@@ -0,0 +1,19 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/spec': patch
+---
+
+fix(runtime)!: `POST /packages/:id/publish-drafts` refuses a change note that is not a string with `400 VALIDATION_ERROR` naming `message`, instead of publishing with the default note (#28452)
+
+Clause-②: no (narrowing) — a body whose `message` is not a string (a number, an object, an array, `null`), which the door answered `200` with the default note, is refused `400 VALIDATION_ERROR` before anything is published. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type changes: the door now enforces the `message?: string` that PublishPackageDraftsRequestSchema already declares. Nothing was stored for the refused bodies (the note was dropped), so there is nothing for a migration to rewrite. -->
+
+**BREAKING** accept-set narrowing at the publish-drafts door (`@objectstack/runtime`).
+
+The door parses `message` with `PublishPackageDraftsRequestSchema`'s own member. A note the declaration refuses used to be dropped silently: the publish went ahead, every history row recorded the sentence naming the package, and the caller never learnt its note was ignored. Now the request is refused, nothing is published and no history row is written, and the same drafts publish once the note is sent as a string.
+
+Unchanged: a string note (empty too) publishes with that note; no body, or no `message`, publishes with the default note; unknown keys are still ignored, so `@objectstack/client`'s `packages.publishDrafts` still works when it sends its deprecated `opts.actor`; a malformed `backfill` is still refused once, by the protocol's own judgement, with the same answer as before.
+
+This supersedes the sentence "Nothing changes on the wire: the door reads the body as it did before this declaration" in the pending `@objectstack/spec` changeset for `PublishPackageDraftsRequestSchema`: from this release the door refuses a non-string `message`. The `@objectstack/spec` patch is that declaration's docblock, which now says so.
@@ -160,6 +160,26 @@ describe('publish-drafts records the change note and the session user (ADR-0146
         expect(commit?.actor).toBe('u_alice');
     });
 
+    it('a note that is not a string is refused 400 VALIDATION_ERROR naming `message`: nothing is published and no history row is written', async () => {
+        const env = await boot();
+        await draftViews(env.protocol, ['notes_open']);
+
+        for (const message of [42, {}, []]) {
+            const body = { message };
+            const result = await env.dispatcher.handlePackages(`/${PKG}/publish-drafts`, 'POST', body, {}, caller('u_alice'));
+            const response: any = result.response;
+            expect(response?.status, JSON.stringify(body)).toBe(400);
+            expect(response?.body?.error?.code, JSON.stringify(body)).toBe('VALIDATION_ERROR');
+            expect(response?.body?.error?.message, JSON.stringify(body)).toMatch(/^Invalid publish-drafts body .*\bmessage: /);
+        }
+        const history = (await env.engine.find('sys_metadata_history', { where: {} })) as any[];
+        expect(history.filter((r) => r.operation_type === 'publish')).toEqual([]);
+        expect(await env.engine.find('sys_metadata_commit', { where: { package_id: PKG } })).toEqual([]);
+        // The draft is still pending: the same draft publishes once the note is a string.
+        const { history: published } = await publish(env, { message: 'Open notes list' });
+        expect(published.map((r) => [r.name, r.change_note])).toEqual([['notes_open', 'Open notes list']]);
+    });
+
     it('a caller with no user id records no actor, never the body’s', async () => {
         const env = await boot();
         await draftViews(env.protocol, ['notes_open']);
 
@@ -10,11 +10,13 @@
  * written without (`route-ledger.ts`, the field's JSDoc), and the reason the
  * `POST /packages/:id/publish-drafts` row may carry
  * `requestSchema: 'PublishPackageDraftsRequestSchema'`. The request schema
- * declares the body; it does not claim the door parses the body with it. So
- * each member's behaviour at the door is pinned here as measured:
+ * declares the body, and each member's behaviour at the door is pinned here as
+ * measured:
  *
- * - `message` — a string reaches `publishPackageDrafts` as sent; a non-string
- *   is dropped (the publish goes ahead with no note), not refused;
+ * - `message` — a string reaches `publishPackageDrafts` as sent; a body the
+ *   schema refuses for its note (a number, an object, an array, `null`) is
+ *   refused `400 VALIDATION_ERROR` naming `message` before anything is
+ *   published;
  * - `backfill` — reaches the protocol as sent, and a body the schema refuses
  *   is refused by the protocol's shape judgement `400 VALIDATION_ERROR`
  *   before anything is published (the real protocol, below);
@@ -144,14 +146,21 @@ describe('publish-drafts request body conforms to PublishPackageDraftsRequestSch
         expect(bodyMembersSent(sent)).toEqual({});
     });
 
