@objectstack/lint 17.0.0-rc.0 → 17.0.0-rc.2

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { Manifest } from '@objectstack/sdui-parser';
 import { AccessMatrix } from '@objectstack/spec/security';
+export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimeStackContext, m as authoringRulesFor, r as runAuthoringRules, n as runRuntimeAuthoringRules, o as runtimeAuthoringRulesFor, p as runtimeGatedTypes, s as splitBySeverity, q as stackKeyForType } from './runtime-Cs64ShwN.js';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -94,7 +95,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$t = Record<string, unknown>;
+type AnyRec$C = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -102,7 +103,7 @@ type AnyRec$t = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$t): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$C): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -115,12 +116,56 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$s = Record<string, unknown>;
+type AnyRec$B = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$s): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$B): ExprIssue[];
+
+/**
+ * The corrective sentence, lifted **verbatim** from `unevaluableRuleError` in
+ * `packages/objectql/src/validation/rule-validator.ts` so the publish-time and
+ * runtime messages read identically — an author who hits one and then the other
+ * must not have to reconcile two phrasings of one rule (#4763).
+ */
+declare const NULL_GUARD_HINT: string;
+interface NullGuardOptions {
+    /** Field names of the object that may hold `null` at evaluation time. */
+    nullableFields: ReadonlySet<string>;
+    /** Roots bound to the object's record shape. Defaults to `record`/`previous`. */
+    roots?: readonly string[];
+}
+interface NullGuardFinding {
+    /** The operand as written, e.g. `record.end_date`. */
+    operand: string;
+    /** The declared field the operand resolves to, e.g. `end_date`. */
+    field: string;
+    /** The operator with no null overload, e.g. `<`. */
+    operator: string;
+    /**
+     * True when the predicate "guards" this operand with `has()` and nothing
+     * else — the exact trap #4763 exists to reject. Used only to sharpen the
+     * message; the verdict is the same either way.
+     */
+    hasOnlyGuard: boolean;
+}
+/**
+ * Find every ordering/arithmetic operand that resolves to a nullable declared
+ * field and is not dominated by a real null guard. Returns `[]` for anything
+ * that does not parse (syntax is reported by `validateExpression`, not here) —
+ * this pass never invents a second syntax verdict.
+ */
+declare function findUnguardedNullableOperands(source: string, opts: NullGuardOptions): NullGuardFinding[];
+/**
+ * The publish-time message for one finding. Names the rule, the operand and the
+ * `!= null` fix (the three things the author needs), then closes with the
+ * verbatim runtime sentence so the two gates speak with one voice.
+ *
+ * @param subject  How the site names itself, e.g. `validation rule 'end_after_start'`.
+ * @param objectName  The object whose field list decided nullability.
+ */
+declare function nullGuardMessage(subject: string, objectName: string | undefined, finding: NullGuardFinding): string;
 
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
@@ -134,7 +179,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$r = Record<string, unknown>;
+type AnyRec$A = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -144,7 +189,25 @@ type AnyRec$r = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$r): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$A): ListViewModeFinding[];
+
+type FunctionalCompletenessSeverity = 'error' | 'warning';
+interface FunctionalCompletenessFinding {
+    severity: FunctionalCompletenessSeverity;
+    /** Stable rule id from the shared predicate (e.g. `field/summary-without-operations`). */
+    rule: string;
+    /** Human-readable location, e.g. `object "order" › fields.total`. */
+    where: string;
+    /** Config path, e.g. `objects[2].fields.total.summaryOperations`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/**
+ * Walk every field definition and every list-view definition in the stack
+ * through the shared completeness predicate.
+ */
+declare function validateFunctionalCompleteness(stack: unknown): FunctionalCompletenessFinding[];
 
 type FlowTriggerReadinessSeverity = 'error' | 'warning';
 interface FlowTriggerReadinessFinding {
@@ -159,12 +222,12 @@ interface FlowTriggerReadinessFinding {
 }
 declare const FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 declare const FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
-type AnyRec$q = Record<string, unknown>;
+type AnyRec$z = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  * Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$q): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$z): FlowTriggerReadinessFinding[];
 
 type FlowTemplatePathSeverity = 'error' | 'warning';
 interface FlowTemplatePathFinding {
@@ -179,12 +242,12 @@ interface FlowTemplatePathFinding {
 }
 declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
-type AnyRec$p = Record<string, unknown>;
+type AnyRec$y = Record<string, unknown>;
 /**
  * Validate `{record.<path>}` template references across every record-change
  * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTemplatePaths(stack: AnyRec$p): FlowTemplatePathFinding[];
+declare function validateFlowTemplatePaths(stack: AnyRec$y): FlowTemplatePathFinding[];
 
 type ReadonlyFlowWriteSeverity = 'error' | 'warning';
 interface ReadonlyFlowWriteFinding {
@@ -199,12 +262,12 @@ interface ReadonlyFlowWriteFinding {
 }
 declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-type AnyRec$o = Record<string, unknown>;
+type AnyRec$x = Record<string, unknown>;
 /**
  * Validate flow `update_record` writes against target-object readonly
  * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateReadonlyFlowWrites(stack: AnyRec$o): ReadonlyFlowWriteFinding[];
+declare function validateReadonlyFlowWrites(stack: AnyRec$x): ReadonlyFlowWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -241,14 +304,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$n = Record<string, unknown>;
+type AnyRec$w = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$n): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$w): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -261,8 +324,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$m = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$m, opts?: {
+type AnyRec$v = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$v, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -275,8 +338,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$l = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$l): ReactPageFinding[];
+type AnyRec$u = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$u): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -287,11 +350,12 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$k = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
-declare function validateReactPageProps(stack: AnyRec$k): ReactPropFinding[];
+declare const REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
+declare function validateReactPageProps(stack: AnyRec$t): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -303,8 +367,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$j = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$j): SourceStyleFinding[];
+type AnyRec$s = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$s): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -348,14 +412,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$i = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$i): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$r): RecordTitleFinding[];
 
 /**
  * Build-time semantic-role diagnostics (ADR-0085).
@@ -392,13 +456,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$h = Record<string, unknown>;
+type AnyRec$q = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$h): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$q): SemanticRoleFinding[];
 
 /**
  * Build-time form-layout diagnostics (#2578).
@@ -441,12 +505,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$p = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$g): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$p): FormLayoutFinding[];
 
