@@ -0,0 +1,13 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/lint': patch
+---
+
+fix(metadata-protocol): both publish doors judge a stored flow draft in its D2-converted spelling, as the save door does
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+A flow draft stored in a legacy ADR-0087 D2 spelling that the automation engine registers (a `get_record` node's `config.filters`, for one) saved as a draft, because the save door judges a flow in its converted spelling and stores the body as written, but the per-item publish (`POST /meta/flow/:name/publish`) and the package publish (`publish-drafts`) then refused it with `422 INVALID_METADATA` (`expression-invalid`, `flow-region-shape-invalid`), because both judged the raw stored body. Both doors, and the draft read's publish verdict, now judge the stored draft through the save door's conversion seam, with the full conversion chain the engine replays when it registers a stored row, and promote it as stored: the active row is the draft's bytes. A draft the flow rules still refuse once converted is refused with the issues its current spelling gets.
+
+The `flow-region-shape-invalid` explanation (`os explain`) now also names the server as a reader of the rule and the body it judges.
@@ -5515,7 +5515,9 @@ const FLOW_REGION_SHAPE_INVALID_EXPLANATION: RuleExplanation = {
       'same region check the engine runs when it registers the flow, and the message is the engine\'s ' +
       'refusal behind the flow\'s name. Like the engine it reports a flow\'s first malformed region, so a ' +
       'flow with two may need two fixes. A flow the flow schema refuses cannot be judged and is reported ' +
-      'as such, with the schema\'s issues.',
+      'as such, with the schema\'s issues. The server asks it too, when a flow is saved active or a draft ' +
+      'is published, of the flow with its legacy spellings converted to the current ones: the body the ' +
+      'engine registers.',
     'Not judged: a cycle in the flow\'s top-level graph, outside any region. The engine refuses that too, ' +
       'with a check this rule cannot reach.',
     'To fix a multi-exit region, add one node every exit of the region leads to; to fix a cycle, remove ' +
 
@@ -3,6 +3,10 @@
 /**
  * `flow-region-shape-invalid` — a flow the automation engine refuses to
  * register for its ADR-0031 region shape, refused at every authoring command.
+ * The runtime authoring gate reads it too, at the save of an active flow and
+ * at both publish doors (the per-item publish and the package publish), and
+ * judges the body the engine registers: the flow in its ADR-0087 D2-converted
+ * spelling (#21982, #29557).
  *
  * ## What it reports
  *
 
@@ -50,6 +50,7 @@ import type { ObjectStackProtocolImplementation } from './protocol.js';
 import { permissionSetOwnerBindingRefusal, runtimeHookWithoutBodyRefusal } from './protocol.js';
 import { objectBodyExtensionFieldSuffixRefusal } from './protocol-extension-field-suffix.js';
 import { datasourceCredentialsRefSaveRefusal } from './protocol-datasource-credentials-ref.js';
+import { storedFlowVerdictBody } from './protocol-flow-save-replay.js';
 import { evaluateRuntimeAuthoringGate } from './runtime-authoring-gate.js';
 import type { PackagedRuleCopyRefusal, RuntimeAuthoringIssue, RuntimeAuthoringVerdict, RuntimePendingDeclarations } from './runtime-authoring-gate.js';
 import { savedItemNameRefusal } from '@objectstack/metadata/view-container-name';
@@ -544,7 +545,9 @@ export async function draftPublishVerdict(
         type: singular,
         name: draft.name,
         state: 'active',
-        body: draft.body,
+        // [#29557] The body the promotion judges: a flow draft in its
+        // D2-converted spelling, every other draft as stored.
+        body: storedFlowVerdictBody(singular, draft.body),
         packageId: draft.packageId,
         ...(pending !== undefined ? { pending } : {}),
         ...(channel
 
@@ -29,6 +29,16 @@
  * imports from it; what it imports from elsewhere, it imports from where
  * `protocol.ts` imported it. Nothing re-exports this module, so the published
  * surface does not move.
