@objectstack/lint 17.0.0-rc.2 → 17.0.0-rc.4

package/dist/runtime.js

@@ -1,19 +1,23 @@
 // src/validate-expressions.ts
-import { validateExpression } from "@objectstack/formula";
+import { validateExpression, collectCelRootIdentifiers } from "@objectstack/formula";
 import { collectFlowGraphs, resolveFlowNodeExpressions } from "@objectstack/spec/automation";
 
+// src/system-fields.ts
+import { FIELD_GROUP_SYSTEM_FIELDS, resolveInjectedSystemColumns } from "@objectstack/spec/data";
+import { SystemFieldName } from "@objectstack/spec/system";
+var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
+  ...FIELD_GROUP_SYSTEM_FIELDS,
+  ...Object.values(SystemFieldName)
+]);
+function injectedColumnsFor(objectDef) {
+  return resolveInjectedSystemColumns(objectDef).names;
+}
+
 // src/validate-null-guards.ts
-import { Environment } from "@marcbachmann/cel-js";
+import { parseCelToAst } from "@objectstack/formula";
 var NULL_GUARD_HINT = `Guard it with '!= null' \u2014 'has(x)' does NOT do that: a declared field holding null is still PRESENT, so has(x) is true.`;
 var FAULTING_BINARY_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "+", "-", "*", "/", "%"]);
 var DEFAULT_RECORD_ROOTS = ["record", "previous"];
-var parseEnv;
-function getParseEnv() {
-  if (!parseEnv) {
-    parseEnv = new Environment({ unlistedVariablesAreDyn: true, enableOptionalTypes: true });
-  }
-  return parseEnv;
-}
 function isNode(v) {
   return !!v && typeof v === "object" && typeof v.op === "string";
 }
@@ -146,12 +150,8 @@ function findUnguardedNullableOperands(source, opts) {
   if (typeof source !== "string" || !source.trim()) return [];
   if (opts.nullableFields.size === 0) return [];
   const roots = opts.roots ?? DEFAULT_RECORD_ROOTS;
-  let ast;
-  try {
-    ast = getParseEnv().parse(source).ast;
-  } catch {
-    return [];
-  }
+  const ast = parseCelToAst(source);
+  if (!ast) return [];
   const hasOperands = /* @__PURE__ */ new Set();
   collectHasOperands(ast, roots, hasOperands);
   const findings = [];
@@ -214,10 +214,14 @@ function findUnguardedNullableOperands(source, opts) {
   visit(ast, /* @__PURE__ */ new Set());
   return findings;
 }
-function nullGuardMessage(subject, objectName, finding) {
+var OUTCOME_CLAUSE = {
+  "fail-closed": "so the rule enforces nothing and the write is rejected fail-closed (#4649/#4763)",
+  "fail-open": "so the predicate is SKIPPED fail-open \u2014 the field is never actually required, the write proceeds unchecked, and the only trace is a `requiredWhen \u2026 failed to evaluate \u2014 skipped` log line (#4649/#4811)"
+};
+function nullGuardMessage(subject, objectName, finding, outcome = "fail-closed") {
   const owner = objectName ? `'${objectName}'` : "this object";
   const hasNote = finding.hasOnlyGuard ? ` \`has(${finding.operand})\` does not guard it.` : "";
-  return `${subject} applies \`${finding.operator}\` to \`${finding.operand}\`, which ${owner} declares as nullable (no \`required: true\`, no \`defaultValue\`).${hasNote} At runtime the operand is null, CEL has no \`${finding.operator}\` overload for null, and the whole predicate aborts \u2014 so the rule enforces nothing and the write is rejected fail-closed (#4649/#4763). The predicate compares a value that is null. ${NULL_GUARD_HINT}`;
+  return `${subject} applies \`${finding.operator}\` to \`${finding.operand}\`, which ${owner} declares as nullable (no \`required: true\`, no \`defaultValue\`).${hasNote} At runtime the operand is null, CEL has no \`${finding.operator}\` overload for null, and the whole predicate aborts \u2014 ${OUTCOME_CLAUSE[outcome]}. The predicate compares a value that is null. ${NULL_GUARD_HINT}`;
 }
 
 // src/validate-expressions.ts
@@ -237,7 +241,7 @@ function buildFieldIndex(objects) {
     let names = [];
     if (Array.isArray(fields)) names = fields.map((f) => f.name).filter((n) => typeof n === "string");
     else if (fields && typeof fields === "object") names = Object.keys(fields);
-    idx.set(name, names);
+    idx.set(name, [.../* @__PURE__ */ new Set([...names, ...injectedColumnsFor(obj)])]);
   }
   return idx;
 }
@@ -297,6 +301,19 @@ function buildNullableFieldIndex(objects) {
   }
   return idx;
 }
+function readsParentRoot(source) {
+  const roots = collectCelRootIdentifiers(source);
+  return roots.ok && roots.roots.includes("parent");
+}
+function masterDetailCount(obj) {
+  let n = 0;
+  for (const [, def] of fieldEntries(obj)) {
+    if (def.type !== "master_detail") continue;
+    const ref = def.reference;
+    if (typeof ref === "string" && ref.trim() !== "") n += 1;
+  }
+  return n;
+}
 function celSourceOf(raw) {
   if (typeof raw === "string") return raw;
   if (raw && typeof raw === "object") {
@@ -310,7 +327,7 @@ function rulePredicates(rule, path) {
   const out = [];
   const name = typeof rule.name === "string" ? rule.name : "?";
   const here = path ? `${path} \u2192 '${name}'` : `'${name}'`;
-  const main = rule.expression ?? rule.predicate ?? rule.condition ?? rule.formula;
+  const main = rule.condition;
   if (main != null) out.push({ label: `validation rule ${here}`, raw: main });
   if (rule.when != null) out.push({ label: `validation rule ${here} when-predicate`, raw: rule.when });
   for (const branch of ["then", "otherwise"]) {
@@ -327,7 +344,7 @@ function validateStackExpressions(stack) {
   const fieldIndex = buildFieldIndex(objects);
   const fieldTypeIndex = buildFieldTypeIndex(objects);
   const nullableIndex = buildNullableFieldIndex(objects);
-  const checkNullGuards = (where, subject, raw, objectName) => {
+  const checkNullGuards = (where, subject, raw, objectName, outcome = "fail-closed") => {
     if (!objectName) return;
     const nullableFields = nullableIndex.get(objectName);
     if (!nullableFields || nullableFields.size === 0) return;
@@ -336,7 +353,7 @@ function validateStackExpressions(stack) {
     for (const finding of findUnguardedNullableOperands(source, { nullableFields })) {
       issues.push({
         where,
-        message: nullGuardMessage(subject, objectName, finding),
+        message: nullGuardMessage(subject, objectName, finding, outcome),
         source,
         severity: "error"
       });
@@ -405,31 +422,45 @@ function validateStackExpressions(stack) {
   }
   for (const obj of objects) {
     const objectName = typeof obj.name === "string" ? obj.name : void 0;
-    const validations = obj.validations ?? obj.validationRules;
+    const validations = obj.validations;
     for (const rule of asArray(validations)) {
       const where = `object '${objectName}' \xB7 validation '${rule.name ?? "?"}'`;
-      check(where, rule.expression ?? rule.predicate ?? rule.condition ?? rule.formula, objectName, "record");
+      check(where, rule.condition, objectName, "record");
       check(`${where} when`, rule.when, objectName, "record");
       for (const p of rulePredicates(rule, "")) {
         checkNullGuards(`object '${objectName}' \xB7 ${p.label}`, p.label, p.raw, objectName);
       }
     }
     const fields = obj.fields;
-    const fieldList = Array.isArray(fields) ? fields : fields && typeof fields === "object" ? Object.values(fields) : [];
-    for (const f of fieldList) {
-      if (f && typeof f === "object") {
-        const fname = f.name ?? "?";
-        for (const key of ["requiredWhen", "readonlyWhen", "conditionalRequired", "visibleWhen"]) {
-          check(`object '${objectName}' \xB7 field '${fname}' ${key}`, f[key], objectName, "record");
-        }
+    const fieldList = Array.isArray(fields) ? fields.filter((f) => !!f && typeof f === "object").map((f) => [typeof f.name === "string" ? f.name : "?", f]) : fields && typeof fields === "object" ? Object.entries(fields).filter(([, def]) => !!def && typeof def === "object").map(([n, def]) => [n, def]) : [];
+    const masters = masterDetailCount(obj);
+    for (const [fname, f] of fieldList) {
+      for (const key of ["requiredWhen", "readonlyWhen", "conditionalRequired", "visibleWhen"]) {
+        check(`object '${objectName}' \xB7 field '${fname}' ${key}`, f[key], objectName, "record");
+      }
+      const roWhenSource = celSourceOf(f.readonlyWhen);
+      if (masters !== 1 && roWhenSource && readsParentRoot(roWhenSource)) {
+        issues.push({
+          where: `object '${objectName}' \xB7 field '${fname}' readonlyWhen`,
+          message: `\`readonlyWhen\` reads \`parent\`, but object '${objectName}' declares ${masters === 0 ? "no" : `${masters}`} \`master_detail\` relationship${masters === 1 ? "" : "s"} \u2014 so the server has no header record to bind as \`parent\` and the field would be locked on every write. ` + (masters === 0 ? `Declare the owning relationship as \`Field.masterDetail('<master>')\`, or rewrite the predicate against \`record\`.` : `\`parent\` needs exactly one master; name the header explicitly through \`record.<fk>\` state instead, or model the extra relationship as a \`lookup\`.`),
+          source: roWhenSource,
+          severity: "error"
+        });
       }
-      if (f && typeof f === "object" && f.formula) {
+      checkNullGuards(
+        `object '${objectName}' \xB7 field '${fname}' requiredWhen`,
+        `field '${fname}' requiredWhen`,
+        f.requiredWhen,
+        objectName,
+        "fail-open"
+      );
+      if (f.expression) {
         const res = validateExpression(
           "value",
-          f.formula,
+          f.expression,
           objectName ? { objectName, fields: fieldIndex.get(objectName), fieldTypes: fieldTypeIndex.get(objectName), scope: "record" } : { scope: "record" }
         );
-        const fieldWhere = `object '${objectName}' \xB7 field '${f.name ?? "?"}' formula`;
+        const fieldWhere = `object '${objectName}' \xB7 field '${fname}' expression`;
         for (const e of res.errors) issues.push({ where: fieldWhere, message: e.message, source: e.source, severity: "error" });
         for (const w of res.warnings) issues.push({ where: fieldWhere, message: w.message, source: w.source, severity: "warning" });
       }
@@ -437,7 +468,7 @@ function validateStackExpressions(stack) {
   }
   const seenActions = /* @__PURE__ */ new Set();
   const checkAction = (where, action, objectName) => {
-    const obj = objectName ?? (typeof action.objectName === "string" ? action.objectName : void 0) ?? (typeof action.object === "string" ? action.object : void 0);
+    const obj = objectName ?? (typeof action.objectName === "string" ? action.objectName : void 0);
     const name = typeof action.name === "string" ? action.name : "?";
     const key = `${obj ?? ""}:${name}`;
     if (seenActions.has(key)) return;
@@ -456,10 +487,10 @@ function validateStackExpressions(stack) {
       checkAction(`object '${objectName}'`, action, objectName);
     }
   }
-  for (const rule of asArray(stack.sharingRules)) {
-    const ruleObj = typeof rule.object === "string" ? rule.object : void 0;
-    const where = `sharingRule '${rule.name ?? "?"}'${ruleObj ? ` (${ruleObj})` : ""} condition`;
-    check(where, rule.condition ?? rule.criteria ?? rule.predicate, ruleObj, "record");
+  for (const sharingRule of asArray(stack.sharingRules)) {
+    const ruleObj = typeof sharingRule.object === "string" ? sharingRule.object : void 0;
+    const where = `sharingRule '${sharingRule.name ?? "?"}'${ruleObj ? ` (${ruleObj})` : ""} condition`;
+    check(where, sharingRule.condition, ruleObj, "record");
   }
   for (const hook of asArray(stack.hooks)) {
     const hookName = hook.name ?? "?";
@@ -681,16 +712,6 @@ function validateViewContainers(stack) {
 // src/validate-widget-bindings.ts
 import { isIncoherentAggregate } from "@objectstack/spec/data";
 import { ChartTypeSchema } from "@objectstack/spec/ui";
-
-// src/system-fields.ts
-import { FIELD_GROUP_SYSTEM_FIELDS } from "@objectstack/spec/data";
-import { SystemFieldName } from "@objectstack/spec/system";
-var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
-  ...FIELD_GROUP_SYSTEM_FIELDS,
-  ...Object.values(SystemFieldName)
-]);
-
-// src/validate-widget-bindings.ts
 var WIDGET_DATASET_UNKNOWN = "widget-dataset-unknown";
 var WIDGET_DIMENSION_UNKNOWN = "widget-dimension-unknown";
 var WIDGET_MEASURE_UNKNOWN = "widget-measure-unknown";
@@ -1144,18 +1165,6 @@ function validateDashboardActionRefs(stack) {
         `${dashPath}.header.actions[${ai}].actionUrl`
       );
     }
-    const widgets = asArray4(dash.widgets);
-    for (let wi = 0; wi < widgets.length; wi++) {
-      const widget = widgets[wi];
-      if (!widget || typeof widget !== "object") continue;
-      if (!strName(widget.actionUrl)) continue;
-      const widgetId = strName(widget.id) ?? `#${wi}`;
-      checkOne(
-        { actionType: widget.actionType, actionUrl: widget.actionUrl },
-        `dashboard "${dashName}" \xB7 widget "${widgetId}" action`,
-        `${dashPath}.widgets[${wi}].actionUrl`
-      );
-    }
   }
   return findings;
 }
@@ -1654,13 +1663,13 @@ function validateSearchableFields(stack) {
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
     if (!isRec2(view)) continue;
-    const viewLabel = strName3(view.name) ?? strName3(view.objectName) ?? `#${vi}`;
+    const viewLabel2 = strName3(view.name) ?? strName3(view.objectName) ?? `#${vi}`;
     const viewObject = strName3(view.objectName) ?? strName3(view.object);
     if (isRec2(view.list)) {
       check(
         view.list.searchableFields,
         listViewObject(view.list) ?? viewObject,
-        `view "${viewLabel}" \u203A list`,
+        `view "${viewLabel2}" \u203A list`,
         `views[${vi}].list.searchableFields`,
         "list-view searchableFields",
         "narrowing"
@@ -1672,7 +1681,7 @@ function validateSearchableFields(stack) {
         check(
           lv.searchableFields,
           listViewObject(lv) ?? viewObject,
-          `view "${viewLabel}" \u203A listViews.${key}`,
+          `view "${viewLabel2}" \u203A listViews.${key}`,
           `views[${vi}].listViews.${key}.searchableFields`,
           "list-view searchableFields",
           "narrowing"
@@ -1980,8 +1989,11 @@ function sortFieldRefs(value, basePath) {
 }
 var COMPONENT_FIELD_SPECS = {
   "record:highlights": { props: ["fields"] },
-  // `sections`/`hideFields` are not in RecordDetailsProps, but every real page
-  // authors them (they survive because `properties` is unvalidated).
+  // `sections` (object form) and `hideFields` are what every real page authors,
+  // and since #5611 they are what `RecordDetailsProps` declares — this model and
+  // the spec agree. (Before that, `sections` was declared as an ID `string[]`
+  // and `hideFields` not at all; both survived only because `properties` is
+  // unvalidated.)