 /**
  * Build-time conditional-visibility diagnostics (ADR-0089 D3b).
@@ -508,7 +572,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$f = Record<string, unknown>;
+type AnyRec$o = Record<string, unknown>;
 /**
  * Validate conditional-visibility keys across authored views and pages.
  *
@@ -523,7 +587,7 @@ type AnyRec$f = Record<string, unknown>;
  * `*.view.ts` / `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The
  * alias-deprecated check is layer-agnostic.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$f, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$o, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -541,12 +605,12 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$e = Record<string, unknown>;
+type AnyRec$n = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$e): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$n): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
@@ -571,12 +635,12 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$d = Record<string, unknown>;
+type AnyRec$m = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$d): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$m): ApprovalApproverFinding[];
 
 type SeedReplaySafetySeverity = 'error' | 'warning';
 interface SeedReplaySafetyFinding {
@@ -590,7 +654,7 @@ interface SeedReplaySafetyFinding {
     hint: string;
 }
 declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
-type AnyRec$c = Record<string, unknown>;
+type AnyRec$l = Record<string, unknown>;
 /**
  * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
  * mode, which duplicates its rows on every replay boot (framework#3434). Returns
@@ -600,7 +664,7 @@ type AnyRec$c = Record<string, unknown>;
  * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
  * with no `data` array yields no findings.
  */
-declare function validateSeedReplaySafety(stack: AnyRec$c): SeedReplaySafetyFinding[];
+declare function validateSeedReplaySafety(stack: AnyRec$l): SeedReplaySafetyFinding[];
 
 type SeedStateMachineSeverity = 'warning';
 interface SeedStateMachineFinding {
@@ -614,7 +678,7 @@ interface SeedStateMachineFinding {
     hint: string;
 }
 declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
-type AnyRec$b = Record<string, unknown>;
+type AnyRec$k = Record<string, unknown>;
 /**
  * Flag every seed record whose `state_machine`-governed field carries a value
  * the machine does not declare (framework#3433 follow-up). Returns the findings
@@ -627,7 +691,7 @@ type AnyRec$b = Record<string, unknown>;
  * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
  * statically compared to the declared-state set.
  */
-declare function validateSeedStateMachine(stack: AnyRec$b): SeedStateMachineFinding[];
+declare function validateSeedStateMachine(stack: AnyRec$k): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -654,7 +718,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
+type AnyRec$j = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -662,7 +726,7 @@ type AnyRec$a = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$a, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$j, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 
@@ -796,13 +860,13 @@ interface DashboardActionRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$9 = Record<string, unknown>;
+type AnyRec$i = Record<string, unknown>;
 /**
  * Validate every dashboard header / widget action reference in a stack. Returns
  * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
  * unresolved routes are warnings.
  */
-declare function validateDashboardActionRefs(stack: AnyRec$9): DashboardActionRefFinding[];
+declare function validateDashboardActionRefs(stack: AnyRec$i): DashboardActionRefFinding[];
 
