@cosmicdrift/kumiko-framework 0.328.0 → 0.328.1

package/src/engine/boot-validator/screens.ts

@@ -1,2604 +0,0 @@
-// Screen validation, including the dashboard-panel sub-validators.
-// Dashboard stays here (not a separate dashboard.ts) — validateScreens
-// calls validateDashboardScreen and the dashboard validators call back
-// into validateColumnRendererForm, splitting them would create a
-// same-folder require cycle.
-
-import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
-import { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
-import type { IconKey } from "@cosmicdrift/kumiko-types/nav-icon";
-import { NAV_ICON_KEYS } from "@cosmicdrift/kumiko-types/nav-icon";
-import { rowMetaFieldNames } from "../../db/table-builder";
-import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta";
-import { parseRefTarget } from "../parse-ref-target";
-import { isKebabSegment, isValidQn, qualifyEntityName } from "../qualified-name";
-import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops";
-import {
-  isExtensionEditSection,
-  isWriteFormEditSection,
-  normalizeEditField,
-  normalizeListColumn,
-  resolveNavParentScreen,
-  sectionFieldSpecs,
-} from "../screen-helpers";
-import type { EntityDefinition, FeatureDefinition, FieldDefinition } from "../types";
-import { metricField } from "../types";
-import type {
-  ActionFormRedirect,
-  ActionFormScreenDefinition,
-  DashboardCustomPanel,
-  DashboardFilterDefinition,
-  DashboardPanelDefinition,
-  DashboardScreenDefinition,
-  DashboardScreenPanel,
-  DashboardStatGroupPanel,
-  EditFieldSpec,
-  EditLayout,
-  FieldCondition,
-  ListColumnSpec,
-  ListFacetSpec,
-  RelatedListToolbarAction,
-  RowAction,
-  RowActionNavigateBase,
-  RowFieldExtractor,
-  ScreenDefinition,
-  SecretMintScreenDefinition,
-  ToolbarAction,
-} from "../types/screen";
-
-// entityList columns accept exactly the row-meta columns the renderer
-// (computeListViewModel) knows how to type — LIST_ROW_META_COLUMNS, NOT the
-// wider rowMetaFieldNames(softDelete) used below for rowAction payload/visible
-// field refs. Those two checks guard different things: a screen column must
-// be renderable, a payload/visible field reference only needs to exist on the
-// row. Using the wider set here would let a softDelete column like
-// "deletedAt" pass the boot gate and then throw at render-time instead.
-const LIST_ROW_META_COLUMN_NAMES = new Set(Object.keys(LIST_ROW_META_COLUMNS));
-
-// entityList and projectionList both allow a rowAction to double as the
-// row-body click target (rowClick: true, fw#1708/#2164) — at most one per
-// screen, or the renderer can't tell which one should fire.
-function validateAtMostOneRowClick(
-  featureName: string,
-  screenId: string,
-  screenType: "entityList" | "projectionList",
-  rowActions: readonly RowAction[],
-): void {
-  const rowClickActions = rowActions.filter((a) => a.kind === "navigate" && a.rowClick === true);
-  if (rowClickActions.length > 1) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has ${rowClickActions.length} ` +
-        "rowActions marked rowClick:true — at most one may fire on a row-body click.",
-    );
-  }
-}
-
-// A field type in NO_WIDGET_FIELD_TYPES renders read-only on the auto-wired
-// entityEdit path (#1925) — a required field the user can never fill would
-// block every save. Only the statically-resolvable case is caught here: a
-// literal `required: true` (screen-spec override or entity-level default).
-// A dynamic FieldCondition depends on runtime form values and can't be
-// evaluated at boot; buildFormSchema() silently skips presence-checking it.
-function validateNoWidgetRequiredField(
-  featureName: string,
-  screenId: string,
-  entityDef: EntityDefinition,
-  fieldSpec: Exclude<EditFieldSpec, string>,
-): void {
-  const fieldDef = entityDef.fields[fieldSpec.field];
-  // skip: field doesn't exist or its type already has a widget — nothing to validate.
-  if (fieldDef === undefined || !NO_WIDGET_FIELD_TYPES.includes(fieldDef.type)) return;
-  // Embedded LIST fields (`multiple: true`) get their own EmbeddedListField
-  // grid widget (#1838) — only plain (non-list) embedded has no widget.
-  const isEmbeddedList = fieldDef.type === "embedded" && fieldDef.multiple === true;
-  // skip: list variant has a widget — not the no-widget case this guard targets.
-  if (isEmbeddedList) return;
-  // skip: already read-only by spec — no fillable widget needed regardless of type.
-  if (fieldSpec.readOnly === true) return;
-  const entityRequired = "required" in fieldDef && fieldDef.required === true;
-  const isStaticallyRequired =
-    fieldSpec.required === undefined ? entityRequired : fieldSpec.required === true;
-  // skip: not required — a read-only widget-less field is fine to leave empty.
-  if (!isStaticallyRequired) return;
-  throw new Error(
-    `[Feature ${featureName}] Screen "${screenId}" (entityEdit) field "${fieldSpec.field}" is ` +
-      `type "${fieldDef.type}", which renders read-only on the auto-wired entityEdit path — a ` +
-      `required field the user could never fill would block every save. Set required: false, ` +
-      `move the field to a custom-component section, or drop the required constraint.`,
-  );
-}
-
-export function rowFieldExtractorKeys(params: RowFieldExtractor): readonly string[] {
-  return "pick" in params ? params.pick : Object.keys(params.map);
-}
-
-// Mirrors the renderer's navigate: an explicit entityId, or a same-entity
-// entityEdit target (row["id"] auto-fill), opens UPDATE mode, which ignores params.
-export function readsNavigateParamsAsFormPrefill(
-  target: ScreenDefinition,
-  explicitEntityId: string | undefined,
-  sourceScreenEntity: string | undefined,
-): boolean {
-  if (target.type === "actionForm" || target.type === "secretMint") return true;
-  if (target.type !== "entityEdit") return false;
-  if (explicitEntityId !== undefined) return false;
-  return sourceScreenEntity === undefined || target.entity !== sourceScreenEntity;
-}
-
-// Tier 2.7e navigate rowAction → target-screen params validity. Shared by
-// entityList and projectionList (framework#1708) — projectionList has no
-// `screen.entity`, so there's no same-entity row["id"] auto-fill case: any
-// entityEdit target without an explicit entityId reaches create there.
-//
-// dashboard targets (framework#1708 follow-up, commit 4e0d6cb26) also read
-// URL search params — but only for the single `filter.id` a dashboard
-// declares (useFilterParams in dashboard-body.tsx seeds its value from
-// `nav.searchParams[filter.id]`). A dashboard with no `filter` has nowhere
-// for the value to land, and a params extractor whose keys don't include
-// the filter's id would silently miss it — both are boot errors instead of
-// a silently-empty dashboard.
-function validateRowActionNavigateParams(
-  featureName: string,
-  screenId: string,
-  screenType: "entityList" | "projectionList" | "projectionDetail" | "entityEdit",
-  screenEntity: string | undefined,
-  action: RowAction,
-  target: { readonly featureName: string; readonly screen: ScreenDefinition } | undefined,
-): void {
-  // skip: not a navigate-with-params action — nothing to validate here.
-  if (action.kind !== "navigate" || action.params === undefined) return;
-  // skip: unresolvable/custom target already reported (or exempt) elsewhere.
-  if (target === undefined || target.screen.type === "custom") return;
-  // skip: entityList/projectionList targets also read URL search params (Tier
-  // 2.7c filter-prefill, see use-list-url-state.ts: `<screenId>.q/.sort/
-  // .dir/.page/.f.<field>`), not just actionForm/entityEdit-create.
-  if (target.screen.type === "entityList" || target.screen.type === "projectionList") return;
-
-  if (target.screen.type === "dashboard") {
-    const targetDescriptor =
-      action.screen !== undefined ? `"${action.screen}"` : `entity "${action.entity}"`;
-    const filter = target.screen.filter;
-    if (filter === undefined) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) rowAction "${action.id}" sets ` +
-          `params on navigate-target ${targetDescriptor} (dashboard) — target dashboard declares no ` +
-          `filter — params would be a no-op. Remove the params extractor, or add a \`filter\` to the ` +
-          `target dashboard so it has somewhere to read the value from.`,
-      );
-    }
-    const extractedKeys = rowFieldExtractorKeys(action.params);
-    if (!extractedKeys.includes(filter.id)) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) rowAction "${action.id}" sets ` +
-          `params [${extractedKeys.join(", ")}] on navigate-target ${targetDescriptor} (dashboard) whose ` +
-          `filter id is "${filter.id}" — none of the extracted keys match, so the filter would stay ` +
-          `unset. Fix the params extractor to produce a "${filter.id}" key, or remove it.`,
-      );
-    }
-    // skip: filter present and the extractor's keys cover it — valid dashboard deep-link.
-    return;
-  }
-
-  if (!readsNavigateParamsAsFormPrefill(target.screen, action.entityId, screenEntity)) {
-    const isEntityEditUpdate = target.screen.type === "entityEdit";
-    const reason = isEntityEditUpdate
-      ? `resolves to UPDATE mode (${
-          action.entityId !== undefined
-            ? `explicit entityId "${action.entityId}"`
-            : `same entity "${screenEntity}" auto-fills row["id"]`
-        })`
-      : `screen type "${target.screen.type}"`;
-    const targetDescriptor =
-      action.screen !== undefined ? `"${action.screen}"` : `entity "${action.entity}"`;
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) rowAction "${action.id}" ` +
-        `sets params on navigate-target ${targetDescriptor} which ${reason} — only actionForm, ` +
-        `secretMint and entityEdit-create targets read URL search params as initial values. Remove ` +
-        `the params extractor or retarget to an actionForm / secretMint / cross-entity ` +
-        `entityEdit-create screen.`,
-    );
-  }
-}
-
-// Shared by projectionDetail and entityEdit: a tab strip needs something to
-// label each tab with and a stable id per tab — the id anchors the ?tab=
-// param on projectionDetail and the jump-to-erroring-tab logic on entityEdit
-// (fw#3134).
-function validateTabSections(
-  featureName: string,
-  screenId: string,
-  screenType: "projectionDetail" | "entityEdit",
-  sections: readonly { readonly id?: string; readonly title?: string }[],
-): void {
-  if (sections.length < 2) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "tabs" but only ` +
-        `${sections.length} section(s) — tabs need at least 2 sections.`,
-    );
-  }
-  const tabIds = new Set<string>();
-  sections.forEach((section, index) => {
-    if (section.title === undefined || section.title.trim().length === 0) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "tabs" but ` +
-          `sections[${index}] has no title — every tab needs a title.`,
-      );
-    }
-    if (section.id === undefined || section.id.trim().length === 0) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "tabs" but ` +
-          `sections[${index}] ("${section.title}") has no id — every tab needs a stable id.`,
-      );
-    }
-    if (!isKebabSegment(section.id)) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) sections[${index}] ` +
-          `("${section.title}") has id "${section.id}" — must be kebab-case.`,
-      );
-    }
-    if (tabIds.has(section.id)) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has duplicate tab id ` +
-          `"${section.id}" (sections[${index}]).`,
-      );
-    }
-    tabIds.add(section.id);
-  });
-}
-
-// Wizard layouts (mode: "wizard") need >= 2 titled sections — a single or
-// untitled step would leave the progress indicator blank, so both fail at
-// boot rather than as a broken step UI.
-function validateWizardLayout(
-  featureName: string,
-  screenId: string,
-  screenType: "entityEdit" | "actionForm" | "configEdit" | "secretMint",
-  layout: EditLayout,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  // entityEdit renders tabs like wizard steps: every section stays mounted,
-  // submit validates across all of them, and a field error jumps to the tab
-  // holding it (fw#3134). The other three have no such jump — actionForm and
-  // secretMint are one-shot forms, configEdit fires a write per field — so a
-  // required field on a hidden tab would still block their submit silently.
-  if (layout.mode === "tabs") {
-    if (screenType !== "entityEdit") {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets mode: "tabs" — tabs are only ` +
-          `supported on projectionDetail and entityEdit. Use mode: "wizard" or "single" instead.`,
-      );
-    }
-    validateTabSections(featureName, screenId, screenType, layout.sections);
-  }
-  // "form-draft" is hardcoded because the framework layer must not depend on
-  // @cosmicdrift/kumiko-bundled-features — same precedence as the
-  // "user-data-rights" check in gdpr-storage.ts.