   "record:details": { props: ["fields", "hideFields"], nestedSections: ["sections"] },
   "record:path": { props: ["statusField"] },
   "element:number": { props: ["field"] },
@@ -2044,7 +2056,7 @@ function indexObjectFields(stack) {
   }
   return objectFields;
 }
-function checkFieldRefs(refs, objectName, objectFields, where, consequence = "skipped") {
+function checkFieldRefs(refs, objectName, objectFields, where, consequence2 = "skipped") {
   const findings = [];
   if (!objectName) return findings;
   const known = objectFields.get(objectName);
@@ -2053,11 +2065,11 @@ function checkFieldRefs(refs, objectName, objectFields, where, consequence = "sk
     if (ref.name.includes(".")) continue;
     if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) continue;
     findings.push({
-      severity: consequence === "queried" ? "error" : "warning",
+      severity: consequence2 === "queried" ? "error" : "warning",
       rule: PAGE_FIELD_UNKNOWN,
       where,
       path: ref.path,
-      message: `field "${ref.name}" is not a field on object "${objectName}" \u2014 ` + (consequence === "queried" ? 'it is used in a QUERY, so the predicate can never match: the surface renders an empty result that looks exactly like "there is no data".' : "the component silently skips it, so it never renders."),
+      message: `field "${ref.name}" is not a field on object "${objectName}" \u2014 ` + (consequence2 === "queried" ? 'it is used in a QUERY, so the predicate can never match: the surface renders an empty result that looks exactly like "there is no data".' : "the component silently skips it, so it never renders."),
       hint: `Fix the field name, or add "${ref.name}" to ${objectName}. References must match the object's field names exactly.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
     });
   }
@@ -2626,6 +2638,13 @@ function collectViewRecord(view, factsFor) {
   const addView = (objectName, name) => {
     if (objectName && name) factsFor(objectName).views.add(name);
   };
+  const addSections = (container, binding) => {
+    if (!binding) return;
+    for (const section of asArray14(container.sections)) {
+      const sectionName = strName10(section.name);
+      if (sectionName) factsFor(binding).sections.add(sectionName);
+    }
+  };
   const listBinding = isRec7(view.list) ? bindingOf(view.list) : void 0;
   if (isRec7(view.list)) addView(listBinding, strName10(view.list.name));
   addView(recordObject ?? listBinding, strName10(view.name));
@@ -2637,21 +2656,11 @@ function collectViewRecord(view, factsFor) {
       const binding = bindingOf(sub) ?? listBinding;
       addView(binding, subKey);
       addView(binding, strName10(sub.name));
-      if (binding) {
-        for (const section of asArray14(sub.sections)) {
-          const sectionName = strName10(section.name);
-          if (sectionName) factsFor(binding).sections.add(sectionName);
-        }
-      }
-    }
-  }
-  const sectionBinding = recordObject ?? listBinding;
-  if (sectionBinding) {
-    for (const section of asArray14(view.sections)) {
-      const sectionName = strName10(section.name);
-      if (sectionName) factsFor(sectionBinding).sections.add(sectionName);
+      addSections(sub, binding);
     }
   }
+  if (isRec7(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  addSections(view, recordObject ?? listBinding);
 }
 function viewObjectName(view) {
   return strName10(view.objectName) ?? strName10(view.object) ?? (isRec7(view.data) ? strName10(view.data.object) : void 0);
@@ -3016,24 +3025,169 @@ function checkActionParams(findings, ctx) {
   }
 }
 
-// src/flow-walk.ts
-import { FLOW_REGION_SLOTS_BY_TYPE, FLOW_REGION_CONFIG_KEYS } from "@objectstack/spec/automation";
+// src/validate-translatable-sections.ts
+var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
 function isRec8(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName11(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
+function viewObjectName2(view) {
+  return strName11(view.objectName) ?? strName11(view.object) ?? (isRec8(view.data) ? strName11(view.data.object) : void 0);
+}
+function collectionEntries(v, base) {
+  if (Array.isArray(v)) {
+    const out = [];
+    for (let i = 0; i < v.length; i++) {
+      if (isRec8(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
+    }
+    return out;
+  }
+  if (isRec8(v)) {
+    return Object.entries(v).filter(([, def]) => isRec8(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
+  }
+  return [];
+}
+function viewLabel(view) {
+  const name = strName11(view.name);
+  return name ? `view "${name}"` : "";
+}
+function joinWhere(...parts) {
+  return parts.filter((p) => p.length > 0).join(" \xB7 ");
+}
+function collectViewSites(view, basePath, label2, sites) {
+  const recordObject = viewObjectName2(view);
+  const listBinding = isRec8(view.list) ? viewObjectName2(view.list) ?? recordObject : void 0;
+  const bindingOf = (container) => viewObjectName2(container) ?? recordObject;
+  sites.push({
+    path: `${basePath}.sections`,
+    surface: label2,
+    objectName: recordObject ?? listBinding,
+    sections: view.sections
+  });
+  if (isRec8(view.form)) {
+    sites.push({
+      path: `${basePath}.form.sections`,
+      surface: joinWhere(label2, "form"),
+      objectName: bindingOf(view.form) ?? listBinding,
+      sections: view.form.sections
+    });
+  }
+  for (const key of ["listViews", "formViews"]) {
+    const container = view[key];
+    if (!isRec8(container)) continue;
+    for (const [subKey, sub] of Object.entries(container)) {
+      if (!isRec8(sub)) continue;
+      sites.push({
+        path: `${basePath}.${key}.${subKey}.sections`,
+        surface: joinWhere(label2, `${key}.${subKey}`),
+        objectName: bindingOf(sub) ?? listBinding,
+        sections: sub.sections
+      });
+    }
+  }
+}
+function translatedObjectNames(stack) {
+  const out = /* @__PURE__ */ new Set();
+  const bundles = Array.isArray(stack.translations) ? stack.translations : [];
+  for (const bundle of bundles) {
+    if (!isRec8(bundle)) continue;
+    for (const data of Object.values(bundle)) {
+      if (!isRec8(data) || !isRec8(data.objects)) continue;
+      for (const [objectName, node] of Object.entries(data.objects)) {
+        if (isRec8(node)) out.add(objectName);
+      }
+    }
+  }
+  return out;
+}
+function suggestedName(label2) {
+  const slug = label2.toLowerCase().replace(/&/g, " and ").replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return slug.length > 0 ? slug : void 0;
+}
+function validateTranslatableSections(stack) {
+  const findings = [];
+  if (!isRec8(stack)) return findings;
+  const translated = translatedObjectNames(stack);
+  if (translated.size === 0) return findings;
+  const sites = [];
+  for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
+    const objectName = strName11(obj.name);
+    if (!objectName) continue;
+    for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
+      collectViewSites(
+        { ...view, object: strName11(view.object) ?? objectName },
+        path,
+        viewLabel(view),
+        sites
+      );
+    }
+    if (isRec8(obj.listViews)) {
+      collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
+    }
+  }
+  for (const { rec: view, path } of collectionEntries(stack.views, "views")) {
+    collectViewSites(view, path, viewLabel(view), sites);
+  }
+  for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
+    const pageName = strName11(page.name);
+    const pageLabel = pageName ? `page "${pageName}"` : "";
+    for (const walked of walkPageComponents(page, pagePath)) {
+      if (!walked.objectName) continue;
+      const props = isRec8(walked.component.properties) ? walked.component.properties : void 0;
+      if (!props) continue;
+      const type = strName11(walked.component.type) ?? "component";
+      sites.push({
+        path: `${walked.path}.properties.sections`,
+        surface: joinWhere(pageLabel, type),
+        objectName: walked.objectName,
+        sections: props.sections
+      });
+    }
+  }
+  for (const site of sites) {
+    const objectName = site.objectName;
+    if (!objectName || !translated.has(objectName)) continue;
+    if (!Array.isArray(site.sections)) continue;
+    for (let i = 0; i < site.sections.length; i++) {
+      const section = site.sections[i];
+      if (!isRec8(section)) continue;
+      if (strName11(section.name)) continue;
+      const heading = strName11(section.label) ?? strName11(section.title);
+      if (!heading) continue;
+      const slug = suggestedName(heading);
+      findings.push({
+        severity: "warning",
+        rule: TRANSLATION_SECTION_NAME_MISSING,
+        where: joinWhere(`object "${objectName}"`, site.surface, `section "${heading}"`),
+        path: `${site.path}[${i}]`,
+        message: `Section "${heading}" declares a label but no \`name\`. Headings resolve through \`objects.${objectName}._sections.<name>.label\`, so a section with no name has no key a bundle can carry \u2014 this heading can never be translated and renders in the source locale in EVERY locale. Object "${objectName}" IS translated, which is what makes the hole invisible: every neighbouring label resolves and only the heading stays behind. The i18n coverage report cannot see it either \u2014 it walks \`sections[].name\`, and a nameless section contributes nothing to walk.`,
+        hint: `Give the section a stable \`name\` (snake_case)` + (slug ? `, e.g. \`name: '${slug}'\`` : "") + `, then translate it as \`objects.${objectName}._sections.${slug ?? "<name>"}.label\` in each locale bundle. The renderers look the heading up by name only \u2014 the name above is a suggestion to write down, never a key derived from the label, so renaming the heading later cannot break the lookup.`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/flow-walk.ts
+import { FLOW_REGION_SLOTS_BY_TYPE, FLOW_REGION_CONFIG_KEYS } from "@objectstack/spec/automation";
+function isRec9(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName12(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
 var REGION_SLOTS = new Map(
   [...FLOW_REGION_SLOTS_BY_TYPE].map(([type, slots]) => [type, slots.map((s) => s.key)])
 );
 var REGION_CONFIG_KEYS = FLOW_REGION_CONFIG_KEYS;
 var MAX_REGION_DEPTH = 16;
 function flowNodeLabel(node, index) {
-  return strName11(node.label) ?? strName11(node.id) ?? `#${index}`;
+  return strName12(node.label) ?? strName12(node.id) ?? `#${index}`;
 }
 function stripRegions(config) {
-  if (!isRec8(config)) return void 0;
+  if (!isRec9(config)) return void 0;
   let out;
   for (const key of Object.keys(config)) {
     if (!REGION_CONFIG_KEYS.has(key)) continue;
@@ -3044,11 +3198,11 @@ function stripRegions(config) {
 }
 function walkFlowNodes(flow, flowPath) {
   const out = [];
-  if (!isRec8(flow)) return out;
+  if (!isRec9(flow)) return out;
   const visitList = (nodes, basePath, trail, depth) => {
     if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
     nodes.forEach((raw, index) => {
-      if (!isRec8(raw)) return;
+      if (!isRec9(raw)) return;
       const path = `${basePath}[${index}]`;
       out.push({
         node: raw,
@@ -3057,9 +3211,9 @@ function walkFlowNodes(flow, flowPath) {
         regionTrail: trail,
         depth
       });
-      const type = strName11(raw.type);
+      const type = strName12(raw.type);
       const slots = type ? REGION_SLOTS.get(type) : void 0;
-      if (!slots || !isRec8(raw.config)) return;
+      if (!slots || !isRec9(raw.config)) return;
       const config = raw.config;
       const here = `${type} "${flowNodeLabel(raw, index)}"`;
       for (const slot of slots) {
@@ -3067,8 +3221,8 @@ function walkFlowNodes(flow, flowPath) {
         if (slot === "branches") {
           if (!Array.isArray(value)) continue;
           value.forEach((branch, b) => {
-            if (!isRec8(branch)) return;
-            const branchName = strName11(branch.name) ?? `#${b}`;
+            if (!isRec9(branch)) return;
+            const branchName = strName12(branch.name) ?? `#${b}`;
             visitList(
               branch.nodes,
               `${path}.config.branches[${b}].nodes`,
@@ -3078,7 +3232,7 @@ function walkFlowNodes(flow, flowPath) {
           });
           continue;
         }
-        if (!isRec8(value)) continue;
+        if (!isRec9(value)) continue;
         visitList(
           value.nodes,
           `${path}.config.${slot}.nodes`,
@@ -3303,7 +3457,7 @@ function asArray16(v) {
   }
   return [];
 }
-function strName12(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -3314,17 +3468,17 @@ function validateAiSurfaceAffinity(stack) {
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
   for (const skill of asArray16(stack.skills)) {
-    const n = strName12(skill.name);
+    const n = strName13(skill.name);
     if (n) skillsByName.set(n, skill);
   }
   const agents = asArray16(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName12(agent.name) ?? `#${ai}`;
+    const agentName = strName13(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName12(skillRefs[si]);
+      const ref = strName13(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -3353,7 +3507,7 @@ function asArray17(v) {
   }
   return [];
 }
-function strName13(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance6(a, b) {
@@ -3394,8 +3548,8 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName13(aiRec.description)) return false;
-  const type = strName13(action.type);
+  if (!strName14(aiRec.description)) return false;
+  const type = strName14(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
@@ -3403,12 +3557,12 @@ function materialisesAsTool(action) {
 function collectToolUniverse(stack) {
   const universe = new Set(PLATFORM_PROVIDED_TOOL_NAMES);
   for (const tool of asArray17(stack.tools)) {
-    const n = strName13(tool.name);
+    const n = strName14(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
     for (const action of asArray17(actions)) {
-      const n = strName13(action.name);
+      const n = strName14(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
@@ -3422,7 +3576,7 @@ function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
     for (const action of asArray17(actions)) {
-      const n = strName13(action.name);
+      const n = strName14(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
@@ -3448,10 +3602,10 @@ function validateAiToolReferences(stack) {
   const skills = asArray17(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName13(skill.name) ?? `#${si}`;
+    const skillName = strName14(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName13(refs[ti]);
+      const ref = strName14(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -3477,7 +3631,7 @@ function asArray18(v) {
   }
   return [];
 }
-function strName14(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
@@ -3487,7 +3641,7 @@ function validateAiAgentAuthoring(stack) {
   const agents = asArray18(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName14(agent.name) ?? `#${ai}`;
+    const name = strName15(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -3585,13 +3739,13 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec9 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec10 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray19(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec9(x));
-  if (isRec9(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec10(x));
+  if (isRec10(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec9(def) ? def : {}
+      ...isRec10(def) ? def : {}
     }));
   }
   return [];
@@ -3737,7 +3891,7 @@ function validateHookBodyWrites(stack) {
   let objectFields = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec9(body) || body.language !== "js") return;
+    if (!isRec10(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
@@ -3808,13 +3962,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec10 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec11 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray20(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec10(x));
-  if (isRec10(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec11(x));
+  if (isRec11(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec10(def) ? def : {}
+      ...isRec11(def) ? def : {}
     }));
   }
   return [];
@@ -3832,7 +3986,7 @@ function collectActionBodies(stack) {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec10(body) || body.language !== "js") return;
+      if (!isRec11(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -3851,7 +4005,7 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec10(stack)) return findings;
+  if (!isRec11(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
@@ -3909,13 +4063,13 @@ function fixHint2(field, declared) {
 import { findClosestMatches as findClosestMatches3, formatSuggestion as formatSuggestion3 } from "@objectstack/spec/shared";
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
-var isRec11 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray21(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec11(x));
-  if (isRec11(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec12(x));
+  if (isRec12(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec11(def) ? def : {}
+      ...isRec12(def) ? def : {}
     }));
   }
   return [];
@@ -3928,7 +4082,7 @@ function readLiteralObjectName(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec11(stack)) return findings;
+  if (!isRec12(stack)) return findings;
   const flows = asArray21(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
@@ -3937,10 +4091,10 @@ function validateFlowNodeWrites(stack) {
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec11(node.config) ? node.config : void 0;
+      const config = isRec12(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec11(fields)) return;
+      if (!isRec12(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName(config);
@@ -4068,10 +4222,50 @@ import {
   REACT_BLOCKS,
   RECORD_CONTEXT_BLOCK_TAGS,
   REACT_RECORD_BLOCK_ALTERNATIVES,
+  ChartAggregateSchema,
+  ChartDrillDownSchema,
   chartAggregateResultKeys,
   isRecordContextBlockType
 } from "@objectstack/spec/ui";
 import { VALID_AST_OPERATORS } from "@objectstack/spec/data";
+
+// src/zod-issue-format.ts
+var isRec13 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var valueAtPath = (root, path) => {
+  let cur = root;
+  for (const key of path) {
+    if (!isRec13(cur) && !Array.isArray(cur)) return void 0;
+    cur = cur[key];
+  }
+  return cur;
+};
+var preview = (value) => {
+  let text;
+  try {
+    text = JSON.stringify(value) ?? String(value);
+  } catch {
+    text = String(value);
+  }
+  return text.length > 80 ? `${text.slice(0, 77)}\u2026` : text;
+};
+function describeIssue(issue, root, depth = 0) {
+  const value = depth === 0 ? valueAtPath(root, issue.path) : void 0;
+  const seen = depth > 0 || issue.code === "custom" || issue.message.includes("received ") ? "" : value === void 0 ? " (nothing is set there)" : ` (received ${preview(value)})`;
+  const armIssues = issue.code === "invalid_union" ? issue.errors : void 0;
+  if (!armIssues || armIssues.length === 0) {
+    return `${issue.message}${seen}`;
+  }
+  const arms = armIssues.map(
+    (arm) => arm.map((inner) => {
+      const where = inner.path.length ? `${inner.path.join(".")} \u2014 ` : "";
+      return `${where}${describeIssue(inner, root, depth + 1)}`;
+    }).join("; ")
+  ).filter((text) => text.length > 0);
+  if (arms.length === 0) return `${issue.message}${seen}`;
+  return `${issue.message}${seen} \u2014 no accepted form matched: ` + arms.map((text, i) => `(${i + 1}) ${text}`).join(" ");
+}
+
+// src/validate-react-page-props.ts
 var cachedTs2 = null;
 function loadTypeScript2() {
   if (cachedTs2) return cachedTs2;
@@ -4175,35 +4369,78 @@ function filterAttrValue(tsc, sf, attr) {
 var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
-var CHART_FUNCTIONS = ["count", "sum", "avg", "min", "max"];
-var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
+function checkChartDrillDown(raw, push2) {
+  if (raw === void 0 || raw === NOT_STATIC) return;
+  if (!isRec14(raw)) {
+    push2(
+      "error",
+      REACT_CHART_DRILLDOWN_INVALID,
+      `drillDown must be a configuration object, not ${Array.isArray(raw) ? "an array" : typeof raw}.`,
+      "Write drillDown={{ \u2026 }} \u2014 or, to turn the drill on with all defaults, drillDown={{}}. Omit the prop entirely to leave drill off."
+    );
+    return;
+  }
+  const parsed = ChartDrillDownSchema.safeParse(raw);
+  if (parsed.success) return;
+  for (const issue of parsed.error.issues) {
+    const at = issue.path.length ? `drillDown.${issue.path.join(".")}` : "drillDown";
+    push2(
+      "error",
+      REACT_CHART_DRILLDOWN_INVALID,
+      `${at}: ${issue.message}`,
+      "The drill config is declared by ChartDrillDownSchema (@objectstack/spec/ui) \u2014 the rejection above carries the fix."