 /**
  * Build-time filter-placeholder diagnostics (issue #3574).
@@ -900,12 +964,247 @@ interface ObjectRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$8 = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /**
  * Validate every object-name reference on the surfaces listed in the module
  * header. Returns findings (empty = clean).
  */
-declare function validateObjectReferences(stack: AnyRec$8): ObjectRefFinding[];
+declare function validateObjectReferences(stack: AnyRec$h): ObjectRefFinding[];
+
+type ReferenceIntegritySeverity = 'error' | 'warning';
+/**
+ * The shape every rule in the suite already returns. Declared here so callers
+ * can hold one type instead of a six-way union.
+ */
+interface ReferenceIntegrityFinding {
+    /** `error` = the reference is dead; `warning` = it may resolve elsewhere, or the miss is inert. */
+    severity: ReferenceIntegritySeverity;
+    /** Diagnostic rule id (stable; used by allowlists and docs). */
+    rule: string;
+    /** Human-readable location. */
+    where: string;
+    /** Config path. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/** One member of the suite. `name` is the exported function's name — the id a wiring test can assert on. */
+interface ReferenceIntegrityRule {
+    name: string;
+    run: (stack: Record<string, unknown>) => ReferenceIntegrityFinding[];
+}
+/**
+ * Every reference-integrity rule, in the order their findings are reported.
+ *
+ * ADDING A RULE: append it here and it runs on `validate`, `lint` and
+ * `compile` at once. Do not re-wire the commands.
+ */
+declare const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[];
+/**
+ * Run every reference-integrity rule over a stack. Returns the concatenated
+ * findings (empty = clean). Pure: no I/O, safe on both the schema-parsed stack
+ * and the raw/normalized config the `lint` path carries.
+ */
+declare function validateReferenceIntegrity(stack: Record<string, unknown>): ReferenceIntegrityFinding[];
+
+/**
+ * [ADR-0072 — reference resolvability] App-navigation targets that are not
+ * object names: `page`, `report`, `dashboard`.
+ *
+ * ## The hole this closes is inside an EXISTING check, not a missing one
+ *
+ * `defineStack`'s `validateCrossReferences` already validates these three
+ * (`stack.zod.ts`, the "Validate app navigation → object/dashboard/page/report
+ * references" block). But each of the three is guarded on the collection being
+ * non-empty:
+ *
+ * ```ts
+ * if (nav.type === 'page' && typeof nav.pageName === 'string'
+ *     && pageNames.size > 0 && !pageNames.has(nav.pageName)) { … }
+ * ```
+ *
+ * So a stack that declares **no `pages` at all** has its page-nav check
+ * silently switched off, and `{ type: 'page', pageName: 'anything' }` sails
+ * through. That is precisely the state a stack is in when the target was never
+ * written — the most likely way to get here, not the least.
+ *
+ * Note the asymmetry the guard creates. The `object` arm of the same block has
+ * no size gate: it errors unless the item carries `requiresObject`, an
+ * EXPLICIT opt-in to "another package provides this". Objects therefore say so
+ * out loud; pages, reports and dashboards get an implicit exemption that
+ * depends on an unrelated property of the stack.
+ *
+ * This rule restores the coverage with the ADR-0072 severity posture rather
+ * than by tightening the parse-time throw — a throw has no escape hatch for a
+ * legitimately cross-package page, and ADR-0072 D1's rule is that one dead
+ * finding costs more than a missed one.
+ *
+ * ## Severity: warning, and why it is not error
+ *
+ * `validate-object-references` can say ERROR for an unresolved *object*
+ * because it resolves against a curated `PLATFORM_PROVIDED_OBJECT_NAMES`
+ * registry — it knows which cross-package names are real. No such registry
+ * exists for pages, reports or dashboards, so "unresolved" genuinely cannot be
+ * distinguished from "provided by a package we cannot see from here".
+ * Advisory is the honest ceiling. When `defineStack`'s own check is live (the
+ * collection is non-empty) it still hard-fails first; this rule is what speaks
+ * when that check has switched itself off.
+ *
+ * ## Deliberately NOT covered — each verified, not assumed
+ *
+ * - **`action`** (`actionDef.actionName`) — already owned by
+ *   `validate-action-name-refs`, which walks app navigation explicitly. Adding
+ *   it here would double-report the same finding.
+ * - **`component`** (`componentRef`) — verified a NON-rule. An unregistered ref
+ *   does NOT fail silently: `ComponentNavView` renders a named diagnostic
+ *   ("Component not registered … Ensure the plugin that provides this surface
+ *   is installed and has called `registerAppComponent()`"), and the registry
+ *   exists precisely so plugin-provided surfaces may legitimately be absent.
+ *   Flagging it would break valid plugin nav and prescribe a fix for something
+ *   already reported better at runtime.
+ * - **`url`** — external by definition; nothing to resolve against.
+ */
+
+type NavTargetRefSeverity = 'error' | 'warning';
+type NavTargetRefFinding = ReferenceIntegrityFinding;
+/** Emitted when a nav item targets a page/report/dashboard the stack cannot resolve. */
+declare const NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
+declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
+
+/**
+ * [ADR-0061 — searchable set] `searchableFields` entries must name a field the
+ * object actually has — and, on a list view, one the runtime will agree to scan.
+ *
+ * `searchableFields` is `z.array(z.string())` in both `object.zod.ts` and the
+ * list-view schema, so nothing checks that an entry resolves to anything. Rename
+ * a field and the old name stays behind: Zod-valid, shipped, and pointing at a
+ * column that no longer exists.
+ *
+ * ── Why a stale entry is not merely inert ────────────────────────────────
+ *
+ * The engine tolerates it. `resolveSearchFields` (`@objectstack/objectql`)
+ * filters the declaration down to fields that exist —
+ * `searchableFields?.filter((f) => all[f])` — so a stale name is dropped
+ * without a word. That tolerance is what makes the drift invisible, and it
+ * fails in the direction nobody expects:
+ *
+ *   - Some entries stale → `$search` quietly scans a NARROWER set than the
