@@ -0,0 +1,10 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): `os package publish` names the `objectstack.manifest.json` keys it does not send (`tags`, `publisher`, `isStarter`, `preview`, `visibility`) instead of dropping them silently
+
+Clause-②: no
+Metadata-protocol: none
+
+The listing file's schema accepts these keys, but publish never carried them to the control plane, so an author's tags, starter flag or preview simply never reached the catalog and nothing said why. Publish now prints a warning naming each declared catalog key: it is declared but not yet carried by the hosted catalog, with a link to the issue tracking that (#27348). A declared `visibility` gets its own warning pointing at `--visibility`, which does carry it. The publish still succeeds: the bundled blank template ships `isStarter: true`. A test classifies every key of the listing-file schema as sent, warned about, or scaffold-only, so a key the schema gains later fails until publish handles it.
@@ -32,7 +32,7 @@ import { readFile } from 'node:fs/promises';
 import { resolve as resolvePath, basename, dirname, isAbsolute } from 'node:path';
 import { Args, Command, Flags } from '@oclif/core';
 import { PackageSchema } from '@objectstack/spec/marketplace';
-import { printHeader, printKV, printSuccess, printError, printStep, isExitSignal } from '../../utils/format.js';
+import { printHeader, printKV, printSuccess, printError, printStep, printWarning, isExitSignal } from '../../utils/format.js';
 import { DEFAULT_CLOUD_URL, tryReadCloudConfig } from '../../utils/cloud-config.js';
 import { resolveCloudActiveEnvironmentId } from '../../utils/active-environment.js';
 import { readErrorMessage } from '../../utils/response-envelope.js';
@@ -256,6 +256,65 @@ async function tryLoadTemplateManifest(
   return null;
 }
 
+/**
+ * Keys `objectstack.manifest.json` accepts that this command does NOT carry to
+ * the control plane. `tags`, `publisher`, `isStarter` and `visibility` are
+ * inherited from `CreatePackageRequestSchema`; `preview` is a scaffold-side
+ * extra (publish has no screenshot upload path).
+ *
+ * They are not sent because nothing in this repo shows the hosted
+ * `POST /cloud/packages` route writes them: the request schema declares them,
+ * but the read-side row stores `tags` as a string, and `publisher` is a trust
+ * tier that gates listing privileges, so a value self-declared in an author's
+ * file is a privilege claim only the control plane can judge. ⛔ Do not start
+ * sending them before {@link CATALOG_SEND_ISSUE} answers what the hosted side
+ * accepts. `visibility` is flag-only on purpose (see the `--visibility` flag).
+ *
+ * Dropping an authored key silently is the defect, so each one the file
+ * declares is named in a warning. The warning does not fail the publish: the
+ * bundled blank template ships `isStarter: true`, and refusing it would break
+ * every project scaffolded from it.
+ *
+ * Every `TemplateManifestSchema` key is classified in
+ * `test/package-publish-uncarried-manifest-keys.test.ts`, so a key the schema
+ * gains later goes red there until publish either sends it or lists it here.
+ */
+export const UNCARRIED_MANIFEST_KEYS = ['tags', 'publisher', 'isStarter', 'preview', 'visibility'] as const;
+
+/** Where carrying the catalog keys to the hosted control plane is tracked. */
+export const CATALOG_SEND_ISSUE = 'https://github.com/objectstack-ai/objectstack/issues/27348';
+
+/** The {@link UNCARRIED_MANIFEST_KEYS} that `manifest` declares, in list order. */
+export function uncarriedManifestKeys(manifest: Record<string, unknown>): string[] {
+  return UNCARRIED_MANIFEST_KEYS.filter((key) => manifest[key] !== undefined);
+}
+
+/**
+ * The warnings for the {@link uncarriedManifestKeys} a manifest declares: one
+ * for the catalog keys (declared, not yet carried by the hosted catalog) and
+ * one for `visibility` (carried by the flag instead). Empty when none.