+    );
+  }
+}
+function checkChartAggregate(raw, push2) {
+  if (raw === void 0 || raw === NOT_STATIC) return;
+  if (!isRec14(raw)) {
+    push2(
+      "error",
+      REACT_CHART_AGGREGATE_INVALID,
+      `aggregate must be a configuration object, not ${Array.isArray(raw) ? "an array" : typeof raw}.`,
+      'Write aggregate={{ function: "count", groupBy: "<field>" }} \u2014 or bind data={\u2026} instead to chart precomputed rows.'
+    );
+    return;
+  }
+  const groupByAbsent = raw.groupBy === void 0;
+  if (groupByAbsent) {
+    push2(
+      "warning",
+      REACT_CHART_AGGREGATE_INVALID,
+      "aggregate.groupBy is not set, so the aggregate returns ONE ungrouped row and the chart plots a single point.",
+      "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. Deliberate single-value charts are tolerated at warning level for now: ChartAggregateSchema declares groupBy required while ObjectChart honours its absence by falling back to xAxisKey \u2014 objectstack#5583 decides which of the two moves."
+    );
+  }
+  const parsed = ChartAggregateSchema.safeParse(raw);
+  if (parsed.success) return;
+  for (const issue of parsed.error.issues) {
+    if (groupByAbsent && issue.path[0] === "groupBy") continue;
+    const at = issue.path.length ? `aggregate.${issue.path.join(".")}` : "aggregate";
+    push2(
+      "error",
+      REACT_CHART_AGGREGATE_INVALID,
+      `${at}: ${describeIssue(issue, raw)}`,
+      "The aggregate is declared by ChartAggregateSchema (@objectstack/spec/ui) \u2014 the rejection above carries the fix."
+    );
+  }
+}
+var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
 function checkObjectChart(attrs, objectFields, findings) {
   const { values, where, path } = attrs;
   const push2 = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
+  checkChartDrillDown(values.get("drillDown"), push2);
   if (values.has("data")) return;
   const aggregate = values.get("aggregate");
+  checkChartAggregate(aggregate, push2);
   if (aggregate === void 0 || aggregate === NOT_STATIC) return;
-  if (!isRec12(aggregate)) return;
+  if (!isRec14(aggregate)) return;
   const fn = strOf(aggregate.function);
   const field = strOf(aggregate.field);
   const groupBy = aggregate.groupBy;
-  const groupByField = strOf(groupBy) ?? (isRec12(groupBy) ? strOf(groupBy.field) : void 0);
-  if (fn && !CHART_FUNCTIONS.includes(fn)) {
-    push2(
-      "error",
-      REACT_CHART_AGGREGATE_INVALID,
-      `aggregate.function "${fn}" is not an aggregation this chart can run.`,
-      `Use one of: ${CHART_FUNCTIONS.join(", ")}.`
-    );
-  } else if (fn && fn !== "count" && !field) {
-    push2(
-      "error",
-      REACT_CHART_AGGREGATE_INVALID,
-      `aggregate.function "${fn}" has no "field" to aggregate.`,
-      'Add aggregate.field, or use function "count" (the only one that may omit it).'
-    );
-  }
+  const groupByField = strOf(groupBy) ?? (isRec14(groupBy) ? strOf(groupBy.field) : void 0);
   const objectName = strOf(values.get("objectName"));
   const known = objectName ? objectFields.get(objectName) : void 0;
   if (objectName && known) {
@@ -4236,18 +4473,18 @@ function checkObjectChart(attrs, objectFields, findings) {
     );
   };
   const xAxisRaw = values.get("xAxis");
-  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec12(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec14(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
   const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
   axisRef(categoryAxis, categoryProp);
   const yAxisRaw = values.get("yAxis");
   const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
   for (const a of yAxisList) {
-    axisRef(strOf(a) ?? (isRec12(a) ? strOf(a.field) : void 0), "yAxis[].field");
+    axisRef(strOf(a) ?? (isRec14(a) ? strOf(a.field) : void 0), "yAxis[].field");
   }
   const series = values.get("series");
   if (Array.isArray(series)) {
     for (const s of series) {
-      if (!isRec12(s)) continue;
+      if (!isRec14(s)) continue;
       const dataKey = strOf(s.dataKey);
       axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
     }
@@ -4303,7 +4540,7 @@ function subformFieldRefs(value, basePath) {
   if (!Array.isArray(value)) return { child, parent };
   for (let i = 0; i < value.length; i++) {
     const sub = value[i];
-    if (!isRec12(sub)) continue;
+    if (!isRec14(sub)) continue;
     const at = (key) => `${basePath}[${i}].${key}`;
     child.push({
       objectName: strOf(sub.childObject),
@@ -4348,20 +4585,20 @@ function reactFieldRefs(spec, values, basePath) {
   }
   for (const key of spec.nestedFields ?? []) {
     const v = readable(key);
-    if (isRec12(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+    if (isRec14(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
   }
   for (const key of spec.sections ?? []) {
     const v = readable(key);
     if (!Array.isArray(v)) continue;
     for (let i = 0; i < v.length; i++) {
       const section = v[i];
-      if (!isRec12(section)) continue;
+      if (!isRec14(section)) continue;
       own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
     }
   }
   for (const key of spec.keyedByField ?? []) {
     const v = readable(key);
-    if (!isRec12(v)) continue;
+    if (!isRec14(v)) continue;
     for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
   }
   for (const key of spec.filterArrays ?? []) {
@@ -4551,6 +4788,14 @@ var REFERENCE_INTEGRITY_RULES = [
   // `component` (an unregistered ref renders a named diagnostic, not silence).
   { name: "validateNavTargetRefs", run: validateNavTargetRefs },
   { name: "validateTranslationReferences", run: validateTranslationReferences },
+  // The same family from the other end (#5417). Its sibling above asks "does
+  // this bundle key resolve?"; this one asks "is there a key at all?" — a form
+  // section authored with a `label` and no `name` renders a heading that
+  // `_sections` (keyed by name) can never address, so neither the orphan check
+  // nor the coverage walk can see it. A reference that cannot be written is
+  // still a reference question, and warning-only for the same reason its
+  // sibling is: one heading stays in the source locale, nothing breaks.
+  { name: "validateTranslatableSections", run: validateTranslatableSections },
   { name: "validateFlowTemplatePaths", run: validateFlowTemplatePaths },
   { name: "validateAiSurfaceAffinity", run: validateAiSurfaceAffinity },
   { name: "validateAiToolReferences", run: validateAiToolReferences },
@@ -4635,6 +4880,90 @@ function validateReferenceIntegrity(stack) {
   return findings;
 }
 
+// src/validate-component-props.ts
+import { ComponentPropsMap } from "@objectstack/spec/ui";
+import { lintUnknownKeysAgainstSchema } from "@objectstack/spec";
+var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
+var COMPONENT_PROPS_INVALID = "component-props-invalid";
+function isRec15(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName16(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function asArray24(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+var PROPS_SCHEMAS = ComponentPropsMap;
+var DATASOURCE_SUPPLIED_PROP = "object";
+function suppliedByDataSource(issue, component) {
+  if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
+  const dataSource = isRec15(component.dataSource) ? component.dataSource : void 0;
+  return strName16(dataSource?.object) !== void 0;
+}
+function validateComponentProps(stack) {
+  const findings = [];
+  if (!isRec15(stack)) return findings;
+  const pages = asArray24(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    const page = pages[pi];
+    if (!isRec15(page)) continue;
+    const pageName = strName16(page.name) ?? `#${pi}`;
+    for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
+      const type = strName16(component.type);
+      if (!type) continue;
+      const schema = PROPS_SCHEMAS[type];
+      if (!schema) continue;
+      const props = isRec15(component.properties) ? component.properties : void 0;
+      if (!props) continue;
+      const where = `page "${pageName}" \xB7 ${type}`;
+      const base = `${path}.properties`;
+      for (const f of lintUnknownKeysAgainstSchema(schema, props, type, base)) {
+        findings.push({
+          severity: "warning",
+          rule: COMPONENT_PROPS_UNKNOWN_KEY,
+          where,
+          path: f.path,
+          message: `\`${f.key}\` is not a prop \`${type}\` declares (ComponentPropsMap, @objectstack/spec/ui), so nothing verifies it: \`properties\` is an untyped bag, the renderer spreads whatever it carries, and a key it does not read is ignored in silence.` + (f.suggestion ? ` Did you mean \`${f.suggestion}\`?` : ""),
+          hint: f.guidance ?? (f.suggestion ? `Rename \`${f.key}\` \u2192 \`${f.suggestion}\`.` : `Remove \`${f.key}\`, or \u2014 if the component really does honour it \u2014 declare it on \`${type}\`'s props schema so the declaration and the renderer agree.`)
+        });
+      }
+      const parsed = schema.safeParse(props);
+      if (parsed.success) continue;
+      for (const issue of parsed.error?.issues ?? []) {
+        if (suppliedByDataSource(issue, component)) continue;
+        const at = issue.path.length ? `${base}.${issue.path.join(".")}` : base;
+        if (issue.code === "unrecognized_keys") {
+          for (const key of issue.keys ?? []) {
+            findings.push({
+              severity: "warning",
+              rule: COMPONENT_PROPS_UNKNOWN_KEY,
+              where,
+              path: `${at}.${key}`,
+              message: `\`${key}\` is not a prop \`${type}\` declares (ComponentPropsMap, @objectstack/spec/ui): ${issue.message}`,
+              hint: `Remove \`${key}\`, or declare it on \`${type}\`'s props schema if the component honours it.`
+            });
+          }
+          continue;
+        }
+        findings.push({
+          severity: "warning",
+          rule: COMPONENT_PROPS_INVALID,
+          where,
+          path: at,
+          message: `${at.slice(base.length + 1) || "properties"}: ${describeIssue(issue, props)}`,
+          hint: `\`${type}\`'s props are declared by ComponentPropsMap (@objectstack/spec/ui) \u2014 the rejection above carries the fix. Advisory for now: the props bag is not parsed on the storage path either, so nothing rejects this today (objectstack#5068).`
+        });
+      }
+    }
+  }
+  return findings;
+}
+
 // src/validate-responsive-styles.ts
 var STYLE_NODE_MISSING_ID = "style-node-missing-id";
 var STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
@@ -4838,7 +5167,7 @@ function looksLikeTailwind(className) {
     return false;
   });
 }
-function asArray24(v) {
+function asArray25(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -4931,13 +5260,13 @@ function checkNode(node, pageName, path, findings) {
 }
 function validateResponsiveStyles(stack) {
   const findings = [];
-  const pages = asArray24(stack.pages);
+  const pages = asArray25(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     const pageName = typeof page.name === "string" ? page.name : `pages[${p}]`;
-    const regions = asArray24(page.regions);
+    const regions = asArray25(page.regions);
     for (let r = 0; r < regions.length; r++) {
-      const components = asArray24(regions[r].components);
+      const components = asArray25(regions[r].components);
       for (let c = 0; c < components.length; c++) {
         checkNode(components[c], pageName, `pages[${p}].regions[${r}].components[${c}]`, findings);
       }
@@ -4948,10 +5277,10 @@ function validateResponsiveStyles(stack) {
 
 // src/validate-jsx-pages.ts
 import { parseJsx, compile } from "@objectstack/sdui-parser";
-var asArray25 = (v) => Array.isArray(v) ? v : [];
+var asArray26 = (v) => Array.isArray(v) ? v : [];
 function validateJsxPages(stack, opts = {}) {
   const findings = [];
-  const pages = asArray25(stack.pages);
+  const pages = asArray26(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "html" && page.kind !== "jsx") continue;
@@ -4998,10 +5327,10 @@ function loadSucraseTransform() {
   }
   return cachedTransform;
 }
-var asArray26 = (v) => Array.isArray(v) ? v : [];
+var asArray27 = (v) => Array.isArray(v) ? v : [];
 function validateReactPages(stack) {
   const findings = [];
-  const pages = asArray26(stack.pages);
+  const pages = asArray27(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -5038,11 +5367,11 @@ function validateReactPages(stack) {
 
 // src/validate-page-source-styling.ts
 var PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-var asArray27 = (v) => Array.isArray(v) ? v : [];
+var asArray28 = (v) => Array.isArray(v) ? v : [];
 var CLASSNAME_ATTR = /\bclassName\s*=\s*["'{]/g;
 function validatePageSourceStyling(stack) {
   const findings = [];
-  const pages = asArray27(stack.pages);
+  const pages = asArray28(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page) continue;
@@ -5070,7 +5399,7 @@ function validatePageSourceStyling(stack) {
 // src/validate-capability-references.ts
 import { PLATFORM_CAPABILITY_NAMES } from "@objectstack/spec/security";
 var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
-function asArray28(v) {
+function asArray29(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5095,13 +5424,13 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(PLATFORM_CAPABILITY_NAMES);
-  for (const cap of asArray28(stack.capabilities)) {
+  for (const cap of asArray29(stack.capabilities)) {
     if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
   }
-  for (const ps of asArray28(stack.permissions)) {
+  for (const ps of asArray29(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
-  for (const seed of asArray28(stack.data)) {
+  for (const seed of asArray29(stack.data)) {
     if (seed.object !== "sys_capability") continue;
     for (const rec of Array.isArray(seed.records) ? seed.records : []) {
       const name = rec?.name;
@@ -5120,7 +5449,7 @@ function validateCapabilityReferences(stack) {
       hint
     });
   };
-  const objects = asArray28(stack.objects);
+  const objects = asArray29(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -5129,27 +5458,27 @@ function validateCapabilityReferences(stack) {
     for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
       flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
     }
-    const fields = asArray28(obj.fields);
+    const fields = asArray29(obj.fields);
     for (const f of fields) {
       const fname = typeof f.name === "string" ? f.name : "(field)";
       for (const cap of asCapArray(f.requiredPermissions)) {
         flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
       }
     }
-    for (const [ai, action] of asArray28(obj.actions).entries()) {
+    for (const [ai, action] of asArray29(obj.actions).entries()) {
       const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
       for (const cap of asCapArray(action.requiredPermissions)) {
         flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
       }
     }
   }
-  for (const [i, action] of asArray28(stack.actions).entries()) {
+  for (const [i, action] of asArray29(stack.actions).entries()) {
     const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
     for (const cap of asCapArray(action.requiredPermissions)) {
       flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
     }
   }
-  const apps = asArray28(stack.apps);
+  const apps = asArray29(stack.apps);
   for (let i = 0; i < apps.length; i++) {
     const app = apps[i];
     if (!app || typeof app !== "object") continue;
@@ -5176,11 +5505,14 @@ function validateCapabilityReferences(stack) {
 }
 
 // src/validate-flow-trigger-readiness.ts
+import { TimeRelativeTriggerSchema } from "@objectstack/spec/automation";
 var FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 var FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
 var FLOW_TRIGGER_UNKNOWN_EVENT = "flow-trigger-unknown-event";
+var FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID = "flow-time-relative-descriptor-invalid";
+var FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-descriptor-unroutable";
 var VALID_RECORD_TRIGGER = /^record-(?:before|after)-(?:create|insert|update|delete|write)$/;
-function asArray29(v) {
+function asArray30(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({
@@ -5190,6 +5522,12 @@ function asArray29(v) {
   }
   return [];
 }
+function renderNonObject(v) {
+  const t = typeof v;
+  if (t === "string" || t === "number" || t === "boolean") return `${JSON.stringify(v)} (a ${t})`;
+  if (t === "bigint") return `${String(v)}n (a bigint)`;
+  return `a ${t}`;
+}
 function startNodeOf(flow) {
   const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
   const index = nodes.findIndex((n) => n?.type === "start");
@@ -5197,10 +5535,10 @@ function startNodeOf(flow) {
 }
 function validateFlowTriggerReadiness(stack) {
   const findings = [];
-  const flows = asArray29(stack.flows);
+  const flows = asArray30(stack.flows);
   if (flows.length === 0) return findings;
   const objectNames = new Set(
-    asArray29(stack.objects).map((o) => typeof o.name === "string" ? o.name : void 0).filter((n) => !!n)
+    asArray30(stack.objects).map((o) => typeof o.name === "string" ? o.name : void 0).filter((n) => !!n)
   );
   flows.forEach((flow, flowIndex) => {
     const flowName = typeof flow.name === "string" ? flow.name : `#${flowIndex}`;
@@ -5237,10 +5575,35 @@ function validateFlowTriggerReadiness(stack) {
           hint: `Object names match exactly. Check config.timeRelative.object against the object's registered name. If the object comes from another installed package, this warning can be ignored.`
         });
       }
+      const parsed = TimeRelativeTriggerSchema.safeParse(tr);
+      if (!parsed.success) {
+        const problems = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message.replace(/\s+/g, " ").trim()}`).join("; ");
+        findings.push({
+          // `error` (#5762): the verdict is `TimeRelativeTriggerSchema`'s, and it
+          // is the same schema the trigger safeParses at bind time. A descriptor
+          // it refuses is refused at bind too — the sweep is never installed, on
+          // every deployment, with no installed package able to change the
+          // answer. Nothing is left for the author to weigh.
