fix(service-settings): move the storage, knowledge and AI warnings into info_banner rows

[objectstack-fleet]

Fixes #23839
Clause-②: no — the bundles fill a slot the spec already declares, and no setting's key, value, default or save behaviour changes. Measured: the package's built dist/index.d.ts and dist/index.d.cts are byte-identical at the base and at this head.

Landing gate: keep this PR draft

This PR stays draft until objectstack's .objectui-sha (now daeb77fc84) carries objectstack-ai/objectui#12671's banner reader, because until then the console draws each banner's English literal and zh-CN, ja-JP and es-ES admins would lose the translated warnings they read today.

What changes

Four warnings were sentences inside ordinary strings, each starting with a hand-typed warning glyph, so the admin read them as one more sentence of the page subtitle or of a toggle's help. Each one is now an info_banner row with bannerSeverity: 'warning', an id, a short label (its title) and bannerText. It sits in the section it concerns, directly under the field it warns about:

Namespace	Banner id	Section, position	Was inside
storage	adapter_switch_warning	Backend, under the Adapter select	the namespace description
knowledge	adapter_switch_warning	Backend, under the Adapter select	the namespace description
knowledge	enforce_rls_warning	Permissions, under the Enforce RLS on search toggle	the enforce_rls help (description)
ai	log_prompts_warning	Observability, under the Log full prompts toggle	the log_prompts help (description)

Each string keeps its non-warning text:

• storage keeps "Backend used for attachments, exports, and user uploads."
• knowledge keeps "Vector-store backend for RAG / knowledge sources." and also the sentence after the warning, "The embedder is configured separately under AI."
• enforce_rls keeps "Re-check every hit against the caller's record-level permissions via IDataEngine."
• log_prompts keeps "Include rendered prompts (not just metadata) in trace rows."

feature-flags.manifest.ts is unchanged: its beta_notice banner already had an id.

Translations

In the en, zh-CN, ja-JP and es-ES bundles, each warning sentence left the bundle's description / help copy and now sits under settings.NAMESPACE.banners.BANNER_ID.{title,text}, the slot PR #23886 declared. The translated sentences are the ones each bundle already carried, moved without the glyph and not re-translated. Each banner has a new short title in every locale:

Banner	en	zh-CN	ja-JP	es-ES
storage.adapter_switch_warning	Existing files are not migrated	已有文件不会迁移	既存ファイルは移行されません	Los archivos existentes no se migran
knowledge.adapter_switch_warning	Existing indices are not migrated	已有索引不会迁移	既存のインデックスは移行されません	Los índices existentes no se migran
knowledge.enforce_rls_warning	Leave RLS on in production	生产环境请保持开启	本番環境では有効のままにしてください	Mantenlo activado en producción
ai.log_prompts_warning	Prompts may contain PII	Prompt 可能含有 PII	PII 漏えいの可能性	Los prompts pueden contener PII
feature_flags.beta_notice	Heads up	注意	ご注意ください	Atención

The Feature Flags beta_notice banner gained copies in all four bundles, since the coverage test now requires them.

Pins

• settings-translation-coverage.test.ts covers banners in both directions. Every info_banner id needs a title and a text in zh-CN, ja-JP and es-ES. A banner with no id is reported, because no locale can address it. No locale (en included) may carry a banner id the manifest does not declare.
• The same file sweeps every manifest's description, helpText and specifier help, and every locale's description, group description and key help: none may contain the warning glyph. Each sweep also asserts it read more than 50 strings, so it cannot pass on an empty set.
• storage.manifest.test.ts, knowledge.manifest.test.ts and ai.manifest.test.ts each pin three things: the exact set of info_banner ids with bannerSeverity: 'warning'; that each banner has a label and a body and sits in its section directly under its field; and that the glyph appears nowhere in the serialized manifest.

Evidence (head c396797fd5)

• Package suite: pnpm --filter @objectstack/service-settings exec vitest run --maxWorkers=2 gave Test Files 47 passed (47), Tests 845 passed (845). pnpm --filter @objectstack/service-settings typecheck (tsc --noEmit) exited 0, and --listFiles shows all four edited test files in the program.

• Runtime probe (one-off, not committed): PlatformTranslationDataSchema.safeParse on each shipped bundle gave success=true for en, zh-CN, ja-JP and es-ES. Every pair of the 5 banners and 4 locales (20 in all) resolved through resolveSettingsBannerTitle / resolveSettingsBannerText from the bundle; none fell back to the manifest literal.

• Ablations were run through scripts/ablation-replace.mjs in wrap mode, on the four test files (105 tests), with the tests reading src by relative import, so no dist was involved. Each restore was proven: blob equals HEAD, and git diff HEAD was empty.

  Mutation	Red
  rename the zh-CN storage banner key adapter_switch_warning to adapter_switch_warnin	zh-CN covers settings.storage (missing banner:adapter_switch_warning.title, .text) and zh-CN carries no copy for a group, key or banner no manifest declares (storage.banner:adapter_switch_warnin), 2 failed
  put the glyph back into the storage manifest description	the storage pin carries the warning glyph nowhere and the sweep (storage.description), 2 failed
  set log_prompts_warning to bannerSeverity: 'info'	the AI pin declares it as a warning-severity info_banner, 1 failed
  put the glyph back into the ja-JP log_prompts help	ja-JP carries the warning glyph in no description or help copy (ai.keys.log_prompts.help), 1 failed

• Declaration closure: the seven edited source files were put back to the base in the working tree only, the package was rebuilt, and then the files were restored to HEAD (blob proof) and rebuilt again. dist/index.d.ts and dist/index.d.cts are byte-identical (md5 68d6b431c4c7fe099f1fe841af3ac690 both sides). Every edited export is declared with a named type (SettingsManifest, PlatformTranslationData, PlatformTranslationBundle).

