@inf-monkeys-tech/monkeys 1.0.72 → 1.1.0

package/lib/contracts/declarative-control.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkbenchRuntimeBundleSchema = exports.ResolvedWorkbenchAppInstanceSchema = exports.PageRuntimeBundleSchema = exports.NavigationReleaseSchema = exports.UnavailableNavigationTargetSchema = exports.ResolvedNavigationTargetSchema = exports.NavigationSchema = exports.NavigationNodeSchema = exports.NavigationSeparatorNodeSchema = exports.NavigationTargetNodeSchema = exports.NavigationGroupNodeSchema = exports.WorkbenchReleaseSchema = exports.WorkbenchSchema = exports.WorkbenchAppInstanceSchema = exports.WorkbenchGroupSchema = exports.PageReleaseSchema = exports.PageSchema = exports.ActionBindingSchema = exports.OntologyBindingSchema = exports.CapabilityInstanceSchema = exports.BindingSourceSchema = exports.WorkbenchIdentitySchema = exports.PublicationPlanSchema = exports.PublicationPlanOperationSchema = exports.ReleaseEvidenceSchema = exports.ReleaseValidationSchema = exports.ReleaseDependencySchema = exports.ReleaseDependencyRoleSchema = exports.ReleaseOperationSchema = exports.CompiledRouteClaimSchema = exports.CompiledRouteMatcherSchema = exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema = exports.LegacyRouteClaimSchema = exports.RouteSpaceSchema = exports.RouteSpaceParameterSchema = exports.RoutePathTemplateSchema = exports.ManagementAccessSchema = exports.AccessPolicySchema = exports.ProductSurfaceSchema = exports.DeclarativeLifecycleSchema = exports.StableRefAliasMapSchema = exports.StableRefAliasSchema = exports.RevisionRefSchema = exports.StableRefSchema = exports.ReferenceVisibilitySchema = exports.TenantScopeSchema = exports.ScopedIdentityRefSchema = exports.I18nTextSchema = exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = void 0;
-exports.DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS = exports.DeclarativeControlOntologyDefinitionSchema = exports.NavigationRuntimeBundleSchema = exports.CompiledNavigationNodeSchema = exports.CompiledNavigationSeparatorNodeSchema = exports.CompiledNavigationTargetNodeSchema = exports.CompiledNavigationGroupNodeSchema = exports.CompiledNavigationResolvedTargetSchema = exports.CompiledNavigationDomainCommandTargetSchema = exports.CompiledNavigationRegisteredMenuActionTargetSchema = void 0;
+exports.CursorWindowBindingSchema = exports.DomainQueryDefinitionSchema = exports.DomainQueryDataSourceSchema = exports.RegisteredServiceDomainQueryDataSourceSchema = exports.GovernedCatalogDomainQueryDataSourceSchema = exports.GovernedCatalogResourceKindSchema = exports.InteractionBindingSchema = exports.PageStateDefinitionSchema = exports.LegacyBrowserPreferenceImportSchema = exports.ResolvedPageEntryTransitionSchema = exports.PageEntryTransitionSchema = exports.PageStateActivationSchema = exports.PageStateConditionSchema = exports.BindingSourceSchema = exports.DeclarativeRouteClaimSchema = exports.LegacyRouteTakeoverAuthorizationSchema = exports.LegacySlotRestorationSchema = exports.WorkbenchIdentitySchema = exports.PublicationPlanSchema = exports.PublicationPlanOperationSchema = exports.ReleaseEvidenceSchema = exports.ReleaseValidationSchema = exports.ReleaseDependencySchema = exports.ReleaseDependencyRoleSchema = exports.ReleaseOperationSchema = exports.CompiledRouteClaimSchema = exports.CompiledRouteMatcherSchema = exports.RouteClaimSchema = exports.LegacyRouteClaimSchema = exports.RouteSpaceSchema = exports.RouteSpaceParameterSchema = exports.RoutePathTemplateSchema = exports.ManagementAccessSchema = exports.PermissionAlternativePolicySchema = exports.AccessPolicySchema = exports.DeclarativeRuntimeShellDescriptorSchema = exports.DeclarativeShellSurfaceChromeSchema = exports.DeclarativeShellHeaderChromeSchema = exports.ProductSurfaceSchema = exports.DeclarativeLifecycleSchema = exports.StableRefAliasMapSchema = exports.StableRefAliasSchema = exports.RevisionRefSchema = exports.StableRefSchema = exports.ReferenceVisibilitySchema = exports.TenantScopeSchema = exports.ScopedIdentityRefSchema = exports.I18nTextSchema = exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = exports.analyzePageBindingDependencies = void 0;
+exports.DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS = exports.DeclarativeControlOntologyDefinitionSchema = exports.NavigationRuntimeBundleSchema = exports.CompiledNavigationNodeSchema = exports.CompiledNavigationSeparatorNodeSchema = exports.CompiledNavigationTargetNodeSchema = exports.CompiledNavigationGroupNodeSchema = exports.CompiledNavigationResolvedTargetSchema = exports.CompiledNavigationDomainCommandTargetSchema = exports.CompiledNavigationRegisteredMenuActionTargetSchema = exports.WorkbenchRuntimeBundleSchema = exports.WorkbenchRuntimeIdentitySchema = exports.ResolvedWorkbenchAppInstanceSchema = exports.PageRuntimeBundleSchema = exports.DeclarativeWorkbenchCatalogSchema = exports.DeclarativeWorkbenchCatalogEntrySchema = exports.DeclarativeRouteOwnerIndexSchema = exports.DeclarativeRouteOwnerIndexEntrySchema = exports.NavigationReleaseSchema = exports.UnavailableNavigationTargetSchema = exports.ResolvedNavigationTargetSchema = exports.NavigationSchema = exports.NavigationNodeSchema = exports.NavigationSeparatorNodeSchema = exports.NavigationTargetNodeSchema = exports.NavigationGroupNodeSchema = exports.WorkbenchReleaseSchema = exports.WorkbenchSchema = exports.WorkbenchAppInstanceSchema = exports.WorkbenchGroupSchema = exports.PageReleaseSchema = exports.PageSchema = exports.PageRouteStatePresentationSchema = exports.PageMigrationEquivalenceSchema = exports.PageMigrationEquivalenceDimensionSchema = exports.ActionBindingSchema = exports.ActionResultClipboardEffectSchema = exports.ActionResultBindingEffectSchema = exports.ActionResultBindingEffectSourceSchema = exports.OntologyBindingSchema = exports.CapabilityInstanceSchema = exports.QueryBindingSchema = exports.QueryResultStateBindingSchema = void 0;
 const zod_1 = require("zod");
 const common_1 = require("./common");
 const data_1 = require("./data");
+const legacy_route_1 = require("./legacy-route");
+const file_1 = require("./file");
 const render_1 = require("./render");
+const page_expression_1 = require("./page-expression");
+const page_binding_dependencies_1 = require("./page-binding-dependencies");
+var page_binding_dependencies_2 = require("./page-binding-dependencies");
+Object.defineProperty(exports, "analyzePageBindingDependencies", { enumerable: true, get: function () { return page_binding_dependencies_2.analyzePageBindingDependencies; } });
 exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = 1;
 const uniqueArray = (values, identity) => {
     const seen = new Set();
@@ -17,6 +23,10 @@ const uniqueArray = (values, identity) => {
     }
     return undefined;
 };
+const exactRevisionRef = (left, right) => stableRefIdentity(left) === stableRefIdentity(right) &&
+    left.revision === right.revision &&
+    left.schemaVersion === right.schemaVersion &&
+    left.contentHash === right.contentHash;
 exports.I18nTextSchema = zod_1.z
     .object({
     defaultLocale: common_1.LocaleIdentifierSchema,
@@ -54,7 +64,11 @@ exports.TenantScopeSchema = zod_1.z
     ];
     expectedKinds.forEach(([field, reference, expectedKind]) => {
         if (reference && reference.kind !== expectedKind) {
-            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: 'custom',
+                path: [field, 'kind'],
+                message: `${field} must reference ${expectedKind}.`,
+            });
         }
     });
 });
@@ -68,16 +82,21 @@ const StableRefShape = {
 };
 const validateReferenceScope = (value, context) => {
     if (value.visibility === 'tenant' && !value.tenantScope) {
-        context.addIssue({ code: 'custom', path: ['tenantScope'], message: 'Tenant references require an explicit tenant scope.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['tenantScope'],
+            message: 'Tenant references require an explicit tenant scope.',
+        });
     }
     if (value.visibility !== 'tenant' && value.tenantScope) {
-        context.addIssue({ code: 'custom', path: ['tenantScope'], message: 'Global and public references cannot carry a tenant scope.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['tenantScope'],
+            message: 'Global and public references cannot carry a tenant scope.',
+        });
     }
 };
-exports.StableRefSchema = zod_1.z
-    .object(StableRefShape)
-    .strict()
-    .superRefine(validateReferenceScope);
+exports.StableRefSchema = zod_1.z.object(StableRefShape).strict().superRefine(validateReferenceScope);
 exports.RevisionRefSchema = zod_1.z
     .object({
     ...StableRefShape,
@@ -90,10 +109,17 @@ exports.RevisionRefSchema = zod_1.z
 const scopedIdentityKey = (reference) => `${reference.kind}:${reference.id}:${reference.ownerRepo}`;
 const tenantScopeKey = (scope) => `${scopedIdentityKey(scope.tenantRef)}:${scopedIdentityKey(scope.dataSpaceRef)}:${scope.teamRef ? scopedIdentityKey(scope.teamRef) : ''}`;
 const stableRefIdentity = (reference) => `${reference.visibility}:${reference.tenantScope ? tenantScopeKey(reference.tenantScope) : ''}:${reference.kind}:${reference.id}:${reference.ownerRepo}`;
-const exactRevisionRef = (left, right) => stableRefIdentity(left) === stableRefIdentity(right)
-    && left.revision === right.revision
-    && left.schemaVersion === right.schemaVersion
-    && left.contentHash === right.contentHash;
+const validateTenantCompatibleReference = (reference, tenantScope, path, context) => {
+    if (reference.visibility === 'tenant' &&
+        reference.tenantScope &&
+        tenantScopeKey(reference.tenantScope) !== tenantScopeKey(tenantScope)) {
+        context.addIssue({
+            code: 'custom',
+            path: [...path, 'tenantScope'],
+            message: 'Reference belongs to another tenant scope.',
+        });
+    }
+};
 exports.StableRefAliasSchema = zod_1.z
     .object({
     aliasRef: exports.StableRefSchema,
@@ -105,10 +131,18 @@ exports.StableRefAliasSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     if (value.aliasRef.kind !== value.canonicalRef.kind) {
-        context.addIssue({ code: 'custom', path: ['canonicalRef', 'kind'], message: 'Alias and canonical references must have the same kind.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['canonicalRef', 'kind'],
+            message: 'Alias and canonical references must have the same kind.',
+        });
     }
     if (value.validUntil && value.validUntil <= value.validFrom) {
-        context.addIssue({ code: 'custom', path: ['validUntil'], message: 'Alias validUntil must be later than validFrom.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['validUntil'],
+            message: 'Alias validUntil must be later than validFrom.',
+        });
     }
 });
 exports.StableRefAliasMapSchema = zod_1.z
@@ -123,17 +157,71 @@ exports.StableRefAliasMapSchema = zod_1.z
     .superRefine((value, context) => {
     const duplicate = uniqueArray(value.aliases, (entry) => stableRefIdentity(entry.aliasRef));
     if (duplicate)
-        context.addIssue({ code: 'custom', path: ['aliases'], message: `Duplicate alias reference: ${duplicate}` });
+        context.addIssue({
+            code: 'custom',
+            path: ['aliases'],
+            message: `Duplicate alias reference: ${duplicate}`,
+        });
 });
 exports.DeclarativeLifecycleSchema = zod_1.z.enum(['active', 'deprecated', 'retired']);
 exports.ProductSurfaceSchema = zod_1.z.enum(['studio', 'kernel']);
+exports.DeclarativeShellHeaderChromeSchema = zod_1.z.discriminatedUnion('enabled', [
+    zod_1.z.object({ enabled: zod_1.z.literal(false) }).strict(),
+    zod_1.z
+        .object({
+        enabled: zod_1.z.literal(true),
+        navigationPlacement: zod_1.z.enum(['studio.headbar.primary', 'kernel.primary']),
+    })
+        .strict(),
+]);
+exports.DeclarativeShellSurfaceChromeSchema = zod_1.z
+    .object({
+    surface: exports.ProductSurfaceSchema,
+    header: exports.DeclarativeShellHeaderChromeSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (!value.header.enabled)
+        return;
+    const expectedPlacement = value.surface === 'studio' ? 'studio.headbar.primary' : 'kernel.primary';
+    if (value.header.navigationPlacement !== expectedPlacement) {
+        context.addIssue({
+            code: 'custom',
+            path: ['header', 'navigationPlacement'],
+            message: `The ${value.surface} shell header must use its governed primary Navigation placement.`,
+        });
+    }
+});
+exports.DeclarativeRuntimeShellDescriptorSchema = zod_1.z
+    .object({
+    shellRevisionRef: exports.RevisionRefSchema,
+    header: exports.DeclarativeShellHeaderChromeSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.shellRevisionRef.kind !== 'shell') {
+        context.addIssue({
+            code: 'custom',
+            path: ['shellRevisionRef', 'kind'],
+            message: 'Runtime shell descriptors require an exact Shell revision.',
+        });
+    }
+});
 const GroupRefSchema = exports.StableRefSchema.superRefine((value, context) => {
     if (value.kind !== 'group')
-        context.addIssue({ code: 'custom', path: ['kind'], message: 'Access group references must use kind group.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['kind'],
+            message: 'Access group references must use kind group.',
+        });
 });
 const AccessConditionRefSchema = exports.RevisionRefSchema.superRefine((value, context) => {
     if (value.kind !== 'access-condition') {
-        context.addIssue({ code: 'custom', path: ['kind'], message: 'Access condition references must use kind access-condition.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['kind'],
+            message: 'Access condition references must use kind access-condition.',
+        });
     }
 });
 exports.AccessPolicySchema = zod_1.z
@@ -152,12 +240,62 @@ exports.AccessPolicySchema = zod_1.z
         ['groupAnyOf', value.groupAnyOf, (candidate) => stableRefIdentity(candidate)],
         ['permissionAllOf', value.permissionAllOf, String],
         ['permissionAnyOf', value.permissionAnyOf, String],
-        ['conditionAllOf', value.conditionAllOf, (candidate) => `${stableRefIdentity(candidate)}@${candidate.revision}`],
+        [
+            'conditionAllOf',
+            value.conditionAllOf,
+            (candidate) => `${stableRefIdentity(candidate)}@${candidate.revision}`,
+        ],
     ];
     checks.forEach(([field, values, identity]) => {
         if (uniqueArray(values, identity))
-            context.addIssue({ code: 'custom', path: [field], message: `${field} entries must be unique.` });
+            context.addIssue({
+                code: 'custom',
+                path: [field],
+                message: `${field} entries must be unique.`,
+            });
+    });
+});
+/**
+ * A finite set of permission conjunctions. An identity is authorized when it
+ * satisfies every permission in at least one alternative. This is deliberately
+ * separate from AccessPolicy: it models a versioned rollout compatibility
+ * bridge such as `new-permission OR (legacy-a AND legacy-b)` without turning
+ * individual legacy permissions into broad aliases.
+ */
+exports.PermissionAlternativePolicySchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('PermissionAlternativePolicy'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    policyId: common_1.ContractIdentifierSchema,
+    alternatives: zod_1.z.array(zod_1.z.array(common_1.ContractIdentifierSchema).min(1)).min(1),
+    retirementGate: zod_1.z
+        .object({
+        capability: common_1.ContractIdentifierSchema,
+        notBefore: common_1.IsoDateTimeSchema.optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const canonical = value.alternatives.map((set) => [...new Set(set)].sort());
+    canonical.forEach((set, index) => {
+        if (set.length !== value.alternatives[index].length) {
+            context.addIssue({
+                code: 'custom',
+                path: ['alternatives', index],
+                message: 'A permission alternative cannot contain duplicate permissions.',
+            });
+        }
     });
+    const identities = canonical.map((set) => set.join('\0'));
+    if (new Set(identities).size !== identities.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['alternatives'],
+            message: 'Permission alternatives must be unique.',
+        });
+    }
 });
 exports.ManagementAccessSchema = zod_1.z
     .object({
@@ -175,13 +313,22 @@ exports.RoutePathTemplateSchema = zod_1.z
     .regex(/^\/(?!\/)/, 'Expected an application-relative path.')
     .superRefine((value, context) => {
     if (value.includes('?') || value.includes('#') || value.includes('\\')) {
-        context.addIssue({ code: 'custom', message: 'Route paths cannot contain query strings, fragments, or backslashes.' });
+        context.addIssue({
+            code: 'custom',
+            message: 'Route paths cannot contain query strings, fragments, or backslashes.',
+        });
     }
     if (value.split('/').some((segment) => segment === '.' || segment === '..')) {
-        context.addIssue({ code: 'custom', message: 'Route paths cannot contain traversal segments.' });
+        context.addIssue({
+            code: 'custom',
+            message: 'Route paths cannot contain traversal segments.',
+        });
     }
     if (/^[a-z][a-z0-9+.-]*:/i.test(value) || value.includes('://')) {
-        context.addIssue({ code: 'custom', message: 'Route paths cannot contain a scheme or host.' });
+        context.addIssue({
+            code: 'custom',
+            message: 'Route paths cannot contain a scheme or host.',
+        });
     }
 });
 exports.RouteSpaceParameterSchema = zod_1.z
@@ -206,10 +353,18 @@ exports.RouteSpaceSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     if (uniqueArray(value.parameters, (parameter) => parameter.name)) {
-        context.addIssue({ code: 'custom', path: ['parameters'], message: 'RouteSpace parameter names must be unique.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['parameters'],
+            message: 'RouteSpace parameter names must be unique.',
+        });
     }
     if (uniqueArray(value.reservedPaths, (path) => path)) {
-        context.addIssue({ code: 'custom', path: ['reservedPaths'], message: 'RouteSpace reserved paths must be unique.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['reservedPaths'],
+            message: 'RouteSpace reserved paths must be unique.',
+        });
     }
 });
 const RouteClaimBaseSchema = zod_1.z
@@ -222,27 +377,37 @@ const RouteClaimBaseSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     if (value.routeSpaceRevisionRef.kind !== 'route-space') {
-        context.addIssue({ code: 'custom', path: ['routeSpaceRevisionRef', 'kind'], message: 'Route claims must reference a route-space revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['routeSpaceRevisionRef', 'kind'],
+            message: 'Route claims must reference a route-space revision.',
+        });
     }
     if (value.kind === 'redirect' && !value.redirectTargetRef) {
-        context.addIssue({ code: 'custom', path: ['redirectTargetRef'], message: 'Redirect claims require a governed target reference.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['redirectTargetRef'],
+            message: 'Redirect claims require a governed target reference.',
+        });
     }
     if (value.kind !== 'redirect' && value.redirectTargetRef) {
-        context.addIssue({ code: 'custom', path: ['redirectTargetRef'], message: 'Only redirect claims may declare redirectTargetRef.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['redirectTargetRef'],
+            message: 'Only redirect claims may declare redirectTargetRef.',
+        });
     }
 });
 /**
  * Read compatibility for schemaVersion 1 Page and Workbench records written
  * before route claims carried their owning product surface. New declarations
- * must use RouteClaimSchema; compilers infer this legacy form only from the
- * exact pinned RouteSpace.