+ *     object declares. Records that should match do not, and the response is
+ *     indistinguishable from "no such record".
+ *   - EVERY entry stale → the filtered set is empty, so resolution falls
+ *     through to the AUTO-DEFAULT (name/title + short-text fields). A
+ *     declaration whose entire purpose is to CHOOSE the searchable set ends up
+ *     selecting a set the author never wrote — the same "asked narrower,
+ *     answered wider" inversion #4226 closed on the projection axis.
+ *
+ * And it does not stay quiet downstream. objectui's list search echoes
+ * `schema.searchableFields` verbatim as the `$searchFields` override, so once
+ * the REST read path validates that override against the object (#4254), a
+ * stale declaration the engine had been silently skipping becomes a `400
+ * INVALID_FIELD` on every list search for that object — a request-time break
+ * whose cause is an authoring typo made long before.
+ *
+ * Hence `error`, not the advisory level the other field-existence rules use
+ * (`page-field-unknown`, `form-field-unknown`, `semantic-role-field-unknown`
+ * are all warnings). Those describe a consumer that SKIPS an unknown name and
+ * renders the rest; this one describes a declaration that either selects the
+ * wrong set or refuses the request outright. It is the same call
+ * `validate-flow-template-paths` makes for a filter-position token: gating when
+ * the miss widens the query rather than shrinking the page.
+ *
+ * ── What is checked ──────────────────────────────────────────────────────
+ *
+ * 1. EXISTENCE, on every surface (`searchable-field-unknown`): an entry that
+ *    resolves to no field at all is drift, whatever declared it.
+ *
+ * 2. RUNTIME ADMISSIBILITY, on view-level narrowings only
+ *    (`searchable-field-unsearchable`, #4830): a list view's
+ *    `searchableFields` is echoed verbatim by clients as the `$searchFields`
+ *    override, and the #4254 ingress gate
+ *    (`assertSearchFieldsAreSearchable`, `@objectstack/metadata-protocol`)
+ *    refuses any entry outside the object's server-resolved allowed set — so
+ *    ONE lookup-typed entry 400s EVERY toolbar search on that list, for every
+ *    role, and until #4830 `compile`/`validate` passed it in silence. The
+ *    allowed set here is computed by the very function the runtime gate and
+ *    the engine consult — {@link resolveSearchFieldResolution}
+ *    (`@objectstack/spec/data`) — never by a second copy of its type list, so
+ *    linter, gate and engine cannot drift apart (the same one-source move
+ *    #4254 made between gate and engine).
+ *
+ * The OBJECT's own `searchableFields` stays existence-only: the runtime's
+ * declared branch filters by existence, never by type, so a json or lookup
+ * column declared THERE is a choice the engine executes (a `$contains` over
+ * the raw column), not a 400. Flagging it would reject metadata the runtime
+ * accepts — the false finding that makes authors stop trusting the linter
+ * (ADR-0072 D1).
+ *
+ * Three skips keep false positives near zero (ADR-0072 D1):
+ *
+ *   1. An object this stack does not define. It may come from another package,
+ *      and a field map we cannot see cannot be judged (the same skip the
+ *      page/flow/widget rules take).
+ *   2. An object that declares no field map at all — external objects and
+ *      datasource-introspected schemas whose columns are resolved at runtime.
+ *   3. Registry-injected system columns, which exist at runtime but never
+ *      appear in authored `fields` — the package-shared `SYSTEM_FIELDS`
+ *      (`system-fields.ts`), derived from the spec's own declarations rather
+ *      than hand-copied (#4330). The admissibility check also skips them:
+ *      their runtime field metadata (type, hidden) is registry-owned and not
+ *      visible here, and judging a column we cannot see risks the false
+ *      positive this list exists to avoid. (Cost asymmetry: a system column
+ *      the runtime would refuse — `created_by` in a view's narrowing — is a
+ *      missed finding, not a wrong one.)
+ *
+ * Dotted paths are NOT skipped here, unlike every sibling rule. Elsewhere
+ * `owner_id.name` is left alone because the query engine resolves the traversal;
+ * search does not — `resolveSearchFields` matches the field map by exact string,
+ * so a dotted entry is dropped exactly like a typo. Skipping it would exempt the
+ * one wrong spelling most likely to be borrowed from `select`/`sort`.
+ */
+
+declare const SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
+declare const SEARCHABLE_FIELD_UNSEARCHABLE = "searchable-field-unsearchable";
+type SearchableFieldSeverity = 'error' | 'warning';
+interface SearchableFieldFinding {
+    /** Always `error` — a stale entry narrows, widens or refuses the search (see module note). */
+    severity: SearchableFieldSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "crm_lead"`. */
+    where: string;
+    /** Config path, e.g. `objects[0].searchableFields[2]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Which runtime judgment applies to the declaration being checked:
+ *
+ * - `'canonical'` — the object's own `searchableFields`. The runtime honors
+ *   any entry that exists (existence-filtered, never type-filtered), so only
+ *   existence is checked.
+ * - `'narrowing'` — a list view's `searchableFields` (metadata or react
+ *   surface). Clients echo it as the `$searchFields` override, which the
+ *   #4254 ingress gate intersects with the object's allowed set — entries the
+ *   runtime would refuse are flagged (#4830).
+ */
+type SearchableFieldRole = 'canonical' | 'narrowing';
+type AnyRec$g = Record<string, unknown>;
+/**
+ * Validate every `searchableFields` declaration in the stack — the object's own
+ * (the canonical set, ADR-0061) and the list views that narrow it. Returns
+ * findings (empty = clean).
+ *
+ * The react page surface (`<ListView searchableFields={…}>`) is deliberately
+ * NOT walked here: its declaration lives inside JSX source, and
+ * `validate-react-page-props` — the gate that already parses that source —
+ * runs the same `checkSearchableFieldList` core on it (#4329).
+ */
+declare function validateSearchableFields(stack: AnyRec$g): SearchableFieldFinding[];
 
 declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
 type ActionNameRefSeverity = 'error' | 'warning';
@@ -923,12 +1222,84 @@ interface ActionNameRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$7 = Record<string, unknown>;
+type AnyRec$f = Record<string, unknown>;
 /**
  * Validate every name-bound action reference in a stack. Returns findings
  * (empty = clean).
  */
-declare function validateActionNameRefs(stack: AnyRec$7): ActionNameRefFinding[];
+declare function validateActionNameRefs(stack: AnyRec$f): ActionNameRefFinding[];
+
+/**
+ * [ADR-0078 Phase 3 — Tier-A `action-locations`] An action nobody placed.
+ *
+ * `locations` is an action's placement declaration. An action that omits it —
+ * and that no view names in `bulkActions` / `bulkActionDefs` / `rowActions` —
+ * has no surface at all: it parses, it publishes, Setup lists it, and no user
+ * can ever click it. ADR-0078 names this shape in its opening paragraph ("a
+ * `summary` with no `summaryOperations`; **an `action` with no `locations`**;
+ * … Each parses, 'renders', reports success — and does nothing") and Phase 3
+ * asks for exactly this rule, one verified shape at a time.
+ *
+ * The renderer half is now unambiguous: objectui#3142 collapsed four
+ * disagreeing renderers onto one predicate — an action renders at a location
+ * only if it DECLARES that location. Before that, `action:bar` and the record
+ * header showed an undeclared action *everywhere*, which is what made this
+ * shape look alive; it is measurably inert as of objectui 17.1.
+ *
+ * ## What is NOT flagged, and why
+ *
+ * **`locations: []` — a deliberate headless action.** `content/docs/ui/
+ * actions.mdx` ("Headless actions: declare it, then hide it") documents the
+ * empty array as a first-class shape: the action stays callable over REST /
+ * MCP / AI and keeps its capability gate, param contract and audit trail,
+ * while claiming no UI surface. ADR-0110 D3 refuses an *undeclared* handler,
+ * so a headless declaration is the only legal way to expose such an action —
+ * flagging it would fight that ADR. The distinction this rule draws is
+ * therefore between an author who said "nowhere, deliberately" (`[]`) and one
+ * who never said anything at all (key absent).
+ *
+ * **Actions a view places by NAME.** Naming an action in a list view's
+ * `bulkActions` or `bulkActionDefs` IS its placement — the selection bar is
+ * driven by the view, never by `locations` (that is what the retired
+ * `action.bulkEnabled` tombstone prescribes, and what objectui#3139's
+ * aggregate bulk mode relies on: an action that only makes sense over a
+ * selection has no single-record location by construction). `rowActions` is
+ * exempted on the same zero-false-positive posture (ADR-0072 D1): it is the
+ * same field pair on the same container, and an author who named an action
+ * there has stated an intent — a name that resolves to nothing is already
+ * `action-name-undefined`'s job, not this rule's.
+ *
+ * Scope note: this rule asks only "did anyone place this action?". It
+ * deliberately does NOT check that a declared location is one a renderer
+ * actually serves, nor that a view's named action belongs to that view's
+ * object — distinct classes with their own rules. Cross-package placement (a
+ * view in another installed package naming this action) is the one legitimate
+ * miss, which is why this is a **warning**: like every other "declared but
+ * does nothing" finding in this package (`validateSemanticRoles`,
+ * `lintLivenessProperties`), it is high-signal and never fatal.
+ */
+declare const ACTION_NO_PLACEMENT = "action-no-placement";
+type ActionLocationsSeverity = 'error' | 'warning';
+interface ActionLocationsFinding {
+    /** Always `warning` — cross-package placement is a legitimate miss. */
+    severity: ActionLocationsSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `action "crm_convert_lead"`. */
+    where: string;
+    /** Config path, e.g. `actions[2]` or `objects[0].actions[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$e = Record<string, unknown>;
+/**
+ * Flag every action that declares no placement and that no view places by
+ * name. Returns findings (empty = clean).
+ */
+declare function validateActionLocations(stack: AnyRec$e): ActionLocationsFinding[];
 