-  if (layout.draft === true) {
-    if (layout.mode !== "wizard") {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets draft: true but ` +
-          `mode is not "wizard" — draft persistence only applies to wizard layouts. Remove ` +
-          `draft: true or set mode: "wizard".`,
-      );
-    }
-    if (!featureMap.has("form-draft")) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets draft: true but the ` +
-          `bundled feature "form-draft" is not mounted — every resume would silently lose its ` +
-          `values. Add formDraftFeature() from @cosmicdrift/kumiko-bundled-features to the app's ` +
-          `feature list.`,
-      );
-    }
-  }
-  // skip: mode omitted/"single" — no wizard constraints apply.
-  if (layout.mode !== "wizard") return;
-  if (layout.sections.length < 2) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "wizard" but only ` +
-        `${layout.sections.length} section(s) — a wizard needs at least 2 sections (one per step).`,
-    );
-  }
-  layout.sections.forEach((section, index) => {
-    if (section.title === undefined || section.title.trim().length === 0) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "wizard" but ` +
-          `sections[${index}] has no title — every wizard step needs a title.`,
-      );
-    }
-  });
-}
-
-// --- Screen validation ---
-//
-// For every r.screen() declaration check what's locally knowable at boot:
-//   - entityList / entityEdit: the referenced entity must exist in the
-//     feature (cross-feature entity-refs aren't allowed — a feature owns
-//     the screens over its own entities) and every column/field ref must
-//     name a real field on that entity
-//   - custom: the renderer must at least have one platform component set
-//     (react OR native), otherwise the screen is structurally empty
-//
-// Field-level renderer QN strings (cross-feature `component:` references)
-// are NOT validated here — the r.uiComponent registry that would resolve
-// them ships in M4/M5. Until then those are kept opaque on purpose.
-
-// every action rendered in a Card title row (screen-level
-// `actions`, section-level `actions`, `emptyState.action`) must draw an
-// icon — declared or id-derived (resolveActionIcon, same resolver the
-// renderer uses). Uncovered here: entityList/projectionList rowActions —
-// those render inside a DataTable row, not a Card title row, so they keep
-// today's "icon optional" behavior.
-//
-// Registration check (not just "resolved is not undefined"): action.icon is
-// typed IconKey, a closed union — but that only protects call sites this
-// repo's own `tsc --build` actually covers (samples and external consumers
-// aren't in that project graph). The renderer's actionIconFor
-// (renderer-web/src/primitives/index.tsx) already falls back to "no icon"
-// for an unregistered key instead of crashing — this check makes the same
-// gap fail loudly at boot instead of silently at render.
-function isRegisteredIcon(icon: IconKey): boolean {
-  return (NAV_ICON_KEYS as readonly string[]).includes(icon);
-}
-
-export function validateActionHasIcon(
-  featureName: string,
-  screenId: string,
-  screenType: "projectionDetail" | "entityEdit",
-  context: string,
-  action: { readonly id: string; readonly icon?: IconKey },
-): void {
-  const resolved = resolveActionIcon(action.id, action.icon);
-  if (resolved === undefined || !isRegisteredIcon(resolved)) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${context} "${action.id}" has no ` +
-        `resolvable icon — set icon to a key registered in NAV_ICONS, or use an id that resolves one of ` +
-        `its kebab segments via the default icon map (resolveActionIcon).`,
-    );
-  }
-}
-
-// Tier 2.7e-3: deklarative Feld-Referenzen einer Action gegen die Entity-
-// Felder pinnen — ein Tippfehler in pick/map-Quellfeldern oder
-// visible.field erzeugte sonst still `undefined` im Payload bzw. dauerhaft
-// falsche Sichtbarkeit (gleiche "Typo fällt erst beim Klick"-Klasse wie
-// navigate/handler). Exported for query-output-columns.ts, which reuses it
-// against a projectionDetail's outputSchema-derived record shape instead of
-// an entity's field map (relatedList toolbarActions' visible/params).
-export function validateActionFieldRefs(
-  featureName: string,
-  screenId: string,
-  actionKind: "rowAction" | "toolbarAction",
-  actionId: string,
-  action: RowAction | ToolbarAction | RelatedListToolbarAction,
-  fieldNames: ReadonlySet<string>,
-  rowMeta: ReadonlySet<string>,
-): void {
-  // ToolbarAction.payload ist ein STATISCHER Record (kein Row-Context) —
-  // nur echte pick/map-Extractoren werden gegen die Feldnamen geprüft.
-  const isExtractor = (v: unknown): v is RowFieldExtractor =>
-    typeof v === "object" && v !== null && ("pick" in v || "map" in v);
-  const payload = "payload" in action && isExtractor(action.payload) ? action.payload : undefined;
-  const params = "params" in action && isExtractor(action.params) ? action.params : undefined;
-  const visible: FieldCondition | undefined = "visible" in action ? action.visible : undefined;
-  const entityId: string | undefined = "entityId" in action ? action.entityId : undefined;
-  const known = () => [...fieldNames].sort().join(", ") || "(none)";
-  const checkExtractor = (label: string, extractor: RowFieldExtractor | undefined): void => {
-    // skip: extractor ist ein optionaler Action-Slot — ohne ihn gibt es
-    // keine Feld-Referenzen zu validieren.
-    if (extractor === undefined) {
-      return;
-    }
-    const sources = "pick" in extractor ? extractor.pick : Object.values(extractor.map);
-    for (const source of sources) {
-      if (rowMeta.has(source)) continue;
-      if (!fieldNames.has(source)) {
-        throw new Error(
-          `[Feature ${featureName}] Screen "${screenId}" ${actionKind} "${actionId}" ` +
-            `${label} references unknown field "${source}". Known fields: ${known()}.`,
-        );
-      }
-    }
-  };
-  checkExtractor("payload", payload);
-  checkExtractor("params", params);
-  if (
-    visible !== undefined &&
-    typeof visible !== "boolean" &&
-    !rowMeta.has(visible.field) &&
-    !fieldNames.has(visible.field)
-  ) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" ${actionKind} "${actionId}" ` +
-        `visible.field references unknown field "${visible.field}". Known fields: ${known()}.`,
-    );
-  }
-  if (entityId !== undefined && entityId !== "id" && !fieldNames.has(entityId)) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" ${actionKind} "${actionId}" ` +
-        `entityId references unknown field "${entityId}". Known fields: ${known()}.`,
-    );
-  }
-}
-
-// Two features registering the same short screen-id is a silent routing
-// footgun: create-app.tsx's runtime router resolves a bare navigate-target
-// id by scanning features[] and taking the first match — the collision
-// never surfaces as an error, the second feature's screen is just
-// unreachable by that id (and always the same one that loses, in whatever
-// order the app composed its features).
-export function validateScreenShortIdCollisions(
-  screensByShortId: ReadonlyMap<
-    string,
-    ReadonlyArray<{ readonly featureName: string; readonly screen: ScreenDefinition }>
-  >,
-): void {
-  for (const [shortId, entries] of screensByShortId) {
-    const featureNames = new Set(entries.map((e) => e.featureName));
-    if (featureNames.size > 1) {
-      throw new Error(
-        `Screen short-id "${shortId}" is registered by ${featureNames.size} features ` +
-          `(${[...featureNames].join(", ")}) — the runtime router resolves a bare navigate-target ` +
-          `id by taking the first match, so all but one of these screens would be unreachable by ` +
-          `that id. Give each screen a distinct id.`,
-      );
-    }
-  }
-}
-
-// redirect/cancelTarget accept either a same-feature short id (unchanged
-// behavior, qualified against the owning feature) or a fully-qualified
-// cross-feature screen QN (`<feature>:screen:<id>`) given verbatim — a
-// short id can never itself be a valid QN (QN_SEGMENT forbids colons), so
-// the two forms don't collide.
-export function resolveScreenTargetQn(featureName: string, target: string): string {
-  return isValidQn(target) ? target : qualifyEntityName(featureName, "screen", target);
-}
-
-function validateScreenNavTarget(
-  featureName: string,
-  screenId: string,
-  screenKind: string,
-  fieldName: string,
-  value: string,
-  allScreenQns: ReadonlySet<string>,
-  screens: FeatureDefinition["screens"],
-): void {
-  const candidateQn = resolveScreenTargetQn(featureName, value);
-  if (!allScreenQns.has(candidateQn)) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${fieldName} "${value}" ` +
-        `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
-        `in this feature: ${[...Object.keys(screens)].sort().join(", ") || "(none)"}.`,
-    );
-  }
-}
-
-// kind:"drawer" resolves same-feature only — unlike navigate/redirect,
-// which the runtime router resolves app-wide (see the comment on
-// validateScreens below), the drawer mounts the target inline using this
-// feature's schema, so a cross-feature reference could never actually
-// render. Two distinct failure messages: dangling reference vs. wrong
-// screen type. Shared by ToolbarAction (fw#2225) and RowAction (fw#2710)
-// drawer variants — same target-resolution rule, only the label in the
-// error message ("toolbarAction" vs. "rowAction" vs. "action") differs.
-function validateDrawerTargetAction(
-  featureName: string,
-  screenId: string,
-  screenKind: string,
-  actionLabel: "toolbarAction" | "rowAction" | "action",
-  action: {
-    readonly id: string;
-    readonly screen: string;
-    readonly params?: RowFieldExtractor;
-  },
-  screens: FeatureDefinition["screens"],
-): void {
-  const target = screens[action.screen];
-  if (target === undefined) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-        `drawer-target "${action.screen}" does not resolve to a registered screen in this feature. ` +
-        `kind:"drawer" only resolves same-feature screens (unlike kind:"navigate", which can target ` +
-        `screens in any feature) — the drawer mounts the target inline using this feature's schema. ` +
-        `Known screens in this feature: ${[...Object.keys(screens)].sort().join(", ") || "(none)"}.`,
-    );
-  }
-  // secretMint is intentionally excluded — a one-time secret reveal belongs on
-  // its own page, not layered in a Drawer above a list.
-  if (target.type !== "actionForm") {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-        `drawer-target "${action.screen}" is a "${target.type}" screen, not an actionForm. ` +
-        `kind:"drawer" mounts an actionForm inside a Drawer widget — point "screen" at an ` +
-        `actionForm screen, or use kind:"navigate" for a full-page target.`,
-    );
-  }
-  // A prefill key the target form doesn't declare is dropped silently by the
-  // renderer (mergeSearchParamsIntoInitial iterates the target's fields), so
-  // the typo would only show up as an empty field at click time.
-  // skip: no params extractor — nothing to check against the target's fields.
-  if (action.params === undefined) return;
-  for (const fieldName of rowFieldExtractorKeys(action.params)) {
-    if (Object.hasOwn(target.fields, fieldName)) continue;
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-        `params prefills "${fieldName}", which drawer-target "${action.screen}" does not declare as a ` +
-        `field — the renderer would drop it and leave the form empty. Target fields: ` +
-        `${Object.keys(target.fields).sort().join(", ") || "(none)"}.`,
-    );
-  }
-}
-
-// fw#2228: a navigate rowAction (or projectionDetail header action, which
-// reuses the same RowActionNavigate shape) names its target as either a
-// screen (existing) or an entity (new) — exactly one. Shared by all three
-// call sites so the mutual-exclusivity check and the entity→detailFor
-// resolution don't drift between them (same drift risk
-// validateRowActionNavigateParams above is already shared to avoid).
-// Runtime-loose shape: boot still rejects both/neither for untyped schemas;
-// authors get the exclusive union via RowActionNavigate (#2303).
-type RowActionNavigateRuntime = RowActionNavigateBase & {
-  readonly screen?: string;
-  readonly entity?: string;
-};
-
-// The target can be any screen, so this checks the resolved target's
-// sections, not the host's.
