@@ -0,0 +1,12 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): an object save or publish whose storage sync the datasource refuses now says so on its answer
+
+Clause-②: no
+Metadata-protocol: none
+
+`PUT /api/v1/meta/object/NAME` (a publish-mode save) and `POST /api/v1/meta/object/NAME/publish` sync the object's table after the item is written. When the datasource refused that sync, both answered `200` success with nothing about storage, and only the server log said the table was not created or altered. Both answers now carry one `warning` on their existing `advisories` key, with the rule id `object-storage-sync-refused`, naming the object and saying its storage did not follow. The datasource's own text is quoted when it declared a client refusal (a 4xx status); otherwise the advisory says the reason is in the server log, which keeps the `error` line it already printed. The status code and every other key are unchanged, the publish is still not failed, and an answer whose sync ran has no new key.
+
+A client that groups or suppresses advisories by rule id sees one new id. The package-draft batch publish (Studio's "publish whole app") still reports a refused sync in the server log only.
@@ -374,6 +374,9 @@ export class ProtocolHistoryAndPublishFacet {
         if (effects.seedApplied) response.seedApplied = effects.seedApplied;
         if (effects.materializeApplied) response.materializeApplied = effects.materializeApplied;
         if (effects.projectionApplied) response.projectionApplied = effects.projectionApplied;
+        // [#30635] A refused storage sync rides the same omitted-when-empty
+        // `advisories`, after the gate's findings; the publish is not failed.
+        if (effects.storageRefused) response.advisories = [...(response.advisories ?? []), effects.storageRefused];
         // [#10219] LAST, and awaited: tell the host that ONE item went live, so
         // it can announce `metadata:reloaded` and boot-cached consumers re-sync
         // without a restart — the parity the batch door has had since #2576.
@@ -1050,11 +1053,13 @@ export class ProtocolHistoryAndPublishFacet {
             seedApplied?: { success: boolean; inserted: number; updated: number; error?: string; errors?: unknown[]; landed?: SeedAppliedLandedParsed[] };
             materializeApplied?: PublishMaterializeResult;
             projectionApplied?: MutationProjectionOutcome;
+            storageRefused?: RuntimeAuthoringIssue;
         }> {
         const out: {
             seedApplied?: { success: boolean; inserted: number; updated: number; error?: string; errors?: unknown[]; landed?: SeedAppliedLandedParsed[] };
             materializeApplied?: PublishMaterializeResult;
             projectionApplied?: MutationProjectionOutcome;
+            storageRefused?: RuntimeAuthoringIssue;
         } = {};
         // Drafts skipped the registry mutation; on publish we now refresh the
         // runtime registry so live behaviour catches up immediately (matches
@@ -1090,7 +1095,11 @@ export class ProtocolHistoryAndPublishFacet {
         // — but it is a fact about a repository read, load-bearing for a guard
         // two files away, and nothing said so at either end. Folding at the
         // producer retires the question instead of restating the invariant.
-        await host.ensureObjectStorage(args.singularType, args.name);
+        //
+        // [#30635] A refused sync comes back as the advisory the caller is
+        // told; set only when it was refused, so a clean result is unchanged.
+        const storageRefused = await host.ensureObjectStorage(args.singularType, args.name);
+        if (storageRefused) out.storageRefused = storageRefused;
         // Publishing a `seed` is what makes its rows live — materialize them
         // NOW (best-effort, never fails the publish) so every publish path
         // (per-ref REST publish, the home banner, package publish-drafts)
 
@@ -50,6 +50,8 @@ import {
 import type { HydrationOptions, ShippingPackages, UnboundOwnerRefusalState } from './protocol-package-bindings.js';
 import { bundleMemberDiscriminator } from './protocol-bundle-members.js';
 import type { ProtocolHost } from './protocol-host.js';
+import type { RuntimeAuthoringIssue } from './runtime-authoring-gate.js';
+import { clientFacingFailureText } from './protocol-client-failures.js';
 
 export class ProtocolRegistryHydrationFacet {
     /**
@@ -1427,8 +1429,15 @@ export class ProtocolRegistryHydrationFacet {
      * not quiet: a refused sync is reported at `error` with its consequence
      * and fix (#22985), because the publish it follows has already answered
      * success.
