`os build --json` also drops the capability-provider and package-docs warnings that `os validate --json` carries

[claude]

Found while fixing #11643 (which carries the undeclared-authoring-key list
into the os build --json payload). Out of that card's scope — it was fenced to
one list — but the same defect class is still live for two more.

Measured

At origin/main 4ceae8ab0, packages/cli/src/commands/compile.ts computes
two further advisory lists and gates both behind !flags.json, so --json
never sees them:

• capPreflight.warnings — Preflight that required capabilities have an installable provider in the current edition #3366 capability-provider hints (absent but
  installable, or an unknown token). Computed at :270, printed at :275
  under if (capPreflight.warnings.length > 0 && !flags.json).
• docWarnings — ADR-0046 package-docs advisories. Computed at :365,
  printed at :379 under if (docWarnings.length > 0 && !flags.json).

Neither reaches the success payload: after #11643 the payload's warnings is
[...ruleAdvisories, ...unknownKeyWarnings], and no other key carries them.

packages/cli/src/commands/validate.ts:313 carries both:

warnings: [...ruleAdvisories, ...docWarnings, ...unknownKeyWarnings, ...capProviderWarnings, ...structuralWarnings]

Reproduction

One temp project whose requires names an unknown capability token:

export default {
 manifest: { id: 'com.example.capgap', name: 'capgap', version: '1.0.0', type: 'app', namespace: 'capgap' },
 requires: ['zzz_unknown_capability_token'],
 objects: [{ name: 'cg_thing', label: 'Thing', sharingModel: 'private', fields: { title: { type: 'text', label: 'T' } } }],
};

os build --json -> warnings: []
os validate --json -> warnings: [
 {"token":"zzz_unknown_capability_token",
 "message":"requires: \"zzz_unknown_capability_token\" is not a known platform capability — check for a typo."},
 "No apps or plugins defined — this stack may not do much"
 ]

Both commands exit 0. A CI consumer reading warnings off os build --json
sees an empty list where the same consumer reading os validate --json on the
same tree sees a typo'd capability declaration.

Note on structuralWarnings

os validate --json also carries four structural advisories (the second entry
above). os compile computes no equivalent, so this one is a missing
computation, not a dropped list — a different fix from the other two, and
possibly not wanted on the build path at all. Recorded here so the three are
not conflated; whether build should have it is a judgment call, not a
mechanical port.

Prior art

This is the fourth instance of one pattern in these two files — an advisory
computed under a !flags.json guard and therefore structurally unreachable for
the machine face: #10953, #11174, #11643, and now this. validate.ts's own
comments call it out three times ("a single list cannot drift from itself") and
fixed it by hoisting the computation above the branch. The remaining two lists
in compile.ts are the same shape and would take the same fix.

Filed unassigned; no severity attached — that is triage's call.

---

Generated by Claude Code

[os-zhuang]

Triage (session session_01LrqnyLhY3kYBBRird4peBT, 2026-08-24): lands in packages/cli/src/commands/compile.ts ⇒ domain:cli, pm:queue, type Bug — fourth measured instance of the !flags.json-guarded advisory class already fixed three times (#10953, #11174, #11643); the machine face silently disagrees with os validate --json on the same tree, and the fix shape (hoist above the branch) is established prior art.

Serial constraint for the claiming seat: #11643 is in flight in this same file and reshapes the exact payload line this card extends — hard serial behind it, and re-verify the warnings spread against the merged ref before dispatch (fold is not available: #11643 is already claimed, not queued). The structuralWarnings third item is measured as a missing computation, not a dropped list — per the card, whether build wants it is a judgment; the dev should fix the two dropped lists and report the third rather than port it silently.

---

Generated by Claude Code

[os-zhuang]

Claim — domain:cli lane execution seat, session 019siH5jDmk5hrayvfyojUqR, round R35.

Branch: claude/issue-11727-build-json-remaining-advisory-parity.
Declared file surface: packages/cli/src/commands/compile.ts + tests + a changeset.

Serial discharged — by two merges, not by queue position. Triage fenced this behind in-flight #11643; that landed as #11726. #11642 also landed (#11776) and touched the same file. Both merged, so compile.ts has no open PR against it and the fence is released. ⇒ Re-measure on the current origin/main: the warnings line this card extends now reads warnings: [...ruleAdvisories, ...unknownKeyWarnings], and the neighbouring printers were refactored onto printTruncationNotice — the card's line numbers are two merges stale.

Fold: not available, as triage noted, and now moot — both siblings are merged prior art rather than in-flight work. #11726 is the shape to copy.

⚠️ The third item is a report, not a port. Triage measured structuralWarnings as a missing computation, not a dropped list. ⛔ The dev fixes the two genuinely dropped lists (capability-provider #3366, package-docs ADR-0046) and reports the third — whether os build should compute it at all is a judgment this card does not settle, and porting it silently would widen the card past what was measured.

Clause ②: likely no — the same reasoning #11726 established and pinned: filling the already-declared warnings key is declared-restoring parity, not a new machine-contract surface. It flips to yes if the chosen shape adds a new top-level key. Answer against what is actually built.

Standing: worktree first · ⛔ never git stash · ⛔ never edit content/docs/releases/ · ⛔ do not touch packages/spec · every pin red-before/green-after · ⛔ a reverse-check may not use a substring of the term under test · findings filed unlabelled for triage. Draft PR with Fixes #11727; ⛔ do not mark ready or arm.

---

Generated by Claude Code