-function validateRowActionNavigateTab(
-  featureName: string,
-  screenId: string,
-  screenType: "entityList" | "projectionList" | "projectionDetail" | "entityEdit",
-  actionLabel: string,
-  action: RowActionNavigateRuntime,
-  target: { readonly featureName: string; readonly screen: ScreenDefinition } | undefined,
-): void {
-  // skip: no tab declared — nothing to check against the target's sections
-  if (action.tab === undefined) return;
-  if (target === undefined) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-        `sets tab "${action.tab}", but its navigate-target could not be resolved to a screen.`,
-    );
-  }
-  if (target.screen.type !== "projectionDetail" || target.screen.layout.mode !== "tabs") {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-        `sets tab "${action.tab}", but navigate-target screen "${target.screen.id}" is not a ` +
-        `projectionDetail with layout.mode "tabs" — only those read the tab param.`,
-    );
-  }
-  const sectionIds = target.screen.layout.sections
-    .map((section) => section.id)
-    .filter((id): id is string => id !== undefined);
-  if (!sectionIds.includes(action.tab)) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-        `navigates to tab "${action.tab}", which is not a section id on target screen ` +
-        `"${target.screen.id}". Available: ${sectionIds.join(", ") || "(none)"}.`,
-    );
-  }
-}
-
-function resolveRowActionNavigateTarget(
-  featureName: string,
-  screenId: string,
-  screenType: "entityList" | "projectionList" | "projectionDetail" | "entityEdit",
-  actionLabel: string,
-  action: RowActionNavigateRuntime,
-  allScreenQns: ReadonlySet<string>,
-  navTargetShortIds: ReadonlySet<string>,
-  screensByShortId: ReadonlyMap<
-    string,
-    ReadonlyArray<{ readonly featureName: string; readonly screen: ScreenDefinition }>
-  >,
-  detailForScreens: ReadonlyMap<
-    string,
-    { readonly featureName: string; readonly screen: ScreenDefinition }
-  >,
-): { readonly featureName: string; readonly screen: ScreenDefinition } | undefined {
-  if (action.entity !== undefined) {
-    if (action.screen !== undefined) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-          `sets both "screen" and "entity" — exactly one navigate-target form is allowed.`,
-      );
-    }
-    if (screenType !== "entityList" && action.entityId === undefined) {
-      // entityList rows are always a real entity record, so row["id"] is a
-      // safe implicit default. projectionList/projectionDetail rows come from
-      // an arbitrary query projection with no guaranteed "id" field — an
-      // entity-target there needs an explicit entityId, or navigation silently
-      // opens the detail screen with no entity context at runtime.
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-          `navigate-target entity "${action.entity}" needs an explicit "entityId" — ${screenType} rows ` +
-          `come from a query projection with no guaranteed "id" field.`,
-      );
-    }
-    const detail = detailForScreens.get(action.entity);
-    if (detail === undefined) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-          `navigate-target entity "${action.entity}" has no screen declaring ` +
-          `detailFor: "${action.entity}".`,
-      );
-    }
-    validateRowActionNavigateTab(featureName, screenId, screenType, actionLabel, action, detail);
-    return detail;
-  }
-  if (action.screen === undefined) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-        `sets neither "screen" nor "entity" — exactly one navigate-target form is required.`,
-    );
-  }
-  const candidateQn = qualifyEntityName(featureName, "screen", action.screen);
-  if (!allScreenQns.has(candidateQn) && !navTargetShortIds.has(action.screen)) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-        `navigate-target "${action.screen}" does not resolve to a registered screen in any feature.`,
-    );
-  }
-  const target = screensByShortId.get(action.screen)?.[0];
-  validateRowActionNavigateTab(featureName, screenId, screenType, actionLabel, action, target);
-  return target;
-}
-
-// Shared by the mint step's own handler (screen.handler) and its optional
-// confirm step (confirm.handler) — both are a bare write-handler QN with the
-// same registration requirement.
-function validateWriteHandlerRegistered(
-  featureName: string,
-  screenId: string,
-  context: string,
-  handler: unknown,
-  allWriteHandlerQns: ReadonlySet<string>,
-): void {
-  if (!handler || typeof handler !== "string") {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${context}) has empty or non-string handler.`,
-    );
-  }
-  if (!allWriteHandlerQns.has(handler)) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${context}) handler "${handler}" ` +
-        `is not a registered write-handler. Check the QN spelling (expected ` +
-        `"<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`,
-    );
-  }
-}
-
-// Every field entry must carry a `type` discriminator. An author typo
-// (`title: { required: true }` without a type) would otherwise let
-// RenderField silently fall through to the default renderer and submit an
-// empty string — failing at boot is clearer. `type as unknown` because
-// FieldDefinition, as a union, only allows known type strings; here we're
-// checking author code that may have circumvented the type check.
-//
-// Parametrized over (fields, layout) instead of a whole screen so a
-// secretMint's own `confirm` step — a second, independent inline form on the
-// same screen — can reuse the same checks as its `fields`/`layout` pair.
-// `allowEmpty` is only ever true for a secretMint's own mint step (an
-// input-less mint, fw#2838): the secret is server-generated and the mint
-// step is just its submit button — actionForm and the confirm step always
-// require at least one field.
-function validateFormFieldsMap(
-  featureName: string,
-  screenId: string,
-  context: string,
-  fields: Readonly<Record<string, FieldDefinition>>,
-  allowEmpty: boolean,
-): Set<string> {
-  const fieldNames = new Set(Object.keys(fields));
-  if (fieldNames.size === 0 && !allowEmpty) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${context}) has empty fields map — ` +
-        `declare at least one field.`,
-    );
-  }
-  for (const [fname, fdef] of Object.entries(fields)) {
-    // @cast-boundary schema-walk — feature-config inspection (Author may circumvent type-check)
-    const ftype = (fdef as { type?: unknown }).type;
-    if (typeof ftype !== "string" || ftype.length === 0) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${context}) field "${fname}" has no ` +
-          `\`type\` set. Each field must declare a type (e.g. "text", "number", "select").`,
-      );
-    }
-    if (ftype === "money") {
-      validateFormMoneyCurrency(featureName, screenId, context, fname, fdef);
-    }
-  }
-  return fieldNames;
-}
-
-// Fail-closed currency-source gate (fw#2839), the runtime half of the
-// narrowed `FormFieldDefinition` — an untyped JS consumer has no compiler to
-// stop it. An inline form screen has no entity, so a money field there can't
-// borrow `entity.defaultCurrency`: without a declared source the renderer
-// seeds a bare `0` and the handler's zod schema rejects the submit. Entity
-// money fields are exempt — create-app already refuses an entity that holds
-// money without a `defaultCurrency`.
-function validateFormMoneyCurrency(
-  featureName: string,
-  screenId: string,
-  context: string,
-  fieldName: string,
-  fdef: unknown,
-): void {
-  const where = `[Feature ${featureName}] Screen "${screenId}" (${context}) money field "${fieldName}"`;
-  const validForms =
-    `Declare \`currency: { kind: "literal", code: "EUR" }\` for a fixed currency, or ` +
-    `\`currency: { kind: "tenant" }\` to take the tenant-settings bundle's per-tenant currency.`;
-  // @cast-boundary schema-walk — feature-config inspection (Author may circumvent type-check)
-  const currency = (fdef as { currency?: { kind?: unknown; code?: unknown } | null }).currency;
-  if (currency === undefined) {
-    throw new Error(
-      `${where} must declare where its currency comes from — this screen has no entity whose ` +
-        `\`defaultCurrency\` it could inherit, so the form would seed a bare \`0\` that the ` +
-        `handler's schema rejects. ${validForms}`,
-    );
-  }
-  if (typeof currency !== "object" || currency === null) {
-    throw new Error(`${where} has a non-object \`currency\`. ${validForms}`);
-  }
-  const kind = currency.kind;
-  if (kind === "literal") {
-    const code = currency.code;
-    if (typeof code !== "string" || code.trim() === "") {
-      throw new Error(
-        `${where} declares \`currency: { kind: "literal" }\` with an empty or non-string \`code\`. ` +
-          `Pass the ISO code, e.g. { kind: "literal", code: "EUR" }.`,
-      );
-    }
-  } else if (kind !== "tenant") {
-    throw new Error(
-      `${where} declares an unknown currency kind ${JSON.stringify(kind)}. ${validForms}`,
-    );
-  }
-}
-
-// `allowEmptySections` mirrors `validateFormFieldsMap`'s `allowEmpty` — the
-// caller only ever passes true together with an actually-empty fields map
-// (an input-less secretMint declares BOTH `fields: {}` and
-// `layout.sections: []`; fields declared with no layout to show them stays
-// an error).
-// `fields`/`groups` are mutually exclusive on a fields-kind section; shared by
-// every EditLayout-walking screen type instead of four hand-rolled copies.
-function validateFieldsXorGroups(
-  errorPrefix: string,
-  section: { readonly title?: string; readonly fields: readonly EditFieldSpec[] } & {
-    readonly groups?: readonly { readonly fields: readonly EditFieldSpec[] }[];
-  },
-): void {
-  if (section.fields.length > 0 && section.groups !== undefined) {
-    throw new Error(
-      `${errorPrefix} section "${section.title}" declares both fields and groups — pass fields: [] ` +
-        `when using groups.`,
-    );
-  }
-  if (section.fields.length === 0 && section.groups === undefined) {
-    throw new Error(
-      `${errorPrefix} has a section "${section.title}" with zero fields — drop the section or add ` +
-        `fields (or groups) to it.`,
-    );
-  }
-}
-
-function validateFormLayoutSections(
-  featureName: string,
-  screenId: string,
-  context: string,
-  layout: EditLayout,
-  fieldNames: ReadonlySet<string>,
-  allowEmptySections: boolean,
-): void {
-  if (layout.sections.length === 0) {
-    // skip: an input-less secretMint declares fields: {} and sections: [] together — no sections to validate.
-    if (allowEmptySections) return;
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (${context}) has an empty sections list — ` +
-        `declare at least one section.`,
-    );
-  }
-  for (const section of layout.sections) {
-    if (isExtensionEditSection(section)) {
-      if (section.component?.react === undefined && section.component?.native === undefined) {
-        throw new Error(
-          `[Feature ${featureName}] Screen "${screenId}" (${context}) extension section ` +
-            `"${section.title}" has no component — declare a react/native component marker.`,
-        );
-      }
-      continue;
-    }
-    if (section.kind === "relatedList") {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${context}) relatedList section ` +
-          `"${section.title}" is not supported — relatedList is a projectionDetail-only ` +
-          `primitive (fw#2166).`,
-      );
-    }
-    if (isWriteFormEditSection(section)) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (${context}) writeForm section ` +
-          `"${section.title}" is not supported — writeForm is a projectionDetail-only primitive.`,
-      );
-    }
-    validateFieldsXorGroups(`[Feature ${featureName}] Screen "${screenId}" (${context})`, section);
-    for (const fieldSpec of sectionFieldSpecs(section)) {
-      const normalized = normalizeEditField(fieldSpec);
-      if (!fieldNames.has(normalized.field)) {
-        throw new Error(
-          `[Feature ${featureName}] Screen "${screenId}" (${context}) layout references unknown field ` +
-            `"${normalized.field}". Known fields: ${[...fieldNames].sort().join(", ")}`,
-        );
-      }
-    }
-  }
-}
-
-// redirect is either a short screen id (same-feature, e.g. "item-list") or
-// a fully-qualified cross-feature QN (`<feature>:screen:<id>`) — the
-// renderer strips the latter to the short id (lastSegment) when
-// navigating, which the nav-router resolves app-wide (#1946). The object
-// form (fw#2670) carries the same target under `screen` plus the payload
-// field `idFrom`. Shared by actionForm/secretMint (validateInlineFormNavTargets)
-// and entityEdit — same rule, same error message, one place to keep them in sync.
-function validateRedirectTarget(
-  feature: FeatureDefinition,
-  screenId: string,
-  screenKind: "actionForm" | "secretMint" | "entityEdit",
-  redirect: string | ActionFormRedirect,
-  allScreenQns: ReadonlySet<string>,
-): void {
-  const redirectTarget = typeof redirect === "string" ? redirect : redirect.screen;
-  if (
-    typeof redirect !== "string" &&
-    (typeof redirect.idFrom !== "string" || redirect.idFrom.trim() === "")
-  ) {
-    throw new Error(
-      `[Feature ${feature.name}] Screen "${screenId}" (${screenKind}) redirect.idFrom is empty or not a string — ` +
-        `name the success-payload field carrying the navigation id, or use the plain string ` +
-        `redirect form to navigate with the handler's own "id".`,
-    );
-  }
-  validateScreenNavTarget(
-    feature.name,
-    screenId,
-    screenKind,
-    "redirect",
-    redirectTarget,
-    allScreenQns,
-    feature.screens,
-  );
-}
-
-function validateInlineFormNavTargets(
-  feature: FeatureDefinition,
-  screenId: string,
-  screen: ActionFormScreenDefinition | SecretMintScreenDefinition,
-  kind: "actionForm" | "secretMint",
-  allScreenQns: ReadonlySet<string>,
-): void {
-  if (screen.redirect !== undefined) {
-    validateRedirectTarget(feature, screenId, kind, screen.redirect, allScreenQns);
-  }
-  if (typeof screen.cancelTarget === "string") {
-    // Same rule as redirect — `false` (no Cancel button) needs no validation.