• Local gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 63 commands at c396797fd5. 62 exited 0. pnpm check:dual-build-cjs-loads exited 3 with PREREQUISITE NOT MET (it needs every package's dist), so it is NOT MEASURED locally and is left to CI. --ran reconciliation: 63 derived famil(ies) accounted for — 62 run, 1 NOT-MEASURED, 0 unrun.

Acceptance notes

• The en banner text mirrors the manifest. For the two knowledge banners, the en text is the manifest's full sentence, because the en bundle's header says it mirrors the manifest literals. The old en copy carried shortened warnings ("Switching adapter does NOT migrate existing indices."; "Disabling skips the platform's unique safeguard."), so English admins now read the full sentence the manifest always had. ja-JP and es-ES had translated the shortened copies, and those moved as they were.
• Pre-existing drift, left as found: the en and translated knowledge descriptions omit "The embedder is configured separately under AI.", and the enforce_rls help in en, ja-JP and es-ES omits "via IDataEngine". Both differences predate this PR, and only the warning sentence was removed here.
• The glyph is gone from the banner text as well; bannerSeverity is now the only warning marker. At the pin daeb77fc84, the console draws every non-error severity in the default Alert variant with an Info icon, and renders bannerText as plain text. Both renderer findings belong to Settings pages: no duplicated action labels, warnings out of the subtitle, Cloud Connection says its sentence once objectui#12610's owner and are not re-filed here. Until that change lands, these banners look like info callouts. Each is still its own titled callout under its field.
• origin/main advanced to 8f4260fe66 while this ran. None of those commits touches packages/services/service-settings or packages/spec/src/system, so the branch was not merged again before opening.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

4 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7277c07f6883fbb5e8893cbe5ad91dd482f83723 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 97ce241e017115147b3ac624c7aef046a83a97cf — the merge of head c396797fd5ecedb4a59ba9284ee78f2f02f2e1f6 into base 7277c07f6883fbb5e8893cbe5ad91dd482f83723, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 97ce241e017115147b3ac624c7aef046a83a97cf && git checkout 97ce241e017115147b3ac624c7aef046a83a97cf
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7277c07f6883fbb5e8893cbe5ad91dd482f83723 c396797fd5ecedb4a59ba9284ee78f2f02f2e1f6 && git checkout -B drift-repro 7277c07f6883fbb5e8893cbe5ad91dd482f83723 && git merge --no-ff c396797fd5ecedb4a59ba9284ee78f2f02f2e1f6

node scripts/docs-audit/affected-docs.mjs --json 7277c07f6883fbb5e8893cbe5ad91dd482f83723

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

席位核对 · review · held for the land-after gate · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T14:03Z

Reviewed at head c396797fd5, from the dev's report on #23839 and the diff. 12 files, 338 changed lines, Clause-②: no. The dev measured that claim: dist/index.d.ts and dist/index.d.cts are byte-identical between base and head.

What the seat re-read in the diff:

• The four warnings. Each is now an info_banner with bannerSeverity: 'warning', an id, a short label and a bannerText, placed directly under the field it warns about. Each string keeps the non-warning text the claim measured, including knowledge's trailing "The embedder is configured separately under AI.".
• Translations. In zh-CN (read in full) and in the other bundles, each warning sentence moved out of its description / help copy into settings.NAMESPACE.banners.BANNER_ID.{title,text}, keeping the existing translated text, and each banner has a translated title. beta_notice gained its copies.
• Proof. The dev's probe resolved 20 of 20 banner × locale pairs from the bundles, with no fallback.
• Pins.
  • settings-translation-coverage.test.ts covers banners in both directions and sweeps every manifest and bundle string for the glyph.
  • The three manifest tests pin each banner's id, severity and position.
  • Four ablations each went red on the expected test, and each restore was proven by blob.

Accepted:

• The two deviations: the en copy added for beta_notice, and the fast-forward of the empty branch.
• No main merge before opening: accepted for a draft. The paths the PR touches did not move. Before landing, the branch takes a merge of origin/main, and CI runs again on that head.
• Out-of-scope findings: both are noted, not filed.
  • The two renderer defects are objectui#12610's. They now apply to five banners: a warning is drawn as an info callout, and the backticks in beta_notice's text show literally.
  • The drift between bundle copy and manifest literals is polish recorded in the PR's Acceptance notes.

Held: the PR stays draft.

• It lands only once objectstack's .objectui-sha (now daeb77fc84) carries console settings: an info_banner row draws its manifest English in every locale. Read the new settings.NAMESPACE.banners.BANNER_ID.{title,text} slot (objectstack#23886) objectui#12671's banner reader (claim 6216295088, note 6216323521 on [finding] 归档卡里的 Re-check grep 用的是脑中完整的那句话,文件里它折了行 —— 三次实测返回没有阳性对照的假零 #12671).
• Until then the console draws each banner's English literal. zh-CN, ja-JP and es-ES admins would lose the translated warnings they read today.
• When the pin moves, the seat:
  1. merges origin/main into the branch;
  2. reads CI on that head;
  3. re-checks that the console at the new pin resolves settings.*.banners.*;
  4. then ACCEPTs.

---

Generated by Claude Code