diff --git a/.changeset/11787-one-save-model.md b/.changeset/11787-one-save-model.md
new file mode 100644
index 0000000000..9f809b92f7
--- /dev/null
+++ b/.changeset/11787-one-save-model.md
@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+---
+
+Studio saves one way on a package: the permission matrix and hooks autosave to the package draft like the other pillars, every create dialog says *Save as draft*, and the Changes count keeps up with a save (objectui#11787).
+
+- **Permission matrix, package door.** An edit is saved to the package's draft 1.5 seconds after the last change, the same autosave the Data and Interfaces pillars run, and the header shows *Saving…* and then *Saved* with the time in place of the Save button. A CEL syntax error in the row filter holds the edit and says why. An edit made while a save is in flight is kept and sent next. The set's API name can no longer be edited here, because the autosave stores the draft under that name. It is set when the set is created.
+- **Permission matrix, environment-admin door.** Unchanged. It keeps its explicit Save, because it writes live access configuration (ADR-0086 D7).
+- **Hooks.** A hook autosaves to its draft the same way, and the *Save hook* button is gone. A hook whose run condition does not parse is held until it does. A hook keeps the name it was created with: while its name is changed the autosave holds, and a line says to change it back. The draft is stored under the hook's name, so a rename is not a save. Creating a hook and saving one both update the Changes count.
+- **Create dialogs.** *New permission set* now says *Save as draft*, like every other Studio create dialog.
+- **Changes count.** After a draft save, the header no longer says "No drafts pending publish" next to an item's "Unpublished draft" chip. It counts at least the draft just saved until its next read answers, and that read is sent after the save instead of reusing a read that was already in flight.
+
+No export, prop, type or language-pack key changes.
diff --git a/packages/app-shell/src/preview/usePendingDrafts.afterSave-11787.test.tsx b/packages/app-shell/src/preview/usePendingDrafts.afterSave-11787.test.tsx
new file mode 100644
index 0000000000..b1115b0860
--- /dev/null
+++ b/packages/app-shell/src/preview/usePendingDrafts.afterSave-11787.test.tsx
@@ -0,0 +1,141 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * objectui#11787 — the count read after a draft save is sent after it, and
+ * until it answers the count is known to be at least one.
+ *
+ * Studio's header showed "No drafts pending publish" beside an item's
+ * "Unpublished draft" chip after a save, until the count caught up. Two causes
+ * meet in this hook:
+ *   - the read a save asks for could JOIN a `_drafts` request already on the
+ *     wire (objectui#11797's sharing), sent before the save and so unable to
+ *     count the draft it wrote;
+ *   - until any read answers, the count shown is the one from before the save.
+ *
+ * Counted on the wire with the same held `fetch` the objectui#11797 pins use:
+ * every request stays open until the test answers it.
+ */
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { act, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { usePendingDrafts } from './usePendingDrafts.js';
+
+interface HeldRequest {
+  url: string;
+  respond: (status: number, body: unknown) => void;
+}
+
+function heldFetch() {
+  const held: HeldRequest[] = [];
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(
+      (input: RequestInfo | URL) =>
+        new Promise((resolve) => {
+          held.push({
+            url: String(input),
+            respond: (status, body) =>
+              resolve({ ok: status >= 200 && status < 300, status, json: async () => body }),
+          });
+        }),
+    ),
+  );
+  const reads = (url: string) => held.filter((r) => r.url === url);
+  return { held, reads };
+}
+
+const CRM = '/api/v1/meta/_drafts?packageId=app.crm';
+const draft = (name: string) => ({ type: 'object', name, packageId: 'app.crm' });
+
+/** The Studio header's shape: the count, whether it is behind a save, and the save's refresh. */
+function Header() {
+  const { count, refresh, behindSave } = usePendingDrafts({ packageId: 'app.crm' });
+  return (
+    <>
+      <span data-testid="count">{count === null ? 'unknown' : String(count)}</span>
+      <span data-testid="behind">{String(behindSave)}</span>
+      <button type="button" data-testid="saved" onClick={() => void refresh({ afterSave: true })} />
+      <button type="button" data-testid="refresh" onClick={() => void refresh()} />
+    </>
+  );
+}
+
+async function drain() {
+  for (let i = 0; i < 5; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('usePendingDrafts — the read after a draft save (objectui#11787)', () => {
+  it('is sent fresh while an earlier read is still on the wire, and its answer wins', async () => {
+    const { reads } = heldFetch();
+    render(<Header />);
+    await act(drain);
+    expect(reads(CRM)).toHaveLength(1);
+
+    // A draft save lands while the mount read is still pending.
+    await act(async () => {
+      fireEvent.click(screen.getByTestId('saved'));
+      await drain();
+    });
+    // Not joined to the request sent before the save.
+    expect(reads(CRM)).toHaveLength(2);
+    // Until a read sent after the save answers, the count is behind it.
+    expect(screen.getByTestId('behind').textContent).toBe('true');
+
+    // The pre-save read answers first, with the ledger as it was: ignored.
+    await act(async () => reads(CRM)[0].respond(200, []));
+    await act(drain);
+    expect(screen.getByTestId('count').textContent).toBe('unknown');
+    expect(screen.getByTestId('behind').textContent).toBe('true');
+
+    // The post-save read counts the draft the save wrote.
+    await act(async () => reads(CRM)[1].respond(200, [draft('crm_account')]));
+    await waitFor(() => expect(screen.getByTestId('count').textContent).toBe('1'));
+    expect(screen.getByTestId('behind').textContent).toBe('false');
+  });
+
+  it('CONTROL — a refresh that is not after a save still shares the pending read (objectui#11797)', async () => {
+    const { reads } = heldFetch();
+    render(<Header />);
+    await act(drain);
+    await act(async () => {
+      fireEvent.click(screen.getByTestId('refresh'));
+      await drain();
+    });
+    expect(reads(CRM)).toHaveLength(1);
+    expect(screen.getByTestId('behind').textContent).toBe('false');
+  });
+
+  it('stays behind when the read after the save fails, and a later answer clears it', async () => {
+    const { reads } = heldFetch();
+    render(<Header />);
+    await act(drain);
+    await act(async () => reads(CRM)[0].respond(200, []));
+    await waitFor(() => expect(screen.getByTestId('count').textContent).toBe('0'));
+
+    await act(async () => {
+      fireEvent.click(screen.getByTestId('saved'));
+      await drain();
+    });
+    await act(async () => reads(CRM)[1].respond(503, { success: false }));
+    await act(drain);
+    // The save is not in doubt: the draft it wrote exists.
+    expect(screen.getByTestId('count').textContent).toBe('unknown');
+    expect(screen.getByTestId('behind').textContent).toBe('true');
+
+    await act(async () => {
+      fireEvent.click(screen.getByTestId('refresh'));
+      await drain();
+    });
+    await act(async () => reads(CRM)[2].respond(200, [draft('crm_account')]));
+    await waitFor(() => expect(screen.getByTestId('count').textContent).toBe('1'));
+    expect(screen.getByTestId('behind').textContent).toBe('false');
+  });
+});
diff --git a/packages/app-shell/src/preview/usePendingDrafts.ts b/packages/app-shell/src/preview/usePendingDrafts.ts
index e16a66db0f..86684cc35e 100644
--- a/packages/app-shell/src/preview/usePendingDrafts.ts
+++ b/packages/app-shell/src/preview/usePendingDrafts.ts
@@ -61,7 +61,10 @@ export interface PendingDraftEntry {
  *  - the publish pulse (`emitMetadataRefresh`, the contract every publish path
  *    keeps — see the module doc) drops the pending requests before the hooks
  *    it wakes read again, so their read is never answered by a request sent
- *    before the publish.
+ *    before the publish;
+ *  - a draft save does the same for the read it asks for
+ *    (`refresh({ afterSave: true })`, objectui#11787): a request sent before
+ *    the save landed cannot count the draft it wrote.
  *
  * Keyed by the `fetch` the request went through: a request only answers
  * callers of the same transport. Each caller parses the shared payload itself,
@@ -70,6 +73,10 @@ export interface PendingDraftEntry {
 const pendingDraftReads = new WeakMap<typeof fetch, Map<string, Promise<unknown>>>();
 let publishPulseObserved = false;
 
+function draftsUrl(packageId?: string | null): string {
+  return `/api/v1/meta/_drafts${packageId ? `?packageId=${encodeURIComponent(packageId)}` : ''}`;
+}
+
 function readDraftsPayload(url: string): Promise<unknown> {
   // Registered on first use rather than at import, and so before the hook's
   // own pulse subscription (the hook reads first, then subscribes): the drop
@@ -107,8 +114,7 @@ function readDraftsPayload(url: string): Promise<unknown> {
 export async function fetchPendingDrafts(
   packageId?: string | null,
 ): Promise<PendingDraftEntry[]> {
-  const qs = packageId ? `?packageId=${encodeURIComponent(packageId)}` : '';
-  const data = (await readDraftsPayload(`/api/v1/meta/_drafts${qs}`)) as
+  const data = (await readDraftsPayload(draftsUrl(packageId))) as
     | Array<Record<string, unknown>>
     | { drafts?: Array<Record<string, unknown>>; data?: { drafts?: Array<Record<string, unknown>> } };
   const list = Array.isArray(data) ? data : (data?.drafts ?? data?.data?.drafts ?? []);
@@ -132,8 +138,25 @@ export interface UsePendingDraftsResult {
   /** null until the first successful read (lets callers hold rendering). */
   count: number | null;
   entries: PendingDraftEntry[];
-  /** Manual refetch — for surface-local triggers (draft saved, turn idle). */
-  refresh: () => Promise<void>;
+  /**
+   * Manual refetch — for surface-local triggers (draft saved, turn idle).
+   *
+   * objectui#11787 — `afterSave`: a draft save in this scope has just landed.
+   * The read is then sent fresh rather than joining one already on the wire,
+   * which was sent before the save and cannot count its draft, and
+   * {@link UsePendingDraftsResult.behindSave} holds until a read sent after it
+   * answers.
+   */
+  refresh: (opts?: { afterSave?: boolean }) => Promise<void>;
+  /**
+   * objectui#11787 — a draft save reported through `refresh({ afterSave: true })`
+   * has landed, and no read sent after it has answered yet. The draft it wrote
+   * exists, so a surface showing the count knows it is at least one: a header
+   * that said "nothing to publish" beside an item's "unpublished draft" chip
+   * was showing a count from before the save. Stays true when that read fails,
+   * since the save itself is not in doubt; a later answer clears it.
+   */
+  behindSave: boolean;
 }
 
 export function usePendingDrafts(opts: UsePendingDraftsOptions = {}): UsePendingDraftsResult {
@@ -143,15 +166,28 @@ export function usePendingDrafts(opts: UsePendingDraftsOptions = {}): UsePending
   // A single in-flight guard + generation counter: a refresh started before a
   // scope change must not land its stale answer on the new scope.
   const genRef = useRef(0);
+  // objectui#11787 — draft saves reported (`savesRef`, mirrored in `saves`
+  // for render), and how many of them the installed answer was sent after.
+  const savesRef = useRef(0);
+  const [saves, setSaves] = useState(0);
+  const [counted, setCounted] = useState(0);
 
-  const refresh = useCallback(async () => {
+  const refresh = useCallback(async (opts?: { afterSave?: boolean }) => {
     if (!enabled) return;
+    if (opts?.afterSave) {
+      savesRef.current += 1;
+      setSaves(savesRef.current);
+      // Never joined to a request sent before the save (objectui#11787).
+      pendingDraftReads.get(globalThis.fetch)?.delete(draftsUrl(packageId));
+    }
+    const sentAfter = savesRef.current;
     const gen = ++genRef.current;
     try {
       const list = await fetchPendingDrafts(packageId);
       if (genRef.current !== gen) return;
       setEntries(list);
       setCount(list.length);
+      setCounted(sentAfter);
     } catch {
       // An errored read means UNKNOWN, not zero: count stays null so surfaces
       // that must fail SAFE on unknown (the preview bar keeps its Publish
@@ -176,5 +212,5 @@ export function usePendingDrafts(opts: UsePendingDraftsOptions = {}): UsePending
     });
   }, [refresh, enabled]);
 
-  return { count, entries, refresh };
+  return { count, entries, refresh, behindSave: counted < saves };
 }
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.artifactTier.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.artifactTier.test.tsx
index 5f9e827d47..6dc8d4e554 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.artifactTier.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.artifactTier.test.tsx
@@ -247,7 +247,8 @@ describe('PermissionMatrixEditPage — MUST NOT CHANGE: what the artifact tier m
     codeLayer = { _packageId: 'com.example.showcase' };
     await renderMatrix({ packageId: 'com.example.showcase' });
 
-    expect(screen.getByRole('button', { name: /^Save$/ })).toBeEnabled();
+    // objectui#11787 — the package door autosaves: no Save button; the live controls are the writability read.
+    expect(screen.queryByRole('button', { name: /^Save$/ })).toBeNull();
     expect(screen.getByLabelText('a_account Read')).toBeEnabled();
     const row = screen.getByText('Account').closest('tr')!;
     for (const n of ['R', 'CRUD', 'All', 'None']) {
@@ -269,7 +270,8 @@ describe('PermissionMatrixEditPage — MUST NOT CHANGE: what the artifact tier m
     codeLayer = null;
     await renderMatrix({ packageId: 'com.example.showcase' });
 
