can we spy `app1.publish(...)` and assert that it wasn't called?