@@ -0,0 +1,21 @@
+---
+'@objectstack/spec': minor
+'@objectstack/cli': minor
+'create-objectstack': patch
+---
+
+feat(spec)!: retire `objectstack.manifest.json` `publisher` and `isStarter` — the platform decides both (#31035)
+
+Clause-②: no (narrowing) — two authorable keys of `TemplateManifestSchema` become tombstones, and `os package publish` refuses the file's `publisher` by name
+Metadata-protocol: narrowed
+
+<!-- adr-0087: registered marketplace-template-manifest-platform-decided-keys-retired -->
+
+**BREAKING** for an `objectstack.manifest.json` that still writes `publisher` or `isStarter`, and for `os package publish` run on a manifest that declares `publisher`.
+
+- **Retired (ADR-0049 enforce-or-remove).** `TemplateManifest.publisher` and `TemplateManifest.isStarter` are `retiredKey()` tombstones: `tsc` refuses them and a parse of `TemplateManifestSchema` refuses each with its prescription. Neither ever had an effect from this file: `publisher` is the trust tier that gates listing privileges, which the platform assigns from the publisher's credentials, and the platform honours a starter flag only on a first-party seed; `os package publish` never sent either. A trust claim does not belong in an author-editable file. `RETIRED_KEYS_BY_MAJOR[18]` lists both keys and the upgrade guide carries the semantic entry `marketplace-template-manifest-platform-decided-keys-retired`. No ADR-0087 conversion: this file is not a stack collection member, so `os migrate meta` has nothing to rewrite; a runtime boot never reads it. The publish request's own `publisher` and `isStarter` (`CreatePackageRequestSchema`) are unchanged.
+- **Migration** — FROM → TO, in `objectstack.manifest.json`:
+  - `publisher` → delete it. The platform assigns a package's trust tier from the credentials it is published with.
+  - `isStarter` → delete it. The platform decides which packages are starters; a first-party script that seeds one in service mode carries the flag itself, not in the manifest.
+- **`@objectstack/cli`.** `os package publish` refuses a manifest declaring `publisher` before any network call. It names `isStarter` in the deletion warning with `name`, `specVersion`, `skills` and `scaffold`, and still publishes, because every project scaffolded from the blank template before this release carries `isStarter: true`. Neither key is ever sent.
+- **`create-objectstack`.** The blank template's manifest drops `isStarter`, and scaffolding strips both keys (with the other retired ones) from a template's manifest, so a template authored before this release still scaffolds a manifest the schema accepts.
@@ -3315,8 +3315,10 @@ checked against the spec's schema before anything is sent, and a declared
 install mode, a `connector` a declared connector. The retired `category` — in
 the file, or as `--category` — is refused before any network call, with the
 facets that replace the value it held, and so is a `visibility` in the file
-(pass `--visibility`). The retired `name`, `specVersion`, `skills` and
-`scaffold`, which nothing ever read, are named in a warning for deletion. `tags` has no flag and is
+(pass `--visibility`) and a `publisher` in the file (the platform assigns the
+trust tier from your credentials). The retired `name`, `specVersion`, `skills`,
+`scaffold` and `isStarter`, which never changed what publish sent, are named in
+a warning for deletion. `tags` has no flag and is
 sent as written: the control plane judges the list, and a refusal is its 400,
 printed as it is. A top-level `tagline` is used only as the description, when
 neither `--description` nor the file's `description` gives one; otherwise it is
 
@@ -92,13 +92,13 @@ columns for a missing key. The per-locale shape is the
 **Two things the file can say that never reach the listing.** Publish uploads no
 screenshot images, and the Console's marketplace pages render none: a
 `preview.screenshots` list stays on your disk, and `screenshotCaptions` travels
-with no image to caption. The schema also accepts `publisher` and `isStarter`,
-but the platform decides both: an author's value has no effect, so
-`os package publish` never sends them and prints a warning naming each one the
-file declares. `tags` is different: it is sent as written (see the table above).
-The file no longer accepts `visibility` (pass `--visibility`; publish refuses the
-key by name) nor `name`, `specVersion`, `skills` or `scaffold`, which nothing
-ever read: publish names each one still present so you can delete it.
+with no image to caption. `tags` is different: it is sent as written (see the
+table above). The file no longer accepts `visibility` (pass `--visibility`;
+publish refuses the key by name), nor `publisher` — the platform assigns a
+package's trust tier from your credentials, and publish refuses the key by name —
+nor `isStarter`, `name`, `specVersion`, `skills` or `scaffold`, which never
+changed what publish sent (the platform decides which packages are starters):
+publish names each one still present so you can delete it.
 Put the icon, the description, the tags, the tagline and the README where the
 table above says, and nothing else.
 </Callout>
 