-    it('a note the schema refuses is dropped by the door, not refused: the publish goes ahead with no note', async () => {
-        // Measured divergence: the schema declares `message` a string and the
-        // door forwards only a string, but answers 200 for anything else. A
-        // door that parses the body with the schema flips this pin to a 400.
-        expect(PublishPackageDraftsRequestSchema.safeParse({ message: 42 }).success).toBe(false);
-        const { response, sent } = await publishWith({ message: 42 });
-        expect(response.status).toBe(200);
-        expect(bodyMembersSent(sent)).toEqual({});
+    it('a note the schema refuses is refused 400 VALIDATION_ERROR naming `message`, before anything is published', async () => {
+        // The door parses `message` with the schema's own member, so a body the
+        // schema refuses for its note is refused here, not published with no note.
+        for (const body of [{ message: 42 }, { message: {} }, { message: [] }, { message: null }, { actor: 'x', message: 7 }]) {
+            expect(PublishPackageDraftsRequestSchema.safeParse(body).success, JSON.stringify(body)).toBe(false);
+            const publishPackageDrafts = vi.fn();
+            const door = makeDoor({ publishPackageDrafts });
+            const result = await door.dispatcher.handlePackages(`/${PKG}/publish-drafts`, 'POST', body, {}, PKG_ADMIN());
+            const response = result.response as any;
+            expect(response.status, JSON.stringify(body)).toBe(400);
+            expect(response.body?.error?.code, JSON.stringify(body)).toBe('VALIDATION_ERROR');
+            expect(response.body?.error?.message, JSON.stringify(body)).toMatch(/^Invalid publish-drafts body .*\bmessage: /);
+            expect(publishPackageDrafts, JSON.stringify(body)).not.toHaveBeenCalled();
+            expect(door.saveMetaItem, JSON.stringify(body)).not.toHaveBeenCalled();
+        }
     });
 
     it('the ADR-0045 app re-save after the publish records the caller too: a body `actor` reaches no write', async () => {
 
@@ -150,6 +150,7 @@ import {
     PackageInstallBodySchema,
     PackageInstallManifestSchema,
     PackageInstallRequestSchema,
+    PublishPackageDraftsRequestSchema,
 } from '@objectstack/spec/api';
 
 /**
@@ -1914,6 +1915,38 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
                 if (packageIsUnknown(registry, id)) {
                     return { handled: true, response: deps.error(`Package '${id}' not found`, 404) };
                 }
+                // [#28452] The note is parsed with the declaration's own
+                // member, `PublishPackageDraftsRequestSchema.shape.message`,
+                // and a note it refuses (a number, an object, an array,
+                // `null`) is refused here `400` (`VALIDATION_ERROR`, derived
+                // from the status as the install door's legs derive it) before
+                // anything is published. It used to be dropped, so the publish
+                // went ahead and every history row recorded the default note,
+                // and the caller never learnt its note was ignored.
+                //
+                // ⛔ Only `message` is judged here. `backfill` keeps its one
+                // refusal, the protocol's shape judgement below (same status,
+                // code and `issues[]` as before); parsing it here too would be a
+                // second judge with a second sentence. Unknown keys are not
+                // read at all, so a body `actor` (the SDK's deprecated
+                // `opts.actor`) still publishes. Placed beside that backfill
+                // judgement, after the 404, so both body-member refusals sit at
+                // one point of the door's order.
+                const declaredMessage = PublishPackageDraftsRequestSchema.shape.message.safeParse(body?.message);
+                if (!declaredMessage.success) {
+                    const located = declaredMessage.error.issues
+                        .map((issue) => `message: ${issue.message}`)
+                        .join('; ');
+                    return {
+                        handled: true,
+                        response: deps.error(
+                            `Invalid publish-drafts body — ${located}. Nothing was published: \`message\` is the `
+                            + 'change note every history row of this publish records; send it as a string, or leave '
+                            + 'it out to record the sentence naming the package.',
+                            400,
+                        ),
+                    };
+                }
                 try {
                     // [ADR-0146 D1] Who published: the identity this request
                     // was authorized as, never a name the body supplies — see
@@ -1924,9 +1957,8 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
                         ...(actor !== undefined ? { actor } : {}),
                         // [ADR-0146 D1] The author's change note: the package
                         // commit and every item history row this publish writes
-                        // carry it. A string, as the single-item publish door
-                        // reads `message`; anything else sends no note.
-                        ...(typeof body?.message === 'string' ? { message: body.message } : {}),
+                        // carry it. The parsed value: a string, or absent.
+                        ...(declaredMessage.data !== undefined ? { message: declaredMessage.data } : {}),
                         // [#24253] Passed through as sent: the protocol judges
                         // its shape and what it names, and refuses the whole
                         // request before anything is published.
 