 /**
  * Shared page-component traversal for the lint rules that inspect
@@ -954,7 +1325,7 @@ declare function validateActionNameRefs(stack: AnyRec$7): ActionNameRefFinding[]
  *     author never wrote, so those pages are skipped here and covered by
  *     `validate-jsx-pages` / `validate-react-page-props` instead.
  */
-type AnyRec$6 = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 
 /**
  * [ADR-0078 — completeness] Field-reference integrity for page components
@@ -993,11 +1364,28 @@ type AnyRec$6 = Record<string, unknown>;
  * `record:details` `sections[].fields[]` and `hideFields[]`, and the record
  * picker's `labelField`. Linting the schema's shape alone would find nothing on
  * the actual corpus.
+ *
+ * ── Shared with the react page surface ──────────────────────────────────
+ *
+ * A `kind:'react'` page authors the SAME components, one surface over, as JSX
+ * props instead of a `properties` bag (`<RecordHighlights fields={…}>`). The
+ * extraction and the check are therefore exported — `COMPONENT_FIELD_SPECS`,
+ * {@link componentFieldRefs}, {@link relatedListFieldRefs},
+ * {@link indexObjectFields}, {@link checkFieldRefs} — and
+ * `validate-react-page-props` runs them on the parsed JSX (#4340). Same table,
+ * same skips, same rule id: the two surfaces agree on what counts as a field by
+ * construction rather than by two lists that happen to match, which is the
+ * drift #4330 had just finished removing from the system-field lists.
  */
 declare const PAGE_FIELD_UNKNOWN = "page-field-unknown";
 type PageFieldSeverity = 'error' | 'warning';
 interface PageFieldFinding {
-    /** Always `warning` — page renderers skip an unknown field rather than fail. */
+    /**
+     * `warning` on every surface this rule itself walks — page renderers skip an
+     * unknown field rather than fail. The shared {@link checkFieldRefs} core also
+     * serves the react page surface, where one batch of refs reaches a QUERY
+     * rather than a renderer and gates instead; see {@link FieldRefConsequence}.
+     */
     severity: PageFieldSeverity;
     /** Diagnostic rule id. */
     rule: string;
@@ -1011,7 +1399,7 @@ interface PageFieldFinding {
     hint: string;
 }
 
-declare function validatePageFieldBindings(stack: AnyRec$6): PageFieldFinding[];
+declare function validatePageFieldBindings(stack: AnyRec$d): PageFieldFinding[];
 
 /**
  * [ADR-0021 — semantic layer] Chart-binding integrity for the surfaces the
@@ -1068,7 +1456,7 @@ interface ChartBindingFinding {
     hint: string;
 }
 
-declare function validateChartBindings(stack: AnyRec$6): ChartBindingFinding[];
+declare function validateChartBindings(stack: AnyRec$d): ChartBindingFinding[];
 
 declare const NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
 type NavAccessSeverity = 'error' | 'warning';
@@ -1086,12 +1474,12 @@ interface NavAccessFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$5 = Record<string, unknown>;
+type AnyRec$c = Record<string, unknown>;
 /**
  * Validate that every object a stack's navigation exposes is readable by at
  * least one permission set the stack declares. Returns findings (empty = clean).
  */
-declare function validateNavAccess(stack: AnyRec$5): NavAccessFinding[];
+declare function validateNavAccess(stack: AnyRec$c): NavAccessFinding[];
 
 declare const TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 declare const TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
@@ -1110,12 +1498,12 @@ interface TranslationRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$4 = Record<string, unknown>;
+type AnyRec$b = Record<string, unknown>;
 /**
  * Validate every reference a translation bundle makes against the metadata it
  * claims to translate. Returns findings (empty = clean).
  */
-declare function validateTranslationReferences(stack: AnyRec$4): TranslationRefFinding[];
+declare function validateTranslationReferences(stack: AnyRec$b): TranslationRefFinding[];
 
 /**
  * [ADR-0064 §3] Skill ↔ agent surface affinity (issue #3820).
@@ -1160,12 +1548,12 @@ interface AiSurfaceAffinityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$3 = Record<string, unknown>;
+type AnyRec$a = Record<string, unknown>;
 /**
  * Validate every in-stack agent→skill binding against the ADR-0064 §3 surface
  * affinity contract. Returns findings (empty = clean).
  */
-declare function validateAiSurfaceAffinity(stack: AnyRec$3): AiSurfaceAffinityFinding[];
+declare function validateAiSurfaceAffinity(stack: AnyRec$a): AiSurfaceAffinityFinding[];
 
 declare const AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
 type AiToolRefSeverity = 'error' | 'warning';
@@ -1183,12 +1571,12 @@ interface AiToolRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$2 = Record<string, unknown>;
+type AnyRec$9 = Record<string, unknown>;
 /**
  * Validate every `skill.tools[]` reference in a stack. Returns findings
  * (empty = clean).
  */
-declare function validateAiToolReferences(stack: AnyRec$2): AiToolRefFinding[];
+declare function validateAiToolReferences(stack: AnyRec$9): AiToolRefFinding[];
 
 /**
  * [ADR-0063 §2] `stack.agents` is a platform-internal slot (issue #3820).
@@ -1233,50 +1621,202 @@ interface AiAgentAuthoringFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$1 = Record<string, unknown>;
+type AnyRec$8 = Record<string, unknown>;
 /**
  * Flag every agent declared in a stack. Returns findings (empty = clean,
  * which is what every app package should be).
  */
-declare function validateAiAgentAuthoring(stack: AnyRec$1): AiAgentAuthoringFinding[];
+declare function validateAiAgentAuthoring(stack: AnyRec$8): AiAgentAuthoringFinding[];
 