@@ -38,9 +38,11 @@ of `SelectOptionSchema.value`): words joined by `_`, never `-`, so a select
 field — the cloud catalog's facet columns, a console filter — can carry the
 facet as its options unchanged.
 
-Values are append-only. Renaming or removing one is an ADR-0087 retirement
-with a data migration. Adding one needs a real listed package, or a ruled
-scenario card, that needs it, and the console's labels in the same change.
+Released values are append-only. Renaming or removing a released value is
+an ADR-0087 retirement with a data migration; a value no release has
+shipped yet can still be respelled without one. Adding one needs a real
+listed package, or a ruled scenario card, that needs it, and the console's
+labels in the same change.
 Keep each facet near a dozen values; merge before you grow.
 
 ## What is deliberately absent
 
@@ -54,8 +54,8 @@ objectstack.manifest.json — template / package source descriptor
 | **iconUrl** | `string` | optional |  |
 | **homepageUrl** | `string` | optional |  |
 | **license** | `string` | optional |  |
-| **publisher** | `Enum<'objectstack' \| 'partner' \| 'community' \| 'private'>` | optional | Package publisher provenance tier |
-| **isStarter** | `boolean` | optional |  |
+| **publisher** | `never` | optional | [REMOVED] `TemplateManifest.publisher` was removed in @objectstack/spec 18 (ADR-0049) — the platform assigns a package's publisher trust tier from the publisher's credentials, so a value written here never had an effect and `os package publish` never sent it. Delete the key. |
+| **isStarter** | `never` | optional | [REMOVED] `TemplateManifest.isStarter` was removed in @objectstack/spec 18 (ADR-0049) — the platform decides which packages are starters (honoured only on a first-party seed), so a value written here never had an effect and `os package publish` never sent it. Delete the key. |
 | **translations** | `Record<string, { displayName?: string; description?: string; readme?: string; tagline?: string; … }>` | optional | Locale-keyed overrides; missing keys fall back to base columns |
 | **manifestId** | `string` | optional | Optional declarative default for the published package id (reverse-domain, e.g. com.acme.crm). Absent on a template source tree: `objectstack package publish` falls back to --manifest-id and then to a derived `local.<slug>`. NOT optional on the publish request itself |
 | **name** | `never` | optional | [REMOVED] `TemplateManifest.name` was removed in @objectstack/spec 18 (ADR-0049) — nothing read it: `os package publish` addresses the package by `manifestId` (or derives one from the compiled artifact), and a project's slug is its `package.json` `name`. Delete the key. |
 
@@ -105,7 +105,7 @@ describe('connector-docusign listing', () => {
   });
 
   it('declares no key the publisher ignores', () => {
-    // The handbook: the platform decides `publisher` and `isStarter`; the CLI never sends them.
+    // Retired from the file: the platform decides `publisher` and `isStarter`, and the schema refuses both.
     expect(manifest).not.toHaveProperty('publisher');
     expect(manifest).not.toHaveProperty('isStarter');
   });
 
@@ -71,7 +71,7 @@ describe('connector-github listing', () => {
   });
 
   it('declares no key the publisher ignores', () => {
-    // The handbook: the platform decides `publisher` and `isStarter`; the CLI never sends them.
+    // Retired from the file: the platform decides `publisher` and `isStarter`, and the schema refuses both.
     expect(manifest).not.toHaveProperty('publisher');
     expect(manifest).not.toHaveProperty('isStarter');
   });
 