+ *
+ * ## [#29557] The flow verdict body, one seam for every door that judges a flow
+ *
+ * {@link flowVerdictBody} below is the conversion the save door's fallback
+ * verdict (#21982) applies, and {@link storedFlowVerdictBody} is that same
+ * conversion asked of a STORED flow draft: the body the per-item publish, the
+ * package publish (both through `promoteDraftForPublish`) and the draft read's
+ * publish verdict (`draftPublishVerdict`) judge. One judge, one spelling: a
+ * legacy D2 spelling the save door accepted and stored raw is accepted at
+ * publish too, and what goes live is still the stored bytes.
  */
 
 import { ALL_CONVERSIONS, applyConversionsToFlow, type ConversionNotice } from '@objectstack/spec';
@@ -113,3 +123,39 @@ export async function flowSaveReplaysRetired(
     strikeCarried(active.body);
     return uncarried.size === 0;
 }
+
+/**
+ * [#21982] The body a flow is JUDGED in when the save door's canonicalizer did
+ * not resolve or threw: the request body with the spec's ADR-0087 D2
+ * conversions applied (`applyConversionsToFlow`), the full chain minus
+ * {@link FLOW_FALLBACK_VERDICT_NOT_REPLAYED}, with the retired entries when
+ * `includeRetired` says so. For the VERDICT only: the caller stores the body
+ * it was handed, never this one. A key no conversion rewrites is judged
+ * exactly as written.
+ */
+export function flowVerdictBody(body: unknown, options: { includeRetired: boolean }): unknown {
+    return applyConversionsToFlow(body, {
+        includeRetired: options.includeRetired,
+        excludeConversionIds: FLOW_FALLBACK_VERDICT_NOT_REPLAYED,
+    });
+}
+
+/**
+ * [#29557] The body a publish judges a STORED draft in: for a `flow`, the
+ * {@link flowVerdictBody} of the draft row with the retired entries included;
+ * every other type, the draft as stored. The two publish doors and the draft
+ * read's publish verdict judge through here and promote, store and serve the
+ * draft as stored.
+ *
+ * A stored draft is a row at rest, so the chain is the full one: the one the
+ * automation engine replays when it registers the published row (its stored-
+ * flow canonicalizer, which every caller but the save door calls with no
+ * options) and the one `applyConversionsToStoredItem` replays on read. The
+ * retired-entry predicate of the save door ({@link flowSaveReplaysRetired},
+ * #23903 ruling B') is not asked again: it judges authored input, and the
+ * draft's own save asked it, in draft mode as in publish mode. `type` is the
+ * singular type name.
+ */
+export function storedFlowVerdictBody(type: string, body: unknown): unknown {
+    return type === 'flow' ? flowVerdictBody(body, { includeRetired: true }) : body;
+}
@@ -117,9 +117,10 @@ export async function readMetaItem(host: Pick<ProtocolHost, 'artifactLockLayerAt
     // [#26707] A served DRAFT is decorated as above and then told what its
     // publish would refuse: the runtime gate's verdict on the stored draft
     // body ({@link draftPublishVerdict}), folded into `_diagnostics`
-    // ({@link withPublishVerdict}). Judged on the row as stored — the body
-    // the promotion judges — never on the governed, converted or redacted
-    // copy this read serves. The execution face serves no `_diagnostics`.
+    // ({@link withPublishVerdict}). Handed the row as stored — the body the
+    // promotion reads, and [#29557] converts for its verdict exactly as the
+    // promotion does — never the governed, converted or redacted copy this
+    // read serves. The execution face serves no `_diagnostics`.
     const serveDraft = async <T>(resolved: T, row: { metadata?: unknown; package_id?: string | null }): Promise<T> => {
         const served = await serveFormLayout(serveItem(resolved));
         if (execution || !served || typeof served !== 'object') return served;
 
@@ -29,7 +29,7 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { assertEngineDeleteDispatch, assertEngineUpdateDispatch, assertEngineFindOnePredicate } from '@objectstack/metadata-core';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch, assertEngineFindOnePredicate, hashSpec } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 /** The LIVE object universe: a deal with a formula field, and its account. */
@@ -974,3 +974,145 @@ describe('[#29007] a stored object carrying the retired titleFormat', () => {
         expect(saved.success).toBe(true);
     });
 });
+
+/**
+ * [#29557] A flow draft stored in a legacy ADR-0087 D2 spelling the engine
+ * registers (`get_record` `config.filters`, `flow-node-crud-filter-alias`). The
+ * save door judges a flow on the canonicalizer's fallback in its D2-converted
+ * spelling and stores the raw body (#21982), so the draft saves; both publish
+ * doors and the draft read judge the stored draft through the same seam, so it
+ * publishes, and what goes live is the stored bytes.