+ * must use RouteClaimSchema; compilers materialize this legacy form only from
+ * the exact pinned RouteSpace surface.
  */
 exports.LegacyRouteClaimSchema = RouteClaimBaseSchema;
 exports.RouteClaimSchema = RouteClaimBaseSchema.safeExtend({
     surface: exports.ProductSurfaceSchema,
 }).strict();
-exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema;
-const LegacyDeclarativeRouteClaimSchema = exports.LegacyRouteClaimSchema;
 const LegacyCompiledRouteMatcherSchema = zod_1.z
     .object({
     caseSensitive: zod_1.z.boolean(),
@@ -256,32 +421,32 @@ exports.CompiledRouteMatcherSchema = LegacyCompiledRouteMatcherSchema.safeExtend
 exports.CompiledRouteClaimSchema = exports.RouteClaimSchema.safeExtend({
     normalizedPath: exports.RoutePathTemplateSchema,
     matcher: exports.CompiledRouteMatcherSchema,
-}).strict();
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.matcher.surface !== value.surface) {
+        context.addIssue({
+            code: 'custom',
+            path: ['matcher', 'surface'],
+            message: 'A compiled route matcher must match its claim surface.',
+        });
+    }
+});
 const LegacyCompiledRouteClaimSchema = exports.LegacyRouteClaimSchema.safeExtend({
     normalizedPath: exports.RoutePathTemplateSchema,
     matcher: LegacyCompiledRouteMatcherSchema,
 }).strict();
-const validateDeclaredRouteSurfaces = (supportedSurfaces, routeClaims, context) => {
-    if (uniqueArray(supportedSurfaces, (surface) => surface)) {
-        context.addIssue({ code: 'custom', path: ['supportedSurfaces'], message: 'Supported surfaces must be unique.' });
-    }
-    const explicitClaims = routeClaims.filter((claim) => 'surface' in claim);
-    if (explicitClaims.length > 0 && explicitClaims.length < routeClaims.length) {
-        context.addIssue({ code: 'custom', path: ['routeClaims'], message: 'Route claims must either all declare surface or all omit it for legacy compatibility.' });
+const validateReleaseRouteSurface = (target, context) => {
+    const claimSurface = 'surface' in target.routeClaim ? target.routeClaim.surface : undefined;
+    const matcherSurface = 'surface' in target.routeClaim.matcher ? target.routeClaim.matcher.surface : undefined;
+    if (claimSurface === undefined && matcherSurface === undefined)
         return;
-    }
-    routeClaims.forEach((claim, index) => {
-        if ('surface' in claim && !supportedSurfaces.includes(claim.surface)) {
-            context.addIssue({ code: 'custom', path: ['routeClaims', index, 'surface'], message: 'Route claim surface must be declared by supportedSurfaces.' });
-        }
-    });
-    if (explicitClaims.length !== routeClaims.length)
+    if (claimSurface === target.surface && matcherSurface === target.surface)
         return;
-    supportedSurfaces.forEach((surface) => {
-        const canonicalCount = explicitClaims.filter((claim) => claim.surface === surface && claim.kind === 'canonical').length;
-        if (canonicalCount !== 1) {
-            context.addIssue({ code: 'custom', path: ['routeClaims'], message: `Surface ${surface} requires exactly one canonical route claim.` });
-        }
+    context.addIssue({
+        code: 'custom',
+        path: ['target', 'routeClaim'],
+        message: 'A compiled Release route claim must either be fully legacy or bind both claim and matcher to the target surface.',
     });
 };
 exports.ReleaseOperationSchema = zod_1.z.enum(['activate', 'deactivate', 'rollback']);
@@ -299,6 +464,7 @@ exports.ReleaseDependencyRoleSchema = zod_1.z.enum([
     'capability',
     'provider',
     'ontology-definition',
+    'query-definition',
     'view',
     'projection',
     'action',
@@ -327,6 +493,7 @@ const DependencyKindByRole = {
     capability: 'capability',
     provider: 'view-provider',
     'ontology-definition': 'ontology-definition',
+    'query-definition': 'domain-query-definition',
     view: 'view',
     projection: 'projection',
     action: 'domain-command',
@@ -387,12 +554,20 @@ exports.ReleaseEvidenceSchema = zod_1.z
     ];
     expectedKinds.forEach(([field, reference, expectedKind]) => {
         if (reference.kind !== expectedKind) {
-            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: 'custom',
+                path: [field, 'kind'],
+                message: `${field} must reference ${expectedKind}.`,
+            });
         }
     });
     value.evidenceRefs.forEach((reference, index) => {
         if (reference.kind !== 'evidence')
-            context.addIssue({ code: 'custom', path: ['evidenceRefs', index, 'kind'], message: 'Release evidenceRefs must reference evidence revisions.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['evidenceRefs', index, 'kind'],
+                message: 'Release evidenceRefs must reference evidence revisions.',
+            });
     });
 });
 exports.PublicationPlanOperationSchema = zod_1.z
@@ -405,11 +580,20 @@ exports.PublicationPlanOperationSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     if (value.releaseRevisionRef.kind !== value.releaseKind || value.releaseRevisionRef.id !== value.releaseSlotId) {
-        context.addIssue({ code: 'custom', path: ['releaseRevisionRef'], message: 'Publication Plan operation must pin the exact release slot revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['releaseRevisionRef'],
+            message: 'Publication Plan operation must pin the exact release slot revision.',
+        });
     }
-    if (value.expectedHeadRevisionRef
-        && (value.expectedHeadRevisionRef.kind !== value.releaseKind || value.expectedHeadRevisionRef.id !== value.releaseSlotId)) {
-        context.addIssue({ code: 'custom', path: ['expectedHeadRevisionRef'], message: 'Expected head must identify the same release slot.' });
+    if (value.expectedHeadRevisionRef &&
+        (value.expectedHeadRevisionRef.kind !== value.releaseKind ||
+            value.expectedHeadRevisionRef.id !== value.releaseSlotId)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['expectedHeadRevisionRef'],
+            message: 'Expected head must identify the same release slot.',
+        });
     }
 });
 exports.PublicationPlanSchema = zod_1.z
@@ -431,7 +615,12 @@ exports.PublicationPlanSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     if (value.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['environmentRef', 'kind'], message: 'Publication Plan requires an environment reference.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['environmentRef', 'kind'],
+            message: 'Publication Plan requires an environment reference.',
+        });
+    validateTenantCompatibleReference(value.environmentRef, value.tenantScope, ['environmentRef'], context);
     const governedRefs = [
         ['approvalPolicyRevisionRef', value.approvalPolicyRevisionRef, 'approval-policy'],
         ['approvalDecisionRevisionRef', value.approvalDecisionRevisionRef, 'approval-decision'],
@@ -439,22 +628,40 @@ exports.PublicationPlanSchema = zod_1.z
     ];
     governedRefs.forEach(([field, reference, expectedKind]) => {
         if (reference.kind !== expectedKind)
-            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: 'custom',
+                path: [field, 'kind'],
+                message: `${field} must reference ${expectedKind}.`,
+            });
+        validateTenantCompatibleReference(reference, value.tenantScope, [field], context);
     });
     value.operations.forEach((operation, index) => {
         [operation.releaseRevisionRef, operation.expectedHeadRevisionRef].forEach((reference, referenceIndex) => {
             if (reference?.tenantScope && tenantScopeKey(reference.tenantScope) !== tenantScopeKey(value.tenantScope)) {
                 const field = referenceIndex === 0 ? 'releaseRevisionRef' : 'expectedHeadRevisionRef';
-                context.addIssue({ code: 'custom', path: ['operations', index, field, 'tenantScope'], message: 'Publication Plan operation belongs to another tenant scope.' });
+                context.addIssue({
+                    code: 'custom',
+                    path: ['operations', index, field, 'tenantScope'],
+                    message: 'Publication Plan operation belongs to another tenant scope.',
+                });
             }
         });
     });
     value.evidenceRefs.forEach((reference, index) => {
         if (reference.kind !== 'evidence')
-            context.addIssue({ code: 'custom', path: ['evidenceRefs', index, 'kind'], message: 'Publication Plan evidenceRefs must reference evidence revisions.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['evidenceRefs', index, 'kind'],
+                message: 'Publication Plan evidenceRefs must reference evidence revisions.',
+            });
+        validateTenantCompatibleReference(reference, value.tenantScope, ['evidenceRefs', index], context);
     });
     if (uniqueArray(value.operations, (operation) => `${operation.releaseKind}:${operation.releaseSlotId}`)) {
-        context.addIssue({ code: 'custom', path: ['operations'], message: 'Publication Plan release slots must be unique.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['operations'],
+            message: 'Publication Plan release slots must be unique.',
+        });
     }
 });
 const IdentitySchema = zod_1.z
@@ -464,105 +671,1266 @@ const IdentitySchema = zod_1.z
     tags: zod_1.z.array(common_1.ContractIdentifierSchema).default([]),
 })
     .strict();
-exports.WorkbenchIdentitySchema = IdentitySchema.extend({ iconRef: exports.StableRefSchema.optional() }).strict();
+exports.WorkbenchIdentitySchema = IdentitySchema.extend({
+    iconRef: exports.StableRefSchema.optional(),
+}).strict();
+exports.LegacySlotRestorationSchema = zod_1.z
+    .object({
+    legacyAdapterRevisionRef: exports.RevisionRefSchema,
+    sourceRevisionRef: exports.RevisionRefSchema,
+    inspectedSourceContentHash: common_1.Sha256Schema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.sourceRevisionRef.contentHash !== value.inspectedSourceContentHash) {
+        context.addIssue({
+            code: 'custom',
+            path: ['inspectedSourceContentHash'],
+            message: 'Legacy restoration must pin the exact inspected source revision hash.',
+        });
+    }
+});
+/**
+ * Exact, inspect-produced authority for taking over one predeclared legacy
+ * route. It is not a general reserved-route bypass: compiler validation binds
+ * it to one canonical claim, one target resource and the exact inspected
+ * source/adaptor revisions.
+ */
+exports.LegacyRouteTakeoverAuthorizationSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('LegacyRouteTakeoverAuthorization'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    routeSpaceRevisionRef: exports.RevisionRefSchema,
+    normalizedPath: exports.RoutePathTemplateSchema,
+    legacyAdapterRevisionRef: exports.RevisionRefSchema,
+    sourceRevisionRef: exports.RevisionRefSchema,
+    inspectedSourceContentHash: common_1.Sha256Schema,
+    targetResourceRef: exports.StableRefSchema,
+    workbenchCatalogDefaults: zod_1.z
+        .object({ order: zod_1.z.number().int(), isDefaultCandidate: zod_1.z.boolean() })
+        .strict()
+        .optional(),
+    contentHash: common_1.Sha256Schema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.routeSpaceRevisionRef.kind !== 'route-space') {
+        context.addIssue({
+            code: 'custom',
+            path: ['routeSpaceRevisionRef', 'kind'],
+            message: 'A route takeover must pin a RouteSpace revision.',
+        });
+    }
+    if (value.legacyAdapterRevisionRef.kind !== 'legacy-route-adapter') {
+        context.addIssue({
+            code: 'custom',
+            path: ['legacyAdapterRevisionRef', 'kind'],
+            message: 'A route takeover must pin a legacy-route-adapter revision.',
+        });
+    }
+    if (!['page', 'workbench'].includes(value.targetResourceRef.kind)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['targetResourceRef', 'kind'],
+            message: 'A route takeover target must be a Page or Workbench.',
+        });
+    }
+    if (value.sourceRevisionRef.contentHash !== value.inspectedSourceContentHash) {
+        context.addIssue({
+            code: 'custom',
+            path: ['inspectedSourceContentHash'],
+            message: 'A route takeover must pin the exact inspected legacy source hash.',
+        });
+    }
+    if (value.targetResourceRef.kind === 'workbench' && !value.workbenchCatalogDefaults) {
+        context.addIssue({
+            code: 'custom',
+            path: ['workbenchCatalogDefaults'],
+            message: 'A Workbench takeover must preserve exact legacy catalog order and default semantics.',
+        });
+    }
+    if (value.targetResourceRef.kind === 'page' && value.workbenchCatalogDefaults) {
+        context.addIssue({
+            code: 'custom',
+            path: ['workbenchCatalogDefaults'],
+            message: 'Page takeover provenance cannot carry Workbench catalog defaults.',
+        });
+    }
+});
+/** Authoring-only route evidence. Runtime compilation deliberately strips the takeover proof. */
+exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema.safeExtend({
+    legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
+}).strict();
+const LegacyDeclarativeRouteClaimSchema = exports.LegacyRouteClaimSchema.safeExtend({
+    legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
+}).strict();
+const validateDeclaredRouteSurfaces = (supportedSurfaces, routeClaims, context) => {
+    if (uniqueArray(supportedSurfaces, (surface) => surface)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['supportedSurfaces'],
+            message: 'Supported surfaces must be unique.',
+        });
+    }
+    const explicitClaims = routeClaims.filter((claim) => 'surface' in claim);
+    if (explicitClaims.length > 0 && explicitClaims.length < routeClaims.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['routeClaims'],
+            message: 'Route claims must either all declare surface or all omit it for legacy compatibility.',
+        });
+        return;
+    }
+    routeClaims.forEach((claim, index) => {
+        if ('surface' in claim && !supportedSurfaces.includes(claim.surface)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['routeClaims', index, 'surface'],
+                message: 'Route claim surface must be declared by supportedSurfaces.',
+            });
+        }
+    });
+    if (explicitClaims.length !== routeClaims.length)
+        return;
+    supportedSurfaces.forEach((surface) => {
+        const canonicalCount = explicitClaims.filter((claim) => claim.surface === surface && claim.kind === 'canonical').length;
+        if (canonicalCount !== 1) {
+            context.addIssue({
+                code: 'custom',
+                path: ['routeClaims'],
+                message: `Surface ${surface} requires exactly one canonical route claim.`,
+            });
+        }
+    });
+};
 const ReleaseBaseShape = {
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     releaseSlotId: common_1.ContractIdentifierSchema,
     tenantScope: exports.TenantScopeSchema,
     operation: exports.ReleaseOperationSchema,
+    legacyRestoration: exports.LegacySlotRestorationSchema.optional(),
     dependencySnapshot: zod_1.z.array(exports.ReleaseDependencySchema),
     evidence: exports.ReleaseEvidenceSchema,
 };
+const validateLegacyRestoration = (value, expectedAdapterKind, context) => {
+    if (value.operation === 'activate' && value.legacyRestoration) {
+        context.addIssue({
+            code: 'custom',
+            path: ['legacyRestoration'],
+            message: 'An active declarative Release cannot also restore a legacy adapter.',
+        });
+    }
+    if (value.legacyRestoration?.legacyAdapterRevisionRef.kind !== undefined &&
+        value.legacyRestoration.legacyAdapterRevisionRef.kind !== expectedAdapterKind) {
+        context.addIssue({
+            code: 'custom',
+            path: ['legacyRestoration', 'legacyAdapterRevisionRef', 'kind'],
+            message: `Legacy restoration requires adapter kind ${expectedAdapterKind}.`,
+        });
+    }
+};
 const validateDependencySnapshot = (snapshot, context) => {
     const duplicate = uniqueArray(snapshot, (dependency) => `${dependency.role}:${stableRefIdentity(dependency.revisionRef)}@${dependency.revisionRef.revision}`);
     if (duplicate)
-        context.addIssue({ code: 'custom', path: ['dependencySnapshot'], message: `Duplicate dependency: ${duplicate}` });
+        context.addIssue({
+            code: 'custom',
+            path: ['dependencySnapshot'],
+            message: `Duplicate dependency: ${duplicate}`,
+        });
 };
-const validateReleaseExpectedHead = (value, expectedKind, context) => {
+const validateReleaseGovernanceScope = (value, expectedKind, context) => {
     const expectedHead = value.evidence.expectedHeadRevisionRef;
     if (expectedHead && (expectedHead.kind !== expectedKind || expectedHead.id !== value.releaseSlotId)) {
-        context.addIssue({ code: 'custom', path: ['evidence', 'expectedHeadRevisionRef'], message: 'Expected head must identify the same release slot.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['evidence', 'expectedHeadRevisionRef'],
+            message: 'Expected head must identify the same release slot.',
+        });
     }
     if (expectedHead?.tenantScope && tenantScopeKey(expectedHead.tenantScope) !== tenantScopeKey(value.tenantScope)) {
-        context.addIssue({ code: 'custom', path: ['evidence', 'expectedHeadRevisionRef', 'tenantScope'], message: 'Expected head belongs to another tenant scope.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['evidence', 'expectedHeadRevisionRef', 'tenantScope'],
+            message: 'Expected head belongs to another tenant scope.',
+        });
     }
+    const governedEvidenceRefs = [
+        [['evidence', 'publicationPlanRef'], value.evidence.publicationPlanRef],
+        [['evidence', 'approvalPolicyRevisionRef'], value.evidence.approvalPolicyRevisionRef],
+        [['evidence', 'approvalDecisionRevisionRef'], value.evidence.approvalDecisionRevisionRef],
+        [['evidence', 'actorRef'], value.evidence.actorRef],
+        ...value.evidence.validation.diagnosticRefs.map((reference, index) => [['evidence', 'validation', 'diagnosticRefs', index], reference]),
+        ...value.evidence.evidenceRefs.map((reference, index) => [['evidence', 'evidenceRefs', index], reference]),
+        ...(expectedHead ? [[['evidence', 'expectedHeadRevisionRef'], expectedHead]] : []),
+        ...(value.legacyRestoration
+            ? [
+                [
+                    ['legacyRestoration', 'legacyAdapterRevisionRef'],
+                    value.legacyRestoration.legacyAdapterRevisionRef,
+                ],
+                [['legacyRestoration', 'sourceRevisionRef'], value.legacyRestoration.sourceRevisionRef],
+            ]
+            : []),
+    ];
+    governedEvidenceRefs.forEach(([path, reference]) => validateTenantCompatibleReference(reference, value.tenantScope, [...path], context));
 };
 exports.BindingSourceSchema = zod_1.z.discriminatedUnion('kind', [
-    zod_1.z.object({ kind: zod_1.z.literal('constant'), value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]) }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('route-parameter'), name: common_1.ContractIdentifierSchema }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('query-parameter'), name: common_1.ContractIdentifierSchema }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('identity'), name: zod_1.z.enum(['tenantId', 'teamId', 'userId']) }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('intent-field'), path: zod_1.z.string().trim().regex(/^[A-Za-z0-9_.-]+$/) }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('binding-field'), bindingId: common_1.ContractIdentifierSchema, path: zod_1.z.string().trim().regex(/^[A-Za-z0-9_.-]+$/) }).strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('scope-field'), path: zod_1.z.string().trim().min(1).max(4096).regex(/^[A-Za-z0-9_.-]+$/).refine((path) => path.split('.').length <= 16 && path.split('.').every((part) => part.length > 0 && !['__proto__', 'prototype', 'constructor'].includes(part)), 'Scope paths require safe own members.') }).strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('binding-field'),
+        bindingId: common_1.ContractIdentifierSchema,
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('constant'),
+        value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('route-parameter'),
+        name: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('query-parameter'),
+        name: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('identity'),
+        name: zod_1.z.enum(['tenantId', 'teamId', 'userId']),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('intent-field'),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('page-state'),
+        stateId: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
 ]);
-exports.CapabilityInstanceSchema = zod_1.z
+const ExpressionBindingSourceSchema = zod_1.z.object({ kind: zod_1.z.literal('expression'), expression: page_expression_1.PageExpressionSchema }).strict().superRefine((value, context) => {
+    if ((0, page_expression_1.collectPageExpressionReads)(value.expression).some(read => read.root === 'actions'))
+        context.addIssue({ code: 'custom', path: ['expression'], message: 'Action runtime state is presentation-only and cannot influence an input or state transition.' });
+});
+const FileFieldBindingSourceSchema = zod_1.z.object({ kind: zod_1.z.literal('file-field'), fileInputId: common_1.ContractIdentifierSchema, path: zod_1.z.enum(['fileName', 'content', 'canonicalUri']) }).strict();
+const ActionFileInputSchema = zod_1.z.object({
+    inputId: common_1.ContractIdentifierSchema,
+    source: zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({ kind: zod_1.z.literal('page-state'), stateId: common_1.ContractIdentifierSchema }).strict(),
+        zod_1.z.object({ kind: zod_1.z.literal('intent-field'), path: zod_1.z.string().trim().regex(/^[A-Za-z0-9_.-]+$/) }).strict(),
+    ]),
+    maxBytes: zod_1.z.number().int().min(1).max(5368709120),
+    upload: zod_1.z.object({ purpose: file_1.FilePurposeSchema }).strict().optional(),
+    accept: zod_1.z.string().min(1).max(256).optional(),
+}).strict().superRefine((value, context) => {
+    if (!value.upload && value.maxBytes > 1048576)
+        context.addIssue({ code: 'custom', path: ['maxBytes'], message: 'Inline text files are limited to one MiB.' });
+});
+const ActionInputBindingSourceSchema = zod_1.z.discriminatedUnion('kind', [...exports.BindingSourceSchema.options, ExpressionBindingSourceSchema, FileFieldBindingSourceSchema]);
+const InteractionBindingSourceSchema = zod_1.z.discriminatedUnion('kind', [
+    ExpressionBindingSourceSchema,
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('constant'),
+        value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('intent-field'),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('result-field'),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('page-state'),
+        stateId: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+]);
+const PageStateComparableLiteralSchema = zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]);
+exports.PageStateConditionSchema = zod_1.z.discriminatedUnion('predicate', [
+    zod_1.z
+        .object({
+        stateId: common_1.ContractIdentifierSchema,
+        predicate: zod_1.z.literal('equals'),
+        value: PageStateComparableLiteralSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        stateId: common_1.ContractIdentifierSchema,
+        predicate: zod_1.z.literal('not-equals'),
+        value: PageStateComparableLiteralSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        stateId: common_1.ContractIdentifierSchema,
+        predicate: zod_1.z.literal('truthy'),
+    })
+        .strict(),
+]);
+/**
+ * A recursive boolean expression over governed Page state. Keeping leaf
+ * conditions inside the original `conditions` array preserves the v1 flat
+ * declaration while allowing groups to be nested without a parallel DSL.