+          severity: "error",
+          rule: FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID,
+          where: `flow "${flowName}" \u203A start node`,
+          path: `flows[${flowIndex}].nodes[${start.index}].config.timeRelative`,
+          message: `has a config.timeRelative descriptor the time-relative trigger REFUSES at bind time, so the sweep is never installed \u2014 the flow declares a time-relative trigger and then never runs (the only trace is one warn in the server log). ${problems}`,
+          hint: `Those messages are TimeRelativeTriggerSchema's own \u2014 the same schema the trigger safeParses at bind time, so a descriptor that satisfies them binds. An unrecognized key names the declared key it was probably meant to be; see content/docs/references/automation/time-relative-trigger.mdx.`
+        });
+      }
     }
     if (start && isRecordTriggered2 && !VALID_RECORD_TRIGGER.test((triggerType ?? "").trim())) {
       findings.push({
-        severity: "warning",
+        // `error` (#5762). The token grammar is CLOSED and local: the engine
+        // routes any `record-`-prefixed string to the record-change trigger by a
+        // hardcoded prefix test (no registry lookup, so installing a package
+        // cannot claim a new `record-*` token), and that trigger maps the token
+        // with `triggerTypeToHookEvents` — the same regex this file's
+        // `VALID_RECORD_TRIGGER` mirrors. Off-grammar means zero hook events,
+        // which means bound-to-nothing on every deployment. Unlike an object
+        // name, there is no other-package reading that rescues it.
+        severity: "error",
         rule: FLOW_TRIGGER_UNKNOWN_EVENT,
         where: `flow "${flowName}" \u203A start node`,
         path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
@@ -5250,7 +5613,14 @@ function validateFlowTriggerReadiness(stack) {
     }
     if (start && isArrayRecordTriggered) {
       findings.push({
-        severity: "warning",
+        // `error` (#5762), same id and same reason as 1c: an array maps to no
+        // hook event either. The engine routes it to the record-change trigger
+        // for the express purpose of making it loud, and its own comment names
+        // THIS rule as the primary catch — a primary catch that only warns is
+        // the "declared ≠ enforced" shape the registry's tier exists to close.
+        // Multi-event arrays are deferred, not unsupported-by-accident (#3457),
+        // so if they land the grammar widens here in the same commit.
+        severity: "error",
         rule: FLOW_TRIGGER_UNKNOWN_EVENT,
         where: `flow "${flowName}" \u203A start node`,
         path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
@@ -5258,6 +5628,25 @@ function validateFlowTriggerReadiness(stack) {
         hint: `Use one triggerType string. For "created or updated" use record-after-write (one flow, both events, #3427). For any other combination, author one flow per event \u2014 multi-event arrays are deferred (#3457).`
       });
     }
+    if (start && config.timeRelative != null && typeof config.timeRelative !== "object") {
+      const fallback = isRecordTriggered2 || isArrayRecordTriggered ? "its record-change trigger" : config.schedule != null || flow.type === "schedule" ? "its plain `config.schedule` cadence" : triggerType === "api" || flow.type === "api" ? "its api trigger" : void 0;
+      const consequence2 = fallback ? `The flow still binds through ${fallback}, so the descriptor is silently DROPPED \u2014 it fires on that trigger's terms (once per firing, with no record on the context) instead of once per matching record, and nothing anywhere reports the difference.` : `Nothing else on this start node declares a trigger either, so the flow binds to NOTHING and never fires \u2014 with zero diagnostics at any layer, not even the one bind-time warn a descriptor that IS an object gets when the trigger refuses it.`;
+      findings.push({
+        // `error` (#5762). The criterion IS the engine's routing predicate, so a
+        // value that fails it is not routed to the time-relative trigger by any
+        // deployment — the strongest verdict in this file, and the one case with
+        // no runtime channel to fall back on (not even the bind-time warn 1b-ii
+        // moves earlier). Note the two consequences below are both defects: one
+        // never fires, the other silently drops the descriptor. Neither is a
+        // shape the author can have meant, so both gate.
+        severity: "error",
+        rule: FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.timeRelative`,
+        message: `has config.timeRelative = ${renderNonObject(config.timeRelative)}, which is not the descriptor OBJECT this slot takes \u2014 the engine routes a flow to the time-relative sweep only when config.timeRelative is an object, so this one is never routed there and the sweep is never installed. ${consequence2}`,
+        hint: `config.timeRelative describes WHICH records to sweep \u2014 an object: { object, dateField, and exactly one of withinDays | offsetDays } (plus optional filter / maxRecords). A cadence like 'daily' is not a descriptor: HOW OFTEN the sweep runs is the sibling key config.schedule on the same start node (it defaults to daily, so it is usually omitted). See TimeRelativeTriggerSchema and content/docs/references/automation/time-relative-trigger.mdx.`
+      });
+    }
     if (isAutoTriggered && (flow.status == null || flow.status === "draft")) {
       findings.push({
         severity: "warning",
@@ -5283,7 +5672,7 @@ import {
   normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
 import { BUILTIN_MEMBERSHIP_ROLES } from "@objectstack/spec";
-import { collectCelRootIdentifiers } from "@objectstack/formula";
+import { collectCelRootIdentifiers as collectCelRootIdentifiers2 } from "@objectstack/formula";
 var APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 var APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
 var APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
@@ -5303,7 +5692,7 @@ var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
 };
-function asArray30(v) {
+function asArray31(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5313,7 +5702,7 @@ function asArray30(v) {
 function validateApprovalApprovers(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const flows = asArray30(stack.flows);
+  const flows = asArray31(stack.flows);
   const validTypes = new Set(ApproverType.options);
   for (let fi = 0; fi < flows.length; fi++) {
     const flow = flows[fi];
@@ -5358,7 +5747,7 @@ function validateApprovalApprovers(stack) {
               hint: `Write a CEL expression over current.* (the record's live state at node entry), trigger.* (the submit-time snapshot) or vars.* (flow variables), e.g. current.approvers_dynamic or vars.approval_lead.picked_departments.`
             });
           } else {
-            const parsed = collectCelRootIdentifiers(source);
+            const parsed = collectCelRootIdentifiers2(source);
             if (!parsed.ok) {
               findings.push({
                 severity: "error",
@@ -5496,7 +5885,7 @@ function validateApprovalApprovers(stack) {
 import { objectTitleCompleteness } from "@objectstack/spec/data";
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
-function asArray31(v) {
+function asArray32(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5505,7 +5894,7 @@ function asArray31(v) {
 }
 function validateRecordTitle(stack) {
   const findings = [];
-  const objects = asArray31(stack.objects);
+  const objects = asArray32(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
@@ -5541,7 +5930,7 @@ var FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 var FIELD_GROUP_EMPTY = "field-group-empty";
 var FIELD_GROUP_SHADOWED = "field-group-shadowed";
 var SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
-function asArray32(v) {
+function asArray33(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5550,7 +5939,7 @@ function asArray32(v) {
 }
 function validateSemanticRoles(stack) {
   const findings = [];
-  const objects = asArray32(stack.objects);
+  const objects = asArray33(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -5558,7 +5947,7 @@ function validateSemanticRoles(stack) {
     const where = `object "${objName}"`;
     const path = `objects[${i}]`;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? obj.fields : {};
-    const fieldNames = new Set(Object.keys(fields));
+    const fieldNames = /* @__PURE__ */ new Set([...Object.keys(fields), ...injectedColumnsFor(obj)]);
     const declaredGroups = new Set(
       (Array.isArray(obj.fieldGroups) ? obj.fieldGroups : []).filter((g) => !!g && typeof g === "object").map((g) => g.key).filter((k) => typeof k === "string" && k.length > 0)
     );
@@ -5645,7 +6034,7 @@ function validateSemanticRoles(stack) {
 // src/validate-form-layout.ts
 var FORM_FIELD_UNKNOWN = "form-field-unknown";
 var FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
-function asArray33(v) {
+function asArray34(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5670,13 +6059,13 @@ function boundObject(view) {
 function validateFormLayout(stack) {
   const findings = [];
   const objectFields = /* @__PURE__ */ new Map();
-  for (const obj of asArray33(stack.objects)) {
+  for (const obj of asArray34(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? Object.keys(obj.fields) : [];
     objectFields.set(name, new Set(fields));
   }
-  const views = asArray33(stack.views);
+  const views = asArray34(stack.views);
   for (let i = 0; i < views.length; i++) {
     const view = views[i];
     if (!view || typeof view !== "object") continue;
@@ -5816,7 +6205,7 @@ var VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 var CANONICAL = "visibleWhen";
 var ALIASES = ["visibleOn", "visibility"];
-function asArray34(v) {
+function asArray35(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5878,7 +6267,7 @@ function isFieldObject(entry) {
 function validateVisibilityPredicates(stack, opts = {}) {
   const layer = opts.layer ?? "runtime";
   const findings = [];
-  const views = asArray34(stack.views);
+  const views = asArray35(stack.views);
   for (let i = 0; i < views.length; i++) {
     const view = views[i];
     if (!view || typeof view !== "object") continue;
@@ -5901,7 +6290,7 @@ function validateVisibilityPredicates(stack, opts = {}) {
       }
     }
   }
-  const pages = asArray34(stack.pages);
+  const pages = asArray35(stack.pages);
   for (let i = 0; i < pages.length; i++) {
     const page = pages[i];
     if (!page || typeof page !== "object") continue;
@@ -5948,7 +6337,7 @@ var OWD_WIDTH = {
   public_read: 1,
   public_read_write: 2
 };
-function asArray35(v) {
+function asArray36(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5956,7 +6345,7 @@ function asArray35(v) {
   return [];
 }
 function owdOf(obj) {
-  return obj.sharingModel ?? obj.security?.sharingModel;
+  return obj.sharingModel;
 }
 function isSystemObject(obj) {
   return obj.isSystem === true || String(obj.name ?? "").startsWith("sys_");
@@ -5970,11 +6359,11 @@ function labelHasRoleWord(label2) {
   return /\brole(s)?\b/i.test(label2);
 }
 function refOf(def) {
-  const r = def.reference ?? def.reference_to;
+  const r = def.reference;
   return typeof r === "string" && r ? r : void 0;
 }
 function firstMasterDetailField(obj) {
-  for (const f of asArray35(obj.fields)) {
+  for (const f of asArray36(obj.fields)) {
     if (f.type === "master_detail") {
       return { name: String(f.name ?? "?"), parent: refOf(f) };
     }
@@ -5987,8 +6376,8 @@ function grantsObjectAccess(p) {
 function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray35(stack.objects);
-  const permissionSets = asArray35(stack.permissions);
+  const objects = asArray36(stack.objects);
+  const permissionSets = asArray36(stack.permissions);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -6117,10 +6506,10 @@ function validateSecurityPosture(stack, opts) {
     if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
     flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray35(obj.fields)) {
+    for (const f of asArray36(obj.fields)) {
       flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
     }
-    for (const [ai, action] of asArray35(obj.actions).entries()) {
+    for (const [ai, action] of asArray36(obj.actions).entries()) {
       flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
     }
   }
@@ -6129,19 +6518,19 @@ function validateSecurityPosture(stack, opts) {
     if (!ps || typeof ps !== "object") continue;
     flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
   }
-  for (const [i, pos] of asArray35(stack.positions).entries()) {
+  for (const [i, pos] of asArray36(stack.positions).entries()) {
     flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
   }
-  for (const [i, app] of asArray35(stack.apps).entries()) {
+  for (const [i, app] of asArray36(stack.apps).entries()) {
     flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
   }
-  for (const [i, book] of asArray35(stack.books).entries()) {
+  for (const [i, book] of asArray36(stack.books).entries()) {
     flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
   }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
-  for (const [i, book] of asArray35(stack.books).entries()) {
+  for (const [i, book] of asArray36(stack.books).entries()) {
     const audience = book.audience;
     if (!audience || typeof audience !== "object") continue;
     const setName = audience.permissionSet;
@@ -6219,7 +6608,7 @@ function validateSecurityPosture(stack, opts) {
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
   const nowMs = opts?.nowMs ?? Date.now();
-  for (const [i, seed] of asArray35(stack.data).entries()) {
+  for (const [i, seed] of asArray36(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
     if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
     const records = Array.isArray(seed.records) ? seed.records : [];
@@ -6263,7 +6652,8 @@ function validateSecurityPosture(stack, opts) {
 var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
 var ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
 var ORG_PARENT_FIELD = "parent_organization_id";
-function asArray36(v) {
+var BU_TREE_RECIPIENT_TYPES = /* @__PURE__ */ new Set(["business_unit", "unit_and_subordinates"]);
+function asArray37(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6273,6 +6663,15 @@ function asArray36(v) {
 function str(v) {
   return typeof v === "string" ? v : "";
 }
+function expressionText(v) {
+  if (typeof v === "string") return v;
+  if (v && typeof v === "object") {
+    const rec = v;
+    if (typeof rec.source === "string") return rec.source;
+    if (rec.ast !== void 0) return JSON.stringify(rec.ast) ?? "";
+  }
+  return "";
+}
 function isTenancyDisabled(object) {
   const tenancy = object.tenancy;
   if (tenancy && typeof tenancy === "object" && tenancy.enabled === false) return true;
@@ -6284,9 +6683,9 @@ var INHERITANCE_HINT = `Remove the ${ORG_PARENT_FIELD} reference. Cross-organiza
 function validateOrgAxisRedLines(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  const permissionSets = asArray36(cfg.permissions ?? cfg.permissionSets);
+  const permissionSets = asArray37(cfg.permissions);
   permissionSets.forEach((ps, psIndex) => {
-    asArray36(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+    asArray37(ps.rowLevelSecurity).forEach((policy, pIndex) => {
       for (const clause of ["using", "check"]) {
         if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
         findings.push({
@@ -6300,68 +6699,434 @@ function validateOrgAxisRedLines(stack) {
       }
     });
   });
-  const objects = asArray36(cfg.objects);
-  objects.forEach((object, oIndex) => {
-    const objectName = str(object.name) || String(oIndex);
-    asArray36(object.rowLevelSecurity ?? object.rls).forEach((policy, pIndex) => {
-      for (const clause of ["using", "check"]) {
-        if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
-        findings.push({
-          severity: "error",
-          rule: ORG_AXIS_PERMISSION_INHERITANCE,
-          where: `object "${objectName}" policy "${str(policy.name) || pIndex}"`,
-          path: `objects[${oIndex}].rowLevelSecurity[${pIndex}].${clause}`,
-          message: `RLS ${clause} reads \`${ORG_PARENT_FIELD}\`, which builds a permission hierarchy along the organization axis. ADR-0105 D6 forbids it: the org tree is a REPORTING dimension only.`,
-          hint: INHERITANCE_HINT
-        });
-      }
-    });
-  });
-  asArray36(cfg.sharingRules ?? cfg.sharing).forEach((rule, rIndex) => {
-    const criteria = JSON.stringify(rule.criteria ?? rule.filter ?? "");
-    const sharedTo = JSON.stringify(rule.sharedTo ?? rule.recipient ?? "");
-    if (criteria.includes(ORG_PARENT_FIELD) || sharedTo.includes(ORG_PARENT_FIELD)) {
+  asArray37(cfg.sharingRules).forEach((rule, rIndex) => {
+    const slots = [
+      { key: "condition", text: expressionText(rule.condition) },
+      { key: "sharedWith", text: JSON.stringify(rule.sharedWith ?? "") ?? "" }
+    ];
+    for (const slot of slots) {
+      if (!slot.text.includes(ORG_PARENT_FIELD)) continue;
       findings.push({
         severity: "error",
         rule: ORG_AXIS_PERMISSION_INHERITANCE,
         where: `sharing rule "${str(rule.name) || rIndex}"`,
-        path: `sharingRules[${rIndex}]`,
-        message: `Sharing rule reads \`${ORG_PARENT_FIELD}\`, granting access by walking the organization tree. ADR-0105 D6 forbids permission inheritance along the org axis.`,
+        path: `sharingRules[${rIndex}].${slot.key}`,
+        message: `Sharing rule ${slot.key} reads \`${ORG_PARENT_FIELD}\`, granting access by walking the organization tree. ADR-0105 D6 forbids permission inheritance along the org axis.`,
         hint: INHERITANCE_HINT
       });
     }
   });
   const tenancyDisabledObjects = new Set(
-    objects.filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
+    asArray37(cfg.objects).filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
   );
-  asArray36(cfg.sharingRules ?? cfg.sharing).forEach((rule, rIndex) => {
-    const target = str(rule.object ?? rule.objectName);
+  asArray37(cfg.sharingRules).forEach((rule, rIndex) => {
+    const target = str(rule.object);
     if (!target || !tenancyDisabledObjects.has(target)) return;
-    const sharedTo = rule.sharedTo ?? rule.recipient;
-    const recipientType = str(sharedTo?.type);
-    if (recipientType !== "business_unit") return;
+    const sharedWith = rule.sharedWith;
+    const recipientType = str(sharedWith?.type);
+    if (!BU_TREE_RECIPIENT_TYPES.has(recipientType)) return;
+    const reach = recipientType === "unit_and_subordinates" ? "a business unit AND every descendant unit" : "a business unit";
     findings.push({
       severity: "error",
       rule: ORG_AXIS_CROSS_ORG_BU_GRANT,
       where: `sharing rule "${str(rule.name) || rIndex}" on object "${target}"`,
-      path: `sharingRules[${rIndex}].sharedTo`,
-      message: `A business-unit sharing rule targets "${target}", which opted out of tenancy (\`tenancy.enabled: false\`). Platform-global objects carry no organization column, so this grant spans EVERY organization \u2014 a cross-organization business-unit grant, which ADR-0105 D6 forbids (BU trees are org-internal).`,
-      hint: `Either scope the object to organizations (drop \`tenancy.enabled: false\` so Layer 0 walls it), or share it to a position / permission-set audience instead of a business unit. A platform-global catalog that everyone should read wants an OWD of \`public_read\`, not a BU grant.`
+      path: `sharingRules[${rIndex}].sharedWith`,
+      message: `Sharing rule recipient \`${recipientType}\` (${reach}) targets "${target}", which opted out of tenancy (\`tenancy.enabled: false\`). Platform-global objects carry no organization column, so this grant spans EVERY organization \u2014 a cross-organization business-unit grant, which ADR-0105 D6 forbids (BU trees are org-internal).`,
+      hint: `Either scope the object to organizations (drop \`tenancy.enabled: false\` so Layer 0 walls it), or share it to a \`user\` / \`team\` / \`position\` audience instead \u2014 those expand flat, with no business-unit tree to resolve. A platform-global catalog that everyone should read wants an OWD of \`public_read\`, not a BU grant.`
+    });
+  });
+  return findings;
+}
+
+// src/validate-sharing-rule-enforceability.ts
+import { compileCelToFilter } from "@objectstack/formula";
+var SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
+var SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
+function asArray38(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function str2(v) {
+  return typeof v === "string" ? v : "";
+}
+function toCompilerInput(condition) {
+  if (typeof condition === "string") return condition.trim() ? condition : null;
+  if (condition && typeof condition === "object") {
+    const source = condition.source;
+    if (typeof source === "string" && source.trim()) return { source };
+  }
+  return null;
+}
+function sourceOf(condition) {
+  const input = toCompilerInput(condition);
+  if (typeof input === "string") return input;
+  return str2(input?.source);
+}
+var PUSHDOWN_SUBSET = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in`, `&&` `||` `!`, `== null` / `!= null`, and the string methods `startsWith` / `endsWith` / `contains` \u2014 over SINGLE-column `record.<field>` paths (ADR-0058 D2).";
+function validateSharingRuleEnforceability(stack) {
+  const findings = [];
+  const cfg = stack ?? {};
+  asArray38(cfg.sharingRules).forEach((rule, index) => {
+    const input = toCompilerInput(rule.condition);
+    if (input === null) return;
+    const result = compileCelToFilter(input, { variables: {} });
+    if (result.ok) return;
+    if (result.reason === "parse-error") return;
+    const name = str2(rule.name) || String(index);
+    const object = str2(rule.object);
+    const where = `sharing rule "${name}"${object ? ` on object "${object}"` : ""}`;
+    const path = `sharingRules[${index}].condition`;
+    const source = sourceOf(rule.condition);
+    const skipped = "so `bootstrapDeclaredSharingRules` SKIPS the rule at boot: it is never written to `sys_sharing_rule`, no `sys_record_share` grant is ever materialised, and the only signal is one WARN line in the boot log. The rule is declared and grants nothing (ADR-0049: an unlowerable condition is never seeded as a permissive match-all).";
+    if (result.reason === "unresolved-variable") {
+      findings.push({
+        severity: "error",
+        rule: SHARING_RULE_RUNTIME_VARIABLE_CONDITION,
+        where,
+        path,
+        message: `Sharing-rule condition \`${source}\` reads a runtime variable (${result.detail}), ` + skipped,
+        hint: "A criteria sharing rule is MATERIALISED: the seeder compiles ONE static `criteria_json` per rule and the evaluator writes `sys_record_share` rows from it, so there is no \"current user\" for the condition to read. Express per-user access with the mechanism that runs per request instead \u2014 an RLS policy on a permission set (`rowLevelSecurity[].using`, where `current_user.*` IS resolved), or the record-ownership path. Keep this rule for the part of the predicate that is a property of the RECORD (e.g. `record.stage == 'closed_won'`) and name the audience through `sharedWith`."