-type ReferenceIntegritySeverity = 'error' | 'warning';
+type HookBodyWriteSeverity = 'warning';
+interface HookBodyWriteFinding {
+    /** v1 is advisory-only by contract — the type says so. */
+    severity: HookBodyWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `hook "normalize_lead" › body`. */
+    where: string;
+    /** Config path, e.g. `hooks[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+/** One syntactic write shape the extractor recognizes. */
+interface HookBodyWritePattern {
+    /** Stable pattern id, carried on every extracted write. */
+    readonly id: string;
+    /** Author-facing syntax summary (for docs/diagnostics, not matching). */
+    readonly syntax: string;
+    /** Reconciliation fixture: extracting `source` must yield exactly `writes`. */
+    readonly example: {
+        readonly source: string;
+        readonly writes: ReadonlyArray<{
+            field: string;
+            object?: string;
+        }>;
+    };
+}
+declare const HOOK_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+/** A ledger pattern a given rule does NOT consume, and why. */
+interface BodyWritePatternExclusion {
+    /** The {@link HOOK_BODY_WRITE_PATTERNS} entry id being excluded. */
+    readonly id: string;
+    /** Why the shape does not mean the same thing on this rule's surface. */
+    readonly reason: string;
+}
 /**
- * The shape every rule in the suite already returns. Declared here so callers
- * can hold one type instead of a six-way union.
+ * The ledger shapes THIS rule consumes.
+ *
+ * Declared rather than implied: before the ledger carried a shape the hook
+ * surface does not have, every write with no `object` was necessarily a
+ * `ctx.input` write, and the rule could branch on that alone. It no longer can
+ * — a `record-property-assign` write also carries no object, and would have
+ * been reported as "the hook writes 'stage' to its input", which is false.
+ * Each consumer declaring its own subset is what stops the next added shape
+ * from silently landing in a branch that was never written for it.
  */
-interface ReferenceIntegrityFinding {
-    /** `error` = the reference is dead; `warning` = it may resolve elsewhere, or the miss is inert. */
-    severity: ReferenceIntegritySeverity;
-    /** Diagnostic rule id (stable; used by allowlists and docs). */
+declare const HOOK_BODY_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const HOOK_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$7 = Record<string, unknown>;
+/** One statically-extracted field write found in an L2 body. */
+interface ExtractedHookBodyWrite {
+    /** Which {@link HOOK_BODY_WRITE_PATTERNS} entry matched. */
+    patternId: string;
+    /** Target object name; `undefined` = the hook's own target object(s). */
+    object?: string;
+    /** The `ctx.api` method for diagnostics (`insert`/`create`/`update`/`updateById`). */
+    method?: string;
+    field: string;
+}
+/** Everything one parse of an L2 body yields. */
+interface ExtractedHookBodyWriteSet {
+    /** Every literal write the {@link HOOK_BODY_WRITE_PATTERNS} ledger declares. */
+    writes: ExtractedHookBodyWrite[];
+    /**
+     * `ctx.record` is handed to something as a VALUE somewhere in the body — an
+     * argument, an assignment RHS, a spread, a return — rather than only having
+     * its properties read and written, or being truthiness/type tested.
+     *
+     * The action rule needs this to tell a dead snapshot write from a live one:
+     * `ctx.record.stage = 'won'; await ctx.api.object('d').update(ctx.record)`
+     * builds a payload and persists it, so the assignment is not a no-op. When
+     * this is true, no record write in the body can be judged, and none is
+     * reported. (One-level aliasing — `const r = ctx.record` — reads as an
+     * escape too, which is the safe direction: it suppresses findings.)
+     */
+    ctxRecordEscapes: boolean;
+}
+/**
+ * Extract every literal field write the pattern ledger declares from an L2
+ * body's source. Parse-only (the source is never executed), error-tolerant
+ * (a body with syntax errors simply yields fewer matches), and lazy: the
+ * TypeScript compiler is not loaded when no pattern can possibly match.
+ *
+ * Thin projection of {@link extractHookBodyWriteSet} — use that one when the
+ * `ctx.record` liveness signal matters, so the body is parsed once, not twice.
+ */
+declare function extractHookBodyWrites(source: string): ExtractedHookBodyWrite[];
+/** {@link extractHookBodyWrites} plus the `ctx.record` liveness signal, one parse. */
+declare function extractHookBodyWriteSet(source: string): ExtractedHookBodyWriteSet;
+/**
+ * Validate L2 hook-body writes against target-object field declarations.
+ * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
+ */
+declare function validateHookBodyWrites(stack: AnyRec$7): HookBodyWriteFinding[];
+
+type ActionBodyWriteSeverity = 'warning';
+interface ActionBodyWriteFinding {
+    /** Advisory-only by contract, exactly like the hook rule — the type says so. */
+    severity: ActionBodyWriteSeverity;
     rule: string;
-    /** Human-readable location. */
+    /** Human-readable location, e.g. `action "close_deal" › body`. */
     where: string;
-    /** Config path. */
+    /** Config path, e.g. `actions[0].body.source`. */
     path: string;
-    /** What is wrong. */
     message: string;
-    /** How to fix it. */
     hint: string;
 }
-/** One member of the suite. `name` is the exported function's name — the id a wiring test can assert on. */
-interface ReferenceIntegrityRule {
-    name: string;
-    run: (stack: Record<string, unknown>) => ReferenceIntegrityFinding[];
-}
+declare const ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
+declare const ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+/** @deprecated alias — the exclusion shape is shared with the hook rule. */
+type ActionBodyWriteExclusion = BodyWritePatternExclusion;
 /**
- * Every reference-integrity rule, in the order their findings are reported.
+ * Ledger shapes the UNKNOWN-FIELD check consumes — resolved against the named
+ * object's declared fields.
  *
- * ADDING A RULE: append it here and it runs on `validate`, `lint` and
- * `compile` at once. Do not re-wire the commands.
+ * Include-list, not exclude-list, on purpose: an unclassified new pattern is
+ * then inert here (a missed finding) rather than live against a context it was
+ * never reasoned about (a false one) — the same asymmetry the extractor's
+ * silent bails follow.
  */
-declare const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[];
+declare const ACTION_BODY_WRITE_PATTERN_IDS: readonly string[];
 /**
- * Run every reference-integrity rule over a stack. Returns the concatenated
- * findings (empty = clean). Pure: no I/O, safe on both the schema-parsed stack
- * and the raw/normalized config the `lint` path carries.
+ * Ledger shapes the DISCARDED-RECORD-WRITE check consumes — never resolved
+ * against anything, because no field name can make a discarded write land.
  */
-declare function validateReferenceIntegrity(stack: Record<string, unknown>): ReferenceIntegrityFinding[];
+declare const ACTION_RECORD_WRITE_PATTERN_IDS: readonly string[];
+/** Shared-ledger patterns neither check consumes, each with its reason. */
+declare const ACTION_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+/**
+ * The subset of the shared ledger the unknown-field check sees — the published
+ * answer to "which writes does the action lint resolve against fields?".
+ */
+declare const ACTION_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+/** The subset the discarded-record-write check sees. */
+declare const ACTION_RECORD_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+type AnyRec$6 = Record<string, unknown>;
+/**
+ * Validate L2 action-body writes against target-object field declarations.
+ * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
+ */
+declare function validateActionBodyWrites(stack: AnyRec$6): ActionBodyWriteFinding[];
+
+type FlowNodeWriteSeverity = 'error';
+interface FlowNodeWriteFinding {
+    /** Always `error` — a literal key against a literal object is a certainty (see module note). */
+    severity: FlowNodeWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `flow "close_deal" › node "Mark won"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[3].config.fields.stagee`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
+/** Flow node types whose `config.fields` keys this rule resolves. */
+declare const FLOW_WRITE_NODE_TYPES: readonly string[];
+/** A `fields`-bearing node type this rule does NOT cover yet, and why. */
+interface FlowWriteNodeDeferral {
+    /** The `FlowNode.type` left uncovered. */
+    readonly type: string;
+    /** Why it is not covered, in terms a reviewer can act on. */
+    readonly reason: string;
+}
+/**
+ * `fields`-bearing CRUD node types deliberately left uncovered.
+ *
+ * **Empty, and that is the point.** #4369 shipped `update_record` alone and
+ * parked `create_record` here with its reason — a gating rule earning its
+ * severity one measured surface at a time — rather than leaving the other half
+ * as silence. #4371 measured the INSERT path (`table deal has no column named
+ * stagee`, and the row never created at all), found it strictly worse than the
+ * UPDATE one, and moved it across.
+ *
+ * The slot stays because the partition test derives the full `fields`-write-map
+ * set from the spec's own config schemas: a node type that grows one later
+ * belongs to neither list and fails that test until someone puts it in one.
+ * Deleting this array would turn that forced decision back into a default.
+ */
+declare const FLOW_WRITE_NODE_TYPES_DEFERRED: readonly FlowWriteNodeDeferral[];
+type AnyRec$5 = Record<string, unknown>;
+/**
+ * Validate flow write-node `fields` keys against the target object's declared
+ * fields. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse
+ * stacks.
+ */
+declare function validateFlowNodeWrites(stack: AnyRec$5): FlowNodeWriteFinding[];
 