-    validateScreenNavTarget(
-      feature.name,
-      screenId,
-      kind,
-      "cancelTarget",
-      screen.cancelTarget,
-      allScreenQns,
-      feature.screens,
-    );
-  }
-}
-
-// actionForm/secretMint have no entity link, only a write-handler QN +
-// inline fields: checks handler registration, field types, layout refs, and nav targets.
-function validateInlineFormScreen(
-  feature: FeatureDefinition,
-  screenId: string,
-  screen: ActionFormScreenDefinition | SecretMintScreenDefinition,
-  kind: "actionForm" | "secretMint",
-  allWriteHandlerQns: ReadonlySet<string>,
-  allScreenQns: ReadonlySet<string>,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  validateWriteHandlerRegistered(feature.name, screenId, kind, screen.handler, allWriteHandlerQns);
-  // Only a secretMint's own mint step may skip fields/sections entirely
-  // (input-less mint, fw#2838) — actionForm always needs at least one field.
-  const allowEmptyMintForm = kind === "secretMint";
-  const fieldNames = validateFormFieldsMap(
-    feature.name,
-    screenId,
-    kind,
-    screen.fields,
-    allowEmptyMintForm,
-  );
-  validateFormLayoutSections(
-    feature.name,
-    screenId,
-    kind,
-    screen.layout,
-    fieldNames,
-    allowEmptyMintForm && fieldNames.size === 0,
-  );
-  validateWizardLayout(feature.name, screenId, kind, screen.layout, featureMap);
-  validateInlineFormNavTargets(feature, screenId, screen, kind, allScreenQns);
-}
-
-// SecretMintConfirmStep (fw#2838): an optional proof-of-receipt form rendered
-// on the reveal card in place of the bare acknowledge button (TOTP enrollment:
-// scan the code, then enter one). Unlike the mint step, confirm always needs
-// at least one field — a step whose only job is proving receipt with no input
-// would be meaningless — and its layout is a single plain form, never a
-// wizard/tabs flow and never a persisted draft: a one-time reveal-confirm is
-// not a multi-step flow, and persisting a draft of it would re-open the leak
-// fw#2548 closed (a lingering copy of the just-revealed secret in storage).
-function validateSecretMintConfirm(
-  feature: FeatureDefinition,
-  screenId: string,
-  screen: SecretMintScreenDefinition,
-  allWriteHandlerQns: ReadonlySet<string>,
-): void {
-  const confirm = screen.confirm;
-  // skip: the screen declares no confirm step — nothing to validate.
-  if (confirm === undefined) return;
-  const context = "secretMint confirm";
-  validateWriteHandlerRegistered(
-    feature.name,
-    screenId,
-    context,
-    confirm.handler,
-    allWriteHandlerQns,
-  );
-  const fieldNames = validateFormFieldsMap(feature.name, screenId, context, confirm.fields, false);
-  validateFormLayoutSections(feature.name, screenId, context, confirm.layout, fieldNames, false);
-  if (confirm.layout.mode !== undefined && confirm.layout.mode !== "single") {
-    throw new Error(
-      `[Feature ${feature.name}] Screen "${screenId}" (${context}) sets layout.mode: ` +
-        `"${confirm.layout.mode}" — a one-time reveal confirm step must stay a single-step form. ` +
-        `Remove mode or set it to "single".`,
-    );
-  }
-  if (confirm.layout.draft === true) {
-    throw new Error(
-      `[Feature ${feature.name}] Screen "${screenId}" (${context}) sets layout.draft: true — ` +
-        `persisting a draft of the reveal-confirm step would leak the one-time secret into storage, ` +
-        `the exact leak fw#2548 closed. Remove draft: true.`,
-    );
-  }
-  // skip: no carry list declared — no carried fields to cross-check against confirm.fields.
-  if (confirm.carry === undefined) return;
-  for (const carryField of confirm.carry) {
-    if (typeof carryField !== "string" || carryField.trim() === "") {
-      throw new Error(
-        `[Feature ${feature.name}] Screen "${screenId}" (${context}) has an empty or non-string ` +
-          `entry in "carry".`,
-      );
-    }
-    if (fieldNames.has(carryField)) {
-      throw new Error(
-        `[Feature ${feature.name}] Screen "${screenId}" (${context}) carry field "${carryField}" ` +
-          `also names a confirm.fields entry — a carried mint-payload value would silently ` +
-          `overwrite the user-entered field of the same name. Rename one of them.`,
-      );
-    }
-  }
-}
-
-// nav.screen is a full QN (cross-feature), so a standalone r.nav() pointing
-// at `targetQn` must be found by scanning every feature's nav entries and actions.
-function hasStandaloneNavEntry(
-  targetQn: string,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): boolean {
-  for (const f of featureMap.values()) {
-    for (const nav of Object.values(f.navs)) {
-      if (nav.screen === targetQn) return true;
-      if (nav.createAction?.screen === targetQn) return true;
-      if (nav.actions?.some((a) => a.screen === targetQn)) return true;
-    }
-  }
-  return false;
-}
-
-// Every screen must resolve nav via `nav`, `r.nav()`, a parent list, or
-// `dormant: true`. Skipped when the composed set has no nav entries at all.
-function validateScreenHasNavArea(
-  feature: FeatureDefinition,
-  screenId: string,
-  screen: ScreenDefinition,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  // skip: the screen already declares its own nav entry.
-  if (screen.nav !== undefined) return;
-  // skip: explicitly opted out via `dormant: true`.
-  if (screen.dormant === true) return;
-  const anyNavRegistered = [...featureMap.values()].some((f) => Object.keys(f.navs).length > 0);
-  // skip: no nav entries exist anywhere in the composed set — a feature/
-  // recipe/test fixture booted without an app shell, not an omission.
-  if (!anyNavRegistered) return;
-  const targetQn = qualifyEntityName(feature.name, "screen", screenId);
-  // skip: a standalone r.nav() elsewhere already points at this screen.
-  if (hasStandaloneNavEntry(targetQn, featureMap)) return;
-  const allScreens = [...featureMap.values()].flatMap((f) => Object.values(f.screens));
-  // skip: resolves to a parent list via listScreenId/rowAction-target/same-entity.
-  if (resolveNavParentScreen(allScreens, screen, (s) => s.id) !== undefined) return;
-  throw new Error(
-    `[Feature ${feature.name}] Screen "${targetQn}" has no nav entry and no resolvable list — ` +
-      `declare listScreenId (or a rowAction/toolbarAction navigate target from a list screen), add ` +
-      `a standalone r.nav() pointing at it, or set dormant: true if it's intentionally reachable ` +
-      `only via a direct link/redirect or a consuming app's own r.nav().`,
-  );
-}
-
-export function validateScreens(
-  feature: FeatureDefinition,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-  allWriteHandlerQns: ReadonlySet<string>,
-  allScreenQns: ReadonlySet<string>,
-  allConfigKeyQns: ReadonlySet<string>,
-  screensByShortId: ReadonlyMap<
-    string,
-    ReadonlyArray<{ readonly featureName: string; readonly screen: ScreenDefinition }>
-  >,
-  detailForScreens: ReadonlyMap<
-    string,
-    { readonly featureName: string; readonly screen: ScreenDefinition }
-  >,
-): void {
-  // navigate-Targets (rowAction/toolbarAction) dürfen cross-feature zeigen —
-  // der Runtime-Router (create-app) löst eine bare screenId app-weit über ALLE
-  // Features auf (eine deklarative Liste im owning-Feature der Entity navigiert
-  // so zu den Custom-Editoren der Consumer-App). Der Validator spiegelt das:
-  // same-feature ODER irgendein Feature. redirect/cancelTarget akzeptieren
-  // zusätzlich eine voll-qualifizierte Cross-Feature-QN (resolveScreenTargetQn,
-  // #1946) — kurze IDs bleiben same-feature wie zuvor.
-  const navTargetShortIds = screenShortIdsFrom(allScreenQns);
-  for (const [screenId, screen] of Object.entries(feature.screens)) {
-    validateScreenHasNavArea(feature, screenId, screen, featureMap);
-    if (screen.type === "custom") {
-      if (!screen.renderer.react && !screen.renderer.native) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" has type="custom" but the renderer ` +
-            `declares neither a react nor a native component — at least one platform must be set.`,
-        );
-      }
-      continue;
-    }
-
-    if (screen.type === "projectionList") {
-      // Query-getrieben, keine Entity → nur query + columns prüfen (die
-      // Column-Felder können nicht gegen eine Entity gecheckt werden; sie
-      // werden zur Render-Zeit gegen die Projection-Rows aufgelöst).
-      if (!screen.query || typeof screen.query !== "string") {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionList) has empty or non-string query.`,
-        );
-      }
-      if (screen.columns.length === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionList) has an empty columns list — ` +
-            `declare at least one column.`,
-        );
-      }
-      for (const col of screen.columns) {
-        const normalizedCol = normalizeListColumn(col);
-        validateColumnRendererForm(feature.name, screenId, normalizedCol);
-        if (normalizedCol.refEntity !== undefined) {
-          assertRefTargetRegistered(
-            `[Feature ${feature.name}] Screen "${screenId}" (projectionList)`,
-            `column "${normalizedCol.field}" (refEntity)`,
-            normalizedCol.refEntity,
-            feature.name,
-            featureMap,
-          );
-        }
-      }
-      // Screen filter (fw#2224) — field existence can't be checked without
-      // an entity (columns aren't a complete field inventory of the
-      // underlying query), so only pin the structure: "in" requires an
-      // array. Field validity is documented in the PR body.
-      if (
-        screen.filter !== undefined &&
-        screen.filter.op === "in" &&
-        !Array.isArray(screen.filter.value)
-      ) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionList) filter.op "in" requires ` +
-            `filter.value to be a readonly array.`,
-        );
-      }
-      if (screen.facets !== undefined) {
-        validateListFacets(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionList)`,
-          screen.facets,
-          screen.columns,
-          feature.name,
-          featureMap,
-        );
-      }
-      if (screen.rowActions !== undefined) {
-        for (const action of screen.rowActions) {
-          if (action.kind === "navigate") {
-            const target = resolveRowActionNavigateTarget(
-              feature.name,
-              screenId,
-              "projectionList",
-              "rowAction",
-              action,
-              allScreenQns,
-              navTargetShortIds,
-              screensByShortId,
-              detailForScreens,
-            );
-            validateRowActionNavigateParams(
-              feature.name,
-              screenId,
-              "projectionList",
-              undefined,
-              action,
-              target,
-            );
-          } else if (action.kind === "drawer") {
-            validateDrawerTargetAction(
-              feature.name,
-              screenId,
-              "projectionList",
-              "rowAction",
-              action,
-              feature.screens,
-            );
-          }
-        }
-        validateAtMostOneRowClick(feature.name, screenId, "projectionList", screen.rowActions);
-      }
-      // Only drawer-kind and navigate actions that set tab are validated
-      // here — plain navigate (no tab) and writeHandler toolbarActions on
-      // projectionList have no boot check yet (pre-existing gap).
-      if (screen.toolbarActions !== undefined) {
-        for (const action of screen.toolbarActions) {
-          if (action.kind === "drawer") {
-            validateDrawerTargetAction(
-              feature.name,
-              screenId,
-              "projectionList",
-              "toolbarAction",
-              action,
-              feature.screens,
-            );
-          }
-          if (action.kind === "navigate" && action.tab !== undefined) {
-            resolveRowActionNavigateTarget(
-              feature.name,
-              screenId,
-              "projectionList",
-              "toolbarAction",
-              action,
-              allScreenQns,
-              navTargetShortIds,
-              screensByShortId,
-              detailForScreens,
-            );
-          }
-        }
-      }
-      continue;
-    }
-
-    if (screen.type === "projectionDetail") {
-      // Query-getrieben wie projectionList, aber Single-Row + Layout statt
-      // Columns. Kein Entity-Check möglich — Felder werden render-seitig
-      // gegen die Query-Response aufgelöst, nicht gegen eine Entity.