+ */
+exports.PageStateActivationSchema = zod_1.z.lazy(() => zod_1.z
     .object({
-    instanceId: common_1.ContractIdentifierSchema,
-    nodeId: common_1.ContractIdentifierSchema,
-    capabilityRevisionRef: exports.RevisionRefSchema,
-    providerRevisionRef: exports.RevisionRefSchema,
-    propertySchemaRevisionRef: exports.RevisionRefSchema,
-    properties: common_1.JsonObjectSchema,
-    allowedSideEffects: zod_1.z.array(zod_1.z.enum(['network', 'storage', 'navigation', 'worker', 'websocket'])),
+    operator: zod_1.z.enum(['all', 'any']),
+    conditions: zod_1.z.array(zod_1.z.union([exports.PageStateConditionSchema, exports.PageStateActivationSchema])).min(1),
 })
-    .strict();
-exports.OntologyBindingSchema = zod_1.z
+    .strict());
+const forEachPageStateCondition = (activation, visit, path = []) => {
+    activation.conditions.forEach((candidate, index) => {
+        const candidatePath = [...path, 'conditions', index];
+        if ('operator' in candidate) {
+            forEachPageStateCondition(candidate, visit, candidatePath);
+            return;
+        }
+        visit(candidate, candidatePath);
+    });
+};
+const PageRouteValueSourceSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal('route-parameter'), name: common_1.ContractIdentifierSchema }).strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('constant'),
+        value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean()]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('page-state'),
+        stateId: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+]);
+/**
+ * Declares an ordered, state-driven route transition owned by one exact Page
+ * revision. The compiler resolves targetRef to one active governed Release;
+ * raw URLs and application-specific route switches are deliberately excluded.
+ */
+exports.PageEntryTransitionSchema = zod_1.z
     .object({
-    bindingId: common_1.ContractIdentifierSchema,
-    ontologyDefinitionRevisionRef: exports.RevisionRefSchema,
-    viewRevisionRef: exports.RevisionRefSchema.optional(),
-    projectionRevisionRef: exports.RevisionRefSchema.optional(),
-    parameters: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
-    target: zod_1.z.object({ capabilityInstanceId: common_1.ContractIdentifierSchema, port: common_1.ContractIdentifierSchema }).strict(),
-    renderModelSchemaRevisionRef: exports.RevisionRefSchema,
-    pagination: zod_1.z.enum(['none', 'cursor', 'offset']),
-    cache: zod_1.z.enum(['none', 'identity-scoped', 'tenant-scoped']),
-    cancelOnChange: zod_1.z.boolean(),
+    browsingContext: zod_1.z.enum(['same', 'new']).optional(),
+    gestureSource: zod_1.z
+        .object({ capabilityInstanceId: common_1.ContractIdentifierSchema, port: common_1.ContractIdentifierSchema })
+        .strict()
+        .optional(),
+    transitionId: common_1.ContractIdentifierSchema,
+    activation: exports.PageStateActivationSchema,
+    targetRef: exports.StableRefSchema,
+    pathParameters: zod_1.z.record(common_1.ContractIdentifierSchema, PageRouteValueSourceSchema),
+    query: zod_1.z
+        .object({
+        preserve: zod_1.z.boolean(),
+        remove: zod_1.z.array(common_1.ContractIdentifierSchema),
+        set: zod_1.z.record(common_1.ContractIdentifierSchema, PageRouteValueSourceSchema),
+    })
+        .strict(),
 })
     .strict()
     .superRefine((value, context) => {
-    if ((value.viewRevisionRef ? 1 : 0) + (value.projectionRevisionRef ? 1 : 0) !== 1) {
-        context.addIssue({ code: 'custom', path: ['viewRevisionRef'], message: 'Ontology bindings require exactly one View or Projection revision.' });
+    if ((value.browsingContext === 'new') !== Boolean(value.gestureSource)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['gestureSource'],
+            message: 'New-context entry transitions require an exact gesture source; same-context transitions must omit it.',
+        });
     }
-    if (value.ontologyDefinitionRevisionRef.kind !== 'ontology-definition') {
-        context.addIssue({ code: 'custom', path: ['ontologyDefinitionRevisionRef', 'kind'], message: 'Expected an ontology-definition revision.' });
+    if (!['page', 'workbench'].includes(value.targetRef.kind)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['targetRef', 'kind'],
+            message: 'Page entry transitions must reference a governed Page or Workbench.',
+        });
+    }
+    if (new Set(value.query.remove).size !== value.query.remove.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['query', 'remove'],
+            message: 'Removed query parameter names must be unique.',
+        });
+    }
+});
+exports.ResolvedPageEntryTransitionSchema = exports.PageEntryTransitionSchema.safeExtend({
+    targetRevisionRef: exports.RevisionRefSchema,
+    targetReleaseRevisionRef: exports.RevisionRefSchema.optional(),
+    targetAccessPolicy: exports.AccessPolicySchema,
+    targetRouteClaim: exports.CompiledRouteClaimSchema,
+}).strict();
+exports.LegacyBrowserPreferenceImportSchema = zod_1.z
+    .object({
+    storageKey: zod_1.z.string().trim().min(1).max(256),
+    jsonPath: zod_1.z
+        .array(zod_1.z.union([zod_1.z.string().trim().min(1).max(128), zod_1.z.object({ stateId: common_1.ContractIdentifierSchema }).strict()]))
+        .min(1)
+        .max(16)
+        .optional(),
+    valueType: zod_1.z.enum(['string', 'number', 'boolean-01', 'json']),
+})
+    .strict();
+exports.PageStateDefinitionSchema = zod_1.z
+    .object({
+    stateId: common_1.ContractIdentifierSchema,
+    scopeNodeId: common_1.ContractIdentifierSchema.optional(),
+    initialValue: page_expression_1.PageExpressionSchema.optional(),
+    schemaRevisionRef: exports.RevisionRefSchema,
+    defaultValue: common_1.JsonValueSchema.optional(),
+    persistence: zod_1.z.enum(['none', 'session', 'url', 'tenant-preference', 'url-with-tenant-preference']),
+    urlWriteback: zod_1.z.enum(['synchronize', 'never']).optional(),
+    preferencePartitionStateId: common_1.ContractIdentifierSchema.optional(),
+    legacyBrowserPreferenceImport: exports.LegacyBrowserPreferenceImportSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.scopeNodeId && value.persistence !== 'none')
+        context.addIssue({ code: 'custom', path: ['persistence'], message: 'Repeated instance state must not persist outside its instance.' });
+    if (value.initialValue && !value.scopeNodeId && (value.persistence !== 'none' || value.initialValue.kind !== 'read' || value.initialValue.root !== 'state' || value.initialValue.path.length !== 1))
+        context.addIssue({ code: 'custom', path: ['initialValue'], message: 'Root initialization must directly read one persisted Page state into non-persistent state.' });
+    if (value.schemaRevisionRef.kind !== 'schema') {
+        context.addIssue({
+            code: 'custom',
+            path: ['schemaRevisionRef', 'kind'],
+            message: 'Page state must pin an exact schema revision.',
+        });
+    }
+    if (value.preferencePartitionStateId !== undefined &&
+        value.persistence !== 'tenant-preference' &&
+        value.persistence !== 'url-with-tenant-preference') {
+        context.addIssue({
+            code: 'custom',
+            path: ['preferencePartitionStateId'],
+            message: 'Preference partitioning requires tenant preference state.',
+        });
+    }
+    if (value.urlWriteback !== undefined &&
+        value.persistence !== 'url' &&
+        value.persistence !== 'url-with-tenant-preference') {
+        context.addIssue({
+            code: 'custom',
+            path: ['urlWriteback'],
+            message: 'URL writeback is only valid for URL-backed Page state.',
+        });
+    }
+});
+exports.InteractionBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    source: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
+    sourceResultSchemaRevisionRef: exports.RevisionRefSchema.optional(),
+    targetStateId: common_1.ContractIdentifierSchema,
+    transition: zod_1.z.enum(['set', 'merge', 'toggle', 'append', 'remove', 'reset']),
+    inputMapping: zod_1.z.record(common_1.ContractIdentifierSchema, InteractionBindingSourceSchema),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.sourceIntentSchemaRevisionRef.kind !== 'schema') {
+        context.addIssue({
+            code: 'custom',
+            path: ['sourceIntentSchemaRevisionRef', 'kind'],
+            message: 'Interaction source intents must pin a schema revision.',
+        });
+    }
+    const mapsResult = Object.values(value.inputMapping).some((source) => source.kind === 'result-field' || (source.kind === 'expression' && (0, page_expression_1.collectPageExpressionReads)(source.expression).some((read) => read.root === 'result')));
+    if (mapsResult && !value.sourceResultSchemaRevisionRef) {
+        context.addIssue({
+            code: 'custom',
+            path: ['sourceResultSchemaRevisionRef'],
+            message: 'Result-field interactions must pin the exact Action result schema revision.',
+        });
+    }
+    if (value.sourceResultSchemaRevisionRef?.kind !== undefined &&
+        value.sourceResultSchemaRevisionRef.kind !== 'schema') {
+        context.addIssue({
+            code: 'custom',
+            path: ['sourceResultSchemaRevisionRef', 'kind'],
+            message: 'Interaction source results must pin a schema revision.',
+        });
+    }
+    if (!mapsResult && value.sourceResultSchemaRevisionRef) {
+        context.addIssue({
+            code: 'custom',
+            path: ['sourceResultSchemaRevisionRef'],
+            message: 'Interaction result schemas are only valid when inputMapping declares a result-field source.',
+        });
+    }
+    const mappedInputs = Object.keys(value.inputMapping);
+    if ((value.transition === 'toggle' || value.transition === 'reset') && mappedInputs.length > 0) {
+        context.addIssue({
+            code: 'custom',
+            path: ['inputMapping'],
+            message: `${value.transition} transitions cannot declare mapped inputs.`,
+        });
+    }
+    if (value.transition !== 'toggle' && value.transition !== 'reset' && mappedInputs.length === 0) {
+        context.addIssue({
+            code: 'custom',
+            path: ['inputMapping'],
+            message: `${value.transition} transitions require at least one mapped input.`,
+        });
+    }
+});
+exports.GovernedCatalogResourceKindSchema = zod_1.z.enum(['tag', 'tag-group', 'feature-column']);
+exports.GovernedCatalogDomainQueryDataSourceSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal('governed-catalog'),
+    resourceKind: exports.GovernedCatalogResourceKindSchema,
+})
+    .strict();
+exports.RegisteredServiceDomainQueryDataSourceSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal('registered-service'),
+})
+    .strict();
+exports.DomainQueryDataSourceSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal('exact-view') }).strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('tenant-catalog'),
+        resource: zod_1.z.enum(['ontology', 'view']),
+        ontologyIdParameter: common_1.ContractIdentifierSchema.optional(),
+    })
+        .strict()
+        .superRefine((source, context) => {
+        if (source.resource === 'view' && !source.ontologyIdParameter) {
+            context.addIssue({
+                code: 'custom',
+                path: ['ontologyIdParameter'],
+                message: 'A tenant View catalog must declare the input parameter that scopes it to one Ontology.',
+            });
+        }
+        if (source.resource === 'ontology' && source.ontologyIdParameter) {
+            context.addIssue({
+                code: 'custom',
+                path: ['ontologyIdParameter'],
+                message: 'An Ontology catalog cannot be pre-scoped by an Ontology input.',
+            });
+        }
+    }),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('tenant-current-view'),
+        ontologyIdParameter: common_1.ContractIdentifierSchema,
+        viewIdParameter: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('page-state') }).strict(),
+    exports.GovernedCatalogDomainQueryDataSourceSchema,
+    exports.RegisteredServiceDomainQueryDataSourceSchema,
+]);
+exports.DomainQueryDefinitionSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('DomainQueryDefinition'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    queryId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    dataSource: exports.DomainQueryDataSourceSchema.optional(),
+    handlerRef: common_1.EntityRefSchema.optional(),
+    ontologyDefinitionRevisionRef: exports.RevisionRefSchema.optional(),
+    viewRevisionRef: exports.RevisionRefSchema.optional(),
+    canonicalDataViewRevisionRef: exports.RevisionRefSchema.optional(),
+    inputSchemaRevisionRef: exports.RevisionRefSchema,
+    resultSchemaRevisionRef: exports.RevisionRefSchema,
+    accessPolicy: exports.AccessPolicySchema,
+    lineageRequired: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const sourceKind = value.dataSource?.kind ?? 'exact-view';
+    const exactDataRefs = [
+        value.ontologyDefinitionRevisionRef,
+        value.viewRevisionRef,
+        value.canonicalDataViewRevisionRef,
+    ];
+    if (sourceKind === 'exact-view' && exactDataRefs.some((reference) => !reference)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['dataSource'],
+            message: 'An exact-view Domain Query must pin Ontology, governed View, and canonical Data View revisions.',
+        });
+    }
+    if (sourceKind !== 'exact-view' && exactDataRefs.some(Boolean)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['dataSource'],
+            message: 'A non-View Domain Query cannot also pin one fixed View.',
+        });
+    }
+    if (value.dataSource && (!value.handlerRef || value.handlerRef.version === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['handlerRef'],
+            message: 'A source-aware Domain Query must pin its release-owned handler version.',
+        });
+    }
+    const refs = [
+        ...(sourceKind === 'exact-view' && value.ontologyDefinitionRevisionRef
+            ? [['ontologyDefinitionRevisionRef', value.ontologyDefinitionRevisionRef, 'ontology-definition']]
+            : []),
+        ...(sourceKind === 'exact-view' && value.viewRevisionRef
+            ? [['viewRevisionRef', value.viewRevisionRef, 'view']]
+            : []),
+        ...(sourceKind === 'exact-view' && value.canonicalDataViewRevisionRef
+            ? [['canonicalDataViewRevisionRef', value.canonicalDataViewRevisionRef, 'view']]
+            : []),
+        ['inputSchemaRevisionRef', value.inputSchemaRevisionRef, 'schema'],
+        ['resultSchemaRevisionRef', value.resultSchemaRevisionRef, 'schema'],
+    ];
+    refs.forEach(([field, reference, expectedKind]) => {
+        if (reference.kind !== expectedKind) {
+            context.addIssue({
+                code: 'custom',
+                path: [field, 'kind'],
+                message: `${field} must reference ${expectedKind}.`,
+            });
+        }
+        validateTenantCompatibleReference(reference, value.tenantScope, [field], context);
+    });
+    [...value.accessPolicy.groupAllOf, ...value.accessPolicy.groupAnyOf].forEach((reference, index) => validateTenantCompatibleReference(reference, value.tenantScope, ['accessPolicy', 'groups', index], context));
+    value.accessPolicy.conditionAllOf.forEach((reference, index) => validateTenantCompatibleReference(reference, value.tenantScope, ['accessPolicy', 'conditionAllOf', index], context));
+    if (value.viewRevisionRef &&
+        value.canonicalDataViewRevisionRef &&
+        exactRevisionRef(value.viewRevisionRef, value.canonicalDataViewRevisionRef)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['canonicalDataViewRevisionRef'],
+            message: 'Governed View adapter and canonical data.view revisions must be distinct.',
+        });
+    }
+});
+exports.CursorWindowBindingSchema = zod_1.z
+    .object({
+    sourceCapabilityInstanceId: common_1.ContractIdentifierSchema.optional(),
+    pageChangePort: common_1.ContractIdentifierSchema,
+    pageChangeIntentSchemaRevisionRef: exports.RevisionRefSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.pageChangeIntentSchemaRevisionRef.kind !== 'schema') {
+        context.addIssue({
+            code: 'custom',
+            path: ['pageChangeIntentSchemaRevisionRef', 'kind'],
+            message: 'Cursor-window page-change intents must pin a schema revision.',
+        });
+    }
+});
+exports.QueryResultStateBindingSchema = zod_1.z
+    .object({
+    targetStateId: common_1.ContractIdentifierSchema,
+    targetStateSchemaRevisionRef: exports.RevisionRefSchema,
+    source: zod_1.z.object({ kind: zod_1.z.enum(['page-info-total', 'model-total']) }).strict(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.targetStateSchemaRevisionRef.kind !== 'schema') {
+        context.addIssue({
+            code: 'custom',
+            path: ['targetStateSchemaRevisionRef', 'kind'],
+            message: 'Query result state bindings must pin a Page-state schema revision.',
+        });
     }
 });
+exports.QueryBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    queryDefinitionRevisionRef: exports.RevisionRefSchema,
+    parameters: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    target: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    renderModelSchemaRevisionRef: exports.RevisionRefSchema,
+    targetProjection: zod_1.z.object({ expression: page_expression_1.PageExpressionSchema, schemaRevisionRef: exports.RevisionRefSchema }).strict().optional(),
+    streamTargetProjection: zod_1.z.object({ expression: page_expression_1.PageExpressionSchema, schemaRevisionRef: exports.RevisionRefSchema }).strict().optional(),
+    stateEffects: zod_1.z.array(zod_1.z.object({ targetStateId: common_1.ContractIdentifierSchema, value: page_expression_1.PageExpressionSchema, when: page_expression_1.PageExpressionSchema.optional() }).strict()).max(32).optional(),
+    queryWhen: exports.PageStateActivationSchema.optional(),
+    accessFailure: zod_1.z.literal('render-forbidden').optional(),
+    resultStateBindings: zod_1.z.array(exports.QueryResultStateBindingSchema).max(32).optional(),
+    execution: zod_1.z.enum(['server', 'local-state']).default('server'),