@@ -82,7 +82,7 @@ describe('connector-stripe listing', () => {
   });
 
   it('declares no key the publisher ignores', () => {
-    // The handbook: the platform decides `publisher` and `isStarter`; the CLI never sends them.
+    // Retired from the file: the platform decides `publisher` and `isStarter`, and the schema refuses both.
     expect(manifest).not.toHaveProperty('publisher');
     expect(manifest).not.toHaveProperty('isStarter');
   });
 
@@ -367,13 +367,28 @@ export function retiredVisibilityRefusal(): string {
 }
 
 /**
- * Retired `objectstack.manifest.json` keys nothing ever read (ADR-0049,
- * #31035): a parse of the file refuses each one, so this command names them
- * for deletion. A warning, not a refusal: every project scaffolded from the
- * blank template before the retirement carries them, and they never changed
- * what was published.
+ * The refusal for a manifest that still declares the retired `publisher`
+ * (ADR-0049, #31035). The platform assigns a package's trust tier from the
+ * publisher's credentials, so this command never sent the file's value and an
+ * author's claim never took effect. Refused, like `visibility`, before any
+ * network call: an author who wrote it meant to claim a trust tier, and
+ * publishing without saying so would hide that the claim was never made.
  */
-export const RETIRED_INERT_MANIFEST_KEYS = ['name', 'specVersion', 'skills', 'scaffold'] as const;
+export function retiredPublisherRefusal(): string {
+  return 'objectstack.manifest.json declares `publisher`, which was removed in @objectstack/spec 18: '
+    + 'the platform assigns a package\'s publisher trust tier from the publisher\'s credentials, and '
+    + '`os package publish` never sent it. Delete it.';
+}
+
+/**
+ * Retired `objectstack.manifest.json` keys that never changed what this
+ * command published (ADR-0049, #31035): a parse of the file refuses each one,
+ * so this command names them for deletion. A warning, not a refusal: every
+ * project scaffolded from the blank template before the retirement carries
+ * them (`isStarter: true` included — the platform decides the starter flag and
+ * this command never sent it).
+ */
+export const RETIRED_INERT_MANIFEST_KEYS = ['name', 'specVersion', 'skills', 'scaffold', 'isStarter'] as const;
 
 /** The {@link RETIRED_INERT_MANIFEST_KEYS} that `manifest` declares, in list order. */
 export function retiredInertManifestKeys(manifest: Record<string, unknown>): string[] {
@@ -382,37 +397,28 @@ export function retiredInertManifestKeys(manifest: Record<string, unknown>): str
 
 /**
  * Keys `objectstack.manifest.json` accepts that this command does NOT carry to
- * the control plane. `publisher` and `isStarter` are inherited from
- * `CreatePackageRequestSchema`; `preview` is a scaffold-side extra (publish
- * has no screenshot upload path).
- *
- * - `publisher` and `isStarter` are {@link PLATFORM_DECIDED_MANIFEST_KEYS}:
- *   the hosted control plane decides both and never reads an author's value
- *   (`publisher` is a trust tier that gates listing privileges; `isStarter` is
- *   honoured only for a first-party seed). ⛔ Never send them: a value
- *   self-declared in an author's file is a claim only the platform can judge.
- * - `preview` is not carried by the hosted catalog yet; that is tracked at
- *   {@link CATALOG_SEND_ISSUE}.
+ * the control plane. `preview` is a scaffold-side extra (publish has no
+ * screenshot upload path) and is not carried by the hosted catalog yet; that
+ * is tracked at {@link CATALOG_SEND_ISSUE}.
  *
- * `visibility` is no longer here: the file's key is retired and refused
- * ({@link retiredVisibilityRefusal}); the `--visibility` flag carries it.
+ * `visibility`, `publisher` and `isStarter` are no longer here: the file's
+ * keys are retired. `visibility` is refused ({@link retiredVisibilityRefusal};
+ * the `--visibility` flag carries it), `publisher` is refused
+ * ({@link retiredPublisherRefusal}), and `isStarter` is named for deletion
+ * ({@link RETIRED_INERT_MANIFEST_KEYS}). ⛔ Never send `publisher` or
+ * `isStarter` from the file: both are claims only the platform can judge.
  *
  * `tags` is not here: the hosted route validates and stores it, so it is sent
  * (see the request body in `run()`).
  *
  * Dropping an authored key silently is the defect, so each one the file
- * declares is named in a warning. The warning does not fail the publish: the
- * bundled blank template ships `isStarter: true`, and refusing it would break
- * every project scaffolded from it.
+ * declares is named in a warning. The warning does not fail the publish.
  *
  * Every `TemplateManifestSchema` key is classified in
  * `test/package-publish-uncarried-manifest-keys.test.ts`, so a key the schema
  * gains later goes red there until publish either sends it or lists it here.
  */
-export const UNCARRIED_MANIFEST_KEYS = ['publisher', 'isStarter', 'preview'] as const;
-
-/** The {@link UNCARRIED_MANIFEST_KEYS} the platform decides, whatever the file says. */
-const PLATFORM_DECIDED_MANIFEST_KEYS: readonly string[] = ['publisher', 'isStarter'];
+export const UNCARRIED_MANIFEST_KEYS = ['preview'] as const;
 
