@@ -0,0 +1,19 @@
+---
+'@objectstack/metadata-protocol': minor
+---
+
+fix(metadata-protocol)!: the metadata save doors refuse an object whose `datasource` names a datasource that does not exist, instead of storing and publishing an object that never registers (#26724)
+
+Clause-②: no (narrowing) — `saveMetaItem` (draft and live), the draft promotion behind `publishMetaItem` and `publishPackageDrafts`, and the restore doors (`rollbackMetaItem`, `revertCommit`) refuse an `object` whose `datasource` names no registered driver, no declared or stored datasource and no pending datasource draft, which they stored before. Nothing is widened.
+Metadata-protocol: narrowed
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type changes: `ObjectSchema.datasource` already names a datasource ID, and the door now refuses an ID that names none, which never worked. A stored object that already holds such a binding keeps re-saving; there is nothing for a migration to rewrite. -->
+
+**BREAKING** accept-set narrowing at the metadata save and publish doors (`@objectstack/metadata-protocol`), served by `PUT /api/v1/meta/object/:name`, `POST /api/v1/meta/object/:name/publish` and `POST /api/v1/packages/:id/publish-drafts`.
+
+- **Before.** An object saved with a misspelled `datasource` (`gapdata_nosuch`) was stored, and `publish-drafts` answered `outcome: 'published'`. The engine routes an explicit `datasource` to the driver of that name only, so the object never registered: every `/api/v1/data/:object` call answered 404 "not registered", with no pointer to the cause.
+- **Now.** The save answers `422 INVALID_METADATA` with one finding at `datasource`: "Object 'NAME' names datasource 'DS', and no datasource of that name exists here: …". Nothing is stored. A draft stored before this is refused at its publish the same way, and a package publish then promotes nothing.
+- **What exists.** No `datasource`, or `'default'`; a driver the engine has registered under the name (a `driver.*` service or an `onEnable` `drivers.register`, with no datasource item); a datasource item the code layer declares (`*.datasource.ts`) or this environment stores, connected or not; on a draft save, any datasource draft of that name; on a package publish, a datasource draft of the same batch.
+- **Not judged.** A save, publish or restore that keeps the `datasource` the object already holds: the binding is not that write's. So `os migrate`'s re-saves, which never run `onEnable`, keep working for an object bound to a driver registered there.
+
+**The remedy.** Correct the name, declare the datasource first (or draft it in the same package and publish both together), or remove `datasource` to use the primary datasource.
@@ -84,6 +84,7 @@ export interface AuthoringGateHost {
     rlsMembershipResolverKeys: ObjectStackProtocolImplementation['rlsMembershipResolverKeys'];
     runAuthoringGate: ObjectStackProtocolImplementation['runAuthoringGate'];
     tenancyPostureInForce: ObjectStackProtocolImplementation['tenancyPostureInForce'];
+    unknownDatasourceSaveRefusal: ObjectStackProtocolImplementation['unknownDatasourceSaveRefusal'];
 }
 
 /** The body of `ObjectStackProtocolImplementation#restoredBodyDerivation`; the method's docblock there is its contract. */
@@ -111,7 +112,7 @@ export function restoredBodyWriter(
 
 /** The body of `ObjectStackProtocolImplementation#refuseRestoredBodyTheSaveDoorRefuses`; the method's docblock there is its contract. */
 export async function refuseRestoredBodyTheSaveDoorRefuses(
-    this: Pick<AuthoringGateHost, 'anonymousElevatedFlowRefusal' | 'assertRuntimeAuthoringRules' | 'authoringChannel' | 'credentialChannelFor' | 'defaultRecordPageSaveRefusal' | 'externalBindingSaveRefusal' | 'runAuthoringGate'>,
+    this: Pick<AuthoringGateHost, 'anonymousElevatedFlowRefusal' | 'assertRuntimeAuthoringRules' | 'authoringChannel' | 'credentialChannelFor' | 'defaultRecordPageSaveRefusal' | 'externalBindingSaveRefusal' | 'runAuthoringGate' | 'unknownDatasourceSaveRefusal'>,
     type: string,
     name: string,
     body: unknown,
@@ -124,6 +125,8 @@ export async function refuseRestoredBodyTheSaveDoorRefuses(
     if (defaultPageRefusal) throw defaultPageRefusal;
     const bindingRefusal = await this.externalBindingSaveRefusal(type, body, name);
     if (bindingRefusal) throw bindingRefusal;
+    const datasourceRefusal = await this.unknownDatasourceSaveRefusal(type, body, name);
+    if (datasourceRefusal) throw datasourceRefusal;
     const elevatedRefusal = await this.anonymousElevatedFlowRefusal(type, body, name);
     if (elevatedRefusal) throw elevatedRefusal;
     const channel = this.credentialChannelFor(type);
 
