@objectstack/lint 17.0.0-rc.3 → 17.0.0-rc.5

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 import { Manifest } from '@objectstack/sdui-parser';
+import { Options } from 'ajv';
 import { AccessMatrix } from '@objectstack/spec/security';
 export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimeStackContext, m as authoringRulesFor, r as runAuthoringRules, n as runRuntimeAuthoringRules, o as runtimeAuthoringRulesFor, p as runtimeGatedTypes, s as splitBySeverity, q as stackKeyForType } from './runtime-Cs64ShwN.cjs';
 
@@ -79,6 +80,8 @@ declare const CHART_FIELD_UNKNOWN = "chart-field-unknown";
 declare const CHART_CONFIG_MISSING = "chart-config-missing";
 declare const TABLE_COUNT_ONLY = "table-count-only";
 declare const MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
+declare const WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
+declare const WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 declare const DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
 type WidgetBindingSeverity = 'error' | 'warning';
 interface WidgetBindingFinding {
@@ -95,7 +98,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$C = Record<string, unknown>;
+type AnyRec$E = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -103,7 +106,7 @@ type AnyRec$C = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$C): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$E): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -116,12 +119,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$B = Record<string, unknown>;
+type AnyRec$D = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$B): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$D): ExprIssue[];
 
 /**
  * The corrective sentence, lifted **verbatim** from `unevaluableRuleError` in
@@ -153,10 +156,41 @@ interface NullGuardFinding {
 /**
  * Find every ordering/arithmetic operand that resolves to a nullable declared
  * field and is not dominated by a real null guard. Returns `[]` for anything
- * that does not parse (syntax is reported by `validateExpression`, not here) —
- * this pass never invents a second syntax verdict.
+ * that does not parse — this pass never invents a second syntax verdict.
+ *
+ * "Does not parse" is deliberately **not** this module's own opinion (#4812).
+ * The AST comes from `@objectstack/formula`'s `parseCelToAst`, the same front
+ * end `celEngine.compile`/`evaluate` use, so the set of sources this gate can
+ * reason about is exactly the set the platform accepts — rewrite (#3306) and
+ * `DEFAULT_LIMITS` included. This module used to build its own bare
+ * `new Environment({ unlistedVariablesAreDyn: true, enableOptionalTypes: true })`,
+ * which carried **no limits**: it parsed, and then adjudicated, predicates that
+ * `compile()` rejects outright at `Exceeded maxAstNodes (256)` / `maxDepth (32)`
+ * / `maxListElements (64)`. Two parse entries, two answers to "what can be
+ * parsed" — and this gate held the more permissive one.
+ *
+ * A source the canonical front end will not parse is therefore left entirely to
+ * the gate that owns that verdict: `validateExpression` runs at the very same
+ * call sites (`validate-expressions.ts` calls `check()` alongside
+ * `checkNullGuards()`) and reports the syntax fault or the bounds fault as a
+ * blocking error, with a message written for self-correction. Nothing is lost
+ * by staying silent here — and once the author fixes the fault the null-guard
+ * verdict comes back on the next run.
  */
 declare function findUnguardedNullableOperands(source: string, opts: NullGuardOptions): NullGuardFinding[];
+/**
+ * What the surface actually DOES once the predicate aborts (#4811).
+ *
+ * Both outcomes are bugs, but they are *opposite* bugs, and an author needs to
+ * be told which one they have: "your write will be refused" and "your rule will
+ * never fire" send you to different places. Never guess one — read the
+ * surface's runtime and name what it really implements.
+ */
+type NullGuardOutcome = 
+/** Validation rules + hook conditions: the fault propagates, the write is refused (#4761). */
+'fail-closed'
+/** Field `requiredWhen`: `rule-validator.ts` logs and skips, so nothing is enforced (#4811). */
+ | 'fail-open';
 /**
  * The publish-time message for one finding. Names the rule, the operand and the
  * `!= null` fix (the three things the author needs), then closes with the
@@ -164,8 +198,11 @@ declare function findUnguardedNullableOperands(source: string, opts: NullGuardOp
  *
  * @param subject  How the site names itself, e.g. `validation rule 'end_after_start'`.
  * @param objectName  The object whose field list decided nullability.
+ * @param finding  The unguarded operand to report.
+ * @param outcome  What this surface's runtime does with the abort. Defaults to
+ *   `fail-closed` — what both #4763 surfaces do.
  */
-declare function nullGuardMessage(subject: string, objectName: string | undefined, finding: NullGuardFinding): string;
+declare function nullGuardMessage(subject: string, objectName: string | undefined, finding: NullGuardFinding, outcome?: NullGuardOutcome): string;
 
