docs(deployment): put widget-binding integrity on the runtime publish door (#8903) (#9005)

#7529 flipped `validateWidgetBindings` from `CLI_ONLY` to `CLI_AND_RUNTIME` with
`runtimeTypes: ['dashboard']`, so a dangling widget dataset binding is now
refused at the runtime publish door (Studio, `PUT /api/v1/meta/*`, MCP), not
only by `os validate` / `os build` / `os lint`. The page still described it as a
CLI-only concern, which is the belief #7529 existed to end.

Three corrections, all sourced from `packages/lint/src/authoring-rules.ts`:

- §2 gains the publish-door paragraph — the located `422 invalid_metadata`
  envelope, all six error-tier findings gating as one class, and the ruled
  draft-may-hold-a-forward-reference carve-out.
- The "one gate, four doors" table's widget-binding row was `—` in the runtime
  publish column, which is now flatly false: it becomes `✓ᵈ`.
- The footnote asserting "the two metadata types rules declare there today" and
  "an object, page or dashboard save is checked by the schema parse and by
  nothing else" is falsified by that row. It loses the hard count rather than
  gaining a wrong one — measured against the registry, "three" would also be
  false, since `validatePresetComparands` and `validateSecurityPosture` already
  declare object/page/seed/permission/book there.


Claude-Session: https://claude.ai/code/session_011RB4waLuNbdruCo6X9oobm

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

content/docs/deployment/validating-metadata.mdx

@@ -58,6 +58,18 @@ dashboard, widget, filter, field, and object. Opt a widget out with
 `filterBindings: { <name>: false }`, or re-target the filter to one of that
 object's own fields.
 
+This is no longer only a CLI verdict. Since #7529 the same rule also runs at the
+**runtime publish door** for `dashboard` writes, so a board published from
+Studio, `PUT /api/v1/meta/*` or an MCP/AI author is refused there too — the same
+located `422 invalid_metadata` envelope, naming the dashboard, the widget and the
+key path. All six of the rule's error-tier findings gate that door as one "this
+board cannot render" class, the filter-field arm above included, while its
+warnings still ride the advisory channel and never block. So an author working
+entirely in Studio, who never runs `os validate`, no longer ships a silently
+empty chart. A **draft** save may still hold a forward reference — the refusal
+lands on the draft→active promotion, per
+[The one gate, four doors](#the-one-gate-four-doors) below.
+
 ### 3. Dead action/route references
 
 A dashboard `header.actions[]` button names a target: a `script`/`modal` action,
@@ -371,7 +383,7 @@ one. `sys_metadata` overlay rows are not in any config file, so there is no
 | CEL / predicate validation (ADR-0032) | ✓ | ✓ | ✓ | ✓ᶠ |
 | List-view navigation modes (ADR-0053) | ✓ | ✓ | ✓ | — |
 | View container shape | ✓ | ✓ | ✓ | — |
-| Widget-binding integrity (ADR-0021) | ✓ | ✓ | ✓ | — |
+| Widget-binding integrity (ADR-0021) | ✓ | ✓ | ✓ | ✓ᵈ |
 | Dashboard action/route references (ADR-0049) | ✓ | ✓ | ✓ | — |
 | Filter placeholder resolvability (#3574) | ✓ | ✓ | ✓ | — |
 | Empty filter combinators — `$and: []`, `$or: []`, `$not: {}` (#5330) | ✓ | ✓ | ✓ | ✓ᶠ |
@@ -399,11 +411,13 @@ one. `sys_metadata` overlay rows are not in any config file, so there is no
 | Emits `dist/objectstack.json` | — | ✓ | — | — |
 
 **`✓ᶠ` means the rule runs at that door for `flow` writes; `✓ᵛ` for `view`
-writes.** Those are the two metadata types rules declare there today — #4463
-shipped P1 as one type and four rule families, and #7220 added the second type
-by moving the whole `views[]` visibility-predicate family across in one edit. So
-an object, page or dashboard save is still checked by the schema parse and by
-nothing else, and the `—` cells above are `—` for two different reasons: some
+writes; `✓ᵈ` for `dashboard` writes.** Each marker names the metadata types that
+rule's own `runtimeTypes` declares, and that entry in `AUTHORING_RULES` is the
+authority — the set has grown a type at a time (#4463 shipped P1 as `flow` and
+four rule families, #7220 moved the whole `views[]` visibility-predicate family
+across in one edit, #7529 put widget-binding integrity on `dashboard`), so read
+the rule rather than assuming a save of some other type reaches storage
+unjudged. The `—` cells above are `—` for two different reasons: some
 rules read a stack-wide collection a one-item write does not carry (pages,
 dashboards, navigation, permission sets), and some parse authored source through
 `typescript`, which the kernel boot path must never load.