 /**
  * [ADR-0090 D6] Access-matrix snapshot — authoring-time companion to the
@@ -1293,13 +1833,211 @@ declare function validateReferenceIntegrity(stack: Record<string, unknown>): Ref
  * AI may draft grants freely; it cannot silently change who can do what.
  */
 
-type AnyRec = Record<string, unknown>;
+type AnyRec$4 = Record<string, unknown>;
 /** Build the sorted access matrix for a normalized stack. */
-declare function buildAccessMatrix(stack: AnyRec): AccessMatrix;
+declare function buildAccessMatrix(stack: AnyRec$4): AccessMatrix;
 /**
  * Semantic diff between two matrices — human-review lines, empty = identical.
  * Ordered: removals, additions, then per-entry bit/scope changes.
  */
 declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
 
-export { ACTION_NAME_UNDEFINED, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FILTER_TOKEN_UNKNOWN, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, type NavAccessFinding, type NavAccessSeverity, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, type PageFieldFinding, type PageFieldSeverity, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_TARGET_UNKNOWN, type TranslationRefFinding, type TranslationRefSeverity, VIEW_CONTAINER_SHAPE, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateDashboardActionRefs, validateFilterTokens, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateJsxPages, validateListViewMode, validateNavAccess, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateStackExpressions, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };
+/**
+ * Build-time lint for flow authoring ANTI-PATTERNS — metadata that is valid
+ * (passes schema + expression checks) but is semantically a footgun at runtime.
+ * Most are emitted as WARNINGS: they guide the author (very often an AI
+ * generating templates) toward the robust pattern without failing the build on
+ * a technically-legal construct.
+ *
+ * A finding carrying `severity: 'error'` FAILS the build. The bar is: **no
+ * reading of the author's metadata does what it says, deterministically, on
+ * every run.** Warning about such a shape is just a slower way of finding out.
+ * That covers two kinds, and only these:
+ *
+ *  - **The runtime refuses.** {@link FLOW_RUNAS_UNSCOPED} — a user-less trigger
+ *    with `runAs:'user'` has no identity to scope to, so the data operation is
+ *    refused outright (#3760).
+ *  - **The declaration is inert and the route silently differs from what is
+ *    written.** {@link FLOW_BRANCH_LABEL_UNMATCHED} — a decision computes a
+ *    branch no out-edge carries, so the branch is discarded and every out-edge
+ *    is considered instead. {@link FLOW_DEFAULT_EDGE_WITH_CONDITION} — an edge
+ *    that is both the default and conditional; the condition wins and the
+ *    marker routes nothing. Neither *fails*; both are wrong every time, and
+ *    silently, which is worse (#4414).
+ *
+ * The bar is deliberately about *provability*, not severity of consequence. A
+ * shape with a legitimate reading stays a warning even when it is usually a
+ * mistake — {@link FLOW_DECISION_UNCONDITIONAL_BRANCH} is normally a guard that
+ * does not guard, but a decision with one guarded and one unconditional out-edge
+ * is a legal "maybe notify, always continue" fan-out, and
+ * {@link FLOW_MULTIPLE_DEFAULT_EDGES} can genuinely mean "when nothing matched,
+ * do both". Failing a customer's build on a shape we cannot prove wrong is a
+ * worse trade than letting the warning be ignored.
+ *
+ * #1874 — time-relative rules via record-change date-EQUALITY. A start-node
+ * trigger condition like `end_date == daysFromNow(60)` on a `record-*` trigger
+ * only fires if the record happens to be written on that exact day; the robust
+ * shape is a daily SCHEDULE trigger + a range query. We flag the equality form
+ * specifically (range operators `>=`/`<=` are not flagged — they're the building
+ * block of the correct pattern), keeping false positives near zero.
+ */
+interface FlowLintFinding {
+    where: string;
+    message: string;
+    hint: string;
+    rule: string;
+    /**
+     * `'error'` FAILS the build; `'warning'` (the default when absent) prints and
+     * continues. Most rules here flag a technically-legal footgun and stay
+     * advisory. A rule is only promoted to `'error'` when the shape it flags is a
+     * *guaranteed* runtime failure — then a warning would just be a slower way of
+     * finding out (#3760).
+     *
+     * `os build` and `os validate` both filter on this field, so promoting a rule
+     * gates both surfaces at once — neither can report clean while the other
+     * rejects the same stack (#3782).
+     */
+    severity?: 'error' | 'warning';
+}
+type AnyRec$3 = Record<string, unknown>;
+declare const FLOW_TIME_RELATIVE_ANTIPATTERN = "flow-time-relative-antipattern";
+declare const FLOW_DATE_EQUALITY_FILTER = "flow-date-equality-filter";
+declare const FLOW_PHANTOM_AGGREGATION = "flow-phantom-aggregation";
+declare const FLOW_DOUBLE_BRACE_INTERP = "flow-double-brace-interpolation";
+declare const FLOW_BARE_DOLLAR_REF = "flow-bare-dollar-reference";
+declare const FLOW_APPROVAL_REVISE_DEAD_END = "flow-approval-revise-dead-end";
+declare const FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE = "flow-approval-revise-unmarked-backedge";
+declare const FLOW_APPROVAL_REVISE_DISABLED = "flow-approval-revise-disabled";
+/**
+ * #3760 — renamed from `flow-schedule-runas-unscoped`. The old id named the
+ * *schedule*, which was never the boundary: the rule is about a trigger that
+ * resolves NO USER, and a schedule is only the most obvious such trigger.
+ */
+declare const FLOW_RUNAS_UNSCOPED = "flow-runas-unscoped";
+declare const FLOW_ERROR_LABEL_NOT_FAULT = "flow-error-label-not-fault";
+/** #4414 — the four ways a decision's declared branching fails to route. */
+declare const FLOW_BRANCH_LABEL_UNMATCHED = "flow-branch-label-unmatched";
+declare const FLOW_DECISION_UNCONDITIONAL_BRANCH = "flow-decision-unconditional-branch";
+declare const FLOW_DEFAULT_EDGE_WITH_CONDITION = "flow-default-edge-with-condition";
+declare const FLOW_MULTIPLE_DEFAULT_EDGES = "flow-multiple-default-edges";
+/** #4414 — `config.condition` on a node whose executor never reads it. */
+declare const FLOW_INERT_NODE_CONDITION = "flow-inert-node-condition";
+/**
+ * Lint every flow's start node for known authoring anti-patterns. Returns a
+ * (possibly empty) list of advisory findings — never throws, never fails a build.
+ */
+declare function lintFlowPatterns(stack: AnyRec$3): FlowLintFinding[];
+
+interface LivenessLintFinding {
+    where: string;
+    message: string;
+    hint: string;
+    rule: string;
+}
+declare const LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
+declare const LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
+type AnyRec$2 = Record<string, unknown>;
+/**
+ * Lint the compiled stack for authored properties the liveness ledger flags as
+ * misleading. Advisory only — returns findings, never throws. Covers every
+ * governed metadata type: objects (incl. `enable.*`) and their fields walk
+ * bespoke nesting; the remaining types are flat stack collections. Container
+ * properties fan out over arrays (each flow node, each dataset measure). The
+ * mechanism stays ledger-driven — coverage grows by marking more entries
+ * `authorWarn` rather than touching this code.
+ */
+declare function lintLivenessProperties(stack: AnyRec$2): LivenessLintFinding[];
+
+interface AutonumberLintFinding {
+    where: string;
+    message: string;
+    hint: string;
+    rule: string;
+    severity: 'error' | 'warning';
+}
+type AnyRec$1 = Record<string, unknown>;
+declare const AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
+declare const AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
+declare const AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
+declare const AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
+/**
+ * Lint every `autonumber` field's format for unresolvable / fragile `{field}`
+ * interpolation. Returns a (possibly empty) list of findings; never throws.
+ */
+declare function lintAutonumberFormats(stack: AnyRec$1): AutonumberLintFinding[];
+
+interface ViewRefFinding {
+    where: string;
+    message: string;
+    hint: string;
+    rule: string;
+    severity: 'error' | 'warning';
+}
+type AnyRec = Record<string, any>;
+declare const VIEW_KEY_COLLISION = "view-key-collision";
+declare const VIEW_REF_FORM_TARGET_MISSING = "view-ref-form-target-missing";
+declare const VIEW_REF_FORM_TARGET_KIND = "view-ref-form-target-kind";
+declare function lintViewRefs(stack: AnyRec): ViewRefFinding[];
+
+/**
+ * Data-model best-practice lint rules.
+ *
+ * These rules encode the relationship / master-detail / roll-up conventions the
+ * platform ships (see the objectstack-data and objectstack-ui skills, ADR-0035).
+ * They run over the normalized object set and flag anti-patterns that an
+ * author — human OR an AI generator — commonly produces. They are intentionally
+ * heuristic: structural problems are `error`, likely-wrong choices are
+ * `warning`, and "you probably want this" nudges are `suggestion`. None of them
+ * block on a judgement call.
+ *
+ * The same rules double as the automated rubric for the metadata-generation
+ * eval (see `score.ts`): a generated stack scores well exactly when it is
+ * schema-valid AND lint-clean here.
+ */
+type Severity = 'error' | 'warning' | 'suggestion';
+interface LintIssue {
+    severity: Severity;
+    rule: string;
+    message: string;
+    path: string;
+    fix?: string;
+}
+declare const UNIQUE_DOUBLE_DECLARATION = "unique/double-declaration";
+/**
+ * R10 — the same column carries BOTH a field-level `unique: true` and an
+ * object-level single-column unique index (#3991).
+ *
+ * The two spellings are deliberately different (see `IndexSchema`): field-level
+ * `unique: true` is tenant-scoped since #3696 — it materializes as
+ * `(organization_id, col)`, unique *within* the tenant — while a declared index
+ * is materialized over exactly the columns listed, i.e. platform-wide. Both are
+ * legitimate on their own; together on one column they are never right:
+ *
+ *   - On a tenant-scoped object they CONTRADICT. The stricter one wins
+ *     physically, so the global index enforces uniqueness and the tenant
+ *     composite becomes a constraint nothing can ever trip. One of the two
+ *     intents the author wrote is silently discarded.
+ *   - On a tenancy-less object they are exactly REDUNDANT — both describe the
+ *     same single-column unique index, under the same generated name.
+ *
+ * Tenancy is deliberately NOT inferred here: `organization_id` is injected by
+ * the kernel at registration rather than authored, so an authoring-time guess
+ * would be wrong half the time. The combination is worth flagging either way,
+ * and the message names both readings so the author picks the one they meant.
+ *
+ * A field declared `unique: 'global'` is exempt: it already says
+ * platform-wide, so the declared index restates the same intent rather than
+ * contradicting it (still redundant, but not a silent loss of meaning).
+ *
+ * Advisory. The resulting stack is well-defined — the cost is an intent that
+ * never takes effect, not a broken artifact — so this never fails a build.
+ */
+declare function lintUniqueDeclarations(objects: any[]): LintIssue[];
+/**
+ * Lint the relationship / data-modeling conventions across the full object set.
+ * Pure and deterministic — safe to call from both the `lint` command and the
+ * metadata-generation scorer.
+ */
+declare function lintDataModel(objects: any[]): LintIssue[];
+
+export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, type PageFieldFinding, type PageFieldSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_TARGET_UNKNOWN, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findUnguardedNullableOperands, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLivenessProperties, lintUniqueDeclarations, lintViewRefs, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateDashboardActionRefs, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateNavAccess, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateSearchableFields, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateStackExpressions, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };