@objectstack/lint 17.0.0-rc.1 → 17.0.0-rc.3

package/dist/index.cjs

@@ -25,6 +25,7 @@ __export(index_exports, {
   ACTION_BODY_WRITE_PATTERN_IDS: () => ACTION_BODY_WRITE_PATTERN_IDS,
   ACTION_BODY_WRITE_UNKNOWN_FIELD: () => ACTION_BODY_WRITE_UNKNOWN_FIELD,
   ACTION_NAME_UNDEFINED: () => ACTION_NAME_UNDEFINED,
+  ACTION_NO_PLACEMENT: () => ACTION_NO_PLACEMENT,
   ACTION_RECORD_WRITE_DISCARDED: () => ACTION_RECORD_WRITE_DISCARDED,
   ACTION_RECORD_WRITE_PATTERNS: () => ACTION_RECORD_WRITE_PATTERNS,
   ACTION_RECORD_WRITE_PATTERN_IDS: () => ACTION_RECORD_WRITE_PATTERN_IDS,
@@ -40,6 +41,13 @@ __export(index_exports, {
   APPROVAL_ESCALATION_REASSIGN_NO_TARGET: () => APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
   APPROVAL_EXPRESSION_INVALID: () => APPROVAL_EXPRESSION_INVALID,
   APPROVAL_EXPRESSION_NO_EMPTY_POLICY: () => APPROVAL_EXPRESSION_NO_EMPTY_POLICY,
+  AUTHORING_COMMANDS: () => AUTHORING_COMMANDS,
+  AUTHORING_RULES: () => AUTHORING_RULES,
+  AUTHORING_SURFACES: () => AUTHORING_SURFACES,
+  AUTONUMBER_LITERAL_TOKEN: () => AUTONUMBER_LITERAL_TOKEN,
+  AUTONUMBER_OPTIONAL_FIELD: () => AUTONUMBER_OPTIONAL_FIELD,
+  AUTONUMBER_SELF_REFERENCE: () => AUTONUMBER_SELF_REFERENCE,
+  AUTONUMBER_UNKNOWN_FIELD: () => AUTONUMBER_UNKNOWN_FIELD,
   CAPABILITY_REFERENCE_UNKNOWN: () => CAPABILITY_REFERENCE_UNKNOWN,
   CHART_AXIS_NOT_SELECTED: () => CHART_AXIS_NOT_SELECTED,
   CHART_CONFIG_MISSING: () => CHART_CONFIG_MISSING,
@@ -50,13 +58,29 @@ __export(index_exports, {
   DASHBOARD_ACTION_ROUTE_UNRESOLVED: () => DASHBOARD_ACTION_ROUTE_UNRESOLVED,
   DASHBOARD_ACTION_TARGET_UNDEFINED: () => DASHBOARD_ACTION_TARGET_UNDEFINED,
   DASHBOARD_FILTER_FIELD_UNKNOWN: () => DASHBOARD_FILTER_FIELD_UNKNOWN,
+  EXPRESSION_INVALID: () => EXPRESSION_INVALID,
   FIELD_GROUP_EMPTY: () => FIELD_GROUP_EMPTY,
   FIELD_GROUP_UNDECLARED: () => FIELD_GROUP_UNDECLARED,
   FILTER_TOKEN_UNKNOWN: () => FILTER_TOKEN_UNKNOWN,
+  FLOW_APPROVAL_REVISE_DEAD_END: () => FLOW_APPROVAL_REVISE_DEAD_END,
+  FLOW_APPROVAL_REVISE_DISABLED: () => FLOW_APPROVAL_REVISE_DISABLED,
+  FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE: () => FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE,
+  FLOW_BARE_DOLLAR_REF: () => FLOW_BARE_DOLLAR_REF,
+  FLOW_BRANCH_LABEL_UNMATCHED: () => FLOW_BRANCH_LABEL_UNMATCHED,
+  FLOW_DATE_EQUALITY_FILTER: () => FLOW_DATE_EQUALITY_FILTER,
+  FLOW_DECISION_UNCONDITIONAL_BRANCH: () => FLOW_DECISION_UNCONDITIONAL_BRANCH,
+  FLOW_DEFAULT_EDGE_WITH_CONDITION: () => FLOW_DEFAULT_EDGE_WITH_CONDITION,
+  FLOW_DOUBLE_BRACE_INTERP: () => FLOW_DOUBLE_BRACE_INTERP,
   FLOW_DRAFT_STATUS_AMBIGUOUS: () => FLOW_DRAFT_STATUS_AMBIGUOUS,
+  FLOW_ERROR_LABEL_NOT_FAULT: () => FLOW_ERROR_LABEL_NOT_FAULT,
+  FLOW_INERT_NODE_CONDITION: () => FLOW_INERT_NODE_CONDITION,
+  FLOW_MULTIPLE_DEFAULT_EDGES: () => FLOW_MULTIPLE_DEFAULT_EDGES,
   FLOW_NODE_WRITE_UNKNOWN_FIELD: () => FLOW_NODE_WRITE_UNKNOWN_FIELD,
+  FLOW_PHANTOM_AGGREGATION: () => FLOW_PHANTOM_AGGREGATION,
+  FLOW_RUNAS_UNSCOPED: () => FLOW_RUNAS_UNSCOPED,
   FLOW_TEMPLATE_LOOKUP_TRAVERSAL: () => FLOW_TEMPLATE_LOOKUP_TRAVERSAL,
   FLOW_TEMPLATE_UNKNOWN_FIELD: () => FLOW_TEMPLATE_UNKNOWN_FIELD,
+  FLOW_TIME_RELATIVE_ANTIPATTERN: () => FLOW_TIME_RELATIVE_ANTIPATTERN,
   FLOW_TRIGGER_UNKNOWN_OBJECT: () => FLOW_TRIGGER_UNKNOWN_OBJECT,
   FLOW_UPDATE_READONLY_FIELD: () => FLOW_UPDATE_READONLY_FIELD,
   FLOW_UPDATE_READONLY_WHEN_FIELD: () => FLOW_UPDATE_READONLY_WHEN_FIELD,
@@ -69,19 +93,25 @@ __export(index_exports, {
   HOOK_BODY_WRITE_PATTERN_IDS: () => HOOK_BODY_WRITE_PATTERN_IDS,
   HOOK_BODY_WRITE_UNKNOWN_FIELD: () => HOOK_BODY_WRITE_UNKNOWN_FIELD,
   LIST_VIEW_FILTERS_IN_VIEWS_MODE: () => LIST_VIEW_FILTERS_IN_VIEWS_MODE,
+  LIVENESS_DEAD_PROPERTY: () => LIVENESS_DEAD_PROPERTY,
+  LIVENESS_EXPERIMENTAL_PROPERTY: () => LIVENESS_EXPERIMENTAL_PROPERTY,
   MEASURE_AGGREGATE_INCOHERENT: () => MEASURE_AGGREGATE_INCOHERENT,
   NAV_OBJECT_UNGRANTED: () => NAV_OBJECT_UNGRANTED,
+  NAV_TARGET_UNRESOLVED: () => NAV_TARGET_UNRESOLVED,
+  NULL_GUARD_HINT: () => NULL_GUARD_HINT,
   OBJECT_REFERENCE_UNKNOWN: () => OBJECT_REFERENCE_UNKNOWN,
   OBJECT_REFERENCE_UNREGISTERED_PLATFORM: () => OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
   ORG_AXIS_CROSS_ORG_BU_GRANT: () => ORG_AXIS_CROSS_ORG_BU_GRANT,
   ORG_AXIS_PERMISSION_INHERITANCE: () => ORG_AXIS_PERMISSION_INHERITANCE,
   PAGE_FIELD_UNKNOWN: () => PAGE_FIELD_UNKNOWN,
   PAGE_SOURCE_CLASSNAME: () => PAGE_SOURCE_CLASSNAME,
+  REACT_BLOCK_NEEDS_RECORD_CONTEXT: () => REACT_BLOCK_NEEDS_RECORD_CONTEXT,
   REACT_CHART_AGGREGATE_INVALID: () => REACT_CHART_AGGREGATE_INVALID,
   REACT_CHART_AXIS_UNKNOWN: () => REACT_CHART_AXIS_UNKNOWN,
   REACT_CHART_FIELD_UNKNOWN: () => REACT_CHART_FIELD_UNKNOWN,
   REFERENCE_INTEGRITY_RULES: () => REFERENCE_INTEGRITY_RULES,
   SEARCHABLE_FIELD_UNKNOWN: () => SEARCHABLE_FIELD_UNKNOWN,
+  SEARCHABLE_FIELD_UNSEARCHABLE: () => SEARCHABLE_FIELD_UNSEARCHABLE,
   SECURITY_ANCHOR_HIGH_PRIVILEGE: () => SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET: () => SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
   SECURITY_DELEGATION_MISSING_REASON: () => SECURITY_DELEGATION_MISSING_REASON,
@@ -106,17 +136,37 @@ __export(index_exports, {
   TITLE_UNRESOLVABLE: () => TITLE_UNRESOLVABLE,
   TRANSLATION_OPTION_KEY_UNKNOWN: () => TRANSLATION_OPTION_KEY_UNKNOWN,
   TRANSLATION_TARGET_UNKNOWN: () => TRANSLATION_TARGET_UNKNOWN,
+  UNIQUE_DOUBLE_DECLARATION: () => UNIQUE_DOUBLE_DECLARATION,
   VIEW_CONTAINER_SHAPE: () => VIEW_CONTAINER_SHAPE,
+  VIEW_KEY_COLLISION: () => VIEW_KEY_COLLISION,
+  VIEW_REF_FORM_TARGET_KIND: () => VIEW_REF_FORM_TARGET_KIND,
+  VIEW_REF_FORM_TARGET_MISSING: () => VIEW_REF_FORM_TARGET_MISSING,
   VISIBILITY_ALIAS_DEPRECATED: () => VISIBILITY_ALIAS_DEPRECATED,
   VISIBILITY_ROOT_MISLAYERED: () => VISIBILITY_ROOT_MISLAYERED,
   WIDGET_DATASET_UNKNOWN: () => WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN: () => WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN: () => WIDGET_MEASURE_UNKNOWN,
+  authoringRulesFor: () => authoringRulesFor,
   buildAccessMatrix: () => buildAccessMatrix,
   diffAccessMatrix: () => diffAccessMatrix,
   extractHookBodyWriteSet: () => extractHookBodyWriteSet,
   extractHookBodyWrites: () => extractHookBodyWrites,
+  findUnguardedNullableOperands: () => findUnguardedNullableOperands,
+  lintAutonumberFormats: () => lintAutonumberFormats,
+  lintDataModel: () => lintDataModel,
+  lintFlowPatterns: () => lintFlowPatterns,
+  lintLivenessProperties: () => lintLivenessProperties,
+  lintUniqueDeclarations: () => lintUniqueDeclarations,
+  lintViewRefs: () => lintViewRefs,
+  nullGuardMessage: () => nullGuardMessage,
+  runAuthoringRules: () => runAuthoringRules,
+  runRuntimeAuthoringRules: () => runRuntimeAuthoringRules,
+  runtimeAuthoringRulesFor: () => runtimeAuthoringRulesFor,
+  runtimeGatedTypes: () => runtimeGatedTypes,
+  splitBySeverity: () => splitBySeverity,
+  stackKeyForType: () => stackKeyForType,
   validateActionBodyWrites: () => validateActionBodyWrites,
+  validateActionLocations: () => validateActionLocations,
   validateActionNameRefs: () => validateActionNameRefs,
   validateAiAgentAuthoring: () => validateAiAgentAuthoring,
   validateAiSurfaceAffinity: () => validateAiSurfaceAffinity,
@@ -130,10 +180,12 @@ __export(index_exports, {
   validateFlowTemplatePaths: () => validateFlowTemplatePaths,
   validateFlowTriggerReadiness: () => validateFlowTriggerReadiness,
   validateFormLayout: () => validateFormLayout,
+  validateFunctionalCompleteness: () => validateFunctionalCompleteness,
   validateHookBodyWrites: () => validateHookBodyWrites,
   validateJsxPages: () => validateJsxPages,
   validateListViewMode: () => validateListViewMode,
   validateNavAccess: () => validateNavAccess,
+  validateNavTargetRefs: () => validateNavTargetRefs,
   validateObjectReferences: () => validateObjectReferences,
   validateOrgAxisRedLines: () => validateOrgAxisRedLines,
   validatePageFieldBindings: () => validatePageFieldBindings,
@@ -335,7 +387,7 @@ function validateWidgetBindings(stack) {
       const where = `dashboard "${dashName}" \u203A widget "${widgetId}"`;
       const path = `dashboards[${i}].widgets[${j}]`;
       const suppressed = (rule) => Array.isArray(w.suppressWarnings) && w.suppressWarnings.includes(rule);
-      const push = (f) => {
+      const push2 = (f) => {
         if (f.severity === "warning" && suppressed(f.rule)) return;
         findings.push({ ...f, where, path });
       };
@@ -347,14 +399,14 @@ function validateWidgetBindings(stack) {
         const plural = legacyUsed.length > 1;
         const datasetHint = `Bind a semantic dataset and select fields BY NAME: \`dataset: '<name>', dimensions: [...], values: [...]\`. Dataset-bound widgets render through DatasetWidget (pivot rows/cols come from \`dimensions\`, cell values from \`values\`).`;
         if (!hasDataSource) {
-          push({
+          push2({
             severity: "error",
             rule: WIDGET_LEGACY_ANALYTICS_UNRENDERABLE,
             message: `sets legacy analytics key${plural ? "s" : ""} ${keyList} (removed by the ADR-0021 single-form cutover) and binds no data source (no \`dataset\`, \`object\`, or inline \`data\`) \u2014 it renders nothing.`,
             hint: `${datasetHint} The renderer ignores the legacy keys, so without a data source this widget has no data at all.`
           });
         } else {
-          push({
+          push2({
             severity: "warning",
             rule: WIDGET_LEGACY_ANALYTICS_SHAPE,
             message: `sets legacy analytics key${plural ? "s" : ""} ${keyList} that the ADR-0021 single-form cutover removed \u2014 the dashboard renderer ignores ${plural ? "them" : "it"}.`,
@@ -365,7 +417,7 @@ function validateWidgetBindings(stack) {
       const dsName = typeof w.dataset === "string" ? w.dataset : void 0;
       const dataset = dsName ? datasets.get(dsName) : void 0;
       if (dsName && !dataset) {
-        push({
+        push2({
           severity: "error",
           rule: WIDGET_DATASET_UNKNOWN,
           message: `dataset "${dsName}" does not resolve to a declared dataset.`,
@@ -373,7 +425,7 @@ function validateWidgetBindings(stack) {
         });
       }
       if (!dsName) {
-        push({
+        push2({
           severity: "error",
           rule: WIDGET_DATASET_UNKNOWN,
           message: `binds no \`dataset\` \u2014 the ADR-0021 widget shape requires one, so this widget resolves no data and renders empty.`,
@@ -392,7 +444,7 @@ function validateWidgetBindings(stack) {
             const field = eff.field;
             if (field.includes(".")) continue;
             if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) continue;
-            push({
+            push2({
               severity: "error",
               rule: DASHBOARD_FILTER_FIELD_UNKNOWN,
               message: eff.explicit ? `binds dashboard filter \`${def.name}\` to field \`${field}\` (via filterBindings), but object \`${datasetObject}\` (dataset "${dsName}") has no field \`${field}\`.` : `inherits dashboard filter \`${def.name}(${field})\`, but object \`${datasetObject}\` (dataset "${dsName}") has no field \`${field}\`.`,
@@ -412,7 +464,7 @@ function validateWidgetBindings(stack) {
       const dims = asStrings(w.dimensions);
       for (let k = 0; k < dims.length; k++) {
         if (dimensionNames.has(dims[k])) continue;
-        push({
+        push2({
           severity: "error",
           rule: WIDGET_DIMENSION_UNKNOWN,
           message: `dimensions[${k}] "${dims[k]}" is not a dimension of dataset "${dsName}" (declared dimensions: ${list(dimensionNames)}).`,
@@ -422,7 +474,7 @@ function validateWidgetBindings(stack) {
       const values = asStrings(w.values);
       for (let k = 0; k < values.length; k++) {
         if (measures.has(values[k])) continue;
-        push({
+        push2({
           severity: "error",
           rule: WIDGET_MEASURE_UNKNOWN,
           message: `values[${k}] "${values[k]}" is not a measure of dataset "${dsName}" (declared measures: ${list(measures.keys())}).`,
@@ -435,7 +487,7 @@ function validateWidgetBindings(stack) {
         const selectedValues = new Set(values.filter((v) => measures.has(v)));
         const xAxis = chartConfig.xAxis && typeof chartConfig.xAxis === "object" ? chartConfig.xAxis : void 0;
         if (xAxis && typeof xAxis.field === "string" && !dimensionNames.has(xAxis.field) && !dims.includes(xAxis.field)) {
-          push({
+          push2({
             severity: "error",
             rule: CHART_FIELD_UNKNOWN,
             message: `chartConfig.xAxis.field "${xAxis.field}" does not resolve to a dimension of dataset "${dsName}" (declared dimensions: ${list(dimensionNames)}).`,
@@ -445,7 +497,7 @@ function validateWidgetBindings(stack) {
         const measureField = (label2, field) => {
           if (values.includes(field)) return;
           const declaredButUnselected = measures.has(field);
-          push({
+          push2({
             severity: "error",
             rule: CHART_FIELD_UNKNOWN,
             message: declaredButUnselected ? `chartConfig.${label2} "${field}" is a measure of dataset "${dsName}" but is not selected in the widget's values (${list(values)}), so the query result will not contain it.` : `chartConfig.${label2} "${field}" does not resolve to a measure of dataset "${dsName}" (declared measures: ${list(measures.keys())}).`,
@@ -463,7 +515,7 @@ function validateWidgetBindings(stack) {
           if (typeof name === "string") measureField(`series[${k}].name`, name);
         }
       } else if (isChartType) {
-        push({
+        push2({
           severity: "warning",
           rule: CHART_CONFIG_MISSING,
           message: `chart-type widget ('${w.type}') has no chartConfig \u2014 the renderer cannot determine which measure to plot, so the series renders empty.`,
@@ -477,7 +529,7 @@ function validateWidgetBindings(stack) {
       if (resolved.some((m) => !m)) continue;
       const countOnly = resolved.every((m) => m.aggregate === "count" && !m.derived);
       if (!countOnly) continue;
-      push({
+      push2({
         severity: "warning",
         rule: TABLE_COUNT_ONLY,
         message: `a '${w.type}' widget bound to dataset "${dsName}" selects only count measure(s) (${values.join(", ")}) and no dimensions, so it renders a single summary row \u2014 not a per-record list.`,
@@ -491,6 +543,226 @@ function validateWidgetBindings(stack) {
 // src/validate-expressions.ts
 var import_formula = require("@objectstack/formula");
 var import_automation = require("@objectstack/spec/automation");
+
+// src/validate-null-guards.ts
+var import_cel_js = require("@marcbachmann/cel-js");
+var NULL_GUARD_HINT = `Guard it with '!= null' \u2014 'has(x)' does NOT do that: a declared field holding null is still PRESENT, so has(x) is true.`;
+var FAULTING_BINARY_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "+", "-", "*", "/", "%"]);
+var DEFAULT_RECORD_ROOTS = ["record", "previous"];
+var parseEnv;
+function getParseEnv() {
+  if (!parseEnv) {
+    parseEnv = new import_cel_js.Environment({ unlistedVariablesAreDyn: true, enableOptionalTypes: true });
+  }
+  return parseEnv;
+}
+function isNode(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function isNullLiteral(node) {
+  return isNode(node) && node.op === "value" && node.args === null;
+}
+function fieldOf(node, roots) {
+  if (!isNode(node)) return null;
+  if (node.op !== "." && node.op !== ".?") return null;
+  const args = node.args;
+  if (!Array.isArray(args) || args.length < 2) return null;
+  const [recv, seg] = args;
+  if (typeof seg !== "string") return null;
+  if (!isNode(recv) || recv.op !== "id") return null;
+  const root = recv.args;
+  if (typeof root !== "string" || !roots.includes(root)) return null;
+  return { operand: `${root}.${seg}`, field: seg };
+}
+function childNodes(node) {
+  const args = node.args;
+  if (isNode(args)) return [args];
+  if (!Array.isArray(args)) return [];
+  const out = [];
+  for (const a of args) {
+    if (isNode(a)) out.push(a);
+    else if (Array.isArray(a)) {
+      for (const b of a) if (isNode(b)) out.push(b);
+    }
+  }
+  return out;
+}
+function callName(node) {
+  if (node.op !== "call") return null;
+  const args = node.args;
+  if (!Array.isArray(args) || typeof args[0] !== "string") return null;
+  return args[0];
+}
+function callArgs(node) {
+  const args = node.args;
+  if (!Array.isArray(args) || !Array.isArray(args[1])) return [];
+  return args[1];
+}
+function union(a, b) {
+  return /* @__PURE__ */ new Set([...a, ...b]);
+}
+function intersect(a, b) {
+  const out = /* @__PURE__ */ new Set();
+  for (const v of a) if (b.has(v)) out.add(v);
+  return out;
+}
+function truthGuards(node, roots) {
+  if (!isNode(node)) return /* @__PURE__ */ new Set();
+  switch (node.op) {
+    case "!=": {
+      const [l, r] = node.args ?? [];
+      if (isNullLiteral(r)) {
+        const f = fieldOf(l, roots);
+        return f ? /* @__PURE__ */ new Set([f.operand]) : /* @__PURE__ */ new Set();
+      }
+      if (isNullLiteral(l)) {
+        const f = fieldOf(r, roots);
+        return f ? /* @__PURE__ */ new Set([f.operand]) : /* @__PURE__ */ new Set();
+      }
+      return /* @__PURE__ */ new Set();
+    }
+    case "&&": {
+      const [l, r] = node.args;
+      return union(truthGuards(l, roots), truthGuards(r, roots));
+    }
+    case "||": {
+      const [l, r] = node.args;
+      return intersect(truthGuards(l, roots), truthGuards(r, roots));
+    }
+    case "!_":
+      return falseGuards(node.args, roots);
+    case "?:": {
+      const [, t, f] = node.args;
+      return intersect(truthGuards(t, roots), truthGuards(f, roots));
+    }
+    default:
+      return /* @__PURE__ */ new Set();
+  }
+}
+function falseGuards(node, roots) {
+  if (!isNode(node)) return /* @__PURE__ */ new Set();
+  switch (node.op) {
+    case "==": {
+      const [l, r] = node.args ?? [];
+      if (isNullLiteral(r)) {
+        const f = fieldOf(l, roots);
+        return f ? /* @__PURE__ */ new Set([f.operand]) : /* @__PURE__ */ new Set();
+      }
+      if (isNullLiteral(l)) {
+        const f = fieldOf(r, roots);
+        return f ? /* @__PURE__ */ new Set([f.operand]) : /* @__PURE__ */ new Set();
+      }
+      return /* @__PURE__ */ new Set();
+    }
+    case "||": {
+      const [l, r] = node.args;
+      return union(falseGuards(l, roots), falseGuards(r, roots));
+    }
+    case "&&": {
+      const [l, r] = node.args;
+      return intersect(falseGuards(l, roots), falseGuards(r, roots));
+    }
+    case "!_":
+      return truthGuards(node.args, roots);
+    case "call": {
+      if (callName(node) !== "isBlank") return /* @__PURE__ */ new Set();
+      const [only] = callArgs(node);
+      const f = fieldOf(only, roots);
+      return f ? /* @__PURE__ */ new Set([f.operand]) : /* @__PURE__ */ new Set();
+    }
+    default:
+      return /* @__PURE__ */ new Set();
+  }
+}
+function collectHasOperands(node, roots, out) {
+  if (!isNode(node)) return;
+  if (callName(node) === "has") {
+    for (const a of callArgs(node)) {
+      const f = fieldOf(a, roots);
+      if (f) out.add(f.operand);
+    }
+  }
+  for (const child of childNodes(node)) collectHasOperands(child, roots, out);
+}
+function findUnguardedNullableOperands(source, opts) {
+  if (typeof source !== "string" || !source.trim()) return [];
+  if (opts.nullableFields.size === 0) return [];
+  const roots = opts.roots ?? DEFAULT_RECORD_ROOTS;
+  let ast;
+  try {
+    ast = getParseEnv().parse(source).ast;
+  } catch {
+    return [];
+  }
+  const hasOperands = /* @__PURE__ */ new Set();
+  collectHasOperands(ast, roots, hasOperands);
+  const findings = [];
+  const seen = /* @__PURE__ */ new Set();
+  const report = (operandNode, operator, guards) => {
+    const f = fieldOf(operandNode, roots);
+    if (!f) return;
+    if (!opts.nullableFields.has(f.field)) return;
+    if (guards.has(f.operand)) return;
+    const key = `${f.operand}\0${operator}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    findings.push({
+      operand: f.operand,
+      field: f.field,
+      operator,
+      hasOnlyGuard: hasOperands.has(f.operand)
+    });
+  };
+  const visit = (node, guards) => {
+    if (!isNode(node)) return;
+    const op = node.op;
+    if (op === "&&") {
+      const [l, r] = node.args;
+      visit(l, guards);
+      visit(r, union(guards, truthGuards(l, roots)));
+      return;
+    }
+    if (op === "||") {
+      const [l, r] = node.args;
+      visit(l, guards);
+      visit(r, union(guards, falseGuards(l, roots)));
+      return;
+    }
+    if (op === "?:") {
+      const [c, t, f] = node.args;
+      visit(c, guards);
+      visit(t, union(guards, truthGuards(c, roots)));
+      visit(f, union(guards, falseGuards(c, roots)));
+      return;
+    }
+    if (op === "call" && callName(node) === "has") {
+      return;
+    }
+    if (FAULTING_BINARY_OPS.has(op)) {
+      const [l, r] = node.args;
+      report(l, op, guards);
+      report(r, op, guards);
+      visit(l, guards);
+      visit(r, guards);
+      return;
+    }
+    if (op === "-_") {
+      report(node.args, "-", guards);
+      visit(node.args, guards);
+      return;
+    }
+    for (const child of childNodes(node)) visit(child, guards);
+  };
+  visit(ast, /* @__PURE__ */ new Set());
+  return findings;
+}
+function nullGuardMessage(subject, objectName, finding) {
+  const owner = objectName ? `'${objectName}'` : "this object";
+  const hasNote = finding.hasOnlyGuard ? ` \`has(${finding.operand})\` does not guard it.` : "";
+  return `${subject} applies \`${finding.operator}\` to \`${finding.operand}\`, which ${owner} declares as nullable (no \`required: true\`, no \`defaultValue\`).${hasNote} At runtime the operand is null, CEL has no \`${finding.operator}\` overload for null, and the whole predicate aborts \u2014 so the rule enforces nothing and the write is rejected fail-closed (#4649/#4763). The predicate compares a value that is null. ${NULL_GUARD_HINT}`;
+}
+
+// src/validate-expressions.ts
 function asArray2(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -534,11 +806,84 @@ function buildFieldTypeIndex(objects) {
   }
   return idx;
 }
+function fieldEntries(obj) {
+  const fields = obj.fields;
+  if (Array.isArray(fields)) {
+    return fields.filter((f) => f && typeof f === "object" && typeof f.name === "string").map((f) => [f.name, f]);
+  }
+  if (fields && typeof fields === "object") {
+    return Object.entries(fields).filter(([, def]) => !!def && typeof def === "object").map(([n, def]) => [n, def]);
+  }
+  return [];
+}
+function isNullableField(def) {
+  if (def.required === true) return false;
+  if (def.defaultValue !== void 0 && def.defaultValue !== null) return false;
+  if (def.type === "autonumber") return false;
+  const options = def.options;
