@@ -0,0 +1,11 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): an object draft's verdict names the package namespace-prefix refusal its publish gives (#27444)
+
+Clause-②: no
+Metadata-protocol: none
+Skills-docs: none — no file under `skills/**` describes what a draft's `_diagnostics` carries; the namespace-prefix rule itself is unchanged.
+
+A draft object saved into a package whose manifest declares a namespace, under a name without the `<namespace>_` prefix, read `_diagnostics: { valid: true }` until "Publish all" refused the whole batch with `NAMESPACE_PREFIX`. The draft read now asks the same judge the publish pre-flight and the per-item publish ask, on the package the draft is staged into, and folds its answer into `_diagnostics`: `valid: false` with an `errors[]` entry whose `code` is `NAMESPACE_PREFIX` and whose message is the sentence publish refuses with. The draft save itself is unchanged — it still stores and answers 200 `state: "draft"` — and publish refuses exactly as before.
@@ -74,6 +74,7 @@ export interface AuthoringGateHost {
     externalBindingSaveRefusal: ObjectStackProtocolImplementation['externalBindingSaveRefusal'];
     foldStoredCollection: ObjectStackProtocolImplementation['foldStoredCollection'];
     getOverlayRepo: ObjectStackProtocolImplementation['getOverlayRepo'];
+    objectNamespacePrefixViolation: ObjectStackProtocolImplementation['objectNamespacePrefixViolation'];
     hierarchyResolverMounted: ObjectStackProtocolImplementation['hierarchyResolverMounted'];
     isArtifactBacked: ObjectStackProtocolImplementation['isArtifactBacked'];
     orgWallEnforced: ObjectStackProtocolImplementation['orgWallEnforced'];
@@ -461,7 +462,7 @@ export async function judgeRuntimeAuthoringRules(
 
 /** The body of `ObjectStackProtocolImplementation#draftPublishVerdict`; the method's docblock there is its contract. */
 export async function draftPublishVerdict(
-    this: RuntimeRulesHost & Pick<AuthoringGateHost, 'collectBatchPendingDeclarations' | 'credentialChannelFor' | 'getOverlayRepo'>,
+    this: RuntimeRulesHost & Pick<AuthoringGateHost, 'collectBatchPendingDeclarations' | 'credentialChannelFor' | 'getOverlayRepo' | 'objectNamespacePrefixViolation'>,
     draft: { type: string; name: string; body: unknown; packageId: string | null },
 ): Promise<RuntimeAuthoringIssue[]> {
     const singular = PLURAL_TO_SINGULAR[draft.type] ?? draft.type;
@@ -490,5 +491,22 @@ export async function draftPublishVerdict(
             ? { restoredCredentialPaths: () => channel.heldPaths({ name: draft.name, state: 'draft', item: draft.body }) }
             : {}),
     });
-    return (verdict.error as { issues?: RuntimeAuthoringIssue[] } | null)?.issues ?? [];
+    const issues = (verdict.error as { issues?: RuntimeAuthoringIssue[] } | null)?.issues ?? [];
+    // [#27444 · ADR-0129 D2] The namespace-prefix rule is not a gate rule: the
+    // doors that make an object live under a package ask it on their own
+    // (the publish pre-flight, the per-item publish), so the draft verdict
+    // asks the same judge, on the package the draft is staged into — the one
+    // "Publish all" promotes it under — and answers its code and sentence.
+    const prefixViolation = singular === 'object'
+        ? this.objectNamespacePrefixViolation(draft.name, draft.packageId)
+        : null;
+    if (!prefixViolation) return issues;
+    return [{
+        rule: 'NAMESPACE_PREFIX',
+        path: 'name',
+        where: `object "${draft.name}"`,
+        message: prefixViolation,
+        hint: prefixViolation,
+        severity: 'error',
+    }, ...issues];
 }
@@ -464,6 +464,61 @@ describe('a draft reads the verdict its publish gives (#26707)', () => {
     });
 });
 