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
@@ -179,7 +216,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$A = Record<string, unknown>;
+type AnyRec$C = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -189,7 +226,7 @@ type AnyRec$A = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$A): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$C): ListViewModeFinding[];
 
 type FunctionalCompletenessSeverity = 'error' | 'warning';
 interface FunctionalCompletenessFinding {
@@ -222,12 +259,44 @@ interface FlowTriggerReadinessFinding {
 }
 declare const FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 declare const FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
-type AnyRec$z = Record<string, unknown>;
+declare const FLOW_TRIGGER_UNKNOWN_EVENT = "flow-trigger-unknown-event";
+/**
+ * #5496 — `config.timeRelative` is present but `TimeRelativeTriggerSchema`
+ * rejects it, so the sweep is never installed.
+ *
+ * Named for the DESCRIPTOR rather than for the rule that reads it, because this
+ * is the first of a family: every flow-node `config` slot whose contract a
+ * schema (or the engine) can already decide, yet which nothing checks at
+ * authoring time. `flow-<descriptor>-<verdict>` is the shape the next one takes.
+ */
+declare const FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID = "flow-time-relative-descriptor-invalid";
+/**
+ * #5647 — `config.timeRelative` is present but is not an object, so the engine
+ * never routes the flow to the time-relative trigger at all.
+ *
+ * The second id in the `flow-<descriptor>-<verdict>` family, and a DIFFERENT
+ * verdict from `…-INVALID` rather than a widening of it. The two partition the
+ * non-null values of one key along the engine's own routing predicate, so
+ * exactly one of them can ever fire on a given descriptor:
+ *
+ *   - `typeof === 'object'` (including arrays and `Date`) — the engine ROUTES
+ *     it, `TimeRelativeTriggerSchema` gets a verdict, and a bad shape is
+ *     `…-INVALID`. That path has a bind-time warn; the rule moves it earlier.
+ *   - anything else (`'daily'`, `7`, `true`, a function) — the engine routes it
+ *     NOWHERE, so no schema and no trigger ever sees it. That is this id, and
+ *     there is no runtime channel at all for it to be moved earlier from.
+ */
+declare const FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-descriptor-unroutable";
+type AnyRec$B = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
- * Pure and dependency-free; safe on pre- or post-parse stacks.
+ *
+ * Pure — no I/O, no runtime, no mutation of `stack` — and safe on pre- or
+ * post-parse stacks. Its one dependency is the `@objectstack/spec` schema that
+ * owns the `timeRelative` descriptor's contract, which is the point: the rule
+ * ASKS that schema rather than restating it.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$z): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$B): FlowTriggerReadinessFinding[];
 
 type FlowTemplatePathSeverity = 'error' | 'warning';
 interface FlowTemplatePathFinding {
@@ -242,12 +311,12 @@ interface FlowTemplatePathFinding {
 }
 declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
-type AnyRec$y = Record<string, unknown>;
+type AnyRec$A = Record<string, unknown>;
 /**
  * Validate `{record.<path>}` template references across every record-change
  * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTemplatePaths(stack: AnyRec$y): FlowTemplatePathFinding[];
+declare function validateFlowTemplatePaths(stack: AnyRec$A): FlowTemplatePathFinding[];
 
 type ReadonlyFlowWriteSeverity = 'error' | 'warning';
 interface ReadonlyFlowWriteFinding {
@@ -262,12 +331,12 @@ interface ReadonlyFlowWriteFinding {
 }
 declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-type AnyRec$x = Record<string, unknown>;
+type AnyRec$z = Record<string, unknown>;
 /**
  * Validate flow `update_record` writes against target-object readonly
  * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateReadonlyFlowWrites(stack: AnyRec$x): ReadonlyFlowWriteFinding[];
+declare function validateReadonlyFlowWrites(stack: AnyRec$z): ReadonlyFlowWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -304,14 +373,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$w = Record<string, unknown>;
+type AnyRec$y = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$w): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$y): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -324,8 +393,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$v = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$v, opts?: {
+type AnyRec$x = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$x, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -338,8 +407,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$u = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$u): ReactPageFinding[];
+type AnyRec$w = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$w): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -350,12 +419,13 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$t = Record<string, unknown>;
+type AnyRec$v = Record<string, unknown>;
 declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
+declare const REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 declare const REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
-declare function validateReactPageProps(stack: AnyRec$t): ReactPropFinding[];
+declare function validateReactPageProps(stack: AnyRec$v): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -367,8 +437,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$s = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$s): SourceStyleFinding[];
+type AnyRec$u = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$u): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -412,34 +482,18 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$r = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$r): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$t): RecordTitleFinding[];
 