+ *
+ * The draft is the realistic one: a stored active row carries the spelling (a
+ * row at rest), and the author's draft re-save of it carries the same hit, so
+ * the save replays the full chain (#23903 ruling B'). This harness reaches no
+ * automation service, so every save takes the fallback.
+ */
+describe('[#29557] a stored flow draft in a legacy D2 spelling the engine registers', () => {
+    let warn: ReturnType<typeof vi.spyOn>;
+    beforeEach(() => {
+        warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+        delete process.env.OS_ALLOW_UNLINTED_METADATA_WRITES;
+    });
+    afterEach(() => {
+        warn.mockRestore();
+    });
+
+    /** start → get_record → end, the match map spelled under `filterKey`. */
+    const fetchFlow = (name: string, filterKey: 'filters' | 'filter') => ({
+        name,
+        label: name,
+        type: 'autolaunched',
+        nodes: [
+            { id: 'start', type: 'start', label: 'Start' },
+            { id: 'fetch', type: 'get_record', label: 'Fetch', config: { objectName: 'deal', [filterKey]: { name: 'Acme' }, outputVariable: 'deal' } },
+            { id: 'end', type: 'end', label: 'End' },
+        ],
+        edges: [
+            { id: 'e1', source: 'start', target: 'fetch' },
+            { id: 'e2', source: 'fetch', target: 'end' },
+        ],
+    });
+
+    /** The stored active row a legacy draft is a re-save of. */
+    async function seedActive(engine: any, body: { name: string }) {
+        await engine.insert('sys_metadata', {
+            type: 'flow',
+            name: body.name,
+            organization_id: null,
+            package_id: PKG,
+            state: 'active',
+            metadata: JSON.stringify(body),
+            checksum: hashSpec(body, 'flow'),
+            version: 1,
+        });
+    }
+
+    const storedConfig = (rows: Map<string, Row>, name: string, state: 'active' | 'draft') => {
+        const row = [...rows.values()].find((r) => r.type === 'flow' && r.name === name && r.state === state);
+        return row ? JSON.parse(row.metadata).nodes[1].config : undefined;
+    };
+
+    async function stageLegacy(name: string, body = fetchFlow(name, 'filters')) {
+        const { engine, rows } = makeStubEngine();
+        const protocol = new ObjectStackProtocolImplementation(engine);
+        await seedActive(engine, body);
+        const saved = await stageDraft(protocol, 'flow', body);
+        expect(saved).toMatchObject({ success: true, state: 'draft' });
+        // Stored as written: the conversion is the verdict's, never the row's.
+        expect(storedConfig(rows, name, 'draft')).toEqual({ objectName: 'deal', filters: { name: 'Acme' }, outputVariable: 'deal' });
+        return { engine, rows, protocol };
+    }
+
+    it('publishes through the per-item door, and the active row is the stored bytes', async () => {
+        const { rows, protocol } = await stageLegacy('legacy_fetch');
+
+        const published: any = await protocol.publishMetaItem({ type: 'flow', name: 'legacy_fetch', packageId: PKG } as any);
+
+        expect(published.success).toBe(true);
+        expect(storedConfig(rows, 'legacy_fetch', 'active')).toEqual({ objectName: 'deal', filters: { name: 'Acme' }, outputVariable: 'deal' });
+        expect(storedConfig(rows, 'legacy_fetch', 'draft')).toBeUndefined();
+    });
+
+    it('publishes through the package door, and the active row is the stored bytes', async () => {
+        const { rows, protocol } = await stageLegacy('legacy_fetch');
+
+        const published: any = await protocol.publishPackageDrafts({ packageId: PKG });
+
+        expect(published).toMatchObject({ success: true, publishedCount: 1, failedCount: 0 });
+        expect(storedConfig(rows, 'legacy_fetch', 'active')).toEqual({ objectName: 'deal', filters: { name: 'Acme' }, outputVariable: 'deal' });
+    });
+
+    it('its draft read reports no publish refusal for it', async () => {
+        const { rows, protocol } = await stageLegacy('legacy_fetch');
+        const stored = JSON.parse([...rows.values()].find((r) => r.name === 'legacy_fetch' && r.state === 'draft')!.metadata);
+
+        // The draft read's publish verdict, on the stored draft: nothing.
