authoring check raised {{count}} advisory finding(s)',
+ });
+ default: {
+ const unhandled: never = ev.door;
+ throw new Error(
+ `saveAdvisoryToast: no title for advisory door ${JSON.stringify(unhandled)}`,
+ );
+ }
+ }
+}
+
+/**
+ * Announce the gate's advisory findings for a metadata write that SUCCEEDED.
  *
  * Says nothing when there is nothing to say: the server omits `advisories`
- * entirely on a clean save, so the common case never reaches here, and an event
- * that somehow carried an empty list is dropped rather than toasted as
+ * entirely on a clean write, so the common case never reaches here, and an
+ * event that somehow carried an empty list is dropped rather than toasted as
  * "0 findings".
+ *
+ * ## One renderer, two doors (#5026)
+ *
+ * The publish door reports through this same function, the same warning tier,
+ * the same duration and the same per-finding formatting — a second SOURCE, not
+ * a second surface. Only the frame's verb changes, and it has to: Save and
+ * Publish are two different buttons in this product, so "Saved" after a Publish
+ * would tell the author their change is still a draft. `ev.door` is what says
+ * which one, because `ev.mode` cannot — a direct active save and a draft
+ * promotion both report `mode: 'publish'`. The choice is an exhaustive switch,
+ * not a two-way test: see {@link advisoryTitle} for why that distinction is
+ * the field's actual guarantee.
  */
 export function emitSaveAdvisories(
  ev: MetadataSaveAdvisoryEvent,
@@ -93,10 +147,7 @@ export function emitSaveAdvisories(
  if (!ev.advisories || ev.advisories.length === 0) return;
 
  sink.warning(
- t('console.saveAdvisoryTitle', {
- count: ev.advisories.length,
- defaultValue: 'Saved — the authoring check raised {{count}} advisory finding(s)',
- }),
+ advisoryTitle(ev, t),
  {
  description: ev.advisories.map(formatFinding).join('\n'),
  duration: ADVISORY_TOAST_MS,

packages/data-objectstack/src/index.ts

@@ -2750,6 +2750,12 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
  this.emitSaveAdvisory({
  type,
  name,
+ // #5026 — this interceptor wraps `meta.saveItem`, the SAVE door
+ // (`PUT /meta/:type/:name`) and only that one. The SDK's publish
+ // door (`meta.publishItem`) has no caller in this repo, so wiring
+ // it here would be a surface with no consumer; `MetadataClient` is
+ // where the publish door is actually taken.
+ door: 'save',
  mode: (result as { state?: string } | null | undefined)?.state === 'draft' ? 'draft' : 'publish',
  advisories,
  });