+      });
+      return;
+    }
+    findings.push({
+      severity: "error",
+      rule: SHARING_RULE_UNLOWERABLE_CONDITION,
+      where,
+      path,
+      message: `Sharing-rule condition \`${source}\` is outside the pushdown subset the runtime can compile (${result.detail}), ` + skipped,
+      hint: "Rewrite the predicate inside the lowerable subset. " + PUSHDOWN_SUBSET + " Two traps in particular: (1) `has(record.x)` is correct in an object VALIDATION rule, which is INTERPRETED, and wrong here, where the condition is COMPILED \u2014 write the null test as `record.x != null`; (2) a related-record path (`record.account.region`) is a join, which the compiler refuses by design (ADR-0055) \u2014 denormalise the value onto this object (a formula/rollup field) and test that column, or share the related object instead."
+    });
+  });
+  return findings;
+}
+
+// src/validate-rls-predicate-enforceability.ts
+import { isPushdownableCel, isSupportedRlsExpression, sqlPredicateToCel } from "@objectstack/formula";
+var RLS_PREDICATE_UNENFORCEABLE = "rls-predicate-unenforceable";
+var RLS_PREDICATE_UNPARSEABLE = "rls-predicate-unparseable";
+function asArray39(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function str3(v) {
+  return typeof v === "string" ? v : "";
+}
+var PUSHDOWN_SUBSET2 = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in`, `&&` `||` `!`, `== null` / `!= null`, and the string methods `startsWith` / `endsWith` / `contains` \u2014 over SINGLE-column field paths (ADR-0058 D2), compared against a literal or a `current_user.*` value.";
+function consequence(clause) {
+  const dropped = 'so `RLSCompiler` DROPS the policy at request time (one WARN line \u2014 "has an uncompilable predicate \u2026 and was DROPPED (no enforcement)" \u2014 is the only signal, and nothing reports it at authoring time). ';
+  return clause === "using" ? dropped + "When it is the only applicable policy for that object and operation, `compileFilter` returns the `RLS_DENY_FILTER` sentinel instead, which is AND-ed onto the where clause: every select / update / delete on the object matches ZERO rows. When other policies also apply, this one just vanishes from the OR and grants none of the access it appears to." : dropped + "On the ADR-0058 D4 write path that leaves the post-image `check` as the `RLS_DENY_FILTER` sentinel, which no record can satisfy: every insert / update the policy governs fails with `PermissionDeniedError`. The policy reads as a write rule and behaves as a blanket refusal.";
+}
+function validateRlsPredicateEnforceability(stack) {
+  const findings = [];
+  const cfg = stack ?? {};
+  asArray39(cfg.permissions).forEach((ps, psIndex) => {
+    asArray39(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+      for (const clause of ["using", "check"]) {
+        const source = str3(policy[clause]);
+        if (!source.trim()) continue;
+        if (isSupportedRlsExpression(source)) continue;
+        const why = isPushdownableCel(sqlPredicateToCel(source));
+        const detail = why.ok ? "" : why.detail;
+        const parseError = !why.ok && why.reason === "parse-error";
+        const psName = str3(ps.name) || String(psIndex);
+        const policyName = str3(policy.name) || String(pIndex);
+        const object = str3(policy.object);
+        const where = `permission set "${psName}" policy "${policyName}"` + (object ? ` on object "${object}"` : "");
+        const path = `permissions[${psIndex}].rowLevelSecurity[${pIndex}].${clause}`;
+        if (parseError) {
+          findings.push({
+            severity: "error",
+            rule: RLS_PREDICATE_UNPARSEABLE,
+            where,
+            path,
+            message: `RLS ${clause} \`${source}\` does not parse as CEL even after the legacy SQL bridge (\`=\` \u2192 \`==\`, \`IN\` \u2192 \`in\`) has been applied (${detail}), ` + consequence(clause),
+            hint: "Author the predicate in canonical CEL (ADR-0058 D1). The bridge covers only the historic SQL subset \u2014 a bare `=` and `IN` \u2014 so everything else must already be CEL: combine with `&&` / `||` rather than SQL `AND` / `OR`, negate with `!`, and use `startsWith` / `endsWith` / `contains` rather than `LIKE`. A subquery has no CEL spelling at all: RLS cannot join (ADR-0055), so pre-resolve the set into a membership key the runtime exposes (`field in current_user.<key>`, ADR-0105 D11) or denormalise the value onto this object."
+          });
+          continue;
+        }
+        findings.push({
+          severity: "error",
+          rule: RLS_PREDICATE_UNENFORCEABLE,
+          where,
+          path,
+          message: `RLS ${clause} \`${source}\` is outside the pushdown subset the runtime can compile (${detail}), ` + consequence(clause),
+          hint: "Rewrite the predicate inside the lowerable subset. " + PUSHDOWN_SUBSET2 + " Three traps in particular: (1) a function call \u2014 `size(record.tags) > 0`, `has(record.x)` \u2014 is correct in an object VALIDATION rule, which is INTERPRETED, and wrong here, where the predicate is COMPILED to a filter; write the null test as `field != null`. (2) A related-record path (`record.account.region`) is a join, which the compiler refuses by design (ADR-0055) \u2014 denormalise the value onto this object (a formula/rollup field) and test that column. (3) Arithmetic on a column (`amount * 2 > 100`) never lowers \u2014 precompute it into a field, or compare the column against the literal directly."
+        });
+      }
     });
   });
   return findings;
 }
 
+// src/validate-rule-compilability.ts
+import { createRequire as createRequire4 } from "module";
+var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
+var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
+var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
+var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray40(v) {
+  if (Array.isArray(v)) return v.filter(isRec16);
+  if (isRec16(v)) {
+    return Object.entries(v).filter(([, def]) => isRec16(def)).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+var cachedAjv = null;
+var cachedAddFormats = null;
+function loadAjv() {
+  if (cachedAjv) return cachedAjv;
+  const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
+  let mod;
+  try {
+    mod = createRequire4(anchor)("ajv");
+  } catch (err) {
+    throw new Error(
+      `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
+    );
+  }
+  const ctor = isRec16(mod) && "default" in mod ? mod.default : mod;
+  cachedAjv = ctor;
+  return ctor;
+}
+function loadAddFormats() {
+  if (cachedAddFormats) return cachedAddFormats;
+  const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
+  let mod;
+  try {
+    mod = createRequire4(anchor)("ajv-formats");
+  } catch (err) {
+    throw new Error(
+      `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
+    );
+  }
+  const plugin = isRec16(mod) && "default" in mod ? mod.default : mod;
+  cachedAddFormats = plugin;
+  return plugin;
+}
+function createRuntimeAjv() {
+  const instance = new (loadAjv())(RUNTIME_AJV_OPTIONS);
+  loadAddFormats()(instance);
+  return instance;
+}
+function registeredFormatNames() {
+  const names = Object.keys(createRuntimeAjv().formats).sort();
+  if (names.length === 0) {
+    throw new Error(
+      `@objectstack/lint: the runtime-parity ajv instance has no \`format\` registered. "ajv-formats" loaded but added nothing, so the set of legitimate format names is unknown \u2014 refusing to judge format names against an empty vocabulary, which would report every \`format\` in the stack as misspelled. Check that the installed "ajv-formats" is the real package and matches the version @objectstack/lint declares.`
+    );
+  }
+  return names;
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+var MAX_RULE_NESTING_DEPTH = 16;
+function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
+  const name = typeof rule.name === "string" && rule.name ? rule.name : "?";
+  const label2 = labelTrail ? `${labelTrail} \u2192 '${name}'` : `'${name}'`;
+  const path = pathTrail ? `${pathTrail}.${name}` : name;
+  const out = [{ rule, label: label2, path }];
+  if (depth >= MAX_RULE_NESTING_DEPTH) return out;
+  for (const branch of ["then", "otherwise"]) {
+    const nested = rule[branch];
+    if (isRec16(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+  }
+  return out;
+}
+function walkObjectValidationRules(stack) {
+  const walked = [];
+  if (!isRec16(stack)) return walked;
+  for (const obj of asArray40(stack.objects)) {
+    const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
+    const validations = obj.validations;
+    for (const authored of asArray40(validations)) {
+      for (const { rule, label: label2, path } of flattenRules(authored, "", "")) {
+        walked.push({
+          rule,
+          objectName,
+          label: label2,
+          where: `object '${objectName}' \xB7 validation ${label2}`,
+          basePath: `objects.${objectName}.validations.${path}`
+        });
+      }
+    }
+  }
+  return walked;
+}
+function validateRuleCompilability(stack) {
+  const findings = [];
+  for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
+    if (rule.type === "format" && typeof rule.regex === "string" && rule.regex !== "") {
+      try {
+        new RegExp(rule.regex);
+      } catch (err) {
+        findings.push({
+          severity: "error",
+          rule: VALIDATION_RULE_REGEX_UNCOMPILABLE,
+          where,
+          path: `${basePath}.regex`,
+          message: `\`format\` validation ${label2} on object '${objectName}' declares a \`regex\` that does not compile: ${errorText(err)}. The write path builds it with \`new RegExp(rule.regex)\` and SKIPS the rule when that throws (rule-validator.ts \`checkFormat\`), so the rule is declared, listed in the metadata, and enforces nothing on any record.`,
+          hint: `Fix the pattern so \`new RegExp('${rule.regex}')\` compiles \u2014 a literal \`(\`, \`[\` or \`\\\` must be escaped (\`\\\\(\`, \`\\\\[\`, \`\\\\\\\\\`), and the source is a STRING, so a backslash is written twice in TypeScript ('^\\\\d{2}-\\\\d{7}$'). Or drop \`regex\` and use a named \`format\` ('email' | 'url' | 'phone' | 'json').`
+        });
+      }
+    }
+    if (rule.type === "json_schema" && isRec16(rule.schema)) {
+      try {
+        createRuntimeAjv().compile(rule.schema);
+      } catch (err) {
+        findings.push({
+          severity: "error",
+          rule: VALIDATION_RULE_SCHEMA_UNCOMPILABLE,
+          where,
+          path: `${basePath}.schema`,
+          message: `\`json_schema\` validation ${label2} on object '${objectName}' declares a \`schema\` ajv cannot compile: ${errorText(err)}. The write path compiles it with the same ajv (\`new Ajv({ allErrors: true, strict: false })\` + \`ajv-formats\`) and SKIPS the rule when that throws (rule-validator.ts \`checkJsonSchema\`), so the rule is declared and enforces nothing on any record.`,
+          hint: `Correct the schema so ajv compiles it \u2014 the message above names the offending keyword. \`type\` must be one of null|boolean|object|array|number|string|integer (or an array of those), \`required\` an array of strings, and every \`$ref\` must resolve. Vendor keywords are fine (the runtime runs \`strict: false\`); a MALFORMED standard keyword is not.`
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+// src/validate-rule-schema-formats.ts
+var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
+var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var SUBSCHEMA_KEYS = [
+  "additionalItems",
+  "additionalProperties",
+  "contains",
+  "propertyNames",
+  "if",
+  "then",
+  "else",
+  "not",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SUBSCHEMA_LIST_KEYS = ["allOf", "anyOf", "oneOf", "prefixItems"];
+var SUBSCHEMA_MAP_KEYS = [
+  "properties",
+  "patternProperties",
+  "$defs",
+  "definitions",
+  "dependentSchemas"
+];
+var MAX_SCHEMA_WALK_DEPTH = 32;
+var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
+function collectFormatUses(schema, pointer, out, depth) {
+  if (!isRec17(schema)) return;
+  if (typeof schema.format === "string") {
+    out.push({ pointer: `${pointer}/format`, name: schema.format });
+  }
+  if (depth >= MAX_SCHEMA_WALK_DEPTH) return;
+  for (const key of SUBSCHEMA_KEYS) {
+    if (key in schema) {
+      collectFormatUses(schema[key], `${pointer}/${escapePointerSegment(key)}`, out, depth + 1);
+    }
+  }
+  for (const key of SUBSCHEMA_LIST_KEYS) {
+    const value = schema[key];
+    if (!Array.isArray(value)) continue;
+    value.forEach((entry, index) => {
+      collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${index}`, out, depth + 1);
+    });
+  }
+  for (const key of SUBSCHEMA_MAP_KEYS) {
+    const value = schema[key];
+    if (!isRec17(value)) continue;
+    for (const [name, entry] of Object.entries(value)) {
+      collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
+    }
+  }
+  const items = schema.items;
+  if (Array.isArray(items)) {
+    items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
+  } else if (isRec17(items)) {
+    collectFormatUses(items, `${pointer}/items`, out, depth + 1);
+  }
+  const dependencies = schema.dependencies;
+  if (isRec17(dependencies)) {
+    for (const [name, entry] of Object.entries(dependencies)) {
+      if (!isRec17(entry)) continue;
+      collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
+    }
+  }
+}
+function editDistance2(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const current = [i];
+    for (let j = 1; j <= b.length; j++) {
+      current[j] = Math.min(
+        previous[j] + 1,
+        current[j - 1] + 1,
+        previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+    previous = current;
+  }
+  return previous[b.length];
+}
+function nearestRegisteredFormat(name, registered) {
+  const budget = Math.min(3, Math.floor(name.length / 2));
+  if (budget < 1) return null;
+  const authored = name.toLowerCase();
+  let best = null;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const candidate of [...registered].sort()) {
+    const distance7 = editDistance2(authored, candidate);
+    if (distance7 < bestDistance) {
+      bestDistance = distance7;
+      best = candidate;
+    }
+  }
+  return bestDistance <= budget ? best : null;
+}
+function validateRuleSchemaFormats(stack) {
+  const findings = [];
+  const pending = [];
+  for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
+    if (rule.type !== "json_schema" || !isRec17(rule.schema)) continue;
+    const uses = [];
+    collectFormatUses(rule.schema, "", uses, 0);
+    for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
+  }
+  if (pending.length === 0) return findings;
+  const registered = registeredFormatNames();
+  const known = new Set(registered);
+  for (const { use, where, label: label2, objectName, basePath } of pending) {
+    if (known.has(use.name)) continue;
+    const suggestion = nearestRegisteredFormat(use.name, registered);
+    const pointer = `#${use.pointer}`;
+    findings.push({
+      severity: "error",
+      rule: VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT,
+      where,
+      path: `${basePath}.schema${pointer}`,