-/**
- * Build-time semantic-role diagnostics (ADR-0085).
- *
- * The object-level semantic roles (`stageField`, `highlightFields` /
- * deprecated `compactLayout`, `fieldGroups` + `Field.group`) are pointers
- * into the object's own field map. A dangling pointer is Zod-valid but
- * silently inert at render time — the exact "parsed, unmarked, silently
- * inert" shape ADR-0078 prohibits — so the completeness lint flags it here,
- * uniformly for `os build`/`os validate`, MCP authoring and hand authors.
- *
- * All three rules are warnings, not errors: every consumer degrades
- * gracefully (an unknown `Field.group` renders in the ungrouped bucket, an
- * unknown highlight name is skipped, an unknown `stageField` falls back to
- * heuristics), so nothing is fully broken — but the author almost certainly
- * typo'd a name and should be told at author time, not discover it by
- * staring at an unchanged page.
- */
 declare const FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 declare const FIELD_GROUP_EMPTY = "field-group-empty";
+declare const FIELD_GROUP_SHADOWED = "field-group-shadowed";
 declare const SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
 type SemanticRoleSeverity = 'error' | 'warning';
 interface SemanticRoleFinding {
@@ -456,13 +510,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$q = Record<string, unknown>;
+type AnyRec$s = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$q): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$s): SemanticRoleFinding[];
 
 /**
  * Build-time form-layout diagnostics (#2578).
@@ -505,12 +559,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$p = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$p): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$r): FormLayoutFinding[];
 
 /**
  * Build-time conditional-visibility diagnostics (ADR-0089 D3b).
@@ -572,7 +626,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$o = Record<string, unknown>;
+type AnyRec$q = Record<string, unknown>;
 /**
  * Validate conditional-visibility keys across authored views and pages.
  *
@@ -587,7 +641,7 @@ type AnyRec$o = Record<string, unknown>;
  * `*.view.ts` / `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The
  * alias-deprecated check is layer-agnostic.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$o, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$q, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -605,16 +659,17 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$n = Record<string, unknown>;
+type AnyRec$p = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$n): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$p): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
 declare const APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
+declare const APPROVAL_APPROVER_TYPE_UNSUPPORTED = "approval-approver-type-unsupported";
 declare const APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
 declare const APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY = "approval-approvers-may-resolve-empty";
 declare const APPROVAL_EXPRESSION_INVALID = "approval-expression-invalid";
@@ -635,12 +690,12 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$m = Record<string, unknown>;
+type AnyRec$o = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$m): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$o): ApprovalApproverFinding[];
 
 type SeedReplaySafetySeverity = 'error' | 'warning';
 interface SeedReplaySafetyFinding {
@@ -654,7 +709,7 @@ interface SeedReplaySafetyFinding {
     hint: string;
 }
 declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
-type AnyRec$l = Record<string, unknown>;
+type AnyRec$n = Record<string, unknown>;
 /**
  * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
  * mode, which duplicates its rows on every replay boot (framework#3434). Returns
@@ -664,7 +719,7 @@ type AnyRec$l = Record<string, unknown>;
  * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
  * with no `data` array yields no findings.
  */
-declare function validateSeedReplaySafety(stack: AnyRec$l): SeedReplaySafetyFinding[];
+declare function validateSeedReplaySafety(stack: AnyRec$n): SeedReplaySafetyFinding[];
 
