docs(deployment): give the "gate" table its fourth column — the runtime publish surface (#7442)

[os-help]

Fixes #7442

The "the gate" table in content/docs/deployment/validating-metadata.mdx documented three CLI commands. Since #4463 P1 there is a fourth door — saveMetaItem runs the same AUTHORING_RULES table on a state: 'active' write, and publishMetaItem runs it on the draft→active promotion — and the table said nothing about it. A reader of that table (human or AI) concluded a Studio save passes no gate. That is false, and it is exactly the mental model that leads someone to add a redundant check or to skip a real one.

Docs-only. One file: content/docs/deployment/validating-metadata.mdx.

Every cell measured, not assumed

The column was derived from the code, not from the issue body. Measured live through the real dispatch path (runRuntimeAuthoringRules) with a throwaway probe against the built workspace:

• runtimeGatedTypes() → ['flow']. flow is the only metadata type any rule declares at that door. An object, view, page or dashboard write runs zero rules — measured, all three returned rulesRun: [].
• Six registry rules carry surfaces: ['cli', 'runtime-publish'], all with runtimeTypes: ['flow']: validateStackExpressions, validateEmptyCombinators, validateReferenceIntegrity, validateFlowTriggerReadiness, validateApprovalApprovers, lintFlowPatterns.
• Refusals observed on crafted flow bodies: expression-invalid, approval-expression-invalid, flow-trigger-unknown-event, flow-runas-unscoped, filter-empty-combinator, flow-node-write-unknown-field.
• Advisories observed (never block): flow-template-unknown-field, flow-draft-status-ambiguous, approval-expression-no-empty-policy.
• Falsified along the way: a flow node naming a non-existent object is not caught at that door. validateObjectReferences reads stack.objects / actions / dashboards / apps and never flows, so the "Object & action name references" row is —, not ✓.

So the new column is ✓ᶠ (runs, flow writes only) on six rows, a plain ✓ on the Zod row (the per-type safeParse runs on every write, before the gate), and — everywhere else.

Four rows added, so the column can be honest

• Empty filter combinators (publish/lint 面对字面量空组合子响亮拒收 —— #5322 拍板单位元后的可选编写期信号(PD #12 形状) #5330) and flow reference integrity — node writes, template paths, read-only writes (lint: no reference-integrity or option-key validation for app metadata #3583) had no row at all, yet both are enforced at the runtime door. Leaving them out would have reproduced the very defect the issue reports.
• Flow trigger readiness (lint never-fire 族 severity 复审:两条 warning 实感更接近 error(#5496/#5647 dev 报告建议)—— 同批升、单独 PR,不逐条搭车 #5762) moved out of the row labelled "Advisory:" — lint never-fire 族 severity 复审:两条 warning 实感更接近 error(#5496/#5647 dev 报告建议)—— 同批升、单独 PR,不逐条搭车 #5762 promoted it to gating, so describing it as advisory while the new column says it refuses a publish would contradict itself.
• Platform-schedule create_record organization ([转移] 发布期护栏:多组织下「平台级 + schedule + create_record + 未显式 organization_id」拒绝——#6155 Q3=A 裁决的 lint 半边 #6285) is — — — ✓ᶠ: runtime-only by ruling, because both its inputs are facts about the deployment. It shows the column is not a pure subset in the other direction either.

Also dropped visibility aliases from the advisory row — visibility-alias-deprecated was retired by #6318 (confirmed in validate-visibility-predicates.ts, authoring-rules.ts and authoring-rule-input-tier.test.ts).

The closing prose

The sentence at the end of the section ("a stack cannot be published through the one command that happens to skip a check") was written before the fourth surface and reads as a guarantee about publishing in general. It is kept — it is still true of the three commands — and followed by what the fourth door does and does not guarantee: authoring-rule-wiring.test.ts fails if a rule runs at the runtime gate but not on os build ("the two publish verbs must not disagree"), so the door narrows types, never verdicts, with #6285 as the one stated exception.

The section also now documents what #7435 (89d7b35a7) landed: advisories ride back on the save response under advisories, which is a channel a Studio / MCP / AI author can actually read, rather than only a deduped console.warn.

Adjacent drift fixed

The AUTHORING_RULES citation said packages/cli/src/lint/authoring-rules.ts. The file is at packages/lint/src/authoring-rules.ts (packages/cli/src/lint/ contains only corpus.ts, metadata-eval.ts, score.ts). Fixed in the same pass, as triage asked.

Deliberately not done

• The heading is still ## The one gate, three entry points. content/docs/deployment/cli.mdx:458 links #the-one-gate-three-entry-points; renaming it would break that link and cli.mdx is outside this card's file surface. The body reconciles the heading with the fourth column instead.
• The sample console transcript still reads Running author-time rules (26); the registry now holds 38 entries. Out of this card's scope — reported on the issue.

Gates run locally

check:nul-bytes, check:doc-authoring, check:docs-audit-scope, check:role-word, check:quick-reference-counts, check:adr-anchors, check:adr-links — all green. MDX compiles (fumadocs-mdx). Note: check:doc-formula-expressions (named at dispatch) does not exist at this HEAD; check:doc-authoring is the doc gate that does.

No changeset — docs-only, skip-changeset.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XAdrnFmbvpLodAR88aoagw

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 10, 2026 1:18pm

[os-help]

Check Changeset is red, and neither remedy is mine to apply. Flagging rather than fixing.

The failure is exactly what it says — this PR adds no changeset:

This PR adds no changeset. If it releases nothing […] apply the skip-changeset label; otherwise run pnpm changeset and name the packages.

That leaves two routes, and the dispatch ruling for #7442 closes both to me:

• Apply skip-changeset — correct route (this is docs-only: one .mdx file, no workspace package touched, nothing to release), but the ruling reserves the label for the PM at accept time.
• Write a changeset — same ruling forbids it, and it would be wrong on the merits anyway: there is no package to name, and an empty-frontmatter one is no longer a third option (空 frontmatter changeset 相对 skip-changeset 标签零收益、单向风险 —— 「禁止空 changeset 进 .changeset/」的决策证据(#5292 结案后无处存放) #5471 rejects newly added ones, because an all-empty set stalls the release silently and greenly — 空 changeset 会静默卡死已 version 的发布:Release run 全绿,但 npm 和 Docker 什么都没发(17.0.0-rc.2 现在就卡着) #4898).

So the fix is one label on this PR: skip-changeset. Every other check is unaffected by it, and the gates this card was dispatched with all pass locally (check:nul-bytes, check:doc-authoring, check:docs-audit-scope, check:role-word, check:quick-reference-counts, plus check:adr-anchors / check:adr-links; fumadocs-mdx compiles the page).

Not pushing anything for this one — a commit cannot clear it, and the label the gate is asking for is the PM's to place.

---

Generated by Claude Code