+    pagination: zod_1.z.enum(['none', 'cursor', 'offset']),
+    cursorWindow: exports.CursorWindowBindingSchema.optional(),
+    cache: zod_1.z.enum(['none', 'identity-scoped', 'tenant-scoped']),
+    cancelOnChange: zod_1.z.boolean(),
+    refreshPolicy: zod_1.z
+        .object({ intervalMs: zod_1.z.number().int().min(1000).max(300000), when: page_expression_1.PageExpressionSchema.optional() })
+        .strict()
+        .optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.targetProjection) {
+        if (value.targetProjection.schemaRevisionRef.kind !== 'schema')
+            context.addIssue({ code: 'custom', path: ['targetProjection', 'schemaRevisionRef'], message: 'Query target projections require an exact target schema revision.' });
+        for (const read of (0, page_expression_1.collectExternalPageExpressionReads)(value.targetProjection.expression))
+            if (read.root !== 'model')
+                context.addIssue({ code: 'custom', path: ['targetProjection', 'expression'], message: 'Query target projections may read only the validated raw model.' });
+    }
+    if (value.streamTargetProjection) {
+        const projection = value.streamTargetProjection;
+        if (projection.schemaRevisionRef.kind !== 'schema')
+            context.addIssue({ code: 'custom', path: ['streamTargetProjection', 'schemaRevisionRef'], message: 'Stream target projections require an exact target schema revision.' });
+        for (const read of (0, page_expression_1.collectExternalPageExpressionReads)(projection.expression))
+            if (read.root !== 'model')
+                context.addIssue({ code: 'custom', path: ['streamTargetProjection', 'expression'], message: 'Stream target projections may read only the verified query and stream envelope.' });
+        if (value.execution !== 'server' || value.pagination !== 'none')
+            context.addIssue({ code: 'custom', path: ['streamTargetProjection'], message: 'Stream target projections require a non-paginated Server query.' });
+    }
+    const effects = value.stateEffects ?? [];
+    if (new Set(effects.map((effect) => effect.targetStateId)).size !== effects.length)
+        context.addIssue({ code: 'custom', path: ['stateEffects'], message: 'A query completion may update each state only once.' });
+    for (const [index, effect] of effects.entries())
+        for (const expression of [effect.value, ...(effect.when ? [effect.when] : [])]) {
+            for (const read of (0, page_expression_1.collectPageExpressionReads)(expression))
+                if (!['model', 'state', 'scope'].includes(read.root))
+                    context.addIssue({ code: 'custom', path: ['stateEffects', index], message: 'Query state effects may read only model, state, and scope.' });
+        }
+    if (effects.length && (value.execution !== 'server' || value.pagination !== 'none'))
+        context.addIssue({ code: 'custom', path: ['stateEffects'], message: 'Query state effects require a non-paginated Server query.' });
+    if (value.refreshPolicy?.when) {
+        for (const read of (0, page_expression_1.collectExternalPageExpressionReads)(value.refreshPolicy.when)) {
+            if (read.root !== 'model' && !(read.root === 'actions' && read.path.length === 2 && read.path[1] === 'pending'))
+                context.addIssue({ code: 'custom', path: ['refreshPolicy', 'when'], message: 'Automatic refresh conditions may read only the verified raw model and declared action pending state.' });
+        }
+    }
+    if (value.refreshPolicy && (value.execution !== 'server' || value.pagination !== 'none')) {
+        context.addIssue({
+            code: 'custom',
+            path: ['refreshPolicy'],
+            message: 'Automatic refresh requires a non-paginated Server query.',
+        });
+    }
+    if (value.queryDefinitionRevisionRef.kind !== 'domain-query-definition') {
+        context.addIssue({
+            code: 'custom',
+            path: ['queryDefinitionRevisionRef', 'kind'],
+            message: 'Query bindings must pin a governed domain-query-definition revision.',
+        });
+    }
+    if (value.renderModelSchemaRevisionRef.kind !== 'schema') {
+        context.addIssue({
+            code: 'custom',
+            path: ['renderModelSchemaRevisionRef', 'kind'],
+            message: 'Query bindings must pin a render-model schema revision.',
+        });
+    }
+    if (value.execution === 'local-state' && value.pagination !== 'none') {
+        context.addIssue({
+            code: 'custom',
+            path: ['pagination'],
+            message: 'Local Page-state queries cannot paginate.',
+        });
+    }
+    if (value.execution === 'local-state' && value.accessFailure) {
+        context.addIssue({
+            code: 'custom',
+            path: ['accessFailure'],
+            message: 'Only a Server query can render an independently governed access failure.',
+        });
+    }
+    if (value.execution === 'local-state' && (value.resultStateBindings?.length ?? 0) > 0) {
+        context.addIssue({
+            code: 'custom',
+            path: ['resultStateBindings'],
+            message: 'Only Server queries can project governed result totals into Page state.',
+        });
+    }
+    const targetStateIds = value.resultStateBindings?.map((binding) => binding.targetStateId) ?? [];
+    if (new Set(targetStateIds).size !== targetStateIds.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['resultStateBindings'],
+            message: 'A Query binding can project a governed result total to each Page state at most once.',
+        });
+    }
+    if (value.cursorWindow && value.pagination !== 'cursor') {
+        context.addIssue({
+            code: 'custom',
+            path: ['cursorWindow'],
+            message: 'Cursor-window navigation requires cursor pagination.',
+        });
+    }
+    if (value.cursorWindow && value.execution !== 'server') {
+        context.addIssue({
+            code: 'custom',
+            path: ['cursorWindow'],
+            message: 'Cursor-window navigation requires Server query execution.',
+        });
+    }
+});
+exports.CapabilityInstanceSchema = zod_1.z
+    .object({
+    instanceId: common_1.ContractIdentifierSchema,
+    nodeId: common_1.ContractIdentifierSchema,
+    capabilityRevisionRef: exports.RevisionRefSchema,
+    providerRevisionRef: exports.RevisionRefSchema,
+    propertySchemaRevisionRef: exports.RevisionRefSchema,
+    properties: common_1.JsonObjectSchema,
+    propertyBindings: zod_1.z.array(page_expression_1.PagePropertyBindingSchema).max(128).optional(),
+    eventPayloadBindings: zod_1.z.array(zod_1.z.object({ port: common_1.ContractIdentifierSchema, expression: page_expression_1.PageExpressionSchema }).strict()).max(32).optional(),
+    eventEffects: zod_1.z.array(zod_1.z.object({
+        sourcePort: common_1.ContractIdentifierSchema,
+        sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
+        refreshBindingIds: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(128),
+    }).strict()).max(32).optional(),
+    accessPolicy: exports.AccessPolicySchema.optional(),
+    activationWhen: exports.PageStateActivationSchema.optional(),
+    allowedSideEffects: zod_1.z.array(zod_1.z.enum(['network', 'storage', 'navigation', 'clipboard', 'worker', 'websocket'])),
+})
+    .strict();
+exports.OntologyBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    ontologyDefinitionRevisionRef: exports.RevisionRefSchema,
+    viewRevisionRef: exports.RevisionRefSchema,
+    canonicalDataViewRevisionRef: exports.RevisionRefSchema,
+    parameters: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    target: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    renderModelSchemaRevisionRef: exports.RevisionRefSchema,
+    pagination: zod_1.z.enum(['none', 'cursor', 'offset']),
+    cursorWindow: exports.CursorWindowBindingSchema.optional(),
+    cache: zod_1.z.enum(['none', 'identity-scoped', 'tenant-scoped']),
+    cancelOnChange: zod_1.z.boolean(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.viewRevisionRef.kind !== 'view') {
+        context.addIssue({
+            code: 'custom',
+            path: ['viewRevisionRef', 'kind'],
+            message: 'Ontology bindings require an exact governed View revision.',
+        });
+    }
+    if (value.canonicalDataViewRevisionRef.kind !== 'view') {
+        context.addIssue({
+            code: 'custom',
+            path: ['canonicalDataViewRevisionRef', 'kind'],
+            message: 'Ontology bindings require an exact canonical data.view revision.',
+        });
+    }
+    if (exactRevisionRef(value.viewRevisionRef, value.canonicalDataViewRevisionRef)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['canonicalDataViewRevisionRef'],
+            message: 'Governed View adapter and canonical data.view revisions must be distinct.',
+        });
+    }
+    if (value.ontologyDefinitionRevisionRef.kind !== 'ontology-definition') {
+        context.addIssue({
+            code: 'custom',
+            path: ['ontologyDefinitionRevisionRef', 'kind'],
+            message: 'Expected an ontology-definition revision.',
+        });
+    }
+    if (value.cursorWindow && value.pagination !== 'cursor') {
+        context.addIssue({
+            code: 'custom',
+            path: ['cursorWindow'],
+            message: 'Cursor-window navigation requires cursor pagination.',
+        });
+    }
+});
+exports.ActionResultBindingEffectSourceSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('result-field'),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('constant'), value: common_1.JsonValueSchema }).strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('collection-length'),
+        offset: zod_1.z.number().int().min(-1000).max(1000),
+    })
+        .strict(),
+]);
+exports.ActionResultBindingEffectSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    operation: zod_1.z.enum(['upsert-append', 'remove-exact']),
+    collectionPath: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(8),
+    identityPath: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(8),
+    mappings: zod_1.z
+        .array(zod_1.z
+        .object({
+        targetPath: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(8),
+        source: exports.ActionResultBindingEffectSourceSchema,
+    })
+        .strict())
+        .min(1)
+        .max(64),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const targetPaths = value.mappings.map(({ targetPath }) => targetPath.join('.'));
+    if (new Set(targetPaths).size !== targetPaths.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['mappings'],
+            message: 'Result binding effect target paths must be unique.',
+        });
+    }
+    if (!targetPaths.includes(value.identityPath.join('.'))) {
+        context.addIssue({
+            code: 'custom',
+            path: ['identityPath'],
+            message: 'A result binding effect must map the exact identity path of the projected item.',
+        });
+    }
+    const identityMapping = value.mappings.find(({ targetPath }) => targetPath.join('.') === value.identityPath.join('.'));
+    if (identityMapping?.source.kind === 'collection-length') {
+        context.addIssue({
+            code: 'custom',
+            path: ['identityPath'],
+            message: 'A projected item identity must come from the verified result or a declared constant.',
+        });
+    }
+    if (value.operation === 'remove-exact' && value.mappings.length !== 1) {
+        context.addIssue({
+            code: 'custom',
+            path: ['mappings'],
+            message: 'An exact removal declares only the verified identity mapping used to remove one item.',
+        });
+    }
+});
+exports.ActionResultClipboardEffectSchema = zod_1.z
+    .object({
+    source: zod_1.z
+        .object({
+        kind: zod_1.z.literal('result-field'),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    copiedToast: exports.I18nTextSchema.optional(),
+    fallbackToast: exports.I18nTextSchema.superRefine((value, context) => {
+        for (const [locale, message] of Object.entries(value.values)) {
+            if (!message.includes('{value}')) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['values', locale],
+                    message: 'Clipboard fallback feedback must visibly include the exact verified value placeholder.',
+                });
+            }
+        }
+    }),
+})
+    .strict();
 exports.ActionBindingSchema = zod_1.z
     .object({
     bindingId: common_1.ContractIdentifierSchema,
     commandRevisionRef: exports.RevisionRefSchema,
-    source: zod_1.z.object({ capabilityInstanceId: common_1.ContractIdentifierSchema, port: common_1.ContractIdentifierSchema }).strict(),
+    source: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
     sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
     inputSchemaRevisionRef: exports.RevisionRefSchema,
-    inputMapping: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    when: page_expression_1.PageExpressionSchema.optional(),
+    fileInputs: zod_1.z.array(ActionFileInputSchema).min(1).max(4).optional(),
+    inputMapping: zod_1.z.record(common_1.ContractIdentifierSchema, ActionInputBindingSourceSchema),
+    sensitiveInputPaths: common_1.SensitiveResultPathsSchema.optional(),
     accessPolicy: exports.AccessPolicySchema,
     confirmation: exports.I18nTextSchema.optional(),
     idempotencyKeySource: zod_1.z.enum(['interaction', 'record-and-interaction', 'caller-provided']),
     compensationCommandRevisionRef: exports.RevisionRefSchema.optional(),
     resultSchemaRevisionRef: exports.RevisionRefSchema,
-    success: zod_1.z.object({
+    success: zod_1.z
+        .object({
+        download: zod_1.z.discriminatedUnion('kind', [
+            zod_1.z.object({ kind: zod_1.z.literal('native') }).strict(),
+            zod_1.z.object({ kind: zod_1.z.literal('text-artifact'), fileNamePath: page_expression_1.PageValuePathSchema.min(1), mimeTypePath: page_expression_1.PageValuePathSchema.min(1), contentPath: page_expression_1.PageValuePathSchema.min(1), maxBytes: zod_1.z.number().int().min(1).max(1048576) }).strict(),
+        ]).optional(),
         refreshBindingIds: zod_1.z.array(common_1.ContractIdentifierSchema),
+        ephemeralResult: zod_1.z
+            .object({
+            kind: zod_1.z.literal('one-time-value'),
+            valuePath: common_1.SensitiveResultPathSchema,
+            labelPath: common_1.SensitiveResultPathSchema,
+            title: exports.I18nTextSchema,
+            description: exports.I18nTextSchema,
+            copySuccessToast: exports.I18nTextSchema,
+            copyFailureToast: exports.I18nTextSchema,
+        })
+            .strict()
+            .optional(),
+        resultBindingEffects: zod_1.z.array(exports.ActionResultBindingEffectSchema).max(64).optional(),
+        clipboard: exports.ActionResultClipboardEffectSchema.optional(),
         navigationTargetRef: exports.StableRefSchema.optional(),
-    }).strict(),
+        toast: exports.I18nTextSchema.optional(),
+    })
+        .strict(),
     recovery: zod_1.z.enum(['retry-safe', 'compensating-command', 'manual-review']),
     lineageRequired: zod_1.z.literal(true),
 })
     .strict()
     .superRefine((value, context) => {
+    const fileIds = new Set();
+    for (const file of value.fileInputs ?? []) {
+        if (fileIds.has(file.inputId))
+            context.addIssue({ code: 'custom', path: ['fileInputs'], message: 'File input ids must be unique.' });
+        fileIds.add(file.inputId);
+        if (!Object.values(value.inputMapping).some(source => source.kind === 'file-field' && source.fileInputId === file.inputId))
+            context.addIssue({ code: 'custom', path: ['fileInputs'], message: 'File inputs require an explicit governed input mapping.' });
+    }
+    for (const [name, source] of Object.entries(value.inputMapping))
+        if (source.kind === 'file-field') {
+            const file = value.fileInputs?.find(file => file.inputId === source.fileInputId);
+            if ((source.path === 'canonicalUri' && !file?.upload) || (source.path === 'content' && file?.upload))
+                context.addIssue({ code: 'custom', path: ['inputMapping', name], message: 'File field must match its declared transport mode.' });
+            if (!fileIds.has(source.fileInputId))
+                context.addIssue({ code: 'custom', path: ['inputMapping', name], message: 'File fields must reference a declared file input.' });
+            if (source.path === 'content' && !value.sensitiveInputPaths?.includes(`/${name}`))
+                context.addIssue({ code: 'custom', path: ['sensitiveInputPaths'], message: 'File content must be declared as a sensitive command input.' });
+        }
+    if (value.when)
+        for (const read of (0, page_expression_1.collectPageExpressionReads)(value.when)) {
+            if (!['intent', 'state', 'scope'].includes(read.root))
+                context.addIssue({ code: 'custom', path: ['when'], message: 'Action conditions may read only intent, declared Page state, and instance scope.' });
+        }
+    if (value.success.ephemeralResult) {
+        const { valuePath, labelPath } = value.success.ephemeralResult;
+        const segments = (path) => path.split('/').slice(1);
+        const valueSegments = segments(valuePath);
+        const labelSegments = segments(labelPath);
+        const sharedLength = Math.min(valueSegments.length, labelSegments.length);
+        if (valueSegments.slice(0, sharedLength).every((segment, index) => segment === labelSegments[index])) {
+            context.addIssue({
+                code: 'custom',
+                path: ['success', 'ephemeralResult', 'labelPath'],
+                message: 'One-time result labels cannot overlap the sensitive value path.',
+            });
+        }
+    }
+    if (value.success.ephemeralResult && (value.success.resultBindingEffects?.length || 0) > 0) {
+        context.addIssue({
+            code: 'custom',
+            path: ['success', 'resultBindingEffects'],
+            message: 'One-time result presentation cannot share a result with durable binding effects.',
+        });
+    }
     if (value.commandRevisionRef.kind !== 'domain-command') {