-      if (!screen.query || typeof screen.query !== "string") {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) has empty or non-string query.`,
-        );
-      }
-      if (screen.singleton === true && screen.idParam !== undefined) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) sets both singleton: true ` +
-            `and idParam — singleton means the server picks the row from the caller's context, so there ` +
-            `is no row id to send under idParam. Remove idParam.`,
-        );
-      }
-      // singleton has no row id in the path, but the auto-generated "Edit"
-      // action (fw#2166, defaultEditAction in kumiko-screen.tsx) navigates
-      // to the detailFor entity's entityEdit screen using that path id —
-      // under singleton it would silently open that screen in CREATE mode
-      // instead of editing the singleton row. Reject rather than let that
-      // win silently, same as the idParam check above.
-      if (screen.singleton === true && screen.detailFor !== undefined) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) sets both singleton: true ` +
-            `and detailFor — the auto-generated "Edit" action navigates using the path's row id, which a ` +
-            `singleton screen never has. Remove detailFor, or declare an explicit "edit" action instead.`,
-        );
-      }
-      if (screen.layout.sections.length === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) has an empty sections list — ` +
-            `declare at least one section.`,
-        );
-      }
-      if (screen.layout.mode === "tabs") {
-        validateTabSections(feature.name, screenId, "projectionDetail", screen.layout.sections);
-        for (const section of screen.layout.sections) {
-          const isFieldsSection = section.kind === undefined || section.kind === "fields";
-          if (isFieldsSection && section.groups !== undefined && section.actions !== undefined) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.id}" ` +
-                `declares both groups and actions in tabs mode — actions has no single group's Card to sit ` +
-                `in, and an extra title-less Card around the group cards would nest a Card inside a Card. ` +
-                `Move the actions onto one group's title, or drop groups for a flat fields grid.`,
-            );
-          }
-        }
-      }
-      if (screen.metrics !== undefined) {
-        for (const metric of screen.metrics) {
-          const field = metricField(metric);
-          const hasOwnLabel = typeof metric !== "string" && metric.label !== undefined;
-          if (!hasOwnLabel && screen.fieldLabels?.[field] === undefined) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) metric "${field}" has ` +
-                `no entry in fieldLabels and no own "label" — every metrics field needs one of the two, ` +
-                `there is no fallback to the raw column name.`,
-            );
-          }
-          const navigate = typeof metric === "string" ? undefined : metric.navigate;
-          if (navigate?.tab !== undefined) {
-            if (navigate.screen === undefined && navigate.entity === undefined) {
-              if (!screen.layout.sections.some((section) => section.id === navigate.tab)) {
-                throw new Error(
-                  `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) metric "${field}" ` +
-                    `navigates to tab "${navigate.tab}", which is not a section id on this screen.`,
-                );
-              }
-            } else {
-              resolveRowActionNavigateTarget(
-                feature.name,
-                screenId,
-                "projectionDetail",
-                "metric",
-                {
-                  kind: "navigate",
-                  id: field,
-                  label: field,
-                  ...(navigate.screen !== undefined ? { screen: navigate.screen } : {}),
-                  ...(navigate.entity !== undefined ? { entity: navigate.entity } : {}),
-                  ...(navigate.entityId !== undefined ? { entityId: navigate.entityId } : {}),
-                  tab: navigate.tab,
-                },
-                allScreenQns,
-                navTargetShortIds,
-                screensByShortId,
-                detailForScreens,
-              );
-            }
-          }
-        }
-      }
-      for (const section of screen.layout.sections) {
-        const sectionLabel = section.title ?? section.id ?? "(untitled)";
-        if (section.actions !== undefined) {
-          for (const action of section.actions) {
-            validateActionHasIcon(
-              feature.name,
-              screenId,
-              "projectionDetail",
-              `section "${sectionLabel}" action`,
-              action,
-            );
-            if (action.kind === "navigate" && action.tab !== undefined) {
-              resolveRowActionNavigateTarget(
-                feature.name,
-                screenId,
-                "projectionDetail",
-                `section "${sectionLabel}" action`,
-                action,
-                allScreenQns,
-                navTargetShortIds,
-                screensByShortId,
-                detailForScreens,
-              );
-            }
-          }
-        }
-        if (section.kind === "relatedList" && section.emptyState?.action !== undefined) {
-          validateActionHasIcon(
-            feature.name,
-            screenId,
-            "projectionDetail",
-            `section "${sectionLabel}" emptyState action`,
-            section.emptyState.action,
-          );
-          if (
-            section.emptyState.action.kind === "navigate" &&
-            section.emptyState.action.tab !== undefined
-          ) {
-            resolveRowActionNavigateTarget(
-              feature.name,
-              screenId,
-              "projectionDetail",
-              `section "${sectionLabel}" emptyState action`,
-              section.emptyState.action,
-              allScreenQns,
-              navTargetShortIds,
-              screensByShortId,
-              detailForScreens,
-            );
-          }
-        }
-        if (isExtensionEditSection(section)) {
-          // projectionDetail is read-only (no composed form submit) — an
-          // extension that persists through the host's Save button has
-          // nothing to save against. Extensions that persist themselves
-          // (e.g. notes-history NotesSection, via their own dispatcher
-          // writes) are fine (solon#264).
-          if (section.contributesToFormSubmit === true) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) extension section ` +
-                `"${section.title}" sets contributesToFormSubmit: true, but projectionDetail has no ` +
-                `form submit to contribute to (read-only screen). Omit contributesToFormSubmit and ` +
-                `persist through the extension's own dispatcher writes instead.`,
-            );
-          }
-          if (section.component?.react === undefined && section.component?.native === undefined) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) extension section ` +
-                `"${section.title}" has no component — declare a react/native component marker.`,
-            );
-          }
-          // The host-derived entity name on projectionDetail is an internal
-          // placeholder (no real entity backs this screen) — a self-
-          // persisting extension needs the real domain entity name declared
-          // explicitly, or it silently reads/writes against the wrong type.
-          if (section.entityName === undefined || section.entityName.trim().length === 0) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) extension section ` +
-                `"${section.title}" has no entityName — projectionDetail has no real entity, so the ` +
-                `extension must declare entityName explicitly (the domain entity it persists against).`,
-            );
-          }
-          continue;
-        }
-        if (section.kind === "relatedList") {
-          if (!section.query || typeof section.query !== "string") {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                `(relatedList) has empty or non-string query.`,
-            );
-          }
-          for (const col of section.columns) {
-            const normalizedCol = normalizeListColumn(col);
-            if (normalizedCol.refEntity !== undefined) {
-              assertRefTargetRegistered(
-                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" (relatedList)`,
-                `column "${normalizedCol.field}" (refEntity)`,
-                normalizedCol.refEntity,
-                feature.name,
-                featureMap,
-              );
-            }
-          }
-          if (screen.layout.mode === "wizard") {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                `is kind "relatedList" in a wizard layout — a read-only list is not supported in a ` +
-                `stepped form. Remove mode: "wizard" or drop the relatedList section.`,
-            );
-          }
-          if (section.rowClick !== undefined) {
-            const targetEntity = section.rowClick.entity;
-            const hasDetailScreen = [...featureMap.values()].some((f) =>
-              Object.values(f.screens).some((s) => s.detailFor === targetEntity),
-            );
-            if (!hasDetailScreen) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                  `(relatedList) rowClick targets entity "${targetEntity}", but no screen declares ` +
-                  `detailFor: "${targetEntity}". Add detailFor: "${targetEntity}" to the screen that shows it.`,
-              );
-            }
-          }
-          if (section.rowActions !== undefined) {
-            for (const action of section.rowActions) {
-              if (action.kind === "navigate") {
-                const target = resolveRowActionNavigateTarget(
-                  feature.name,
-                  screenId,
-                  "projectionDetail",
-                  "rowAction",
-                  action,
-                  allScreenQns,
-                  navTargetShortIds,
-                  screensByShortId,
-                  detailForScreens,
-                );
-                validateRowActionNavigateParams(
-                  feature.name,
-                  screenId,
-                  "projectionDetail",
-                  undefined,
-                  action,
-                  target,
-                );
-              } else if (action.kind === "drawer") {
-                validateDrawerTargetAction(
-                  feature.name,
-                  screenId,
-                  "projectionDetail",
-                  "rowAction",
-                  action,
-                  feature.screens,
-                );
-              } else if (!allWriteHandlerQns.has(action.handler)) {
-                throw new Error(
-                  `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section ` +
-                    `"${section.title}" (relatedList) rowAction "${action.id}" handler "${action.handler}" ` +
-                    `is not a registered write-handler. Check the QN spelling (expected ` +
-                    `"<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`,
-                );
-              }
-            }
-            // section.rowClick (legacy, navigate-only) and a rowActions entry
-            // marked rowClick:true both claim the row-body click — same
-            // at-most-one constraint as entityList/projectionList's
-            // validateAtMostOneRowClick, just spanning two fields instead of one.
-            const rowClickActionCount = section.rowActions.filter(
-              (a) => a.kind === "navigate" && a.rowClick === true,
-            ).length;
-            const legacyRowClickCount = section.rowClick !== undefined ? 1 : 0;
-            if (rowClickActionCount + legacyRowClickCount > 1) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                  `(relatedList) has both a rowClick and ${rowClickActionCount} rowActions marked ` +
-                  `rowClick:true — at most one may fire on a row-body click.`,
-              );
-            }
-          }
-          if (section.defaultSort !== undefined) {
-            const sortField = section.defaultSort.field;
-            const col = section.columns.find((c) => normalizeListColumn(c).field === sortField);
-            if (col === undefined) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                  `(relatedList) defaultSort.field "${sortField}" is not a listed column.`,
-              );
-            }
-            if (normalizeListColumn(col).sortable !== true) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                  `(relatedList) defaultSort.field "${sortField}" is not sortable. Set sortable: true on ` +
-                  `the column or pick another field.`,
-              );
-            }
-          }
-          if (section.facets !== undefined) {
-            validateListFacets(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) relatedList section "${section.title}"`,
-              section.facets,
-              section.columns,
-              feature.name,
-              featureMap,
-            );
-          }
-          // Only drawer-kind and navigate actions that set tab are validated
-          // here — plain navigate (no tab) and writeHandler toolbarActions
-          // have no boot check yet, same gap as above.
-          if (section.toolbarActions !== undefined) {
-            for (const action of section.toolbarActions) {
-              if (action.kind === "drawer") {
-                validateDrawerTargetAction(
-                  feature.name,
-                  screenId,
-                  "projectionDetail",
-                  "toolbarAction",
-                  action,
-                  feature.screens,
-                );
-              }
-              if (action.kind === "navigate" && action.tab !== undefined) {
-                resolveRowActionNavigateTarget(
-                  feature.name,
-                  screenId,
-                  "projectionDetail",
-                  "toolbarAction",
-                  action,
-                  allScreenQns,
-                  navTargetShortIds,
-                  screensByShortId,
-                  detailForScreens,
-                );
-              }
-            }
-          }
-          continue;
-        }
-        if (isWriteFormEditSection(section)) {
-          if (Object.keys(section.fieldDefs).length === 0) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                `(writeForm) has an empty fieldDefs map — declare at least one field type.`,
-            );
-          }
-          if (section.fields.length === 0) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                `(writeForm) has zero fields — drop the section or add fields to it.`,
-            );
-          }
-          // kumiko-lint-ignore section-fields-raw writeForm sections carry no groups (EditWriteFormSection)
-          for (const f of section.fields) {
-            const fieldName = normalizeEditField(f).field;
-            if (section.fieldDefs[fieldName] === undefined) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                  `(writeForm) field "${fieldName}" has no entry in fieldDefs — every rendered field needs ` +
-                  `a type declared there.`,
-              );
-            }
-          }
-          if (screen.layout.mode === "wizard") {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                `is kind "writeForm" in a wizard layout — a self-persisting form is not supported in a ` +
-                `stepped form. Remove mode: "wizard" or drop the writeForm section.`,
-            );
-          }
-          if (!allWriteHandlerQns.has(section.handler)) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
-                `(writeForm) handler "${section.handler}" is not a registered write-handler. Check the QN ` +
-                `spelling (expected "<feature>:write:<short>") and that the handler is declared via ` +
-                `r.writeHandler(...).`,
-            );
-          }
-          continue;
-        }
-        validateFieldsXorGroups(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail)`,
-          section,
-        );
-        for (const fieldSpec of sectionFieldSpecs(section)) {
-          const normalizedField = normalizeEditField(fieldSpec);
-          if (normalizedField.refEntity !== undefined) {
-            assertRefTargetRegistered(
-              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail)`,
-              `field "${normalizedField.field}" (refEntity)`,
-              normalizedField.refEntity,
-              feature.name,
-              featureMap,
-            );
-          }
-        }
-      }
-      // Header actions reuse RowAction (the displayed record stands in for
-      // the row), so the same navigate/writeHandler existence checks as
-      // entityList/projectionList apply. `rowClick` is rejected outright —
-      // a detail screen has no row to click.