-    expect(screen.getByRole('button', { name: /^Save$/ })).toBeEnabled();
+    // objectui#11787 — the package door autosaves: no Save button; the live controls are the writability read.
+    expect(screen.queryByRole('button', { name: /^Save$/ })).toBeNull();
     expect(screen.getByLabelText('a_account Read')).toBeEnabled();
     expect(lockBadge()).toBeNull();
   });
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.autosave-11787.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.autosave-11787.test.tsx
new file mode 100644
index 0000000000..f54a0336aa
--- /dev/null
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.autosave-11787.test.tsx
@@ -0,0 +1,202 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectui#11787 — one save model in Studio: the permission matrix autosaves on
+ * the PACKAGE door and keeps its explicit Save on the ENVIRONMENT door.
+ *
+ * ADR-0086 D6 puts the package Access door under package draft/publish "exactly
+ * like Data and Interfaces", and ADR-0033 §2 makes that draft the approval gate,
+ * so an autosave there writes the same draft the old Save button wrote. The
+ * environment-admin door writes live config (ADR-0086 D7): an autosave there
+ * would change access on every click, so it never autosaves.
+ *
+ * Each absence below is read against a presence from the same harness and the
+ * same edit: the package-door case that saves is the control for the
+ * environment door's silence, and the environment door's Save click is the
+ * control that its edit was a real one.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+
+const PUBLISHED = {
+  name: 'sales_perms',
+  label: 'Sales',
+  objects: { a_account: { allowRead: true, allowCreate: true } },
+  fields: {},
+};
+
+const LAYERED = { effective: PUBLISHED, code: null, overlay: null, overlayScope: null };
+
+/** A saved permission set, as far as these pins read it. */
+interface SavedSet {
+  objects: Record<string, Record<string, boolean>>;
+}
+
+interface Server {
+  saved: SavedSet[];
+  savedOpts: Array<Record<string, unknown> | undefined>;
+}
+
+/** A pending answer the test settles by hand: a save held in flight. */
+function deferred() {
+  let resolve!: () => void;
+  const promise = new Promise<void>((r) => {
+    resolve = r;
+  });
+  return { promise, resolve };
+}
+
+/** The slice of the metadata client the editor calls here. */
+type FakeClient = Record<string, (...args: never[]) => Promise<unknown>>;
+
+function makeClient(server: Server, opts: { holdFirstSave?: Promise<void> } = {}): FakeClient {
+  return {
+    layered: async () => LAYERED,
+    getDraft: async () => null,
+    list: async (type: string) => (type === 'object' ? [{ item: { name: 'a_account' } }] : []),
+    get: async () => null,
+    save: async (
+      _type: string,
+      _name: string,
+      payload: Record<string, unknown>,
+      saveOpts?: Record<string, unknown>,
+    ) => {
+      server.saved.push(JSON.parse(JSON.stringify(payload)) as SavedSet);
+      server.savedOpts.push(saveOpts);
+      if (server.saved.length === 1 && opts.holdFirstSave) await opts.holdFirstSave;
+      return payload;
+    },
+  };
+}
+
+let clientImpl: FakeClient;
+
+vi.mock('./useMetadata', () => ({
+  useMetadataClient: () => clientImpl,
+  useMetadataTypes: () => ({
+    loading: false,
+    error: null,
+    entries: [{ type: 'permission', label: 'Permission', allowOrgOverride: true }],
+  }),
+}));
+
+vi.mock('./AssignedUsersSection', () => ({ AssignedUsersSection: () => null }));
+
+import { PermissionMatrixEditPage } from './PermissionMatrixEditor';
+
+afterEach(cleanup);
+
+/** The shared autosave fires 1.5s after the last edit. */
+const AUTOSAVE = { timeout: 4000 };
+
+function renderDoor(packageId: string | undefined, onDraftSaved?: () => void) {
+  return render(
+    <MemoryRouter>
+      <PermissionMatrixEditPage
+        type="permission"
+        name="sales_perms"
+        packageId={packageId}
+        onDraftSaved={onDraftSaved}
+      />
+    </MemoryRouter>,
+  );
+}
+
+const accountRow = () => screen.getByText('a_account').closest('tr')!;
+const readBox = () => within(accountRow()).getByRole('checkbox', { name: 'a_account Read' });
+const saveButton = () => screen.queryByRole('button', { name: /^Save$/ });
+
+describe('the package door autosaves to the package draft (objectui#11787)', () => {
+  it('saves an edit as a draft of this package after the pause, with no Save button', async () => {
+    const server: Server = { saved: [], savedOpts: [] };
+    clientImpl = makeClient(server);
+    const onDraftSaved = vi.fn();
+    renderDoor('app.a', onDraftSaved);
+    await screen.findByText('a_account');
+
+    // No Save button on this door: the autosave is the save.
+    expect(saveButton()).toBeNull();
+
+    fireEvent.click(within(accountRow()).getByRole('button', { name: 'None' }));
+    // Debounced, not per click.
+    expect(server.saved).toHaveLength(0);
+
+    await waitFor(() => expect(server.saved).toHaveLength(1), AUTOSAVE);
+    expect(server.saved[0].objects.a_account).toEqual({});
+    expect(server.savedOpts[0]).toMatchObject({ mode: 'draft', packageId: 'app.a' });
+    // The surface's pending-changes count hears of it.
+    await waitFor(() => expect(onDraftSaved).toHaveBeenCalledTimes(1));
+    // The status line every Studio editor shows replaces the button.
+    expect(await screen.findByTestId('perm-saved-at')).toBeInTheDocument();
+  });
+
+  it('keeps an edit taken while the autosave is in flight, and sends it next (objectui#11204)', async () => {
+    const server: Server = { saved: [], savedOpts: [] };
+    const hold = deferred();
+    clientImpl = makeClient(server, { holdFirstSave: hold.promise });
+    renderDoor('app.a');
+    await screen.findByText('a_account');
+
+    fireEvent.click(within(accountRow()).getByRole('button', { name: 'None' }));
+    await waitFor(() => expect(server.saved).toHaveLength(1), AUTOSAVE);
+    expect(await screen.findByTestId('perm-autosaving')).toBeInTheDocument();
+
+    // A second edit while the first save is on the wire.
+    fireEvent.click(readBox());
+    expect(readBox()).toBeChecked();
+    hold.resolve();
+
+    // The landed save does not put its own body back over the newer edit…
+    await waitFor(() => expect(screen.queryByTestId('perm-autosaving')).toBeNull());
+    expect(readBox()).toBeChecked();
+    // …and the edit, still unsent, goes out next.
+    await waitFor(() => expect(server.saved).toHaveLength(2), AUTOSAVE);
+    expect(server.saved[0].objects.a_account).toEqual({});
+    expect(server.saved[1].objects.a_account).toEqual({ allowRead: true });
+  });
+
+  it('fixes the api name: it is the draft’s identity, set by "+ New"', async () => {
+    clientImpl = makeClient({ saved: [], savedOpts: [] });
+    renderDoor('app.a');
+    await screen.findByText('a_account');
+    fireEvent.click(screen.getByRole('button', { name: /Sales/ }));
+    expect(screen.getByLabelText('Name')).toBeDisabled();
+    // CONTROL: the label stays editable on the same door.
+    expect(screen.getByLabelText('Label')).toBeEnabled();
+  });
+});
+
+describe('the environment door keeps its explicit Save: live config never autosaves (ADR-0086 D7)', () => {
+  it('sends nothing on an edit, however long the pause, until Save is clicked', async () => {
+    const server: Server = { saved: [], savedOpts: [] };
+    clientImpl = makeClient(server);
+    const onDraftSaved = vi.fn();
+    renderDoor(undefined, onDraftSaved);
+    await screen.findByText('a_account');
+
+    fireEvent.click(within(accountRow()).getByRole('button', { name: 'None' }));
+    // Longer than the autosave's pause, which the package door's case above
+    // shows sending the same edit.
+    await new Promise((resolve) => setTimeout(resolve, 2200));
+    expect(server.saved).toHaveLength(0);
+    expect(screen.queryByTestId('perm-autosaving')).toBeNull();
+
+    // CONTROL: the edit is real, and the door's own Save writes it, live.
+    fireEvent.click(saveButton()!);
+    await waitFor(() => expect(server.saved).toHaveLength(1));
+    expect(server.saved[0].objects.a_account).toEqual({});
+    expect(server.savedOpts[0]).toEqual({ force: false });
+    expect(onDraftSaved).not.toHaveBeenCalled();
+  });
+
+  it('keeps the api name editable', async () => {
+    clientImpl = makeClient({ saved: [], savedOpts: [] });
+    renderDoor(undefined);
+    await screen.findByText('a_account');
+    fireEvent.click(screen.getByRole('button', { name: /Sales/ }));
+    expect(screen.getByLabelText('Name')).toBeEnabled();
+  });
+});
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.bulkMergeKeys.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.bulkMergeKeys.test.tsx
index 62dd6ca901..da5ac831b4 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.bulkMergeKeys.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.bulkMergeKeys.test.tsx
@@ -135,6 +135,15 @@ async function save(server: FakeServer) {
   return server.saved!;
 }
 
+/**
+ * objectui#11787 — the package door has no Save button: the edit autosaves to
+ * the package draft after the shared autosave's pause. Return what it sent.
+ */
+async function autosaved(server: FakeServer) {
+  await waitFor(() => expect(server.saved).not.toBeNull(), { timeout: 4000 });
+  return server.saved!;
+}
+
 describe('PermissionMatrixEditor · bulk buttons vs unmodelled keys (objectui#6605)', () => {
   it('"All" — the widening shape — grants every column AND the saved row keeps readScope / writeScope / allowExport', async () => {
     const server = await renderMatrix({
@@ -238,7 +247,7 @@ describe('PermissionMatrixEditor · bulk buttons vs unmodelled keys (objectui#66
     );
 
     fireEvent.click(bulkButton('a_account', 'All'));
-    const payload = await save(server);
+    const payload = await autosaved(server);
 
     const row = payload.objects.a_account;
     for (const key of MATRIX_KEYS) expect(row[key], key).toBe(true);
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.cloneToCustomize.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.cloneToCustomize.test.tsx
index 5163e5cb66..c8af12f3e6 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.cloneToCustomize.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.cloneToCustomize.test.tsx
@@ -553,9 +553,11 @@ describe('PermissionMatrixEditPage — a save the server refuses as a packaged s
       throw Object.assign(new Error(SERVER_TEXT), { status: 403, code: 'NOT_OVERRIDABLE' });
     };
     await renderPlain({ packageId: 'com.example.showcase' });
-    fireEvent.click(saveButton()!);
+    // objectui#11787 — the package door has no Save button: an edit autosaves
+    // to the package draft after the shared autosave's pause.
+    fireEvent.click(screen.getAllByRole('checkbox')[0]);
 
-    await screen.findByText(SERVER_TEXT);
+    await screen.findByText(SERVER_TEXT, undefined, { timeout: 4000 });
     expect(screen.queryByRole('alert')).toBeNull();
     expect(cloneButtons()).toHaveLength(0);
   });
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.dirty.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.dirty.test.tsx
index 068523e89f..a662ca0c87 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.dirty.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.dirty.test.tsx
@@ -8,7 +8,8 @@
  *
  *   • clean after the initial load,
  *   • dirty as soon as a matrix cell changes,
- *   • clean again after a successful Save (draft becomes the new baseline),
+ *   • clean again after a successful save (draft becomes the new baseline) —
+ *     on this door the save is the autosave (objectui#11787),
  *   • reset to false on unmount (a confirmed discard must clear the guard).
  */
 
@@ -102,9 +103,9 @@ describe('PermissionMatrixEditPage — onDirtyChange', () => {
     fireEvent.click(within(row).getByRole('button', { name: 'None' }));
     expect(onDirtyChange).toHaveBeenLastCalledWith(true);
 
-    // Save re-anchors the baseline — clean again, no reload needed.
-    fireEvent.click(screen.getByRole('button', { name: /^Save$/ }));
-    await waitFor(() => expect(server.saved).toHaveLength(1));
+    // The save re-anchors the baseline — clean again, no reload needed. On
+    // this door the save is the autosave, after its pause (objectui#11787).
+    await waitFor(() => expect(server.saved).toHaveLength(1), { timeout: 4000 });
     await waitFor(() => expect(onDirtyChange).toHaveBeenLastCalledWith(false));
   });
 
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorFacets.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorFacets.test.tsx
index abbb436e8e..313dc9d7a2 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorFacets.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorFacets.test.tsx
@@ -172,9 +172,15 @@ describe('PermissionMatrixEditPage — the PACKAGE door persists every authored
 
     await authorEveryFacet();
 
-    fireEvent.click(screen.getByRole('button', { name: /^Save$/ }));
-    await waitFor(() => expect(server.saved).toHaveLength(1));
-    const body = server.saved[0] as any;
+    // objectui#11787 — the package door autosaves to its draft after the
+    // shared autosave's pause; it has no Save button. An authoring pause along
+    // the way may send an earlier body, so the save read is the one carrying
+    // the last facet authored.
+    await waitFor(
+      () => expect((server.saved.at(-1) as any)?.adminScope).toEqual({ businessUnit: 'emea' }),
+      { timeout: 4000 },
+    );
+    const body = server.saved.at(-1) as any;
 
     // The row filter reaches the wire — the key whose absence was the defect.
     expect(body.rowLevelSecurity).toEqual([AUTHORED_POLICY]);
@@ -190,7 +196,7 @@ describe('PermissionMatrixEditPage — the PACKAGE door persists every authored
     });
     expect(body.fields['b_order.total']).toEqual({ readable: true, editable: true });
     // ADR-0086 P2 (D6/D7) — still a package-stamped DRAFT write, not a live one.
-    expect(server.savedOpts[0]).toMatchObject({ mode: 'draft', packageId: 'app.a' });
+    expect(server.savedOpts.at(-1)).toMatchObject({ mode: 'draft', packageId: 'app.a' });
   });
 
   it('keeps a policy carried by the pending draft when the published base has none', async () => {
@@ -208,8 +214,8 @@ describe('PermissionMatrixEditPage — the PACKAGE door persists every authored
     const row = screen.getByText('a_account').closest('tr')!;
     fireEvent.click(within(row).getByRole('button', { name: 'None' }));
 