+      message: `\`json_schema\` validation ${label2} on object '${objectName}' names \`format: '${use.name}'\` at \`${pointer}\`, which is not a registered format. ajv logs \`unknown format "${use.name}" ignored\` once at compile time and DROPS the keyword \u2014 in the write path (rule-validator.ts, \`strict: false\`) and in the publish gate alike \u2014 so the schema compiles, the rule ships and runs on every write, its \`type\`/\`required\` keywords are enforced, and this constraint is enforced on no record, ever. The record is ACCEPTED, so nothing downstream reports the gap either.`,
+      hint: (suggestion ? `Did you mean \`format: '${suggestion}'\`? ` : "") + `The registered names are: ${registered.join(", ")} \u2014 the default \`ajv-formats\` set, the one \`rule-validator.ts\` registers (#5029). Names are case-sensitive and hyphenated (\`date-time\`, not \`datetime\`). If you meant a constraint ajv has no format for, express it with \`pattern\` instead \u2014 a regex is enforced, an unknown format name is not.`
+    });
+  }
+  return findings;
+}
+
 // src/validate-action-locations.ts
 var ACTION_NO_PLACEMENT = "action-no-placement";
-function asArray37(v) {
+function asArray41(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName15(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
@@ -6375,8 +7140,8 @@ function collectNamePlacedActions(stack) {
     for (const key of ["rowActions", "bulkActions"]) {
       for (const n of strList3(list3[key])) placed.add(n);
     }
-    for (const def of asArray37(list3.bulkActionDefs)) {
-      const n = strName15(def?.name);
+    for (const def of asArray41(list3.bulkActionDefs)) {
+      const n = strName17(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -6384,12 +7149,12 @@ function collectNamePlacedActions(stack) {
     if (!listViews || typeof listViews !== "object" || Array.isArray(listViews)) return;
     for (const lv of Object.values(listViews)) harvest(lv);
   };
-  for (const view of asArray37(stack.views)) {
+  for (const view of asArray41(stack.views)) {
     if (!view || typeof view !== "object") continue;
     harvest(view.list);
     harvestListViews(view.listViews);
   }
-  for (const obj of asArray37(stack.objects)) {
+  for (const obj of asArray41(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     harvestListViews(obj.listViews);
   }
@@ -6402,7 +7167,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName15(action.name);
+    const name = strName17(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -6414,20 +7179,25 @@ function validateActionLocations(stack) {
       hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`, `global_nav`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
     });
   };
-  const actions = asArray37(stack.actions);
+  const actions = asArray41(stack.actions);
   for (let i = 0; i < actions.length; i++) check(actions[i], `actions[${i}]`);
-  const objects = asArray37(stack.objects);
+  const objects = asArray41(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
-    const own = asArray37(obj.actions);
+    const own = asArray41(obj.actions);
     for (let ai = 0; ai < own.length; ai++) check(own[ai], `objects[${oi}].actions[${ai}]`);
   }
   return findings;
 }
 
 // src/lint-flow-patterns.ts
-function asArray38(v) {
+import {
+  APPROVAL_NODE_TYPE as APPROVAL_NODE_TYPE2,
+  APPROVAL_REVISE_NODE_TYPE,
+  collectFlowGraphs as collectFlowGraphs2
+} from "@objectstack/spec/automation";
+function asArray42(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -6450,6 +7220,7 @@ var FLOW_BARE_DOLLAR_REF = "flow-bare-dollar-reference";
 var FLOW_APPROVAL_REVISE_DEAD_END = "flow-approval-revise-dead-end";
 var FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE = "flow-approval-revise-unmarked-backedge";
 var FLOW_APPROVAL_REVISE_DISABLED = "flow-approval-revise-disabled";
+var FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED = "flow-approval-revise-target-not-service-owned";
 var FLOW_RUNAS_UNSCOPED = "flow-runas-unscoped";
 var FLOW_ERROR_LABEL_NOT_FAULT = "flow-error-label-not-fault";
 var FLOW_BRANCH_LABEL_UNMATCHED = "flow-branch-label-unmatched";
@@ -6457,6 +7228,7 @@ var FLOW_DECISION_UNCONDITIONAL_BRANCH = "flow-decision-unconditional-branch";
 var FLOW_DEFAULT_EDGE_WITH_CONDITION = "flow-default-edge-with-condition";
 var FLOW_MULTIPLE_DEFAULT_EDGES = "flow-multiple-default-edges";
 var FLOW_INERT_NODE_CONDITION = "flow-inert-node-condition";
+var FLOW_MULTI_WRITE_UNFILTERED = "flow-multi-write-unfiltered";
 var INERT_CONDITION_NODE_TYPES = /* @__PURE__ */ new Set([
   "decision",
   "assignment",
@@ -6479,6 +7251,36 @@ var INERT_CONDITION_NODE_TYPES = /* @__PURE__ */ new Set([
   "end"
 ]);
 var DATA_NODE_TYPES = /* @__PURE__ */ new Set(["get_record", "create_record", "update_record", "delete_record"]);
+var RUNAS_EFFECTIVE_IDENTITY = "`runAs:'user'` (the default when none is declared)";
+function findDataNodeAnywhere(nodes, edges) {
+  for (const graph of collectFlowGraphs2({
+    nodes,
+    edges
+  })) {
+    for (const node of graph.nodes) {
+      if (DATA_NODE_TYPES.has(typeof node.type === "string" ? node.type : "")) {
+        return { node, scope: graph.scope };
+      }
+    }
+  }
+  return null;
+}
+var BULK_WRITE_CONSEQUENCE = /* @__PURE__ */ new Map([
+  ["delete_record", {
+    verb: "deleted",
+    engineCall: "driver.deleteMany",
+    // The delete dispatch is the one that is EXTRACTED and case-set-pinned
+    // (`engine-delete-dispatch.ts`), so it can be cited by name.
+    dispatchNote: "the engine's delete-dispatch case-set lists `multi with no predicate at all` as a legal `multi` call"
+  }],
+  ["update_record", {
+    verb: "overwritten",
+    engineCall: "driver.updateMany",
+    // Update has no extracted dispatch module, so the branch itself is the
+    // authority — and its refusal fires only WITHOUT the declaration.
+    dispatchNote: "the engine takes its bulk branch on `options.multi` alone (`Update requires an ID or options.multi=true` is refused only when the declaration is absent)"
+  }]
+]);
 var ERROR_LABELS = /* @__PURE__ */ new Set(["error", "fault", "failure", "failed", "catch", "on_error", "onerror", "on error"]);
 var BRANCH_LABEL_NODE_TYPES = /* @__PURE__ */ new Set(["decision", "approval", "screen", "try_catch"]);
 function isScheduleTriggered(flow, startCfg) {
@@ -6563,7 +7365,7 @@ function collectTemplateStrings(value, key, out) {
 function edgeLabelOf(e) {
   return typeof e.label === "string" ? e.label.trim().toLowerCase() : "";
 }
-function scanErrorLabelledEdges(flowName, nodes, edges, findings) {
+function scanErrorLabelledEdges(at, nodes, edges, findings) {
   const typeById = /* @__PURE__ */ new Map();
   for (const n of nodes) {
     if (typeof n.id === "string") typeById.set(n.id, typeof n.type === "string" ? n.type : "");
@@ -6576,14 +7378,14 @@ function scanErrorLabelledEdges(flowName, nodes, edges, findings) {
     const src = typeof e.source === "string" ? e.source : "";
     if (BRANCH_LABEL_NODE_TYPES.has(typeById.get(src) ?? "")) continue;
     findings.push({
-      where: `flow '${flowName}' \xB7 edge '${src}' \u2192 '${String(e.target)}'`,
+      where: `${at} \xB7 edge '${src}' \u2192 '${String(e.target)}'`,
       message: `edge is labelled '${String(e.label)}' but its type is '${String(e.type ?? "default")}', not 'fault' \u2014 so it is an ORDINARY out-edge. Unconditional out-edges all run in parallel, so '${String(e.target)}' executes on every SUCCESSFUL run of '${src}' and never on a failure. The error path the label describes does not exist, and the run still aborts when '${src}' fails.`,
       hint: `Add \`type: 'fault'\` to this edge. Only runtime failures route \u2014 a guard refusal (a filter token that resolved to nothing, a missing required config key, an unscoped run) stays fatal by design and must be fixed in the metadata, not handled. (#3863)`,
       rule: FLOW_ERROR_LABEL_NOT_FAULT
     });
   }
 }
-function scanBranchRouting(flowName, nodes, edges, findings) {
+function scanBranchRouting(at, nodes, edges, findings) {
   const outEdgesBySource = /* @__PURE__ */ new Map();
   for (const e of edges) {
     if (e.type === "fault") continue;
@@ -6596,7 +7398,7 @@ function scanBranchRouting(flowName, nodes, edges, findings) {
     for (const e of outs) {
       if (e.isDefault === true && e.condition) {
         findings.push({
-          where: `flow '${flowName}' \xB7 edge '${src}' \u2192 '${String(e.target)}'`,
+          where: `${at} \xB7 edge '${src}' \u2192 '${String(e.target)}'`,
           message: `edge sets \`isDefault: true\` AND a \`condition\` \u2014 contradictory. \`isDefault\` means "take this edge when NO sibling condition matched"; a condition makes it an ordinary guarded branch. The condition wins and the default marker routes nothing.`,
           hint: `Drop one: keep \`condition\` for a guarded branch, or drop it and keep \`isDefault: true\` for the "otherwise" path. (#4414)`,
           rule: FLOW_DEFAULT_EDGE_WITH_CONDITION,
@@ -6609,7 +7411,7 @@ function scanBranchRouting(flowName, nodes, edges, findings) {
     const defaults = outs.filter((e) => e.isDefault === true && !e.condition);
     if (defaults.length > 1) {
       findings.push({
-        where: `flow '${flowName}' \xB7 node '${src}'`,
+        where: `${at} \xB7 node '${src}'`,
         message: `${defaults.length} out-edges are marked \`isDefault: true\` (${defaults.map((e) => `'${String(e.target)}'`).join(", ")}) \u2014 a node has at most ONE default path. All of them are traversed together when no condition matches, which is a parallel fan-out, not an "otherwise".`,
         hint: `Keep \`isDefault: true\` on the single fallback edge and give the others a \`condition\` (or leave them unconditional if the fan-out really is intended). (#4414)`,
         rule: FLOW_MULTIPLE_DEFAULT_EDGES
@@ -6622,7 +7424,7 @@ function scanBranchRouting(flowName, nodes, edges, findings) {
     const cfg = node.config ?? {};
     if (cfg.condition == null || conditionSource(cfg.condition).trim() === "") continue;
     findings.push({
-      where: `flow '${flowName}' \xB7 node '${String(node.id)}' (${nodeType})`,
+      where: `${at} \xB7 node '${String(node.id)}' (${nodeType})`,
       message: `\`config.condition\` is set but nothing reads it \u2014 the key is the trigger gate on a \`start\` node and is ignored on every other node type, so this predicate never gates anything. (It is still parse-validated at registration, which is why a malformed one is caught and an inert one is not.)`,
       hint: nodeType === "decision" ? `Branching lives on the OUT-EDGES: give each branch its own \`condition\` and mark the fallback \`isDefault: true\`. If the edges already carry the predicate, delete this copy. (#4414)` : `Delete it, or move the predicate to the incoming edge's \`condition\` if this step was meant to be conditional. (#4414)`,
       rule: FLOW_INERT_NODE_CONDITION
@@ -6642,7 +7444,7 @@ function scanBranchRouting(flowName, nodes, edges, findings) {
     const unclaimed = [...declaredLabels].filter((l) => !edgeLabels.has(l));
     if (unclaimed.length > 0) {
       findings.push({
-        where: `flow '${flowName}' \xB7 decision '${nid}'`,
+        where: `${at} \xB7 decision '${nid}'`,
         message: `declares branch label(s) ${unclaimed.map((l) => `'${l}'`).join(", ")} that no out-edge carries \u2014 out-edge labels are [${[...edgeLabels].map((l) => `'${l}'`).join(", ") || "none"}]. Traversal cannot honour a label nothing claims, so it falls back to considering EVERY out-edge and the branch the decision computed is ignored.`,
         hint: `Make an out-edge's \`label\` match the declared branch exactly, or drop \`config.conditions\` and branch on the edges instead (\`condition\` per branch + \`isDefault: true\` on the fallback) \u2014 one mechanism per decision, never both. (#4414)`,
         rule: FLOW_BRANCH_LABEL_UNMATCHED,
@@ -6658,7 +7460,7 @@ function scanBranchRouting(flowName, nodes, edges, findings) {
     );
     if (ungated.length > 0) {
       findings.push({
-        where: `flow '${flowName}' \xB7 decision '${nid}'`,
+        where: `${at} \xB7 decision '${nid}'`,
         message: `has guarded out-edge(s) alongside unconditional one(s) (${ungated.map((e) => `'${String(e.target)}'`).join(", ")}) \u2014 an unconditional out-edge is traversed on EVERY pass, in parallel with whichever guarded branch matched, so the decision does not actually exclude it. A \`label\` alone does not select a path unless the decision declares a matching \`conditions[].label\`.`,
         hint: `Mark the fallback \`isDefault: true\` so it is taken only when no sibling condition matched (BPMN default flow), or give it its own \`condition\`. (#4414)`,
         rule: FLOW_DECISION_UNCONDITIONAL_BRANCH
@@ -6666,10 +7468,39 @@ function scanBranchRouting(flowName, nodes, edges, findings) {
     }
   }
 }
-function scanApprovalReviseLoops(flowName, nodes, edges, findings) {
-  const approvals = nodes.filter((n) => n.type === "approval");
+function filterCarriesNoCondition(filter) {
+  if (filter === void 0 || filter === null) return true;
+  if (typeof filter !== "object" || Array.isArray(filter)) return false;
+  return Object.keys(filter).length === 0;
+}
+function scanUnboundedBulkWrites(at, nodes, findings) {
+  for (const node of nodes) {
+    const nodeType = typeof node.type === "string" ? node.type : "";
+    const consequence2 = BULK_WRITE_CONSEQUENCE.get(nodeType);
+    if (!consequence2) continue;
+    const cfg = node.config ?? {};
+    if (cfg.multi !== true) continue;
+    if (!filterCarriesNoCondition(cfg.filter)) continue;
+    const objectName = typeof cfg.objectName === "string" && cfg.objectName ? cfg.objectName : "(unnamed object)";
+    const filterState = cfg.filter === void 0 || cfg.filter === null ? "no `filter` key" : "an EMPTY `filter`";
+    findings.push({
+      where: `${at} \xB7 node '${String(node.id)}' (${nodeType})`,
+      message: `declares \`multi: true\` with ${filterState} \u2014 this is a WHOLE-OBJECT write, by declaration: every row of '${objectName}' is ${consequence2.verb} on every run. The executor forwards \`where: {}\` plus the bulk intent, ${consequence2.dispatchNote}, and it lands on \`${consequence2.engineCall}\` with no predicate. Nothing refuses it at run time, so the only feedback is the step's \`acted\` row count \u2014 reported AFTER the rows are gone.`,
+      hint: `Write the constraint you mean into \`filter\` (e.g. \`{ status: 'closed' }\` \u2014 see examples/app-showcase \`showcase_inquiry_purge\`, bulk intent bounded by a predicate). If emptying '${objectName}' really is the intent, keep it: this is a warning, not a gate, and the run-time path stays open. Distinct from the #3810 erased-condition guard, which REFUSES this node at run time when a condition you WROTE interpolated to nothing \u2014 that guard is keyed on "a written condition is gone" and deliberately not on "the filter is empty", which is the fact this rule judges at authoring time. (#5482, #5393)`,
+      // Warning, not `error`: see the severity policy at the top of this file.
+      // The shape has a legitimate reading the engine grants on purpose, so it is
+      // not provably wrong — unlike the gating members of this family.