@@ -169,6 +169,7 @@ export interface SaveDoorRefusalHost {
     externalBindingDatasourceDefinition: ObjectStackProtocolImplementation['externalBindingDatasourceDefinition'];
     getOverlayRepo: ObjectStackProtocolImplementation['getOverlayRepo'];
     readonly getServicesRegistry: ObjectStackProtocolImplementation['getServicesRegistry'];
+    listDrafts: ObjectStackProtocolImplementation['listDrafts'];
     objectsBoundExternallyTo: ObjectStackProtocolImplementation['objectsBoundExternallyTo'];
     overlayLockLayerAt: ObjectStackProtocolImplementation['overlayLockLayerAt'];
     readActiveOverlayRows: ObjectStackProtocolImplementation['readActiveOverlayRows'];
@@ -312,6 +313,65 @@ export async function externalBindingDatasourceDefinition(
     return definition && typeof definition === 'object' ? definition as { schemaMode?: unknown } : undefined;
 }
 
+/**
+ * The body of `ObjectStackProtocolImplementation#unknownDatasourceSaveRefusal`;
+ * the method's docblock there is its contract. [#26724] Written here after the
+ * cut-6 move, beside the external-binding refusal it sits next to at every
+ * door, rather than moved: its reads are the same by-name read
+ * (`readMetaItem`) plus the engine's registered drivers.
+ */
+export async function unknownDatasourceSaveRefusal(
+    this: Pick<SaveDoorRefusalHost, 'engine' | 'listDrafts' | 'readMetaItem'>,
+    singularType: string,
+    item: unknown,
+    name: string,
+    pending?: 'drafts' | ReadonlySet<string>,
+    writeFace?: MetadataWriteFace,
+): Promise<(Error & { code: 'INVALID_METADATA'; status: 422; issues: MetadataIssueEntry[] }) | undefined> {
+    if (singularType !== 'object') return undefined;
+    if (!item || typeof item !== 'object' || Array.isArray(item)) return undefined;
+    const raw = (item as { datasource?: unknown }).datasource;
+    if (typeof raw !== 'string' || raw === '' || raw === 'default') return undefined;
+    const datasource = raw;
+    // An engine that cannot name its registered drivers cannot say a name is
+    // unknown: a driver registered at run time (a `driver.*` service, an
+    // `onEnable` `drivers.register`) declares no datasource item.
+    const getDriverByName = (this.engine as { getDriverByName?: unknown } | undefined)?.getDriverByName;
+    if (typeof getDriverByName !== 'function') return undefined;
+    if (getDriverByName.call(this.engine, datasource)) return undefined;
+    // A declared datasource: the environment's stored row, else the code
+    // layer's definition. Its driver may not be connected (yet, or ever);
+    // that is reported where it is used, not refused here.
+    if ((await this.readMetaItem({ type: 'datasource', name: datasource }))?.item) return undefined;
+    // A datasource still pending: any draft, for a draft save; the batch's
+    // own drafts, for a package publish.
+    const pendingDraft = pending instanceof Set
+        ? pending.has(datasource)
+        : pending === 'drafts' && (await this.listDrafts({ type: 'datasource' })).drafts.some((d) => d.name === datasource);
+    if (pendingDraft) return undefined;
+    // The binding the object already holds is not this save's: a re-save, a
+    // stored-row migration or a restore that keeps it is judged at the save
+    // that introduced it. (A declaration boot never runs `onEnable`, so a
+    // driver registered there is absent from it.)
+    const current = (await this.readMetaItem({ type: 'object', name }))?.item as { datasource?: unknown } | undefined;
+    if (current?.datasource === datasource) return undefined;
+    const issues: MetadataIssueEntry[] = [{
+        path: 'datasource',
+        message: `Object '${name}' names datasource '${datasource}', and no datasource of that name exists here: `
+            + `none is declared (a \`*.datasource.ts\` or a saved \`datasource\`) and no driver is registered under it. `
+            + 'An object bound to it never registers, so every data call on it would answer 404. Correct the name, '
+            + `declare datasource '${datasource}' first, or remove \`datasource\` to use the primary datasource ('default').`,
+        code: 'custom',
+    }];
+    const err = new Error(
+        `${singularType}/${name} failed spec validation: ${specValidationFindings(writeFace, issues)}`,
+    ) as Error & { code: 'INVALID_METADATA'; status: 422; issues: MetadataIssueEntry[] };
+    err.code = 'INVALID_METADATA';
+    err.status = 422;
+    err.issues = issues;
+    return err;
+}
+
 /** The body of `ObjectStackProtocolImplementation#objectsBoundExternallyTo`; the method's docblock there is its contract. */
 export async function objectsBoundExternallyTo(
     this: Pick<SaveDoorRefusalHost, 'engine' | 'readActiveOverlayRows' | 'rethrowUnlessMetadataStoreUnprovisioned' | 'storedOverlayEntries'>,
 