+     *
+     * [#30635] …and to the CALLER: a refused sync returns one `warning`
+     * advisory ({@link objectStorageSyncRefusedNotice}) that both doors running
+     * this sync put on the 2xx they answer (`saveMetaItem` in publish mode and
+     * `publishMetaItem`, through `runPublishSideEffects`). A sync that ran, or
+     * a type with no storage, returns `undefined`, so a clean answer is
+     * unchanged.
      */
-    static async ensureObjectStorage(host: Pick<ProtocolHost, 'engine' | 'ensureObjectStorage'>, type: string, name: string): Promise<void> {
+    static async ensureObjectStorage(host: Pick<ProtocolHost, 'engine' | 'ensureObjectStorage'>, type: string, name: string): Promise<RuntimeAuthoringIssue | undefined> {
         // [#8862] The `&& type !== 'objects'` limb is GONE. Both call sites
         // hand over a folded value — `saveMetaItem` after
         // `canonicalizeMetaRequestType`, and `runPublishSideEffects` as
@@ -1446,6 +1455,7 @@ export class ProtocolRegistryHydrationFacet {
         if (type !== 'object') return;
         try {
             await host.engine.syncObjectSchema(name);
+            return undefined;
         } catch (err: any) {
             // [#22985] `error`, not `warn`, by the one question AGENTS.md
             // "Degradation log levels" turns this on: the publish still
@@ -1463,6 +1473,7 @@ export class ProtocolRegistryHydrationFacet {
                 + 're-runs this sync, or restart, since the boot syncs every registered object\'s storage.',
                 err?.message ?? err,
             );
+            return objectStorageSyncRefusedNotice(name, err);
         }
     }
 
@@ -1663,3 +1674,40 @@ export class ProtocolRegistryHydrationFacet {
         return err;
     }
 }
+
+/**
+ * [#30635] The rule id of the advisory a save or publish answers with when the
+ * object's storage sync was refused. Stable across releases: the key a client
+ * groups or suppresses the notice by.
+ */
+export const OBJECT_STORAGE_SYNC_REFUSED = 'object-storage-sync-refused';
+
+/**
+ * [#30635] The caller's half of a refused object-storage sync: one `warning`
+ * on the answer's `advisories`, beside the #22985 `error` line the operator
+ * reads. The answer stays the success it already was (the item is published,
+ * registered and served); this says its storage did not follow, so the
+ * author does not find out only when reads and writes against it fail.
+ *
+ * `path` is empty: the finding is about the object as a whole. The driver's
+ * text is quoted only when the driver declared it a client refusal (a 4xx
+ * `status`), the rule every report riding a 2xx on these doors follows
+ * ({@link clientFacingFailureText}); any other failure is named as being in
+ * the server log, where the `error` line carries it whole.
+ */
+export function objectStorageSyncRefusedNotice(name: string, err: unknown): RuntimeAuthoringIssue {
+    const reason = clientFacingFailureText(err, 'the reason is in the server log');
+    return {
+        rule: OBJECT_STORAGE_SYNC_REFUSED,
+        severity: 'warning',
+        where: `object "${name}"`,
+        path: '',
+        message:
+            `object '${name}' was saved and is served, but its storage was NOT created or altered: `
+            + `the datasource refused its schema sync (${reason}). Until the sync runs, reads and writes `
+            + 'against it fail, or miss the columns this save added.',
+        hint:
+            "Resolve the datasource's refusal, then publish the object again (which re-runs the sync), "
+            + 'or restart the server, which syncs the storage of every registered object.',
+    };
+}
@@ -2070,7 +2070,12 @@ export class ProtocolSaveFacet {
                     // [#6602] The SAME scope the row was just written with.
                     organizationId: null,
                 });
-                await host.ensureObjectStorage(request.type, request.name);
+                // [#30635] A refused storage sync is told to the caller too:
+                // one `warning` on this answer's `advisories`, after the
+                // gate's findings and the save's own notices. The save is not
+                // failed (the row is written, registered and served).