-      if (screen.actions !== undefined) {
-        for (const action of screen.actions) {
-          validateActionHasIcon(feature.name, screenId, "projectionDetail", "action", action);
-          if (action.kind === "navigate" && action.rowClick === true) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${qualifyEntityName(feature.name, "screen", screenId)}" ` +
-                `(projectionDetail) action "${action.id}" sets rowClick: true — there is no row to ` +
-                `click on a detail screen. Remove rowClick.`,
-            );
-          }
-          if (action.kind === "navigate") {
-            const target = resolveRowActionNavigateTarget(
-              feature.name,
-              screenId,
-              "projectionDetail",
-              "action",
-              action,
-              allScreenQns,
-              navTargetShortIds,
-              screensByShortId,
-              detailForScreens,
-            );
-            validateRowActionNavigateParams(
-              feature.name,
-              screenId,
-              "projectionDetail",
-              screen.detailFor,
-              action,
-              target,
-            );
-          } else if (action.kind === "drawer") {
-            validateDrawerTargetAction(
-              feature.name,
-              screenId,
-              "projectionDetail",
-              "action",
-              action,
-              feature.screens,
-            );
-          } else {
-            if (!allWriteHandlerQns.has(action.handler)) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) action "${action.id}" ` +
-                  `handler "${action.handler}" is not a registered write-handler. Check the QN spelling ` +
-                  `(expected "<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`,
-              );
-            }
-          }
-        }
-      }
-      continue;
-    }
-
-    if (screen.type === "dashboard") {
-      validateDashboardScreen(feature.name, screenId, screen, featureMap);
-      continue;
-    }
-
-    if (screen.type === "configEdit") {
-      // configEdit: layout/fields wie actionForm validieren, plus
-      // Cross-Check dass jeder qualifizierte Config-Key registriert
-      // ist und der scope mit dem Key matcht.
-      const fieldNames = new Set(Object.keys(screen.fields));
-      if (fieldNames.size === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (configEdit) has empty fields map — ` +
-            `declare at least one field.`,
-        );
-      }
-      for (const [fname, fdef] of Object.entries(screen.fields)) {
-        // @cast-boundary schema-walk — feature-config inspection
-        const ftype = (fdef as { type?: unknown }).type;
-        if (typeof ftype !== "string" || ftype.length === 0) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (configEdit) field "${fname}" has no ` +
-              `\`type\` set. Each field must declare a type (e.g. "text", "number", "select").`,
-          );
-        }
-      }
-      if (screen.layout.sections.length === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (configEdit) has an empty sections list — ` +
-            `declare at least one section.`,
-        );
-      }
-      for (const section of screen.layout.sections) {
-        if (isExtensionEditSection(section)) {
-          if (section.component?.react === undefined && section.component?.native === undefined) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (configEdit) extension section ` +
-                `"${section.title}" has no component — declare a react/native component marker.`,
-            );
-          }
-          continue;
-        }
-        if (section.kind === "relatedList") {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (configEdit) relatedList section ` +
-              `"${section.title}" is not supported — relatedList is a projectionDetail-only ` +
-              `primitive (fw#2166).`,
-          );
-        }
-        if (isWriteFormEditSection(section)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (configEdit) writeForm section ` +
-              `"${section.title}" is not supported — writeForm is a projectionDetail-only primitive.`,
-          );
-        }
-        validateFieldsXorGroups(
-          `[Feature ${feature.name}] Screen "${screenId}" (configEdit)`,
-          section,
-        );
-        for (const fieldSpec of sectionFieldSpecs(section)) {
-          const normalized = normalizeEditField(fieldSpec);
-          if (!fieldNames.has(normalized.field)) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (configEdit) layout references unknown ` +
-                `field "${normalized.field}". Known fields: ${[...fieldNames].sort().join(", ")}`,
-            );
-          }
-        }
-      }
-      validateWizardLayout(feature.name, screenId, "configEdit", screen.layout, featureMap);
-      // configKeys: jeder fieldName muss einen Mapping-Eintrag haben,
-      // jeder qualifizierte Key muss in der Registry existieren.
-      for (const fname of fieldNames) {
-        const qualified = screen.configKeys[fname];
-        if (qualified === undefined) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (configEdit) field "${fname}" hat ` +
-              `keinen Eintrag in configKeys-Map. Jedes deklarierte Field braucht ein Mapping zu ` +
-              `einem qualifizierten Config-Key (\`<feature>:config:<short>\`).`,
-          );
-        }
-        if (!allConfigKeyQns.has(qualified)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (configEdit) field "${fname}" → ` +
-              `Config-Key "${qualified}" ist in keiner Feature-Registry deklariert. Tippfehler? ` +
-              `Erwartetes Format: "<feature>:config:<short>". Bekannte Keys: ${
-                [...allConfigKeyQns].sort().join(", ") || "(keine)"
-              }`,
-          );
-        }
-      }
-      continue;
-    }
-
-    if (screen.type === "actionForm") {
-      validateInlineFormScreen(
-        feature,
-        screenId,
-        screen,
-        "actionForm",
-        allWriteHandlerQns,
-        allScreenQns,
-        featureMap,
-      );
-      continue;
-    }
-
-    if (screen.type === "secretMint") {
-      validateInlineFormScreen(
-        feature,
-        screenId,
-        screen,
-        "secretMint",
-        allWriteHandlerQns,
-        allScreenQns,
-        featureMap,
-      );
-      if (screen.reveal.fields.length === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (secretMint) has an empty reveal.fields ` +
-            `list — declare at least one field to reveal.`,
-        );
-      }
-      const revealFieldNames = new Set<string>();
-      for (const revealField of screen.reveal.fields) {
-        if (typeof revealField.field !== "string" || revealField.field.trim() === "") {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (secretMint) has a reveal.fields entry ` +
-              `with an empty or non-string "field".`,
-          );
-        }
-        if (revealFieldNames.has(revealField.field)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (secretMint) reveal.fields has a ` +
-              `duplicate field "${revealField.field}" — each revealed field must be unique.`,
-          );
-        }
-        revealFieldNames.add(revealField.field);
-        if (typeof revealField.label !== "string" || revealField.label.trim() === "") {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (secretMint) reveal.fields entry ` +
-              `"${revealField.field}" has an empty or non-string "label".`,
-          );
-        }
-      }
-      validateSecretMintConfirm(feature, screenId, screen, allWriteHandlerQns);
-      continue;
-    }
-
-    // secretsEdit is generator-only (buildConfigFeatureSchema) — never
-    // authored via r.screen, so feature.screens never actually carries one.
-    // Kept here only so this loop's type narrowing stays exhaustive.
-    if (screen.type === "secretsEdit") continue;
-
-    // entityList / entityEdit: entity-refs are feature-local.
-    const entityDef = feature.entities?.[screen.entity];
-    if (!entityDef) {
-      const known =
-        Object.keys(feature.entities ?? {})
-          .sort()
-          .join(", ") || "(none)";
-      const crossFeature = findEntityFeature(screen.entity, featureMap);
-      const hint = crossFeature
-        ? ` Entity "${screen.entity}" is owned by feature "${crossFeature}" — cross-feature screen ownership is not supported.`
-        : "";
-      throw new Error(
-        `[Feature ${feature.name}] Screen "${screenId}" references entity "${screen.entity}" ` +
-          `which is not declared in this feature (known: ${known}).${hint}`,
-      );
-    }
-
-    const fieldNames = new Set(Object.keys(entityDef.fields));
-    // List columns may also name a read-time derived field (not a stored
-    // column). Allowed for display; deliberately NOT added to `fieldNames`, so
-    // defaultSort/filter on a derived field still fails — server-side sort over
-    // a non-column is a silent no-op (see DerivedFieldDef).
-    const columnFieldNames =
-      entityDef.derivedFields !== undefined
-        ? new Set([...fieldNames, ...Object.keys(entityDef.derivedFields)])
-        : fieldNames;
-    const rowMeta = rowMetaFieldNames(entityDef.softDelete ?? false);
-    if (screen.type === "entityList") {
-      // Empty column list would render as a blank table — almost always the
-      // sign of an in-progress screen the author forgot to fill in. Fail
-      // loud: ui-core's computeListViewModel can't do anything useful with
-      // zero columns either.
-      if (screen.columns.length === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (entityList) has an empty columns list — ` +
-            `declare at least one column.`,
-        );
-      }
-      for (const col of screen.columns) {
-        const normalized = normalizeListColumn(col);
-        // A row-meta column (id/tenantId/version/insertedAt/modifiedAt/...) is a
-        // real DB column without being a declared entity field — e.g. a
-        // SystemAdmin cross-tenant list exposing tenantId. Accept it like a
-        // regular field name — but only the columns computeListViewModel can
-        // actually render (LIST_ROW_META_COLUMN_NAMES), not the wider
-        // softDelete-aware rowMeta set used below for payload/visible refs.
-        //
-        // A virtual presentational column (drawn by a columnRenderer component
-        // from the row, e.g. tag chips) needs BOTH a label AND a renderer —
-        // renderer is what actually makes it "virtual" (label alone still
-        // needs list.ts's virtual-branch to have something to draw; without
-        // a renderer the column would render nothing). A column with neither
-        // matching a real field/row-meta column NOR a renderer is a typo worth
-        // failing the boot.
-        if (
-          !columnFieldNames.has(normalized.field) &&
-          !LIST_ROW_META_COLUMN_NAMES.has(normalized.field) &&
-          !(normalized.label !== undefined && normalized.renderer !== undefined)
-        ) {
-          throw new Error(
-            buildUnknownFieldMessage(
-              feature.name,
-              screenId,
-              normalized.field,
-              screen.entity,
-              columnFieldNames,
-            ),
-          );
-        }
-        validateColumnRendererForm(feature.name, screenId, normalized);
-      }
-      // Pagination/Sort/Search-Validierung: Author-Fehler beim Boot
-      // fangen, damit kein "warum kommt die Liste leer / falsch
-      // sortiert"-Debug-Cycle zur Laufzeit losgeht.
-      if (screen.pageSize !== undefined && screen.pageSize <= 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (entityList) has pageSize=${screen.pageSize} — ` +
-            `must be a positive integer.`,
-        );
-      }
-      if (screen.defaultSort !== undefined) {
-        const sortField = screen.defaultSort.field;
-        if (!fieldNames.has(sortField)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityList) defaultSort references unknown ` +
-              `field "${sortField}". Known fields: ${[...fieldNames].sort().join(", ")}`,
-          );
-        }
-        // sortable: true Pflicht — verhindert dass das UI auf einer
-        // Spalte sortiert, die Server-Side gar keinen DB-Index hat
-        // oder im Schema absichtlich nicht sortiert werden soll
-        // (Audit-Felder, Computed-Werte). `sortable` lebt heute nur
-        // auf TextFieldDef; "in"-narrow lässt das auch für andere
-        // Field-Types ohne explizites Flag durchfallen, was ok ist:
-        // Number/Date sind natürlich sortierbar, der Author kann sie
-        // im Author-Code als sortable markieren wenn das Field-Type
-        // es trägt (Erweiterung folgt).
-        const fieldDef = entityDef.fields[sortField];
-        const isSortable =
-          fieldDef !== undefined && "sortable" in fieldDef && fieldDef.sortable === true;
-        if (!isSortable) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityList) defaultSort.field "${sortField}" ` +
-              `is not sortable. Set sortable: true on the field definition or pick another field.`,
-          );
-        }
-      }
-      // Screen-Filter (Tier 2.7c) — drei Layer Author-Code-Check:
-      //   1) Field existiert auf der Entity (Tippfehler = leere Liste
-      //      statt Crash; Boot-Fail ist deutlich besser).
-      //   2) Field hat `filterable: true` (Author opt-in, analog zu
-      //      `sortable`). Verhindert dass Audit-/Computed-/encrypted-
-      //      Felder unbeabsichtigt filterbar werden.