-    fireEvent.click(screen.getByRole('button', { name: /^Save$/ }));
-    await waitFor(() => expect(server.saved).toHaveLength(1));
+    // objectui#11787 — autosaved after the shared pause (no Save button here).
+    await waitFor(() => expect(server.saved).toHaveLength(1), { timeout: 4000 });
     const body = server.saved[0] as any;
 
     expect(body.rowLevelSecurity).toEqual([AUTHORED_POLICY]);
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorRereadRefusal.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorRereadRefusal.test.tsx
index 155cbf55b1..aad9dd50e7 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorRereadRefusal.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorRereadRefusal.test.tsx
@@ -35,10 +35,11 @@
  *
  * "`client.save` was not called" is an absence, and an absence is worth nothing
  * without a control that can produce the presence. The resolving-arm test in
- * this file is that control: the same harness, the same edit, the same click —
- * only the re-read's answer differs — and it PUTs, with package B's rows
- * intact. The refusal test additionally asserts `layeredCalls === 2`, so the
- * empty `saved` cannot be a Save button that was never reached.
+ * this file is that control: the same harness, the same edit, the same
+ * autosave (objectui#11787: the package door has no Save button) — only the
+ * re-read's answer differs — and it PUTs, with package B's rows intact. The
+ * refusal test additionally asserts `layeredCalls === 2`, so the empty `saved`
+ * cannot be a save that never ran.
  *
  * ## What is deliberately NOT refused
  *
@@ -203,6 +204,13 @@ function clickSave() {
   fireEvent.click(screen.getByRole('button', { name: /^Save$/ }));
 }
 
+/**
+ * objectui#11787 — the package door has no Save button: an edit autosaves to
+ * the package draft after the shared autosave's pause (1.5s), so a wait on a
+ * package-door save allows for that pause.
+ */
+const AUTOSAVE = { timeout: 4000 };
+
 describe('PermissionMatrixEditPage — the PACKAGE door refuses rather than delete (objectui#9420)', () => {
   it('does NOT call client.save when the save-time layered re-read rejects', async () => {
     const server = freshServer();
@@ -211,14 +219,14 @@ describe('PermissionMatrixEditPage — the PACKAGE door refuses rather than dele
     await screen.findByText('a_account');
 
     editAccountRow();
-    clickSave();
 
     // Settle on EITHER arm before asserting — the refusal reaching the screen,
     // or a PUT landing. Waiting on the refusal alone would make the pre-fix
     // reading a timeout instead of the PUT it is, and waiting on
     // `layeredCalls` alone would race the save that follows it.
-    await waitFor(() =>
-      expect(server.saved.length > 0 || screen.queryByText(REFUSAL) !== null).toBe(true),
+    await waitFor(
+      () => expect(server.saved.length > 0 || screen.queryByText(REFUSAL) !== null).toBe(true),
+      AUTOSAVE,
     );
 
     // CONTROL: the re-read really was attempted and really did reject, so the
@@ -234,8 +242,9 @@ describe('PermissionMatrixEditPage — the PACKAGE door refuses rather than dele
     // the same strip a failed `client.save` renders into. No new toast path.
     expect(screen.getByText(REFUSAL)).toBeInTheDocument();
 
-    // The page is usable again: `saving` cleared, so the author can retry.
-    expect(screen.getByRole('button', { name: /^Save$/ })).toBeEnabled();
+    // The page is usable again: `saving` cleared, so the next edit is sent
+    // (objectui#11787 — the autosave retries on the author's next edit).
+    expect(screen.queryByTestId('perm-autosaving')).toBeNull();
   });
 
   it('CONTROL — the same harness PUTs, with package B intact, when the re-read resolves', async () => {
@@ -245,9 +254,8 @@ describe('PermissionMatrixEditPage — the PACKAGE door refuses rather than dele
     await screen.findByText('a_account');
 
     editAccountRow();
-    clickSave();
 
-    await waitFor(() => expect(server.saved).toHaveLength(1));
+    await waitFor(() => expect(server.saved).toHaveLength(1), AUTOSAVE);
     const body = server.saved[0] as any;
 
     // The author's edit is on the wire…
@@ -276,9 +284,8 @@ describe('PermissionMatrixEditPage — the PACKAGE door refuses rather than dele
     await screen.findByText('a_account');
 
     editAccountRow();
-    clickSave();
 
-    await waitFor(() => expect(server.saved).toHaveLength(1));
+    await waitFor(() => expect(server.saved).toHaveLength(1), AUTOSAVE);
     expect((server.saved[0] as any).objects.a_account).toEqual({});
     // objectui#11799 — the load reads no layers for this set: the published
     // set list does not hold it and its draft is in hand. The one read is the
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readDecorationStrip.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readDecorationStrip.test.tsx
index 54a7310677..189d7f7e29 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readDecorationStrip.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readDecorationStrip.test.tsx
@@ -174,8 +174,9 @@ describe('PermissionMatrixEditPage — read decorations never reach the save (ob
     const row = screen.getByText('a_account').closest('tr')!;
     fireEvent.click(within(row).getByRole('button', { name: 'None' }));
 
-    fireEvent.click(screen.getByRole('button', { name: /^Save$/ }));
-    await waitFor(() => expect(server.saved).toHaveLength(1));
+    // objectui#11787 — the package door autosaves the edit to its draft after
+    // the shared autosave's pause; it has no Save button.
+    await waitFor(() => expect(server.saved).toHaveLength(1), { timeout: 4000 });
     const body = server.saved[0] as Record<string, any>;
 
     // ── CONTROLS. Every absence below is meaningless without these. ──
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonly.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonly.test.tsx
index 95a92c7e3f..c933711f3f 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonly.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonly.test.tsx
@@ -178,7 +178,8 @@ describe('PermissionMatrixEditPage — read-only package gate (host readOnly)',
     renderMatrix();
     await screen.findByText('Account');
 
-    expect(screen.getByRole('button', { name: /^Save$/ })).toBeEnabled();
+    // objectui#11787 — the package door autosaves: no Save button; the live controls are the writability read.
+    expect(screen.queryByRole('button', { name: /^Save$/ })).toBeNull();
     expect(screen.getByLabelText('a_account Read')).toBeEnabled();
     expect(screen.queryByText('Read-only', { exact: true })).toBeNull();
     expect(screen.queryByText(/OS_METADATA_WRITABLE/)).toBeNull();
@@ -229,7 +230,8 @@ describe('PermissionMatrixEditPage — type-level gate keeps its own wording', (
     renderMatrix();
     await screen.findByText('Account');
 
-    expect(screen.getByRole('button', { name: /^Save$/ })).toBeEnabled();
+    // objectui#11787 — the package door autosaves: no Save button; the live controls are the writability read.
+    expect(screen.queryByRole('button', { name: /^Save$/ })).toBeNull();
     expect(screen.getByLabelText('a_account Read')).toBeEnabled();
 
     // Row bulk-set buttons are live too — `writable` drives all of them.
@@ -266,7 +268,8 @@ describe('PermissionMatrixEditPage — type-level gate keeps its own wording', (
     renderMatrix();
     await screen.findByText('Account');
 
-    expect(screen.getByRole('button', { name: /^Save$/ })).toBeEnabled();
+    // objectui#11787 — the package door autosaves: no Save button; the live controls are the writability read.
+    expect(screen.queryByRole('button', { name: /^Save$/ })).toBeNull();
     expect(screen.getByLabelText('a_account Read')).toBeEnabled();
     expect(screen.queryByText('Read-only', { exact: true })).toBeNull();
     expect(screen.queryByText(/no runtime write channel/)).toBeNull();
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonlyHeaderBadge.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonlyHeaderBadge.test.tsx
index 509967e492..cae2890b1f 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonlyHeaderBadge.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.readonlyHeaderBadge.test.tsx
@@ -180,10 +180,11 @@ describe('PermissionMatrixEditPage — header writability badge vs the package g
     for (const box of boxes) expect(box).toBeDisabled();
   });
 
-  it('CONTROL — gating is untouched: a writable package keeps Save and live checkboxes', async () => {
+  it('CONTROL — gating is untouched: a writable package keeps live checkboxes', async () => {
     await renderMatrix();
 
-    expect(screen.getByRole('button', { name: /^Save$/ })).toBeEnabled();
+    // objectui#11787 — the package door autosaves: no Save button; the live controls are the writability read.
+    expect(screen.queryByRole('button', { name: /^Save$/ })).toBeNull();
     expect(screen.getByLabelText('a_account Read')).toBeEnabled();
   });
 });
@@ -238,8 +239,8 @@ describe('PermissionMatrixEditPage — badge and controls read ONE predicate (#4
       const badgeSaysReadOnly = headerBadgeTexts().includes('read-only');
 
       if (c.expectWritable) {
-        expect(save).not.toBeNull();
-        expect(save).toBeEnabled();
+        // objectui#11787 — the package door autosaves: no Save button; the live controls are the writability read.
+        expect(save).toBeNull();
         expect(readBox).toBeEnabled();
         expect(badgeSaysReadOnly).toBe(false);
       } else {
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.scope.test.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.scope.test.tsx
index d86134f3a1..c22f5730c8 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.scope.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.scope.test.tsx
@@ -155,9 +155,9 @@ describe('PermissionMatrixEditPage — package scope + slice merge (ADR-0086 P0)
     const row = screen.getByText('a_account').closest('tr')!;
     fireEvent.click(within(row).getByRole('button', { name: 'None' }));
 
-    // 3) Save.
-    fireEvent.click(screen.getByRole('button', { name: /^Save$/ }));
-    await waitFor(() => expect(server.saved).toHaveLength(1));
+    // 3) Save — the package door autosaves the edit to its draft after the
+    // shared autosave's pause (objectui#11787); it has no Save button.
+    await waitFor(() => expect(server.saved).toHaveLength(1), { timeout: 4000 });
 
     const saved = server.saved[0] as any;
     // Package B's contributed rows are preserved byte-for-byte.
diff --git a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx
index 0442e49265..3072cecab6 100644
--- a/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx
+++ b/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx
@@ -78,6 +78,9 @@ import { HistoryPanel } from './ResourceHistoryPage.js';
 import { useMetadataClient, useMetadataTypes, type RichMetadataTypeEntry } from './useMetadata.js';
 // objectui#11773 — the package door's draft save sends the version it was built on.
 import { useDraftSaveGuard } from './DraftConflictDialog.js';
+// objectui#11787 — the package door autosaves through the pillars' own autosave.
+import { useDraftAutoSave, type DraftSend } from '../studio-design/useDraftAutoSave.js';
+import { useDisplayLocale } from '@object-ui/i18n';
 import { t as translate, tFormat, useMetadataLocale } from './i18n.js';
 import { PermissionAdvancedFacets } from './PermissionAdvancedFacets.js';
 import { errorCodeIs } from '@object-ui/types';
@@ -231,11 +234,13 @@ export interface PermissionMatrixEditPageProps {
   packageId?: string;
   /**
    * ADR-0086 P2 (D6/D7 — the package door). When editing under a `packageId`,
-   * a permission set is package **metadata**: Save writes a **draft** (not a
-   * live record), published atomically with the rest of the package. `onDraftSaved`
-   * notifies the surface so its pending-changes counter refreshes; `publishNonce`
-   * bumps on publish so the editor re-reads the now-published baseline (its draft
-   * is gone). Both are no-ops at environment scope, where Save stays live (D7).
+   * a permission set is package **metadata**: an edit is autosaved to a
+   * **draft** (not a live record), published atomically with the rest of the
+   * package, the way the Data and Interfaces pillars save (objectui#11787).
+   * `onDraftSaved` notifies the surface so its pending-changes counter
+   * refreshes; `publishNonce` bumps on publish so the editor re-reads the
+   * now-published baseline (its draft is gone). Both are no-ops at environment
+   * scope, where the explicit Save stays and writes live config (D7).
    */
   onDraftSaved?: () => void;
   publishNonce?: number;
@@ -452,6 +457,10 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
   const [expanded, setExpanded] = React.useState<Set<string>>(new Set());
   const [loading, setLoading] = React.useState(true);
   const [saving, setSaving] = React.useState(false);
+  // objectui#11787 — when the package door's last draft save landed, for the
+  // status line that replaces its Save button ("Saved 10:42").
+  const [savedAt, setSavedAt] = React.useState<Date | null>(null);
+  const displayLocale = useDisplayLocale();
   const [error, setError] = React.useState<string | null>(null);
   // objectui#9484 — the ENVIRONMENT door's post-save baseline re-read REJECTED.
   // The write itself has already landed when that read runs, so this is an
@@ -847,7 +856,12 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
   }
 
   /* ── Save ────────────────────────────────────────────────── */
-  async function doSave(force: boolean, pending?: PermissionSetDraft) {
+  /**
+   * `sent` is the autosave's claim on the buffer it sent (objectui#11787, the
+   * package door only); the environment door's Save and the destructive
+   * dialog's force-save pass none.
+   */
+  async function doSave(force: boolean, pending?: PermissionSetDraft, sent?: DraftSend) {
     const payload = pending ?? draft;
     setSaving(true);
     setError(null);
@@ -904,9 +918,26 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
       // The author chose the saved version; the load replaces the matrix.
       if (outcome === 'reloaded') return;
       if (packageId) {
-        // The draft is now the pending truth for display; the published baseline
-        // hasn't moved. Show what we just staged and let the surface count it.
-        resetDraftBaseline(toDisplayDraft(toSave));
+        setSavedAt(new Date());
+        if (sent && !sent.unmoved()) {
+          // objectui#11787 (the objectui#11204 rule) — the author edited while
+          // this autosave was in flight. Re-installing the staged body would
+          // throw that edit away, so the matrix keeps it and only the anchor
+          // moves to what this save sent: the edit stays dirty, and the
+          // autosave sends it next. The fresh identity makes `isDirty` read the
+          // moved anchor (objectui#9484).
+          try {
+            baselineRef.current = JSON.stringify(payload);
+          } catch {
+            baselineRef.current = null;
+          }
+          setDraft((current) => ({ ...current }));
+        } else {
+          // The draft is now the pending truth for display; the published
+          // baseline hasn't moved. Show what we just staged.
+          resetDraftBaseline(toDisplayDraft(toSave));
+        }
+        // Let the surface count it.
         onDraftSaved?.();
       } else {
         // objectui#9484 — this read runs AFTER `client.save` has returned: the
@@ -961,6 +992,28 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
     }
   }
 