-        context.addIssue({ code: 'custom', path: ['commandRevisionRef', 'kind'], message: 'Action bindings must reference a domain-command revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['commandRevisionRef', 'kind'],
+            message: 'Action bindings must reference a domain-command revision.',
+        });
     }
     if (value.sourceIntentSchemaRevisionRef.kind !== 'schema') {
-        context.addIssue({ code: 'custom', path: ['sourceIntentSchemaRevisionRef', 'kind'], message: 'Action source intents must pin a schema revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['sourceIntentSchemaRevisionRef', 'kind'],
+            message: 'Action source intents must pin a schema revision.',
+        });
     }
     if (value.inputSchemaRevisionRef.kind !== 'schema') {
-        context.addIssue({ code: 'custom', path: ['inputSchemaRevisionRef', 'kind'], message: 'Action command inputs must pin a schema revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['inputSchemaRevisionRef', 'kind'],
+            message: 'Action command inputs must pin a schema revision.',
+        });
     }
     if (value.recovery === 'compensating-command' && !value.compensationCommandRevisionRef) {
-        context.addIssue({ code: 'custom', path: ['compensationCommandRevisionRef'], message: 'Compensating recovery requires a compensation command.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['compensationCommandRevisionRef'],
+            message: 'Compensating recovery requires a compensation command.',
+        });
     }
 });
+exports.PageMigrationEquivalenceDimensionSchema = zod_1.z.enum([
+    'url',
+    'navigation',
+    'access',
+    'deep-link',
+    'layout',
+    'size',
+    'spacing',
+    'design-tokens',
+    'responsive',
+    'view-modes',
+    'search-filter',
+    'editing',
+    'detail',
+    'history',
+    'dialogs',
+    'keyboard',
+    'loading',
+    'empty',
+    'error',
+    'forbidden',
+]);
+exports.PageMigrationEquivalenceSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('PageMigrationEquivalence'),
+    schemaVersion: zod_1.z.literal(1),
+    policy: zod_1.z.literal('preserve-ui-ux'),
+    baseline: zod_1.z
+        .object({
+        repository: common_1.ContractIdentifierSchema,
+        revision: zod_1.z.string().regex(/^[0-9a-f]{40}$/),
+        pageId: common_1.ContractIdentifierSchema,
+        routePath: exports.RoutePathTemplateSchema,
+    })
+        .strict(),
+    protectedDimensions: zod_1.z.array(exports.PageMigrationEquivalenceDimensionSchema).min(1),
+    viewports: zod_1.z
+        .array(zod_1.z
+        .object({
+        viewportId: common_1.ContractIdentifierSchema,
+        width: zod_1.z.number().int().min(320).max(7680),
+        height: zod_1.z.number().int().min(480).max(4320),
+    })
+        .strict())
+        .min(2),
+    scenarios: zod_1.z
+        .array(zod_1.z
+        .object({
+        scenarioId: common_1.ContractIdentifierSchema,
+        viewportIds: zod_1.z.array(common_1.ContractIdentifierSchema).min(1),
+    })
+        .strict())
+        .min(1),
+    evidence: zod_1.z
+        .object({
+        sideBySideVisual: zod_1.z.literal(true),
+        domSnapshot: zod_1.z.literal(true),
+        consoleErrors: zod_1.z.literal('none'),
+    })
+        .strict(),
+    allowedDifferences: zod_1.z.array(zod_1.z
+        .object({
+        differenceId: common_1.ContractIdentifierSchema,
+        requirementRevisionRef: exports.RevisionRefSchema,
+    })
+        .strict()),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (uniqueArray(value.protectedDimensions, (candidate) => candidate)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['protectedDimensions'],
+            message: 'Protected UI/UX dimensions must be unique.',
+        });
+    }
+    if (uniqueArray(value.viewports, (candidate) => candidate.viewportId)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['viewports'],
+            message: 'Migration equivalence viewport identities must be unique.',
+        });
+    }
+    if (uniqueArray(value.scenarios, (candidate) => candidate.scenarioId)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['scenarios'],
+            message: 'Migration equivalence scenario identities must be unique.',
+        });
+    }
+    const viewportIds = new Set(value.viewports.map((viewport) => viewport.viewportId));
+    value.scenarios.forEach((scenario, index) => {
+        scenario.viewportIds.forEach((viewportId, viewportIndex) => {
+            if (!viewportIds.has(viewportId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['scenarios', index, 'viewportIds', viewportIndex],
+                    message: `Migration equivalence scenario references unknown viewport ${viewportId}.`,
+                });
+            }
+        });
+    });
+});
+exports.PageRouteStatePresentationSchema = zod_1.z
+    .object({
+    surface: exports.ProductSurfaceSchema,
+    state: zod_1.z.literal('forbidden'),
+    kind: zod_1.z.literal('status'),
+    presentation: zod_1.z.enum(['panel', 'page']),
+    title: exports.I18nTextSchema,
+    description: exports.I18nTextSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const localizedFields = [
+        ['title', value.title, 160],
+        ['description', value.description, 1000],
+    ];
+    localizedFields.forEach(([field, copy, maxLength]) => {
+        if (!copy)
+            return;
+        const entries = Object.entries(copy.values);
+        if (entries.length > 16) {
+            context.addIssue({
+                code: 'custom',
+                path: [field, 'values'],
+                message: 'Route-state presentation copy supports at most 16 locales.',
+            });
+        }
+        entries.forEach(([locale, text]) => {
+            if (text.length > maxLength) {
+                context.addIssue({
+                    code: 'custom',
+                    path: [field, 'values', locale],
+                    message: `Route-state ${field} copy must contain at most ${maxLength} characters.`,
+                });
+            }
+        });
+    });
+});
 exports.PageSchema = zod_1.z
     .object({
     contract: zod_1.z.literal('Page'),
@@ -572,11 +1940,18 @@ exports.PageSchema = zod_1.z
     identity: IdentitySchema,
     supportedSurfaces: zod_1.z.array(exports.ProductSurfaceSchema).min(1),
     lifecycle: exports.DeclarativeLifecycleSchema,
+    legacyRoutePolicy: legacy_route_1.LegacyRoutePolicySchema.optional(),
+    migrationEquivalence: exports.PageMigrationEquivalenceSchema.optional(),
+    routeStatePresentations: zod_1.z.array(exports.PageRouteStatePresentationSchema).max(8).optional(),
     routeClaims: zod_1.z.array(zod_1.z.union([exports.DeclarativeRouteClaimSchema, LegacyDeclarativeRouteClaimSchema])).min(1),
     shellRevisionRef: exports.RevisionRefSchema,
     renderTree: render_1.RenderTreeSchema,
     capabilityInstances: zod_1.z.array(exports.CapabilityInstanceSchema).min(1),
+    stateDefinitions: zod_1.z.array(exports.PageStateDefinitionSchema).optional(),
+    entryTransitions: zod_1.z.array(exports.PageEntryTransitionSchema).optional(),
+    interactionBindings: zod_1.z.array(exports.InteractionBindingSchema).optional(),
     ontologyBindings: zod_1.z.array(exports.OntologyBindingSchema),
+    queryBindings: zod_1.z.array(exports.QueryBindingSchema).optional(),
     actionBindings: zod_1.z.array(exports.ActionBindingSchema),
     pageAccessPolicy: exports.AccessPolicySchema,
     managementAccess: exports.ManagementAccessSchema,
@@ -588,34 +1963,590 @@ exports.PageSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     validateDeclaredRouteSurfaces(value.supportedSurfaces, value.routeClaims, context);
+    const routeStatePresentations = value.routeStatePresentations ?? [];
+    if (uniqueArray(routeStatePresentations, (candidate) => `${candidate.surface}:${candidate.state}`)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['routeStatePresentations'],
+            message: 'Page route-state presentations must be unique per surface and state.',
+        });
+    }
+    routeStatePresentations.forEach((presentation, index) => {
+        if (!value.supportedSurfaces.includes(presentation.surface)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['routeStatePresentations', index, 'surface'],
+                message: 'Page route-state presentation surface must be declared by supportedSurfaces.',
+            });
+        }
+    });
+    const stateDefinitions = value.stateDefinitions ?? [];
+    const entryTransitions = value.entryTransitions ?? [];
+    const interactionBindings = value.interactionBindings ?? [];
+    const queryBindings = value.queryBindings ?? [];
+    stateDefinitions.forEach((definition, index) => {
+        const partitionStateId = definition.preferencePartitionStateId;
+        const dynamicLegacySegments = definition.legacyBrowserPreferenceImport?.jsonPath?.filter((segment) => typeof segment !== 'string') ?? [];
+        if (!partitionStateId) {
+            if (dynamicLegacySegments.length > 0) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['stateDefinitions', index, 'legacyBrowserPreferenceImport', 'jsonPath'],
+                    message: 'A dynamic legacy preference path requires a declared preference partition state.',
+                });
+            }
+            return;
+        }
+        const partitionDefinition = stateDefinitions.find((candidate) => candidate.stateId === partitionStateId);
+        if (partitionStateId === definition.stateId ||
+            !partitionDefinition ||
+            partitionDefinition.preferencePartitionStateId) {
+            context.addIssue({
+                code: 'custom',
+                path: ['stateDefinitions', index, 'preferencePartitionStateId'],
+                message: 'Preference partitioning must reference a distinct, non-partitioned Page state.',
+            });
+        }
+        definition.legacyBrowserPreferenceImport?.jsonPath?.forEach((segment, segmentIndex) => {
+            if (typeof segment !== 'string' && segment.stateId !== partitionStateId) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['stateDefinitions', index, 'legacyBrowserPreferenceImport', 'jsonPath', segmentIndex],
+                    message: 'A dynamic legacy preference path must use the declared preference partition state.',
+                });
+            }
+        });
+    });
     const uniqueness = [
         ['capabilityInstances', value.capabilityInstances, (candidate) => String(candidate.instanceId)],
+        ['stateDefinitions', stateDefinitions, (candidate) => String(candidate.stateId)],
+        ['entryTransitions', entryTransitions, (candidate) => String(candidate.transitionId)],
+        ['interactionBindings', interactionBindings, (candidate) => String(candidate.bindingId)],
         ['ontologyBindings', value.ontologyBindings, (candidate) => String(candidate.bindingId)],
+        ['queryBindings', queryBindings, (candidate) => String(candidate.bindingId)],
         ['actionBindings', value.actionBindings, (candidate) => String(candidate.bindingId)],
     ];
     uniqueness.forEach(([field, values, identity]) => {
         if (uniqueArray(values, identity))
-            context.addIssue({ code: 'custom', path: [field], message: `${field} identities must be unique.` });
+            context.addIssue({
+                code: 'custom',
+                path: [field],
+                message: `${field} identities must be unique.`,
+            });
+    });
+    const instanceIds = new Set(value.capabilityInstances.map((instance) => instance.instanceId));
+    const stateIds = new Set(stateDefinitions.map((state) => state.stateId));
+    value.capabilityInstances.forEach((instance, index) => {
+        const ports = new Set();
+        const payloadPorts = new Set();
+        instance.eventPayloadBindings?.forEach((binding, bindingIndex) => {
+            const path = ['capabilityInstances', index, 'eventPayloadBindings', bindingIndex];
+            if (payloadPorts.has(binding.port))
+                context.addIssue({ code: 'custom', path, message: 'An event payload can have only one declarative projection.' });
+            payloadPorts.add(binding.port);
+            for (const read of (0, page_expression_1.collectPageExpressionReads)(binding.expression)) {
+                if (read.root === 'actions' || read.root === 'result' || (read.root === 'state' && !stateIds.has(read.path[0] ?? '')) || (read.root === 'bindings' && ![...value.ontologyBindings, ...queryBindings].some((candidate) => candidate.bindingId === read.path[0])))
+                    context.addIssue({ code: 'custom', path, message: 'Event payload projections require local event, model, scope, declared query results, or declared state.' });
+            }
+        });
+        instance.eventEffects?.forEach((effect, effectIndex) => {
+            const path = ['capabilityInstances', index, 'eventEffects', effectIndex];
+            if (effect.sourceIntentSchemaRevisionRef.kind !== 'schema' || ports.has(effect.sourcePort))
+                context.addIssue({ code: 'custom', path, message: 'Event effects require one exact source schema per output port.' });
+            ports.add(effect.sourcePort);
+            if (value.actionBindings.some((binding) => binding.source.capabilityInstanceId === instance.instanceId && binding.source.port === effect.sourcePort))
+                context.addIssue({ code: 'custom', path, message: 'An Action output port must declare refresh effects through Action.success.' });
+            for (const id of effect.refreshBindingIds)
+                if (![...value.ontologyBindings, ...queryBindings].some((binding) => binding.bindingId === id))
+                    context.addIssue({ code: 'custom', path, message: 'Event effect references an unknown query binding.' });
+        });
+    });
+    const repeatNodes = new Set(value.renderTree.nodes.filter((node) => node.repeat).map((node) => node.nodeId));
+    stateDefinitions.forEach((definition, index) => {
+        if (definition.scopeNodeId && !repeatNodes.has(definition.scopeNodeId))
+            context.addIssue({ code: 'custom', path: ['stateDefinitions', index, 'scopeNodeId'], message: 'Instance state must reference an existing repeated RenderNode.' });
+        if (definition.initialValue && !definition.scopeNodeId) {
+            const expression = definition.initialValue;
+            const source = expression.kind === 'read' ? stateDefinitions.find(state => state.stateId === expression.path[0] && !state.scopeNodeId) : undefined;
+            if (!source || source.initialValue || !['tenant-preference', 'url-with-tenant-preference'].includes(source.persistence))
+                context.addIssue({ code: 'custom', path: ['stateDefinitions', index, 'initialValue'], message: 'Root initialization requires an independently hydrated tenant preference; initialization chains are forbidden.' });
+        }
+        if (definition.initialValue) {
+            for (const read of (0, page_expression_1.collectPageExpressionReads)(definition.initialValue)) {
+                if (!['scope', 'state'].includes(read.root) || (read.root === 'state' && !stateDefinitions.some((state) => state.stateId === read.path[0] && !state.scopeNodeId)))
+                    context.addIssue({ code: 'custom', path: ['stateDefinitions', index, 'initialValue'], message: 'Instance initial values can read only their item scope and declared Page state.' });
+            }
+        }
+    });
+    value.renderTree.nodes.forEach((node, index) => {
+        if (!node.repeat)
+            return;
+        for (const read of (0, page_expression_1.collectPageExpressionReads)(node.repeat.source)) {
+            if (read.root === 'actions' || read.root === 'intent' || read.root === 'result' || read.root === 'model' || (read.root === 'state' && !stateIds.has(read.path[0] ?? '')) || (read.root === 'bindings' && ![...value.ontologyBindings, ...queryBindings].some((binding) => binding.bindingId === read.path[0])))
+                context.addIssue({ code: 'custom', path: ['renderTree', 'nodes', index, 'repeat', 'source'], message: 'Repeated nodes require declared Page state, query results, or parent item scope.' });
+        }
+    });
+    // A declaration can consume its own instance or ancestors, never an arbitrary sibling row.
+    const renderNodesById = new Map(value.renderTree.nodes.map((node) => [node.nodeId, node]));
+    const instanceNodes = new Map(value.capabilityInstances.map((instance) => [instance.instanceId, instance.nodeId]));
+    const scopesForNode = (nodeId) => {
+        const scopes = new Set();
+        const visited = new Set();
+        let node = nodeId ? renderNodesById.get(nodeId) : undefined;
+        while (node && !visited.has(node.nodeId)) {
+            visited.add(node.nodeId);
+            if (node.repeat)
+                scopes.add(node.nodeId);
+            node = node.parentNodeId ? renderNodesById.get(node.parentNodeId) : undefined;
+        }
+        return scopes;
+    };
+    const queryOwners = new Map([...value.ontologyBindings, ...queryBindings].map((binding) => [
+        binding.bindingId, [...scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId))][0],
+    ]));
+    const actionScopes = new Map(value.actionBindings.map(binding => [binding.bindingId, scopesForNode(instanceNodes.get(binding.source.capabilityInstanceId))]));
+    const actionOwners = new Map([...actionScopes].map(([id, scopes]) => [id, [...scopes][0]]));
+    if (actionOwners.size !== value.actionBindings.length)
+        context.addIssue({ code: 'custom', path: ['actionBindings'], message: 'Action binding identifiers must be unique.' });
+    const checkScopedReads = (reads, scopes, path) => {
+        for (const read of reads) {
+            const owner = read.root === 'state' ? stateDefinitions.find((state) => state.stateId === read.path[0])?.scopeNodeId
+                : read.root === 'bindings' ? queryOwners.get(read.path[0]) : read.root === 'actions' ? actionOwners.get(read.path[0]) : undefined;
+            // A parent may observe only aggregate pending for its descendant action scopes.
+            // Error codes and individual row state remain scoped; unrelated repeat branches cannot aggregate.