@@ -523,7 +523,7 @@ export const ROUTE_LEDGER: readonly RouteLedgerEntry[] = [
   { route: 'POST /packages/:id/publish-drafts', domain: '/packages', disposition: 'sdk', client: 'packages.publishDrafts',
     requestSchema: 'PublishPackageDraftsRequestSchema',
     responseSchema: 'PublishPackageDraftsResponseSchema',
-    note: 'dispatch() answers through the { success, data } envelope, so the named schema is the `data` — the protocol result AFTER the door\'s own mutations (seedApplied back-fill, ADR-0045 unhiddenApps/unhideError, rebindError). Fillable because packages-publish-drafts-response-conformance.test.ts drives THIS handler and parses the payload it answers; the producer half is pinned in objectql\'s publish-package-drafts-response-conformance.test.ts. `probes` is deliberately opaque in the declaration, upgraded to a modeled schema only when a consumer needs a field of it. `requestSchema` is the body the door reads (`message`, `backfill`; a body `actor` is ignored, so the schema strips unknown keys rather than refusing them), filled because packages-publish-drafts-request-conformance.test.ts drives THIS handler and pins what each body member does' },
+    note: 'dispatch() answers through the { success, data } envelope, so the named schema is the `data` — the protocol result AFTER the door\'s own mutations (seedApplied back-fill, ADR-0045 unhiddenApps/unhideError, rebindError). Fillable because packages-publish-drafts-response-conformance.test.ts drives THIS handler and parses the payload it answers; the producer half is pinned in objectql\'s publish-package-drafts-response-conformance.test.ts. `probes` is deliberately opaque in the declaration, upgraded to a modeled schema only when a consumer needs a field of it. `requestSchema` is the body the door reads (`message`, parsed with the schema\'s own member so a non-string note is refused 400 VALIDATION_ERROR before anything is published; `backfill`, judged by the protocol; a body `actor` is ignored, so the schema strips unknown keys rather than refusing them), filled because packages-publish-drafts-request-conformance.test.ts drives THIS handler and pins what each body member does' },
   { route: 'POST /packages/:id/discard-drafts', domain: '/packages', disposition: 'sdk', client: 'packages.discardDrafts',
     responseSchema: 'DiscardPackageDraftsResponseSchema',
     note: 'Enveloped — the named schema is the `data`: `discardPackageDrafts`\'s declared return, transcribed describe-only. Conformance: spec `api/package-lifecycle.test.ts`' },
 
@@ -1497,7 +1497,9 @@ export const PublishMetaItemResponseSchema = lazySchema(() => z.object({
  * is the `:id` path segment, never a body member. The door reads exactly two
  * body members and hands them to `publishPackageDrafts`:
  *
- * - `message` — forwarded only when it is a string;
+ * - `message` — parsed with this declaration's member; a note it refuses (a
+ *   number, an object, an array, `null`) is refused `400 VALIDATION_ERROR`
+ *   naming `message` before anything is published;
  * - `backfill` — forwarded as sent whenever the key is present; the protocol
  *   judges its shape before anything is published and refuses the whole
  *   request `400 VALIDATION_ERROR` with every bad entry in `issues[]`.