+ */
+export function uncarriedManifestWarnings(manifest: Record<string, unknown>): string[] {
+  const declared = uncarriedManifestKeys(manifest);
+  const catalog = declared.filter((key) => key !== 'visibility');
+  const warnings: string[] = [];
+  if (catalog.length > 0) {
+    warnings.push(
+      `objectstack.manifest.json declares ${catalog.map((key) => `\`${key}\``).join(', ')}, which the `
+      + 'hosted catalog does not carry yet: `os package publish` does not send '
+      + (catalog.length === 1 ? 'it' : 'them')
+      + `, so the published package will not show ${catalog.length === 1 ? 'it' : 'them'}. See ${CATALOG_SEND_ISSUE}.`,
+    );
+  }
+  if (declared.includes('visibility')) {
+    warnings.push(
+      'objectstack.manifest.json declares `visibility`, which `os package publish` does not read from '
+      + 'the file. Pass --visibility to set it.',
+    );
+  }
+  return warnings;
+}
+
 /**
  * Read a string that is EITHER inlined markdown OR a path relative to
  * the template manifest directory. Treats short, single-line `.md` /
@@ -450,6 +509,7 @@ export default class PackagePublish extends Command {
         printStep(`Loaded objectstack.manifest.json`);
       }
       const m = tplManifest?.data ?? {};
+      for (const warning of uncarriedManifestWarnings(m)) printWarning(warning);
       const baseDir = tplManifest?.baseDir ?? process.cwd();
 
       // One gate for both paths — the explicitly supplied id and the derived one
 
@@ -0,0 +1,160 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * `os package publish` names every `objectstack.manifest.json` key it does not
+ * send, instead of dropping it silently.
+ *
+ * `TemplateManifestSchema` accepts `tags`, `publisher`, `isStarter`, `preview`
+ * and `visibility`, so an author (or an AI agent) writes them and the file
+ * validates — but publish never carried them, and the catalog simply showed
+ * none of it. Carrying them waits on what the hosted side accepts
+ * (`CATALOG_SEND_ISSUE`). These cases pin the warning, pin that it does not
+ * fail the publish (the blank template ships `isStarter: true`), and classify
+ * every schema key so a key added later cannot be dropped silently again.
+ */
+
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { TemplateManifestSchema } from '@objectstack/spec/marketplace';
+import PackagePublish, {
+  CATALOG_SEND_ISSUE,
+  UNCARRIED_MANIFEST_KEYS,
+  uncarriedManifestKeys,
+} from '../src/commands/package/publish.js';
+
+type Call = { url: string; body: any };
+
+/** Stub `fetch` so both publish POSTs succeed, and record what was sent. */
+function stubCloud(): Call[] {
+  const calls: Call[] = [];
+  vi.stubGlobal('fetch', vi.fn(async (url: string, init: any) => {
+    calls.push({ url, body: JSON.parse(init.body) });
+    const data = url.endsWith('/versions')
+      ? { id: 'ver_1', version: '1.2.0', listing_status: 'draft' }
+      : { id: 'pkg_1', created: true, visibility: 'org' };
+    return { ok: true, status: 200, statusText: 'OK', json: async () => ({ success: true, data }) } as any;
+  }));
+  return calls;
+}
+
+/**
+ * Every `TemplateManifestSchema` key, by what publish does with it. A key the
+ * schema gains lands in none of these and fails the partition test below.