 type SeedStateMachineSeverity = 'warning';
 interface SeedStateMachineFinding {
@@ -678,7 +733,7 @@ interface SeedStateMachineFinding {
     hint: string;
 }
 declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
-type AnyRec$k = Record<string, unknown>;
+type AnyRec$m = Record<string, unknown>;
 /**
  * Flag every seed record whose `state_machine`-governed field carries a value
  * the machine does not declare (framework#3433 follow-up). Returns the findings
@@ -691,7 +746,7 @@ type AnyRec$k = Record<string, unknown>;
  * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
  * statically compared to the declared-state set.
  */
-declare function validateSeedStateMachine(stack: AnyRec$k): SeedStateMachineFinding[];
+declare function validateSeedStateMachine(stack: AnyRec$m): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -702,6 +757,7 @@ declare const SECURITY_ROLE_WORD = "security-role-word";
 declare const SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unknown-set";
 declare const SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
 declare const SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
+declare const SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
 declare const SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 declare const SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
 type SecuritySeverity = 'error' | 'warning' | 'info';
@@ -718,7 +774,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$j = Record<string, unknown>;
+type AnyRec$l = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -726,7 +782,7 @@ type AnyRec$j = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$j, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$l, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 
@@ -759,13 +815,62 @@ declare function validateSecurityPosture(stack: AnyRec$j, opts?: {
  * business-unit sharing rule on a PLATFORM-GLOBAL object (`tenancy.enabled:
  * false`) has no organization column to scope against, so the grant spans every
  * organization in the database — a cross-org BU grant by construction, and the
- * "cross-org BU mega-tree" the ADR rejected, arrived at by accident.
+ * "cross-org BU mega-tree" the ADR rejected, arrived at by accident. It covers
+ * BOTH business-unit recipients, `business_unit` and `unit_and_subordinates`
+ * — see {@link BU_TREE_RECIPIENT_TYPES} for the word list and its deliberate
+ * complement.
  *
  * Both are `error`, per ADR-0049 discipline: each mirrors a real enforcement
  * property (the Layer 0 wall's independence; the org-predicated BU resolver),
  * so the lint moves the failure from silent-wrong-answer to author-time fix-it.
  *
  * Pure `(stack) => Finding[]`; accepts the NORMALIZED stack input.
+ *
+ * ## Scope — the keys this rule reads, and the ones it deliberately does not
+ *
+ * Every key below is one `@objectstack/spec` DECLARES. That is a contract, not
+ * a style preference: the rule is registered `input: 'parsed'`, so what it sees
+ * is what `ObjectStackSchema` returned. An undeclared key never survives to be
+ * read — the stack root strips it, and the `.strict()` sub-schemas reject the
+ * whole stack outright — so a branch keyed on one is inert for every stack an
+ * author can actually ship (#4984, #5009).
+ *
+ * | Read                                  | Declared by                        |
+ * |---------------------------------------|------------------------------------|
+ * | `permissions[]`                       | `ObjectStackSchema`                |
+ * | `permissions[].rowLevelSecurity[]`    | `PermissionSetSchema`              |
+ * | `…[].using` / `…[].check`             | `RowLevelSecurityPolicySchema`     |
+ * | `sharingRules[]`                      | `ObjectStackSchema`                |
+ * | `sharingRules[].condition` / `.sharedWith` / `.object` | `SharingRuleSchema` |
+ * | `objects[].tenancy` / `.systemFields` | `ObjectSchema`                     |
+ *
+ * NOT read, and each for a reason that is a schema fact:
+ *
+ * - `permissionSets` / `sharing` — not declared on the stack root. The root
+ *   STRIPS them, so after parse they are `undefined` no matter what the author
+ *   wrote. The declared spellings are `permissions` and `sharingRules`.
+ * - `sharingRules[].objectName` — `SharingRuleSchema` is `.strict()` and knows
+ *   it only as a rejected name; `object` is required, so the canonical read can
+ *   never be missing on a rule that parsed.
+ * - `objects[].rowLevelSecurity` / `objects[].rls` — **object-level RLS is not
+ *   an authoring surface at all.** `ObjectSchema` declares neither key (nor
+ *   does `authorable-surface.json` list one: the sole entry is
+ *   `security/PermissionSet:rowLevelSecurity`), and `ObjectSchema` is
+ *   `.strict()`, so a stack carrying one does not parse — it is refused with
+ *   "Unrecognized key(s) on this object". Until #5009 this file walked that
+ *   non-existent surface for ~20 lines, complete with an `objects[N].
+ *   rowLevelSecurity[M].using` diagnostic path. Nothing could reach it, and the
+ *   cost was never the missed finding: the next author to read this rule (human
+ *   or AI) came away believing object-level RLS was a real authorization
+ *   surface and wrote more code against it (#5008 nearly did). RLS policies
+ *   live on a permission set; that is the branch above.
+ *
+ * Alias tolerance belongs at the schema's refusal, not in a consumer (Prime
+ * Directive #12) — where it also converts a loud, named rejection into a
+ * silently-inert gate. `validate-org-axis-red-lines.test.ts` pins all of this
+ * structurally: every key read here is checked against the declaring schema's
+ * own `.shape`, and every `findings.push` site must be reachable by a fixture
+ * that passed `safeParse`.
  */
 declare const ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
 declare const ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
@@ -788,18 +893,71 @@ interface OrgAxisFinding {
  */
 declare function validateOrgAxisRedLines(stack: unknown): OrgAxisFinding[];
 