-      //   3) Op passt zum Field-Type. Lt/gt auf text-Feldern → Boot-
-      //      Fail mit Hinweis statt String-Sort-Surprise zur Laufzeit.
-      // Außerdem: "in" verlangt readonly Array.
-      if (screen.filter !== undefined) {
-        const filterField = screen.filter.field;
-        if (!fieldNames.has(filterField)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityList) filter references unknown ` +
-              `field "${filterField}". Known fields: ${[...fieldNames].sort().join(", ")}`,
-          );
-        }
-        const fieldDef = entityDef.fields[filterField];
-        if (fieldDef !== undefined && !isFieldFilterable(fieldDef)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityList) filter references field ` +
-              `"${filterField}" which is not filterable. Set filterable: true on the field ` +
-              `definition or pick another field.`,
-          );
-        }
-        if (fieldDef !== undefined) {
-          const allowedOps = getAllowedFilterOps(fieldDef);
-          if (!allowedOps.includes(screen.filter.op)) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (entityList) filter.op ` +
-                `"${screen.filter.op}" is not allowed on field "${filterField}" ` +
-                `(type "${fieldDef.type}"). Allowed ops: ${allowedOps.join(", ") || "(none)"}.`,
-            );
-          }
-        }
-        if (screen.filter.op === "in" && !Array.isArray(screen.filter.value)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityList) filter.op "in" requires ` +
-              `filter.value to be a readonly array.`,
-          );
-        }
-      }
-      // Tier 2.7e-1: rowActions pinnen — navigate-target existiert (selbes
-      // Feature), writeHandler-QN ist registriert. Tippfehler fallen sonst
-      // erst beim ersten Klick als "Screen not found" / 404 auf.
-      if (screen.rowActions !== undefined) {
-        for (const action of screen.rowActions) {
-          if (action.kind === "navigate") {
-            const target = resolveRowActionNavigateTarget(
-              feature.name,
-              screenId,
-              "entityList",
-              "rowAction",
-              action,
-              allScreenQns,
-              navTargetShortIds,
-              screensByShortId,
-              detailForScreens,
-            );
-            // The renderer's default-entityId fallback (row["id"]) only fires
-            // for a same-feature entityEdit target — it can't safely guess
-            // the id for a screen owned by a different feature. Cross-feature
-            // + entityEdit therefore MUST set an explicit entityId, or the
-            // edit screen silently opens with no entity context at runtime.
-            // Entity-targets (fw#2228) are exempt: the renderer always
-            // supplies an id for them (explicit entityId, else row["id"]),
-            // regardless of which feature the resolved detailFor screen
-            // belongs to.
-            if (
-              action.screen !== undefined &&
-              target !== undefined &&
-              target.featureName !== feature.name &&
-              target.screen.type === "entityEdit" &&
-              action.entityId === undefined
-            ) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (entityList) rowAction "${action.id}" ` +
-                  `navigates cross-feature to entityEdit screen "${action.screen}" (feature ` +
-                  `"${target.featureName}") without an explicit entityId field — the renderer's ` +
-                  `same-feature row["id"] fallback does not apply across features. Set entityId to ` +
-                  `the row field that names the target entity's id.`,
-              );
-            }
-            // params only have a reader in actionForm and entityEdit-CREATE;
-            // on projectionDetail/dashboard/configEdit/entityEdit-update they
-            // are silently ignored at runtime. `custom` is deliberately
-            // exempt: it renders an app-registered component the framework
-            // has no visibility into — the author may read nav.searchParams
-            // directly (real example: publicstatus's MonitorDetailScreen
-            // does exactly that), so flagging it would be a false positive
-            // on working code, not a caught bug.
-            //
-            // Whether an entityEdit target lands in create or update mode is
-            // decided by the same rule the renderer's runNavigate() uses: an
-            // explicit entityId always forces update mode, and (absent an
-            // explicit entityId) a same-entity target gets row["id"] auto-
-            // injected — only a cross-entity target with no explicit
-            // entityId reaches create.
-            validateRowActionNavigateParams(
-              feature.name,
-              screenId,
-              "entityList",
-              screen.entity,
-              action,
-              target,
-            );
-          } else if (action.kind === "drawer") {
-            validateDrawerTargetAction(
-              feature.name,
-              screenId,
-              "entityList",
-              "rowAction",
-              action,
-              feature.screens,
-            );
-          } else {
-            if (!allWriteHandlerQns.has(action.handler)) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (entityList) rowAction "${action.id}" ` +
-                  `handler "${action.handler}" is not a registered write-handler. Check the QN spelling ` +
-                  `(expected "<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`,
-              );
-            }
-          }
-          validateActionFieldRefs(
-            feature.name,
-            screenId,
-            "rowAction",
-            action.id,
-            action,
-            fieldNames,
-            rowMeta,
-          );
-        }
-        validateAtMostOneRowClick(feature.name, screenId, "entityList", screen.rowActions);
-      }
-      // Tier 2.7e-2: toolbarActions — analog zu rowActions, aber bisher
-      // ohne Validator. Typo'd navigate-targets und unregistrierte
-      // writeHandler-QNs fallen bis hierhin erst beim Klick auf.
-      if (screen.toolbarActions !== undefined) {
-        for (const action of screen.toolbarActions) {
-          if (action.kind === "navigate") {
-            const candidateQn = qualifyEntityName(feature.name, "screen", action.screen);
-            if (!allScreenQns.has(candidateQn) && !navTargetShortIds.has(action.screen)) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (entityList) toolbarAction "${action.id}" ` +
-                  `navigate-target "${action.screen}" does not resolve to a registered screen in any feature.`,
-              );
-            }
-            if (action.tab !== undefined) {
-              resolveRowActionNavigateTarget(
-                feature.name,
-                screenId,
-                "entityList",
-                "toolbarAction",
-                action,
-                allScreenQns,
-                navTargetShortIds,
-                screensByShortId,
-                detailForScreens,
-              );
-            }
-          } else if (action.kind === "drawer") {
-            validateDrawerTargetAction(
-              feature.name,
-              screenId,
-              "entityList",
-              "toolbarAction",
-              action,
-              feature.screens,
-            );
-          } else {
-            if (!allWriteHandlerQns.has(action.handler)) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (entityList) toolbarAction "${action.id}" ` +
-                  `handler "${action.handler}" is not a registered write-handler. Check the QN spelling ` +
-                  `(expected "<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`,
-              );
-            }
-          }
-          validateActionFieldRefs(
-            feature.name,
-            screenId,
-            "toolbarAction",
-            action.id,
-            action,
-            fieldNames,
-            rowMeta,
-          );
-        }
-      }
-    } else {
-      // Same rationale as the columns check: an entityEdit layout with zero
-      // sections (or sections without any fields) renders as nothing — reject
-      // at boot so the author sees it before the blank form surprises them.
-      if (screen.layout.sections.length === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (entityEdit) has an empty sections list — ` +
-            `declare at least one section.`,
-        );
-      }
-      for (const section of screen.layout.sections) {
-        if (section.actions !== undefined) {
-          const sectionLabel = section.title ?? section.id ?? "(untitled)";
-          for (const action of section.actions) {
-            validateActionHasIcon(
-              feature.name,
-              screenId,
-              "entityEdit",
-              `section "${sectionLabel}" action`,
-              action,
-            );
-            if (action.kind === "navigate" && action.tab !== undefined) {
-              resolveRowActionNavigateTarget(
-                feature.name,
-                screenId,
-                "entityEdit",
-                `section "${sectionLabel}" action`,
-                action,
-                allScreenQns,
-                navTargetShortIds,
-                screensByShortId,
-                detailForScreens,
-              );
-            }
-          }
-        }
-        if (isExtensionEditSection(section)) {
-          if (section.component?.react === undefined && section.component?.native === undefined) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${screenId}" (entityEdit) extension section ` +
-                `"${section.title}" has no component — declare a react/native component marker.`,
-            );
-          }
-          continue;
-        }
-        if (section.kind === "relatedList") {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityEdit) relatedList section ` +
-              `"${section.title}" is not supported — relatedList is a projectionDetail-only ` +
-              `primitive (fw#2166).`,
-          );
-        }
-        if (isWriteFormEditSection(section)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityEdit) writeForm section ` +
-              `"${section.title}" is not supported — writeForm is a projectionDetail-only primitive.`,
-          );
-        }
-        validateFieldsXorGroups(
-          `[Feature ${feature.name}] Screen "${screenId}" (entityEdit)`,
-          section,
-        );
-        for (const fieldSpec of sectionFieldSpecs(section)) {
-          const normalized = normalizeEditField(fieldSpec);
-          if (!fieldNames.has(normalized.field)) {
-            throw new Error(
-              buildUnknownFieldMessage(
-                feature.name,
-                screenId,
-                normalized.field,
-                screen.entity,
-                fieldNames,
-              ),
-            );
-          }
-          validateNoWidgetRequiredField(feature.name, screenId, entityDef, normalized);
-        }
-      }
-      validateWizardLayout(feature.name, screenId, "entityEdit", screen.layout, featureMap);
-      // Header actions reuse RowAction — same shape and same checks as
-      // projectionDetail's `actions` above (the loaded record stands in
-      // for the row). `rowClick` is rejected outright — entityEdit has no
-      // row to click either.
-      if (screen.actions !== undefined) {
-        for (const action of screen.actions) {
-          if (action.kind === "navigate" && action.rowClick === true) {
-            throw new Error(
-              `[Feature ${feature.name}] Screen "${qualifyEntityName(feature.name, "screen", screenId)}" ` +
-                `(entityEdit) action "${action.id}" sets rowClick: true — there is no row to click ` +
-                `on an edit screen. Remove rowClick.`,
-            );
-          }
-          if (action.kind === "navigate") {
-            const target = resolveRowActionNavigateTarget(
-              feature.name,
-              screenId,
-              "entityEdit",
-              "action",
-              action,
-              allScreenQns,
-              navTargetShortIds,
-              screensByShortId,
-              detailForScreens,
-            );
-            validateRowActionNavigateParams(
-              feature.name,
-              screenId,
-              "entityEdit",
-              screen.entity,
-              action,
-              target,
-            );
-          } else if (action.kind === "drawer") {
-            validateDrawerTargetAction(
-              feature.name,
-              screenId,
-              "entityEdit",
-              "action",
-              action,
-              feature.screens,
-            );
-          } else {
-            if (!allWriteHandlerQns.has(action.handler)) {
-              throw new Error(
-                `[Feature ${feature.name}] Screen "${screenId}" (entityEdit) action "${action.id}" ` +
-                  `handler "${action.handler}" is not a registered write-handler. Check the QN spelling ` +
-                  `(expected "<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`,
-              );
-            }
-          }
-        }
-      }
-      if (screen.redirect !== undefined) {
-        validateRedirectTarget(feature, screenId, "entityEdit", screen.redirect, allScreenQns);
-      }
-    }
-  }
-}
-
-// Panel-getrieben, keine Entity — Struktur-Checks (eindeutige Panel-Ids,
-// non-empty Queries/Columns/valueField); die Query-Contracts (Stat-Record,
-// Points-Envelope, Paged-Rows) werden zur Render-Zeit aufgelöst.