+describe('[#27444] an object draft without its package namespace prefix', () => {
+    // A package whose manifest DECLARES a namespace, beside the stub's
+    // namespace-less base: the prefix rule judges only the former.
+    const NS_PKG = 'qa.scratch.r2';
+    const nsEngine = () => {
+        const stub = makeStubEngine();
+        const base = stub.engine.registry.getPackage;
+        stub.engine.registry.getPackage = (id: string) =>
+            id === NS_PKG ? { manifest: { id: NS_PKG, namespace: 'r2' } } : base(id);
+        return stub;
+    };
+    const objectBody = (name: string) => ({
+        name,
+        label: 'Formula Pkg',
+        sharingModel: 'private',
+        fields: { name: { type: 'text', label: 'Name' } },
+    });
+    const stage = (protocol: ObjectStackProtocolImplementation, name: string) =>
+        (protocol as any).saveMetaItem({ type: 'object', name, item: objectBody(name), packageId: NS_PKG, mode: 'draft' });
+    const read = async (protocol: ObjectStackProtocolImplementation, name: string) =>
+        ((await protocol.getMetaItem({ type: 'object', name, state: 'draft', packageId: NS_PKG } as any)) as any)
+            .item._diagnostics as { valid: boolean; errors?: Array<{ path: string; message: string; code?: string }> };
+
+    it('saves as a draft, and its read carries the NAMESPACE_PREFIX refusal publish-drafts gives', async () => {
+        const { engine, rows } = nsEngine();
+        const protocol = new ObjectStackProtocolImplementation(engine);
+
+        // The draft still saves (ADR-0129 D2: a draft is judged when it is promoted).
+        expect(await stage(protocol, 'qa_formula_pkg_r2')).toMatchObject({ success: true, state: 'draft' });
+        expect([...rows.values()].filter((r) => r.name === 'qa_formula_pkg_r2').map((r) => r.state)).toEqual(['draft']);
+
+        const diagnostics = await read(protocol, 'qa_formula_pkg_r2');
+
+        // The batch publish still refuses it, as before…
+        const res: any = await protocol.publishPackageDrafts({ packageId: NS_PKG });
+        expect(res).toMatchObject({ success: false, outcome: 'refused', publishedCount: 0 });
+        const refused = res.failed.find((f: any) => f.name === 'qa_formula_pkg_r2');
+        expect(refused?.code).toBe('NAMESPACE_PREFIX');
+
+        // …and the draft's verdict is that refusal: its code, its sentence.
+        expect(diagnostics.valid).toBe(false);
+        expect(diagnostics.errors?.filter((e) => e.code === 'NAMESPACE_PREFIX').map((e) => e.message))
+            .toEqual([refused.error]);
+    });
+
+    it('a prefixed draft object in the same package still reads valid:true', async () => {
+        const { engine } = nsEngine();
+        const protocol = new ObjectStackProtocolImplementation(engine);
+        await stage(protocol, 'r2_formula_pkg');
+
+        expect(await read(protocol, 'r2_formula_pkg')).toEqual({ valid: true });
+        expect(await protocol.publishPackageDrafts({ packageId: NS_PKG })).toMatchObject({ success: true, failedCount: 0 });
+    });
+});
+
 describe('[#27445] a stored dashboard carrying an undeclared filterBindings key', () => {
     const board = CASES.find((c) => c.rule === 'dashboard-filter-binding-unknown')!.item;
 
 
@@ -7218,6 +7218,11 @@ export class ObjectStackProtocolImplementation implements
      * Computed on every draft read rather than stored at save: the verdict
      * depends on the live universe and the package's other drafts, which a
      * stored verdict would not see change.
+     *
+     * [#27444] An object draft is also told the namespace-prefix verdict
+     * ({@link objectNamespacePrefixViolation}, `NAMESPACE_PREFIX`), the one
+     * rule outside the gate that the promotion doors refuse a draft on — the
+     * same judge, on the draft row's package, never a copy of it.
      */
     private draftPublishVerdict(draft: {
         type: string; name: string; body: unknown; packageId: string | null;
@@ -7232,6 +7237,7 @@ export class ObjectStackProtocolImplementation implements
             foldStoredCollection: (...a) => this.foldStoredCollection(...a),
             getOverlayRepo: (...a) => this.getOverlayRepo(...a),
             hierarchyResolverMounted: (...a) => this.hierarchyResolverMounted(...a),
+            objectNamespacePrefixViolation: (...a) => this.objectNamespacePrefixViolation(...a),
             orgWallEnforced: (...a) => this.orgWallEnforced(...a),
             resolveSduiManifest: (...a) => this.resolveSduiManifest(...a),
             resolveWritePackageScope: (...a) => this.resolveWritePackageScope(...a),