+  /* ── Autosave — the package door only (objectui#11787) ─────────── */
+  // ADR-0086 D6 puts the package door under package draft/publish "exactly
+  // like Data and Interfaces", and ADR-0033 §2 makes that draft the approval
+  // gate, so this door saves the way those pillars do: the shared autosave,
+  // 1.5s after the last edit, under the same conditions the Save button had
+  // (a CEL syntax error holds the edit, objectui#2413). ⛔ The environment door
+  // never autosaves: it writes live config (ADR-0086 D7), so every click would
+  // change access at once. It keeps its explicit Save, and `blocked` holds the
+  // timer there for good.
+  //
+  // The set is the open item; the host keys this page per set, so the target
+  // never moves within a mount. The buffer is that set's once its load lands.
+  const autosaveTarget = `${type}:${name}`;
+  useDraftAutoSave({
+    target: autosaveTarget,
+    loadedFor: loading ? '' : autosaveTarget,
+    dirty: isDirty,
+    blocked: !packageId || !writable || saving || celErrorCount > 0 || destructive !== null,
+    snapshot: draft,
+    save: (sent) => doSave(false, undefined, sent),
+  });
+
   /* ── Clone to customize (objectui#5987) ──────────────────────── */
   /**
    * Run the server-published `clone_permission_set` record action on THIS set.
@@ -1113,7 +1166,8 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
           >
             <HistoryIcon className="h-4 w-4 mr-1" /> {t('engine.edit.history')}
           </Button>
-          {writable && (
+          {/* ADR-0086 D7 — the environment door's explicit Save: a live write. */}
+          {writable && !packageId && (
             <Button
               size="sm"
               onClick={() => doSave(false)}
@@ -1128,6 +1182,31 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
               {t('engine.edit.save')}
             </Button>
           )}
+          {/* objectui#11787 — the package door autosaves (see the autosave
+              above), so its Save button gives way to the status line every
+              Studio pillar shows: saving while in flight, the last-saved time
+              once landed, and why an edit is held when a CEL error holds it. */}
+          {writable && packageId && (
+            saving ? (
+              <span
+                className="inline-flex items-center gap-1 text-[11px] text-muted-foreground"
+                data-testid="perm-autosaving"
+              >
+                <Loader2 className="h-3 w-3 animate-spin" />
+                {t('engine.studio.autoSaving')}
+              </span>
+            ) : celErrorCount > 0 && isDirty ? (
+              <span className="text-[11px] text-destructive" data-testid="perm-autosave-held">
+                {t('perm.cel.saveBlocked')}
+              </span>
+            ) : savedAt && !isDirty ? (
+              <span className="text-[11px] text-muted-foreground" data-testid="perm-saved-at">
+                {tFormat('engine.studio.data.lastSaved', locale, {
+                  time: savedAt.toLocaleTimeString(displayLocale, { hour: '2-digit', minute: '2-digit' }),
+                })}
+              </span>
+            ) : null
+          )}
           {/* objectui#5987 — the locked editor's PRIMARY action, in the slot Save
               would occupy: a code package ships this set, so the ruled path is
               to clone it and edit the clone. Only where the artifact tier is
@@ -1290,7 +1369,12 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
                 <Input
                   id="perm-name"
                   value={draft.name}
-                  disabled={!writable}
+                  // objectui#11787 — on the package door the api name is the
+                  // set's identity in the package's drafts: the autosave writes
+                  // the draft under `draft.name`, so an editable name would
+                  // stage a new set at every pause while typing. It is set once,
+                  // by "+ New". The environment door keeps it editable.
+                  disabled={!writable || !!packageId}
                   onChange={(e) => setDraft((p) => ({ ...p, name: e.target.value }))}
                   className="h-8 w-56"
                 />
diff --git a/packages/app-shell/src/views/metadata-admin/i18n.ts b/packages/app-shell/src/views/metadata-admin/i18n.ts
index bda9189f32..4913c949ff 100644
--- a/packages/app-shell/src/views/metadata-admin/i18n.ts
+++ b/packages/app-shell/src/views/metadata-admin/i18n.ts
@@ -2757,7 +2757,6 @@ const ENGINE_STRINGS_EN: Record<string, string> = {
   // ── StudioDesignSurface (ADR-0080 WYSIWYG design surface) ──────────────
   // Shared chrome
   'engine.studio.cancel': 'Cancel',
-  'engine.studio.create': 'Create',
   'engine.studio.creating': 'Creating…',
   // objectui#11792 — CreateItemDialog's preview of the name the item is saved
   // under, shown when the caller supplies that rule (an object's namespace prefix).
@@ -3370,12 +3369,11 @@ const ENGINE_STRINGS_EN: Record<string, string> = {
   'engine.studio.api.body': 'Example body',
   'engine.studio.api.bodyOmitted': 'Required fields come first. Optional fields not shown: {fields}',
   // Hooks view
+  'engine.studio.hooks.renameHeld': 'Not saved yet: a hook keeps the name it was created with. Change the name back to {name} to save your changes.',
   'engine.studio.hooks.none': 'No hooks target this object.',
   'engine.studio.hooks.async': 'async',
   'engine.studio.hooks.pick': 'Select a hook to edit it.',
   'engine.studio.hooks.newLabel': 'New hook',
-  'engine.studio.hooks.saved': 'Saved “{label}” as draft',
-  'engine.studio.hooks.save': 'Save hook',
   'engine.studio.data.addFieldTitle': 'Add a field (then set its type and properties on the right)',
   'engine.studio.data.addField': 'Add field',
   'engine.studio.data.editFieldProps': 'Edit field properties',
@@ -5992,7 +5990,6 @@ const ENGINE_STRINGS_ZH: Record<string, string> = {
   // ── StudioDesignSurface (ADR-0080 WYSIWYG design surface) ──────────────
   // Shared chrome
   'engine.studio.cancel': '取消',
-  'engine.studio.create': '创建',
   'engine.studio.creating': '创建中…',
   'engine.studio.createItem.savedAs': '保存为',
   // `383502b23` — see the English entry. This value must share no leading
@@ -6514,12 +6511,11 @@ const ENGINE_STRINGS_ZH: Record<string, string> = {
   'engine.studio.api.body': '示例请求体',
   'engine.studio.api.bodyOmitted': '必填字段排在最前。未列出的可选字段：{fields}',
   // Hooks view
+  'engine.studio.hooks.renameHeld': '尚未保存：钩子会保留创建时的名称。把名称改回 {name} 即可保存更改。',
   'engine.studio.hooks.none': '没有钩子作用于该对象。',
   'engine.studio.hooks.async': '异步',
   'engine.studio.hooks.pick': '选择一个钩子进行编辑。',
   'engine.studio.hooks.newLabel': '新钩子',
-  'engine.studio.hooks.saved': '已将「{label}」存为草稿',
-  'engine.studio.hooks.save': '保存钩子',
   'engine.studio.data.addFieldTitle': '添加一个字段(随后在右侧设置类型与属性)',
   'engine.studio.data.addField': '添加字段',
   'engine.studio.data.editFieldProps': '编辑字段属性',
diff --git a/packages/app-shell/src/views/studio-design/CreateItemDialog.oneLabel-11787.test.ts b/packages/app-shell/src/views/studio-design/CreateItemDialog.oneLabel-11787.test.ts
new file mode 100644
index 0000000000..94e8c3a448
--- /dev/null
+++ b/packages/app-shell/src/views/studio-design/CreateItemDialog.oneLabel-11787.test.ts
@@ -0,0 +1,79 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectui#11787 — Studio's create dialogs say one thing: *Save as draft*.
+ *
+ * Every `CreateItemDialog` in Studio writes a draft (an app, a page, a
+ * dashboard, a report, an object, a flow, a permission set), so the submit
+ * button names that one act with one string, `engine.studio.createDraft`. The
+ * QA pass that filed the card found *New permission set* alone saying
+ * *Create*.
+ *
+ * The call sites are ENUMERATED from this package's source, not listed here
+ * (AGENTS.md #9): a dialog added later is asked the same question, and the
+ * control below proves the enumeration reaches the site this card changed.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+// @ts-expect-error — plain-JS shared helper, intentionally untyped (`allowJs: false`)
+import { maskComments } from '../../../../../scripts/js-comment-mask.mjs';
+
+const mask: (source: string) => string = maskComments;
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '../../../../..');
+const SRC = path.join(repoRoot, 'packages/app-shell/src');
+
+function sourceFiles(dir: string): string[] {
+  const out: string[] = [];
+  for (const entry of readdirSync(dir)) {
+    const full = path.join(dir, entry);
+    if (statSync(full).isDirectory()) out.push(...sourceFiles(full));
+    else if (full.endsWith('.tsx') && !/\.test\.tsx$/.test(full)) out.push(full);
+  }
+  return out;
+}
+
+/** One rendered `<CreateItemDialog …>`: its file, its submit label, and the props text around it. */
+interface Site {
+  file: string;
+  submitLabel: string | undefined;
+  props: string;
+}
+
+function createDialogSites(): Site[] {
+  const sites: Site[] = [];
+  for (const file of sourceFiles(SRC)) {
+    const source = mask(readFileSync(file, 'utf8'));
+    // `submitLabel` is a required prop, so the first one after the tag is the tag's own.
+    for (const props of source.split('<CreateItemDialog').slice(1)) {
+      sites.push({
+        file: path.relative(repoRoot, file),
+        submitLabel: props.match(/submitLabel=\{([^}]*)\}/)?.[1],
+        props,
+      });
+    }
+  }
+  return sites;
+}
+
+const ONE_LABEL = "t('engine.studio.createDraft', locale)";
+
+describe('Studio create dialogs carry one label (objectui#11787)', () => {
+  it('every CreateItemDialog submits as "Save as draft"', () => {
+    const sites = createDialogSites();
+    expect(sites.length).toBeGreaterThan(0);
+    for (const site of sites) {
+      expect({ file: site.file, submitLabel: site.submitLabel }).toEqual({ file: site.file, submitLabel: ONE_LABEL });
+    }
+  });
+
+  it('CONTROL — the enumeration reaches the New permission set dialog, the one that said "Create"', () => {
+    const access = createDialogSites().filter((site) => /title=\{t\('engine\.studio\.access\.new'/.test(site.props));
+    expect(access).toHaveLength(1);
+    expect(access[0].submitLabel).toBe(ONE_LABEL);
+  });
+});
diff --git a/packages/app-shell/src/views/studio-design/ObjectHooksPanel.autosave-11787.test.tsx b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.autosave-11787.test.tsx
new file mode 100644
index 0000000000..315e6d7638
--- /dev/null
+++ b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.autosave-11787.test.tsx
@@ -0,0 +1,172 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectui#11787 — a hook autosaves to its draft like the other Studio
+ * editors, and its saves reach the surface's pending-changes count.
+ *
+ * The *Save hook* button was the third save model in Studio (beside the
+ * pillars' autosave and the permission matrix's Save). The panel now runs the
+ * shared autosave: an edit is sent 1.5s after the last change, a save that
+ * lands reports to the surface (`onDraftSaved`) so the header's count
+ * refreshes, and an edit taken while a save is in flight is kept and sent next
+ * (the objectui#11204 rule every pillar keeps). A hook keeps the name it was
+ * created with: the inspector commits the name on every keystroke and the draft
+ * is stored under it, so a rename is held rather than staged as one more hook
+ * per pause while typing. The held half — a blocking CEL
+ * verdict holds the autosave — is pinned beside it in
+ * `ObjectHooksPanel.celGate.test.tsx`.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
+import { render, screen, fireEvent, cleanup, waitFor, act } from '@testing-library/react';
+
+const hook = {
+  name: 'guard_hook',
+  label: 'Guard',
+  object: 'invoice',
+  events: ['beforeInsert'],
+  handler: 'guard_fn',
+};
+
+/** Bodies the panel sent, copied at the moment of the call. */
+const sent: Array<Record<string, unknown>> = [];
+/** When set, the first save waits on it: a save held in flight. */
+let holdFirstSave: Promise<void> | null = null;
+
+const mockClient = {
+  list: vi.fn(async () => [hook]),
+  listDrafts: vi.fn(async () => []),
+  getDraft: vi.fn(async () => null),
+  get: vi.fn(async () => null),
+  withPreviewDrafts() {
+    return this;
+  },
+  save: vi.fn(async (_type: string, _name: string, body: Record<string, unknown>) => {
+    sent.push(JSON.parse(JSON.stringify(body)));
+    if (sent.length === 1 && holdFirstSave) await holdFirstSave;
+    return {};
+  }),
+};
+
+vi.mock('../metadata-admin/useMetadata', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('../metadata-admin/useMetadata')>();
+  return { ...mod, useMetadataClient: () => mockClient };
+});
+
+import { ObjectHooksPanel } from './ObjectHooksPanel';
+import { registerBuiltinInspectors } from '../metadata-admin/inspectors';
+import { __setCelFormulaLoader } from '../metadata-admin/celAuthoring';
+
+registerBuiltinInspectors();
+
+beforeEach(() => {
+  sent.length = 0;
+  holdFirstSave = null;
+  mockClient.save.mockClear();
+  __setCelFormulaLoader(() =>
+    Promise.resolve({
+      validateExpression: () => ({ ok: true, errors: [], warnings: [] }),
+      introspectScope: () => ({ fields: ['status'], roots: ['record'], functions: ['has'] }),
+      inferExpressionType: () => 'boolean' as const,
+    }),
+  );
+});
+afterEach(() => {
+  cleanup();
+  __setCelFormulaLoader(undefined);
+});
+
+const AUTOSAVE = { timeout: 4000 };
+const pause = (ms: number) => act(async () => {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+});
+
+async function openGuard(onDraftSaved?: () => void) {
+  render(<ObjectHooksPanel objectName="invoice" packageId="com.example.showcase" onDraftSaved={onDraftSaved} />);
+  fireEvent.click(await screen.findByText('Guard'));
+  fireEvent.click(await screen.findByText('Expression'));
+  return screen.getAllByRole('combobox').find((el) => el.tagName === 'TEXTAREA') as HTMLTextAreaElement;
+}
+
+describe('ObjectHooksPanel — a hook autosaves to its draft (objectui#11787)', () => {
+  it('sends an edit after the pause, with no Save hook button, and tells the surface', async () => {
+    const onDraftSaved = vi.fn();
+    const box = await openGuard(onDraftSaved);
+    expect(screen.queryByRole('button', { name: /Save/i })).toBeNull();
+
+    fireEvent.change(box, { target: { value: "record.status == 'open'" } });
+    // Debounced, not per keystroke.
+    expect(mockClient.save).not.toHaveBeenCalled();
+
+    await waitFor(() => expect(mockClient.save).toHaveBeenCalledTimes(1), AUTOSAVE);
+    expect(mockClient.save).toHaveBeenCalledWith(
+      'hook',
+      'guard_hook',
+      expect.objectContaining({ object: 'invoice', handler: 'guard_fn' }),
+      expect.objectContaining({ mode: 'draft', packageId: 'com.example.showcase' }),
+    );
+    await waitFor(() => expect(onDraftSaved).toHaveBeenCalledTimes(1));
+    expect(await screen.findByTestId('hooks-saved-at')).toBeInTheDocument();
+  });
+
+  it('"+ New" is a draft save too: the surface hears of it', async () => {
+    const onDraftSaved = vi.fn();
+    render(<ObjectHooksPanel objectName="invoice" packageId="com.example.showcase" onDraftSaved={onDraftSaved} />);
+    await screen.findByText('Guard');
+
+    fireEvent.click(screen.getByRole('button', { name: /New/ }));
+    await waitFor(() => expect(mockClient.save).toHaveBeenCalledTimes(1));
+    await waitFor(() => expect(onDraftSaved).toHaveBeenCalledTimes(1));
+  });
+
+  it('holds a rename typed with a pause between its parts, and saves once the name is back', async () => {
+    render(<ObjectHooksPanel objectName="invoice" packageId="com.example.showcase" />);
+    fireEvent.click(await screen.findByText('Guard'));
+    const name = () => screen.getByTestId('hook-name') as HTMLInputElement;
+    await screen.findByTestId('hook-name');
+    expect(name().value).toBe('guard_hook');
+
+    // Typed in two parts, with a pause longer than the autosave's between them.
+    fireEvent.change(name(), { target: { value: 'audit' } });
+    await pause(1600);
+    fireEvent.change(name(), { target: { value: 'audit_trail' } });
+    await pause(2300);
+
+    // No draft staged under either typed name: the probe on the head before
+    // this pin measured two, `hook/audit` and `hook/audit_trail`.
+    expect(mockClient.save).not.toHaveBeenCalled();
+    expect(screen.getByTestId('hooks-rename-held')).toHaveTextContent('guard_hook');
+
+    // CONTROL: the same edit path saves once the hook has its own name again,
+    // under that name.
+    fireEvent.change(name(), { target: { value: 'guard_hook' } });
+    await waitFor(() => expect(mockClient.save).toHaveBeenCalledTimes(1), AUTOSAVE);
+    expect(mockClient.save.mock.calls[0][1]).toBe('guard_hook');
+    expect(screen.queryByTestId('hooks-rename-held')).toBeNull();
+  });
+
+  it('keeps an edit taken while the autosave is in flight, and sends it next (objectui#11204)', async () => {
+    let release!: () => void;
+    holdFirstSave = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const box = await openGuard();
+
+    fireEvent.change(box, { target: { value: "record.status == 'open'" } });
+    await waitFor(() => expect(sent).toHaveLength(1), AUTOSAVE);
+    expect(await screen.findByTestId('hooks-autosaving')).toBeInTheDocument();
+
+    // A second edit while the first save is on the wire.
+    fireEvent.change(box, { target: { value: "record.status == 'closed'" } });
+    release();
+
+    // The landed save does not put its own body back over the newer edit…
+    await waitFor(() => expect(screen.queryByTestId('hooks-autosaving')).toBeNull());
+    expect(box).toHaveValue("record.status == 'closed'");
+    // …and the edit, still unsent, goes out next.
+    await waitFor(() => expect(sent).toHaveLength(2), AUTOSAVE);
+    expect(JSON.stringify(sent[0])).toContain("record.status == 'open'");
+    expect(JSON.stringify(sent[1])).toContain("record.status == 'closed'");
+  });
+});
diff --git a/packages/app-shell/src/views/studio-design/ObjectHooksPanel.celGate.test.tsx b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.celGate.test.tsx
index 8a522509ae..611bca04df 100644
--- a/packages/app-shell/src/views/studio-design/ObjectHooksPanel.celGate.test.tsx
+++ b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.celGate.test.tsx
@@ -1,16 +1,21 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * The object hooks panel owns its OWN per-hook Save (it writes the hook
- * directly with `client.save('hook', …, { mode: 'draft' })` — the object's Save
+ * The object hooks panel owns its OWN per-hook save (it writes the hook
+ * directly with `client.save('hook', …, { mode: 'draft' })` — the object's
  * draft does not cover hooks), so it must refuse to write a guard whose CEL
  * does not parse — objectui#4527 phase 2.
  *
  * Of the four panel hosts the #4547 census surfaced, this is the only one that
- * owns a Save button; the other three write through the Data pillar's draft and
- * report upward instead. So this suite is the end-to-end proof for the
- * hook branch of the default-inspector family: HookDefaultInspector's verdict
- * has to reach a real disabled button, not just a callback.
+ * owns its save; the other three write through the Data pillar's draft and
+ * report upward instead. So this suite is the end-to-end proof for the hook
+ * branch of the default-inspector family: HookDefaultInspector's verdict has to
+ * reach the save itself, not just a callback.
+ *
+ * objectui#11787 — that save is now the panel's autosave (the shared one every
+ * Studio editor runs), so the verdict HOLDS it: a malformed guard is never
+ * sent, however long the pause, and the panel says why. Each absence is read
+ * against the same harness sending the same hook once the guard parses.
  */
 