+  if (Array.isArray(options) && options.some((o) => !!o && typeof o === "object" && o.default === true)) {
+    return false;
+  }
+  return true;
+}
+function buildNullableFieldIndex(objects) {
+  const idx = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const nullable = /* @__PURE__ */ new Set();
+    for (const [fname, def] of fieldEntries(obj)) {
+      if (isNullableField(def)) nullable.add(fname);
+    }
+    idx.set(name, nullable);
+  }
+  return idx;
+}
+function celSourceOf(raw) {
+  if (typeof raw === "string") return raw;
+  if (raw && typeof raw === "object") {
+    const rec = raw;
+    if (typeof rec.dialect === "string" && rec.dialect !== "cel") return void 0;
+    if (typeof rec.source === "string") return rec.source;
+  }
+  return void 0;
+}
+function rulePredicates(rule, path) {
+  const out = [];
+  const name = typeof rule.name === "string" ? rule.name : "?";
+  const here = path ? `${path} \u2192 '${name}'` : `'${name}'`;
+  const main = rule.expression ?? rule.predicate ?? rule.condition ?? rule.formula;
+  if (main != null) out.push({ label: `validation rule ${here}`, raw: main });
+  if (rule.when != null) out.push({ label: `validation rule ${here} when-predicate`, raw: rule.when });
+  for (const branch of ["then", "otherwise"]) {
+    const nested = rule[branch];
+    if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+      out.push(...rulePredicates(nested, `${here} ${branch}`));
+    }
+  }
+  return out;
+}
 function validateStackExpressions(stack) {
   const issues = [];
   const objects = asArray2(stack.objects);
   const fieldIndex = buildFieldIndex(objects);
   const fieldTypeIndex = buildFieldTypeIndex(objects);
+  const nullableIndex = buildNullableFieldIndex(objects);
+  const checkNullGuards = (where, subject, raw, objectName) => {
+    if (!objectName) return;
+    const nullableFields = nullableIndex.get(objectName);
+    if (!nullableFields || nullableFields.size === 0) return;
+    const source = celSourceOf(raw);
+    if (!source) return;
+    for (const finding of findUnguardedNullableOperands(source, { nullableFields })) {
+      issues.push({
+        where,
+        message: nullGuardMessage(subject, objectName, finding),
+        source,
+        severity: "error"
+      });
+    }
+  };
   const check = (where, raw, objectName, scope = "flattened") => {
     if (raw == null) return;
     const fields = objectName ? fieldIndex.get(objectName) : void 0;
@@ -579,17 +924,17 @@ function validateStackExpressions(stack) {
         if (node.type === "script") {
           const fn = (typeof cfg.function === "string" ? cfg.function.trim() : "") || (typeof cfg.functionName === "string" ? cfg.functionName.trim() : "");
           const action = typeof cfg.actionType === "string" ? cfg.actionType.trim() : "";
-          const inline = typeof cfg.script === "string" ? cfg.script.trim() : "";
-          if (!fn && !action && !inline) {
+          const retired = ["actionType", "template", "recipients", "variables", "script"].filter((k) => cfg[k] != null);
+          if (retired.length > 0) {
             issues.push({
               where: `${at} \xB7 node '${node.id}' (script) callable`,
-              message: `script node declares neither \`actionType\` nor \`function\` \u2014 it would do nothing at runtime. Name a built-in action (e.g. \`actionType: 'email'\`) or a registered function (\`function: 'my_fn'\`, registered via \`defineStack({ functions })\`).`,
+              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + `Run \`os migrate meta --from 16\` to rewrite it automatically.`,
               source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
             });
-          } else if (action === "invoke_function" && !fn) {
+          } else if (!fn) {
             issues.push({
               where: `${at} \xB7 node '${node.id}' (script) callable`,
-              message: `script node uses \`actionType: 'invoke_function'\` but no \`function\` (or \`functionName\`) \u2014 it names no callable. Set \`function: 'my_fn'\` and register it via \`defineStack({ functions })\`.`,
+              message: `script node declares no \`function\` \u2014 it would do nothing at runtime. Name a registered function (\`function: 'my_fn'\`, registered via \`defineStack({ functions })\`).`,
               source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
             });
           }
@@ -607,6 +952,9 @@ function validateStackExpressions(stack) {
       const where = `object '${objectName}' \xB7 validation '${rule.name ?? "?"}'`;
       check(where, rule.expression ?? rule.predicate ?? rule.condition ?? rule.formula, objectName, "record");
       check(`${where} when`, rule.when, objectName, "record");
+      for (const p of rulePredicates(rule, "")) {
+        checkNullGuards(`object '${objectName}' \xB7 ${p.label}`, p.label, p.raw, objectName);
+      }
     }
     const fields = obj.fields;
     const fieldList = Array.isArray(fields) ? fields : fields && typeof fields === "object" ? Object.values(fields) : [];
@@ -659,6 +1007,12 @@ function validateStackExpressions(stack) {
     const hookName = hook.name ?? "?";
     if (typeof hook.object === "string") {
       check(`hook '${hookName}' (${hook.object}) condition`, hook.condition, hook.object, "record");
+      checkNullGuards(
+        `hook '${hookName}' (${hook.object}) condition`,
+        `hook '${hookName}' condition`,
+        hook.condition,
+        hook.object
+      );
       continue;
     }
     const targets = Array.isArray(hook.object) ? hook.object.filter((o) => typeof o === "string" && o !== "*") : [];
@@ -672,6 +1026,12 @@ function validateStackExpressions(stack) {
     for (const target of targets) {
       const mark = issues.length;
       check(`hook '${hookName}' (${target}) condition`, hook.condition, target, "record");
+      checkNullGuards(
+        `hook '${hookName}' (${target}) condition`,
+        `hook '${hookName}' condition`,
+        hook.condition,
+        target
+      );
       for (let i = mark; i < issues.length; i++) {
         const issue = issues[i];
         const key = `${issue.message}\0${issue.source ?? ""}`;
@@ -753,6 +1113,72 @@ function validateListViewMode(stack) {
   return out;
 }
 
+// src/validate-functional-completeness.ts
+var import_kernel = require("@objectstack/spec/kernel");
+var isRec = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function entriesOf(v) {
+  if (Array.isArray(v)) {
+    return v.flatMap(
+      (def, i) => isRec(def) ? [{ name: String(def.name ?? i), def, key: `[${i}]` }] : []
+    );
+  }
+  if (isRec(v)) {
+    return Object.entries(v).flatMap(
+      ([name, def]) => isRec(def) ? [{ name, def: { name, ...def }, key: `.${name}` }] : []
+    );
+  }
+  return [];
+}
+function push(out, found, where, basePath) {
+  for (const f of found) {
+    out.push({
+      severity: f.severity,
+      rule: f.rule,
+      where,
+      path: `${basePath}.${f.path}`,
+      message: f.message,
+      hint: f.fix
+    });
+  }
+}
+function validateFunctionalCompleteness(stack) {
+  const out = [];
+  if (!isRec(stack)) return out;
+  for (const [oi, obj] of entriesOf(stack.objects).entries()) {
+    for (const field of entriesOf(obj.def.fields)) {
+      push(
+        out,
+        (0, import_kernel.checkFieldCompleteness)(field.def),
+        `object "${obj.name}" \u203A fields.${field.name}`,
+        `objects[${oi}].fields${field.key}`
+      );
+    }
+  }
+  for (const [vi, container] of entriesOf(stack.views).entries()) {
+    const where = container.def.object ? `view container "${container.name}"` : `view container [${vi}]`;
+    if (isRec(container.def.list)) {
+      push(out, (0, import_kernel.checkViewCompleteness)(container.def.list), `${where} \u203A list`, `views[${vi}].list`);
+    }
+    for (const lv of entriesOf(container.def.listViews)) {
+      push(
+        out,
+        (0, import_kernel.checkViewCompleteness)(lv.def),
+        `${where} \u203A listViews.${lv.name}`,
+        `views[${vi}].listViews${lv.key}`
+      );
+    }
+  }
+  for (const hook of entriesOf(stack.webhooks)) {
+    push(
+      out,
+      (0, import_kernel.checkWebhookCompleteness)(hook.def),
+      `webhook "${hook.name}"`,
+      `webhooks${hook.key}`
+    );
+  }
+  return out;
+}
+
 // src/validate-flow-trigger-readiness.ts
 var FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 var FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
@@ -852,7 +1278,7 @@ function validateFlowTriggerReadiness(stack) {
 
 // src/flow-walk.ts
 var import_automation2 = require("@objectstack/spec/automation");
-function isRec(v) {
+function isRec2(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName(v) {
@@ -867,7 +1293,7 @@ function flowNodeLabel(node, index) {
   return strName(node.label) ?? strName(node.id) ?? `#${index}`;
 }
 function stripRegions(config) {
-  if (!isRec(config)) return void 0;
+  if (!isRec2(config)) return void 0;
   let out;
   for (const key of Object.keys(config)) {
     if (!REGION_CONFIG_KEYS.has(key)) continue;
@@ -878,11 +1304,11 @@ function stripRegions(config) {
 }
 function walkFlowNodes(flow, flowPath) {
   const out = [];
-  if (!isRec(flow)) return out;
+  if (!isRec2(flow)) return out;
   const visitList = (nodes, basePath, trail, depth) => {
     if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
     nodes.forEach((raw, index) => {
-      if (!isRec(raw)) return;
+      if (!isRec2(raw)) return;
       const path = `${basePath}[${index}]`;
       out.push({
         node: raw,
@@ -893,7 +1319,7 @@ function walkFlowNodes(flow, flowPath) {
       });
       const type = strName(raw.type);
       const slots = type ? REGION_SLOTS.get(type) : void 0;
-      if (!slots || !isRec(raw.config)) return;
+      if (!slots || !isRec2(raw.config)) return;
       const config = raw.config;
       const here = `${type} "${flowNodeLabel(raw, index)}"`;
       for (const slot of slots) {
@@ -901,7 +1327,7 @@ function walkFlowNodes(flow, flowPath) {
         if (slot === "branches") {
           if (!Array.isArray(value)) continue;
           value.forEach((branch, b) => {
-            if (!isRec(branch)) return;
+            if (!isRec2(branch)) return;
             const branchName = strName(branch.name) ?? `#${b}`;
             visitList(
               branch.nodes,
@@ -912,7 +1338,7 @@ function walkFlowNodes(flow, flowPath) {
           });
           continue;
         }
-        if (!isRec(value)) continue;
+        if (!isRec2(value)) continue;
         visitList(
           value.nodes,
           `${path}.config.${slot}.nodes`,
@@ -1661,10 +2087,12 @@ function validateReactPages(stack) {
 // src/validate-react-page-props.ts
 var import_node_module2 = require("module");
 var import_ui2 = require("@objectstack/spec/ui");
-var import_data3 = require("@objectstack/spec/data");
+var import_data4 = require("@objectstack/spec/data");
 
 // src/validate-searchable-fields.ts
+var import_data3 = require("@objectstack/spec/data");
 var SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
+var SEARCHABLE_FIELD_UNSEARCHABLE = "searchable-field-unsearchable";
 function asArray10(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -1672,21 +2100,50 @@ function asArray10(v) {
   }
   return [];
 }
-function isRec2(v) {
+function isRec3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName2(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function declaredFieldNames(obj) {
+function declaredFieldTarget(obj) {
   const fields = obj.fields;
   if (!fields || typeof fields !== "object") return null;
   const names = /* @__PURE__ */ new Set();
+  const metas = {};
   for (const f of asArray10(fields)) {
     const n = strName2(f.name);
-    if (n) names.add(n);
+    if (!n) continue;
+    names.add(n);
+    metas[n] = {
+      type: typeof f.type === "string" ? f.type : void 0,
+      hidden: f.hidden === true
+    };
   }
-  return names.size > 0 ? names : null;
+  if (names.size === 0) return null;
+  const searchableFields = Array.isArray(obj.searchableFields) ? obj.searchableFields.filter((e) => typeof e === "string") : void 0;
+  return {
+    names,
+    fields: metas,
+    searchableFields,
+    displayField: strName2(obj.nameField) ?? strName2(obj.displayNameField)
+  };
+}
+function resolveAllowedSet(target) {
+  let fields = target.fields;
+  const systemDeclared = (target.searchableFields ?? []).filter(
+    (f) => !target.names.has(f) && SYSTEM_FIELDS.has(f)
+  );
+  if (systemDeclared.length > 0) {
+    fields = { ...fields };
+    for (const f of systemDeclared) fields[f] = {};
+  }
+  const { allowed, source } = (0, import_data3.resolveSearchFieldResolution)({
+    fields,
+    searchableFields: target.searchableFields,
+    displayField: target.displayField
+  });
+  return { allowed: new Set(allowed), source, declaredList: allowed };
 }
 function suggest2(target, known) {
   let best;
@@ -1719,50 +2176,87 @@ function distance(a, b) {
 }
 function indexObjectSearchTargets(stack) {
   const fieldsByObject = /* @__PURE__ */ new Map();
-  if (!isRec2(stack)) return fieldsByObject;
+  if (!isRec3(stack)) return fieldsByObject;
   for (const obj of asArray10(stack.objects)) {
     const name = strName2(obj.name);
-    if (name) fieldsByObject.set(name, declaredFieldNames(obj));
+    if (name) fieldsByObject.set(name, declaredFieldTarget(obj));
   }
   return fieldsByObject;
 }
-function checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject) {
+function checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role = "narrowing") {
   const findings = [];
   if (!Array.isArray(declared) || declared.length === 0) return findings;
   if (!objectName) return findings;
   if (!fieldsByObject.has(objectName)) return findings;
-  const known = fieldsByObject.get(objectName);
-  if (!known) return findings;
+  const target = fieldsByObject.get(objectName);
+  if (!target) return findings;
+  const known = target.names;
+  const resolution = role === "narrowing" ? resolveAllowedSet(target) : void 0;
   for (let i = 0; i < declared.length; i++) {
     const entry = declared[i];
     const name = strName2(entry);
     if (!name) continue;
-    if (known.has(name) || SYSTEM_FIELDS.has(name)) continue;
-    const dotted = name.includes(".");
+    if (!known.has(name) && !SYSTEM_FIELDS.has(name)) {
+      const dotted = name.includes(".");
+      findings.push({
+        severity: "error",
+        rule: SEARCHABLE_FIELD_UNKNOWN,
+        where,
+        path: `${path}[${i}]`,
+        message: `${subject} entry "${name}" is not a field on object "${objectName}". The declaration is stale: searching it can never match, and the engine silently drops it \u2014 leaving a narrower search than declared, or the auto-default set once every entry is dropped.` + (dotted ? "" : suggest2(name, known)),
+        hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a formula field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+      });
+      continue;
+    }
+    if (!resolution || resolution.allowed.has(name)) continue;
+    if (!known.has(name)) continue;
+    const meta = target.fields[name];
+    if (resolution.source === "declared") {
+      findings.push({
+        severity: "error",
+        rule: SEARCHABLE_FIELD_UNSEARCHABLE,
+        where,
+        path: `${path}[${i}]`,
+        message: `${subject} entry "${name}" is outside object "${objectName}"'s declared searchableFields (${resolution.declaredList.join(", ")}) \u2014 the set 'search' scans. Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses an entry outside the allowed set: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
+        hint: `Add "${name}" to ${objectName}.searchableFields, or drop it from this view \u2014 a view narrows the object's searchable set, never widens it (ADR-0061).`
+      });
+      continue;
+    }
+    const isReference = meta?.type === "lookup" || meta?.type === "master_detail";
+    let why;
+    if (import_data3.SEARCH_AUTO_EXCLUDED_FIELDS.has(name)) {
+      why = "a system/audit column, which the auto-default set never includes";
+    } else if (meta?.hidden) {
+      why = "hidden";
+    } else if (typeof meta?.type === "string") {
+      why = `of type '${meta.type}', which 'search' cannot scan`;
+    } else {
+      continue;
+    }
     findings.push({
       severity: "error",
-      rule: SEARCHABLE_FIELD_UNKNOWN,
+      rule: SEARCHABLE_FIELD_UNSEARCHABLE,
       where,
       path: `${path}[${i}]`,
-      message: `${subject} entry "${name}" is not a field on object "${objectName}". The declaration is stale: searching it can never match, and the engine silently drops it \u2014 leaving a narrower search than declared, or the auto-default set once every entry is dropped.` + (dotted ? "" : suggest2(name, known)),
-      hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a formula field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+      message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...import_data3.SEARCHABLE_TEXTUAL_TYPES, ...import_data3.SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
+      hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a text/formula field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
     });
   }
   return findings;
 }
 function validateSearchableFields(stack) {
   const findings = [];
-  if (!isRec2(stack)) return findings;
+  if (!isRec3(stack)) return findings;
   const objects = asArray10(stack.objects);
   const fieldsByObject = indexObjectSearchTargets(stack);
-  const check = (declared, objectName, where, path, subject) => {
+  const check = (declared, objectName, where, path, subject, role) => {
     findings.push(
-      ...checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject)
+      ...checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role)
     );
   };
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec2(obj)) continue;
+    if (!isRec3(obj)) continue;
     const objName = strName2(obj.name);
     const label2 = objName ? `object "${objName}"` : `objects[${oi}]`;
     check(
@@ -1770,11 +2264,12 @@ function validateSearchableFields(stack) {
       objName,
       label2,
       `objects[${oi}].searchableFields`,
-      "searchableFields"
+      "searchableFields",
+      "canonical"
     );
-    if (isRec2(obj.listViews)) {
+    if (isRec3(obj.listViews)) {
       for (const [key, lv] of Object.entries(obj.listViews)) {
-        if (!isRec2(lv)) continue;
+        if (!isRec3(lv)) continue;
         check(
           lv.searchableFields,
           // A built-in list view belongs to its object; an inline `data.object`
@@ -1782,7 +2277,8 @@ function validateSearchableFields(stack) {
           listViewObject(lv) ?? objName,
           `${label2} \u203A listViews.${key}`,
           `objects[${oi}].listViews.${key}.searchableFields`,
-          "list-view searchableFields"
+          "list-view searchableFields",
+          "narrowing"
         );
       }
     }
@@ -1790,27 +2286,29 @@ function validateSearchableFields(stack) {
   const views = asArray10(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec2(view)) continue;
+    if (!isRec3(view)) continue;
     const viewLabel = strName2(view.name) ?? strName2(view.objectName) ?? `#${vi}`;
     const viewObject = strName2(view.objectName) ?? strName2(view.object);
-    if (isRec2(view.list)) {
+    if (isRec3(view.list)) {
       check(
         view.list.searchableFields,
         listViewObject(view.list) ?? viewObject,
         `view "${viewLabel}" \u203A list`,
         `views[${vi}].list.searchableFields`,
-        "list-view searchableFields"
+        "list-view searchableFields",
+        "narrowing"
       );
     }
-    if (isRec2(view.listViews)) {
+    if (isRec3(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
-        if (!isRec2(lv)) continue;
+        if (!isRec3(lv)) continue;
         check(
           lv.searchableFields,
           listViewObject(lv) ?? viewObject,
           `view "${viewLabel}" \u203A listViews.${key}`,
           `views[${vi}].listViews.${key}.searchableFields`,
-          "list-view searchableFields"
+          "list-view searchableFields",
+          "narrowing"
         );
       }
     }
@@ -1819,11 +2317,11 @@ function validateSearchableFields(stack) {
 }
 function listViewObject(listView) {
   const data = listView.data;
-  return isRec2(data) ? strName2(data.object) : void 0;
+  return isRec3(data) ? strName2(data.object) : void 0;
 }
 
 // src/page-walk.ts
-function isRec3(v) {
+function isRec4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName3(v) {
@@ -1836,19 +2334,19 @@ function isSourceAuthoredPage(page) {
 }
 function walkPageComponents(page, pagePath) {
   const out = [];
-  if (!isRec3(page) || isSourceAuthoredPage(page)) return out;
+  if (!isRec4(page) || isSourceAuthoredPage(page)) return out;
   const pageObject = strName3(page.object);
   const visit = (node, path, inheritedObject) => {
-    if (!isRec3(node)) return;
-    const props = isRec3(node.properties) ? node.properties : void 0;
-    const dataSource = isRec3(node.dataSource) ? node.dataSource : void 0;
+    if (!isRec4(node)) return;
+    const props = isRec4(node.properties) ? node.properties : void 0;
+    const dataSource = isRec4(node.dataSource) ? node.dataSource : void 0;
     const objectName = strName3(dataSource?.object) ?? strName3(props?.object) ?? inheritedObject;
     out.push({ component: node, path, objectName });
     if (!props) return;
     if (Array.isArray(props.items)) {
       for (let i = 0; i < props.items.length; i++) {
         const item = props.items[i];
-        if (!isRec3(item) || !Array.isArray(item.children)) continue;
+        if (!isRec4(item) || !Array.isArray(item.children)) continue;
         for (let c = 0; c < item.children.length; c++) {
           visit(item.children[c], `${path}.properties.items[${i}].children[${c}]`, objectName);
         }
@@ -1870,12 +2368,12 @@ function walkPageComponents(page, pagePath) {
   const regions = Array.isArray(page.regions) ? page.regions : [];
   for (let r = 0; r < regions.length; r++) {
     const region = regions[r];
-    if (!isRec3(region) || !Array.isArray(region.components)) continue;
+    if (!isRec4(region) || !Array.isArray(region.components)) continue;
     for (let c = 0; c < region.components.length; c++) {
       visit(region.components[c], `${pagePath}.regions[${r}].components[${c}]`, pageObject);
     }
   }
-  const slots = isRec3(page.slots) ? page.slots : void 0;
+  const slots = isRec4(page.slots) ? page.slots : void 0;
   if (slots) {
     for (const [slot, value] of Object.entries(slots)) {
       const list3 = Array.isArray(value) ? value : [value];
@@ -1900,7 +2398,7 @@ function asArray11(v) {
 function strName4(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function isRec4(v) {
+function isRec5(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function fieldRefsFrom(value, basePath) {
