@@ -0,0 +1,12 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): the stored-metadata healing pass re-saves a draft-only permission set that grants on an object which exists nowhere now, instead of reporting it `failed`
+
+Clause-②: yes (widening) — `migrateStoredMetadata` (`os migrate meta --stored --apply`, `POST /api/v1/meta/_migrate-stored`) now rewrites a draft-only permission set whose stored body needs a conversion and whose grant names an object with no active row and no draft; it reported that row `failed` with the unknown-grant `422`. Every author-facing save, publish and restore door judges the grant as before.
+Metadata-protocol: none
+
+- **Before.** The save door's unknown-grant refusal skips a grant the set already holds, read from the set's active row. A set that is only a draft has none, so the pass re-saving its own draft (for example to strip the retired `managedBy` key) was refused once the object draft it granted on had been discarded, and the legacy key stayed at rest.
+- **Now.** A `migrate-stored` re-save is not judged for unknown grants, as it already is not for a seed's keyed field: it rewrites a row the store already holds. A draft stored before the rule is refused at its publish, as any other publish of it is.
+- **Wording.** At a draft's publish the finding now says what the publish looked for: "no package registers an object of that name, and no published object, or object draft of this batch, carries it". The save door's sentence, the finding path and the leading "Permission 'SET' grants on object 'NAME' which is not defined in objects" are unchanged.
@@ -541,6 +541,7 @@ export async function unknownGrantObjectSaveRefusal(
     name: string,
     pending?: 'drafts' | ReadonlySet<string>,
     writeFace?: MetadataWriteFace,
+    door: 'save' | 'publish' = 'save',
 ): Promise<(Error & { code: 'INVALID_METADATA'; status: 422; issues: MetadataIssueEntry[] }) | undefined> {
     if (singularType !== 'permission') return undefined;
     if (!item || typeof item !== 'object' || Array.isArray(item)) return undefined;
@@ -587,10 +588,15 @@ export async function unknownGrantObjectSaveRefusal(
         : new Set<string>();
     unknown = unknown.filter((key) => !held.has(key));
     if (unknown.length === 0) return undefined;
+    // [#29279] What was looked for, as this door looked: a save also counts an
+    // object saved here; a draft's publish counts only what goes live with it.
+    const looked = door === 'publish'
+        ? 'no package registers an object of that name, and no published object, or object draft of this batch, carries it'
+        : 'no package registers an object of that name and none is saved here';
     const issues: MetadataIssueEntry[] = unknown.map((key) => ({
         path: `objects.${key}`,
-        message: `Permission '${name}' grants on object '${key}' which is not defined in objects: no package registers `
-            + 'an object of that name and none is saved here, so the grant applies to nothing. Correct the name to the '
+        message: `Permission '${name}' grants on object '${key}' which is not defined in objects: ${looked}, `
+            + 'so the grant applies to nothing. Correct the name to the '
             + `object's full name (e.g. 'crm_lead', not 'lead'), create the object first, or remove the grant.`,
         code: 'custom',
     }));
 
@@ -14993,31 +14993,36 @@ export class ObjectStackProtocolImplementation implements
      *    on a package publish, an object draft of the same batch (`pending` as
      *    a set), since the batch promotes as one unit in no type order;
      *  - the set's current definition already grants on it: the grant is not
-     *    this write's. A re-save, a stored-row migration (`os migrate meta
-     *    --stored`) or a restore that keeps it is not judged, and neither is
-     *    an object that has gone since the grant was made.
+     *    this write's. A re-save or a restore that keeps it is not judged, and
+     *    neither is an object that has gone since the grant was made.
      *
      * Asked in draft and in publish mode by {@link saveMetaItem} after the
-     * schema gate, again by {@link promoteDraftForPublish} on the draft body
+     * schema gate (except a `migrate-stored` re-save, the platform healing
+     * its own storage: a draft-only set holds no active definition, so its
+     * own rewrite would be judged as new grants), again by {@link promoteDraftForPublish} on the draft body
      * (the object can go between a draft's save and its publish), and by the
      * restore doors ({@link refuseRestoredBodyTheSaveDoorRefuses}). Answered
      * as the schema gate answers: `422 INVALID_METADATA`, one finding per
-     * unknown object at `objects.<name>`, naming it.
+     * unknown object at `objects.<name>`, naming it. [#29279] `door` names
+     * what the finding says was looked for: a save counts an object saved
+     * here, a draft's publish (`'publish'`) only a published object or an
+     * object draft of its batch.
      */
     private unknownGrantObjectSaveRefusal(
         singularType: string,
         item: unknown,
         name: string,
         pending?: 'drafts' | ReadonlySet<string>,
         writeFace?: MetadataWriteFace,
+        door?: 'save' | 'publish',
     ): Promise<(Error & { code: 'INVALID_METADATA'; status: 422; issues: MetadataIssueEntry[] }) | undefined> {
         const readEngine = () => this.engine;
         const host: ThisParameterType<typeof unknownGrantObjectSaveRefusal> = {
             get engine() { return readEngine(); },
             listDrafts: (...a) => this.listDrafts(...a),
             readMetaItem: (...a) => this.readMetaItem(...a),
         };
-        return unknownGrantObjectSaveRefusal.call(host, singularType, item, name, pending, writeFace);
+        return unknownGrantObjectSaveRefusal.call(host, singularType, item, name, pending, writeFace, door);
     }
 