+                const storageRefused = await host.ensureObjectStorage(request.type, request.name);
+                if (storageRefused) saveNotices.push(storageRefused);
             }
             // ADR-0010 — success audit (best-effort).
             await host.recordMetadataAudit({
 
@@ -416,3 +416,138 @@ describe('[#22985] a refused object-storage sync on publish is an error, once',
         expect(spy.error).not.toHaveBeenCalled();
     });
 });
+
+// ---------------------------------------------------------------------------
+// [#30635] A refused object-storage sync is reported to the CALLER too, on
+// the answer's `advisories` — not only in the server log.
+// ---------------------------------------------------------------------------
+// The #22985 line above tells the operator; the admin or AI that saved the
+// object read a plain success and learned nothing until reads and writes
+// against the object failed. Both doors that run the sync now carry one
+// `warning` advisory naming the object, on the 2xx they already answer: the
+// save (`PUT /meta/object/NAME`, `saveMetaItem` in publish mode) and the
+// single-item publish (`POST /meta/object/NAME/publish`). Status and every
+// other key are unchanged, and a clean sync answers without the key at all.
+//
+// The driver's text is quoted only when the driver declared it a client
+// refusal (a 4xx `status`), the rule every 2xx side-effect report on these
+// doors follows (`clientFacingFailureText`); otherwise the advisory says the
+// reason is in the server log, where the #22985 line carries it whole.
+
+/** The advisory's stable rule id — the key a client groups or suppresses it by. */
+const SYNC_REFUSED_RULE = 'object-storage-sync-refused';
+
+describe('[#30635] a refused object-storage sync rides the answer as a warning advisory', () => {
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    /** Quiets (and keeps) the #22985 log line, which is pinned above. */
+    const quietConsole = () => vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    /** A driver refusal that DECLARES itself a client refusal (4xx `status`). */
+    function declareRefusal(engine: any, text: string): void {
+        engine.syncObjectSchema = vi.fn(async () => {
+            throw Object.assign(new Error(text), { status: 409 });
+        });
+    }
+
+    const syncRefused = (res: any) => (res.advisories ?? []).filter((a: any) => a.rule === SYNC_REFUSED_RULE);
+
+    it('save door: a refused sync answers success with one warning naming the object, and withholds undeclared driver text', async () => {
+        const error = quietConsole();
+        const { protocol, syncedObjects } = makeProtocol(new Set(['ticket']));
+
+        const res = await protocol.saveMetaItem({
+            type: 'object', name: 'ticket', item: objectBody('ticket'), packageId: PKG,
+        });
+
+        // The publish the answer stands for is not undone.
+        expect(res.success).toBe(true);
+        expect(res.state).toBe('active');
+        expect(syncedObjects).toEqual([]);
+        const [advisory, ...rest] = syncRefused(res);
+        expect(rest).toEqual([]);
+        expect(advisory).toMatchObject({
+            rule: SYNC_REFUSED_RULE, severity: 'warning', path: '', where: 'object "ticket"',
+        });
+        expect(advisory.message).toContain("'ticket'");
+        expect(typeof advisory.hint).toBe('string');
+        // An undeclared driver failure is withheld from the 2xx body…
+        expect(advisory.message).not.toContain('there is already an index');
+        expect(advisory.message).toContain('server log');
+        // …and still reaches the server log whole (#22985).