-function validateDashboardScreen(
-  featureName: string,
-  screenId: string,
-  screen: DashboardScreenDefinition,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  if (screen.panels.length === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) has an empty panels list — ` +
-        `declare at least one panel.`,
-    );
-  }
-  const panelIds = new Set<string>();
-  const addPanelId = (id: string, context: string): void => {
-    if (panelIds.has(id)) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (dashboard) has duplicate panel id "${id}" (${context}).`,
-      );
-    }
-    panelIds.add(id);
-  };
-
-  for (const panel of screen.panels) {
-    addPanelId(panel.id, panel.kind);
-    if (panel.kind === "stat-group") {
-      validateDashboardStatGroupPanel(featureName, screenId, panel, addPanelId);
-    } else if (panel.kind === "custom") {
-      validateDashboardCustomPanel(featureName, screenId, panel);
-    } else if (panel.kind === "screen") {
-      validateDashboardScreenPanel(featureName, screenId, panel, featureMap);
-    } else {
-      validateDashboardQueryPanel(featureName, screenId, panel);
-    }
-  }
-
-  if (screen.filter !== undefined) {
-    validateDashboardFilterDefinition(featureName, screenId, screen.filter);
-  }
-}
-
-const EMBEDDABLE_SCREEN_TYPES: ReadonlySet<ScreenDefinition["type"]> = new Set([
-  "projectionList",
-  "actionForm",
-  "secretMint",
-  "configEdit",
-  "secretsEdit",
-]);
-
-function validateDashboardScreenPanel(
-  featureName: string,
-  screenId: string,
-  panel: DashboardScreenPanel,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  const context = `[Feature ${featureName}] Screen "${screenId}" (dashboard) screen-panel "${panel.id}"`;
-  const targetQn = resolveScreenTargetQn(featureName, panel.screen);
-  const [targetFeatureName = "", , targetShortId = ""] = targetQn.split(":");
-  const target = featureMap.get(targetFeatureName)?.screens[targetShortId];
-  if (target === undefined) {
-    throw new Error(
-      `${context} screen "${panel.screen}" does not resolve to a registered screen (checked "${targetQn}"). ` +
-        `Use a same-feature short id or a cross-feature QN "<feature>:screen:<id>".`,
-    );
-  }
-  if (!EMBEDDABLE_SCREEN_TYPES.has(target.type)) {
-    throw new Error(
-      `${context} embeds "${targetQn}" of type "${target.type}", which can't be embedded — allowed: ` +
-        `${[...EMBEDDABLE_SCREEN_TYPES].join(", ")}. Use a custom panel for app components.`,
-    );
-  }
-  const visibleWhen = panel.visibleWhen;
-  if (visibleWhen !== undefined && (visibleWhen.query === "" || visibleWhen.field === "")) {
-    throw new Error(`${context} visibleWhen needs a non-empty query and field.`);
-  }
-}
-
-function validateDashboardStatGroupPanel(
-  featureName: string,
-  screenId: string,
-  panel: DashboardStatGroupPanel,
-  addPanelId: (id: string, context: string) => void,
-): void {
-  if (panel.stats.length === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-group "${panel.id}" has an empty stats list.`,
-    );
-  }
-  for (const stat of panel.stats) {
-    addPanelId(stat.id, "stat-group child");
-    if (!stat.query || typeof stat.query !== "string") {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-group "${panel.id}" child "${stat.id}" has empty or non-string query.`,
-      );
-    }
-    if (stat.valueField.length === 0) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-group "${panel.id}" child "${stat.id}" has empty valueField.`,
-      );
-    }
-  }
-}
-
-function validateDashboardCustomPanel(
-  featureName: string,
-  screenId: string,
-  panel: DashboardCustomPanel,
-): void {
-  if (panel.component.react === undefined && panel.component.native === undefined) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) custom-panel "${panel.id}" has no component — ` +
-        `declare a react/native component marker.`,
-    );
-  }
-}
-
-function validateDashboardQueryPanel(
-  featureName: string,
-  screenId: string,
-  panel: Exclude<
-    DashboardPanelDefinition,
-    DashboardStatGroupPanel | DashboardCustomPanel | DashboardScreenPanel
-  >,
-): void {
-  if (!panel.query || typeof panel.query !== "string") {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}" has empty or non-string query.`,
-    );
-  }
-  if (panel.kind === "stat" && panel.valueField.length === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-panel "${panel.id}" has empty valueField.`,
-    );
-  }
-  if (panel.kind === "list") {
-    if (panel.columns.length === 0) {
-      throw new Error(
-        `[Feature ${featureName}] Screen "${screenId}" (dashboard) list-panel "${panel.id}" has an empty columns list.`,
-      );
-    }
-    for (const col of panel.columns) {
-      validateColumnRendererForm(featureName, screenId, normalizeListColumn(col));
-    }
-  }
-}
-
-function validateDashboardFilterDefinition(
-  featureName: string,
-  screenId: string,
-  filter: DashboardFilterDefinition,
-): void {
-  if (filter.id.length === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) filter has an empty id.`,
-    );
-  }
-  if (filter.label.length === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) filter has an empty label.`,
-    );
-  }
-  const hasOptions = filter.options !== undefined;
-  const hasOptionsQuery = filter.optionsQuery !== undefined;
-  if (hasOptions === hasOptionsQuery) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) filter must set exactly one of ` +
-        `options/optionsQuery.`,
-    );
-  }
-  if (hasOptions && (filter.options?.length ?? 0) === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) filter.options is empty — ` +
-        `declare at least one option or use optionsQuery instead.`,
-    );
-  }
-  if (hasOptionsQuery && filter.optionsQuery?.length === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" (dashboard) filter.optionsQuery is empty.`,
-    );
-  }
-}
-
-// Form-check für ListColumn-Renderer in der PlatformComponent-Form
-// (`{ react: { __component: "Name" } }`). Der Server kennt die client-
-// seitige columnRenderers-Map nicht — also nur prüfen ob die Struktur
-// stimmt: wenn `react` als Object gesetzt ist, MUSS `__component` ein
-// nicht-leerer String sein. Ein client-seitig ausgelassener Key löst
-// nur eine Warnung aus, kein Boot-Fail.
-export function validateColumnRendererForm(
-  featureName: string,
-  screenId: string,
-  column: { readonly field: string; readonly renderer?: unknown },
-): void {
-  const renderer = column.renderer;
-  // skip: nur die PlatformComponent-Form ({ react: { __component: "..." } })
-  // wird strukturell validiert. Funktions-, String-QN- und null/undefined-
-  // Renderer sind alle gültige andere Formen — kein Form-Fehler.
-  if (renderer === null || typeof renderer !== "object") return;
-  // @cast-boundary schema-walk — feature-config renderer-shape introspection
-  const react = (renderer as { react?: unknown }).react;
-  // skip: kein react-Branch → entweder native-only oder kein
-  // PlatformComponent — beides außerhalb dieses Checks.
-  if (react === undefined || react === null) return;
-  if (typeof react !== "object") {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" column "${column.field}" has a renderer with ` +
-        `a non-object \`react\` branch — expected \`{ react: { __component: "Name" } }\`.`,
-    );
-  }
-  // @cast-boundary schema-walk — feature-config react-branch introspection
-  const component = (react as { __component?: unknown }).__component;
-  // skip: ohne __component-Schlüssel ist das keine String-Key-Form
-  // (z.B. ein zukünftiger direkter Component-Ref); nicht unsere Domäne.
-  if (component === undefined) return;
-  if (typeof component !== "string" || component.length === 0) {
-    throw new Error(
-      `[Feature ${featureName}] Screen "${screenId}" column "${column.field}" has a renderer with ` +
-        `\`react.__component\` = ${JSON.stringify(component)} — expected a non-empty string identifying ` +
-        `a client-side columnRenderers entry.`,
-    );
-  }
-}
-
-// Shared entity-target resolution for reference facets, refEntity columns
-// (projectionList/relatedList) and refEntity fields (projectionDetail).
-function assertRefTargetRegistered(
-  prefix: string,
-  subject: string,
-  refTarget: string,
-  currentFeatureName: string,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  const target = parseRefTarget(refTarget, currentFeatureName);
-  const targetFeature = featureMap.get(target.featureName);
-  if (targetFeature?.entities?.[target.entityName] === undefined) {
-    throw new Error(
-      `${prefix} ${subject} targets entity "${refTarget}", which does not resolve to a ` +
-        `registered entity. Known entities in feature "${target.featureName}": ` +
-        `${
-          Object.keys(targetFeature?.entities ?? {})
-            .sort()
-            .join(", ") || "(none)"
-        }.`,
-    );
-  }
-}
-
-// Facets (fw#2224) — unlike filter, a field inventory IS available here: the
-// declared columns. A facet on a field with no column is almost always a
-// typo (the user never sees the field anywhere), so this is hard-checked
-// rather than just documented. Shared by projectionList and relatedList
-// (fw#2740) — `prefix` carries the caller's own screen/section message lead-in.
-//
-// `type: "reference"` is exempt from the same-name-column rule (fw akte-
-// bedienkonzept-2): it filters by an id field (e.g. "propertyId") but
-// displays a different, human-readable column (e.g. "propertyLabel") — a
-// column named after the filter field would almost never exist, and
-// requiring one anyway would force apps to add a column no design calls
-// for just to satisfy this check. Its own `entity` is mandatory on the type
-// (TS, not just this validator) and is resolved below — that explicit,
-// checked declaration is this facet type's field inventory, filling the
-// same "not just a typo" role the column-name check plays for select/
-// boolean facets. select/boolean facets keep the column requirement
-// unchanged: both filter and display the same field, so a facet with no
-// matching column is still almost always a typo.
-function validateListFacets(
-  prefix: string,
-  facets: readonly ListFacetSpec[],
-  columns: readonly ListColumnSpec[],
-  currentFeatureName: string,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  const columnFieldNames = new Set(columns.map((col) => normalizeListColumn(col).field));
-  const seenFacetFields = new Set<string>();
-  for (const facet of facets) {
-    if (seenFacetFields.has(facet.field)) {
-      throw new Error(`${prefix} declares facet "${facet.field}" more than once.`);
-    }
-    seenFacetFields.add(facet.field);
-    if (facet.type !== "reference" && !columnFieldNames.has(facet.field)) {
-      throw new Error(
-        `${prefix} facet references field "${facet.field}" which is not a declared column. ` +
-          `Known columns: ${[...columnFieldNames].sort().join(", ")}`,
-      );
-    }
-    if (facet.type === "select" && facet.options.length === 0) {
-      throw new Error(
-        `${prefix} facet "${facet.field}" (type "select") has an empty options list — ` +
-          `declare at least one option.`,
-      );
-    }
-    if (facet.type === "reference") {
-      assertRefTargetRegistered(
-        prefix,
-        `facet "${facet.field}" (type "reference")`,
-        facet.entity,
-        currentFeatureName,
-        featureMap,
-      );
-    }
-  }
-}
-
-export function findEntityFeature(
-  entityName: string,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): string | undefined {
-  for (const [name, feature] of featureMap) {
-    if (feature.entities?.[entityName]) return name;
-  }
-  return undefined;
-}
-
-export function buildUnknownFieldMessage(
-  featureName: string,
-  screenId: string,
-  fieldName: string,
-  entityName: string,
-  knownFields: ReadonlySet<string>,
-): string {
-  const known = [...knownFields].sort().join(", ");
-  return (
-    `[Feature ${featureName}] Screen "${screenId}" references field "${fieldName}" ` +
-    `which does not exist on entity "${entityName}" (known: ${known}).`
-  );
-}
-
-export function collectScreenQns(features: readonly FeatureDefinition[]): Set<string> {
-  const set = new Set<string>();
-  for (const f of features) {
-    for (const screenId of Object.keys(f.screens)) {
-      set.add(qualifyEntityName(f.name, "screen", screenId));
-    }
-  }
-  return set;
-}
-
-// Bare Screen-ids (ohne `<feature>:screen:`-Prefix) aus den qualifizierten
-// QNs — für die app-weite Auflösung von navigate-Targets (s. validateScreens).
-// Spiegelt den Runtime-Router, der bare ids feature-übergreifend matcht.
-export function screenShortIdsFrom(allScreenQns: ReadonlySet<string>): Set<string> {
-  const marker = ":screen:";
-  const set = new Set<string>();
-  for (const qn of allScreenQns) {
-    const at = qn.indexOf(marker);
-    if (at !== -1) set.add(qn.slice(at + marker.length));
-  }
-  return set;
-}
-
-// Short screen-id → every {featureName, screen} that registers it. The
-// runtime router (create-app.tsx) resolves a bare navigate-target short-id by
-// scanning ALL features and taking the first match — so two features
-// registering the same short-id is a silent routing footgun (whichever
-// feature comes first in the app's features[] array always wins, the other
-// is unreachable by that id) and a prerequisite for the entityId-check below
-// (which target screen it resolves to must be unambiguous).
-export function collectScreensByShortId(
-  features: readonly FeatureDefinition[],
-): Map<string, ReadonlyArray<{ readonly featureName: string; readonly screen: ScreenDefinition }>> {
-  const map = new Map<
-    string,
-    Array<{ readonly featureName: string; readonly screen: ScreenDefinition }>
-  >();
-  for (const f of features) {
-    for (const [screenId, screen] of Object.entries(f.screens)) {
-      const entries = map.get(screenId) ?? [];
-      entries.push({ featureName: f.name, screen });
-      map.set(screenId, entries);
-    }
-  }
-  return map;
-}