+        expect(await (protocol as any).draftPublishVerdict({ type: 'flow', name: 'legacy_fetch', body: stored, packageId: PKG }))
+            .toEqual([]);
+        // Served, it carries none of the rules the publish refused it on before.
+        // (The read's own schema half still judges the served body as stored;
+        // that seam is the read's, not the publish verdict's.)
+        const codes = ((await draftDiagnostics(protocol, 'flow', 'legacy_fetch')).errors ?? []).map((e) => e.code);
+        expect(codes).not.toContain('expression-invalid');
+        expect(codes).not.toContain('flow-region-shape-invalid');
+    });
+
+    /** The same flow with a conditional edge whose CEL does not parse. */
+    const brokenEdge = (name: string, filterKey: 'filters' | 'filter') => {
+        const flow = fetchFlow(name, filterKey);
+        flow.edges[1] = { ...flow.edges[1]!, type: 'conditional', condition: 'record.name ==' } as typeof flow.edges[number];
+        return flow;
+    };
+
+    /** The per-item door's 422 for a draft of `body`, staged as `stageLegacy` stages it. */
+    async function perItemRefusal(body: ReturnType<typeof fetchFlow>) {
+        const { engine } = makeStubEngine();
+        const protocol = new ObjectStackProtocolImplementation(engine);
+        await seedActive(engine, body);
+        await stageDraft(protocol, 'flow', body);
+        const err: any = await protocol.publishMetaItem({ type: 'flow', name: body.name, packageId: PKG } as any)
+            .then(() => null, (e: unknown) => e);
+        return { protocol, err };
+    }
+
+    const issueTriples = (issues: Array<{ rule?: string; path?: string; message: string }>) =>
+        issues.map((i) => [i.rule, i.path, i.message]).sort();
+
+    it('a draft still refused once converted is refused at both doors with the issues its canonical spelling gets', async () => {
+        const canonical = await perItemRefusal(brokenEdge('broken_fetch', 'filter'));
+        const legacy = await perItemRefusal(brokenEdge('broken_fetch', 'filters'));
+
+        expect({ code: canonical.err?.code, status: canonical.err?.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        expect(canonical.err.issues.map((i: any) => i.rule)).toContain('expression-invalid');
+        expect({ code: legacy.err?.code, status: legacy.err?.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        expect(issueTriples(legacy.err.issues)).toEqual(issueTriples(canonical.err.issues));
+
+        // The package door refuses the same draft, on the same issues, and
+        // publishes nothing.
+        const batch: any = await legacy.protocol.publishPackageDrafts({ packageId: PKG });
+        expect(batch).toMatchObject({ success: false, publishedCount: 0 });
+        expect(batch.failed.map((f: any) => f.name)).toEqual(['broken_fetch']);
+        expect(issueTriples(batch.failed[0].issues)).toEqual(issueTriples(canonical.err.issues));
+    });
+});
Original file line number	Diff line number	Diff line change
`@@ -3,6 +3,10 @@`
`3`	`3`	`/**`
`4`	`4`	* `flow-region-shape-invalid` — a flow the automation engine refuses to
`5`	`5`	`* register for its ADR-0031 region shape, refused at every authoring command.`
	`6`	`+ * The runtime authoring gate reads it too, at the save of an active flow and`
	`7`	`+ * at both publish doors (the per-item publish and the package publish), and`
	`8`	`+ * judges the body the engine registers: the flow in its ADR-0087 D2-converted`
	`9`	`+ * spelling (#21982, #29557).`
`6`	`10`	`*`
`7`	`11`	`* ## What it reports`
`8`	`12`	`*`