feat(studio): render the runtime authoring gate's advisory findings after a save - #4236

Fixes #4133

The gate's advisories ride a 200 — the save succeeded, the row persisted, the version bumped — and objectui discarded them one layer further out than the server used to: MetadataClient.save parsed the response body, returned it as an opaque T, and every call site awaited it for its side effect and dropped the value. objectstack#7435 (89d7b35a7) put them on the wire; this renders them.

Premise check

Verified against the installed rc.6 dist rather than assumed (a runtime safeParse, not a type read):

spec version: 17.0.0-rc.6
SaveMetaItemResponseSchema exported: true
RuntimeAuthoringIssueSchema exported: true
parse WITH advisories -> true
parse WITHOUT advisories -> true   advisories key present: false
reverse probe: partial finding REJECTED -> true  advisories.0.path | advisories.0.where | …

rulesRun is absent from the response and nothing here expects it.

The call-site map

Every app-shell write path takes its client from useMetadataClient, so that hook — not the ~20 client.save(...) call sites — is where this lifts. Measured, with the save mode each site uses:

MetadataProvider's client is read-only and never receives one, so it is not wired.

Flow coverage — stated honestly, and pinned

A draft-then-publish flow surfaces nothing today, at both of its doors, for two different reasons — and the first is not the one the card assumed:

• The save door. Drafts are never gated. The framework returns before running a single rule, at metadata-protocol/src/runtime-authoring-gate.ts:388:

  // D1 — drafts are never gated. Publishing one runs this same function.
  if (args.state !== 'active') return null;
  

  So a draft save produces no findings at all, rather than producing some that are withheld. The client is not what suppresses this; there is nothing to suppress.
• The publish door. It does run the gate, but PublishMetaItemResponseSchema carries no advisories field until objectstack#7294.

Since Studio's designer saves as draft on every edit, that is the whole designer. a draft save carries no findings — the gate never ran (D1) is the control test asserting the publish path is unchanged.

Shape

Mirrors ObjectStackAdapter.onWriteWarning (#3431/#3455) — the repo's existing seam for exactly this problem: a successful write whose response carries something the author must be told, emitted as an event so the data layer never imports a toaster. Rendering mirrors writeWarningToast.ts (pure builder, caller-owned sink) and the 10s multi-finding toast of preview/usePublishAllDrafts.ts.

Warning tier, never error — the title says "Saved" first, because a successful save that reads as a failure is the defect this surface must not ship. Each finding renders rule + message + hint, with where as secondary context; path is a machine pointer and is omitted. message/hint are server prose, rendered verbatim — only the frame is translated (console.saveAdvisoryTitle, all ten packs). The finding type is re-exported from @objectstack/spec (RuntimeAuthoringIssue), not restated, so it cannot fork from the 422 issues[] it shares a declaration with.

Malformed findings are dropped rather than printed as blanks, and a throwing renderer cannot turn a committed save into an error.

Reverse verification

Direction predicted before running: removing the emit restores "parse and discard", so the pins asserting an event arrives go red and the absence-asserting ones cannot see it.

Measured, exactly as predicted — 5 red / 20 green:

× emits the findings a successful save returned
× carries rule, message and hint through verbatim — they are server prose
× labels the mode when a draft save does somehow advise
× survives the withEnvironment clone — console clients are all env-scoped
× survives the withPreviewDrafts clone
 Tests  5 failed | 20 passed (25)

Worth recording: saveAdvisoryToast.test.ts stayed fully green through the revert. It exercises the pure builder, not the wiring — those tests alone would not catch this regression, which is what the data-layer emit pins carry. The clone pins are there because useMetadataClient routes every console client through withEnvironment; dropping the sink there would have disabled the channel silently.

Tests

packages/data-objectstack                     28 files, 408 tests   PASS
app-shell providers + metadata-admin + ratchet 147 files, 1488 tests PASS
i18n all-locales-key-parity                    20 tests             PASS
check:i18n-keys / check:i18n-drift / check:control-bytes             PASS
eslint (7 touched files)                       0 errors

Pre-existing reds, confirmed not mine

Both comparison-worktreed against clean origin/main (6314e87f2):

• check:spec-symbols — identical failure set on clean main (5 symbols in @object-ui/types, incl. complex.zod.ts). My RuntimeAuthoringIssue re-export passes the gate.
• data-objectstack type-check — spec-symbol-batch6.test.ts(208) reproduces with my changes fully reverted via git checkout origin/main --. Cause: rc.6 added a third DroppedFieldsEvent.reason member (primary_key) and the typetest pins two.
• app-shell type-check — the resolveActionParams.test.ts reds. No error in any file this PR touches.

All belong to the #4169 rc.6 train / PR #4208, not to this change.

Generated by Claude Code