     /**
@@ -16766,8 +16771,12 @@ export class ObjectStackProtocolImplementation implements
         // here is refused, in draft and in publish mode, after the schema and
         // before the authoring gate and every write: stored, the grant applies
         // to nothing. A draft may grant on an object that is itself still a
-        // draft. See {@link unknownGrantObjectSaveRefusal}.
-        {
+        // draft. [#29279] A `migrate-stored` re-save rewrites a row the store
+        // already holds and is not judged: a draft-only set has no active row
+        // to hold its grants, so judging it refused the pass's own rewrite of
+        // a draft whose object draft was gone; the draft is judged at its
+        // publish. See {@link unknownGrantObjectSaveRefusal}.
+        if (writeSource !== 'migrate-stored') {
             const grantRefusal = await this.unknownGrantObjectSaveRefusal(
                 singularType, request.item, request.name, mode === 'draft' ? 'drafts' : undefined, request.writeFace,
             );
@@ -18678,7 +18687,7 @@ export class ObjectStackProtocolImplementation implements
         // {@link unknownGrantObjectSaveRefusal}.
         if (draftForGate) {
             const grantRefusal = await this.unknownGrantObjectSaveRefusal(
-                singularType, draftForGate.body, request.name, request.batchObjects,
+                singularType, draftForGate.body, request.name, request.batchObjects, undefined, 'publish',
             );
             if (grantRefusal) throw grantRefusal;
         }
 
@@ -187,18 +187,25 @@ function plant(rows: Map<string, Row>, body: Record<string, unknown>, state: 'dr
     rows.set(keyOf(data), { ...data, id: `planted_${state}_${String(body.name)}` });
 }
 
-/** The finding's first sentence, spelled out. */
-const unknownFinding = (setName: string, objectName: string) =>
+/**
+ * The finding's first sentence, spelled out. [#29279] A draft's publish says
+ * what it looked for there: a published object or an object draft of its
+ * batch, not an object "saved here" (a draft of it may be saved here).
+ */
+const unknownFinding = (setName: string, objectName: string, door: 'save' | 'publish' = 'save') =>
     `Permission '${setName}' grants on object '${objectName}' which is not defined in objects: no package registers `
-    + 'an object of that name and none is saved here, so the grant applies to nothing.';
+    + (door === 'publish'
+        ? 'an object of that name, and no published object, or object draft of this batch, carries it'
+        : 'an object of that name and none is saved here')
+    + ', so the grant applies to nothing.';
 
-const expectRefusal = (err: any, setName: string, objectNames: string[]) => {
+const expectRefusal = (err: any, setName: string, objectNames: string[], door: 'save' | 'publish' = 'save') => {
     expect({ code: err?.code, status: err?.status }, String(err?.message)).toEqual({ code: 'INVALID_METADATA', status: 422 });
     expect(String(err.message).startsWith(`permission/${setName} failed spec validation: `), String(err.message)).toBe(true);
     expect(err.issues.map((i: any) => i.path)).toEqual(objectNames.map((o) => `objects.${o}`));
     for (const [index, objectName] of objectNames.entries()) {
         expect(err.issues[index].code).toBe('custom');
-        expect(String(err.issues[index].message).startsWith(unknownFinding(setName, objectName)), err.issues[index].message).toBe(true);
+        expect(String(err.issues[index].message).startsWith(unknownFinding(setName, objectName, door)), err.issues[index].message).toBe(true);
     }
 };
 
