fix(cli): include readonly flow-write warnings in os validate --json (#3465 follow-up)

[os-zhuang]

Small follow-up to #3465 (spotted while merging #3472).

Problem

validateReadonlyFlowWrites (added in #3465) surfaces two things: errors for a static-readonly + literal write (a certain silent no-op — these gate and exit), and warnings for a readonlyWhen field (per-record-state → advisory). The warnings are printed in human mode:

if (!flags.json) {
  for (const f of readonlyWriteWarnings.slice(0, 50)) { … }
}

…but readonlyWriteWarnings was omitted from the --json summary's warnings array, where every other advisory category is aggregated:

warnings: [...exprWarnings, …, ...flowReadinessWarnings, ...flowTemplateWarnings, ...securityAdvisories, ...capProviderWarnings],

So os validate --json consumers (CI gates, editor integrations) silently never saw the readonly readonlyWhen warnings, while human output showed them — the two modes disagreed.

Fix

Add ...readonlyWriteWarnings to the JSON summary array, positioned by execution order (right after ...flowTemplateWarnings, before the security advisories). One line; mirrors the nine existing warning spreads exactly.

Testing

• @objectstack/cli: tsc --noEmit clean.
• No behavior change in human mode; JSON mode now includes the readonly advisory that was already computed and printed. (The CLI's JSON warnings aggregation has no dedicated test seam — none of the other nine categories is asserted there either; each underlying validator, including validateReadonlyFlowWrites, is unit-tested in @objectstack/lint.)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 25, 2026 1:35am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli.

18 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/ai/skills-reference.mdx (via packages/cli)
• content/docs/api/client-sdk.mdx (via @objectstack/cli)
• content/docs/api/data-flow.mdx (via @objectstack/cli)
• content/docs/api/environment-routing.mdx (via @objectstack/cli)
• content/docs/api/error-catalog.mdx (via @objectstack/cli)
• content/docs/automation/hook-bodies.mdx (via packages/cli)
• content/docs/deployment/backup-restore.mdx (via @objectstack/cli)
• content/docs/deployment/cli.mdx (via @objectstack/cli)
• content/docs/deployment/self-hosting.mdx (via @objectstack/cli)
• content/docs/getting-started/your-first-project.mdx (via @objectstack/cli)
• content/docs/kernel/runtime-services/data-service.mdx (via packages/cli)
• content/docs/kernel/runtime-services/index.mdx (via packages/cli)
• content/docs/permissions/authentication.mdx (via @objectstack/cli)
• content/docs/plugins/packages.mdx (via @objectstack/cli)
• content/docs/protocol/kernel/plugin-spec.mdx (via @objectstack/cli)
• content/docs/protocol/kernel/realtime-protocol.mdx (via @objectstack/cli)
• content/docs/releases/implementation-status.mdx (via @objectstack/cli)
• content/docs/releases/v16.mdx (via @objectstack/cli)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.