+ */
+const SENT = [
+  'manifestId', 'displayName', 'description', 'category', 'iconUrl',
+  'homepageUrl', 'license', 'translations', 'readmePath',
+] as const;
+/** Scaffold-time extras: read by `create-objectstack` or docs, never a publish key. */
+const SCAFFOLD_ONLY = ['name', 'specVersion', 'namespace', 'skills', 'scaffold'] as const;
+
+describe('os package publish — manifest keys it does not send', () => {
+  let dir = '';
+  const prevEnv = { url: process.env.OS_CLOUD_URL, key: process.env.OS_CLOUD_API_KEY };
+  const prevCwd = process.cwd();
+
+  afterEach(async () => {
+    process.chdir(prevCwd);
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+    process.env.OS_CLOUD_URL = prevEnv.url;
+    process.env.OS_CLOUD_API_KEY = prevEnv.key;
+    if (dir) await rm(dir, { recursive: true, force: true });
+  });
+
+  async function projectWith(manifest: Record<string, unknown>): Promise<string> {
+    dir = await mkdtemp(join(tmpdir(), 'package-publish-uncarried-'));
+    const path = join(dir, 'objectstack.json');
+    await writeFile(path, JSON.stringify({
+      manifest: { id: 'com.acme.crm', name: 'Acme CRM', version: '1.2.0' },
+      objects: [],
+    }));
+    await writeFile(join(dir, 'objectstack.manifest.json'), JSON.stringify(manifest));
+    process.chdir(dir);
+    process.env.OS_CLOUD_URL = 'http://cloud.test';
+    process.env.OS_CLOUD_API_KEY = 'tok_123';
+    return path;
+  }
+
+  function captureLog(): string[] {
+    const lines: string[] = [];
+    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
+      lines.push(args.map(String).join(' '));
+    });
+    return lines;
+  }
+
+  it('names each declared catalog key it does not send, points at the tracking issue, and still publishes', async () => {
+    const path = await projectWith({
+      name: 'acme-crm',
+      specVersion: '^18.0.0',
+      displayName: 'Acme CRM',
+      tags: ['crm', 'sales'],
+      publisher: 'community',
+      isStarter: true,
+      preview: { screenshots: ['shot.png'] },
+    });
+    const calls = stubCloud();
+    const log = captureLog();
+
+    await PackagePublish.run([path]);
+
+    expect(calls).toHaveLength(2);
+    const warnings = log.filter((line) => line.includes('objectstack.manifest.json declares'));
+    expect(warnings).toHaveLength(1);
+    for (const key of ['tags', 'publisher', 'isStarter', 'preview']) expect(warnings[0]).toContain(`\`${key}\``);
+    expect(warnings[0]).toContain('hosted catalog does not carry yet');
+    expect(warnings[0]).toContain(CATALOG_SEND_ISSUE);
+    expect(warnings[0]).not.toContain('`visibility`');
+    // Not sent under either spelling — the warning describes the wire.
+    for (const key of ['tags', 'publisher', 'isStarter', 'is_starter', 'preview']) {
+      expect(key in calls[0].body).toBe(false);
+    }
+  });
+
+  it('names `visibility` separately, with the flag that does carry it', async () => {
+    const path = await projectWith({ name: 'acme-crm', specVersion: '^18.0.0', visibility: 'marketplace' });
+    const calls = stubCloud();
+    const log = captureLog();
+
+    await PackagePublish.run([path]);
+
+    expect('visibility' in calls[0].body).toBe(false);
+    const warnings = log.filter((line) => line.includes('objectstack.manifest.json declares'));
+    expect(warnings).toHaveLength(1);
+    expect(warnings[0]).toContain('`visibility`');
+    expect(warnings[0]).toContain('--visibility');
+    // `visibility` is not waiting on the hosted catalog: the flag carries it today.
+    expect(warnings[0]).not.toContain(CATALOG_SEND_ISSUE);
+  });
+
+  it('stays quiet when the manifest declares none of them', async () => {
+    const path = await projectWith({ name: 'acme-crm', specVersion: '^18.0.0', displayName: 'Acme CRM' });
+    stubCloud();
+    const log = captureLog();
+
+    await PackagePublish.run([path]);
+
+    expect(log.some((line) => line.includes('objectstack.manifest.json declares'))).toBe(false);
+  });
+});
+
+describe('every TemplateManifestSchema key is sent, warned about, or scaffold-only', () => {
+  it('partitions the schema keys exactly', () => {
+    const schemaKeys = Object.keys(TemplateManifestSchema.shape).sort();
+    const classified = [...SENT, ...UNCARRIED_MANIFEST_KEYS, ...SCAFFOLD_ONLY].sort();
+    expect(classified).toEqual(schemaKeys);
+    // No key sits in two buckets.
+    expect(new Set(classified).size).toBe(classified.length);
+  });
+
+  it('warns only about keys the schema accepts', () => {
+    // A warned key the schema rejects would never reach publish; the list
+    // would then be naming a key no valid file can carry.
+    const fixture = { name: 'acme-crm', specVersion: '^18.0.0', displayName: 'Acme CRM', tags: ['crm'], publisher: 'community', isStarter: true, preview: { demoUrl: 'https://demo.example.com' }, visibility: 'org' };
+    expect(TemplateManifestSchema.safeParse(fixture).success).toBe(true);
+    expect(uncarriedManifestKeys(fixture)).toEqual([...UNCARRIED_MANIFEST_KEYS]);
+  });
+});