 import '@testing-library/jest-dom/vitest';
@@ -71,7 +76,10 @@ afterEach(() => {
   __setCelFormulaLoader(undefined);
 });
 
-const saveButton = () => screen.getByRole('button', { name: /Save/i });
+/** Longer than the shared autosave's pause (1.5s). */
+const PAST_THE_PAUSE = 2200;
+const AUTOSAVE = { timeout: 4000 };
+const pause = () => new Promise((resolve) => setTimeout(resolve, PAST_THE_PAUSE));
 
 /** Open the panel, select the hook, and switch its guard into raw CEL mode. */
 async function openGuard() {
@@ -81,35 +89,41 @@ async function openGuard() {
   return screen.getAllByRole('combobox').find((el) => el.tagName === 'TEXTAREA') as HTMLTextAreaElement;
 }
 
-describe('ObjectHooksPanel — its own Save refuses a guard that does not parse (#4527)', () => {
-  it('disables Save while the hook guard is malformed', async () => {
-    const box = await openGuard();
+describe('ObjectHooksPanel — its autosave holds a guard that does not parse (#4527, objectui#11787)', () => {
+  beforeEach(() => mockClient.save.mockClear());
 
-    // A valid guard first: dirties the draft (so Save is live at all) and pins
-    // the must-not-change half — a good guard never blocks.
-    fireEvent.change(box, { target: { value: "record.status == 'open'" } });
-    await waitFor(() => expect(saveButton()).toBeEnabled(), { timeout: 4000 });
+  it('holds the malformed hook, and says why', async () => {
+    const box = await openGuard();
+    // No Save button: the panel autosaves.
+    expect(screen.queryByRole('button', { name: /Save/i })).toBeNull();
 
     fireEvent.change(box, { target: { value: 'record.status ==' } });
-    await waitFor(() => expect(saveButton()).toBeDisabled(), { timeout: 4000 });
+    expect(await screen.findByTestId('hooks-autosave-held', undefined, AUTOSAVE)).toBeInTheDocument();
+    await pause();
+    expect(mockClient.save).not.toHaveBeenCalled();
   });
 
-  it('re-enables Save once the guard parses again', async () => {
+  it('sends the hook once the guard parses again', async () => {
     const box = await openGuard();
 
     fireEvent.change(box, { target: { value: 'record.status ==' } });
-    await waitFor(() => expect(saveButton()).toBeDisabled(), { timeout: 4000 });
+    await screen.findByTestId('hooks-autosave-held', undefined, AUTOSAVE);
 
     fireEvent.change(box, { target: { value: "record.status == 'open'" } });
-    await waitFor(() => expect(saveButton()).toBeEnabled(), { timeout: 4000 });
+    await waitFor(() => expect(mockClient.save).toHaveBeenCalledTimes(1), AUTOSAVE);
+    expect(mockClient.save).toHaveBeenCalledWith(
+      'hook',
+      'guard_hook',
+      expect.objectContaining({ object: 'invoice' }),
+      expect.objectContaining({ mode: 'draft', packageId: 'com.example.showcase' }),
+    );
+    expect(screen.queryByTestId('hooks-autosave-held')).toBeNull();
   });
 
-  it('never writes the malformed hook', async () => {
+  it('CONTROL — a good guard is sent after the pause, never held', async () => {
     const box = await openGuard();
-    fireEvent.change(box, { target: { value: 'record.status ==' } });
-    await waitFor(() => expect(saveButton()).toBeDisabled(), { timeout: 4000 });
-
-    fireEvent.click(saveButton());
-    expect(mockClient.save).not.toHaveBeenCalled();
+    fireEvent.change(box, { target: { value: "record.status == 'open'" } });
+    await waitFor(() => expect(mockClient.save).toHaveBeenCalledTimes(1), AUTOSAVE);
+    expect(screen.queryByTestId('hooks-autosave-held')).toBeNull();
   });
 });
diff --git a/packages/app-shell/src/views/studio-design/ObjectHooksPanel.designerRegistryMissing.test.tsx b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.designerRegistryMissing.test.tsx
index 8607fd9e83..6979f12624 100644
--- a/packages/app-shell/src/views/studio-design/ObjectHooksPanel.designerRegistryMissing.test.tsx
+++ b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.designerRegistryMissing.test.tsx
@@ -8,8 +8,8 @@
  * undefined the panel falls back to the generic `SchemaForm`, which synthesises
  * a control per top-level key of the selected hook. That is a working editor,
  * not an empty state — so the pin has to prove it WORKS, not merely that
- * something rendered: an edit in the generic form dirties the panel, enables
- * its own Save, and the save writes the edited value through.
+ * something rendered: an edit in the generic form dirties the panel, and the
+ * panel's autosave (objectui#11787) writes the edited value through.
  *
  * "Something rendered" would pass on the hook's bare label — exactly the shape
  * of the `ObjectActionsPanel` defect the card repaired — which is why the
@@ -91,15 +91,13 @@ describe('ObjectHooksPanel — no curated hook editor registered (#6846)', () =>
     // state — it is an editor.
     expect(document.body.textContent ?? '').not.toMatch(/loading|try again/i);
 
-    // "Working": an edit in the generic form dirties the panel and enables
-    // its own Save…
-    const save = screen.getByRole('button', { name: /Save/i });
-    expect(save).toBeDisabled();
+    // "Working": an edit in the generic form dirties the panel, and its
+    // autosave (objectui#11787 — no Save button) writes the edited value
+    // through, as a draft of THIS hook, after the shared autosave's pause.
+    expect(screen.queryByRole('button', { name: /Save/i })).toBeNull();
+    expect(mockClient.save).not.toHaveBeenCalled();
     fireEvent.change(handler, { target: { value: 'guard_fn_v2' } });
-    await waitFor(() => expect(save).toBeEnabled());
-    // …and Save writes the edited value through, as a draft of THIS hook.
-    fireEvent.click(save);
-    await waitFor(() => expect(mockClient.save).toHaveBeenCalledTimes(1));
+    await waitFor(() => expect(mockClient.save).toHaveBeenCalledTimes(1), { timeout: 4000 });
     expect(mockClient.save).toHaveBeenCalledWith(
       'hook',
       'guard_hook',
diff --git a/packages/app-shell/src/views/studio-design/ObjectHooksPanel.tsx b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.tsx
index dbf8a3335f..bcc852a7cb 100644
--- a/packages/app-shell/src/views/studio-design/ObjectHooksPanel.tsx
+++ b/packages/app-shell/src/views/studio-design/ObjectHooksPanel.tsx
@@ -16,10 +16,12 @@
  * draft doesn't cover them.
  *
  * Master-detail, editable: a left list of the hooks that fire on this object,
- * and on the right the platform's own generic metadata form (SchemaForm) — the
- * same surface the metadata admin uses to edit a hook — with a per-hook Save.
- * There's no curated `hook` inspector, so SchemaForm synthesises a structured
- * form from the hook's shape.
+ * and on the right the hook's inspector (the platform's generic metadata form,
+ * SchemaForm, until the curated one registers). An edit autosaves to the
+ * hook's draft the way the other Studio editors do (objectui#11787): the shared
+ * autosave, 1.5s after the last edit, held while a CEL syntax error stands or
+ * while the hook's name differs from the one it was created with, and the
+ * panel's status line in place of the old Save hook button.
  *
  * A new hook targets the object it is created from (`addHook`). Its target
  * picker is told which objects belong to this package (objectui#11820), so it
@@ -28,8 +30,8 @@
  */
 