+            const pendingAggregate = read.root === 'actions' && read.path.length === 2 && read.path[1] === 'pending'
+                && actionScopes.has(read.path[0]) && [...scopes].every(scope => actionScopes.get(read.path[0]).has(scope));
+            if (owner && !scopes.has(owner) && !pendingAggregate)
+                context.addIssue({ code: 'custom', path, message: 'A binding cannot read state, query results, or individual action status from a sibling or descendant instance.' });
+        }
+    };
+    const checkScopedSources = (sources, scopes, path) => {
+        Object.entries(sources).forEach(([name, source]) => {
+            if (source.kind === 'expression')
+                checkScopedReads((0, page_expression_1.collectPageExpressionReads)(source.expression), scopes, [...path, name]);
+            if (source.kind === 'page-state')
+                checkScopedReads([{ kind: 'read', root: 'state', path: [source.stateId] }], scopes, [...path, name]);
+            if (source.kind === 'binding-field')
+                checkScopedReads([{ kind: 'read', root: 'bindings', path: [source.bindingId] }], scopes, [...path, name]);
+            if (source.kind === 'scope-field' && scopes.size === 0)
+                context.addIssue({ code: 'custom', path: [...path, name], message: 'A scope field requires a repeated instance.' });
+        });
+    };
+    value.capabilityInstances.forEach((instance, index) => instance.eventPayloadBindings?.forEach((binding, bindingIndex) => checkScopedReads((0, page_expression_1.collectPageExpressionReads)(binding.expression), scopesForNode(instance.nodeId), ['capabilityInstances', index, 'eventPayloadBindings', bindingIndex])));
+    value.capabilityInstances.forEach((instance, index) => instance.propertyBindings?.forEach((binding, bindingIndex) => {
+        checkScopedReads((0, page_expression_1.collectPageExpressionReads)(binding.expression), scopesForNode(instance.nodeId), ['capabilityInstances', index, 'propertyBindings', bindingIndex]);
+    }));
+    for (const [collection, bindings] of [['ontologyBindings', value.ontologyBindings], ['queryBindings', queryBindings]]) {
+        bindings.forEach((binding, index) => checkScopedSources(binding.parameters, scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId)), [collection, index, 'parameters']));
+    }
+    value.actionBindings.forEach((binding, index) => {
+        const scopes = scopesForNode(instanceNodes.get(binding.source.capabilityInstanceId));
+        checkScopedSources(binding.inputMapping, scopes, ['actionBindings', index, 'inputMapping']);
+        for (const [fileIndex, file] of (binding.fileInputs ?? []).entries()) {
+            if (file.source.kind === 'page-state') {
+                const stateId = file.source.stateId;
+                const state = stateDefinitions.find(candidate => candidate.stateId === stateId);
+                if (!state || state.persistence !== 'none')
+                    context.addIssue({ code: 'custom', path: ['actionBindings', index, 'fileInputs', fileIndex], message: 'File handles require declared nonpersistent Page state.' });
+                checkScopedSources({ file: file.source }, scopes, ['actionBindings', index, 'fileInputs', fileIndex]);
+            }
+        }
+        if (binding.when) {
+            const reads = (0, page_expression_1.collectPageExpressionReads)(binding.when);
+            checkScopedReads(reads, scopes, ['actionBindings', index, 'when']);
+            for (const read of reads)
+                if (read.root === 'state' && !stateIds.has(read.path[0]))
+                    context.addIssue({ code: 'custom', path: ['actionBindings', index, 'when'], message: 'Action condition references an unknown Page state.' });
+        }
+    });
+    interactionBindings.forEach((binding, index) => {
+        const sourceScopes = scopesForNode(instanceNodes.get(binding.source.capabilityInstanceId));
+        const targetScope = stateDefinitions.find((state) => state.stateId === binding.targetStateId)?.scopeNodeId;
+        if (targetScope && !sourceScopes.has(targetScope))
+            context.addIssue({ code: 'custom', path: ['interactionBindings', index, 'targetStateId'], message: 'An interaction must target its own instance or an ancestor.' });
+        checkScopedSources(binding.inputMapping, targetScope ? scopesForNode(targetScope) : new Set(), ['interactionBindings', index, 'inputMapping']);
+    });
+    value.renderTree.nodes.forEach((node, index) => {
+        if (node.repeat)
+            checkScopedReads((0, page_expression_1.collectPageExpressionReads)(node.repeat.source), scopesForNode(node.parentNodeId), ['renderTree', 'nodes', index, 'repeat', 'source']);
+    });
+    entryTransitions.forEach((transition, transitionIndex) => {
+        if (transition.gestureSource &&
+            (!instanceIds.has(transition.gestureSource.capabilityInstanceId) ||
+                !interactionBindings.some((binding) => binding.source.capabilityInstanceId === transition.gestureSource.capabilityInstanceId &&
+                    binding.source.port === transition.gestureSource.port))) {
+            context.addIssue({
+                code: 'custom',
+                path: ['entryTransitions', transitionIndex, 'gestureSource'],
+                message: 'Entry gesture source must match an existing capability interaction source.',
+            });
+        }
+        if (transition.targetRef.kind === 'page' && transition.targetRef.id === value.pageId) {
+            context.addIssue({
+                code: 'custom',
+                path: ['entryTransitions', transitionIndex, 'targetRef'],
+                message: 'A Page cannot route into itself on entry.',
+            });
+        }
+        forEachPageStateCondition(transition.activation, (condition, conditionPath) => {
+            if (!stateIds.has(condition.stateId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['entryTransitions', transitionIndex, 'activation', ...conditionPath, 'stateId'],
+                    message: `Entry transition references unknown Page state ${condition.stateId}.`,
+                });
+            }
+        });
+        const declaredRouteParameters = new Set(value.routeClaims.flatMap((claim) => [...claim.pathTemplate.matchAll(/:([A-Za-z][A-Za-z0-9_-]*)/g)].map((match) => match[1])));
+        for (const source of [...Object.values(transition.pathParameters), ...Object.values(transition.query.set)]) {
+            if (source.kind === 'route-parameter' && !declaredRouteParameters.has(source.name)) {
+                context.addIssue({ code: 'custom', path: ['entryTransitions', transitionIndex], message: `Entry transition references unknown source route parameter ${source.name}.` });
+            }
+        }
+        const stateSources = [
+            ...Object.values(transition.pathParameters).flatMap((source) => source.kind === 'page-state' ? [source.stateId] : []),
+            ...Object.values(transition.query.set).flatMap((source) => source.kind === 'page-state' ? [source.stateId] : []),
+        ];
+        stateSources.forEach((stateId) => {
+            if (!stateIds.has(stateId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['entryTransitions', transitionIndex],
+                    message: `Entry transition references unknown Page state ${stateId}.`,
+                });
+            }
+        });
+    });
+    const validatePageStateSources = (sources, path) => {
+        Object.entries(sources).forEach(([name, source]) => {
+            if (source.kind === 'expression') {
+                for (const read of (0, page_expression_1.collectPageExpressionReads)(source.expression)) {
+                    if ((read.root === 'state' && (!read.path[0] || !stateIds.has(read.path[0]))) || read.root === 'model' || read.root === 'bindings' || (read.root === 'result' && path[0] !== 'interactionBindings')) {
+                        context.addIssue({ code: 'custom', path: [...path, name, 'expression'], message: 'Expression references unavailable context or an undeclared Page state.' });
+                    }
+                }
+            }
+            if (source.kind === 'page-state' && !stateIds.has(source.stateId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: [...path, name, 'stateId'],
+                    message: `Unknown Page state: ${source.stateId}`,
+                });
+            }
+        });
+    };
+    interactionBindings.forEach((binding, index) => {
+        if (!instanceIds.has(binding.source.capabilityInstanceId)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['interactionBindings', index, 'source', 'capabilityInstanceId'],
+                message: 'Interaction binding sources an unknown capability instance.',
+            });
+        }
+        if (!stateIds.has(binding.targetStateId)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['interactionBindings', index, 'targetStateId'],
+                message: 'Interaction binding targets an unknown Page state.',
+            });
+        }
+        validatePageStateSources(binding.inputMapping, ['interactionBindings', index, 'inputMapping']);
+        if (Object.values(binding.inputMapping).some((source) => source.kind === 'result-field' || (source.kind === 'expression' && (0, page_expression_1.collectPageExpressionReads)(source.expression).some((read) => read.root === 'result')))) {
+            const action = value.actionBindings.find((candidate) => candidate.source.capabilityInstanceId === binding.source.capabilityInstanceId &&
+                candidate.source.port === binding.source.port);
+            if (!action) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['interactionBindings', index, 'source'],
+                    message: 'Result-field interactions must source one declared Action binding.',
+                });
+            }
+            else if (!binding.sourceResultSchemaRevisionRef ||
+                !exactRevisionRef(binding.sourceResultSchemaRevisionRef, action.resultSchemaRevisionRef)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['interactionBindings', index, 'sourceResultSchemaRevisionRef'],
+                    message: 'Interaction result schema must exactly match the sourced Action result schema.',
+                });
+            }
+        }
+    });
+    value.capabilityInstances.forEach((instance, index) => {
+        const paths = [];
+        instance.propertyBindings?.forEach((binding, bindingIndex) => {
+            const path = ['capabilityInstances', index, 'propertyBindings', bindingIndex];
+            if (instance.capabilityRevisionRef.id.startsWith('monkeys.design.component.')) {
+                const [group, member, field] = binding.targetPath;
+                const messages = instance.properties.messages;
+                const message = messages && typeof messages === 'object' && !Array.isArray(messages) ? messages[member] : undefined;
+                const declaredMessage = message && typeof message === 'object' && !Array.isArray(message);
+                const allowed = (group === 'props' && binding.targetPath.length >= 2) ||
+                    (group === 'messages' && declaredMessage && ((field === 'values' && binding.targetPath.length >= 3) ||
+                        (binding.targetPath.length === 3 && (field === 'key' || field === 'textI18n') &&
+                            Object.prototype.hasOwnProperty.call(message, field))));
+                if (!allowed)
+                    context.addIssue({ code: 'custom', path: [...path, 'targetPath'], message: 'Component expressions can update property values or declared message fields, never executable wiring.' });
+            }
+            if (paths.some((previous) => previous.slice(0, Math.min(previous.length, binding.targetPath.length)).every((key, i) => key === binding.targetPath[i]))) {
+                context.addIssue({ code: 'custom', path: [...path, 'targetPath'], message: 'Dynamic property targets must not overlap.' });
+            }
+            paths.push(binding.targetPath);
+            (0, page_expression_1.visitPageExpression)(binding.expression, (expression) => {
+                if (expression.kind !== 'read')
+                    return;
+                if (expression.root === 'state' && (!expression.path[0] || !stateIds.has(expression.path[0]))) {
+                    context.addIssue({ code: 'custom', path: [...path, 'expression'], message: 'Property expressions must reference a declared Page state.' });
+                }
+                if (expression.root === 'bindings' && ![...value.ontologyBindings, ...queryBindings].some((candidate) => candidate.bindingId === expression.path[0])) {
+                    context.addIssue({ code: 'custom', path: [...path, 'expression'], message: 'Property expressions must reference a declared Page query binding.' });
+                }
+                if (expression.root === 'actions' && (expression.path.length !== 2 || !actionOwners.has(expression.path[0]) || !['pending', 'errorCode'].includes(expression.path[1]))) {
+                    context.addIssue({ code: 'custom', path: [...path, 'expression'], message: 'Property expressions may read only pending or errorCode from a declared Action binding.' });
+                }
+                if (expression.root === 'intent' || expression.root === 'result') {
+                    context.addIssue({ code: 'custom', path: [...path, 'expression'], message: 'Property expressions cannot read transient event or Action results.' });
+                }
+            });
+        });
+        if (!instance.activationWhen)
+            return;
+        forEachPageStateCondition(instance.activationWhen, (condition, conditionPath) => {
+            if (!stateIds.has(condition.stateId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['capabilityInstances', index, 'activationWhen', ...conditionPath, 'stateId'],
+                    message: 'Capability activation condition references an unknown Page state.',
+                });
+            }
+        });
     });
-    const instanceIds = new Set(value.capabilityInstances.map((instance) => instance.instanceId));
     value.ontologyBindings.forEach((binding, index) => {
         if (!instanceIds.has(binding.target.capabilityInstanceId)) {
-            context.addIssue({ code: 'custom', path: ['ontologyBindings', index, 'target', 'capabilityInstanceId'], message: 'Ontology binding targets an unknown capability instance.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['ontologyBindings', index, 'target', 'capabilityInstanceId'],
+                message: 'Ontology binding targets an unknown capability instance.',
+            });
+        }
+        validatePageStateSources(binding.parameters, ['ontologyBindings', index, 'parameters']);
+    });
+    queryBindings.forEach((binding, index) => {
+        if (!instanceIds.has(binding.target.capabilityInstanceId)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['queryBindings', index, 'target', 'capabilityInstanceId'],
+                message: 'Query binding targets an unknown capability instance.',
+            });
+        }
+        validatePageStateSources(binding.parameters, ['queryBindings', index, 'parameters']);
+        if (binding.queryWhen) {
+            forEachPageStateCondition(binding.queryWhen, (condition, conditionPath) => {
+                if (!stateIds.has(condition.stateId)) {
+                    context.addIssue({
+                        code: 'custom',
+                        path: ['queryBindings', index, 'queryWhen', ...conditionPath, 'stateId'],
+                        message: 'Query activation condition references an unknown Page state.',
+                    });
+                }
+            });
+        }
+        if (binding.refreshPolicy?.when) {
+            const path = ['queryBindings', index, 'refreshPolicy', 'when'];
+            const reads = (0, page_expression_1.collectExternalPageExpressionReads)(binding.refreshPolicy.when);
+            checkScopedReads(reads, scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId)), path);
+            for (const read of reads)
+                if (read.root === 'actions' && !actionScopes.has(read.path[0]))
+                    context.addIssue({ code: 'custom', path, message: 'Automatic refresh condition references an unknown action binding.' });
+        }
+        const effectOwners = new Set(binding.stateEffects?.map((effect) => stateDefinitions.find((definition) => definition.stateId === effect.targetStateId)?.scopeNodeId ?? '') ?? []);
+        if (effectOwners.size > 1)
+            context.addIssue({ code: 'custom', path: ['queryBindings', index, 'stateEffects'], message: 'A query completion must update a single state owner atomically.' });
+        binding.stateEffects?.forEach((effect, effectIndex) => {
+            const path = ['queryBindings', index, 'stateEffects', effectIndex];
+            const state = stateDefinitions.find((definition) => definition.stateId === effect.targetStateId);
+            const scopes = scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId));
+            if (!state || (state.scopeNodeId && !scopes.has(state.scopeNodeId)))
+                context.addIssue({ code: 'custom', path: [...path, 'targetStateId'], message: 'A query effect must target declared state in its own scope or an ancestor.' });
+            for (const expression of [effect.value, ...(effect.when ? [effect.when] : [])]) {
+                const reads = (0, page_expression_1.collectPageExpressionReads)(expression);
+                checkScopedReads(reads, state?.scopeNodeId ? scopesForNode(state.scopeNodeId) : new Set(), path);
+                for (const read of reads)
+                    if (read.root === 'state' && !stateIds.has(read.path[0]))
+                        context.addIssue({ code: 'custom', path, message: 'Query effect references an unknown Page state.' });
+            }
+        });
+        binding.resultStateBindings?.forEach((resultBinding, resultIndex) => {
+            const stateDefinition = stateDefinitions.find((definition) => definition.stateId === resultBinding.targetStateId);
+            if (!stateDefinition) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['queryBindings', index, 'resultStateBindings', resultIndex, 'targetStateId'],
+                    message: 'Query result binding targets an unknown Page state.',
+                });
+                return;
+            }
+            if (!exactRevisionRef(resultBinding.targetStateSchemaRevisionRef, stateDefinition.schemaRevisionRef)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['queryBindings', index, 'resultStateBindings', resultIndex, 'targetStateSchemaRevisionRef'],
+                    message: 'Query result binding must pin the exact target Page-state schema revision.',
+                });
+            }
+            if (stateDefinition.persistence !== 'none') {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['queryBindings', index, 'resultStateBindings', resultIndex, 'targetStateId'],
+                    message: 'Query result state projections must target non-persistent Page state.',
+                });
+            }
+        });
+    });
+    const dependencyBindings = [...value.ontologyBindings, ...queryBindings];
+    (0, page_binding_dependencies_1.analyzePageBindingDependencies)(dependencyBindings).errors.forEach((error) => {
+        const ontologyIndex = value.ontologyBindings.findIndex((binding) => binding.bindingId === error.bindingId);
+        const collection = ontologyIndex >= 0 ? 'ontologyBindings' : 'queryBindings';
+        const index = ontologyIndex >= 0 ? ontologyIndex : queryBindings.findIndex((binding) => binding.bindingId === error.bindingId);
+        context.addIssue({ code: 'custom', path: [collection, index, 'parameters'], message: `Page binding dependency ${error.code}: ${error.dependencyId ?? error.bindingId}` });
+    });
+    const projectedQueryStateIds = new Set();
+    queryBindings.forEach((binding, index) => {
+        binding.resultStateBindings?.forEach((resultBinding, resultIndex) => {
+            if (projectedQueryStateIds.has(resultBinding.targetStateId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['queryBindings', index, 'resultStateBindings', resultIndex, 'targetStateId'],
+                    message: 'One Page state can have only one Server Query result owner.',
+                });
+            }
+            projectedQueryStateIds.add(resultBinding.targetStateId);
+        });
+    });
+    queryBindings.forEach((binding, index) => {
+        if (binding.execution !== 'server')
+            return;
+        const readStateIds = new Set(Object.values(binding.parameters).flatMap((source) => (source.kind === 'page-state' ? [source.stateId] : [])));
+        if (binding.queryWhen) {
+            forEachPageStateCondition(binding.queryWhen, (condition) => readStateIds.add(condition.stateId));
+        }
+        const feedbackStateId = [...readStateIds].find((stateId) => projectedQueryStateIds.has(stateId));
+        if (feedbackStateId) {
+            context.addIssue({
+                code: 'custom',
+                path: ['queryBindings', index],
+                message: `Server Query bindings cannot read projected Query result state: ${feedbackStateId}`,
+            });
+        }
+    });
+    const cursorWindowBindings = [
+        ...value.ontologyBindings.map((binding, index) => ({
+            binding,
+            index,
+            collection: 'ontologyBindings',
+        })),
+        ...queryBindings.map((binding, index) => ({
+            binding,
+            index,
+            collection: 'queryBindings',
+        })),
+    ].filter((candidate) => candidate.binding.cursorWindow !== undefined);
+    const cursorWindowSources = new Set();
+    cursorWindowBindings.forEach(({ binding, index, collection }) => {
+        const sourceId = binding.cursorWindow.sourceCapabilityInstanceId ?? binding.target.capabilityInstanceId;
+        if (!instanceIds.has(sourceId))
+            context.addIssue({ code: 'custom', path: [collection, index, 'cursorWindow', 'sourceCapabilityInstanceId'], message: 'Cursor-window source must reference a declared capability instance.' });
+        const sourceScopes = [...scopesForNode(instanceNodes.get(sourceId))];
+        const targetScopes = [...scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId))];
+        if (sourceScopes.length !== targetScopes.length || sourceScopes.some((id, index) => id !== targetScopes[index]))
+            context.addIssue({ code: 'custom', path: [collection, index, 'cursorWindow', 'sourceCapabilityInstanceId'], message: 'Cursor-window source and query target must share the same repeated scope.' });
+        const sourceKey = `${sourceId}:${binding.cursorWindow.pageChangePort}`;
+        if (cursorWindowSources.has(sourceKey)) {
+            context.addIssue({
+                code: 'custom',
+                path: [collection, index, 'cursorWindow', 'pageChangePort'],