@@ -1911,7 +2409,7 @@ function fieldRefsFrom(value, basePath) {
       out.push({ name: bare, path });
       return;
     }
-    if (!isRec4(v)) return;
+    if (!isRec5(v)) return;
     const named = strName4(v.field) ?? strName4(v.name);
     if (named) out.push({ name: named, path: `${path}.${strName4(v.field) ? "field" : "name"}` });
   };
@@ -1953,15 +2451,15 @@ function componentFieldRefs(type, props, basePath, sep = ".") {
     const sections = Array.isArray(props[key]) ? props[key] : [];
     for (let si = 0; si < sections.length; si++) {
       const section = sections[si];
-      if (!isRec4(section)) continue;
+      if (!isRec5(section)) continue;
       refs.push(...fieldRefsFrom(section.fields, `${basePath}${sep}${key}[${si}].fields`));
     }
   }
   return refs;
 }
 function relatedListFieldRefs(props, basePath, sep = ".") {
-  const add = isRec4(props.add) ? props.add : void 0;
-  const picker = add && isRec4(add.picker) ? add.picker : void 0;
+  const add = isRec5(props.add) ? props.add : void 0;
+  const picker = add && isRec5(add.picker) ? add.picker : void 0;
   const at = (key) => `${basePath}${sep}${key}`;
   return {
     relatedObject: strName4(props.objectName),
@@ -1982,7 +2480,7 @@ function relatedListFieldRefs(props, basePath, sep = ".") {
 }
 function indexObjectFields(stack) {
   const objectFields = /* @__PURE__ */ new Map();
-  if (!isRec4(stack)) return objectFields;
+  if (!isRec5(stack)) return objectFields;
   for (const obj of asArray11(stack.objects)) {
     const name = strName4(obj.name);
     if (!name) continue;
@@ -2028,7 +2526,7 @@ function validatePageFieldBindings(stack) {
     };
     for (const { component, path, objectName } of walkPageComponents(page, `pages[${pi}]`)) {
       const type = strName4(component.type);
-      const props = isRec4(component.properties) ? component.properties : void 0;
+      const props = isRec5(component.properties) ? component.properties : void 0;
       if (!type || !props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -2043,7 +2541,7 @@ function validatePageFieldBindings(stack) {
       if (!refs) continue;
       checkRefs(refs, objectName, where);
     }
-    const cfg = isRec4(page.interfaceConfig) ? page.interfaceConfig : void 0;
+    const cfg = isRec5(page.interfaceConfig) ? page.interfaceConfig : void 0;
     if (cfg) {
       const cfgObject = strName4(cfg.source) ?? strName4(page.object);
       const base = `pages[${pi}].interfaceConfig`;
@@ -2052,7 +2550,7 @@ function validatePageFieldBindings(stack) {
         ...sortFieldRefs(cfg.sort, `${base}.sort`),
         ...fieldRefsFrom(cfg.filterBy, `${base}.filterBy`)
       ];
-      const userFilters = isRec4(cfg.userFilters) ? cfg.userFilters : void 0;
+      const userFilters = isRec5(cfg.userFilters) ? cfg.userFilters : void 0;
       if (userFilters) {
         refs.push(...fieldRefsFrom(userFilters.fields, `${base}.userFilters.fields`));
       }
@@ -2168,28 +2666,28 @@ var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 var CHART_FUNCTIONS = ["count", "sum", "avg", "min", "max"];
-var isRec5 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec6 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
 function checkObjectChart(attrs, objectFields, findings) {
   const { values, where, path } = attrs;
-  const push = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
+  const push2 = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
   if (values.has("data")) return;
   const aggregate = values.get("aggregate");
   if (aggregate === void 0 || aggregate === NOT_STATIC) return;
-  if (!isRec5(aggregate)) return;
+  if (!isRec6(aggregate)) return;
   const fn = strOf(aggregate.function);
   const field = strOf(aggregate.field);
   const groupBy = aggregate.groupBy;
-  const groupByField = strOf(groupBy) ?? (isRec5(groupBy) ? strOf(groupBy.field) : void 0);
+  const groupByField = strOf(groupBy) ?? (isRec6(groupBy) ? strOf(groupBy.field) : void 0);
   if (fn && !CHART_FUNCTIONS.includes(fn)) {
-    push(
+    push2(
       "error",
       REACT_CHART_AGGREGATE_INVALID,
       `aggregate.function "${fn}" is not an aggregation this chart can run.`,
       `Use one of: ${CHART_FUNCTIONS.join(", ")}.`
     );
   } else if (fn && fn !== "count" && !field) {
-    push(
+    push2(
       "error",
       REACT_CHART_AGGREGATE_INVALID,
       `aggregate.function "${fn}" has no "field" to aggregate.`,
@@ -2203,7 +2701,7 @@ function checkObjectChart(attrs, objectFields, findings) {
       if (!name) return;
       if (name.includes(".")) return;
       if (known.has(name) || SYSTEM_FIELDS.has(name)) return;
-      push(
+      push2(
         "error",
         REACT_CHART_FIELD_UNKNOWN,
         `aggregate.${prop} "${name}" is not a field on object "${objectName}" \u2014 the aggregate query has nothing to ${prop === "groupBy" ? "group by" : "aggregate"}, so the chart comes back empty.`,
@@ -2220,7 +2718,7 @@ function checkObjectChart(attrs, objectFields, findings) {
     if (!name) return;
     if (columns.includes(name)) return;
     if (keys.comparison && name === keys.comparison) return;
-    push(
+    push2(
       "error",
       REACT_CHART_AXIS_UNKNOWN,
       `"${name}" is not a column this aggregate returns, so the axis plots nothing. Object-bound aggregate rows are keyed by the RAW FIELD NAMES (unlike a dataset, whose rows are keyed by measure name).`,
@@ -2228,24 +2726,24 @@ function checkObjectChart(attrs, objectFields, findings) {
     );
   };
   const xAxisRaw = values.get("xAxis");
-  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec5(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec6(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
   const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
   axisRef(categoryAxis, categoryProp);
   const yAxisRaw = values.get("yAxis");
   const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
   for (const a of yAxisList) {
-    axisRef(strOf(a) ?? (isRec5(a) ? strOf(a.field) : void 0), "yAxis[].field");
+    axisRef(strOf(a) ?? (isRec6(a) ? strOf(a.field) : void 0), "yAxis[].field");
   }
   const series = values.get("series");
   if (Array.isArray(series)) {
     for (const s of series) {
-      if (!isRec5(s)) continue;
+      if (!isRec6(s)) continue;
       const dataKey = strOf(s.dataKey);
       axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
     }
   }
   if (categoryAxis && keys.category && categoryAxis !== keys.category && categoryAxis === keys.value) {
-    push(
+    push2(
       "error",
       REACT_CHART_AXIS_UNKNOWN,
       `${categoryProp} "${categoryAxis}" is the aggregate's VALUE column, not its category column.`,
@@ -2295,7 +2793,7 @@ function subformFieldRefs(value, basePath) {
   if (!Array.isArray(value)) return { child, parent };
   for (let i = 0; i < value.length; i++) {
     const sub = value[i];
-    if (!isRec5(sub)) continue;
+    if (!isRec6(sub)) continue;
     const at = (key) => `${basePath}[${i}].${key}`;
     child.push({
       objectName: strOf(sub.childObject),
@@ -2320,7 +2818,7 @@ function filterFieldRefs(node, basePath, out) {
     for (let i = 0; i < node.length; i++) filterFieldRefs(node[i], `${basePath}[${i}]`, out);
     return;
   }
-  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data3.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
+  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data4.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
     out.push({ name: head, path: `${basePath}[0]` });
   }
 }
@@ -2340,20 +2838,20 @@ function reactFieldRefs(spec, values, basePath) {
   }
   for (const key of spec.nestedFields ?? []) {
     const v = readable(key);
-    if (isRec5(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+    if (isRec6(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
   }
   for (const key of spec.sections ?? []) {
     const v = readable(key);
     if (!Array.isArray(v)) continue;
     for (let i = 0; i < v.length; i++) {
       const section = v[i];
-      if (!isRec5(section)) continue;
+      if (!isRec6(section)) continue;
       own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
     }
   }
   for (const key of spec.keyedByField ?? []) {
     const v = readable(key);
-    if (!isRec5(v)) continue;
+    if (!isRec6(v)) continue;
     for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
   }
   for (const key of spec.filterArrays ?? []) {
@@ -2379,25 +2877,41 @@ function checkBlockFieldProps(tag, values, objectFields, where, path) {
     out.push(...checkFieldRefs(subs.parent, objectName, objectFields, where));
   }
   const schemaType = tag === "Block" ? strOf(values.get("type")) : SCHEMA_TYPE_BY_TAG.get(tag);
-  if (schemaType) {
-    const props = readableProps(values);
-    if (schemaType === RELATED_LIST_TYPE) {
-      const split = relatedListFieldRefs(props, path, PATH_SEP);
-      out.push(...checkFieldRefs(split.related, split.relatedObject, objectFields, where));
-      out.push(...checkFieldRefs(split.picker, split.pickerObject, objectFields, where));
-    } else if (COMPONENT_FIELD_SPECS[schemaType]) {
-      out.push(
-        ...checkFieldRefs(
-          componentFieldRefs(schemaType, props, path, PATH_SEP) ?? [],
-          objectName,
-          objectFields,
-          where
-        )
-      );
-    }
+  if (schemaType && COMPONENT_FIELD_SPECS[schemaType]) {
+    out.push(
+      ...checkFieldRefs(
+        componentFieldRefs(schemaType, readableProps(values), path, PATH_SEP) ?? [],
+        objectName,
+        objectFields,
+        where
+      )
+    );
   }
   return out;
 }
+var REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
+var RECORD_BLOCK_GENERIC_FIX = "author the page as `type:'record'` \u2014 a record page mounts the record context these blocks render from.";
+function recordContextFinding(tag, schemaType, where, path) {
+  return {
+    severity: "error",
+    rule: REACT_BLOCK_NEEDS_RECORD_CONTEXT,
+    where,
+    path,
+    message: `<${tag}> renders "${schemaType}", which reads its record from the record context a record page mounts \u2014 a kind:'react' page never mounts one, so the block renders empty no matter how it is bound (its objectName/recordId are not read by the renderer).`,
+    hint: `On a react page bind the record yourself: ${import_ui2.REACT_RECORD_BLOCK_ALTERNATIVES[schemaType] ?? RECORD_BLOCK_GENERIC_FIX}`
+  };
+}
+function localComponentNames(tsc, sf) {
+  const names = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    if (tsc.isFunctionDeclaration(node) && node.name) names.add(node.name.text);
+    else if (tsc.isVariableDeclaration(node) && tsc.isIdentifier(node.name)) names.add(node.name.text);
+    else if (tsc.isImportSpecifier(node)) names.add(node.name.text);
+    tsc.forEachChild(node, walk);
+  };
+  walk(sf);
+  return names;
+}
 function validateReactPageProps(stack) {
   const findings = [];
   const objectFields = indexObjectFields(stack);
@@ -2416,9 +2930,18 @@ function validateReactPageProps(stack) {
     } catch {
       continue;
     }
+    const locals = localComponentNames(tsc, sf);
     const visit = (node) => {
       if (tsc.isJsxOpeningElement(node) || tsc.isJsxSelfClosingElement(node)) {
         const tag = node.tagName.getText(sf);
+        const where = `page "${name}" \u203A <${tag}>`;
+        const path = `pages[${p}].source`;
+        const recordType = import_ui2.RECORD_CONTEXT_BLOCK_TAGS.get(tag);
+        if (recordType && !locals.has(tag)) {
+          findings.push(recordContextFinding(tag, recordType, where, path));
+          tsc.forEachChild(node, visit);
+          return;
+        }
         const block = BLOCKS.get(tag);
         if (block) {
           let hasSpread = false;
@@ -2438,8 +2961,14 @@ function validateReactPageProps(stack) {
               );
             }
           }
-          const where = `page "${name}" \u203A <${tag}>`;
-          const path = `pages[${p}].source`;
+          if (tag === "Block") {
+            const blockType = strOf(values.get("type"));
+            if (blockType && (0, import_ui2.isRecordContextBlockType)(blockType)) {
+              findings.push(recordContextFinding(tag, blockType, where, path));
+              tsc.forEachChild(node, visit);
+              return;
+            }
+          }
           if (!hasSpread) {
             for (const req of block.requiredBindings) {
               if (!used.has(req)) {
@@ -2528,7 +3057,7 @@ function validatePageSourceStyling(stack) {
 }
 
 // src/validate-record-title.ts
-var import_data4 = require("@objectstack/spec/data");
+var import_data5 = require("@objectstack/spec/data");
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
 function asArray14(v) {
@@ -2556,7 +3085,7 @@ function validateRecordTitle(stack) {
         hint: `titleFormat is a render-only template the server cannot return or query, and an explicit nameField now takes precedence. For a single-field title set nameField: '<field>'. For a composite title, add a formula field (returnType: 'text') and designate it via nameField.`
       });
     }
-    const completeness = (0, import_data4.objectTitleCompleteness)(obj);
+    const completeness = (0, import_data5.objectTitleCompleteness)(obj);
     if (completeness.status === "none") {
       findings.push({
         severity: "warning",
@@ -3859,7 +4388,7 @@ function validateDashboardActionRefs(stack) {
 }
 
 // src/validate-filter-tokens.ts
-var import_data5 = require("@objectstack/spec/data");
+var import_data6 = require("@objectstack/spec/data");
 var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
 var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
 function asArray23(v) {
@@ -3872,11 +4401,11 @@ function asArray23(v) {
 function label(v, fallback) {
   return typeof v === "string" && v.length > 0 ? v : fallback;
 }
-var KNOWN_LIST = import_data5.CONTEXT_TOKENS.join("}, {");
+var KNOWN_LIST = import_data6.CONTEXT_TOKENS.join("}, {");
 function walkFilterValues(node, path, where, out, seen) {
   if (node === null || node === void 0) return;
   if (typeof node === "string") {
-    const cls = (0, import_data5.classifyFilterToken)(node);
+    const cls = (0, import_data6.classifyFilterToken)(node);
     if (cls?.kind === "unknown") {
       const suggestion = cls.suggestion;
       out.push({
@@ -4145,16 +4674,86 @@ function validateObjectReferences(stack) {
   return findings;
 }
 
+// src/validate-nav-target-refs.ts
+var NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
+var isRec7 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray25(v) {
+  if (Array.isArray(v)) return v.filter(isRec7);
+  if (isRec7(v)) return Object.entries(v).map(([name, def]) => isRec7(def) ? { name, ...def } : { name });
+  return [];
+}
+function strName7(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var isInterpolated2 = (s) => s.includes("${") || s.includes("{");
+var NAV_TARGETS = [
+  ["page", "pageName", "pages", "page"],
+  ["report", "reportName", "reports", "report"],
+  ["dashboard", "dashboardName", "dashboards", "dashboard"]
+];
+function namesOf(collection) {
+  const out = /* @__PURE__ */ new Set();
+  for (const entry of asArray25(collection)) {
+    const n = strName7(entry.name);
+    if (n) out.add(n);
+  }
+  return out;
+}
+function validateNavTargetRefs(stack) {
+  const findings = [];
+  if (!isRec7(stack)) return findings;
+  const apps = asArray25(stack.apps);
+  if (apps.length === 0) return findings;
+  const declared = /* @__PURE__ */ new Map();
+  for (const [, , collection] of NAV_TARGETS) {
+    declared.set(collection, namesOf(stack[collection]));
+  }
+  for (const [ai, app] of apps.entries()) {
+    const appName = strName7(app.name) ?? `#${ai}`;
+    const walk = (items, basePath) => {
+      if (!Array.isArray(items)) return;
+      for (const [ni, raw] of items.entries()) {
+        if (!isRec7(raw)) continue;
+        const nav = raw;
+        const navPath = `${basePath}[${ni}]`;
+        for (const [type, prop, collection, noun] of NAV_TARGETS) {
+          if (nav.type !== type) continue;
+          const target = strName7(nav[prop]);
+          if (!target || isInterpolated2(target)) continue;
+          const known = declared.get(collection);
+          if (known.has(target)) continue;
+          const emptyCollection = known.size === 0;
+          findings.push({
+            severity: "warning",
+            rule: NAV_TARGET_UNRESOLVED,
+            where: `app "${appName}" \xB7 nav "${strName7(nav.id) ?? strName7(nav.label) ?? `#${ni}`}"`,
+            path: `${navPath}.${prop}`,
+            message: `Navigation targets ${noun} '${target}', which this stack does not declare in \`${collection}\`. ` + (emptyCollection ? `The stack declares NO ${collection} at all, so \`defineStack\`'s own cross-reference check skipped this entry entirely (it is gated on \`${collection === "pages" ? "pageNames" : collection === "reports" ? "reportNames" : "dashboardNames"}.size > 0\`) \u2014 nothing else will report it. ` : "") + `The entry renders in the sidebar and resolves to nothing when clicked. If another package provides this ${noun}, this is expected and advisory only.`,
+            hint: `Declare the ${noun} in \`${collection}\`, correct the name, or remove the nav entry if the ${noun} is gone.`
+          });
+        }
+        if (Array.isArray(nav.children)) walk(nav.children, `${navPath}.children`);
+      }
+    };
+    walk(app.navigation, `apps[${ai}].navigation`);
+    for (const [ari, area] of asArray25(app.areas).entries()) {
+      walk(area.items, `apps[${ai}].areas[${ari}].items`);
+      walk(area.navigation, `apps[${ai}].areas[${ari}].navigation`);
+    }
+  }
+  return findings;
+}
+
 // src/validate-action-name-refs.ts
 var ACTION_NAME_UNDEFINED = "action-name-undefined";
-function asArray25(v) {
+function asArray26(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName7(v) {
+function strName8(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList(v) {
@@ -4191,14 +4790,14 @@ function suggest4(target, known) {
 }
 function collectActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
-  for (const action of asArray25(stack.actions)) {
-    const n = strName7(action?.name);
+  for (const action of asArray26(stack.actions)) {
+    const n = strName8(action?.name);
     if (n) names.add(n);
   }
-  for (const obj of asArray25(stack.objects)) {
+  for (const obj of asArray26(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
-    for (const action of asArray25(obj.actions)) {
-      const n = strName7(action?.name);
+    for (const action of asArray26(obj.actions)) {
+      const n = strName8(action?.name);
       if (n) names.add(n);
     }
   }
@@ -4208,7 +4807,7 @@ function validateActionNameRefs(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = collectActionNames(stack);
-  const check = (name, where, path, surface) => {
+  const check = (name, where, path, surface, placement = "with the location this surface needs") => {
     if (known.has(name)) return;
     findings.push({
       severity: "error",
@@ -4216,42 +4815,72 @@ function validateActionNameRefs(stack) {
       where,
       path,
       message: `${surface} names action "${name}", which is defined by no action in this stack (neither \`stack.actions\` nor any object's \`actions\`). The button renders and does nothing when clicked \u2014 a dead affordance the runtime cannot dispatch.` + suggest4(name, known),
-      hint: `Define an action named "${name}" (in \`stack.actions\` or the object's \`actions\`) with the location this surface needs, remove the reference, or ignore this if the action is contributed by another installed package.` + (known.size > 0 ? ` Defined actions: ${[...known].sort().join(", ")}.` : "")
+      hint: `Define an action named "${name}" (in \`stack.actions\` or the object's \`actions\`) ${placement}, remove the reference, or ignore this if the action is contributed by another installed package.` + (known.size > 0 ? ` Defined actions: ${[...known].sort().join(", ")}.` : "")
     });
   };
-  const views = asArray25(stack.views);
+  const SELECTION_BAR_PLACEMENT = "(no `locations` entry needed \u2014 the selection bar places it by name)";
+  const checkListContainer = (container, owner, label2, path) => {
+    if (!container || typeof container !== "object") return;
+    const list3 = container;
+    for (const key of ["rowActions", "bulkActions"]) {
+      const names = strList(list3[key]);
+      for (let ai = 0; ai < names.length; ai++) {
+        check(
+          names[ai],
+          `${owner} \xB7 ${label2} \xB7 ${key}`,
+          `${path}.${key}[${ai}]`,
+          key === "bulkActions" ? "Bulk-action menu" : "Row-action menu",
+          key === "bulkActions" ? SELECTION_BAR_PLACEMENT : void 0
+        );
+      }
+    }
+    const defs = Array.isArray(list3.bulkActionDefs) ? list3.bulkActionDefs : [];
+    for (let di = 0; di < defs.length; di++) {
+      const def = defs[di];
+      if (!def || typeof def !== "object") continue;
+      if (def.execution !== "aggregate") continue;
+      if (def.actionDef !== void 0) continue;
+      const name = strName8(def.name);
+      if (!name) continue;
+      check(
+        name,
+        `${owner} \xB7 ${label2} \xB7 bulkActionDefs[${di}]`,
+        `${path}.bulkActionDefs[${di}].name`,
+        "Aggregate bulk action",
+        SELECTION_BAR_PLACEMENT
+      );
+    }
+  };
+  const views = asArray26(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
     if (!view || typeof view !== "object") continue;
-    const viewName = strName7(view.name) ?? strName7(view.object) ?? `#${vi}`;
-    const checkListContainer = (container, label2, path) => {
-      if (!container || typeof container !== "object") return;
-      const list3 = container;
-      for (const key of ["rowActions", "bulkActions"]) {
-        const names = strList(list3[key]);
-        for (let ai = 0; ai < names.length; ai++) {
-          check(
-            names[ai],
-            `view "${viewName}" \xB7 ${label2} \xB7 ${key}`,
-            `${path}.${key}[${ai}]`,
-            key === "bulkActions" ? "Bulk-action menu" : "Row-action menu"
-          );
-        }
-      }
-    };
-    checkListContainer(view.list, "list", `views[${vi}].list`);
+    const viewName = strName8(view.name) ?? strName8(view.object) ?? `#${vi}`;
+    const owner = `view "${viewName}"`;
+    checkListContainer(view.list, owner, "list", `views[${vi}].list`);
     const listViews = view.listViews;
     if (listViews && typeof listViews === "object" && !Array.isArray(listViews)) {
       for (const [key, lv] of Object.entries(listViews)) {
-        checkListContainer(lv, `listViews.${key}`, `views[${vi}].listViews.${key}`);
+        checkListContainer(lv, owner, `listViews.${key}`, `views[${vi}].listViews.${key}`);
       }
     }
   }
-  const pages = asArray25(stack.pages);
+  const objects = asArray26(stack.objects);
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!obj || typeof obj !== "object") continue;