 import React from 'react';
-import { Webhook, Plus, Loader2, Save } from 'lucide-react';
-import { toast } from 'sonner';
+import { Webhook, Plus, Loader2 } from 'lucide-react';
+import { useDisplayLocale } from '@object-ui/i18n';
 import { SchemaForm } from '../metadata-admin/SchemaForm.js';
 import { useRegisteredMetadataDefaultInspector } from '../metadata-admin/default-inspector-registry.js';
 import { HookTargetScopeContext, type HookTargetScope } from '../metadata-admin/inspectors/HookDefaultInspector.js';
@@ -37,6 +39,8 @@ import { loadPackageSurfaces } from './packageSurfaces.js';
 import { useMetadataClient } from '../metadata-admin/useMetadata.js';
 // objectui#11773 — the hook's draft save sends the version it was built on.
 import { useDraftSaveGuard } from '../metadata-admin/DraftConflictDialog.js';
+// objectui#11787 — a hook autosaves through the pillars' own autosave.
+import { useDraftAutoSave, type DraftSend } from './useDraftAutoSave.js';
 import { t, tFormat, useMetadataLocale } from '../metadata-admin/i18n.js';
 // `formatMetadataError` is the one metadata-save error reader (objectui#11302).
 import { extractDraftBody, formatMetadataError } from '@object-ui/data-objectstack';
@@ -85,6 +89,7 @@ export function ObjectHooksPanel({
   disabled,
   hookSchema,
   publishNonce = 0,
+  onDraftSaved,
 }: {
   objectName: string;
   packageId: string;
@@ -100,6 +105,11 @@ export function ObjectHooksPanel({
    * metadata contract rather than being synthesised from the value shape.
    */
   hookSchema?: Record<string, unknown>;
+  /**
+   * objectui#11787 — a hook draft landed (an edit, or "+ New"), so the
+   * surface's pending-changes count refreshes, as every other draft save does.
+   */
+  onDraftSaved?: () => void;
 }) {
   const locale = useMetadataLocale();
   const client = useMetadataClient();
@@ -112,13 +122,19 @@ export function ObjectHooksPanel({
   const [error, setError] = React.useState<string | null>(null);
   const [selected, setSelected] = React.useState<string | null>(null);
   const [draft, setDraft] = React.useState<HookItem | null>(null);
+  // objectui#11787 — the hook whose body the buffer holds (`selected` when its
+  // install has run), and when its last draft save landed.
+  const [draftFor, setDraftFor] = React.useState<string | null>(null);
+  const [savedAt, setSavedAt] = React.useState<{ hook: string; at: Date } | null>(null);
+  const displayLocale = useDisplayLocale();
   const [dirty, setDirty] = React.useState(false);
   const [saving, setSaving] = React.useState(false);
   const [nonce, setNonce] = React.useState(0);
   // objectui#11773 — the version the open hook's draft was saved at, sent as
-  // `If-Match` by its next save. The list re-read that follows this panel's own
-  // save reads back what it wrote, so the version survives it; a conflict's
-  // "reload" re-reads the list, and a publish forgets the version.
+  // `If-Match` by its next save. A save writes the list in place (objectui#11787)
+  // and the re-read that follows "+ New" reads back what was written, so the
+  // version survives both; a conflict's "reload" re-reads the list, and a
+  // publish forgets the version.
   const reloadHooks = React.useCallback(() => setNonce((n) => n + 1), []);
   const {
     save: saveHookDraft,
@@ -161,11 +177,11 @@ export function ObjectHooksPanel({
       ? packageScope
       : null;
 
-  /* ─── Blocking CEL verdicts → this panel's OWN Save (objectui#4527) ────────
+  /* ─── Blocking CEL verdicts → this panel's OWN save (objectui#4527) ────────
    *
    * Unlike the object's other panels, this one writes the hook itself
-   * (`client.save('hook', …, { mode: 'draft' })`), so it owns the button that
-   * has to refuse. The count is STAMPED with the hook it describes and
+   * (`client.save('hook', …, { mode: 'draft' })`), so it owns the save that
+   * has to refuse: the autosave below is held while one stands (objectui#11787). The count is STAMPED with the hook it describes and
    * mismatch is read as 0, so a verdict that lands after the author switched
    * hooks cannot gate the one now on screen — derivation, not a reset effect,
    * and the selected hook always has its editor available to fix in. */
@@ -225,28 +241,81 @@ export function ObjectHooksPanel({
     };
   }, [client, packageId, objectName, nonce]);
 
-  // Load the selected hook into an editable draft (once per selection change).
+  // Load the selected hook into an editable draft: on a selection change, and
+  // when the list changes. objectui#11787 — except over an unsent edit of that
+  // same hook: the list an autosave writes holds what that save sent, and an
+  // edit the author took meanwhile is newer than it.
+  const bufferRef = React.useRef({ hook: draftFor, dirty });
+  React.useLayoutEffect(() => {
+    bufferRef.current = { hook: draftFor, dirty };
+  });
   React.useEffect(() => {
+    if (selected !== null && bufferRef.current.hook === selected && bufferRef.current.dirty) return;
     const hook = hooks.find((h) => h.name === selected) ?? null;
     setDraft(hook ? { ...hook } : null);
+    setDraftFor(hook ? selected : null);
     setDirty(false);
   }, [selected, hooks]);
 
-  const save = React.useCallback(async () => {
+  const save = React.useCallback(async (sent: DraftSend) => {
     if (!draft?.name) return;
     setSaving(true);
     setError(null);
     try {
-      if ((await saveHookDraft('hook', String(draft.name), draft, { mode: 'draft', packageId })) === 'reloaded') return;
-      toast.success(tFormat('engine.studio.hooks.saved', locale, { label: String(draft.label || draft.name) }));
-      setDirty(false);
-      setNonce((n) => n + 1);
+      if ((await saveHookDraft('hook', String(draft.name), draft, { mode: 'draft', packageId })) === 'reloaded') {
+        // objectui#11773 — the author chose the saved version: the list re-read
+        // installs it over this buffer, which holds nothing of theirs to keep.
+        setDirty(false);
+        return;
+      }
+      // No success toast: with autosave it would fire after every editing
+      // pause; the status line is the affordance (objectui#11787).
+      // objectui#11204 — clean only if nothing was edited while it was in flight.
+      if (sent.unmoved()) setDirty(false);
+      setSavedAt({ hook: String(selected ?? ''), at: new Date() });
+      onDraftSaved?.();
+      // The list now holds what the draft holds. Written in place rather than
+      // read again: a re-read blanks the list to "Loading…" at every editing
+      // pause, and it would answer with this very body (a draft wins over the
+      // published row of its name, and a hook no longer aimed at this object
+      // leaves its list).
+      const sentBody = draft;
+      setHooks((list) => {
+        const kept = list.filter((h) => h.name !== sentBody.name);
+        if (!targetsObject(sentBody, objectName)) return kept;
+        const at = list.findIndex((h) => h.name === sentBody.name);
+        return at < 0 ? [...kept, sentBody] : list.map((h, i) => (i === at ? sentBody : h));
+      });
     } catch (e) {
       setError(formatMetadataError(e));
     } finally {
       setSaving(false);
     }
-  }, [saveHookDraft, draft, packageId, locale]);
+  }, [saveHookDraft, draft, packageId, selected, onDraftSaved, objectName]);
+
+  // objectui#11787 — a hook autosaves to its draft like the pillars' editors:
+  // the shared autosave, blocked where the Save hook button was disabled (a
+  // blocking CEL verdict holds the edit, objectui#4527) and while the package
+  // is read-only. The hook is the open item; the buffer is its own once the
+  // install above has run for it.
+  const hookTarget = `hook:${selected ?? ''}`;
+  // objectui#11787 — a hook keeps the name it was created with ("+ New" sets
+  // it). The draft is stored under its name, and the inspector commits the name
+  // on every keystroke, so a rename the autosave sent would stage one more hook
+  // per pause while typing (measured: two drafts, each under a partial name,
+  // beside the original). The same rule the package door's permission matrix
+  // keeps for its api name: a renamed buffer is held, and the line below says
+  // how to get the edit saved.
+  const renamedFrom =
+    draft !== null && draftFor !== null && String(draft.name ?? '') !== draftFor ? draftFor : null;
+  useDraftAutoSave({
+    target: hookTarget,
+    loadedFor: `hook:${draftFor ?? ''}`,
+    dirty,
+    blocked: !draft?.name || saving || !!disabled || blockingIssues > 0 || renamedFrom !== null,
+    snapshot: draft,
+    save,
+  });
 
   const addHook = React.useCallback(async () => {
     const name = nextHookName(objectName, hooks.map((h) => String(h.name ?? '')));
@@ -265,6 +334,8 @@ export function ObjectHooksPanel({
     setError(null);
     try {
       await client.save('hook', name, fresh, { mode: 'draft', packageId });
+      // objectui#11787 — a new hook is a new draft: the count says so.
+      onDraftSaved?.();
       setNonce((n) => n + 1);
       setSelected(name);
     } catch (e) {
@@ -272,7 +343,7 @@ export function ObjectHooksPanel({
     } finally {
       setSaving(false);
     }
-  }, [client, objectName, hooks, packageId, locale]);
+  }, [client, objectName, hooks, packageId, locale, onDraftSaved]);
 
   return (
     <div className="flex min-h-0 flex-1 gap-4">
@@ -338,19 +409,36 @@ export function ObjectHooksPanel({
           <>
             <div className="flex shrink-0 items-center gap-2 border-b px-3 py-1.5">
               <span className="min-w-0 flex-1 truncate text-[12px] font-medium">{String(draft.label || draft.name)}</span>
-              {!disabled && (
-                <button
-                  type="button"
-                  onClick={save}
-                  disabled={!dirty || saving || blockingIssues > 0}
-                  title={blockingIssues > 0 ? t('perm.cel.saveBlocked', locale) : undefined}
-                  className="inline-flex items-center gap-1 rounded-md border px-2 py-0.5 text-[11px] hover:bg-muted disabled:opacity-50"
-                >
-                  {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <Save className="h-3 w-3" />}
-                  {t('engine.studio.hooks.save', locale)}
-                </button>
-              )}
+              {/* objectui#11787 — the status line every Studio editor shows in
+                  place of a Save button: saving while in flight, the
+                  last-saved time once landed, and why an edit is held when a
+                  CEL syntax error holds it. */}
+              {disabled ? null : saving ? (
+                <span className="inline-flex items-center gap-1 text-[11px] text-muted-foreground" data-testid="hooks-autosaving">
+                  <Loader2 className="h-3 w-3 animate-spin" />
+                  {t('engine.studio.autoSaving', locale)}
+                </span>
+              ) : renamedFrom !== null ? null : blockingIssues > 0 && dirty ? (
+                <span className="text-[11px] text-destructive" data-testid="hooks-autosave-held">
+                  {t('perm.cel.saveBlocked', locale)}
+                </span>
+              ) : savedAt && savedAt.hook === selected && !dirty ? (
+                <span className="text-[11px] text-muted-foreground" data-testid="hooks-saved-at">
+                  {tFormat('engine.studio.data.lastSaved', locale, {
+                    time: savedAt.at.toLocaleTimeString(displayLocale, { hour: '2-digit', minute: '2-digit' }),
+                  })}
+                </span>
+              ) : null}
             </div>
+            {renamedFrom !== null && !disabled && (
+              <p
+                role="status"
+                data-testid="hooks-rename-held"
+                className="border-b bg-muted/40 px-3 py-1.5 text-[11px] text-muted-foreground"
+              >
+                {tFormat('engine.studio.hooks.renameHeld', locale, { name: renamedFrom })}
+              </p>
+            )}
             <div className="min-h-0 flex-1 overflow-auto">
               {HookInspector ? (
                 <HookTargetScopeContext.Provider value={hookTargetScope}>
diff --git a/packages/app-shell/src/views/studio-design/StudioDesignSurface.accessGuard.test.tsx b/packages/app-shell/src/views/studio-design/StudioDesignSurface.accessGuard.test.tsx
index 1e855d4b39..a56484397d 100644
--- a/packages/app-shell/src/views/studio-design/StudioDesignSurface.accessGuard.test.tsx
+++ b/packages/app-shell/src/views/studio-design/StudioDesignSurface.accessGuard.test.tsx
@@ -298,7 +298,8 @@ describe('AccessPillar — unsaved OWD overview edits guard (#2600)', () => {
     fireEvent.change(within(dialog).getByPlaceholderText('Display name (e.g. Sales permissions)'), {
       target: { value: 'Set C' },
     });
-    fireEvent.click(within(dialog).getByRole('button', { name: 'Create' }));
+    // objectui#11787 — the create dialog's one label: it writes a draft.
+    fireEvent.click(within(dialog).getByRole('button', { name: t('engine.studio.createDraft', 'en-US') }));
 
     await findInMatrix('set_c');
     expect(screen.queryByTestId('owd-overview')).not.toBeInTheDocument();
diff --git a/packages/app-shell/src/views/studio-design/StudioDesignSurface.changesCount-11787.test.tsx b/packages/app-shell/src/views/studio-design/StudioDesignSurface.changesCount-11787.test.tsx
new file mode 100644
index 0000000000..3dcaf89410
--- /dev/null
+++ b/packages/app-shell/src/views/studio-design/StudioDesignSurface.changesCount-11787.test.tsx
@@ -0,0 +1,186 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectui#11787 — the header's Changes count after a draft save.
+ *
+ * Found in a browser QA pass: after an autosave, an item showed its
+ * "Unpublished draft" chip while the header beside it still said "No drafts
+ * pending publish", until the count's read caught up. A draft save stamped with
+ * this package means at least one draft is pending, so from the render in which
+ * the save lands the header says so, and the read the save asks for is sent
+ * after it rather than joined to one already on the wire.
+ *
+ * Driven through a save every author reaches: the Access pillar's
+ * "New permission set", whose dialog also carries Studio's one create label.
+ *
+ * Real: the surface, its pillar, `useMetadataClient` and the client it builds,
+ * and `usePendingDrafts`. Stubbed: `globalThis.fetch` (the server; every
+ * `_drafts` read is held open until the test answers it), `packages-io`'s
+ * package list, `sonner`, and the dock and panels no assertion reads.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import * as React from 'react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { act, cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+
+const PACKAGE_ID = 'app.a';
+const DRAFTS = `/api/v1/meta/_drafts?packageId=${PACKAGE_ID}`;
+
+vi.mock('sonner', () => ({
+  toast: {
+    warning: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+    info: vi.fn(),
+    message: vi.fn(),
+    dismiss: vi.fn(),
+  },
+  Toaster: () => null,
+}));
+
+vi.mock('./packages-io', async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>();
+  return {
+    ...actual,
+    fetchPackages: vi.fn(async () => [{ id: PACKAGE_ID, name: PACKAGE_ID, writable: true, namespace: 'a' }]),
+  };
+});
+
+vi.mock('@object-ui/react', async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>();
+  return { ...actual, useAdapter: () => ({}) };
+});
+
+vi.mock('../../components/SuggestedBindingsPanel', () => ({ SuggestedBindingsPanel: () => null }));
+vi.mock('../metadata-admin/AccessExplainPanel', () => ({ AccessExplainPanel: () => null }));
+vi.mock('./StudioAiCopilot', () => ({ StudioChatDock: () => null }));
+vi.mock('../../preview/DraftChangesPanel', () => ({ DraftChangesPanel: () => null }));
+
+import { StudioDesignSurface } from './StudioDesignSurface';
+import { t } from '../metadata-admin/i18n';
+
+window.matchMedia = ((query: string) => ({
+  matches: false,
+  media: query,
+  onchange: null,
+  addEventListener: () => {},
+  removeEventListener: () => {},
+  addListener: () => {},
+  removeListener: () => {},
+  dispatchEvent: () => false,
+})) as unknown as typeof window.matchMedia;
+(globalThis as unknown as { ResizeObserver: unknown }).ResizeObserver =
+  (globalThis as unknown as { ResizeObserver?: unknown }).ResizeObserver ??
+  class {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  };
+
+interface HeldRead {
+  respond: (drafts: Array<Record<string, unknown>>) => void;
+}
+
+/** The `_drafts` reads, in the order they were sent, each held until answered. */
+const draftReads: HeldRead[] = [];
+/** Draft saves the surface sent (`PUT …?mode=draft`). */
+const draftSaves: string[] = [];
+
+function json(body: unknown) {
+  return new Response(JSON.stringify(body), { status: 200, headers: { 'content-type': 'application/json' } });
+}
+
+beforeEach(() => {
+  draftReads.length = 0;
+  draftSaves.length = 0;
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async (input: unknown, init?: { method?: string }) => {
+      const url = String(input);
+      if (url === DRAFTS) {
+        return new Promise<Response>((resolve) => {
+          draftReads.push({ respond: (drafts) => resolve(json({ drafts })) });
+        });
+      }
+      if (init?.method === 'PUT' && url.includes('mode=draft')) {
+        draftSaves.push(url);
+        return json({});
+      }
+      // Every other read (the pillar's lists, the type registry, the matrix's
+      // reads) answers empty — none of them is under test here.
+      return json([]);
+    }) as unknown as typeof fetch,
+  );
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+const NONE_PENDING = t('engine.studio.publishNoneTitle', 'en');
+const changesButton = () => screen.getByRole('button', { name: new RegExp(`^${t('engine.studio.changes', 'en')}`) });
+
+async function drain() {
+  for (let i = 0; i < 5; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+async function createSetThroughTheDialog() {
+  fireEvent.click(await screen.findByRole('button', { name: t('engine.studio.access.new', 'en') }));
+  const dialog = await screen.findByRole('dialog');
+  fireEvent.change(within(dialog).getByPlaceholderText(t('engine.studio.access.labelPlaceholder', 'en')), {
+    target: { value: 'Set C' },
+  });
+  // Studio's one create label (objectui#11787): every create dialog writes a draft.
+  fireEvent.click(within(dialog).getByRole('button', { name: t('engine.studio.createDraft', 'en') }));
+}
+
+describe('the Changes count after a draft save (objectui#11787)', () => {
+  it('says a draft is pending from the render the save lands in, and the read it asks for is its own', async () => {
+    render(
+      <MemoryRouter initialEntries={[`/studio/${PACKAGE_ID}/access`]}>
+        <Routes>
+          <Route path="/studio/:packageId/:tab" element={<StudioDesignSurface />} />
+        </Routes>
+      </MemoryRouter>,
+    );
+    // The mount read is on the wire and unanswered.
+    await waitFor(() => expect(draftReads.length).toBeGreaterThan(0));
+    await act(drain);
+    const beforeSave = draftReads.length;
+
+    await act(async () => {
+      await createSetThroughTheDialog();
+    });
+    await waitFor(() => expect(draftSaves).toHaveLength(1));
+    await act(drain);
+
+    // The save landed: the header no longer says nothing is pending, and the
+    // count is at least the draft the save wrote — before any read answers.
+    expect(screen.queryByText(NONE_PENDING)).toBeNull();
+    expect(changesButton()).toHaveTextContent('· 1');
+    // The save sent a read of its own, not one joined to the read on the wire.
+    expect(draftReads.length).toBe(beforeSave + 1);
+
+    // The reads sent before the save answer with the ledger as it was: ignored.
+    await act(async () => {
+      for (const read of draftReads.slice(0, beforeSave)) read.respond([]);
+      await drain();
+    });
+    expect(screen.queryByText(NONE_PENDING)).toBeNull();
+    expect(changesButton()).toHaveTextContent('· 1');
+
+    // The read sent after the save answers with the server's count.
+    await act(async () => {
+      draftReads[beforeSave].respond([
+        { type: 'permission', name: 'set_c', packageId: PACKAGE_ID },
+        { type: 'object', name: 'a_account', packageId: PACKAGE_ID },
+      ]);
+      await drain();
+    });
+    await waitFor(() => expect(changesButton()).toHaveTextContent('· 2'));
+    expect(screen.queryByText(NONE_PENDING)).toBeNull();
+  });
+});
diff --git a/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx b/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx
index 9d6ced425b..9b725ed0fb 100644
--- a/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx
+++ b/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx
@@ -205,6 +205,8 @@ import {
   newField,
 } from '../metadata-admin/previews/object-fields-io.js';
 import { CreateItemDialog } from './CreateItemDialog.js';
+// objectui#11787 — the shared draft autosave, moved to its own module unchanged.
+import { useDraftAutoSave, type DraftSend } from './useDraftAutoSave.js';
 import { FLOW_PRESETS, flowPresetTrigger, type FlowPreset } from './flowPresets.js';
 import {
   CreatePackageDialog,
@@ -254,68 +256,6 @@ const PILLARS: ReadonlyArray<{ key: string; label: string; Icon: LucideIcon }> =
   { key: 'automations', label: 'Automations', Icon: Workflow },
   { key: 'interfaces', label: 'Interfaces', Icon: LayoutDashboard },
 ];
-// objectui#5813 — debounced draft auto-save, shared by the pillars' editors.
-// Drafts never touch the live app, so persisting them automatically is
-// zero-risk; the Save draft buttons it replaces were a standing tax on the
-// topbars AND a real loss point (forgot-to-save). Semantics:
-//  - re-arms 1.5s after the LAST edit (the snapshot key changes per edit);
-//  - `blocked` mirrors each site's old disabled-guard — in particular a
-//    CEL-blocking inspector must gate the TIMER, not just a button, or the
-//    timer publishes the malformed definition a second later (objectui#4306);
-//  - a FAILED save does not retry until the user edits again (the snapshot
-//    it attempted is remembered), so an invalid draft can't toast-loop.
-//  - objectui#11189 — the returned `flush` fires the pending save now instead
-//    of at the timer, under the same conditions, and says whether a save went
-//    out. A flushed snapshot counts as attempted, so the timer never sends it
-//    a second time.
-//  - objectui#11204 — a save that lands clears its dirty flag only if nothing
-//    was edited while it was in flight. The hook hands every save it sends a
-//    `DraftSend` claim on the snapshot it sent, and the caller's
-//    `set*Dirty(false)` after its await runs only while `sent.unmoved()`. An
-//    edit taken meanwhile keeps the buffer dirty, and the autosave, unblocked
-//    by the save's end, sends it next. A save the caller sends itself takes
-//    its claim from `sending(body)`.
-//  - objectui#11232 — a dirty period belongs to the item that was open when it
-//    began. The caller names the item its `save` addresses as `target`, a
-//    primitive identity (type and name; never a memoised object, AGENTS.md
-//    #10). On a switch the caller's `save` addresses the newly opened item at
-//    once, while the buffer holds the previous item's document until the new
-//    load installs its own; so a period that began on another item is never
-//    sent, by the timer or by `flush`, and it ends only when the caller's dirty
-//    flag falls.
-//    The previous item's pending edit is dropped: what the Data pillar's switch
-//    has always done, and what every pillar did whenever the new load landed
-//    inside the debounce. A claim also reads moved once the target has
-//    changed, so a save that lands after a switch never clears the dirty flag
-//    of the item opened since.
-//  - objectui#11272 — the buffer belongs to the item it was loaded for. The
-//    caller names that item as `loadedFor`, in `target`'s spelling, and sets
-//    it where its load installs a buffer and nowhere else. Until the open
-//    item's own document is in, `loadedFor` is not `target`: then the timer
-//    and `flush` send nothing, `sending` gives no claim (every save the caller
-//    sends itself asks it first, and sends nothing without one), and `loaded`
-//    is false, which the caller reads to show and offer nothing of the buffer
-//    under the open item. An edit a period begins while the buffer is another
-//    item's is never sent. It ends with the dirty flag, which every caller's
-//    buffer install clears: the page inspector's and the Data pillar's as
-//    they install (the Data pillar also at its load's start), a leaf with no
-//    editable draft as its `{}` goes in, and Automations when the load
-//    settles. The Interfaces nav installs only over a clean buffer, or on its
-//    mount (it is keyed by package).
-
-/**
- * objectui#11204 — one draft save's claim on the buffer it sent. `unmoved()`
- * is true while the buffer, as last committed, is still the snapshot that
- * save sent, compared the way the autosave compares snapshots (serialised).
- * It compares content, not an edit count: an edit undone while the save was
- * in flight leaves the buffer as the server now holds it, and so clean.
- * objectui#11232 — and only while the hook's `target` is still the item the
- * save was sent for: after a switch the buffer is the next item's to clear.
- */
-interface DraftSend {
-  unmoved: () => boolean;
-}
-
 /**
  * objectui#11357 — the body the Interfaces pillar saves for its open leaf. A
  * page goes through the `page` registration's `fromDraft`, the serialiser
@@ -336,95 +276,6 @@ function interfacesSaveBody(type: string, draft: Record<string, unknown>): Recor
   return fromDraft ? fromDraft(draft) : draft;
 }
 
-function draftSnapshotKey(snapshot: unknown): string {
-  try {
-    return JSON.stringify(snapshot ?? null);
-  } catch {
-    // Unserializable draft (never the case for metadata bodies): a constant
-    // key means one auto-save per dirty period instead of per edit, and a
-    // save that lands always reads unmoved: degraded, as before.
-    return '"__unserializable__"';
-  }
-}
-
-function useDraftAutoSave(opts: {
-  /** objectui#11232 — the item `save` addresses, as a primitive identity. */
-  target: string;
-  /** objectui#11272 — the item whose document the buffer holds: the target
-   * the caller's load installed it for, in the same spelling. */
-  loadedFor: string;
-  dirty: boolean;
-  blocked: boolean;
-  snapshot: unknown;
-  save: (sent: DraftSend) => void | Promise<void>;
-}): {
-  flush: () => boolean;
-  /** A claim for a save the caller sends itself; `null` refuses it (objectui#11272). */
-  sending: (snapshot: unknown) => DraftSend | null;
-  /** objectui#11272 — the buffer is the open item's own document. */
-  loaded: boolean;
-} {
-  const { target, loadedFor, dirty, blocked, snapshot, save } = opts;
-  // Pure (the react compiler forbids impure render calls).
-  const snapKey = React.useMemo(() => draftSnapshotKey(snapshot), [snapshot]);
-  const lastAttemptRef = React.useRef<string | null>(null);
-  const saveRef = React.useRef(save);
-  // What the timer below would send, as last committed, for `flush` and for a
-  // landing save's claim to read. A layout effect, so it is current as soon as
-  // a render commits: a save that lands right after an edit reads the edit.
-  // `since` is the target the dirty period began on (objectui#11232): taken
-  // as the flag rises, kept while it stays up.
-  const pendingRef = React.useRef({ dirty, blocked, snapKey, target, loadedFor, since: target });
-  React.useLayoutEffect(() => {
-    const prev = pendingRef.current;
-    saveRef.current = save;
-    pendingRef.current = { dirty, blocked, snapKey, target, loadedFor, since: dirty && prev.dirty ? prev.since : target };
-  });
-  // A state initializer, not a memo: React keeps its identity by contract, so
-  // a caller may list it, or a member of it, as an effect dependency
-  // (AGENTS.md #10).
-  const [api] = React.useState(() => {
-    const claim = (key: string, sentFor: string): DraftSend => ({
-      unmoved: () => pendingRef.current.target === sentFor && pendingRef.current.snapKey === key,
-    });
-    // objectui#11232 — the pending edit is the open item's own: its dirty
-    // period began on the item `save` now addresses. objectui#11272 — and the
-    // buffer it edits is that item's document: its load installed it for it.
-    const owned = (): boolean => {
-      const { since, target: now, loadedFor: holds } = pendingRef.current;
-      return since === now && holds === now;
-    };
-    const send = (key: string): void => {
-      lastAttemptRef.current = key;
-      void saveRef.current(claim(key, pendingRef.current.target));
-    };
-    return {
-      send,
-      owned,
-      flush: (): boolean => {
-        const pending = pendingRef.current;
-        if (!pending.dirty || pending.blocked || !owned() || lastAttemptRef.current === pending.snapKey) return false;
-        send(pending.snapKey);
-        return true;
-      },
-      sending: (sent: unknown): DraftSend | null =>
-        owned() ? claim(draftSnapshotKey(sent), pendingRef.current.target) : null,
-    };
-  });
-  React.useEffect(() => {
-    if (!dirty || blocked) return;
-    if (lastAttemptRef.current === snapKey) return;
-    const timer = setTimeout(() => {
-      if (lastAttemptRef.current === snapKey) return;
-      // Read as last committed: a switch since the edit left it with its item.
-      if (!api.owned()) return;
-      api.send(snapKey);
-    }, 1500);
-    return () => clearTimeout(timer);
-  }, [dirty, blocked, snapKey, api]);
-  return { flush: api.flush, sending: api.sending, loaded: loadedFor === target };
-}
-
 /**
  * objectui#11786 — tells the surface's Publish what edit a pillar holds unsent
  * (`StudioHeld.clause`, or `null`), and takes it back when the pillar unmounts,
@@ -1260,7 +1111,7 @@ export function StudioDesignSurface({ aiSlot }: StudioDesignSurfaceProps): React
   const [changesOpen, setChangesOpen] = React.useState(false);
   const [publishing, setPublishing] = React.useState(false);
   const [publishNonce, setPublishNonce] = React.useState(0); // ↑ → pillars re-read the published baseline
-  const [draftNonce, setDraftNonce] = React.useState(0); // ↑ → refresh the pending-draft count
+  const [draftNonce, setDraftNonce] = React.useState(0); // ↑ → a draft save landed (`onDraftSaved`)
 
