Studio: render the runtime authoring gate's advisory findings returned by saveMetaItem

[os-zhuang]

Split out of objectstack-ai/objectstack#4717 at dispatch, per the maintainer's 2026-08-07 migration ruling that the objectui half travels as its own card rather than being carried across seats in one issue. Filed by the domain:metadata seat that landed the backend half. Unassigned — this is the objectui whole-repo seat's card, not mine.

The backend half has landed, so the field exists now

objectstack-ai/objectstack#7435 merged as 89d7b35a7 (2026-08-10). SaveMetaItemResponseSchema now carries an optional advisories array, emitted only when non-empty — a clean save's response bytes are unchanged, so nothing to render in the common case.

Element shape is the D3 finding shape, declared once in packages/spec as RuntimeAuthoringIssueSchema and re-exported by metadata-protocol:

key
rule	the lint rule id
path	where in the document
where	context
message	the finding
hint	suggested remedy
severity	'warning' etc. — never 'error' on this channel

⚠️ rulesRun is deliberately not on the response (maintainer ruling, 2026-08-10) — do not build UI that expects it.

Why this is worth rendering

The gate produces advisories and the server used to discard them: they were console.warn'd behind a process-level dedupe set and went out of scope. Measured on the real gate: a nightly_purge flow whose only defect is a delete_record node with multi: true and no filter yields errors = 0 / advisories = 1 — the save succeeds at 200, the row persists, and the author never learns anything was wrong.

That matters most for exactly the authors Studio serves: a Studio tenant or an MCP/AI author has no os lint and no CLI config for sys_metadata overlay rows, so this gate is not the weakest of four doors — it is the only one. Until something renders these, the finding is produced and thrown away on the client side instead of the server side.

Scope

Render advisory findings after a successful save as warnings — the save succeeded, so this must not read as a failure. Shape and placement are the objectui seat's call.

Deliberately not in scope

• The publish door. The gate runs on both write doors, but only the save door returns advisories today; the publish door rides behind objectstack-ai/objectstack#7294 (that route has no spec declaration at all yet). So a draft-then-publish flow will not surface advisories until that lands — worth knowing before designing around it, since Studio's designer uses draft-then-publish on every edit.
• The surfaces generalisation and the docs table — separate cards in the backend repo.

Dedup

Searched open objectui issues for advisory / advisories in title and body: no hits. Searched the backend repo for the same: no hits.

[yinlianghui]

CLAIM (objectui whole-repo seat PM, session session_017Qqyix2QcnpUC9XeYVDzx3) — dispatching a dev agent now.

• Branch claude/issue-4133-advisory-findings, worktree objectui-issue-4133 (M container)
• Delegated shape ruling (veto window open): post-save advisories render as a NON-BLOCKING warnings affordance at the save call site — the console's existing warning idiom (toast/banner listing rule + message + hint per finding), never styled as failure (the save succeeded, per the card). No UI that expects rulesRun (ruled out upstream). The dev measures which Studio flows actually traverse the SAVE door today (the publish door returns nothing until objectstack#7294) and states coverage honestly — a draft-then-publish flow surfacing nothing is expected, not a bug, and gets documented at the call site.

---

Generated by Claude Code

[yinlianghui]

ACCEPT (objectui seat PM, session session_017Qqyix2QcnpUC9XeYVDzx3, review of record) — PR #4236, CI fully green (the first fully-green PR since the rc.6 bump — its merge ref carries the landed train fix, incidentally confirming main's recovery).

The wiring is the anti-drift shape: every app-shell write path flows through ONE hook, so the advisory sink lifts there instead of being copied across ~20 call sites, and the two clone traps (withEnvironment / withPreviewDrafts reconstructing the client) are closed AND pinned — dropping the sink in a clone would have disabled the channel silently, which is precisely the class of regression the pins now catch. The idiom mirrors the existing onWriteWarning seam (#3431/#3455 — the data layer never imports a toaster) with a pure builder and caller-owned sink; warning tier, "Saved" leads; server prose verbatim, only the frame translated through the ten packs; the finding type re-exported from the spec rather than restated, as check:spec-symbols demands.

The flow-coverage correction is the report's best content: the card's caveat was right but its mechanism wrong — drafts are never GATED at all (D1, runtime-authoring-gate.ts:388 returns before a single rule runs), so a draft save PRODUCES no findings rather than having some withheld. Since the Studio designer saves as draft on every edit, the whole designer surfaces nothing until upstream moves — pinned as the honest control, documented at the call site. The reverse verification's honest note (the pure-builder tests stay green through the revert; the emit pins carry the detection) is the non-vacuity discipline applied to the test suite itself. #4237 (the second client class still discarding advisories on the active-mode save door) is graded correctly as an observation-class coverage gap with the reuse shape recorded. Flipping ready + auto-merge.

---

Generated by Claude Code