+        expect(error.mock.calls.some((args) => args[1] === 'there is already an index named ticket')).toBe(true);
+    });
+
+    it('save door: a DECLARED driver refusal is quoted on the advisory', async () => {
+        quietConsole();
+        const { protocol, engine } = makeProtocol();
+        declareRefusal(engine, "Schema sync REFUSED for the existing table 'ticket': it holds 2 rows.");
+
+        const res = await protocol.saveMetaItem({
+            type: 'object', name: 'ticket', item: objectBody('ticket'), packageId: PKG,
+        });
+
+        expect(res.success).toBe(true);
+        const [advisory] = syncRefused(res);
+        expect(advisory?.severity).toBe('warning');
+        expect(advisory?.message).toContain("Schema sync REFUSED for the existing table 'ticket': it holds 2 rows.");
+    });
+
+    it('CONTROL save door: a clean sync answers with no `advisories` key at all', async () => {
+        const { protocol, syncedObjects } = makeProtocol();
+
+        const res = await protocol.saveMetaItem({
+            type: 'object', name: 'ticket', item: objectBody('ticket'), packageId: PKG,
+        });
+
+        expect(res.success).toBe(true);
+        expect(syncedObjects).toEqual(['ticket']);
+        expect('advisories' in res).toBe(false);
+    });
+
+    it('CONTROL save door: a draft save runs no sync and reports none', async () => {
+        const { protocol, engine } = makeProtocol(new Set(['ticket']));
+
+        const res = await protocol.saveMetaItem({
+            type: 'object', name: 'ticket', item: objectBody('ticket'), packageId: PKG, mode: 'draft',
+        });
+
+        expect(res.success).toBe(true);
+        expect(engine.syncObjectSchema).not.toHaveBeenCalled();
+        expect('advisories' in res).toBe(false);
+    });
+
+    it('publish door: a refused sync answers success with the same warning', async () => {
+        quietConsole();
+        const { protocol, engine } = makeProtocol();
+        await protocol.saveMetaItem({
+            type: 'object', name: 'ticket', item: objectBody('ticket'), packageId: PKG, mode: 'draft',
+        });
+        declareRefusal(engine, "Schema sync REFUSED for the existing table 'ticket': it holds 2 rows.");
+
+        const res = await protocol.publishMetaItem({ type: 'object', name: 'ticket' });
+
+        expect(res.success).toBe(true);
+        const [advisory, ...rest] = syncRefused(res);
+        expect(rest).toEqual([]);
+        expect(advisory).toMatchObject({
+            rule: SYNC_REFUSED_RULE, severity: 'warning', path: '', where: 'object "ticket"',
+        });
+        expect(advisory.message).toContain("Schema sync REFUSED for the existing table 'ticket': it holds 2 rows.");
+    });
+
+    it('CONTROL publish door: a clean sync answers with no `advisories` key at all', async () => {
+        const { protocol, syncedObjects } = makeProtocol();
+        await protocol.saveMetaItem({
+            type: 'object', name: 'ticket', item: objectBody('ticket'), packageId: PKG, mode: 'draft',
+        });
+
+        const res = await protocol.publishMetaItem({ type: 'object', name: 'ticket' });
+
+        expect(res.success).toBe(true);
+        expect(syncedObjects).toEqual(['ticket']);
+        expect('advisories' in res).toBe(false);
+    });
+});
@@ -175,6 +175,12 @@ function makeStubEngine() {
             tableOf(table).delete(found.key);
             return { deleted: 1 };
         },
+        // [#30635] A publish syncs the object's storage, and a refused sync
+        // rides the answer's `advisories`. This double's sync succeeds, so the
+        // advisories these pins read are the gate's alone.
+        async syncObjectSchema() {
+            return true;
+        },
         registry: {
             registerItem: () => {},
             registerObject: () => {},
 
@@ -10032,7 +10032,7 @@ export class ObjectStackProtocolImplementation implements
     }
 
     /** Docblock and body: {@link ProtocolRegistryHydrationFacet.ensureObjectStorage} in `protocol-registry-hydration.ts` [#29985 codemod]. */
-    private async ensureObjectStorage(type: string, name: string): Promise<void> {
+    private async ensureObjectStorage(type: string, name: string): Promise<RuntimeAuthoringIssue | undefined> {
         // [#29985 codemod] The body moved to `protocol-registry-hydration.ts`; it reaches this class through `protocol-host.ts`.
         return ProtocolRegistryHydrationFacet.ensureObjectStorage(protocolHost(this), type, name);
     }
@@ -11340,6 +11340,7 @@ export class ObjectStackProtocolImplementation implements
         seedApplied?: { success: boolean; inserted: number; updated: number; error?: string; errors?: unknown[]; landed?: SeedAppliedLandedParsed[] };
         materializeApplied?: PublishMaterializeResult;
         projectionApplied?: MutationProjectionOutcome;
+        storageRefused?: RuntimeAuthoringIssue;
     }> {
         // [#29985 codemod] The body moved to `protocol-history-and-publish.ts`; it reaches this class through `protocol-host.ts`.
         return ProtocolHistoryAndPublishFacet.runPublishSideEffects(protocolHost(this), args);