   // objectui#5801 — the shared pending-drafts source: same fetch, same count,
   // and the assistant bus's metadata-refresh pulse keeps this topbar in step
@@ -1274,13 +1125,20 @@ export function StudioDesignSurface({ aiSlot }: StudioDesignSurfaceProps): React
     count: feedCount,
     entries: pendingEntries,
     refresh: refreshPending,
+    behindSave,
   } = usePendingDrafts({ packageId });
   const pendingCount =
     packageId !== null ? feedCount : feedCount === null ? null : pendingEntries.filter(isOrgScopeDraft).length;
 
+  // A draft save asks for its own read (`onDraftSaved` below, objectui#11787);
+  // this one serves the mount and a publish.
   React.useEffect(() => {
     void refreshPending();
-  }, [refreshPending, publishNonce, draftNonce]);
+  }, [refreshPending, publishNonce]);
+  const refreshPendingRef = React.useRef(refreshPending);
+  React.useLayoutEffect(() => {
+    refreshPendingRef.current = refreshPending;
+  });
 
   // objectui#11786 — what the open pillar's autosave holds unsent (an
   // incomplete-but-normal edit), as the clause naming what it needs. A publish
@@ -1427,8 +1285,19 @@ export function StudioDesignSurface({ aiSlot }: StudioDesignSurfaceProps): React
     await refreshPending();
   }, [shellClient, packageId, refreshPending, locale, heldEdit]);
 
-  const onDraftSaved = React.useCallback(() => setDraftNonce((n) => n + 1), []);
-  const hasPending = (pendingCount ?? 0) > 0;
+  // objectui#11787 — a Studio draft save reports here when it lands, and the
+  // count follows it: the read it asks for is sent after the save, never
+  // answered by a read already on the wire, and until that read answers the
+  // count is at least the one draft the save wrote (`behindSave`). So the
+  // header stops saying "No drafts pending publish" in the same render that
+  // shows an item's "Unpublished draft" chip, both being set by the save that
+  // landed. Pinned by `StudioDesignSurface.changesCount-11787.test.tsx`.
+  const onDraftSaved = React.useCallback(() => {
+    setDraftNonce((n) => n + 1);
+    void refreshPendingRef.current({ afterSave: true });
+  }, []);
+  const shownPendingCount = behindSave ? Math.max(pendingCount ?? 0, 1) : pendingCount;
+  const hasPending = (shownPendingCount ?? 0) > 0;
   const publishNoneReasonId = React.useId();
 
   // Builder → running-app bridge (Airtable's Launch): the builder edits the
@@ -1496,14 +1365,14 @@ export function StudioDesignSurface({ aiSlot }: StudioDesignSurfaceProps): React
         toast.success(tFormat('engine.studio.app.savedDraft', locale, { label }));
         setAppDraftPending(label);
         setAppCreating(false);
-        setDraftNonce((n) => n + 1);
+        onDraftSaved();
       } catch (e) {
         setAppErr(formatMetadataError(e));
       } finally {
         setAppBusy(false);
       }
     },
-    [appAddObjects, loadPackageObjects, shellClient, packageId, locale],
+    [appAddObjects, loadPackageObjects, shellClient, packageId, locale, onDraftSaved],
   );
 
   // objectui#5800, fixed in passing — the topbar's app detection used to
@@ -1733,7 +1602,7 @@ export function StudioDesignSurface({ aiSlot }: StudioDesignSurfaceProps): React
                 className="inline-flex items-center gap-1.5 rounded-md border px-2.5 py-1 text-xs text-muted-foreground hover:bg-muted hover:text-foreground"
               >
                 <GitBranch className="h-3.5 w-3.5" />
-                {t('engine.studio.changes', locale)}{hasPending ? ` · ${pendingCount}` : ''}
+                {t('engine.studio.changes', locale)}{hasPending ? ` · ${shownPendingCount}` : ''}
               </button>
               {/* objectui#8219 — with nothing to publish, say so on the page
                   rather than only in the hover tooltip. */}
@@ -5305,6 +5174,7 @@ export function DataPillar({
                   disabled={readOnly}
                   hookSchema={typeSchemas.hook}
                   publishNonce={publishNonce}
+                  onDraftSaved={onDraftSaved}
                 />
               ) : viewMode === 'actions' ? (
                 <ObjectActionsPanel
@@ -7044,7 +6914,7 @@ export function AccessPillar({
           ) : current ? (
             /* The existing Salesforce-style matrix page, embedded unchanged —
              * objects × CRUD/VAMA/lifecycle up top, per-object field-level R/W
-             * below, its own Save + destructive-change guard included. The
+             * below, its own autosave + destructive-change guard included. The
              * read-only OWD badge deep-links to the overview above. */
             <PermissionMatrixEditPage
               key={current}
@@ -7082,7 +6952,8 @@ export function AccessPillar({
         labelPlaceholder={t('engine.studio.access.labelPlaceholder', locale)}
         idFieldLabel={t('engine.studio.access.idLabel', locale)}
         idPlaceholder={t('engine.studio.access.idPlaceholder', locale)}
-        submitLabel={t('engine.studio.create', locale)}
+        // objectui#11787 — one label on every Studio create dialog: each writes a draft.
+        submitLabel={t('engine.studio.createDraft', locale)}
         submittingLabel={t('engine.studio.creating', locale)}
         busy={busy}
         error={createErr}
diff --git a/packages/app-shell/src/views/studio-design/useDraftAutoSave.ts b/packages/app-shell/src/views/studio-design/useDraftAutoSave.ts
new file mode 100644
index 0000000000..9a33e92753
--- /dev/null
+++ b/packages/app-shell/src/views/studio-design/useDraftAutoSave.ts
@@ -0,0 +1,166 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The debounced draft autosave every Studio editor shares (objectui#5813).
+ *
+ * Moved out of `StudioDesignSurface.tsx` unchanged by objectui#11787 so that the
+ * package door's permission matrix (`metadata-admin/PermissionMatrixEditor.tsx`)
+ * and the Data pillar's hooks panel (`ObjectHooksPanel.tsx`) run the same
+ * autosave as the pillars, not a second debounce. A module of its own because
+ * the matrix cannot import the surface: the surface imports the matrix, and
+ * the matrix is also loaded on the environment-admin route, where the surface
+ * is not.
+ */
+
+import * as React from 'react';
+
+// objectui#5813 — debounced draft auto-save, shared by the pillars' editors.
+// Drafts never touch the live app, so persisting them automatically is
+// zero-risk; the Save draft buttons it replaces were a standing tax on the
+// topbars AND a real loss point (forgot-to-save). Semantics:
+//  - re-arms 1.5s after the LAST edit (the snapshot key changes per edit);
+//  - `blocked` mirrors each site's old disabled-guard — in particular a
+//    CEL-blocking inspector must gate the TIMER, not just a button, or the
+//    timer publishes the malformed definition a second later (objectui#4306);
+//  - a FAILED save does not retry until the user edits again (the snapshot
+//    it attempted is remembered), so an invalid draft can't toast-loop.
+//  - objectui#11189 — the returned `flush` fires the pending save now instead
+//    of at the timer, under the same conditions, and says whether a save went
+//    out. A flushed snapshot counts as attempted, so the timer never sends it
+//    a second time.
+//  - objectui#11204 — a save that lands clears its dirty flag only if nothing
+//    was edited while it was in flight. The hook hands every save it sends a
+//    `DraftSend` claim on the snapshot it sent, and the caller's
+//    `set*Dirty(false)` after its await runs only while `sent.unmoved()`. An
+//    edit taken meanwhile keeps the buffer dirty, and the autosave, unblocked
+//    by the save's end, sends it next. A save the caller sends itself takes
+//    its claim from `sending(body)`.
+//  - objectui#11232 — a dirty period belongs to the item that was open when it
+//    began. The caller names the item its `save` addresses as `target`, a
+//    primitive identity (type and name; never a memoised object, AGENTS.md
+//    #10). On a switch the caller's `save` addresses the newly opened item at
+//    once, while the buffer holds the previous item's document until the new
+//    load installs its own; so a period that began on another item is never
+//    sent, by the timer or by `flush`, and it ends only when the caller's dirty
+//    flag falls.
+//    The previous item's pending edit is dropped: what the Data pillar's switch
+//    has always done, and what every pillar did whenever the new load landed
+//    inside the debounce. A claim also reads moved once the target has
+//    changed, so a save that lands after a switch never clears the dirty flag
+//    of the item opened since.
+//  - objectui#11272 — the buffer belongs to the item it was loaded for. The
+//    caller names that item as `loadedFor`, in `target`'s spelling, and sets
+//    it where its load installs a buffer and nowhere else. Until the open
+//    item's own document is in, `loadedFor` is not `target`: then the timer
+//    and `flush` send nothing, `sending` gives no claim (every save the caller
+//    sends itself asks it first, and sends nothing without one), and `loaded`
+//    is false, which the caller reads to show and offer nothing of the buffer
+//    under the open item. An edit a period begins while the buffer is another
+//    item's is never sent. It ends with the dirty flag, which every caller's
+//    buffer install clears: the page inspector's and the Data pillar's as
+//    they install (the Data pillar also at its load's start), a leaf with no
+//    editable draft as its `{}` goes in, and Automations when the load
+//    settles. The Interfaces nav installs only over a clean buffer, or on its
+//    mount (it is keyed by package).
+
+/**
+ * objectui#11204 — one draft save's claim on the buffer it sent. `unmoved()`
+ * is true while the buffer, as last committed, is still the snapshot that
+ * save sent, compared the way the autosave compares snapshots (serialised).
+ * It compares content, not an edit count: an edit undone while the save was
+ * in flight leaves the buffer as the server now holds it, and so clean.
+ * objectui#11232 — and only while the hook's `target` is still the item the
+ * save was sent for: after a switch the buffer is the next item's to clear.
+ */
+export interface DraftSend {
+  unmoved: () => boolean;
+}
+
+function draftSnapshotKey(snapshot: unknown): string {
+  try {
+    return JSON.stringify(snapshot ?? null);
+  } catch {
+    // Unserializable draft (never the case for metadata bodies): a constant
+    // key means one auto-save per dirty period instead of per edit, and a
+    // save that lands always reads unmoved: degraded, as before.
+    return '"__unserializable__"';
+  }
+}
+
+export function useDraftAutoSave(opts: {
+  /** objectui#11232 — the item `save` addresses, as a primitive identity. */
+  target: string;
+  /** objectui#11272 — the item whose document the buffer holds: the target
+   * the caller's load installed it for, in the same spelling. */
+  loadedFor: string;
+  dirty: boolean;
+  blocked: boolean;
+  snapshot: unknown;
+  save: (sent: DraftSend) => void | Promise<void>;
+}): {
+  flush: () => boolean;
+  /** A claim for a save the caller sends itself; `null` refuses it (objectui#11272). */
+  sending: (snapshot: unknown) => DraftSend | null;
+  /** objectui#11272 — the buffer is the open item's own document. */
+  loaded: boolean;
+} {
+  const { target, loadedFor, dirty, blocked, snapshot, save } = opts;
+  // Pure (the react compiler forbids impure render calls).
+  const snapKey = React.useMemo(() => draftSnapshotKey(snapshot), [snapshot]);
+  const lastAttemptRef = React.useRef<string | null>(null);
+  const saveRef = React.useRef(save);
+  // What the timer below would send, as last committed, for `flush` and for a
+  // landing save's claim to read. A layout effect, so it is current as soon as
+  // a render commits: a save that lands right after an edit reads the edit.
+  // `since` is the target the dirty period began on (objectui#11232): taken
+  // as the flag rises, kept while it stays up.
+  const pendingRef = React.useRef({ dirty, blocked, snapKey, target, loadedFor, since: target });
+  React.useLayoutEffect(() => {
+    const prev = pendingRef.current;
+    saveRef.current = save;
+    pendingRef.current = { dirty, blocked, snapKey, target, loadedFor, since: dirty && prev.dirty ? prev.since : target };
+  });
+  // A state initializer, not a memo: React keeps its identity by contract, so
+  // a caller may list it, or a member of it, as an effect dependency
+  // (AGENTS.md #10).
+  const [api] = React.useState(() => {
+    const claim = (key: string, sentFor: string): DraftSend => ({
+      unmoved: () => pendingRef.current.target === sentFor && pendingRef.current.snapKey === key,
+    });
+    // objectui#11232 — the pending edit is the open item's own: its dirty
+    // period began on the item `save` now addresses. objectui#11272 — and the
+    // buffer it edits is that item's document: its load installed it for it.
+    const owned = (): boolean => {
+      const { since, target: now, loadedFor: holds } = pendingRef.current;
+      return since === now && holds === now;
+    };
+    const send = (key: string): void => {
+      lastAttemptRef.current = key;
+      void saveRef.current(claim(key, pendingRef.current.target));
+    };
+    return {
+      send,
+      owned,
+      flush: (): boolean => {
+        const pending = pendingRef.current;
+        if (!pending.dirty || pending.blocked || !owned() || lastAttemptRef.current === pending.snapKey) return false;
+        send(pending.snapKey);
+        return true;
+      },
+      sending: (sent: unknown): DraftSend | null =>
+        owned() ? claim(draftSnapshotKey(sent), pendingRef.current.target) : null,
+    };
+  });
+  React.useEffect(() => {
+    if (!dirty || blocked) return;
+    if (lastAttemptRef.current === snapKey) return;
+    const timer = setTimeout(() => {
+      if (lastAttemptRef.current === snapKey) return;
+      // Read as last committed: a switch since the edit left it with its item.
+      if (!api.owned()) return;
+      api.send(snapKey);
+    }, 1500);
+    return () => clearTimeout(timer);
+  }, [dirty, blocked, snapKey, api]);
+  return { flush: api.flush, sending: api.sending, loaded: loadedFor === target };
+}