@@ -237,7 +244,7 @@ describe('[#28990] the permission-set save door — a grant on an object that do
         // The set alone goes live; its object stays a draft.
         const err = await refusalOf(protocol.publishMetaItem({ type: 'permission', name: 'qa_probe' }));
 
-        expectRefusal(err, 'qa_probe', ['qa_widget']);
+        expectRefusal(err, 'qa_probe', ['qa_widget'], 'publish');
         expect(stored(rows, 'permission', 'qa_probe')).toEqual(['draft|-|qa_widget']);
     });
 });
@@ -249,7 +256,7 @@ describe('[#28990] the publish doors — a set draft stored before the rule', ()
 
         const err = await refusalOf(protocol.publishMetaItem({ type: 'permission', name: 'qa_probe' }));
 
-        expectRefusal(err, 'qa_probe', ['qa_no_such_object']);
+        expectRefusal(err, 'qa_probe', ['qa_no_such_object'], 'publish');
         expect(stored(rows, 'permission', 'qa_probe')).toEqual(['draft|-|qa_no_such_object']);
     });
 
@@ -263,13 +270,42 @@ describe('[#28990] the publish doors — a set draft stored before the rule', ()
         expect(res).toMatchObject({ outcome: 'refused', success: false, publishedCount: 0, published: [] });
         const causal = res.failed.find((f: any) => f.name === 'qa_probe');
         expect(causal, JSON.stringify(res.failed)).toMatchObject({ type: 'permission', code: 'INVALID_METADATA' });
-        expect(JSON.stringify(causal)).toContain("grants on object 'qa_no_such_object'");
+        expect(JSON.stringify(causal)).toContain(unknownFinding('qa_probe', 'qa_no_such_object', 'publish'));
         // (The double's `transaction` does not roll back, so the sibling's
         // promotion is not read here: `publishedCount: 0` is the batch's word.)
         expect(stored(rows, 'permission', 'qa_probe')).toEqual([`draft|${PKG}|qa_no_such_object`]);
     });
 });
 
+describe('[#29279] the stored-metadata healing pass — a draft-only set stored before the rule', () => {
+    it('`migrate-stored` rewrites it (a legacy key stripped), and its publish is still refused', async () => {
+        const { protocol, rows } = makeSession();
+        plant(rows, set('qa_probe', ['qa_no_such_object'], { managedBy: 'user' }), 'draft', null);
+
+        const report = await protocol.migrateStoredMetadata({ apply: true, types: ['permission'] });
+
+        const row = report.rows.find((r: any) => r.name === 'qa_probe');
+        expect(row, JSON.stringify(row)).toMatchObject({ state: 'draft', outcome: 'rewritten' });
+        const bodies = [...rows.values()].filter((r) => r.type === 'permission').map((r) => JSON.parse(r.metadata));
+        expect(bodies).toHaveLength(1);
+        expect(bodies[0]).not.toHaveProperty('managedBy');
+        expect(stored(rows, 'permission', 'qa_probe')).toEqual(['draft|-|qa_no_such_object']);
+        const err = await refusalOf(protocol.publishMetaItem({ type: 'permission', name: 'qa_probe' }));
+        expectRefusal(err, 'qa_probe', ['qa_no_such_object'], 'publish');
+    });
+
+    it('an author re-saving the same draft is still refused', async () => {
+        const { protocol, rows } = makeSession();
+        plant(rows, set('qa_probe', ['qa_no_such_object'], { managedBy: 'user' }), 'draft', null);
+
+        const err = await refusalOf(protocol.saveMetaItem({
+            type: 'permission', name: 'qa_probe', item: set('qa_probe', ['qa_no_such_object']), mode: 'draft',
+        }));
+
+        expectRefusal(err, 'qa_probe', ['qa_no_such_object']);
+    });
+});
+
 describe('[#28990] controls — a grant on an object that exists is not refused', () => {
     it.each([
         ['an object the registry registers', ['qa_widget']],