fix(metadata-protocol): audit the batch package publish in Phase 2, outside the transaction (#8400) (#8605)

* fix(metadata-protocol): audit the batch package publish in Phase 2, outside the transaction

`publishPackageDrafts` (Studio's "publish whole app") wrote no
`sys_metadata_audit` rows at all — neither the allowed-outcome `publish`
rows nor a `denied` row for a refusal. It calls `promoteDraftForPublish`
directly, so #7748's row in `publishMetaItem` never ran for it.

Both outcomes are written in Phase 2, after the ADR-0067 D2 transaction
has closed: the allowed rows off `promoted[]`, the `denied` row from the
rollback `catch`. Inside the transaction the refusal's own row would roll
back with the batch it records, which is the defect #7748 closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WMpuAfA2KSdDjGF6tm1bH

* test(metadata-protocol): mark the audit-vocabulary literals; add changeset

`check:error-code-casing` correctly flags `code: 'batch_aborted'` in a code
position. Opted out per site with the gate's documented `adr0112-ok: D6b`
marker rather than exempting the whole file, so the rest stays guarded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WMpuAfA2KSdDjGF6tm1bH

* test(metadata-protocol): pin BOTH audit rows to the draft's own org scope

The existing fixtures used ORG for the draft and for the publishing session,
so an audit row keyed on either would pass. These two differ: an env-wide
draft (organization_id IS NULL) published, and refused, by a non-null-org
caller — the #3115 shape listDrafts surfaces via its $or.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WMpuAfA2KSdDjGF6tm1bH

---------

Co-authored-by: os-zhuang <jack@objectstack.ai>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

.changeset/package-publish-audit-rows.md

@@ -0,0 +1,29 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/metadata-core': patch
+---
+
+fix(metadata-protocol): `publishPackageDrafts` now writes the audit rows a batch publish always owed
+
+Studio's "publish whole app" (`POST /packages/:id/publish-drafts`) promoted every
+draft in a package and wrote **no `sys_metadata_audit` rows at all** — neither the
+allowed-outcome `publish` rows nor a `denied` row for a refusal. The route calls
+`promoteDraftForPublish` directly rather than `publishMetaItem`, so the row added
+for the single-item routes never ran for it: a batch that published twenty
+artifacts left the compliance trail exactly as empty as a batch nobody ran.
+
+Both outcomes are now recorded, and **where** they are recorded is the fix:
+
+- **allowed** — one `publish` / `allowed` row per promoted item, written in Phase 2
+  off `promoted[]`, with `source: 'protocol.publishPackageDrafts'` so the trail
+  distinguishes "publish whole app" from a single-item publish. The row is keyed on
+  the scope the draft was promoted in, not the request's active org, because
+  env-wide drafts are promoted env-wide.
+- **denied** — one `publish` / `denied` row with `code: 'batch_aborted'` when the
+  batch rolls back, written from the rollback handler, **outside** the
+  `engine.transaction()`. Written inside it, the refusal's own row would roll back
+  with the batch it records — leaving nothing behind about a refused publish, which
+  is the defect the single-item audit rows exist to close.
+
+The causal reason rides in `note`, which is served by `GET /api/v1/meta/:type/:name/audit`
+and therefore carries the client-facing text rather than raw driver output.

packages/metadata-core/src/objects/sys-metadata-audit.object.ts

@@ -123,9 +123,17 @@ export const SysMetadataAuditObject = ObjectSchema.create({
      *  - on `allowed`: `'ok'`
      *  - on `denied`: `'not_overridable'` | `'not_creatable'` |
      *    `'item_locked'` | `'invalid_metadata'` | `'destructive_change'` |
-     *    `'metadata_conflict'`
+     *    `'metadata_conflict'` | `'batch_aborted'`
      *  - on `forced`: `'lock_override'` (Phase 3)
      *
+     * `batch_aborted` (#8400) is the batch publish's own refusal value:
+     * `publishPackageDrafts` promotes a whole package inside ONE transaction,
+     * so its refusal is "the batch rolled back and nothing landed" rather than
+     * any one item's verdict, and the causal code rides in `note`. It is ONE
+     * fixed value on purpose — lower-casing whatever `error.code` happened to
+     * abort the batch would turn this closed set into an open one that grows
+     * silently with the error catalog.
+     *
      * Deliberately lowercase, and deliberately NOT the `error.code` vocabulary
      * (ADR-0112) even though the denial values are spelled the same as the
      * codes the protocol throws. This column is persisted audit history: rows