+    const objListViews = obj.listViews;
+    if (!objListViews || typeof objListViews !== "object" || Array.isArray(objListViews)) continue;
+    const owner = `object "${strName8(obj.name) ?? `#${oi}`}"`;
+    for (const [key, lv] of Object.entries(objListViews)) {
+      checkListContainer(lv, owner, `listViews.${key}`, `objects[${oi}].listViews.${key}`);
+    }
+  }
+  const pages = asArray26(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
-    const pageName = strName7(page.name) ?? `#${pi}`;
+    const pageName = strName8(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
       const props = component.properties;
       if (!props || typeof props !== "object") continue;
@@ -4259,30 +4888,30 @@ function validateActionNameRefs(stack) {
       for (let ai = 0; ai < names.length; ai++) {
         check(
           names[ai],
-          `page "${pageName}" \xB7 component "${strName7(component.type) ?? "?"}"`,
+          `page "${pageName}" \xB7 component "${strName8(component.type) ?? "?"}"`,
           `${path}.properties.actionNames[${ai}]`,
           "Quick-actions bar"
         );
       }
     }
   }
-  const apps = asArray25(stack.apps);
+  const apps = asArray26(stack.apps);
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName7(app.name) ?? `#${ai}`;
+    const appName = strName8(app.name) ?? `#${ai}`;
     const walkNav = (items, basePath) => {
-      const navItems = asArray25(items);
+      const navItems = asArray26(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
         const actionDef = nav.actionDef;
-        const actionName = strName7(actionDef?.actionName);
+        const actionName = strName8(actionDef?.actionName);
         if (nav.type === "action" && actionName) {
           check(
             actionName,
-            `app "${appName}" \xB7 nav "${strName7(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName8(nav.id) ?? `#${ni}`}"`,
             `${navPath}.actionDef.actionName`,
             "Navigation action item"
           );
@@ -4291,7 +4920,7 @@ function validateActionNameRefs(stack) {
       }
     };
     walkNav(app.navigation, `apps[${ai}].navigation`);
-    const areas = asArray25(app.areas);
+    const areas = asArray26(app.areas);
     for (let ri = 0; ri < areas.length; ri++) {
       walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
@@ -4299,42 +4928,116 @@ function validateActionNameRefs(stack) {
   return findings;
 }
 
-// src/validate-chart-bindings.ts
-var CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
-var CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
-var CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
-var CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
-function asArray26(v) {
+// src/validate-action-locations.ts
+var ACTION_NO_PLACEMENT = "action-no-placement";
+function asArray27(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName8(v) {
+function strName9(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList2(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function isRec6(v) {
-  return !!v && typeof v === "object" && !Array.isArray(v);
-}
-function distance4(a, b) {
-  const m = a.length;
-  const n = b.length;
-  if (m === 0) return n;
-  if (n === 0) return m;
-  let prev = Array.from({ length: n + 1 }, (_, j) => j);
-  for (let i = 1; i <= m; i++) {
-    const curr = [i, ...new Array(n).fill(0)];
-    for (let j = 1; j <= n; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+function collectNamePlacedActions(stack) {
+  const placed = /* @__PURE__ */ new Set();
+  const harvest = (container) => {
+    if (!container || typeof container !== "object") return;
+    const list3 = container;
+    for (const key of ["rowActions", "bulkActions"]) {
+      for (const n of strList2(list3[key])) placed.add(n);
     }
-    prev = curr;
+    for (const def of asArray27(list3.bulkActionDefs)) {
+      const n = strName9(def?.name);
+      if (n) placed.add(n);
+    }
+  };
+  const harvestListViews = (listViews) => {
+    if (!listViews || typeof listViews !== "object" || Array.isArray(listViews)) return;
+    for (const lv of Object.values(listViews)) harvest(lv);
+  };
+  for (const view of asArray27(stack.views)) {
+    if (!view || typeof view !== "object") continue;
+    harvest(view.list);
+    harvestListViews(view.listViews);
   }
-  return prev[n];
+  for (const obj of asArray27(stack.objects)) {
+    if (!obj || typeof obj !== "object") continue;
+    harvestListViews(obj.listViews);
+  }
+  return placed;
+}
+function validateActionLocations(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const namePlaced = collectNamePlacedActions(stack);
+  const check = (action, path) => {
+    if (!action || typeof action !== "object") return;
+    if ("locations" in action) return;
+    const name = strName9(action.name);
+    if (!name) return;
+    if (namePlaced.has(name)) return;
+    findings.push({
+      severity: "warning",
+      rule: ACTION_NO_PLACEMENT,
+      where: `action "${name}"`,
+      path,
+      message: `Action "${name}" declares no \`locations\` and no view places it by name, so it renders on no surface \u2014 the button exists in metadata and nowhere in the UI.`,
+      hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`, `global_nav`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
+    });
+  };
+  const actions = asArray27(stack.actions);
+  for (let i = 0; i < actions.length; i++) check(actions[i], `actions[${i}]`);
+  const objects = asArray27(stack.objects);
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!obj || typeof obj !== "object") continue;
+    const own = asArray27(obj.actions);
+    for (let ai = 0; ai < own.length; ai++) check(own[ai], `objects[${oi}].actions[${ai}]`);
+  }
+  return findings;
+}
+
+// src/validate-chart-bindings.ts
+var CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
+var CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
+var CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
+var CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
+function asArray28(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName10(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function strList3(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
+}
+function isRec8(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function distance4(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
 }
 function suggest5(target, known) {
   let best;
@@ -4355,17 +5058,17 @@ function list2(names) {
 }
 function indexDatasets(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const ds of asArray26(stack.datasets)) {
-    const name = strName8(ds.name);
+  for (const ds of asArray28(stack.datasets)) {
+    const name = strName10(ds.name);
     if (!name) continue;
     const dimensions = /* @__PURE__ */ new Set();
-    for (const d of asArray26(ds.dimensions)) {
-      const n = strName8(d.name);
+    for (const d of asArray28(ds.dimensions)) {
+      const n = strName10(d.name);
       if (n) dimensions.add(n);
     }
     const measures = /* @__PURE__ */ new Set();
-    for (const m of asArray26(ds.measures)) {
-      const n = strName8(m.name);
+    for (const m of asArray28(ds.measures)) {
+      const n = strName10(m.name);
       if (n) measures.add(n);
     }
     out.set(name, { dimensions, measures });
@@ -4443,75 +5146,75 @@ function validateChartBindings(stack) {
     if (binding.yAxis) measureRef(binding.yAxis.name, binding.yAxis.path, selected);
     for (const s of binding.series ?? []) measureRef(s.name, s.path, selected);
   };
-  const reports = asArray26(stack.reports);
+  const reports = asArray28(stack.reports);
   for (let ri = 0; ri < reports.length; ri++) {
     const report = reports[ri];
-    if (!isRec6(report)) continue;
-    const reportName = strName8(report.name) ?? `#${ri}`;
+    if (!isRec8(report)) continue;
+    const reportName = strName10(report.name) ?? `#${ri}`;
     const checkReportChart = (chart, dataset, values, where, path) => {
-      if (!isRec6(chart)) return;
+      if (!isRec8(chart)) return;
       check({
         dataset,
         // `values` is the report's measure SELECTION, not a chart ref; feeding
         // it in lets the yAxis "declared but not selected" check work without
         // reporting the selection itself twice.
         values: { names: values, path: `${path}.values` },
-        xAxis: strName8(chart.xAxis) ? { name: strName8(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
-        yAxis: strName8(chart.yAxis) ? { name: strName8(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
-        series: asArray26(chart.series).map((s, si) => ({ name: strName8(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
+        xAxis: strName10(chart.xAxis) ? { name: strName10(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
+        yAxis: strName10(chart.yAxis) ? { name: strName10(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
+        series: asArray28(chart.series).map((s, si) => ({ name: strName10(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
         where,
         path: `${path}.chart`
       });
     };
     checkReportChart(
       report.chart,
-      strName8(report.dataset),
-      strList2(report.values),
+      strName10(report.dataset),
+      strList3(report.values),
       `report "${reportName}" \xB7 chart`,
       `reports[${ri}]`
     );
     const blocks = Array.isArray(report.blocks) ? report.blocks : [];
     for (let bi = 0; bi < blocks.length; bi++) {
       const block = blocks[bi];
-      if (!isRec6(block)) continue;
+      if (!isRec8(block)) continue;
       checkReportChart(
         block.chart,
-        strName8(block.dataset),
-        strList2(block.values),
-        `report "${reportName}" \xB7 block "${strName8(block.name) ?? `#${bi}`}" chart`,
+        strName10(block.dataset),
+        strList3(block.values),
+        `report "${reportName}" \xB7 block "${strName10(block.name) ?? `#${bi}`}" chart`,
         `reports[${ri}].blocks[${bi}]`
       );
     }
   }
   const checkListChart = (container, where, path) => {
-    if (!isRec6(container)) return;
+    if (!isRec8(container)) return;
     const chart = container.chart;
-    if (!isRec6(chart)) return;
+    if (!isRec8(chart)) return;
     check({
-      dataset: strName8(chart.dataset),
-      dimensions: { names: strList2(chart.dimensions), path: `${path}.chart.dimensions` },
-      values: { names: strList2(chart.values), path: `${path}.chart.values` },
+      dataset: strName10(chart.dataset),
+      dimensions: { names: strList3(chart.dimensions), path: `${path}.chart.dimensions` },
+      values: { names: strList3(chart.values), path: `${path}.chart.values` },
       where,
       path: `${path}.chart`
     });
   };
-  const views = asArray26(stack.views);
+  const views = asArray28(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec6(view)) continue;
-    const viewName = strName8(view.name) ?? strName8(view.objectName) ?? `#${vi}`;
+    if (!isRec8(view)) continue;
+    const viewName = strName10(view.name) ?? strName10(view.objectName) ?? `#${vi}`;
     checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
-    if (isRec6(view.listViews)) {
+    if (isRec8(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
         checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
       }
     }
   }
-  const objects = asArray26(stack.objects);
+  const objects = asArray28(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec6(obj) || !isRec6(obj.listViews)) continue;
-    const objName = strName8(obj.name) ?? `#${oi}`;
+    if (!isRec8(obj) || !isRec8(obj.listViews)) continue;
+    const objName = strName10(obj.name) ?? `#${oi}`;
     for (const [key, lv] of Object.entries(obj.listViews)) {
       checkListChart(
         lv,
@@ -4520,22 +5223,22 @@ function validateChartBindings(stack) {
       );
     }
   }
-  const pages = asArray26(stack.pages);
+  const pages = asArray28(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec6(page)) continue;
-    const pageName = strName8(page.name) ?? `#${pi}`;
+    if (!isRec8(page)) continue;
+    const pageName = strName10(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const props = isRec6(component.properties) ? component.properties : void 0;
-      if (!props || !strName8(props.dataset)) continue;
-      const axisRefs = asArray26(props.yAxis).map((a, ai) => ({ name: strName8(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
-      const seriesRefs = asArray26(props.series).map((s, si) => ({ name: strName8(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
+      const props = isRec8(component.properties) ? component.properties : void 0;
+      if (!props || !strName10(props.dataset)) continue;
+      const axisRefs = asArray28(props.yAxis).map((a, ai) => ({ name: strName10(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
+      const seriesRefs = asArray28(props.series).map((s, si) => ({ name: strName10(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
       check({
-        dataset: strName8(props.dataset),
-        dimensions: { names: strList2(props.dimensions), path: `${path}.properties.dimensions` },
-        values: { names: strList2(props.values), path: `${path}.properties.values` },
+        dataset: strName10(props.dataset),
+        dimensions: { names: strList3(props.dimensions), path: `${path}.properties.dimensions` },
+        values: { names: strList3(props.values), path: `${path}.properties.values` },
         series: [...axisRefs, ...seriesRefs],
-        where: `page "${pageName}" \xB7 ${strName8(component.type) ?? "chart"}`,
+        where: `page "${pageName}" \xB7 ${strName10(component.type) ?? "chart"}`,
         path: `${path}.properties`
       });
     }
@@ -4547,7 +5250,7 @@ function validateChartBindings(stack) {
 var import_system3 = require("@objectstack/spec/system");
 
 // src/build-access-matrix.ts
-function asArray27(v) {
+function asArray29(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -4558,13 +5261,13 @@ function buildAccessMatrix(stack) {
   const entries = [];
   if (!stack || typeof stack !== "object") return { version: 1, entries };
   const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray27(stack.objects)) {
+  for (const obj of asArray29(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : "";
     if (!name) continue;
     const owd = obj.sharingModel ?? obj.security?.sharingModel;
     if (typeof owd === "string") owdByObject.set(name, owd);
   }
-  for (const ps of asArray27(stack.permissions)) {
+  for (const ps of asArray29(stack.permissions)) {
     const psName = typeof ps.name === "string" ? ps.name : "";
     if (!psName) continue;
     const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
@@ -4637,34 +5340,34 @@ function diffAccessMatrix(before, after) {
 
 // src/validate-nav-access.ts
 var NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
-function asArray28(v) {
+function asArray30(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName9(v) {
+function strName11(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function collectNavExposures(stack) {
   const out = [];
-  const apps = asArray28(stack.apps);
+  const apps = asArray30(stack.apps);
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName9(app.name) ?? `#${ai}`;
+    const appName = strName11(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
-      const navItems = asArray28(items);
+      const navItems = asArray30(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
-        const objectName = strName9(nav.objectName);
+        const objectName = strName11(nav.objectName);
         if (nav.type === "object" && objectName) {
           out.push({
             objectName,
-            where: `app "${appName}" \xB7 nav "${strName9(nav.id) ?? `#${ni}`}"`,
+            where: `app "${appName}" \xB7 nav "${strName11(nav.id) ?? `#${ni}`}"`,
             path: `${navPath}.objectName`
           });
         }
@@ -4672,7 +5375,7 @@ function collectNavExposures(stack) {
       }
     };
     walk(app.navigation, `apps[${ai}].navigation`);
-    const areas = asArray28(app.areas);
+    const areas = asArray30(app.areas);
     for (let ri = 0; ri < areas.length; ri++) {
       walk(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
@@ -4682,13 +5385,13 @@ function collectNavExposures(stack) {
 function validateNavAccess(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const permissionSets = asArray28(stack.permissions);
+  const permissionSets = asArray30(stack.permissions);
   if (permissionSets.length === 0) return findings;
   const exposures = collectNavExposures(stack);
   if (exposures.length === 0) return findings;
   const ownObjects = /* @__PURE__ */ new Set();
-  for (const obj of asArray28(stack.objects)) {
-    const n = strName9(obj.name);
+  for (const obj of asArray30(stack.objects)) {
+    const n = strName11(obj.name);
     if (n) ownObjects.add(n);
   }
   const readable = /* @__PURE__ */ new Set();
@@ -4720,15 +5423,15 @@ function validateNavAccess(stack) {
 var import_system4 = require("@objectstack/spec/system");
 var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec7(v) {
+function isRec9(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function asArray29(v) {
+function asArray31(v) {
   if (Array.isArray(v)) return v;
-  if (isRec7(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec7(def) ? def : {} }));
+  if (isRec9(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec9(def) ? def : {} }));
   return [];
 }
-function strName10(v) {
+function strName12(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance5(a, b) {
@@ -4786,20 +5489,20 @@ function collectViewRecord(view, factsFor) {
   const addView = (objectName, name) => {
     if (objectName && name) factsFor(objectName).views.add(name);
   };
-  const listBinding = isRec7(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec7(view.list)) addView(listBinding, strName10(view.list.name));
-  addView(recordObject ?? listBinding, strName10(view.name));
+  const listBinding = isRec9(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec9(view.list)) addView(listBinding, strName12(view.list.name));
+  addView(recordObject ?? listBinding, strName12(view.name));
   for (const key of ["listViews", "formViews"]) {
     const container = view[key];
-    if (!isRec7(container)) continue;
+    if (!isRec9(container)) continue;
     for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec7(sub)) continue;
+      if (!isRec9(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
       addView(binding, subKey);
-      addView(binding, strName10(sub.name));
+      addView(binding, strName12(sub.name));
       if (binding) {
-        for (const section of asArray29(sub.sections)) {
-          const sectionName = strName10(section.name);
+        for (const section of asArray31(sub.sections)) {
+          const sectionName = strName12(section.name);
           if (sectionName) factsFor(binding).sections.add(sectionName);
         }
       }
@@ -4807,14 +5510,14 @@ function collectViewRecord(view, factsFor) {
   }
   const sectionBinding = recordObject ?? listBinding;
   if (sectionBinding) {
-    for (const section of asArray29(view.sections)) {
-      const sectionName = strName10(section.name);
+    for (const section of asArray31(view.sections)) {
+      const sectionName = strName12(section.name);
       if (sectionName) factsFor(sectionBinding).sections.add(sectionName);
     }
   }
 }
 function viewObjectName(view) {
-  return strName10(view.objectName) ?? strName10(view.object) ?? (isRec7(view.data) ? strName10(view.data.object) : void 0);
+  return strName12(view.objectName) ?? strName12(view.object) ?? (isRec9(view.data) ? strName12(view.data.object) : void 0);
 }
 function readOptions(field) {
   const raw = field.options;
@@ -4826,14 +5529,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec7(opt)) continue;
-      const value = strName10(opt.value);
+      if (!isRec9(opt)) continue;
+      const value = strName12(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName10(opt.label);
+      const label2 = strName12(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec7(raw)) {
+  } else if (isRec9(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -4853,48 +5556,48 @@ function buildUniverse(stack) {
     }
     return facts;
   };
-  for (const obj of asArray29(stack.objects)) {
-    const objectName = strName10(obj.name);
+  for (const obj of asArray31(stack.objects)) {
+    const objectName = strName12(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
-    for (const field of asArray29(obj.fields)) {
-      const fieldName = strName10(field.name);
+    for (const field of asArray31(obj.fields)) {
+      const fieldName = strName12(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
-    for (const action of asArray29(obj.actions)) {
-      const actionName = strName10(action.name);
+    for (const action of asArray31(obj.actions)) {
+      const actionName = strName12(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
-    for (const view of asArray29(obj.views)) {
-      collectViewRecord({ ...view, object: strName10(view.object) ?? objectName }, factsFor);
+    for (const view of asArray31(obj.views)) {
+      collectViewRecord({ ...view, object: strName12(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
-    for (const group of asArray29(obj.fieldGroups)) {
-      const key = strName10(group.key) ?? strName10(group.name);
+    for (const group of asArray31(obj.fieldGroups)) {
+      const key = strName12(group.key) ?? strName12(group.name);
       if (key) facts.sections.add(key);
     }
   }
-  for (const view of asArray29(stack.views)) {
+  for (const view of asArray31(stack.views)) {
     collectViewRecord(view, factsFor);
   }
-  const pages = asArray29(stack.pages);
+  const pages = asArray31(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec7(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec9(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      for (const section of asArray29(props.sections)) {
-        const sectionName = strName10(section.name);
+      for (const section of asArray31(props.sections)) {
+        const sectionName = strName12(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
   }
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
-  for (const action of asArray29(stack.actions)) {
-    const actionName = strName10(action.name);
+  for (const action of asArray31(stack.actions)) {
+    const actionName = strName12(action.name);
     if (!actionName) continue;
-    const owner = strName10(action.objectName) ?? strName10(action.object);
+    const owner = strName12(action.objectName) ?? strName12(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -4908,41 +5611,41 @@ function buildUniverse(stack) {
     }
   }
   const apps = /* @__PURE__ */ new Map();
-  for (const app of asArray29(stack.apps)) {