+                message: 'A capability output port can govern at most one cursor-window binding.',
+            });
+        }
+        cursorWindowSources.add(sourceKey);
+        const conflictingInteraction = interactionBindings.some((candidate) => candidate.source.capabilityInstanceId === sourceId &&
+            candidate.source.port === binding.cursorWindow.pageChangePort);
+        const conflictingAction = value.actionBindings.some((candidate) => candidate.source.capabilityInstanceId === sourceId &&
+            candidate.source.port === binding.cursorWindow.pageChangePort);
+        if (conflictingInteraction || conflictingAction) {
+            context.addIssue({
+                code: 'custom',
+                path: [collection, index, 'cursorWindow', 'pageChangePort'],
+                message: 'Cursor-window page-change ports cannot also drive Page state or Domain Actions.',
+            });
         }
     });
     value.actionBindings.forEach((binding, index) => {
         if (!instanceIds.has(binding.source.capabilityInstanceId)) {
-            context.addIssue({ code: 'custom', path: ['actionBindings', index, 'source', 'capabilityInstanceId'], message: 'Action binding sources an unknown capability instance.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['actionBindings', index, 'source', 'capabilityInstanceId'],
+                message: 'Action binding sources an unknown capability instance.',
+            });
         }
+        validatePageStateSources(binding.inputMapping, ['actionBindings', index, 'inputMapping']);
         binding.success.refreshBindingIds.forEach((bindingId) => {
-            if (!value.ontologyBindings.some((candidate) => candidate.bindingId === bindingId)) {
-                context.addIssue({ code: 'custom', path: ['actionBindings', index, 'success', 'refreshBindingIds'], message: `Unknown refresh binding: ${bindingId}` });
+            if (!value.ontologyBindings.some((candidate) => candidate.bindingId === bindingId) &&
+                !queryBindings.some((candidate) => candidate.bindingId === bindingId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['actionBindings', index, 'success', 'refreshBindingIds'],
+                    message: `Unknown refresh binding: ${bindingId}`,
+                });
             }
         });
+        const effectBindingIds = binding.success.resultBindingEffects?.map((effect) => effect.bindingId) ?? [];
+        if (new Set(effectBindingIds).size !== effectBindingIds.length) {
+            context.addIssue({
+                code: 'custom',
+                path: ['actionBindings', index, 'success', 'resultBindingEffects'],
+                message: 'An Action can declare at most one result effect for each target binding.',
+            });
+        }
+        binding.success.resultBindingEffects?.forEach((effect, effectIndex) => {
+            if (!value.ontologyBindings.some((candidate) => candidate.bindingId === effect.bindingId) &&
+                !queryBindings.some((candidate) => candidate.bindingId === effect.bindingId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['actionBindings', index, 'success', 'resultBindingEffects', effectIndex, 'bindingId'],
+                    message: `Unknown result effect binding: ${effect.bindingId}`,
+                });
+            }
+            if (binding.success.refreshBindingIds.includes(effect.bindingId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['actionBindings', index, 'success', 'resultBindingEffects', effectIndex, 'bindingId'],
+                    message: 'A result-projected binding cannot also be refreshed by the same Action.',
+                });
+            }
+        });
+        if (binding.success.clipboard) {
+            const sourceInstance = value.capabilityInstances.find((instance) => instance.instanceId === binding.source.capabilityInstanceId);
+            if (!sourceInstance?.allowedSideEffects.includes('clipboard'))
+                context.addIssue({
+                    code: 'custom',
+                    path: ['actionBindings', index, 'success', 'clipboard'],
+                    message: 'An Action result clipboard effect requires clipboard permission on its source capability instance.',
+                });
+        }
     });
     if (value.shellRevisionRef.kind !== 'shell')
-        context.addIssue({ code: 'custom', path: ['shellRevisionRef', 'kind'], message: 'Page shellRevisionRef must reference a shell.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['shellRevisionRef', 'kind'],
+            message: 'Page shellRevisionRef must reference a shell.',
+        });
     value.capabilityInstances.forEach((instance, index) => {
+        if (instance.accessPolicy) {
+            [
+                ...instance.accessPolicy.groupAllOf,
+                ...instance.accessPolicy.groupAnyOf,
+                ...instance.accessPolicy.conditionAllOf,
+            ].forEach((reference, refIndex) => validateTenantCompatibleReference(reference, value.tenantScope, ['capabilityInstances', index, 'accessPolicy', refIndex], context));
+        }
         const refs = [
             ['capabilityRevisionRef', instance.capabilityRevisionRef, 'capability'],
             ['providerRevisionRef', instance.providerRevisionRef, 'view-provider'],
@@ -623,46 +2554,95 @@ exports.PageSchema = zod_1.z
         ];
         refs.forEach(([field, reference, expectedKind]) => {
             if (reference.kind !== expectedKind)
-                context.addIssue({ code: 'custom', path: ['capabilityInstances', index, field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+                context.addIssue({
+                    code: 'custom',
+                    path: ['capabilityInstances', index, field, 'kind'],
+                    message: `${field} must reference ${expectedKind}.`,
+                });
         });
     });
     value.tokenRevisionRefs.forEach((reference, index) => {
         if (reference.kind !== 'design-token')
-            context.addIssue({ code: 'custom', path: ['tokenRevisionRefs', index, 'kind'], message: 'Page token references must use kind design-token.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['tokenRevisionRefs', index, 'kind'],
+                message: 'Page token references must use kind design-token.',
+            });
     });
     if (value.performanceBudgetRef.kind !== 'performance-budget')
-        context.addIssue({ code: 'custom', path: ['performanceBudgetRef', 'kind'], message: 'Page requires a performance-budget revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['performanceBudgetRef', 'kind'],
+            message: 'Page requires a performance-budget revision.',
+        });
     if (value.observationPolicyRevisionRef.kind !== 'observation-policy')
-        context.addIssue({ code: 'custom', path: ['observationPolicyRevisionRef', 'kind'], message: 'Page requires an observation-policy revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['observationPolicyRevisionRef', 'kind'],
+            message: 'Page requires an observation-policy revision.',
+        });
 });
 exports.PageReleaseSchema = zod_1.z
     .object({
     contract: zod_1.z.literal('PageRelease'),
     ...ReleaseBaseShape,
     pageRevisionRef: exports.RevisionRefSchema,
-    target: zod_1.z.object({
+    target: zod_1.z
+        .object({
         environmentRef: exports.StableRefSchema,
         surface: exports.ProductSurfaceSchema,
         routeSpaceRevisionRef: exports.RevisionRefSchema,
         normalizedPath: exports.RoutePathTemplateSchema,
         routeClaim: zod_1.z.union([exports.CompiledRouteClaimSchema, LegacyCompiledRouteClaimSchema]),
-    }).strict(),
+        legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
+    })
+        .strict(),
 })
     .strict()
     .superRefine((value, context) => {
+    validateLegacyRestoration(value, 'legacy-route-adapter', context);
     validateDependencySnapshot(value.dependencySnapshot, context);
-    validateReleaseExpectedHead(value, 'page-release', context);
+    validateReleaseGovernanceScope(value, 'page-release', context);
     if (value.pageRevisionRef.kind !== 'page')
-        context.addIssue({ code: 'custom', path: ['pageRevisionRef', 'kind'], message: 'Expected a page revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['pageRevisionRef', 'kind'],
+            message: 'Expected a page revision.',
+        });
     if (value.target.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Page release target requires an environment reference.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'environmentRef', 'kind'],
+            message: 'Page release target requires an environment reference.',
+        });
     if (value.target.routeSpaceRevisionRef.kind !== 'route-space')
-        context.addIssue({ code: 'custom', path: ['target', 'routeSpaceRevisionRef', 'kind'], message: 'Page release target requires a route-space revision.' });
-    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath || !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim'], message: 'Page Release route authority must pin the exact compiled claim and normalized path.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'routeSpaceRevisionRef', 'kind'],
+            message: 'Page release target requires a route-space revision.',
+        });
+    validateReleaseRouteSurface(value.target, context);
+    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath ||
+        !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'routeClaim'],
+            message: 'Page Release route authority must pin the exact compiled claim and normalized path.',
+        });
     }
-    if ('surface' in value.target.routeClaim && value.target.routeClaim.surface !== value.target.surface) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim', 'surface'], message: 'Page Release route claim must match the target surface.' });
+    const takeover = value.target.legacyRouteTakeoverAuthorization;
+    if (takeover &&
+        (value.target.routeClaim.kind !== 'canonical' ||
+            takeover.normalizedPath !== value.target.normalizedPath ||
+            !exactRevisionRef(takeover.routeSpaceRevisionRef, value.target.routeSpaceRevisionRef) ||
+            takeover.targetResourceRef.kind !== 'page' ||
+            takeover.targetResourceRef.id !== value.pageRevisionRef.id ||
+            takeover.targetResourceRef.ownerRepo !== value.pageRevisionRef.ownerRepo)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'legacyRouteTakeoverAuthorization'],
+            message: 'A Page route takeover must bind the exact canonical claim, RouteSpace and target Page.',
+        });
     }
 });
 exports.WorkbenchGroupSchema = zod_1.z
@@ -685,7 +2665,12 @@ exports.WorkbenchAppInstanceSchema = zod_1.z
     input: common_1.JsonObjectSchema,
     groupId: common_1.ContractIdentifierSchema,
     order: zod_1.z.number().int(),
-    display: zod_1.z.object({ name: exports.I18nTextSchema.optional(), iconRef: exports.StableRefSchema.optional() }).strict(),
+    display: zod_1.z
+        .object({
+        name: exports.I18nTextSchema.optional(),
+        iconRef: exports.StableRefSchema.optional(),
+    })
+        .strict(),
     accessPolicy: exports.AccessPolicySchema,
 })
     .strict();
@@ -703,19 +2688,29 @@ exports.WorkbenchSchema = zod_1.z
     routeClaims: zod_1.z.array(zod_1.z.union([exports.DeclarativeRouteClaimSchema, LegacyDeclarativeRouteClaimSchema])).min(1),
     groups: zod_1.z.array(exports.WorkbenchGroupSchema).min(1),
     appInstances: zod_1.z.array(exports.WorkbenchAppInstanceSchema).min(1),
-    defaultEntry: zod_1.z.object({ groupId: common_1.ContractIdentifierSchema, instanceId: common_1.ContractIdentifierSchema, showDefaultGroup: zod_1.z.boolean() }).strict(),
-    layout: zod_1.z.object({
+    defaultEntry: zod_1.z
+        .object({
+        groupId: common_1.ContractIdentifierSchema,
+        instanceId: common_1.ContractIdentifierSchema,
+        showDefaultGroup: zod_1.z.boolean(),
+    })
+        .strict(),
+    layout: zod_1.z
+        .object({
         hostCapabilityRevisionRef: exports.RevisionRefSchema,
         hostProviderRevisionRef: exports.RevisionRefSchema,
         layoutPolicyRevisionRef: exports.RevisionRefSchema,
         tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
-    }).strict(),
+    })
+        .strict(),
     workbenchAccessPolicy: exports.AccessPolicySchema,
     managementAccess: exports.ManagementAccessSchema,
-    personalPreferencesPolicy: zod_1.z.object({
+    personalPreferencesPolicy: zod_1.z
+        .object({
         allowed: zod_1.z.array(zod_1.z.enum(['collapsed-groups', 'recent-entry', 'layout-density'])),
         authority: zod_1.z.literal('identity-overlay'),
-    }).strict(),
+    })
+        .strict(),
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
     privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
@@ -724,22 +2719,42 @@ exports.WorkbenchSchema = zod_1.z
     .superRefine((value, context) => {
     validateDeclaredRouteSurfaces(value.supportedSurfaces, value.routeClaims, context);
     if (value.purpose === 'template' && value.sourceTemplateRevisionRef) {
-        context.addIssue({ code: 'custom', path: ['sourceTemplateRevisionRef'], message: 'Templates cannot derive from another template at runtime.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['sourceTemplateRevisionRef'],
+            message: 'Templates cannot derive from another template at runtime.',
+        });
     }
     const duplicateGroup = uniqueArray(value.groups, (group) => group.groupId);
     if (duplicateGroup)
-        context.addIssue({ code: 'custom', path: ['groups'], message: `Duplicate Workbench group: ${duplicateGroup}` });
+        context.addIssue({
+            code: 'custom',
+            path: ['groups'],
+            message: `Duplicate Workbench group: ${duplicateGroup}`,
+        });
     const duplicateInstance = uniqueArray(value.appInstances, (instance) => instance.instanceId);
     if (duplicateInstance)
-        context.addIssue({ code: 'custom', path: ['appInstances'], message: `Duplicate Workbench instance: ${duplicateInstance}` });
+        context.addIssue({
+            code: 'custom',
+            path: ['appInstances'],
+            message: `Duplicate Workbench instance: ${duplicateInstance}`,
+        });
     const groupIds = new Set(value.groups.map((group) => group.groupId));
     value.appInstances.forEach((instance, index) => {
         if (!groupIds.has(instance.groupId))
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'groupId'], message: 'Workbench app references an unknown group.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['appInstances', index, 'groupId'],
+                message: 'Workbench app references an unknown group.',
+            });
     });
     const defaultInstance = value.appInstances.find((instance) => instance.instanceId === value.defaultEntry.instanceId);
     if (!defaultInstance || defaultInstance.groupId !== value.defaultEntry.groupId) {
-        context.addIssue({ code: 'custom', path: ['defaultEntry'], message: 'Workbench default entry must reference an app in the declared group.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['defaultEntry'],
+            message: 'Workbench default entry must reference an app in the declared group.',
+        });
     }
     const targetKindByInstanceKind = {
         'built-in-application': 'built-in-application',
@@ -751,11 +2766,23 @@ exports.WorkbenchSchema = zod_1.z
     };
     value.appInstances.forEach((instance, index) => {
         if (instance.targetRevisionRef.kind !== targetKindByInstanceKind[instance.kind])
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'targetRevisionRef', 'kind'], message: `Workbench ${instance.kind} target has an incompatible reference kind.` });
+            context.addIssue({
+                code: 'custom',
+                path: ['appInstances', index, 'targetRevisionRef', 'kind'],
+                message: `Workbench ${instance.kind} target has an incompatible reference kind.`,
+            });
         if (instance.providerRevisionRef.kind !== 'view-provider')
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'providerRevisionRef', 'kind'], message: 'Workbench app provider must use kind view-provider.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['appInstances', index, 'providerRevisionRef', 'kind'],
+                message: 'Workbench app provider must use kind view-provider.',
+            });
         if (instance.inputSchemaRevisionRef.kind !== 'schema')
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'inputSchemaRevisionRef', 'kind'], message: 'Workbench app input must pin a schema revision.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['appInstances', index, 'inputSchemaRevisionRef', 'kind'],
+                message: 'Workbench app input must pin a schema revision.',
+            });
     });
     const layoutRefs = [
         ['hostCapabilityRevisionRef', value.layout.hostCapabilityRevisionRef, 'capability'],
@@ -764,11 +2791,19 @@ exports.WorkbenchSchema = zod_1.z
     ];
     layoutRefs.forEach(([field, reference, expectedKind]) => {
         if (reference.kind !== expectedKind)
-            context.addIssue({ code: 'custom', path: ['layout', field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: 'custom',
+                path: ['layout', field, 'kind'],
+                message: `${field} must reference ${expectedKind}.`,
+            });
     });
     value.layout.tokenRevisionRefs.forEach((reference, index) => {
         if (reference.kind !== 'design-token')
-            context.addIssue({ code: 'custom', path: ['layout', 'tokenRevisionRefs', index, 'kind'], message: 'Workbench token references must use kind design-token.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['layout', 'tokenRevisionRefs', index, 'kind'],
+                message: 'Workbench token references must use kind design-token.',
+            });
     });
 });
 exports.WorkbenchReleaseSchema = zod_1.z
@@ -776,32 +2811,65 @@ exports.WorkbenchReleaseSchema = zod_1.z
     contract: zod_1.z.literal('WorkbenchRelease'),
     ...ReleaseBaseShape,
     workbenchRevisionRef: exports.RevisionRefSchema,
-    target: zod_1.z.object({
+    target: zod_1.z
+        .object({
         environmentRef: exports.StableRefSchema,
         surface: exports.ProductSurfaceSchema,
         workbenchId: common_1.ContractIdentifierSchema,
         routeSpaceRevisionRef: exports.RevisionRefSchema,
         normalizedPath: exports.RoutePathTemplateSchema,
         routeClaim: zod_1.z.union([exports.CompiledRouteClaimSchema, LegacyCompiledRouteClaimSchema]),
+        legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
         order: zod_1.z.number().int(),
         isDefaultCandidate: zod_1.z.boolean(),
-    }).strict(),
+    })
+        .strict(),
 })
     .strict()
     .superRefine((value, context) => {
+    validateLegacyRestoration(value, 'legacy-workbench-adapter', context);
     validateDependencySnapshot(value.dependencySnapshot, context);
-    validateReleaseExpectedHead(value, 'workbench-release', context);
+    validateReleaseGovernanceScope(value, 'workbench-release', context);
     if (value.workbenchRevisionRef.kind !== 'workbench')
-        context.addIssue({ code: 'custom', path: ['workbenchRevisionRef', 'kind'], message: 'Expected a workbench revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['workbenchRevisionRef', 'kind'],
+            message: 'Expected a workbench revision.',
+        });
     if (value.target.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Workbench release target requires an environment reference.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'environmentRef', 'kind'],
+            message: 'Workbench release target requires an environment reference.',
+        });
     if (value.target.routeSpaceRevisionRef.kind !== 'route-space')
-        context.addIssue({ code: 'custom', path: ['target', 'routeSpaceRevisionRef', 'kind'], message: 'Workbench release target requires a route-space revision.' });
-    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath || !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim'], message: 'Workbench Release route authority must pin the exact compiled claim and normalized path.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'routeSpaceRevisionRef', 'kind'],
+            message: 'Workbench release target requires a route-space revision.',
+        });
+    validateReleaseRouteSurface(value.target, context);
+    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath ||
+        !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'routeClaim'],
+            message: 'Workbench Release route authority must pin the exact compiled claim and normalized path.',
+        });
     }
-    if ('surface' in value.target.routeClaim && value.target.routeClaim.surface !== value.target.surface) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim', 'surface'], message: 'Workbench Release route claim must match the target surface.' });
+    const takeover = value.target.legacyRouteTakeoverAuthorization;
+    if (takeover &&
+        (value.target.routeClaim.kind !== 'canonical' ||
+            takeover.normalizedPath !== value.target.normalizedPath ||
+            !exactRevisionRef(takeover.routeSpaceRevisionRef, value.target.routeSpaceRevisionRef) ||
+            takeover.targetResourceRef.kind !== 'workbench' ||
+            takeover.targetResourceRef.id !== value.workbenchRevisionRef.id ||
+            takeover.targetResourceRef.ownerRepo !== value.workbenchRevisionRef.ownerRepo)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'legacyRouteTakeoverAuthorization'],
+            message: 'A Workbench route takeover must bind the exact canonical claim, RouteSpace and target Workbench.',
+        });
     }
 });
 const NavigationNodeBaseShape = {
@@ -810,15 +2878,18 @@ const NavigationNodeBaseShape = {
     order: zod_1.z.number().int(),
     disabled: zod_1.z.boolean().optional(),
 };
-exports.NavigationGroupNodeSchema = zod_1.z.object({
+exports.NavigationGroupNodeSchema = zod_1.z
+    .object({
     ...NavigationNodeBaseShape,
     kind: zod_1.z.literal('group'),
     label: exports.I18nTextSchema,
     iconRef: exports.StableRefSchema.optional(),
     collapsedByDefault: zod_1.z.boolean(),
     audience: exports.AccessPolicySchema,
-}).strict();
-exports.NavigationTargetNodeSchema = zod_1.z.object({
+})
+    .strict();
+exports.NavigationTargetNodeSchema = zod_1.z
+    .object({
     ...NavigationNodeBaseShape,
     kind: zod_1.z.literal('target'),
     label: exports.I18nTextSchema,
@@ -827,11 +2898,14 @@ exports.NavigationTargetNodeSchema = zod_1.z.object({
     targetRef: exports.StableRefSchema,
     parameterMapping: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
     audience: exports.AccessPolicySchema,
-}).strict();
-exports.NavigationSeparatorNodeSchema = zod_1.z.object({
+})
+    .strict();
+exports.NavigationSeparatorNodeSchema = zod_1.z
+    .object({
     ...NavigationNodeBaseShape,
     kind: zod_1.z.literal('separator'),
-}).strict();
+})
+    .strict();
 exports.NavigationNodeSchema = zod_1.z.discriminatedUnion('kind', [
     exports.NavigationGroupNodeSchema,
     exports.NavigationTargetNodeSchema,
@@ -841,7 +2915,11 @@ const validateNavigationTree = (nodes, context) => {
     const byId = new Map();
     nodes.forEach((node, index) => {
         if (byId.has(node.nodeId))
-            context.addIssue({ code: 'custom', path: ['nodes', index, 'nodeId'], message: `Duplicate Navigation node: ${node.nodeId}` });
+            context.addIssue({
+                code: 'custom',
+                path: ['nodes', index, 'nodeId'],
+                message: `Duplicate Navigation node: ${node.nodeId}`,
+            });
         else
             byId.set(node.nodeId, { node, index });
     });
@@ -849,20 +2927,36 @@ const validateNavigationTree = (nodes, context) => {
     nodes.forEach((node, index) => {
         const orderKey = `${node.parentNodeId ?? ''}:${node.order}`;
         if (siblingOrders.has(orderKey))
-            context.addIssue({ code: 'custom', path: ['nodes', index, 'order'], message: 'Sibling Navigation order values must be unique.' });
+            context.addIssue({
+                code: 'custom',
+                path: ['nodes', index, 'order'],
+                message: 'Sibling Navigation order values must be unique.',
+            });
         siblingOrders.add(orderKey);
         if (node.parentNodeId) {
             const parent = byId.get(node.parentNodeId)?.node;
             if (!parent)
-                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: 'Navigation node has an unknown parent.' });
+                context.addIssue({
+                    code: 'custom',
+                    path: ['nodes', index, 'parentNodeId'],
+                    message: 'Navigation node has an unknown parent.',
+                });
             else if (parent.kind !== 'group')
-                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: 'Navigation parents must be groups.' });
+                context.addIssue({
+                    code: 'custom',
+                    path: ['nodes', index, 'parentNodeId'],
+                    message: 'Navigation parents must be groups.',
+                });
         }
         const ancestors = new Set([node.nodeId]);
         let parentId = node.parentNodeId;
         while (parentId) {
             if (ancestors.has(parentId)) {
-                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: `Navigation cycle contains ${node.nodeId}.` });
+                context.addIssue({
+                    code: 'custom',
+                    path: ['nodes', index, 'parentNodeId'],
+                    message: `Navigation cycle contains ${node.nodeId}.`,
+                });
                 break;
             }
             ancestors.add(parentId);
@@ -889,8 +2983,13 @@ exports.NavigationSchema = zod_1.z
     .superRefine((value, context) => {
     validateNavigationTree(value.nodes, context);
     value.nodes.forEach((node, index) => {
-        if (node.kind === 'target' && !['page', 'workbench', 'menu-action', 'domain-command'].includes(node.targetRef.kind)) {
-            context.addIssue({ code: 'custom', path: ['nodes', index, 'targetRef', 'kind'], message: 'Navigation targets must reference Page, Workbench, registered Menu Action, or DomainCommand identities.' });
+        if (node.kind === 'target' &&
+            !['page', 'workbench', 'menu-action', 'domain-command'].includes(node.targetRef.kind)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['nodes', index, 'targetRef', 'kind'],
+                message: 'Navigation targets must reference Page, Workbench, registered Menu Action, or DomainCommand identities.',
+            });
         }
     });
 });
@@ -914,34 +3013,51 @@ exports.NavigationReleaseSchema = zod_1.z
     contract: zod_1.z.literal('NavigationRelease'),
     ...ReleaseBaseShape,
     navigationRevisionRef: exports.RevisionRefSchema,
-    target: zod_1.z.object({
+    target: zod_1.z
+        .object({
         environmentRef: exports.StableRefSchema,
         surface: exports.ProductSurfaceSchema,
         placement: common_1.ContractIdentifierSchema,
-    }).strict(),
+    })
+        .strict(),
     resolvedTargets: zod_1.z.array(exports.ResolvedNavigationTargetSchema),
     unavailableTargets: zod_1.z.array(exports.UnavailableNavigationTargetSchema).optional(),
 })
     .strict()
     .superRefine((value, context) => {
+    validateLegacyRestoration(value, 'legacy-navigation-adapter', context);
     validateDependencySnapshot(value.dependencySnapshot, context);
-    validateReleaseExpectedHead(value, 'navigation-release', context);
+    validateReleaseGovernanceScope(value, 'navigation-release', context);
     if (value.navigationRevisionRef.kind !== 'navigation')
-        context.addIssue({ code: 'custom', path: ['navigationRevisionRef', 'kind'], message: 'Expected a navigation revision.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['navigationRevisionRef', 'kind'],
+            message: 'Expected a navigation revision.',
+        });
     if (value.target.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Navigation release target requires an environment reference.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['target', 'environmentRef', 'kind'],
+            message: 'Navigation release target requires an environment reference.',
+        });
     if (uniqueArray(value.resolvedTargets, (target) => target.nodeId))
-        context.addIssue({ code: 'custom', path: ['resolvedTargets'], message: 'Resolved Navigation node IDs must be unique.' });
+        context.addIssue({
+            code: 'custom',
+            path: ['resolvedTargets'],
+            message: 'Resolved Navigation node IDs must be unique.',
+        });
     if (uniqueArray([...value.resolvedTargets, ...(value.unavailableTargets ?? [])], (target) => target.nodeId)) {
         context.addIssue({ code: 'custom', path: ['unavailableTargets'], message: 'Navigation target resolutions must have unique node IDs.' });
     }
 });
-const RuntimeDiagnosticSchema = zod_1.z.object({
+const RuntimeDiagnosticSchema = zod_1.z
+    .object({
     code: common_1.ContractIdentifierSchema,
     severity: zod_1.z.enum(['info', 'warning', 'error']),
     path: zod_1.z.string().trim().min(1),
     message: zod_1.z.string().trim().min(1),
-}).strict();
+})
+    .strict();
 const RuntimeBundleBaseShape = {
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     tenantScope: exports.TenantScopeSchema,
@@ -953,40 +3069,264 @@ const RuntimeBundleBaseShape = {
     rebuildable: zod_1.z.literal(true),
     diagnostics: zod_1.z.array(RuntimeDiagnosticSchema),
 };
-exports.PageRuntimeBundleSchema = zod_1.z.object({
+const validateRuntimeBundleReference = (reference, tenantScope, path, expectedKind, expectedId, context) => {
+    if (reference.kind !== expectedKind) {
+        context.addIssue({
+            code: 'custom',
+            path: [path, 'kind'],
+            message: `${path} must reference ${expectedKind}.`,
+        });
+    }
+    if (expectedId !== undefined && reference.id !== expectedId) {
+        context.addIssue({
+            code: 'custom',
+            path: [path, 'id'],
+            message: `${path} must identify ${expectedId}.`,
+        });
+    }
+    validateTenantCompatibleReference(reference, tenantScope, [path], context);
+};
+const validateRuntimeBundleBase = (value, expectedReleaseKind, context) => {
+    validateRuntimeBundleReference(value.releaseRevisionRef, value.tenantScope, 'releaseRevisionRef', expectedReleaseKind, undefined, context);
+    validateRuntimeBundleReference(value.compilerRevisionRef, value.tenantScope, 'compilerRevisionRef', 'compiler', undefined, context);
+};
+exports.DeclarativeRouteOwnerIndexEntrySchema = zod_1.z
+    .object({
+    resourceKind: zod_1.z.enum(['page', 'workbench']),
+    releaseSlotId: common_1.ContractIdentifierSchema,
+    activeReleaseRevisionRef: exports.RevisionRefSchema,
+    routeClaim: exports.CompiledRouteClaimSchema,
+    authority: zod_1.z.enum(['declarative', 'legacy', 'unavailable']),
+    legacyRestoration: exports.LegacySlotRestorationSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.authority === 'legacy' && !value.legacyRestoration) {
+        context.addIssue({
+            code: 'custom',
+            path: ['legacyRestoration'],
+            message: 'A restored legacy route must pin its exact inspected source and adapter revisions.',
+        });
+    }
+    if (value.authority !== 'legacy' && value.legacyRestoration) {
+        context.addIssue({
+            code: 'custom',
+            path: ['legacyRestoration'],
+            message: 'Only a restored legacy route can carry legacy restoration provenance.',
+        });
+    }
+});
+exports.DeclarativeRouteOwnerIndexSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('DeclarativeRouteOwnerIndex'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    tenantScope: exports.TenantScopeSchema,
+    environmentRef: exports.StableRefSchema,
+    surface: exports.ProductSurfaceSchema,
+    generation: zod_1.z.number().int().positive(),
+    entries: zod_1.z.array(exports.DeclarativeRouteOwnerIndexEntrySchema).max(4096),
+    contentHash: common_1.Sha256Schema,
+    rebuildable: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const identities = value.entries.map((entry) => `${entry.resourceKind}:${entry.releaseSlotId}`);
+    if (new Set(identities).size !== identities.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['entries'],
+            message: 'Route owner index entries must be unique by Release slot.',
+        });
+    }
+    if (identities.some((identity, index) => index > 0 && identities[index - 1].localeCompare(identity) > 0)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['entries'],
+            message: 'Route owner index entries must use deterministic Release-slot order.',
+        });
+    }
+});
+exports.DeclarativeWorkbenchCatalogEntrySchema = zod_1.z
+    .object({
+    workbenchId: common_1.ContractIdentifierSchema,
+    authority: zod_1.z.enum(['declarative', 'legacy', 'unavailable']),
+    identity: exports.WorkbenchIdentitySchema,
+    order: zod_1.z.number().int(),
+    isDefaultCandidate: zod_1.z.boolean(),
+    activeReleaseRevisionRef: exports.RevisionRefSchema.optional(),
+    legacyAdapterRevisionRef: exports.RevisionRefSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.authority === 'declarative') {
+        if (value.activeReleaseRevisionRef?.kind !== 'workbench-release') {
+            context.addIssue({
+                code: 'custom',
+                path: ['activeReleaseRevisionRef'],
+                message: 'A declarative Workbench catalog entry requires an exact Workbench Release.',
+            });
+        }
+        if (value.legacyAdapterRevisionRef) {
+            context.addIssue({
+                code: 'custom',
+                path: ['legacyAdapterRevisionRef'],
+                message: 'A declarative Workbench catalog entry cannot carry a legacy adapter.',
+            });
+        }
+        return;
+    }
+    if (value.activeReleaseRevisionRef) {
+        context.addIssue({
+            code: 'custom',
+            path: ['activeReleaseRevisionRef'],
+            message: 'A non-declarative Workbench entry cannot expose a Workbench Release.',
+        });
+    }
+    if (value.authority === 'legacy' && value.legacyAdapterRevisionRef?.kind !== 'legacy-workbench-adapter') {
+        context.addIssue({
+            code: 'custom',
+            path: ['legacyAdapterRevisionRef'],
+            message: 'A legacy Workbench entry requires an exact legacy-workbench-adapter revision.',
+        });
+    }
+    if (value.authority === 'unavailable' && value.legacyAdapterRevisionRef) {
+        context.addIssue({
+            code: 'custom',
+            path: ['legacyAdapterRevisionRef'],
+            message: 'An unavailable Workbench entry cannot carry a legacy adapter.',
+        });
+    }
+});
+exports.DeclarativeWorkbenchCatalogSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('DeclarativeWorkbenchCatalog'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    tenantScope: exports.TenantScopeSchema,
+    environmentRef: exports.StableRefSchema,
+    surface: exports.ProductSurfaceSchema,
+    generation: zod_1.z.number().int().positive(),
+    entries: zod_1.z.array(exports.DeclarativeWorkbenchCatalogEntrySchema).max(4096),
+    contentHash: common_1.Sha256Schema,
+    rebuildable: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.environmentRef.kind !== 'environment') {
+        context.addIssue({
+            code: 'custom',
+            path: ['environmentRef', 'kind'],
+            message: 'A Workbench catalog requires an Environment reference.',
+        });
+    }
+    const ids = value.entries.map((entry) => entry.workbenchId);
+    if (new Set(ids).size !== ids.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['entries'],
+            message: 'Workbench catalog identities must be unique.',
+        });
+    }
+    if (value.entries.filter((entry) => entry.authority !== 'unavailable' && entry.isDefaultCandidate).length > 1) {
+        context.addIssue({
+            code: 'custom',
+            path: ['entries'],
+            message: 'The effective Workbench catalog may have at most one default.',
+        });
+    }
+    const sorted = [...value.entries].sort((left, right) => left.order - right.order || left.workbenchId.localeCompare(right.workbenchId));
+    if (sorted.some((entry, index) => entry.workbenchId !== value.entries[index]?.workbenchId)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['entries'],
+            message: 'Workbench catalog entries must use deterministic order plus Workbench identity.',
+        });
+    }
+});
+exports.PageRuntimeBundleSchema = zod_1.z
+    .object({
     contract: zod_1.z.literal('PageRuntimeBundle'),
     ...RuntimeBundleBaseShape,
     pageId: common_1.ContractIdentifierSchema,
     pageRevisionRef: exports.RevisionRefSchema,
     surface: exports.ProductSurfaceSchema,
     routeClaims: zod_1.z.array(exports.CompiledRouteClaimSchema),
+    routeStatePresentations: zod_1.z.array(exports.PageRouteStatePresentationSchema).default([]),
     shellRevisionRef: exports.RevisionRefSchema,
+    shellDescriptor: exports.DeclarativeRuntimeShellDescriptorSchema,
     renderTree: render_1.RenderTreeSchema,
     capabilityInstances: zod_1.z.array(exports.CapabilityInstanceSchema),
+    deniedCapabilityInstanceIds: zod_1.z.array(common_1.ContractIdentifierSchema).default([]),
+    capabilityAccessEvaluated: zod_1.z.literal(true).optional(),
+    stateDefinitions: zod_1.z.array(exports.PageStateDefinitionSchema).default([]),
+    entryTransitions: zod_1.z.array(exports.ResolvedPageEntryTransitionSchema).default([]),
+    interactionBindings: zod_1.z.array(exports.InteractionBindingSchema).default([]),
     ontologyBindings: zod_1.z.array(exports.OntologyBindingSchema),
+    queryBindings: zod_1.z.array(exports.QueryBindingSchema).default([]),
     actionBindings: zod_1.z.array(exports.ActionBindingSchema),
     pageAccessPolicy: exports.AccessPolicySchema,
     tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema),
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
     privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
-}).strict();
+})
+    .strict()
+    .superRefine((value, context) => {
+    const instanceIds = new Set(value.capabilityInstances.map((instance) => instance.instanceId));
+    if (new Set(value.deniedCapabilityInstanceIds).size !== value.deniedCapabilityInstanceIds.length ||
+        value.deniedCapabilityInstanceIds.some((id) => !instanceIds.has(id))) {
+        context.addIssue({
+            code: 'custom',
+            path: ['deniedCapabilityInstanceIds'],
+            message: 'Denied capability identities must be unique declared instances.',
+        });
+    }
+    validateRuntimeBundleBase(value, 'page-release', context);
+    value.routeClaims.forEach((claim, index) => {
+        if (claim.surface !== value.surface) {
+            context.addIssue({
+                code: 'custom',
+                path: ['routeClaims', index, 'surface'],
+                message: 'Runtime route claims must match the bundle surface.',
+            });
+        }
+    });
+    validateRuntimeBundleReference(value.pageRevisionRef, value.tenantScope, 'pageRevisionRef', 'page', value.pageId, context);
+    value.routeStatePresentations.forEach((presentation, index) => {
+        if (presentation.surface !== value.surface) {
+            context.addIssue({
+                code: 'custom',
+                path: ['routeStatePresentations', index, 'surface'],
+                message: 'Runtime route-state presentations must match the compiled Page surface.',
+            });
+        }
+    });
+});
 exports.ResolvedWorkbenchAppInstanceSchema = exports.WorkbenchAppInstanceSchema.extend({
     targetAccessPolicy: exports.AccessPolicySchema,
 }).strict();
-const WorkbenchRuntimeTargetSchema = exports.WorkbenchReleaseSchema.shape.target.safeExtend({
+exports.WorkbenchRuntimeIdentitySchema = zod_1.z
+    .object({
+    name: exports.I18nTextSchema,
+    description: exports.I18nTextSchema.optional(),
+})
+    .strict();
+const WorkbenchRuntimeTargetSchema = exports.WorkbenchReleaseSchema.shape.target
+    .safeExtend({
     routeClaim: exports.CompiledRouteClaimSchema,
-}).strict();
-exports.WorkbenchRuntimeBundleSchema = zod_1.z.object({
+})
+    .strict();
+exports.WorkbenchRuntimeBundleSchema = zod_1.z
+    .object({
     contract: zod_1.z.literal('WorkbenchRuntimeBundle'),
     ...RuntimeBundleBaseShape,
     workbenchId: common_1.ContractIdentifierSchema,
     workbenchRevisionRef: exports.RevisionRefSchema,
+    identity: exports.WorkbenchRuntimeIdentitySchema,
     surface: exports.ProductSurfaceSchema,
     routeClaims: zod_1.z.array(exports.CompiledRouteClaimSchema),
     groups: zod_1.z.array(exports.WorkbenchGroupSchema),
     appInstances: zod_1.z.array(exports.ResolvedWorkbenchAppInstanceSchema),
-    defaultEntry: exports.WorkbenchSchema.shape.defaultEntry,
+    defaultEntry: exports.WorkbenchSchema.shape.defaultEntry.nullable(),
     layout: exports.WorkbenchSchema.shape.layout,
     workbenchAccessPolicy: exports.AccessPolicySchema,
     personalPreferencesPolicy: exports.WorkbenchSchema.shape.personalPreferencesPolicy,
@@ -994,7 +3334,54 @@ exports.WorkbenchRuntimeBundleSchema = zod_1.z.object({
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
     privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
-}).strict();
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateRuntimeBundleBase(value, 'workbench-release', context);
+    value.routeClaims.forEach((claim, index) => {
+        if (claim.surface !== value.surface) {
+            context.addIssue({
+                code: 'custom',
+                path: ['routeClaims', index, 'surface'],
+                message: 'Runtime route claims must match the bundle surface.',
+            });
+        }
+    });
+    validateRuntimeBundleReference(value.workbenchRevisionRef, value.tenantScope, 'workbenchRevisionRef', 'workbench', value.workbenchId, context);
+    if (value.appInstances.length === 0) {
+        if (value.defaultEntry !== null) {
+            context.addIssue({
+                code: 'custom',
+                path: ['defaultEntry'],
+                message: 'An empty Workbench runtime bundle must use a null default entry.',
+            });
+        }
+        return;
+    }
+    if (value.defaultEntry === null) {
+        context.addIssue({
+            code: 'custom',
+            path: ['defaultEntry'],
+            message: 'A non-empty Workbench runtime bundle requires a default entry.',
+        });
+        return;
+    }
+    const defaultInstance = value.appInstances.find((instance) => instance.instanceId === value.defaultEntry?.instanceId);
+    if (!defaultInstance || defaultInstance.groupId !== value.defaultEntry.groupId) {
+        context.addIssue({
+            code: 'custom',
+            path: ['defaultEntry'],
+            message: 'Workbench runtime default entry must reference a visible app in the declared group.',
+        });
+    }
+    if (!value.groups.some((group) => group.groupId === value.defaultEntry?.groupId)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['defaultEntry', 'groupId'],
+            message: 'Workbench runtime default entry must reference a visible group.',
+        });
+    }
+});
 const CompiledNavigationTargetSchema = exports.ResolvedNavigationTargetSchema.extend({
     kind: zod_1.z.literal('route'),
     accessPolicy: exports.AccessPolicySchema,
@@ -1047,7 +3434,8 @@ exports.CompiledNavigationNodeSchema = zod_1.z.discriminatedUnion('kind', [
     exports.CompiledNavigationTargetNodeSchema,
     exports.CompiledNavigationSeparatorNodeSchema,
 ]);
-exports.NavigationRuntimeBundleSchema = zod_1.z.object({
+exports.NavigationRuntimeBundleSchema = zod_1.z
+    .object({
     contract: zod_1.z.literal('NavigationRuntimeBundle'),
     ...RuntimeBundleBaseShape,
     navigationId: common_1.ContractIdentifierSchema,
@@ -1057,16 +3445,23 @@ exports.NavigationRuntimeBundleSchema = zod_1.z.object({
     nodes: zod_1.z.array(exports.CompiledNavigationNodeSchema),
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
-}).strict();
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateRuntimeBundleBase(value, 'navigation-release', context);
+    validateRuntimeBundleReference(value.navigationRevisionRef, value.tenantScope, 'navigationRevisionRef', 'navigation', value.navigationId, context);
+});
 exports.DeclarativeControlOntologyDefinitionSchema = data_1.OntologyDefinitionSchema.extend({
     classification: zod_1.z.literal('control'),
-    discovery: zod_1.z.object({
+    discovery: zod_1.z
+        .object({
         ordinaryDataBrowser: zod_1.z.literal(false),
         businessSearch: zod_1.z.literal(false),
         businessStatistics: zod_1.z.literal(false),
         ordinaryExport: zod_1.z.literal(false),
         genericWrite: zod_1.z.literal(false),
-    }).strict(),
+    })
+        .strict(),
 }).strict();
 const controlDefinition = (ontologyId, bodySchemaRef) => exports.DeclarativeControlOntologyDefinitionSchema.parse({
     contract: 'OntologyDefinition',
@@ -1074,7 +3469,11 @@ const controlDefinition = (ontologyId, bodySchemaRef) => exports.DeclarativeCont
     dataSpaceId: 'monkeys.control',
     ownerRepo: 'monkeys-js-sdk',
     bodySchemaRef,
-    authority: { service: 'monkeys-data-server', storage: 'domain-record', scope: 'tenant' },
+    authority: {
+        service: 'monkeys-data-server',
+        storage: 'domain-record',
+        scope: 'tenant',
+    },
     relationKinds: [],
     metricKinds: [],
     classification: 'control',