docs(qa): key the permission-matrix publish refusal on code NO_DRAFT, not a retired message spelling

[objectstack-fleet]

Fixes #19705
Clause-②: no

What

docs/qa/platform-checklist/areas/access-security.json, item access-security.permission-matrix-edit-loop (P1): clause 2 and its verify quoted the nothing-to-publish refusal by a bracketed lowercase opener inside the message text. That opener was retired from every metadata-protocol refusal in 7a25a3ee9c (PR #19683), so a checker following the clause verbatim against a live answer recorded a false failure.

Per the card's fix shape (adopted by triage): the clause and verify now key on the code axis: HTTP 404 whose body carries code: 'NO_DRAFT', and say explicitly to judge the refusal on status + code, never on message prose. Pass/fail semantics are unchanged.

• revision 2 -> 3, with a new append-only history entry (revision 3, ref [finding] Two QA platform-checklist area files quote 404 [no_draft] as the expected refusal text — a spelling #16245 retires #19705). The revision-2 history entry that quotes the old spelling is untouched (history is append-only).
• New source row: packages/metadata-protocol/src/sys-metadata-repository.ts#promoteDraft, the producer.

Runtime site (verified on origin/main 71ef221)

• Producer: SysMetadataRepository.promoteDraft (packages/metadata-protocol/src/sys-metadata-repository.ts) throws message No pending draft exists for TYPE/NAME — nothing to publish. with code = 'NO_DRAFT', status = 404. No bracketed opener.
• Route: POST /meta/:type/:name/publish in packages/rest/src/rest-server.ts routes the throw through handleRouteError; the wire body shape { error, code: 'NO_DRAFT' } is pinned in rest-4xx-message-truncation.test.ts and rest-5xx-message-sanitization.test.ts.
• Status and code match the card. Absence of the opener family is pinned by protocol.bracketed-refusal-opener-absence.test.ts.

Carrier re-derivation over docs/qa/**

Instrument: git grep -ni no_draft -- docs/qa plus a family census git grep -noE '[0-9]{3} \[[a-z][a-z_]+\]' -- docs/qa, at 71ef221 (base). Radius: every tracked file under docs/qa/. Lit control: git grep -nic invalid_metadata -- docs/qa answers 3 hits in each of two area files, so the instrument reaches both files.

• Before: no_draft 3 lines, all in access-security.json (clause, verify, revision-2 history).
• After (db81a89): 1 line, the immutable revision-2 history entry. No other docs/qa/** carrier of the retired no_draft spelling exists.

Gates (all at db81a89b)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 13 commands; all 13 run, reconciled with --ran (13 derived, 13 run, 0 NOT-MEASURED, derived from recorded exit codes). All exit 0. check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET, formula/lint unbuilt, nothing measured); after turbo run build --filter=@objectstack/formula --filter=@objectstack/lint it re-ran exit 0.

check:platform-checklist anchor counts: symbol anchors before 620/638 resolved against 310 cited sources, after 621/639 against 311 (the one new source row resolves); residual 18 unchanged; 17 file floors held; line citations 0 before and after. No floor or ledger touched.

Changeset

None. Docs/QA-only: docs/qa/** ships in no package's files[] (git grep -l docs/qa -- '**/package.json' = 0 hits; positive control: the files arrays exist and list dist). This is skip-changeset territory; per the dispatch, no label write was attempted from this seat.

Acceptance notes

• docs/qa/platform-checklist/areas/studio-authoring.json is off-limits for this card by the triage ruling. Its [invalid_metadata] lines have already been re-spelled on main (its item revision 3, dated 2026-09-23). It still carries 422 [writable_package_required] in one clause and one source row, for the metadata-protocol write door, which no longer emits that opener (SysMetadataRepository throws WRITABLE_PACKAGE_REQUIRED / 422 with plain prose). Same false-failure class as this card; reported for the seat to file or attach to [finding] Three more producers still write bracketed openers that restate their own declared code — the #16245 family beyond its two named files #19709, not edited here.
• packages/runtime/src/domains/packages.ts still opens two refusals with a bracketed restatement of their declared code ([writable_package_required] and [duplicate_source_not_a_base]). The absence pin covers only metadata-protocol. Reported, not edited here (outside docs/qa/**).
• packages/rest/src/rest-server.ts: the comment above the publish route still reads 404 [no_draft] when nothing to publish. This is a code comment, not a refusal, so it goes here as a note only.
• packages/client JSDoc carrying the same spelling is [finding] packages/client/src/index.ts:2151 JSDoc still documents 404 [no_draft], a spelling the runtime no longer emits after #16245 #19704 (a domain:cli card). [finding] packages/client/src/index.ts:2151 JSDoc still documents 404 [no_draft], a spelling the runtime no longer emits after #16245 #19704 is not addressed here.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: db81a89b3a36a7ce979995065d5050ac50f9ad0d

① Derived judgments

• "POST .../publish then answers 404 with code NO_DRAFT because nothing is pending": packages/metadata-protocol/src/sys-metadata-repository.ts:942-948 (No pending draft exists for … — nothing to publish., err.code = 'NO_DRAFT', err.status = 404). Bracketed opener retired in 7a25a3ee (ancestor of origin/main; protocol.bracketed-refusal-opener-absence.test.ts:8). True.
• "rest-server.ts mounts POST /meta/:type/:name/publish for every type": packages/rest/src/rest-server.ts:7943 (path: \${metaPath}/:type/:name/publish`, method: 'POST'`). True.
• "HTTP 404 whose body carries code: 'NO_DRAFT'": wire shape { error, code: 'NO_DRAFT' } pinned in packages/rest/src/rest-4xx-message-truncation.test.ts:344-352 and meta-item-absent-404.test.ts:534-541. True.
• "the message is prose, and a quoted message spelling goes stale without the refusal changing": the 2026-08-29 ruling as recorded in the absence pin test. True.
• New source row packages/metadata-protocol/src/sys-metadata-repository.ts#promoteDraft: symbol exists at :885. Resolves.
• history: revision-1 and revision-2 entries byte-unchanged (only the array separator comma appended to rev 2); revision-3 appended; revision 2→3. Append-only holds. Pass/fail semantics of the clause unchanged (either 2xx-after-draft or 404/NO_DRAFT passes provided the verb is published).
• No accept set or public surface touched; Clause-②: no is right. No generated/release/governed path.

② Semver level

docs/qa/** only (one file); ships in no package files[]; no .changeset/*.md. No changeset is correct; skip-changeset is the route.

③ Boundary flags

• none crossed: studio-authoring.json (struck from the card by triage) untouched; [finding] packages/client/src/index.ts:2151 JSDoc still documents 404 [no_draft], a spelling the runtime no longer emits after #16245 #19704 (packages/client, domain:cli) not folded; rev-2 history entry quoting the old spelling correctly left as is.
• Note for the PM: the stale // 404 [no_draft] code comment at rest-server.ts:7940 remains (dev recorded it as out-of-scope; not a doc carrier).

Implemented-by: claude/issue-19705-no-draft-code-axis
Reviewed-by: session_01VDtqoecgES7ScQYGbFVDRv

VERDICT: PASS

Isolated at-tier reviewer, adopted by the domain:devx#1 seat. Reviewed with the seat's own ACCEPT excluded from its inputs.

---

Generated by Claude Code