@@ -7,7 +7,8 @@
  * body back as the active row (`repo.restoreVersion`). `saveMetaItem` refuses a
  * family of shapes after its schema gate: a hook with no `body`, a second
  * default record page of an object, an `external` object binding on a managed
- * datasource (both halves of the pair), a `runAs: 'system'` flow an anonymous
+ * datasource (both halves of the pair), an object `datasource` that names no
+ * datasource (#26724), a `runAs: 'system'` flow an anonymous
  * endpoint names, the shared runtime authoring rules, and the authoring gate a
  * domain plugin registers. Measured on `origin/main` `5801a4f2c` before this
  * file: each restore door wrote every one of those shapes back, so a version
@@ -92,6 +93,8 @@ function makeStubEngine() {
     const rows = new Map<string, Row>();
     const historyRows: HistoryRow[] = [];
     const registered = new Map<string, Map<string, unknown>>();
+    // [#26724] The drivers the engine has registered by name, with no datasource item.
+    const drivers = new Set<string>();
     let nextId = 0;
     let commit: unknown = null;
 
@@ -169,6 +172,7 @@ function makeStubEngine() {
             return { deleted: 1 };
         },
         async count() { return 0; },
+        getDriverByName: (name: string) => (drivers.has(name) ? { name } : undefined),
         async syncObjectSchema() { return true; },
         async dropObjectSchema() { return true; },
         registry: {
@@ -195,6 +199,7 @@ function makeStubEngine() {
         rows,
         historyRows,
         registered,
+        drivers,
         serveCommit: (c: unknown) => { commit = c; },
     };
 }
@@ -476,6 +481,27 @@ pinBothDoors({
     expectDetail: (error) => expect(error.issues).toEqual([expect.objectContaining({ path: 'runAs', code: 'custom' })]),
 });
 
+pinBothDoors({
+    title: 'an object restored with a `datasource` that names nothing now (unknownDatasourceSaveRefusal)',
+    type: 'object',
+    name: 'wh_order',
+    code: 'INVALID_METADATA',
+    status: 422,
+    async stage(h) {
+        h.drivers.add('rt_store');
+        await h.protocol.saveMetaItem({ type: 'object', name: 'wh_order', item: order({ datasource: 'rt_store' }) });
+        await h.protocol.saveMetaItem({ type: 'object', name: 'wh_order', item: order({ datasource: undefined }) });
+        await h.protocol.saveMetaItem({ type: 'object', name: 'wh_order', item: order({ datasource: undefined, label: 'Order v3' }) });
+        // The driver v1 was bound to is gone.
+        h.drivers.delete('rt_store');
+        return { refused: 1, accepted: 2 };
+    },
+    expectDetail: (error) => {
+        expect(error.issues).toEqual([expect.objectContaining({ path: 'datasource', code: 'custom' })]);
+        expect(error.issues[0].message.startsWith("Object 'wh_order' names datasource 'rt_store', and no datasource")).toBe(true);
+    },
+});
+
 pinBothDoors({
     title: 'a body the runtime authoring rules refuse (assertRuntimeAuthoringRules)',
     type: 'object',