 /** Where carrying the remaining catalog keys to the hosted control plane is tracked. */
 export const CATALOG_SEND_ISSUE = 'https://github.com/objectstack-ai/objectstack/issues/27348';
@@ -423,24 +429,14 @@ export function uncarriedManifestKeys(manifest: Record<string, unknown>): string
 }
 
 /**
- * The warnings for the {@link uncarriedManifestKeys} a manifest declares: one
- * for the platform-decided keys (an author's value has no effect), and one for
- * the catalog keys the hosted side does not carry yet — then one for the
+ * The warnings for the {@link uncarriedManifestKeys} a manifest declares — one
+ * for the catalog keys the hosted side does not carry yet — then one for the
  * {@link retiredInertManifestKeys} it still declares. Empty when none.
  */
 export function uncarriedManifestWarnings(manifest: Record<string, unknown>): string[] {
-  const declared = uncarriedManifestKeys(manifest);
+  const catalog = uncarriedManifestKeys(manifest);
   const named = (keys: string[]) => keys.map((key) => `\`${key}\``).join(', ');
-  const platform = declared.filter((key) => PLATFORM_DECIDED_MANIFEST_KEYS.includes(key));
-  const catalog = declared.filter((key) => !PLATFORM_DECIDED_MANIFEST_KEYS.includes(key));
   const warnings: string[] = [];
-  if (platform.length > 0) {
-    const one = platform.length === 1;
-    warnings.push(
-      `objectstack.manifest.json declares ${named(platform)}, which ${one ? 'is' : 'are'} decided by the `
-      + `platform: an author's value has no effect, so \`os package publish\` does not send ${one ? 'it' : 'them'}.`,
-    );
-  }
   if (catalog.length > 0) {
     const one = catalog.length === 1;
     warnings.push(
@@ -455,8 +451,8 @@ export function uncarriedManifestWarnings(manifest: Record<string, unknown>): st
     const one = retired.length === 1;
     warnings.push(
       `objectstack.manifest.json declares ${named(retired)}, which ${one ? 'was' : 'were'} removed in `
-      + `@objectstack/spec 18: nothing ever read ${one ? 'it' : 'them'}, and a parse of the file now refuses `
-      + `${one ? 'it' : 'them'}. Delete ${one ? 'it' : 'them'}.`,
+      + `@objectstack/spec 18: ${one ? 'it' : 'they'} never changed what \`os package publish\` sent, and a `
+      + `parse of the file now refuses ${one ? 'it' : 'them'}. Delete ${one ? 'it' : 'them'}.`,
     );
   }
   return warnings;
@@ -701,6 +697,11 @@ export default class PackagePublish extends Command {
         this.exit(1);
         return;
       }
+      if (m.publisher !== undefined) {
+        printError(retiredPublisherRefusal());
+        this.exit(1);
+        return;
+      }
       const taxonomy = readPublishTaxonomy(m, artifact);
       if (!taxonomy.ok) {
         printError(taxonomy.message);