+      rule: FLOW_MULTI_WRITE_UNFILTERED
+    });
+  }
+}
+function scanApprovalReviseLoops(at, nodes, edges, findings) {
+  const approvals = nodes.filter((n) => n.type === APPROVAL_NODE_TYPE2);
   if (approvals.length === 0) return;
   const nodeIds = new Set(nodes.map((n) => typeof n.id === "string" ? n.id : "").filter(Boolean));
+  const nodeTypeById = new Map(
+    nodes.filter((n) => typeof n.id === "string").map((n) => [n.id, typeof n.type === "string" ? n.type : ""])
+  );
   const outEdges = /* @__PURE__ */ new Map();
   for (const e of edges) {
     const src = typeof e.source === "string" ? e.source : "";
@@ -6682,7 +7513,18 @@ function scanApprovalReviseLoops(flowName, nodes, edges, findings) {
     if (!aid) continue;
     const reviseTargets = edges.filter((e) => e.source === aid && edgeLabelOf(e) === "revise").map((e) => typeof e.target === "string" ? e.target : "").filter((t) => t && nodeIds.has(t));
     if (reviseTargets.length === 0) continue;
-    const where = `flow '${flowName}' \xB7 approval '${aid}'`;
+    const where = `${at} \xB7 approval '${aid}'`;
+    for (const target of reviseTargets) {
+      const targetType = nodeTypeById.get(target) ?? "";
+      if (targetType === APPROVAL_REVISE_NODE_TYPE) continue;
+      findings.push({
+        where,
+        severity: "error",
+        message: `has a 'revise' out-edge into node '${target}' of type '${targetType || "(untyped)"}' \u2014 the revise window must be an '${APPROVAL_REVISE_NODE_TYPE}' node. Send-back parks the run there while the record is unlocked, and only the approvals service may continue it (submitter-only, audited, and refusing a colliding pending request); \`sendBack\` refuses any other target, so this flow's revise branch cannot run.`,
+        hint: `Set node '${target}' to \`type: '${APPROVAL_REVISE_NODE_TYPE}'\` (drop any \`waitEventConfig\` \u2014 the window is ended by POST /api/v1/approvals/requests/:id/resubmit, not by a signal). ADR-0044 D3 originally said 'wait' here; its 2026-07-28 amendment reversed that, because a 'wait' is resumable by anyone with the run id (#3823, #3801).`,
+        rule: FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED
+      });
+    }
     const cfg = a.config ?? {};
     if (cfg.maxRevisions === 0) {
       findings.push({
@@ -6710,7 +7552,7 @@ function scanApprovalReviseLoops(flowName, nodes, edges, findings) {
       findings.push({
         where,
         message: `has a 'revise' out-edge but no path loops back to it \u2014 the submitter reworks the record with nowhere to resubmit, so the revise branch dead-ends. (registerFlow accepts this \u2014 it's a valid DAG.)`,
-        hint: `Close the loop: the 'revise' edge should reach a wait node whose resubmit edge returns to '${aid}' marked \`type: 'back'\` (ADR-0044). See examples/app-showcase showcase_budget_approval.`,
+        hint: `Close the loop: the 'revise' edge should reach an '${APPROVAL_REVISE_NODE_TYPE}' node whose resubmit edge returns to '${aid}' marked \`type: 'back'\` (ADR-0044). See examples/app-showcase showcase_budget_approval.`,
         rule: FLOW_APPROVAL_REVISE_DEAD_END
       });
     } else if (!returnEdges.some((e) => e.type === "back")) {
@@ -6725,7 +7567,7 @@ function scanApprovalReviseLoops(flowName, nodes, edges, findings) {
 }
 function lintFlowPatterns(stack) {
   const findings = [];
-  for (const flow of asArray38(stack.flows)) {
+  for (const flow of asArray42(stack.flows)) {
     const flowName = typeof flow.name === "string" ? flow.name : "(unnamed flow)";
     const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
     const edges = Array.isArray(flow.edges) ? flow.edges : [];
@@ -6746,74 +7588,90 @@ function lintFlowPatterns(stack) {
     const runAs = typeof flow.runAs === "string" ? flow.runAs : "user";
     const userLessKind = userLessTriggerKind(flow, startCfg);
     if (userLessKind && runAs !== "system") {
-      const dataNode = nodes.find((n) => DATA_NODE_TYPES.has(typeof n.type === "string" ? n.type : ""));
+      const dataNode = findDataNodeAnywhere(nodes, edges);
       if (dataNode) {
-        const declared = typeof flow.runAs === "string" ? `\`runAs:'${runAs}'\`` : `the default \`runAs:'user'\``;
+        const at = dataNode.scope ? `, in ${dataNode.scope},` : "";
         findings.push({
           where: `flow '${flowName}' \xB7 runAs`,
-          message: `${userLessKind}-triggered flow runs as ${declared}, but a ${userLessKind} run has no trigger user \u2014 so its data node '${dataNode.id}' (${dataNode.type}) has no identity to scope to and will be REFUSED at run time.`,
+          message: `${userLessKind}-triggered flow runs under ${RUNAS_EFFECTIVE_IDENTITY}, but a ${userLessKind} run has no trigger user \u2014 so its data node '${dataNode.node.id}' (${dataNode.node.type})${at} has no identity to scope to and will be REFUSED at run time.`,
           hint: `Declare \`runAs:'system'\` to make the elevation explicit and intended (the run reads/writes every record). A ${userLessKind} flow cannot scope to a user \u2014 there is none. (ADR-0049, ADR-0073 D5, #1888, #3760)`,
           rule: FLOW_RUNAS_UNSCOPED,
           severity: "error"
         });
       }
     }
-    for (const node of nodes) {
-      const nodeWhere = `flow '${flowName}' \xB7 node '${node.id}' (${node.type})`;
-      const cfg = node.config ?? {};
-      if (cfg.filter) scanFilterForDateEquality(cfg.filter, `${nodeWhere} filter`, findings);
-      for (const key of Object.keys(cfg)) {
-        if (PHANTOM_AGG_KEYS.has(key)) {
-          findings.push({
-            where: nodeWhere,
-            message: `node config has \`${key}\` \u2014 the automation engine has no aggregate node, so \`${key}\` is silently ignored and this node computes nothing at runtime.`,
-            hint: `Aggregation belongs in the data layer: use \`Field.summary\` for a cross-object rollup (sum/count of children), or \`Field.formula\` for a per-record computed value. (#1870)`,
-            rule: FLOW_PHANTOM_AGGREGATION
-          });
-        }
-      }
-      const strings = [];
-      collectTemplateStrings(node.config, void 0, strings);
-      for (const str2 of strings) {
-        if (DOUBLE_BRACE.test(str2)) {
-          findings.push({
-            where: nodeWhere,
-            message: `double-brace interpolation \`${str2.trim().slice(0, 80)}\` \u2014 flow node values use SINGLE braces.`,
-            hint: `Use \`{var}\` (e.g. \`{record.title}\`). Double-brace \`{{ }}\` is the formula/template-field dialect, not flow node values. (#1315)`,
-            rule: FLOW_DOUBLE_BRACE_INTERP
-          });
+    for (const graph of collectFlowGraphs2({
+      // A cast, not a parse. `FlowNodeSchema.config` is an open `z.record`, so a
+      // region's contents arrive as raw authored records even in a parsed stack —
+      // a nested edge `condition` may still be a bare string where a top-level
+      // one is an Expression envelope. Every rule below reads both
+      // (`conditionSource`), and the walk itself only touches `type` / `config`.
+      // The already-guarded arrays are passed rather than `flow` itself so a
+      // non-array `nodes` still cannot throw: this function promises it never does.
+      nodes,
+      edges
+    })) {
+      const at = graph.scope ? `flow '${flowName}' \xB7 ${graph.scope}` : `flow '${flowName}'`;
+      const graphNodes = graph.nodes;
+      const graphEdges = graph.edges;
+      for (const node of graphNodes) {
+        const nodeWhere = `${at} \xB7 node '${node.id}' (${node.type})`;
+        const cfg = node.config ?? {};
+        if (cfg.filter) scanFilterForDateEquality(cfg.filter, `${nodeWhere} filter`, findings);
+        for (const key of Object.keys(cfg)) {
+          if (PHANTOM_AGG_KEYS.has(key)) {
+            findings.push({
+              where: nodeWhere,
+              message: `node config has \`${key}\` \u2014 the automation engine has no aggregate node, so \`${key}\` is silently ignored and this node computes nothing at runtime.`,
+              hint: `Aggregation belongs in the data layer: use \`Field.summary\` for a cross-object rollup (sum/count of children), or \`Field.formula\` for a per-record computed value. (#1870)`,
+              rule: FLOW_PHANTOM_AGGREGATION
+            });
+          }
         }
-        if (BARE_DOLLAR_REF.test(str2)) {
-          findings.push({
-            where: nodeWhere,
-            message: `\`${str2.trim().slice(0, 80)}\` looks like a reference written as a literal \u2014 a bare \`$ref.field\` is NOT interpolated.`,
-            hint: `Wrap it and bind a variable: \`{source.id}\` (or \`{$User.Id}\` for the current user). (#1315)`,
-            rule: FLOW_BARE_DOLLAR_REF
-          });
+        const strings = [];
+        collectTemplateStrings(stripRegions(node.config), void 0, strings);
+        for (const str4 of strings) {
+          if (DOUBLE_BRACE.test(str4)) {
+            findings.push({
+              where: nodeWhere,
+              message: `double-brace interpolation \`${str4.trim().slice(0, 80)}\` \u2014 flow node values use SINGLE braces.`,
+              hint: `Use \`{var}\` (e.g. \`{record.title}\`). Double-brace \`{{ }}\` is the formula/template-field dialect, not flow node values. (#1315)`,
+              rule: FLOW_DOUBLE_BRACE_INTERP
+            });
+          }
+          if (BARE_DOLLAR_REF.test(str4)) {
+            findings.push({
+              where: nodeWhere,
+              message: `\`${str4.trim().slice(0, 80)}\` looks like a reference written as a literal \u2014 a bare \`$ref.field\` is NOT interpolated.`,
+              hint: `Wrap it and bind a variable: \`{source.id}\` (or \`{$User.Id}\` for the current user). (#1315)`,
+              rule: FLOW_BARE_DOLLAR_REF
+            });
+          }
         }
       }
+      scanApprovalReviseLoops(at, graphNodes, graphEdges, findings);
+      scanErrorLabelledEdges(at, graphNodes, graphEdges, findings);
+      scanBranchRouting(at, graphNodes, graphEdges, findings);
+      scanUnboundedBulkWrites(at, graphNodes, findings);
     }
-    scanApprovalReviseLoops(flowName, nodes, edges, findings);
-    scanErrorLabelledEdges(flowName, nodes, edges, findings);
-    scanBranchRouting(flowName, nodes, edges, findings);
   }
   return findings;
 }
 
 // src/lint-liveness-properties.ts
-import { createRequire as createRequire4 } from "module";
+import { createRequire as createRequire5 } from "module";
 import { dirname, join } from "path";
 import { existsSync, readFileSync } from "fs";
 var LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
 var LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
-function asArray39(v) {
+function asArray43(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
 }
 function resolveLivenessDir() {
   try {
-    const require2 = createRequire4(import.meta.url);
+    const require2 = createRequire5(import.meta.url);
     const pkgJson = require2.resolve("@objectstack/spec/package.json");
     const dir = join(dirname(pkgJson), "liveness");
     return existsSync(dir) ? dir : null;
@@ -6919,7 +7777,16 @@ var TYPE_COLLECTIONS = [
   { type: "job", key: "jobs" },
   { type: "email_template", key: "emailTemplates" },
   { type: "mapping", key: "mappings" },
-  { type: "translation", key: "translations" }
+  { type: "translation", key: "translations" },
+  // #4956 — dashboard joins the list the moment its ledger first warns on
+  // anything, which is exactly the rule the comment above states. Drilling
+  // `widgets` produced five warned keys (`colorVariant`, `actionUrl`,
+  // `actionType`, `actionIcon`, `aria`), all under `widgets[]`; `getNested`
+  // fans a dotted path out over an array level, so `widgets.colorVariant`
+  // checks every widget on the dashboard. Registering it here is not optional
+  // bookkeeping: without it the ledger would be newly correct and newly
+  // silent, which is the shape this lint exists to prevent.
+  { type: "dashboard", key: "dashboards" }
 ];
 function lintLivenessProperties(stack) {
   const dir = resolveLivenessDir();
@@ -6927,11 +7794,11 @@ function lintLivenessProperties(stack) {
   const findings = [];
   const objectWarn = loadWarnMap(dir, "object");
   const fieldWarn = loadWarnMap(dir, "field");
-  for (const obj of asArray39(stack.objects)) {
+  for (const obj of asArray43(stack.objects)) {
     const objName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     if (objectWarn.size > 0) checkItem("object", obj, `object '${objName}'`, objectWarn, findings);
     if (fieldWarn.size > 0) {
-      for (const field of asArray39(obj.fields)) {
+      for (const field of asArray43(obj.fields)) {
         const fieldName = typeof field.name === "string" ? field.name : "(unnamed field)";
         checkItem("field", field, `object '${objName}' \xB7 field '${fieldName}'`, fieldWarn, findings);
       }
@@ -6940,7 +7807,7 @@ function lintLivenessProperties(stack) {
   for (const { type, key } of TYPE_COLLECTIONS) {
     const warnMap = loadWarnMap(dir, type);
     if (warnMap.size === 0) continue;
-    for (const item of asArray39(stack[key])) {
+    for (const item of asArray43(stack[key])) {
       const name = typeof item.name === "string" ? item.name : typeof item.object === "string" ? item.object : `(unnamed ${type})`;
       checkItem(type, item, `${type} '${name}'`, warnMap, findings);
     }
@@ -6954,7 +7821,7 @@ var AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
 var AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
 var AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
 var AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
-function asArray40(v) {
+function asArray44(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6963,9 +7830,9 @@ function asArray40(v) {
 }
 function lintAutonumberFormats(stack) {
   const findings = [];
-  for (const obj of asArray40(stack.objects)) {
+  for (const obj of asArray44(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
-    const fields = asArray40(obj.fields);
+    const fields = asArray44(obj.fields);
     const fieldMeta = /* @__PURE__ */ new Map();
     for (const f of fields) {
       if (typeof f.name === "string") fieldMeta.set(f.name, { required: f.required === true });
@@ -7031,7 +7898,7 @@ function lintAutonumberFormats(stack) {
 
 // src/lint-view-refs.ts
 import { expandViewContainerWithDiagnostics, isAggregatedViewContainer } from "@objectstack/spec";
-function asArray41(v) {
+function asArray45(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -7059,7 +7926,7 @@ function lintViewRefs(stack) {
     s.add(kind);
   };
   const containers = [];
-  for (const v of asArray41(stack.views)) {
+  for (const v of asArray45(stack.views)) {
     if (v.viewKind) {
       if (typeof v.name === "string") indexKind(v.name, v.viewKind === "form" ? "form" : "list");
       continue;
@@ -7068,7 +7935,7 @@ function lintViewRefs(stack) {
     const object = viewContainerObjectName(v);
     if (object) containers.push({ object, container: v });
   }
-  for (const obj of asArray41(stack.objects)) {
+  for (const obj of asArray45(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
     if (!object) continue;
     if (obj.list || obj.form || obj.listViews || obj.formViews) {
@@ -7122,11 +7989,11 @@ function lintViewRefs(stack) {
       });
     }
   };
-  for (const obj of asArray41(stack.objects)) {
+  for (const obj of asArray45(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
-    for (const action of asArray41(obj.actions)) checkAction(action, object);
+    for (const action of asArray45(obj.actions)) checkAction(action, object);
   }
-  for (const action of asArray41(stack.actions)) checkAction(action);
+  for (const action of asArray45(stack.actions)) checkAction(action);
   return findings;
 }
 
@@ -7139,8 +8006,43 @@ function fieldEntries2(fields) {
   return Object.entries(fields).map(([name, def]) => ({ name, def }));
 }
 var UNIQUE_DOUBLE_DECLARATION = "unique/double-declaration";
+var UNIQUE_UNSCOPED_DECLARED_INDEX = "unique/unscoped-declared-index";
+var UNIQUE_LEGACY_ORGANIZATION_COMPOSITE = "unique/legacy-organization-composite";
+function authoredTenantColumn(obj) {
+  const declared = obj?.tenancy?.tenantField;
+  return typeof declared === "string" && declared.trim() ? declared.trim() : "organization_id";
+}
 function uniqueDeclared(u) {
-  return u === true || u === "global";
+  return u === true || u === "global" || u === "organization";
+}
+function fieldUniqueScope(u) {
+  return u === "global" ? "global" : "organization";
+}
+function indexUniqueScope(u) {
+  return u === "organization" ? "organization" : "global";
+}
+function lintUnscopedDeclaredIndexes(objects) {
+  const issues = [];
+  if (!Array.isArray(objects) || objects.length === 0) return issues;
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj?.name) continue;
+    const declaredIndexes = Array.isArray(obj.indexes) ? obj.indexes : [];
+    for (let j = 0; j < declaredIndexes.length; j++) {
+      const idx = declaredIndexes[j];
+      if (idx?.unique !== true) continue;
+      const cols = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string").join(", ") : "";
+      const indexLabel = typeof idx?.name === "string" && idx.name.trim() ? ` '${idx.name.trim()}'` : "";
+      issues.push({
+        severity: "warning",
+        rule: UNIQUE_UNSCOPED_DECLARED_INDEX,
+        message: `"${obj.name}" declares index${indexLabel} [${cols}] with bare \`unique: true\` \u2014 a unique index whose scope is unstated (ADR-0120). Today the bare spelling materializes over exactly its \`fields\`, i.e. installation-wide; an author who meant "unique per organization" gets no per-organization constraint and no error. Protocol 18 rejects this spelling (#5082).`,
+        path: `objects[${i}].indexes[${j}]`,
+        fix: `State the scope: \`unique: 'global'\` (installation-wide \u2014 exactly today's behavior) or \`unique: 'organization'\` (one holder per organization \u2014 the driver prepends the NULL-safe organization key part at registration).`
+      });
+    }
+  }
+  return issues;
 }
 function lintUniqueDeclarations(objects) {
   const issues = [];
@@ -7160,16 +8062,59 @@ function lintUniqueDeclarations(objects) {
     if (singleColumnUniqueIndexes.size === 0) continue;
     for (const { name, def } of fieldEntries2(obj.fields)) {
       if (!uniqueDeclared(def?.unique)) continue;
-      if (def.unique === "global") continue;
       const idx = singleColumnUniqueIndexes.get(name);