-    const appName = strName10(app.name);
+  for (const app of asArray31(stack.apps)) {
+    const appName = strName12(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
-      for (const item of asArray29(items)) {
-        const id = strName10(item.id);
+      for (const item of asArray31(items)) {
+        const id = strName12(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
-    for (const area of asArray29(app.areas)) {
-      const areaId = strName10(area.id);
+    for (const area of asArray31(app.areas)) {
+      const areaId = strName12(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
     apps.set(appName, navIds);
   }
   const dashboards = /* @__PURE__ */ new Map();
-  for (const dash of asArray29(stack.dashboards)) {
-    const dashName = strName10(dash.name);
+  for (const dash of asArray31(stack.dashboards)) {
+    const dashName = strName12(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
-    for (const widget of asArray29(dash.widgets)) {
-      const id = strName10(widget.id) ?? strName10(widget.name);
+    for (const widget of asArray31(dash.widgets)) {
+      const id = strName12(widget.id) ?? strName12(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray29(isRec7(dash.header) ? dash.header.actions : void 0),
-      ...asArray29(dash.actions)
+      ...asArray31(isRec9(dash.header) ? dash.header.actions : void 0),
+      ...asArray31(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName10(action.actionUrl) ?? strName10(action.url) ?? strName10(action.name);
+      const key = strName12(action.actionUrl) ?? strName12(action.url) ?? strName12(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -4954,7 +5657,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec7(stack)) return findings;
+  if (!isRec9(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -4963,13 +5666,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec7(bundle)) continue;
+    if (!isRec9(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec7(rawData)) continue;
+      if (!isRec9(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec7(rawNode)) continue;
+        if (!isRec9(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -4995,7 +5698,7 @@ function validateTranslationReferences(stack) {
             );
             continue;
           }
-          if (!isRec7(rawField)) continue;
+          if (!isRec9(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -5077,7 +5780,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec7(rawApp)) continue;
+        if (!isRec9(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
@@ -5100,7 +5803,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec7(rawDash)) continue;
+        if (!isRec9(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
@@ -5125,7 +5828,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec7(v) ? v : {};
+  return isRec9(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -5137,7 +5840,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName10(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName12(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -5156,11 +5859,11 @@ function checkOptionKeys(findings, ctx) {
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec7(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec9(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
-  for (const param of asArray29(ctx.action.params)) {
-    const name = strName10(param.name) ?? strName10(param.field);
+  for (const param of asArray31(ctx.action.params)) {
+    const name = strName12(param.name) ?? strName12(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -5178,14 +5881,14 @@ function checkActionParams(findings, ctx) {
 
 // src/validate-ai-surface-affinity.ts
 var AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
-function asArray30(v) {
+function asArray32(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName11(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -5195,18 +5898,18 @@ function validateAiSurfaceAffinity(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
-  for (const skill of asArray30(stack.skills)) {
-    const n = strName11(skill.name);
+  for (const skill of asArray32(stack.skills)) {
+    const n = strName13(skill.name);
     if (n) skillsByName.set(n, skill);
   }
-  const agents = asArray30(stack.agents);
+  const agents = asArray32(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName11(agent.name) ?? `#${ai}`;
+    const agentName = strName13(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName11(skillRefs[si]);
+      const ref = strName13(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -5228,14 +5931,14 @@ function validateAiSurfaceAffinity(stack) {
 // src/validate-ai-tool-references.ts
 var import_system5 = require("@objectstack/spec/system");
 var AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
-function asArray31(v) {
+function asArray33(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName12(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance6(a, b) {
@@ -5276,26 +5979,26 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName12(aiRec.description)) return false;
-  const type = strName12(action.type);
+  if (!strName14(aiRec.description)) return false;
+  const type = strName14(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
 }
 function collectToolUniverse(stack) {
   const universe = new Set(import_system5.PLATFORM_PROVIDED_TOOL_NAMES);
-  for (const tool of asArray31(stack.tools)) {
-    const n = strName12(tool.name);
+  for (const tool of asArray33(stack.tools)) {
+    const n = strName14(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
-    for (const action of asArray31(actions)) {
-      const n = strName12(action.name);
+    for (const action of asArray33(actions)) {
+      const n = strName14(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
   addActionFamily(stack.actions);
-  for (const obj of asArray31(stack.objects)) {
+  for (const obj of asArray33(stack.objects)) {
     addActionFamily(obj.actions);
   }
   return universe;
@@ -5303,13 +6006,13 @@ function collectToolUniverse(stack) {
 function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
-    for (const action of asArray31(actions)) {
-      const n = strName12(action.name);
+    for (const action of asArray33(actions)) {
+      const n = strName14(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
   scan(stack.actions);
-  for (const obj of asArray31(stack.objects)) scan(obj.actions);
+  for (const obj of asArray33(stack.objects)) scan(obj.actions);
   return names;
 }
 function validateAiToolReferences(stack) {
@@ -5327,13 +6030,13 @@ function validateAiToolReferences(stack) {
     }
     return universe.has(ref);
   };
-  const skills = asArray31(stack.skills);
+  const skills = asArray33(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName12(skill.name) ?? `#${si}`;
+    const skillName = strName14(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName12(refs[ti]);
+      const ref = strName14(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -5352,24 +6055,24 @@ function validateAiToolReferences(stack) {
 
 // src/validate-ai-agent-authoring.ts
 var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
-function asArray32(v) {
+function asArray34(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName13(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
 function validateAiAgentAuthoring(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const agents = asArray32(stack.agents);
+  const agents = asArray34(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName13(agent.name) ?? `#${ai}`;
+    const name = strName15(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -5474,24 +6177,24 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray33(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec8(x));
-  if (isRec8(v)) {
+var isRec10 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray35(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec10(x));
+  if (isRec10(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec8(def) ? def : {}
+      ...isRec10(def) ? def : {}
     }));
   }
   return [];
 }
 function indexObjectFields2(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const obj of asArray33(stack.objects)) {
+  for (const obj of asArray35(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const names = /* @__PURE__ */ new Set();
-    for (const f of asArray33(obj.fields)) {
+    for (const f of asArray35(obj.fields)) {
       if (typeof f.name === "string" && f.name) names.add(f.name);
     }
     out.set(name, names);
@@ -5621,12 +6324,12 @@ ${source}
 }
 function validateHookBodyWrites(stack) {
   const findings = [];
-  const hooks = asArray33(stack.hooks);
+  const hooks = asArray35(stack.hooks);
   if (hooks.length === 0) return findings;
   let objectFields = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec8(body) || body.language !== "js") return;
+    if (!isRec10(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
@@ -5707,13 +6410,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec9 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray34(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec9(x));
-  if (isRec9(v)) {
+var isRec11 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray36(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec11(x));
+  if (isRec11(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec9(def) ? def : {}
+      ...isRec11(def) ? def : {}
     }));
   }
   return [];
@@ -5727,9 +6430,11 @@ function collectActionBodies(stack) {
   const sites = [];
   const seen = /* @__PURE__ */ new Set();
   const collect = (actions, pathPrefix, parentObject) => {
-    asArray34(actions).forEach((action, index) => {
+    asArray36(actions).forEach((action, index) => {
+      const type = typeof action.type === "string" ? action.type : "script";
+      if (type !== "script") return;
       const body = action.body;
-      if (!isRec9(body) || body.language !== "js") return;
+      if (!isRec11(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -5740,7 +6445,7 @@ function collectActionBodies(stack) {
     });
   };
   collect(stack.actions, "actions");
-  asArray34(stack.objects).forEach((obj, objIndex) => {
+  asArray36(stack.objects).forEach((obj, objIndex) => {
     const parentObject = typeof obj.name === "string" && obj.name ? obj.name : void 0;
     collect(obj.actions, `objects[${objIndex}].actions`, parentObject);
   });
@@ -5748,7 +6453,7 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec9(stack)) return findings;
+  if (!isRec11(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
@@ -5807,13 +6512,13 @@ var import_shared3 = require("@objectstack/spec/shared");
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
 var FLOW_WRITE_NODE_TYPES_DEFERRED = [];
-var isRec10 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray35(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec10(x));
-  if (isRec10(v)) {
+var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray37(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec12(x));
+  if (isRec12(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec10(def) ? def : {}
+      ...isRec12(def) ? def : {}
     }));
   }
   return [];
@@ -5826,8 +6531,8 @@ function readLiteralObjectName2(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec10(stack)) return findings;
-  const flows = asArray35(stack.flows);
+  if (!isRec12(stack)) return findings;
+  const flows = asArray37(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
   flows.forEach((flow, flowIndex) => {
@@ -5835,10 +6540,10 @@ function validateFlowNodeWrites(stack) {
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec10(node.config) ? node.config : void 0;
+      const config = isRec12(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec10(fields)) return;
+      if (!isRec12(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName2(config);
@@ -5877,6 +6582,13 @@ var REFERENCE_INTEGRITY_RULES = [
   { name: "validatePageFieldBindings", run: validatePageFieldBindings },
   { name: "validateChartBindings", run: validateChartBindings },
   { name: "validateNavAccess", run: validateNavAccess },
+  // Nav targets that are NOT object names — page/report/dashboard. Restores the
+  // coverage `defineStack`'s own cross-reference block switches off whenever the
+  // stack declares none of that collection (`pageNames.size > 0 && …`), which is
+  // exactly the state a stack is in when the target was never written.
+  // `action` is deliberately absent (validateActionNameRefs owns it) and so is
+  // `component` (an unregistered ref renders a named diagnostic, not silence).
+  { name: "validateNavTargetRefs", run: validateNavTargetRefs },
   { name: "validateTranslationReferences", run: validateTranslationReferences },
   { name: "validateFlowTemplatePaths", run: validateFlowTemplatePaths },
   { name: "validateAiSurfaceAffinity", run: validateAiSurfaceAffinity },
@@ -5924,12 +6636,20 @@ var REFERENCE_INTEGRITY_RULES = [
   { name: "validateReadonlyFlowWrites", run: validateReadonlyFlowWrites },
   // The `kind:'react'` page surface. Every prop a react block binds BY FIELD
   // NAME is resolved against the object it names (#4340) — `<ListView columns>`,
-  // `<ObjectForm fields>`, the `record:*` family through the SAME
+  // `<ObjectForm fields>`, `<Block type="element:…">` through the SAME
   // `COMPONENT_FIELD_SPECS` table `validatePageFieldBindings` walks one surface
   // over, plus `<ObjectChart>`'s aggregate/axes (#3701/#3729) and
   // `searchableFields` (#4329). Squarely the charter's question, on the surface
   // where it had no answer at all.
   //
+  // It also carries `react-block-needs-record-context` (#4413) — a BINDING
+  // question rather than a resolution one: the `record:*` family reads its
+  // record from a record page's context, so on THIS surface the binding does
+  // not exist at all and the props the contract published for it were read by
+  // no renderer. This rule used to resolve those props' field names against
+  // the object they named — lint standing guard over a binding that never ran.
+  // It rejects the blocks now, out of the same parse.
+  //
   // It was hand-wired into `os validate` ALONE, so `os lint` and `os compile`
   // accepted a react page whose every field binding was stale — including the
   // gating ones (a missing required binding, a filter position naming no field:
@@ -5953,6 +6673,1488 @@ function validateReferenceIntegrity(stack) {
   }
   return findings;
 }
+
+// src/lint-flow-patterns.ts
+function asArray38(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  return [];
+}
+function conditionSource(raw) {
+  if (typeof raw === "string") return raw;
+  if (raw && typeof raw === "object" && typeof raw.source === "string") return raw.source;
+  return "";
+}
+var TIME_FNS = "daysFromNow|daysAgo|today|now|date|datetime";
+var TIME_FN_RE = new RegExp(`\\b(?:${TIME_FNS})\\s*\\(`);
+var DATE_EQ = new RegExp(
+  `(?:(?:${TIME_FNS})\\s*\\([^)]*\\)\\s*(?:==|!=))|(?:(?:==|!=)\\s*(?:${TIME_FNS})\\s*\\()`
+);
+var FLOW_TIME_RELATIVE_ANTIPATTERN = "flow-time-relative-antipattern";
+var FLOW_DATE_EQUALITY_FILTER = "flow-date-equality-filter";
+var FLOW_PHANTOM_AGGREGATION = "flow-phantom-aggregation";
+var FLOW_DOUBLE_BRACE_INTERP = "flow-double-brace-interpolation";
+var FLOW_BARE_DOLLAR_REF = "flow-bare-dollar-reference";
+var FLOW_APPROVAL_REVISE_DEAD_END = "flow-approval-revise-dead-end";
+var FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE = "flow-approval-revise-unmarked-backedge";
+var FLOW_APPROVAL_REVISE_DISABLED = "flow-approval-revise-disabled";
+var FLOW_RUNAS_UNSCOPED = "flow-runas-unscoped";
+var FLOW_ERROR_LABEL_NOT_FAULT = "flow-error-label-not-fault";
+var FLOW_BRANCH_LABEL_UNMATCHED = "flow-branch-label-unmatched";
+var FLOW_DECISION_UNCONDITIONAL_BRANCH = "flow-decision-unconditional-branch";
+var FLOW_DEFAULT_EDGE_WITH_CONDITION = "flow-default-edge-with-condition";
+var FLOW_MULTIPLE_DEFAULT_EDGES = "flow-multiple-default-edges";
+var FLOW_INERT_NODE_CONDITION = "flow-inert-node-condition";
+var INERT_CONDITION_NODE_TYPES = /* @__PURE__ */ new Set([
+  "decision",
+  "assignment",
+  "loop",
+  "parallel",
+  "try_catch",
+  "create_record",
+  "update_record",
+  "delete_record",
+  "get_record",
+  "http",
+  "notify",
+  "script",
+  "screen",
+  "wait",
+  "subflow",
+  "map",
+  "connector_action",
+  "approval",
+  "end"
+]);
+var DATA_NODE_TYPES = /* @__PURE__ */ new Set(["get_record", "create_record", "update_record", "delete_record"]);
+var ERROR_LABELS = /* @__PURE__ */ new Set(["error", "fault", "failure", "failed", "catch", "on_error", "onerror", "on error"]);
+var BRANCH_LABEL_NODE_TYPES = /* @__PURE__ */ new Set(["decision", "approval", "screen", "try_catch"]);
+function isScheduleTriggered(flow, startCfg) {
+  if (flow.type === "schedule") return true;
+  if (typeof startCfg.triggerType === "string" && startCfg.triggerType === "schedule") return true;
+  return startCfg.schedule != null;
+}
+function userLessTriggerKind(flow, startCfg) {
+  if (isScheduleTriggered(flow, startCfg)) return "schedule";
+  if (startCfg.timeRelative != null) return "time-relative";
+  if (typeof startCfg.triggerType === "string" && startCfg.triggerType === "time_relative") return "time-relative";
+  if (flow.type === "api") return "api";
+  if (typeof startCfg.triggerType === "string" && startCfg.triggerType === "api") return "api";
+  return null;
+}
+var PHANTOM_AGG_KEYS = /* @__PURE__ */ new Set(["aggregations", "aggregate", "groupBy", "rollup", "having"]);
+function celTimeSource(v) {
+  if (v && typeof v === "object" && v.dialect === "cel") {
+    const src = v.source;
+    if (typeof src === "string" && TIME_FN_RE.test(src)) return src;
+  }
+  return null;
+}
+var RANGE_OPS = /* @__PURE__ */ new Set(["$gte", "$gt", "$lte", "$lt", "$ne"]);
+function scanFilterForDateEquality(filter, where, findings) {
+  if (!filter || typeof filter !== "object" || Array.isArray(filter)) return;
+  for (const [key, val] of Object.entries(filter)) {
+    if (key === "$or" || key === "$and") {
+      if (Array.isArray(val)) for (const sub of val) scanFilterForDateEquality(sub, where, findings);
+      continue;
+    }
+    const direct = celTimeSource(val);
+    let hit = direct ? { op: "==", src: direct } : null;
+    if (!hit && val && typeof val === "object" && val.dialect !== "cel") {
+      for (const [op, operand] of Object.entries(val)) {
+        if (RANGE_OPS.has(op)) continue;
+        if (op === "$eq") {
+          const s = celTimeSource(operand);
+          if (s) {
+            hit = { op: "$eq", src: s };
+            break;
+          }
+        } else if (op === "$in" && Array.isArray(operand)) {
+          for (const item of operand) {
+            const s = celTimeSource(item);
+            if (s) {
+              hit = { op: "$in", src: s };
+              break;
+            }
+          }
+          if (hit) break;
+        }
+      }
+    }
+    if (hit) {
+      findings.push({
+        where,
+        message: `filter matches \`${key}\` by ${hit.op} against a time value (\`${hit.src}\`) \u2014 a date field carries a time component, so exact equality against \`${hit.src}\` (re-computed each run) silently matches nothing.`,
+        hint: `Use a one-day window instead: \`${key}: { $gte: daysFromNow(N), $lt: daysFromNow(N+1) }\` (wrap multiple tiers in \`$or\`). The abutting windows tile the timeline so each row matches exactly once. (#1874)`,
+        rule: FLOW_DATE_EQUALITY_FILTER
+      });
+    }
+  }
+}
+var DOUBLE_BRACE = /\{\{\s*[\w$][\w$.\s]*\}\}/;
+var BARE_DOLLAR_REF = /(?:^|[^{])\$[A-Za-z_]\w*\.[A-Za-z_]/;
+var CEL_KEYS = /* @__PURE__ */ new Set(["condition", "expression", "conditions"]);
+function collectTemplateStrings(value, key, out) {
+  if (key && CEL_KEYS.has(key)) return;
+  if (typeof value === "string") {
+    out.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) collectTemplateStrings(v, key, out);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const [k, v] of Object.entries(value)) collectTemplateStrings(v, k, out);
+  }
+}
+function edgeLabelOf(e) {
+  return typeof e.label === "string" ? e.label.trim().toLowerCase() : "";
+}
+function scanErrorLabelledEdges(flowName, nodes, edges, findings) {
+  const typeById = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    if (typeof n.id === "string") typeById.set(n.id, typeof n.type === "string" ? n.type : "");
+  }
+  for (const e of edges) {
+    const label2 = typeof e.label === "string" ? e.label.trim().toLowerCase() : "";
+    if (!ERROR_LABELS.has(label2)) continue;
+    if (e.type === "fault") continue;
+    if (e.condition) continue;
+    const src = typeof e.source === "string" ? e.source : "";
+    if (BRANCH_LABEL_NODE_TYPES.has(typeById.get(src) ?? "")) continue;
+    findings.push({
+      where: `flow '${flowName}' \xB7 edge '${src}' \u2192 '${String(e.target)}'`,
+      message: `edge is labelled '${String(e.label)}' but its type is '${String(e.type ?? "default")}', not 'fault' \u2014 so it is an ORDINARY out-edge. Unconditional out-edges all run in parallel, so '${String(e.target)}' executes on every SUCCESSFUL run of '${src}' and never on a failure. The error path the label describes does not exist, and the run still aborts when '${src}' fails.`,
+      hint: `Add \`type: 'fault'\` to this edge. Only runtime failures route \u2014 a guard refusal (a filter token that resolved to nothing, a missing required config key, an unscoped run) stays fatal by design and must be fixed in the metadata, not handled. (#3863)`,
+      rule: FLOW_ERROR_LABEL_NOT_FAULT
+    });
+  }
+}
+function scanBranchRouting(flowName, nodes, edges, findings) {
+  const outEdgesBySource = /* @__PURE__ */ new Map();
+  for (const e of edges) {
+    if (e.type === "fault") continue;
+    const src = typeof e.source === "string" ? e.source : "";
+    if (!src) continue;
+    if (!outEdgesBySource.has(src)) outEdgesBySource.set(src, []);
+    outEdgesBySource.get(src).push(e);
+  }
+  for (const [src, outs] of outEdgesBySource) {
+    for (const e of outs) {
+      if (e.isDefault === true && e.condition) {
+        findings.push({
+          where: `flow '${flowName}' \xB7 edge '${src}' \u2192 '${String(e.target)}'`,
+          message: `edge sets \`isDefault: true\` AND a \`condition\` \u2014 contradictory. \`isDefault\` means "take this edge when NO sibling condition matched"; a condition makes it an ordinary guarded branch. The condition wins and the default marker routes nothing.`,
+          hint: `Drop one: keep \`condition\` for a guarded branch, or drop it and keep \`isDefault: true\` for the "otherwise" path. (#4414)`,
+          rule: FLOW_DEFAULT_EDGE_WITH_CONDITION,
+          // Gating: the two keys contradict, the condition always wins, and the
+          // marker never routes. No reading makes it do what it says.
+          severity: "error"
+        });
+      }
+    }
+    const defaults = outs.filter((e) => e.isDefault === true && !e.condition);
+    if (defaults.length > 1) {
+      findings.push({
+        where: `flow '${flowName}' \xB7 node '${src}'`,
+        message: `${defaults.length} out-edges are marked \`isDefault: true\` (${defaults.map((e) => `'${String(e.target)}'`).join(", ")}) \u2014 a node has at most ONE default path. All of them are traversed together when no condition matches, which is a parallel fan-out, not an "otherwise".`,
+        hint: `Keep \`isDefault: true\` on the single fallback edge and give the others a \`condition\` (or leave them unconditional if the fan-out really is intended). (#4414)`,
+        rule: FLOW_MULTIPLE_DEFAULT_EDGES
+      });
+    }
+  }
+  for (const node of nodes) {
+    const nodeType = typeof node.type === "string" ? node.type : "";
+    if (!INERT_CONDITION_NODE_TYPES.has(nodeType)) continue;
+    const cfg = node.config ?? {};
+    if (cfg.condition == null || conditionSource(cfg.condition).trim() === "") continue;
+    findings.push({
+      where: `flow '${flowName}' \xB7 node '${String(node.id)}' (${nodeType})`,
+      message: `\`config.condition\` is set but nothing reads it \u2014 the key is the trigger gate on a \`start\` node and is ignored on every other node type, so this predicate never gates anything. (It is still parse-validated at registration, which is why a malformed one is caught and an inert one is not.)`,
+      hint: nodeType === "decision" ? `Branching lives on the OUT-EDGES: give each branch its own \`condition\` and mark the fallback \`isDefault: true\`. If the edges already carry the predicate, delete this copy. (#4414)` : `Delete it, or move the predicate to the incoming edge's \`condition\` if this step was meant to be conditional. (#4414)`,
+      rule: FLOW_INERT_NODE_CONDITION
+    });
+  }
+  for (const node of nodes) {
+    if (node.type !== "decision") continue;
+    const nid = typeof node.id === "string" ? node.id : "";
+    if (!nid) continue;
+    const outs = outEdgesBySource.get(nid) ?? [];
+    if (outs.length === 0) continue;
+    const cfg = node.config ?? {};
+    const declaredLabels = new Set(
+      (Array.isArray(cfg.conditions) ? cfg.conditions : []).map((c) => typeof c?.label === "string" ? c.label.trim().toLowerCase() : "").filter(Boolean)
+    );
+    const edgeLabels = new Set(outs.map(edgeLabelOf).filter(Boolean));
+    const unclaimed = [...declaredLabels].filter((l) => !edgeLabels.has(l));
+    if (unclaimed.length > 0) {
+      findings.push({
+        where: `flow '${flowName}' \xB7 decision '${nid}'`,
+        message: `declares branch label(s) ${unclaimed.map((l) => `'${l}'`).join(", ")} that no out-edge carries \u2014 out-edge labels are [${[...edgeLabels].map((l) => `'${l}'`).join(", ") || "none"}]. Traversal cannot honour a label nothing claims, so it falls back to considering EVERY out-edge and the branch the decision computed is ignored.`,
+        hint: `Make an out-edge's \`label\` match the declared branch exactly, or drop \`config.conditions\` and branch on the edges instead (\`condition\` per branch + \`isDefault: true\` on the fallback) \u2014 one mechanism per decision, never both. (#4414)`,
+        rule: FLOW_BRANCH_LABEL_UNMATCHED,
+        // Gating: a label nothing claims cannot route under ANY reading, on
+        // every run. See the severity policy at the top of this file.
+        severity: "error"
+      });
+    }
+    const gated = outs.filter((e) => e.condition || e.isDefault === true);
+    if (gated.length === 0) continue;
+    const ungated = outs.filter(
+      (e) => !e.condition && e.isDefault !== true && !declaredLabels.has(edgeLabelOf(e))
+    );
+    if (ungated.length > 0) {
+      findings.push({
+        where: `flow '${flowName}' \xB7 decision '${nid}'`,
+        message: `has guarded out-edge(s) alongside unconditional one(s) (${ungated.map((e) => `'${String(e.target)}'`).join(", ")}) \u2014 an unconditional out-edge is traversed on EVERY pass, in parallel with whichever guarded branch matched, so the decision does not actually exclude it. A \`label\` alone does not select a path unless the decision declares a matching \`conditions[].label\`.`,
+        hint: `Mark the fallback \`isDefault: true\` so it is taken only when no sibling condition matched (BPMN default flow), or give it its own \`condition\`. (#4414)`,
+        rule: FLOW_DECISION_UNCONDITIONAL_BRANCH
+      });
+    }
+  }
+}
+function scanApprovalReviseLoops(flowName, nodes, edges, findings) {
+  const approvals = nodes.filter((n) => n.type === "approval");
+  if (approvals.length === 0) return;
+  const nodeIds = new Set(nodes.map((n) => typeof n.id === "string" ? n.id : "").filter(Boolean));
+  const outEdges = /* @__PURE__ */ new Map();
+  for (const e of edges) {
+    const src = typeof e.source === "string" ? e.source : "";
+    if (!src) continue;
+    if (!outEdges.has(src)) outEdges.set(src, []);
+    outEdges.get(src).push(e);
+  }
+  for (const a of approvals) {
+    const aid = typeof a.id === "string" ? a.id : "";
+    if (!aid) continue;
+    const reviseTargets = edges.filter((e) => e.source === aid && edgeLabelOf(e) === "revise").map((e) => typeof e.target === "string" ? e.target : "").filter((t) => t && nodeIds.has(t));
+    if (reviseTargets.length === 0) continue;
+    const where = `flow '${flowName}' \xB7 approval '${aid}'`;
+    const cfg = a.config ?? {};
+    if (cfg.maxRevisions === 0) {
+      findings.push({
+        where,
+        message: `declares a 'revise' out-edge but \`maxRevisions: 0\` disables send-back \u2014 every revise auto-rejects, so the revise branch never runs.`,
+        hint: `Set \`maxRevisions\` >= 1 to allow N send-backs before auto-reject, or drop the 'revise' edge if send-back isn't intended (ADR-0044).`,
+        rule: FLOW_APPROVAL_REVISE_DISABLED
+      });
+    }
+    const seen = new Set(reviseTargets);
+    const queue = [...reviseTargets];
+    const returnEdges = [];
+    while (queue.length) {
+      const cur = queue.shift();
+      for (const e of outEdges.get(cur) ?? []) {
+        if (e.target === aid) returnEdges.push(e);
+        const t = typeof e.target === "string" ? e.target : "";
+        if (t && nodeIds.has(t) && !seen.has(t)) {
+          seen.add(t);
+          queue.push(t);
+        }
+      }
+    }
+    if (returnEdges.length === 0) {
+      findings.push({
+        where,
+        message: `has a 'revise' out-edge but no path loops back to it \u2014 the submitter reworks the record with nowhere to resubmit, so the revise branch dead-ends. (registerFlow accepts this \u2014 it's a valid DAG.)`,
+        hint: `Close the loop: the 'revise' edge should reach a wait node whose resubmit edge returns to '${aid}' marked \`type: 'back'\` (ADR-0044). See examples/app-showcase showcase_budget_approval.`,
+        rule: FLOW_APPROVAL_REVISE_DEAD_END
+      });
+    } else if (!returnEdges.some((e) => e.type === "back")) {
+      findings.push({
+        where,
+        message: `has a 'revise' loop that returns to it, but the closing edge isn't declared \`type: 'back'\` \u2014 registerFlow rejects this as an un-declared cycle.`,
+        hint: `Mark the resubmit edge (whose target is '${aid}') \`type: 'back'\` so cycle validation skips it while it still traverses at runtime; \`maxRevisions\` guards the loop (ADR-0044).`,
+        rule: FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE
+      });
+    }
+  }
+}
+function lintFlowPatterns(stack) {
+  const findings = [];
+  for (const flow of asArray38(stack.flows)) {
+    const flowName = typeof flow.name === "string" ? flow.name : "(unnamed flow)";
+    const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+    const edges = Array.isArray(flow.edges) ? flow.edges : [];
+    const start = nodes.find((n) => n.type === "start");
+    const startCfg = start?.config ?? {};
+    const triggerType = typeof startCfg.triggerType === "string" ? startCfg.triggerType : "";
+    if (triggerType.startsWith("record-")) {
+      const src = conditionSource(startCfg.condition).trim();
+      if (src && DATE_EQ.test(src)) {
+        findings.push({
+          where: `flow '${flowName}' \xB7 start condition`,
+          message: `record-change trigger uses a date-EQUALITY time condition (\`${src}\`) \u2014 it only fires if the record happens to be written on that exact day, so unattended "N days before" rules never run.`,
+          hint: `Use a SCHEDULE trigger (daily cron) + a range query instead \u2014 e.g. a scheduled flow whose get_record filters \`end_date\` BETWEEN {TODAY()} and {TODAY()+N}. (#1874)`,
+          rule: FLOW_TIME_RELATIVE_ANTIPATTERN
+        });
+      }
+    }
+    const runAs = typeof flow.runAs === "string" ? flow.runAs : "user";
+    const userLessKind = userLessTriggerKind(flow, startCfg);
+    if (userLessKind && runAs !== "system") {
+      const dataNode = nodes.find((n) => DATA_NODE_TYPES.has(typeof n.type === "string" ? n.type : ""));
+      if (dataNode) {
+        const declared = typeof flow.runAs === "string" ? `\`runAs:'${runAs}'\`` : `the default \`runAs:'user'\``;
+        findings.push({
+          where: `flow '${flowName}' \xB7 runAs`,
+          message: `${userLessKind}-triggered flow runs as ${declared}, but a ${userLessKind} run has no trigger user \u2014 so its data node '${dataNode.id}' (${dataNode.type}) has no identity to scope to and will be REFUSED at run time.`,
+          hint: `Declare \`runAs:'system'\` to make the elevation explicit and intended (the run reads/writes every record). A ${userLessKind} flow cannot scope to a user \u2014 there is none. (ADR-0049, ADR-0073 D5, #1888, #3760)`,
+          rule: FLOW_RUNAS_UNSCOPED,
+          severity: "error"
+        });
+      }
+    }
+    for (const node of nodes) {
+      const nodeWhere = `flow '${flowName}' \xB7 node '${node.id}' (${node.type})`;
+      const cfg = node.config ?? {};
+      if (cfg.filter) scanFilterForDateEquality(cfg.filter, `${nodeWhere} filter`, findings);
+      for (const key of Object.keys(cfg)) {
+        if (PHANTOM_AGG_KEYS.has(key)) {
+          findings.push({
+            where: nodeWhere,
+            message: `node config has \`${key}\` \u2014 the automation engine has no aggregate node, so \`${key}\` is silently ignored and this node computes nothing at runtime.`,
+            hint: `Aggregation belongs in the data layer: use \`Field.summary\` for a cross-object rollup (sum/count of children), or \`Field.formula\` for a per-record computed value. (#1870)`,
+            rule: FLOW_PHANTOM_AGGREGATION
+          });
+        }
+      }
+      const strings = [];
+      collectTemplateStrings(node.config, void 0, strings);
+      for (const str2 of strings) {
+        if (DOUBLE_BRACE.test(str2)) {
+          findings.push({
+            where: nodeWhere,
+            message: `double-brace interpolation \`${str2.trim().slice(0, 80)}\` \u2014 flow node values use SINGLE braces.`,
+            hint: `Use \`{var}\` (e.g. \`{record.title}\`). Double-brace \`{{ }}\` is the formula/template-field dialect, not flow node values. (#1315)`,
+            rule: FLOW_DOUBLE_BRACE_INTERP
+          });
+        }
+        if (BARE_DOLLAR_REF.test(str2)) {
+          findings.push({
+            where: nodeWhere,
+            message: `\`${str2.trim().slice(0, 80)}\` looks like a reference written as a literal \u2014 a bare \`$ref.field\` is NOT interpolated.`,
+            hint: `Wrap it and bind a variable: \`{source.id}\` (or \`{$User.Id}\` for the current user). (#1315)`,
+            rule: FLOW_BARE_DOLLAR_REF
+          });
+        }
+      }
+    }
+    scanApprovalReviseLoops(flowName, nodes, edges, findings);
+    scanErrorLabelledEdges(flowName, nodes, edges, findings);
+    scanBranchRouting(flowName, nodes, edges, findings);
+  }
+  return findings;
+}
+
+// src/lint-liveness-properties.ts
+var import_node_module4 = require("module");
+var import_node_path = require("path");
+var import_node_fs = require("fs");
+var import_meta4 = {};
+var LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
+var LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
+function asArray39(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  return [];
+}
+function resolveLivenessDir() {
+  try {
+    const require2 = (0, import_node_module4.createRequire)(import_meta4.url);
+    const pkgJson = require2.resolve("@objectstack/spec/package.json");
+    const dir = (0, import_node_path.join)((0, import_node_path.dirname)(pkgJson), "liveness");
+    return (0, import_node_fs.existsSync)(dir) ? dir : null;
+  } catch {
+    return null;
+  }
+}
+function loadWarnMap(dir, type) {
+  const map = /* @__PURE__ */ new Map();
+  const file = (0, import_node_path.join)(dir, `${type}.json`);
+  if (!(0, import_node_fs.existsSync)(file)) return map;
+  let ledger;
+  try {
+    ledger = JSON.parse((0, import_node_fs.readFileSync)(file, "utf8"));
+  } catch {
+    return map;
+  }
+  const props = ledger.props || {};
+  for (const [key, entry] of Object.entries(props)) {
+    if (entry?.children) {
+      for (const [ck, centry] of Object.entries(entry.children)) {
+        if (shouldWarn(centry)) map.set(`${key}.${ck}`, centry);
+      }
+    }
+    if (shouldWarn(entry)) map.set(key, entry);
+  }
+  return map;
+}
+function shouldWarn(entry) {
+  if (!entry) return false;
+  return entry.authorWarn === true || entry.status === "experimental";
+}
+function isAuthored(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "boolean") return value === true;
+  return true;
+}
+function describe(entry) {
+  if (entry.status === "experimental") {
+    return { kind: "is experimental \u2014 declared but NOT enforced at runtime", rule: LIVENESS_EXPERIMENTAL_PROPERTY };
+  }
+  return { kind: "has no runtime effect (liveness: dead)", rule: LIVENESS_DEAD_PROPERTY };
+}
+function checkItem(type, item, whereBase, warnMap, findings) {
+  for (const [path, entry] of warnMap) {
+    const values = path.includes(".") ? getNested(item, path) : [item[path]];
+    for (const value of values instanceof Array ? values : [values]) {
+      if (!isAuthored(value)) continue;
+      const { kind, rule } = describe(entry);
+      const hint = entry.authorHint ?? entry.note ?? "Remove it \u2014 it is declared in the spec but not consumed at runtime.";
+      findings.push({
+        where: whereBase,
+        message: `sets \`${path}\` but this ${type} property ${kind}.`,
+        hint,
+        rule
+      });
+      break;
+    }
+  }
+}
+function getNested(obj, path) {
+  let cur = [obj];
+  for (const seg of path.split(".")) {
+    const next = [];
+    for (const c of cur) {
+      if (c === null || typeof c !== "object") continue;
+      const v = Array.isArray(c) ? void 0 : c[seg];
+      if (Array.isArray(c)) {
+        for (const el of c) {
+          if (el && typeof el === "object") next.push(el[seg]);
+        }
+      } else {
+        next.push(v);
+      }
+    }
+    cur = next;
+  }
+  return cur.flatMap((v) => Array.isArray(v) ? v : [v]);
+}
+var TYPE_COLLECTIONS = [
+  { type: "flow", key: "flows" },
+  { type: "action", key: "actions" },
+  { type: "agent", key: "agents" },
+  { type: "tool", key: "tools" },
+  { type: "skill", key: "skills" },
+  { type: "dataset", key: "datasets" },
+  { type: "permission", key: "permissions" },
+  { type: "hook", key: "hooks" },
+  { type: "page", key: "pages" },
+  { type: "view", key: "views" },
+  { type: "webhook", key: "webhooks" },
+  // #4487. Note what adding a TYPE costs versus adding a warned property: the
+  // doc below is right that coverage grows by marking entries `authorWarn` —
+  // but only WITHIN a type already listed here. A newly governed type needs its
+  // collection registered or its ledger warns nobody, which would leave the
+  // ledger correct and silent: the exact shape this lint exists to prevent.
+  { type: "datasource", key: "datasources" },
+  // #4488 — the six newly governed types that carry `authorWarn` entries.
+  // (doc / seed / validation are governed too but warn on nothing today, so
+  // they are not listed; add them here the day one of their entries warns.)