       if (!idx) continue;
+      const fScope = fieldUniqueScope(def.unique);
+      const iScope = indexUniqueScope(idx.unique);
       const indexLabel = typeof idx?.name === "string" && idx.name.trim() ? ` '${idx.name.trim()}'` : "";
+      const fieldSpelling = `\`unique: ${typeof def.unique === "string" ? `'${def.unique}'` : def.unique}\``;
+      const indexSpelling = `\`unique: ${typeof idx.unique === "string" ? `'${idx.unique}'` : idx.unique}\``;
+      let message;
+      let fix;
+      if (fScope === iScope) {
+        const boundary = fScope === "global" ? "installation-wide" : "per-organization";
+        message = `"${obj.name}.${name}" declares field-level ${fieldSpelling} AND a single-column unique index${indexLabel} (${indexSpelling}) on the same column. Both ask for the same ${boundary} boundary \u2014 the same unique index declared twice (ADR-0120 D5b). Redundant, not contradictory: drop one so the intent has a single home.`;
+        fix = fScope === "global" ? `Keep ONE spelling of installation-wide uniqueness: \`unique: 'global'\` on '${name}', or the declared index \u2014 not both.` : `Keep ONE spelling of per-organization uniqueness: \`unique: 'organization'\` on '${name}' (preferred), or the declared \`'organization'\` index \u2014 not both.`;
+      } else {
+        const globalSide = fScope === "global" ? `field-level ${fieldSpelling}` : `declared index${indexLabel} (${indexSpelling})`;
+        const orgSide = fScope === "global" ? `declared index${indexLabel} (${indexSpelling})` : `field-level ${fieldSpelling}`;
+        message = `"${obj.name}.${name}" declares an installation-wide unique (${globalSide}) AND a per-organization unique (${orgSide}) on the same column \u2014 the two scopes CONTRADICT (ADR-0120 D5b). The installation-wide index is physically stricter and wins; the per-organization constraint can never be tripped, so one of the two intents you wrote is silently dead.`;
+        fix = `Pick ONE scope and say it once: for installation-wide uniqueness keep \`unique: 'global'\` and drop the per-organization declaration; for per-organization uniqueness set \`unique: 'organization'\` (field-level on '${name}', or on the declared index) and drop the installation-wide one.`;
+      }
       issues.push({
         severity: "warning",
         rule: UNIQUE_DOUBLE_DECLARATION,
-        message: `"${obj.name}.${name}" declares field-level \`unique: true\` AND a single-column unique index${indexLabel} on the same column. Since #3696 the field-level form is scoped per tenant \u2014 \`(tenant, ${name})\` \u2014 while a declared index is materialized over exactly its \`fields\`, i.e. platform-wide. On a tenant-scoped object the global index wins and the per-tenant constraint can never be reached; on a tenancy-less object the two are the same index declared twice. Either way one of the two declarations has no effect.`,
+        message,
         path: `objects[${i}]`,
-        fix: `Pick the intent: for platform-wide uniqueness set \`unique: 'global'\` on '${name}' and drop the duplicate index; for per-tenant uniqueness drop the index (the field-level declaration already builds the tenant composite), or spell the index out as \`fields: ['organization_id', '${name}']\` if you want it explicit.`
+        fix
+      });
+    }
+  }
+  return issues;
+}
+function lintLegacyOrganizationComposites(objects) {
+  const issues = [];
+  if (!Array.isArray(objects) || objects.length === 0) return issues;
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj?.name) continue;
+    const tenantColumn = authoredTenantColumn(obj);
+    const declaredIndexes = Array.isArray(obj.indexes) ? obj.indexes : [];
+    for (let j = 0; j < declaredIndexes.length; j++) {
+      const idx = declaredIndexes[j];
+      if (!uniqueDeclared(idx?.unique) || idx.unique === "organization") continue;
+      const cols = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string") : [];
+      if (cols.length < 2) continue;
+      if (!cols.includes(tenantColumn)) continue;
+      const indexLabel = typeof idx?.name === "string" && idx.name.trim() ? ` '${idx.name.trim()}'` : "";
+      const spelling = `\`unique: ${typeof idx.unique === "string" ? `'${idx.unique}'` : idx.unique}\``;
+      const rest = cols.filter((c) => c !== tenantColumn);
+      issues.push({
+        severity: "warning",
+        rule: UNIQUE_LEGACY_ORGANIZATION_COMPOSITE,
+        message: `"${obj.name}" declares index${indexLabel} [${cols.join(", ")}] with ${spelling} and lists the organization column '${tenantColumn}' itself \u2014 the hand-written per-organization composite that predates the scope vocabulary (ADR-0120 S6). It reads as "unique per organization" but materializes as a plain composite, and SQL UNIQUE is NULL-distinct: on every row whose '${tenantColumn}' is NULL it enforces nothing (#5030) \u2014 which on a single-organization deployment is every row.`,
+        path: `objects[${i}].indexes[${j}]`,
+        fix: `State the scope instead: \`unique: 'organization'\` on this index (keep \`fields\` exactly as they are \u2014 the driver makes the listed '${tenantColumn}' NULL-safe in place rather than prepending a second organization key part). ${rest.length > 0 ? `The constraint then really is "one ${rest.join(" + ")} per organization". ` : ""}Opting in is a physical tightening: it surfaces as a \`recreate_index\` drift op gated by the duplicate pre-flight probe (ADR-0120 D4), so pre-existing duplicate NULL-organization rows block it with a report rather than failing a boot. Leaving it as-is stays valid indefinitely and forces no drift.`
       });
     }
   }
@@ -7318,6 +8263,42 @@ var AUTHORING_RULES = [
     runtimeTypes: ["flow"],
     run: (stack) => validateReferenceIntegrity(stack)
   },
+  // ADR-0078 / #5068 — the SDUI component-props gate. `PageComponent.properties`
+  // is `z.record(z.string(), z.unknown())` and ADR-0089 D3a strictness does not
+  // recurse into it, so until this entry existed the 31 typed prop schemas in
+  // `ComponentPropsMap` were parsed by NOTHING (#4001 批 17's `no gate`
+  // verdict): an undeclared or wrongly-typed prop parsed clean, was retained,
+  // and reached objectui's renderer to be ignored there. This dispatches on
+  // `type` and judges the bag; unregistered types are skipped, which is a
+  // required semantic (`type` is an open union — the example corpus authors 87
+  // nodes of 10 types this map does not carry).
+  //
+  // `normalized` for a reason worth stating, since the props bag survives the
+  // Zod parse UNCHANGED and both tiers would otherwise carry the same data: the
+  // ADR-0087 conversion layer runs inside `normalizeStackInput`, so a converted
+  // alias (`page-header-subtitle-alias` rewrites `properties.description` →
+  // `subtitle`) is already canonical here and is never reported as undeclared —
+  // while a schema error elsewhere in the stack cannot take these findings down
+  // with it.
+  //
+  // Advisory, deliberately, and this is the whole shape of #5068's first step:
+  // wiring the parse is the precondition for enforcement, not the enforcement
+  // (#5020, one surface over). The live corpus violates the declarations in two
+  // places that are open contract questions — inline i18n label maps on three
+  // published platform pages (#5728) and the record picker's declared-but-unread
+  // `displayField` (#5775) — so gating today would fail the platform's own pages
+  // to enforce declarations the platform does not keep. The error upgrade is a
+  // separate step, once the warning-period inventory is empty.
+  {
+    name: "validateComponentProps",
+    tier: "advisory",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-component-props.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    run: (stack) => validateComponentProps(stack)
+  },
   // ADR-0065 — a styled node's responsiveStyles must be scopable (needs an
   // `id`), name real CSS properties + design tokens, and carry a `large` base.
   {
@@ -7381,18 +8362,32 @@ var AUTHORING_RULES = [
     surfaceReason: 'P2 (#4463): the ONE rule the runtime universe makes strictly stronger \u2014 the advisory hedge ("another installed package may provide it") is decidable against the live capability registry, so it graduates from advisory to gating there rather than merely being ported. That promotion is a severity change on a published rule id and belongs in its own PR, not riding a wiring change.',
     run: (stack) => validateCapabilityReferences(stack)
   },
-  // A record-change flow whose start-node objectName matches nothing never
-  // fires — silently. Reads the pre-parse tier so an author sees what they
-  // wrote. Advisory: the object may come from another installed package.
+  // A flow that LOOKS armed and never launches — silently. Reads the pre-parse
+  // tier so an author sees what they wrote.
+  //
+  // `gating` since #5762, which reviewed the file's rules as one family and
+  // split them on a single question: is THIS STACK enough to know the flow is
+  // dead? Three rules answer yes and now emit `error` — a `config.timeRelative`
+  // the spec's own `TimeRelativeTriggerSchema` refuses, one the engine's routing
+  // predicate cannot route at all, and a `record-*` triggerType outside the
+  // closed token grammar `triggerTypeToHookEvents` maps. None of those verdicts
+  // can be changed by installing a package, so there is no reading under which
+  // the flow fires. `flow-trigger-unknown-object` deliberately stayed `warning`
+  // (the object may come from another installed package — a hedge this rule
+  // cannot decide), as did `flow-draft-status-ambiguous` (draft flows DO fire;
+  // that one is ambiguity of intent, not a dead flow).
   {
     name: "validateFlowTriggerReadiness",
-    tier: "advisory",
+    tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-flow-trigger-readiness.ts",
-    // Runtime publish gate (#4463): the FLOW family. Advisory at this surface
-    // too — its findings are logged, not thrown (P1 gates on `error` only; P2
-    // puts advisories on the response for Studio to render).
+    // Runtime publish gate (#4463): the FLOW family. Its `error` findings now
+    // REFUSE a `state: 'active'` write (P1 gates on `error` only); the rules that
+    // stayed `warning` keep being logged as advisories. The gate judges a
+    // snapshot whose `flows` holds only the written item and subtracts the
+    // baseline's findings, so this refuses the dead flow's own publish — never
+    // another flow's save on account of a stored one.
     surfaces: CLI_AND_RUNTIME,
     runtimeTypes: ["flow"],
     run: (stack) => validateFlowTriggerReadiness(stack)
@@ -7603,9 +8598,31 @@ var AUTHORING_RULES = [
       hint: f.hint
     }))
   },
-  // #3991 — a column carrying BOTH a field-level `unique: true` and a
-  // single-column declared unique index has two intents, of which exactly one
-  // takes effect (the global index wins; the tenant composite is unreachable).
+  // ADR-0120 D5a — a declared index with bare `unique: true` states no scope
+  // at all (`unique/unscoped-declared-index` — the #4986 trap). Fires on the
+  // spelling alone, no tenancy inference; 17.x warns, protocol 18 rejects the
+  // spelling (#5082).
+  {
+    name: "lintUnscopedDeclaredIndexes",
+    tier: "advisory",
+    input: "parsed",
+    commands: ["validate", "build"],
+    source: "packages/lint/src/data-model-rules.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly ahead of R10 in its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
+    run: (stack) => lintUnscopedDeclaredIndexes(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
+      severity: f.severity === "suggestion" ? "info" : f.severity,
+      rule: f.rule,
+      where: f.path,
+      path: f.path,
+      message: f.message,
+      hint: f.fix ?? ""
+    }))
+  },
+  // #3991 / ADR-0120 D5b — a column carrying BOTH a field-level `unique` and a
+  // single-column declared unique index states two scopes of which at most one
+  // takes effect (`unique/double-declaration`, the four-quadrant matrix).
   {
     name: "lintUniqueDeclarations",
     tier: "advisory",
@@ -7624,6 +8641,28 @@ var AUTHORING_RULES = [
       hint: f.fix ?? ""
     }))
   },
+  // ADR-0120 D5c — a declared unique listing the organization column IS the
+  // hand-written per-organization composite (S6). Advisory nudge toward the
+  // `'organization'` respelling, which is also what closes its NULL hole
+  // (#5030). Never auto-fixed: opting in is a real D4 tightening.
+  {
+    name: "lintLegacyOrganizationComposites",
+    tier: "advisory",
+    input: "parsed",
+    commands: ["validate", "build"],
+    source: "packages/lint/src/data-model-rules.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly alongside R10/R11 in its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
+    run: (stack) => lintLegacyOrganizationComposites(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
+      severity: f.severity === "suggestion" ? "info" : f.severity,
+      rule: f.rule,
+      where: f.path,
+      path: f.path,
+      message: f.message,
+      hint: f.fix ?? ""
+    }))
+  },
   // ADR-0090 D7 — the security-domain publish linter. Every `error` rule mirrors
   // a runtime enforcement point (fail-closed OWD default, canonical enum, anchor
   // binding gate, vocabulary freeze), moving the failure from a runtime deny to
@@ -7651,6 +8690,88 @@ var AUTHORING_RULES = [
     surfaces: CLI_ONLY,
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateOrgAxisRedLines(stack)
+  },
+  // #4698 — the "declared but never read" gate, for the one surface where the
+  // predicate is EXACT rather than inferred. A sharing rule's `condition` has a
+  // single runtime consumer (`bootstrapDeclaredSharingRules`) whose only use of
+  // the key is `compileCelToFilter(condition, { variables: {} })`; a condition
+  // that does not lower means the rule is SKIPPED at boot, so the grant is
+  // declared and does not exist. The lint calls that same compiler, from the
+  // same package, with the same options — the verdict cannot drift from the
+  // consumer's. Gating for the ADR-0078 reason `SharingRuleSchema`'s own
+  // docblock states: the whole authorable surface is enforced, and this was the
+  // one field where that sentence was not yet true.
+  {
+    name: "validateSharingRuleEnforceability",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-sharing-rule-enforceability.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: "P2 (#4463): a sharing rule is not a `flow`, and P1 gates `flow` alone. The rule itself is snapshot-safe \u2014 it reads ONLY `stack.sharingRules[].condition` and needs no other collection \u2014 so widening it here is a `runtimeTypes: ['sharing_rule']` edit once the gate accepts that type, not new wiring. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
+    run: (stack) => validateSharingRuleEnforceability(stack)
+  },
+  // #4983 — the sibling surface of the rule above, and ADR-0056 D4's gate,
+  // which had never been wired to anything: `isSupportedRlsExpression` existed
+  // solely so an authoring command could reject a predicate the runtime drops,
+  // and no authoring command called it. An unlowerable
+  // `rowLevelSecurity[].using` is DROPPED by `RLSCompiler` and — when it is the
+  // only applicable policy — replaced by `RLS_DENY_FILTER`, so the policy reads
+  // as an authorization and behaves as a blanket refusal. Same construction as
+  // the sharing-rule entry: the verdict is the runtime's own function, reached
+  // through `@objectstack/formula` (where #4983 hoisted it), never a model of it.
+  {
+    name: "validateRlsPredicateEnforceability",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-rls-predicate-enforceability.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: "P2 (#4463): the rule reads `stack.permissions[]`, a stack-wide collection the per-write snapshot does not carry, and P1 gates `flow` alone. It is otherwise snapshot-ready \u2014 it needs no other collection \u2014 so widening it is a `runtimeTypes: ['permission_set']` edit once the gate builds that snapshot, not new wiring. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
+    run: (stack) => validateRlsPredicateEnforceability(stack)
+  },
+  // #4762 — the same "declared but enforces nothing" question, for the two
+  // STATIC artifacts an object validation rule carries. A `format` rule's
+  // `regex` that `new RegExp(...)` throws on, and a `json_schema` rule's schema
+  // ajv cannot compile, are both logged and SKIPPED on the write path
+  // (`rule-validator.ts`), so the rule ships, lists, and protects nothing.
+  // Neither needs a record to judge, so the authoring door is the right one:
+  // rejecting a broken regex at RUNTIME instead would reject every write
+  // touching that field for as long as the metadata is deployed (#4762's own
+  // analysis — the runtime-backstop question stays open for the maintainer).
+  // Gating for the `lint-flow-patterns.ts` bar: no reading of the metadata
+  // behaves as written, because the rule does not run at all.
+  {
+    name: "validateRuleCompilability",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-rule-compilability.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateRuleCompilability(stack)
+  },
+  // #5178 — the residual half of #5029, which registering `ajv-formats` does
+  // NOT close: under `strict: false` a MISSPELLED format name (`emial`) is
+  // logged once and DROPPED, so the rule compiles, ships, runs on every write
+  // and enforces nothing for the keyword its author wrote — and the record is
+  // accepted, which is the silent direction. Deliberately its own entry rather
+  // than a third finding inside the rule above: that one's whole contract is
+  // compiling in the runtime's exact environment, and a typo'd format compiles
+  // there. This judges the format NAME against the registered set (enumerated
+  // from the same ajv instance, never a hardcoded list) and compiles nothing,
+  // so the #4762/#5029 compile parity is untouched — a judgement beside the
+  // compile, not a divergent compile. Gating for the `lint-flow-patterns.ts`
+  // bar: no reading of the metadata behaves as written.
+  {
+    name: "validateRuleSchemaFormats",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-rule-schema-formats.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateRuleSchemaFormats(stack)
   }
 ];