+  { type: "app", key: "apps" },
+  { type: "book", key: "books" },
+  { type: "job", key: "jobs" },
+  { type: "email_template", key: "emailTemplates" },
+  { type: "mapping", key: "mappings" },
+  { type: "translation", key: "translations" }
+];
+function lintLivenessProperties(stack) {
+  const dir = resolveLivenessDir();
+  if (!dir) return [];
+  const findings = [];
+  const objectWarn = loadWarnMap(dir, "object");
+  const fieldWarn = loadWarnMap(dir, "field");
+  for (const obj of asArray39(stack.objects)) {
+    const objName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
+    if (objectWarn.size > 0) checkItem("object", obj, `object '${objName}'`, objectWarn, findings);
+    if (fieldWarn.size > 0) {
+      for (const field of asArray39(obj.fields)) {
+        const fieldName = typeof field.name === "string" ? field.name : "(unnamed field)";
+        checkItem("field", field, `object '${objName}' \xB7 field '${fieldName}'`, fieldWarn, findings);
+      }
+    }
+  }
+  for (const { type, key } of TYPE_COLLECTIONS) {
+    const warnMap = loadWarnMap(dir, type);
+    if (warnMap.size === 0) continue;
+    for (const item of asArray39(stack[key])) {
+      const name = typeof item.name === "string" ? item.name : typeof item.object === "string" ? item.object : `(unnamed ${type})`;
+      checkItem(type, item, `${type} '${name}'`, warnMap, findings);
+    }
+  }
+  return findings;
+}
+
+// src/lint-autonumber-formats.ts
+var import_data7 = require("@objectstack/spec/data");
+var AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
+var AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
+var AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
+var AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
+function asArray40(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function lintAutonumberFormats(stack) {
+  const findings = [];
+  for (const obj of asArray40(stack.objects)) {
+    const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
+    const fields = asArray40(obj.fields);
+    const fieldMeta = /* @__PURE__ */ new Map();
+    for (const f of fields) {
+      if (typeof f.name === "string") fieldMeta.set(f.name, { required: f.required === true });
+    }
+    for (const f of fields) {
+      if (f.type !== "autonumber") continue;
+      const name = typeof f.name === "string" ? f.name : "(unnamed field)";
+      const fmt = typeof f.autonumberFormat === "string" ? f.autonumberFormat : typeof f.format === "string" ? f.format : "";
+      if (!fmt) continue;
+      const tokens = (0, import_data7.parseAutonumberFormat)(fmt);
+      const refs = (0, import_data7.referencedFields)(tokens);
+      const where = `object '${objectName}' \xB7 field '${name}' (autonumber "${fmt}")`;
+      for (const t of tokens) {
+        if (t.kind !== "literal") continue;
+        const braced = t.text.match(/\{[^{}]*\}/g);
+        if (!braced) continue;
+        for (const tok of braced) {
+          const body = tok.slice(1, -1);
+          const isExtraSeq = /^0+$/.test(body);
+          findings.push({
+            where,
+            message: isExtraSeq ? `format has a second sequence slot \`${tok}\` \u2014 only the first \`{0..0}\` counts; this one renders literally as "${tok}".` : `format has an unrecognized token \`${tok}\` \u2014 it is not a counter/date/{field} token, so it renders literally as "${tok}" in every record number.`,
+            hint: isExtraSeq ? `Use a single \`{0000}\` slot; fold any second number into a literal or a {field} token.` : `Date tokens are case-sensitive and exact: {YYYY} {YY} {MM} {DD} {YYYYMMDD} (no spaces/punctuation inside). For a field value use {field_name}.`,
+            rule: AUTONUMBER_LITERAL_TOKEN,
+            severity: "warning"
+          });
+        }
+      }
+      for (const ref of refs) {
+        if (ref === name) {
+          findings.push({
+            where,
+            message: `format interpolates \`{${ref}}\` \u2014 its own value, which does not exist yet when the number is generated.`,
+            hint: `Reference a DIFFERENT field that is set before create (e.g. \`{plan_no}{000}\`), or drop the token.`,
+            rule: AUTONUMBER_SELF_REFERENCE,
+            severity: "error"
+          });
+          continue;
+        }
+        const meta = fieldMeta.get(ref);
+        if (!meta) {
+          findings.push({
+            where,
+            message: `format interpolates \`{${ref}}\`, but object '${objectName}' has no field named '${ref}' \u2014 generation will always throw.`,
+            hint: `Reference an existing field, or remove the \`{${ref}}\` token from the format.`,
+            rule: AUTONUMBER_UNKNOWN_FIELD,
+            severity: "error"
+          });
+        } else if (!meta.required) {
+          findings.push({
+            where,
+            message: `format interpolates \`{${ref}}\`, but '${ref}' is optional \u2014 any record left blank fails autonumber generation at create time.`,
+            hint: `Mark '${ref}' as \`required: true\` so it is always set before the record number is rendered.`,
+            rule: AUTONUMBER_OPTIONAL_FIELD,
+            severity: "warning"
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+// src/lint-view-refs.ts
+var import_spec2 = require("@objectstack/spec");
+function asArray41(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  return [];
+}
+var VIEW_KEY_COLLISION = "view-key-collision";
+var VIEW_REF_FORM_TARGET_MISSING = "view-ref-form-target-missing";
+var VIEW_REF_FORM_TARGET_KIND = "view-ref-form-target-kind";
+function containerFromObject(obj) {
+  return { list: obj.list, form: obj.form, listViews: obj.listViews, formViews: obj.formViews };
+}
+function viewContainerObjectName(item) {
+  if (typeof item.name === "string" && item.name) return item.name;
+  if (typeof item.id === "string" && item.id) return item.id;
+  if (typeof item.object === "string" && item.object) return item.object;
+  if (typeof item.list?.data?.object === "string") return item.list.data.object;
+  if (typeof item.form?.data?.object === "string") return item.form.data.object;
+  return void 0;
+}
+function lintViewRefs(stack) {
+  const findings = [];
+  const viewKinds = /* @__PURE__ */ new Map();
+  const indexKind = (name, kind) => {
+    let s = viewKinds.get(name);
+    if (!s) viewKinds.set(name, s = /* @__PURE__ */ new Set());
+    s.add(kind);
+  };
+  const containers = [];
+  for (const v of asArray41(stack.views)) {
+    if (v.viewKind) {
+      if (typeof v.name === "string") indexKind(v.name, v.viewKind === "form" ? "form" : "list");
+      continue;
+    }
+    if (!(0, import_spec2.isAggregatedViewContainer)(v)) continue;
+    const object = viewContainerObjectName(v);
+    if (object) containers.push({ object, container: v });
+  }
+  for (const obj of asArray41(stack.objects)) {
+    const object = typeof obj.name === "string" ? obj.name : void 0;
+    if (!object) continue;
+    if (obj.list || obj.form || obj.listViews || obj.formViews) {
+      containers.push({ object, container: containerFromObject(obj) });
+    }
+  }
+  for (const { object, container } of containers) {
+    const { items, collisions } = (0, import_spec2.expandViewContainerWithDiagnostics)(object, container);
+    for (const it of items) indexKind(it.name, it.viewKind);
+    for (const col of collisions) {
+      findings.push({
+        where: `object '${object}' \xB7 view key '${col.key}'`,
+        message: `View key collision: the ${col.viewKind} view '${col.requested}' clashes with another view in the same container and was renamed to '${col.renamedTo}'. Anything referencing '${col.requested}' (a form action target, a navigation viewName) resolves to the OTHER view, not this one.`,
+        hint: `Give the ${col.viewKind} view a unique key \u2014 the default list implicitly claims '<object>.default'. Renaming key '${col.key}' fixes both this collision and any reference that targets it.`,
+        rule: VIEW_KEY_COLLISION,
+        severity: "warning"
+      });
+    }
+  }
+  const seenFormTargets = /* @__PURE__ */ new Set();
+  const checkAction = (action, ownerObject) => {
+    if (!action || action.type !== "form") return;
+    const target = action.target;
+    if (typeof target !== "string" || !target) return;
+    if (target.includes("${")) return;
+    if (!target.includes(".")) return;
+    const actionName = typeof action.name === "string" ? action.name : "(unnamed)";
+    const dedupeKey = `${actionName}\0${target}`;
+    if (seenFormTargets.has(dedupeKey)) return;
+    seenFormTargets.add(dedupeKey);
+    const where = ownerObject ? `action '${actionName}' on object '${ownerObject}'` : `action '${actionName}'`;
+    const kinds = viewKinds.get(target);
+    if (!kinds) {
+      findings.push({
+        where,
+        message: `Form action target '${target}' does not resolve to any view. A type:'form' action must point at an existing form view; at runtime this opens a blank/broken form.`,
+        hint: `Check for a typo, or a form view renamed by a key collision. Expected a form view named '<object>.<formViewKey>'.`,
+        rule: VIEW_REF_FORM_TARGET_MISSING,
+        severity: "warning"
+      });
+      return;
+    }
+    if (!kinds.has("form")) {
+      const actual = [...kinds].join("/");
+      findings.push({
+        where,
+        message: `Form action target '${target}' resolves to a ${actual} view, not a form view. Opening a ${actual} view through a form action renders an empty form (and a submit can silently no-op) at runtime.`,
+        hint: `Point target at a form view (viewKind 'form'). If the form view was renamed by a key collision, fix the colliding key so '${target}' names the form again.`,
+        rule: VIEW_REF_FORM_TARGET_KIND,
+        severity: "error"
+      });
+    }
+  };
+  for (const obj of asArray41(stack.objects)) {
+    const object = typeof obj.name === "string" ? obj.name : void 0;
+    for (const action of asArray41(obj.actions)) checkAction(action, object);
+  }
+  for (const action of asArray41(stack.actions)) checkAction(action);
+  return findings;
+}
+
+// src/data-model-rules.ts
+var RELATIONSHIP_TYPES = /* @__PURE__ */ new Set(["lookup", "master_detail"]);
+var NUMERIC_TYPES = /* @__PURE__ */ new Set([
+  "number",
+  "currency",
+  "integer",
+  "decimal",
+  "percent",
+  "float",
+  "double"
+]);
+var OPTION_FIELD_TYPES = /* @__PURE__ */ new Set(["select", "multiselect", "radio", "enum"]);
+var NAME_LIKE_FIELDS = ["name", "title", "subject", "label", "full_name", "display_name", "code"];
+var LINE_ITEM_RE = /_(line|lines|line_item|line_items|item|items|detail|details|entry|entries)$/;
+var ASSOCIATION_TOKENS = [
+  "comment",
+  "attachment",
+  "note",
+  "log",
+  "audit",
+  "activity",
+  "activities",
+  "history",
+  "event",
+  "reaction",
+  "like",
+  "mention",
+  "notification",
+  "message"
+];
+function isLineItemName(name) {
+  return LINE_ITEM_RE.test(name);
+}
+function isAssociationName(name) {
+  const lc = name.toLowerCase();
+  return ASSOCIATION_TOKENS.some((t) => lc === t || lc.endsWith(`_${t}`) || lc.endsWith(`_${t}s`));
+}
+function fieldEntries2(fields) {
+  if (!fields) return [];
+  if (Array.isArray(fields)) {
+    return fields.filter((f) => f && f.name != null).map((f) => ({ name: String(f.name), def: f }));
+  }
+  return Object.entries(fields).map(([name, def]) => ({ name, def }));
+}
+function refOf2(def) {
+  return def?.reference || def?.reference_to;
+}
+var UNIQUE_DOUBLE_DECLARATION = "unique/double-declaration";
+function uniqueDeclared(u) {
+  return u === true || u === "global";
+}
+function lintUniqueDeclarations(objects) {
+  const issues = [];
+  if (!Array.isArray(objects) || objects.length === 0) return issues;
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj?.name) continue;
+    const declaredIndexes = Array.isArray(obj.indexes) ? obj.indexes : [];
+    if (declaredIndexes.length === 0) continue;
+    const singleColumnUniqueIndexes = /* @__PURE__ */ new Map();
+    for (const idx of declaredIndexes) {
+      if (!uniqueDeclared(idx?.unique)) continue;
+      const cols = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string") : [];
+      if (cols.length !== 1) continue;
+      if (!singleColumnUniqueIndexes.has(cols[0])) singleColumnUniqueIndexes.set(cols[0], idx);
+    }
+    if (singleColumnUniqueIndexes.size === 0) continue;
+    for (const { name, def } of fieldEntries2(obj.fields)) {
+      if (!uniqueDeclared(def?.unique)) continue;
+      if (def.unique === "global") continue;
+      const idx = singleColumnUniqueIndexes.get(name);
+      if (!idx) continue;
+      const indexLabel = typeof idx?.name === "string" && idx.name.trim() ? ` '${idx.name.trim()}'` : "";
+      issues.push({
+        severity: "warning",
+        rule: UNIQUE_DOUBLE_DECLARATION,
+        message: `"${obj.name}.${name}" declares field-level \`unique: true\` AND a single-column unique index${indexLabel} on the same column. Since #3696 the field-level form is scoped per tenant \u2014 \`(tenant, ${name})\` \u2014 while a declared index is materialized over exactly its \`fields\`, i.e. platform-wide. On a tenant-scoped object the global index wins and the per-tenant constraint can never be reached; on a tenancy-less object the two are the same index declared twice. Either way one of the two declarations has no effect.`,
+        path: `objects[${i}]`,
+        fix: `Pick the intent: for platform-wide uniqueness set \`unique: 'global'\` on '${name}' and drop the duplicate index; for per-tenant uniqueness drop the index (the field-level declaration already builds the tenant composite), or spell the index out as \`fields: ['organization_id', '${name}']\` if you want it explicit.`
+      });
+    }
+  }
+  return issues;
+}
+function lintDataModel(objects) {
+  const issues = lintUniqueDeclarations(objects);
+  if (!Array.isArray(objects) || objects.length === 0) return issues;
+  const childrenByParent = {};
+  for (const child of objects) {
+    if (!child?.name) continue;
+    for (const { name: fieldName, def } of fieldEntries2(child.fields)) {
+      if (!RELATIONSHIP_TYPES.has(def?.type)) continue;
+      const parent = refOf2(def);
+      if (!parent) continue;
+      (childrenByParent[parent] || (childrenByParent[parent] = [])).push({ child, fieldName, def });
+    }
+  }
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj?.name) continue;
+    const objPath = `objects[${i}]`;
+    const fields = fieldEntries2(obj.fields);
+    const hasNameField = !!obj.primaryField || !!obj.titleFormat || fields.some((f) => NAME_LIKE_FIELDS.includes(f.name));
+    if (fields.length > 0 && !hasNameField) {
+      issues.push({
+        severity: "suggestion",
+        rule: "object/missing-name-field",
+        message: `Object "${obj.name}" has no name/title field or primaryField \u2014 records will display as raw IDs`,
+        path: `${objPath}.fields`
+      });
+    }
+    for (const { name: fieldName, def } of fields) {
+      if (!def || typeof def !== "object") continue;
+      const fieldPath = `${objPath}.fields.${fieldName}`;
+      const type = def.type;
+      if (OPTION_FIELD_TYPES.has(type)) {
+        const hasOptions = Array.isArray(def.options) && def.options.length > 0 || !!def.optionsFrom || !!def.dataSource || !!def.reference;
+        if (!hasOptions) {
+          issues.push({
+            severity: "warning",
+            rule: "field/select-missing-options",
+            message: `${type} field "${obj.name}.${fieldName}" has no options`,
+            path: `${fieldPath}.options`
+          });
+        }
+      }
+      if (!RELATIONSHIP_TYPES.has(type)) continue;
+      const parent = refOf2(def);
+      if (!parent) {
+        issues.push({
+          severity: "error",
+          rule: "relationship/missing-reference",
+          message: `${type} field "${obj.name}.${fieldName}" is missing a reference target`,
+          path: `${fieldPath}.reference`
+        });
+        continue;
+      }
+      if (type === "master_detail") {
+        if (def.required !== true) {
+          issues.push({
+            severity: "warning",
+            rule: "relationship/master-detail-required",
+            message: `master_detail "${obj.name}.${fieldName}" \u2192 ${parent} should be required (a detail record cannot exist without its master)`,
+            path: `${fieldPath}.required`,
+            fix: "required: true"
+          });
+        }
+        if (def.deleteBehavior === void 0) {
+          issues.push({
+            severity: "suggestion",
+            rule: "relationship/delete-behavior",
+            message: `master_detail "${obj.name}.${fieldName}" \u2192 ${parent} should declare deleteBehavior (cascade/restrict/set_null)`,
+            path: `${fieldPath}.deleteBehavior`,
+            fix: "deleteBehavior: 'cascade'"
+          });
+        }
+        if (isLineItemName(obj.name) && def.inlineEdit !== true) {
+          issues.push({
+            severity: "suggestion",
+            rule: "relationship/line-items-inline-edit",
+            message: `"${obj.name}" looks like line items of ${parent}; consider inlineEdit: true on "${fieldName}" so it is entered inline within the ${parent} form`,
+            path: `${fieldPath}.inlineEdit`,
+            fix: "inlineEdit: true"
+          });
+        }
+      }
+      if (type === "lookup" && isLineItemName(obj.name)) {
+        issues.push({
+          severity: "suggestion",
+          rule: "relationship/line-item-should-be-master-detail",
+          message: `"${obj.name}" looks like line items of ${parent} but uses lookup; master_detail gives ownership + cascade + roll-ups`,
+          path: `${fieldPath}.type`,
+          fix: "type: 'master_detail'"
+        });
+      }
+      if (def.inlineEdit === true && isAssociationName(obj.name)) {
+        issues.push({
+          severity: "warning",
+          rule: "relationship/association-inline-edit",
+          message: `"${obj.name}" is an association (comments/audit/activity), not line items \u2014 inlineEdit clutters the ${parent} entry form; surface it as a detail-page related list instead`,
+          path: `${fieldPath}.inlineEdit`,
+          fix: "remove inlineEdit (use relatedList on the detail page)"
+        });
+      }
+    }
+    const children = childrenByParent[obj.name] || [];
+    const summaryChildObjects = new Set(
+      fields.filter((f) => f.def?.type === "summary").map((f) => f.def?.summaryOperations?.object || f.def?.reference).filter(Boolean)
+    );
+    const seenSuggestedChild = /* @__PURE__ */ new Set();
+    for (const { child, def } of children) {
+      if (def?.type !== "master_detail") continue;
+      if (!child?.name || seenSuggestedChild.has(child.name)) continue;
+      if (summaryChildObjects.has(child.name)) continue;
+      const numericChildField = fieldEntries2(child.fields).find((f) => NUMERIC_TYPES.has(f.def?.type));
+      if (!numericChildField) continue;
+      seenSuggestedChild.add(child.name);
+      issues.push({
+        severity: "suggestion",
+        rule: "rollup/missing-summary",
+        message: `"${obj.name}" owns "${child.name}" (master_detail) with numeric field "${numericChildField.name}" but has no roll-up summary; consider a summary field (count/sum) on ${obj.name}`,
+        path: `${objPath}.fields`,
+        fix: `summary field aggregating ${child.name}.${numericChildField.name}`
+      });
+    }
+  }
+  return issues;
+}
+
+// src/authoring-rules.ts
+var AUTHORING_COMMANDS = ["validate", "build", "lint"];
+var AUTHORING_SURFACES = ["cli", "runtime-publish"];
+var ALL = AUTHORING_COMMANDS;
+var CLI_ONLY = ["cli"];
+var CLI_AND_RUNTIME = ["cli", "runtime-publish"];
+var RUNTIME_NEEDS_FULL_SNAPSHOT = "P2 (#4463): reads a stack-wide collection the per-write snapshot does not carry, so running it now would report the rest of the tenant's metadata as missing rather than judging this write.";
+var RUNTIME_HEAVY_SOURCE_PARSE = "Not runtime-safe: parses authored source through typescript/sucrase, the two dependencies the kernel boot path must never load (lazy-deps.test.ts). Studio compiles page source on its own path.";
+var RUNTIME_OBJECT_WRITES_P2 = "P2 (#4463): judges an object/field declaration. Object writes are the hottest metadata path in the product, so P1 gates `flow` first and widens once the gate has real traffic behind it.";
+var EXPRESSION_INVALID = "expression-invalid";
+var AUTHORING_RULES = [
+  // ADR-0032 §1a/1b — CEL predicates in actions/validations/flows/sharing/hooks
+  // are parsed for syntax AND checked that each `record.<field>` resolves. This
+  // is what catches a BARE field ref (`done` instead of `record.done`) that
+  // would otherwise silently hide an action on every record (#2183/#2185).
+  {
+    name: "validateStackExpressions",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-expressions.ts",
+    // Runtime publish gate (#4463): the EXPRESSION family. On a flow write it
+    // checks every script-node callable and every declared predicate the flow
+    // carries, against the live object universe — the same parse `os build`
+    // runs, now at the door Studio/REST/MCP authors actually use.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => validateStackExpressions(stack).map((i) => ({
+      severity: i.severity ?? "error",
+      rule: EXPRESSION_INVALID,
+      where: i.where,
+      path: i.where,
+      message: i.message,
+      hint: `source: \`${i.source}\``
+    }))
+  },
+  // ADR-0053 — `userFilters`/`quickFilters` on an object list view ("views"
+  // mode) are silently dropped: `ObjectListViewSchema` omits them, so this must
+  // read the pre-parse tier or the evidence is already gone.
+  {
+    name: "validateListViewMode",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-list-view-mode.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateListViewMode(stack)
+  },
+  // [ADR-0078] A Zod-VALID instance that silently does nothing: a `summary`
+  // with no `summaryOperations`, a `lookup` with no `reference`, a `select`
+  // with no `options`. Every key is one we know, so #4001's unknown-key
+  // rejection cannot see it, and the liveness ledger cannot either (it is
+  // per-property; the properties ARE live). This is the gate between them.
+  //
+  // `gating` because the error-severity shapes are fully inert — the field
+  // reads 0 forever while authoring reports success, which is the failure the
+  // ADR was written for (cloud#687). Pre-parse so the findings survive an
+  // unrelated schema error elsewhere in the stack.
+  {
+    name: "validateFunctionalCompleteness",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-functional-completeness.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateFunctionalCompleteness(stack)
+  },
+  // A flat list-view object in `views: []` parses to an EMPTY container
+  // (ViewSchema strips unknown keys): the schema step passes, zero views
+  // register, and the Console renders nothing. Pre-parse for the same reason.
+  {
+    name: "validateViewContainers",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-view-containers.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateViewContainers(stack)
+  },
+  // ADR-0021 (#1719/#1721) — a widget's `dataset`/`dimensions`/`values` and its
+  // chartConfig axis/series must resolve against the declared datasets.
+  {
+    name: "validateWidgetBindings",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-widget-bindings.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateWidgetBindings(stack)
+  },
+  // ADR-0049 / #3367 — a header or widget action naming a `script`/`modal`
+  // target that resolves to no defined action ships a button that renders and
+  // silently does nothing on click. Unresolved `url` routes stay advisory.
+  {
+    name: "validateDashboardActionRefs",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-dashboard-action-refs.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateDashboardActionRefs(stack)
+  },
+  // #3574 — a filter value like `{current_user}` resolves in no vocabulary,
+  // reaches the data engine as a literal and matches nothing. The surface
+  // renders empty with no error, and a silent zero is indistinguishable from a
+  // genuine one at review time.
+  {
+    name: "validateFilterTokens",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-filter-tokens.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateFilterTokens(stack)
+  },
+  // The reference-integrity suite (#3583 §5 D5) — itself a registry, of the
+  // rules that answer "does this name resolve to anything?". It reached all
+  // three commands before this file existed; it is an entry here so the two
+  // registries compose instead of competing, and so its members are covered by
+  // the same guard as everything else.
+  {
+    name: "validateReferenceIntegrity",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/reference-integrity-suite.ts",
+    // Runtime publish gate (#4463): the REFERENCE family. On a flow snapshot the
+    // members that answer a flow question run (`validateFlowTemplatePaths`,
+    // `validateFlowNodeWrites`, `validateReadonlyFlowWrites`,
+    // `validateObjectReferences`); the page/nav/AI members see no such
+    // collection in the snapshot and return nothing, and the two that would
+    // load `typescript` need a hook/action/react body the snapshot never
+    // carries — which is what `runtime-lazy-deps.test.ts` pins.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => validateReferenceIntegrity(stack)
+  },
+  // ADR-0065 — a styled node's responsiveStyles must be scopable (needs an
+  // `id`), name real CSS properties + design tokens, and carry a `large` base.
+  {
+    name: "validateResponsiveStyles",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-responsive-styles.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateResponsiveStyles(stack)
+  },
+  // ADR-0080 — a `kind:'jsx'` page's `source` is parsed (never executed) and
+  // compiled to the SDUI tree at save time, so malformed source must fail loudly
+  // here (ADR-0078) instead of being stored and breaking only at render.
+  {
+    name: "validateJsxPages",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-jsx-pages.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_HEAVY_SOURCE_PARSE,
+    run: (stack, ctx) => validateJsxPages(stack, ctx.sduiManifest ? { manifest: ctx.sduiManifest } : {})
+  },
+  // ADR-0081 — a `kind:'react'` page's `source` is real React executed at
+  // render. Transpiled here (Sucrase, never executed) so a syntax error fails at
+  // author time, not at render. Lazy: only a stack with such a page pays.
+  {
+    name: "validateReactPages",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-react-pages.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_HEAVY_SOURCE_PARSE,
+    run: (stack) => validateReactPages(stack)
+  },
+  // ADR-0065, source tier — Tailwind `className` in a `kind:'html'`/`'react'`
+  // page silently no-ops (the build never scans authored metadata).
+  {
+    name: "validatePageSourceStyling",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-page-source-styling.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validatePageSourceStyling(stack)
+  },
+  // ADR-0066 ⑨ — a `requiredPermissions` entry naming a capability registered
+  // nowhere fails closed at runtime. Advisory: another installed package may
+  // legitimately provide it.
+  {
+    name: "validateCapabilityReferences",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-capability-references.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: 'P2 (#4463): the ONE rule the runtime universe makes strictly stronger \u2014 the advisory hedge ("another installed package may provide it") is decidable against the live capability registry, so it graduates from advisory to gating there rather than merely being ported. That promotion is a severity change on a published rule id and belongs in its own PR, not riding a wiring change.',
+    run: (stack) => validateCapabilityReferences(stack)
+  },
+  // A record-change flow whose start-node objectName matches nothing never
+  // fires — silently. Reads the pre-parse tier so an author sees what they
+  // wrote. Advisory: the object may come from another installed package.
+  {
+    name: "validateFlowTriggerReadiness",
+    tier: "advisory",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-flow-trigger-readiness.ts",
+    // Runtime publish gate (#4463): the FLOW family. Advisory at this surface
+    // too — its findings are logged, not thrown (P1 gates on `error` only; P2
+    // puts advisories on the response for Studio to render).
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => validateFlowTriggerReadiness(stack)
+  },
+  // ADR-0090 D3 fallout — an approval `{ type: 'role' }` resolves against the
+  // better-auth org-membership tier, not positions, so a position name authored
+  // there routes the approval to nobody; and an expression approver that does
+  // not parse can never resolve. The rule whose absence from `os build` and
+  // `os validate` was #4409's worked example: it gates, and it ran on `os lint`
+  // alone, so a broken approval flow built and published green.
+  {
+    name: "validateApprovalApprovers",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-approval-approvers.ts",
+    // Runtime publish gate (#4463): the APPROVAL family, and the issue's worked
+    // example both times. #4409 fixed it for `os build`; a tenant saving the
+    // same broken expression approver from Studio still sailed through, because
+    // `approver.value` is just a string to Zod. It is not just a string here.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => validateApprovalApprovers(stack)
+  },
+  // ADR-0079 — `titleFormat` is retired in favour of `nameField`, and an object
+  // with no resolvable title ships records with no meaningful name. Advisory:
+  // auto-provision and the `Record #<id>` floor keep it from ever being fatal.
+  {
+    name: "validateRecordTitle",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-record-title.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateRecordTitle(stack)
+  },
+  // ADR-0085 — `stageField` / `highlightFields` / `Field.group` are pointers
+  // into the object's field map; a dangling one is Zod-valid and silently inert
+  // at render. Advisory: every consumer degrades gracefully.
+  {
+    name: "validateSemanticRoles",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-semantic-roles.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateSemanticRoles(stack)
+  },
+  // #2578 / #4449 — a form section's field reference that resolves to nothing
+  // (silently not rendered) and an absolute `colSpan` under a per-surface
+  // derived column count. Advisory: the renderer skips the unknown field and
+  // clamps the span, so nothing is broken — but each is almost certainly an
+  // authoring mistake, and until #4449 this rule ran on no command at all.
+  // Pure structured-metadata walk (no lazy dependency), so wiring it to all
+  // three costs nothing measurable.
+  {
+    name: "validateFormLayout",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-form-layout.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateFormLayout(stack)
+  },
+  // ADR-0078 Phase 3 (Tier-A `action-locations`) — an action that declares no
+  // `locations` and that no view places by name renders on no surface at all.
+  // objectui#3142 made that measurable: four renderers used to show an
+  // undeclared action anyway, and now none does. Advisory: a view in another
+  // installed package may be the one placing it, and `locations: []` (the
+  // documented headless shape) is deliberately never flagged.
+  {
+    name: "validateActionLocations",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-action-locations.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateActionLocations(stack)
+  },
+  // framework#3434 — seeds replay on every boot, so a `mode: 'insert'` dataset
+  // duplicates its table on every restart.
+  {
+    name: "validateSeedReplaySafety",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-seed-replay-safety.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateSeedReplaySafety(stack)
+  },
+  // framework#3433 follow-up — #3433 exempts seed writes from the
+  // `state_machine` rule, so a seeded status the FSM does not declare is no
+  // longer rejected at write time. Re-added at author time; advisory, because
+  // the exemption itself is legitimate.
+  {
+    name: "validateSeedStateMachine",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-seed-state-machine.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateSeedStateMachine(stack)
+  },
+  // ADR-0089 D3b — deprecated visibility aliases and a mis-layered binding root.
+  // Pre-parse: the schema folds `visibleOn`/`visibility` into `visibleWhen`
+  // during parse, so the alias the author wrote is gone from `result.data`.
+  {
+    name: "validateVisibilityPredicates",
+    tier: "advisory",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-visibility-predicates.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateVisibilityPredicates(stack)
+  },
+  // #1874 — flow authoring anti-patterns. Advisory by default; a finding marked
+  // `error` gates. Three do today: `flow-runas-unscoped` (#3760 — metadata the
+  // runtime REFUSES to execute), plus `flow-branch-label-unmatched` and
+  // `flow-default-edge-with-condition` (#4414 — a declaration that is inert, so
+  // the route silently differs from what the author wrote). The bar for
+  // promoting one is stated at the top of `lint-flow-patterns.ts`.
+  {
+    name: "lintFlowPatterns",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/lint-flow-patterns.ts",
+    // Runtime publish gate (#4463): the FLOW family's anti-pattern half. Its
+    // three `error` rules are the sharpest fit for a publish gate that exists —
+    // `flow-runas-unscoped` is metadata the automation engine REFUSES to
+    // execute, so publishing it can only ever produce a broken flow.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => lintFlowPatterns(stack).map((f) => ({
+      severity: f.severity ?? "warning",
+      rule: f.rule,
+      where: f.where,
+      path: f.where,
+      message: f.message,
+      hint: f.hint
+    }))
+  },
+  // The spec-liveness loop on the author side: a property the ledger marks
+  // dead-and-misleading or experimental is set hopefully and does nothing.
+  // Ledger-driven (entries opt in via `authorWarn`), so it is high-signal and
+  // never fatal.
+  {
+    name: "lintLivenessProperties",
+    tier: "advisory",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/lint-liveness-properties.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => lintLivenessProperties(stack).map((f) => ({
+      severity: "warning",
+      rule: f.rule,
+      where: f.where,
+      path: f.where,
+      message: f.message,
+      hint: f.hint
+    }))
+  },
+  // A format like `{plan_no}{000}` makes the referenced field part of the
+  // counter scope, so it must exist and be set at create time. Unknown field →
+  // broken (error); optional field → fragile (warning).
+  {
+    name: "lintAutonumberFormats",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/lint-autonumber-formats.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => lintAutonumberFormats(stack).map((f) => ({
+      severity: f.severity,
+      rule: f.rule,
+      where: f.where,
+      path: f.where,
+      message: f.message,
+      hint: f.hint
+    }))
+  },
+  // #2554 — a `type:'form'` action target naming a missing or LIST view opens a
+  // broken form at runtime; a list/form view-key collision silently renames one
+  // view so references resolve to the OTHER. Both are broken.
+  {
+    name: "lintViewRefs",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/lint-view-refs.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => lintViewRefs(stack).map((f) => ({
+      severity: f.severity,
+      rule: f.rule,
+      where: f.where,
+      path: f.where,
+      message: f.message,
+      hint: f.hint
+    }))
+  },
+  // #3991 — a column carrying BOTH a field-level `unique: true` and a
+  // single-column declared unique index has two intents, of which exactly one
+  // takes effect (the global index wins; the tenant composite is unreachable).
+  {
+    name: "lintUniqueDeclarations",
+    tier: "advisory",
+    input: "parsed",
+    commands: ["validate", "build"],
+    source: "packages/lint/src/data-model-rules.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly as R10 of its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
+    run: (stack) => lintUniqueDeclarations(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
+      severity: f.severity === "suggestion" ? "info" : f.severity,
+      rule: f.rule,
+      where: f.path,
+      path: f.path,
+      message: f.message,
+      hint: f.fix ?? ""
+    }))
+  },
+  // ADR-0090 D7 — the security-domain publish linter. Every `error` rule mirrors
+  // a runtime enforcement point (fail-closed OWD default, canonical enum, anchor
+  // binding gate, vocabulary freeze), moving the failure from a runtime deny to
+  // an author-time fix-it. Per ADR-0049 this is not advisory security.
+  {
+    name: "validateSecurityPosture",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-security-posture.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: "Already gated at this surface by a DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on `object` (`registerAuthoringGate`) that enforces the same OWD posture rules on every runtime write. Running the linter here as well would double-report one refusal in two vocabularies. Consolidating the two onto this table is P2 (#4463), and is a merge, not a hole.",
+    run: (stack) => validateSecurityPosture(stack)
+  },
+  // ADR-0105 D6 — the org tree is a REPORTING dimension. An RLS policy or
+  // sharing rule that walks it builds a second permission hierarchy (the
+  // dual-hierarchy mistake ADR-0057 D5 retired) and cannot widen Layer 0 anyway,
+  // so it grants nothing it appears to.
+  {
+    name: "validateOrgAxisRedLines",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-org-axis-red-lines.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateOrgAxisRedLines(stack)
+  }
+];
+function authoringRulesFor(command) {
+  return AUTHORING_RULES.filter((r) => r.commands.includes(command));
+}
+function runAuthoringRules(command, run) {
+  const findings = [];
+  const ctx = { sduiManifest: run.sduiManifest };
+  for (const rule of authoringRulesFor(command)) {
+    const stack = rule.input === "normalized" ? run.normalized : run.parsed ?? run.normalized;
+    findings.push(...rule.run(stack, ctx));
+  }
+  return findings;
+}
+function splitBySeverity(findings) {
+  return {
+    errors: findings.filter((f) => f.severity === "error"),
+    advisories: findings.filter((f) => f.severity !== "error")
+  };
+}
+
+// src/runtime-gate.ts
+var TYPE_TO_STACK_KEY = {
+  flow: "flows",
+  object: "objects",
+  view: "views",
+  action: "actions",
+  page: "pages",
+  dashboard: "dashboards",
+  agent: "agents",
+  hook: "hooks",
+  seed: "seeds"
+};
+function runtimeAuthoringRulesFor(type) {
+  return AUTHORING_RULES.filter(
+    (r) => r.surfaces.includes("runtime-publish") && (r.runtimeTypes ?? []).includes(type)
+  );
+}
+function runtimeGatedTypes() {
+  const types = /* @__PURE__ */ new Set();
+  for (const rule of AUTHORING_RULES) {
+    if (!rule.surfaces.includes("runtime-publish")) continue;
+    for (const t of rule.runtimeTypes ?? []) types.add(t);
+  }
+  return [...types].sort();
+}
+function stackKeyForType(type) {
+  return TYPE_TO_STACK_KEY[type] ?? null;
+}
+var fingerprint = (f) => `${f.rule}\0${f.where}\0${f.path}\0${f.message}`;
+function runRules(rules, stack, ctx) {
+  const findings = [];
+  for (const rule of rules) {
+    try {
+      findings.push(...rule.run(stack, ctx));
+    } catch (err) {
+      findings.push({
+        severity: "warning",
+        rule: "authoring-rule-threw",
+        where: rule.name,
+        path: rule.source,
+        message: `rule ${rule.name} threw while judging this write: ${err instanceof Error ? err.message : String(err)}`,
+        hint: "This is a bug in the rule, not in the metadata \u2014 the write was not blocked by it. Please report it with the body that triggered it."
+      });
+    }
+  }
+  return findings;
+}
+function runRuntimeAuthoringRules(args) {
+  const rules = runtimeAuthoringRulesFor(args.type);
+  const empty = { errors: [], advisories: [], rulesRun: [] };
+  if (rules.length === 0) return empty;
+  const stackKey = stackKeyForType(args.type);
+  if (!stackKey) return empty;
+  if (!args.item || typeof args.item !== "object") return empty;
+  const item = args.item;
+  const itemName = typeof item.name === "string" ? item.name : void 0;
+  const contextObjects = args.context?.objects ?? [];
+  const ctx = { sduiManifest: args.sduiManifest };
+  const writesIntoContext = stackKey === "objects";
+  const baselineObjects = writesIntoContext ? contextObjects.filter((o) => !itemName || o?.name !== itemName) : contextObjects;
+  const baseline = { objects: baselineObjects };
+  const candidate = writesIntoContext ? { objects: [...baselineObjects, item] } : { objects: baselineObjects, [stackKey]: [item] };
+  const before = new Set(runRules(rules, baseline, ctx).map(fingerprint));
+  const added = runRules(rules, candidate, ctx).filter((f) => !before.has(fingerprint(f)));
+  return {
+    errors: added.filter((f) => f.severity === "error"),
+    advisories: added.filter((f) => f.severity !== "error"),
+    rulesRun: rules.map((r) => r.name)
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACTION_BODY_WRITE_EXCLUSIONS,
@@ -5960,6 +8162,7 @@ function validateReferenceIntegrity(stack) {
   ACTION_BODY_WRITE_PATTERN_IDS,
   ACTION_BODY_WRITE_UNKNOWN_FIELD,
   ACTION_NAME_UNDEFINED,
+  ACTION_NO_PLACEMENT,
   ACTION_RECORD_WRITE_DISCARDED,
   ACTION_RECORD_WRITE_PATTERNS,
   ACTION_RECORD_WRITE_PATTERN_IDS,
@@ -5975,6 +8178,13 @@ function validateReferenceIntegrity(stack) {
   APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
   APPROVAL_EXPRESSION_INVALID,
   APPROVAL_EXPRESSION_NO_EMPTY_POLICY,
+  AUTHORING_COMMANDS,
+  AUTHORING_RULES,
+  AUTHORING_SURFACES,
+  AUTONUMBER_LITERAL_TOKEN,
+  AUTONUMBER_OPTIONAL_FIELD,
+  AUTONUMBER_SELF_REFERENCE,
+  AUTONUMBER_UNKNOWN_FIELD,
   CAPABILITY_REFERENCE_UNKNOWN,
   CHART_AXIS_NOT_SELECTED,
   CHART_CONFIG_MISSING,
@@ -5985,13 +8195,29 @@ function validateReferenceIntegrity(stack) {
   DASHBOARD_ACTION_ROUTE_UNRESOLVED,
   DASHBOARD_ACTION_TARGET_UNDEFINED,
   DASHBOARD_FILTER_FIELD_UNKNOWN,
+  EXPRESSION_INVALID,
   FIELD_GROUP_EMPTY,
   FIELD_GROUP_UNDECLARED,
   FILTER_TOKEN_UNKNOWN,
+  FLOW_APPROVAL_REVISE_DEAD_END,
+  FLOW_APPROVAL_REVISE_DISABLED,
+  FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE,
+  FLOW_BARE_DOLLAR_REF,
+  FLOW_BRANCH_LABEL_UNMATCHED,
+  FLOW_DATE_EQUALITY_FILTER,
+  FLOW_DECISION_UNCONDITIONAL_BRANCH,
+  FLOW_DEFAULT_EDGE_WITH_CONDITION,
+  FLOW_DOUBLE_BRACE_INTERP,
   FLOW_DRAFT_STATUS_AMBIGUOUS,
+  FLOW_ERROR_LABEL_NOT_FAULT,
+  FLOW_INERT_NODE_CONDITION,
+  FLOW_MULTIPLE_DEFAULT_EDGES,
   FLOW_NODE_WRITE_UNKNOWN_FIELD,
+  FLOW_PHANTOM_AGGREGATION,
+  FLOW_RUNAS_UNSCOPED,
   FLOW_TEMPLATE_LOOKUP_TRAVERSAL,
   FLOW_TEMPLATE_UNKNOWN_FIELD,
+  FLOW_TIME_RELATIVE_ANTIPATTERN,
   FLOW_TRIGGER_UNKNOWN_OBJECT,
   FLOW_UPDATE_READONLY_FIELD,
   FLOW_UPDATE_READONLY_WHEN_FIELD,
@@ -6004,19 +8230,25 @@ function validateReferenceIntegrity(stack) {
   HOOK_BODY_WRITE_PATTERN_IDS,
   HOOK_BODY_WRITE_UNKNOWN_FIELD,
   LIST_VIEW_FILTERS_IN_VIEWS_MODE,
+  LIVENESS_DEAD_PROPERTY,
+  LIVENESS_EXPERIMENTAL_PROPERTY,
   MEASURE_AGGREGATE_INCOHERENT,
   NAV_OBJECT_UNGRANTED,
+  NAV_TARGET_UNRESOLVED,
+  NULL_GUARD_HINT,
   OBJECT_REFERENCE_UNKNOWN,
   OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
   ORG_AXIS_CROSS_ORG_BU_GRANT,
   ORG_AXIS_PERMISSION_INHERITANCE,
   PAGE_FIELD_UNKNOWN,
   PAGE_SOURCE_CLASSNAME,
+  REACT_BLOCK_NEEDS_RECORD_CONTEXT,
   REACT_CHART_AGGREGATE_INVALID,
   REACT_CHART_AXIS_UNKNOWN,
   REACT_CHART_FIELD_UNKNOWN,
   REFERENCE_INTEGRITY_RULES,
   SEARCHABLE_FIELD_UNKNOWN,
+  SEARCHABLE_FIELD_UNSEARCHABLE,
   SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
   SECURITY_DELEGATION_MISSING_REASON,
@@ -6041,17 +8273,37 @@ function validateReferenceIntegrity(stack) {
   TITLE_UNRESOLVABLE,
   TRANSLATION_OPTION_KEY_UNKNOWN,
   TRANSLATION_TARGET_UNKNOWN,
+  UNIQUE_DOUBLE_DECLARATION,
   VIEW_CONTAINER_SHAPE,
+  VIEW_KEY_COLLISION,
+  VIEW_REF_FORM_TARGET_KIND,
+  VIEW_REF_FORM_TARGET_MISSING,
   VISIBILITY_ALIAS_DEPRECATED,
   VISIBILITY_ROOT_MISLAYERED,
   WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN,
+  authoringRulesFor,
   buildAccessMatrix,
   diffAccessMatrix,
   extractHookBodyWriteSet,
   extractHookBodyWrites,
+  findUnguardedNullableOperands,
+  lintAutonumberFormats,
+  lintDataModel,
+  lintFlowPatterns,
+  lintLivenessProperties,
+  lintUniqueDeclarations,
+  lintViewRefs,
+  nullGuardMessage,
+  runAuthoringRules,
+  runRuntimeAuthoringRules,
+  runtimeAuthoringRulesFor,
+  runtimeGatedTypes,
+  splitBySeverity,
+  stackKeyForType,
   validateActionBodyWrites,
+  validateActionLocations,
   validateActionNameRefs,
   validateAiAgentAuthoring,
   validateAiSurfaceAffinity,
@@ -6065,10 +8317,12 @@ function validateReferenceIntegrity(stack) {
   validateFlowTemplatePaths,
   validateFlowTriggerReadiness,
   validateFormLayout,
+  validateFunctionalCompleteness,
   validateHookBodyWrites,
   validateJsxPages,
   validateListViewMode,
   validateNavAccess,
+  validateNavTargetRefs,
   validateObjectReferences,
   validateOrgAxisRedLines,
   validatePageFieldBindings,