+/** A `condition` outside the pushdown subset — the rule is never seeded. */
+declare const SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
+/** A `condition` reading `current_user.*` — unresolvable when grants are materialized. */
+declare const SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
+type SharingRuleEnforceabilitySeverity = 'error' | 'warning';
+interface SharingRuleEnforceabilityFinding {
+    severity: SharingRuleEnforceabilitySeverity;
+    /** Diagnostic rule id (`sharing-rule-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `sharing rule "high_value_opps" on object "opportunity"`. */
+    where: string;
+    /** Config path, e.g. `sharingRules[2].condition`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
 /**
- * [ADR-0049 — references] Reference-integrity for dashboard header & widget
- * action targets (issue #3367).
+ * Gate stack-declared sharing rules on the ONE thing their runtime consumer
+ * does with `condition`: lower it to a `criteria_json` filter.
+ *
+ * Pure `(stack) => Finding[]`; tolerates the normalized and the parsed tier.
+ */
+declare function validateSharingRuleEnforceability(stack: unknown): SharingRuleEnforceabilityFinding[];
+
+/** A predicate outside the pushdown subset — the policy enforces nothing. */
+declare const RLS_PREDICATE_UNENFORCEABLE = "rls-predicate-unenforceable";
+/** A predicate that does not parse as CEL even after the legacy SQL bridge. */
+declare const RLS_PREDICATE_UNPARSEABLE = "rls-predicate-unparseable";
+type RlsPredicateSeverity = 'error' | 'warning';
+interface RlsPredicateFinding {
+    severity: RlsPredicateSeverity;
+    /** Diagnostic rule id (`rls-predicate-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `permission set "sales" policy "own_leads"`. */
+    where: string;
+    /** Config path, e.g. `permissions[2].rowLevelSecurity[0].using`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Gate every stack-declared RLS predicate on the ONE thing the runtime does
+ * with it: lower it to a FilterCondition (ADR-0056 D4).
+ *
+ * Pure `(stack) => Finding[]`; tolerates the normalized and the parsed tier
+ * (`using` / `check` are plain `z.string()`, identical in both).
+ */
+declare function validateRlsPredicateEnforceability(stack: unknown): RlsPredicateFinding[];
+
+/**
+ * [ADR-0049 — references] Reference-integrity for dashboard header action
+ * targets (issue #3367).
  *
  * ADR-0049 established the "enforce-or-remove" gate for spec *properties*: a
  * declared property the runtime does not honour is a false promise and must be
  * enforced, marked experimental, or removed. This rule applies the SAME honesty
- * principle to *references*. A dashboard header action (or a widget's header
- * action button) names a target — a `script`/`modal` action, or a `url` route —
- * that must actually resolve. A dangling target ships a button that renders and,
- * on click, silently does nothing: a false affordance, exactly the failure
- * ADR-0049 exists to prevent, just for a reference rather than a property.
+ * principle to *references*. A dashboard header action names a target — a
+ * `script`/`modal` action, or a `url` route — that must actually resolve. A
+ * dangling target ships a button that renders and, on click, silently does
+ * nothing: a false affordance, exactly the failure ADR-0049 exists to prevent,
+ * just for a reference rather than a property.
  *
  * Nothing in the protocol schema can express this: `actionUrl` is a free string,
  * so `{ actionType: 'script', actionUrl: 'export_dashboard_pdf' }` parses and
@@ -807,7 +965,24 @@ declare function validateOrgAxisRedLines(stack: unknown): OrgAxisFinding[];
  *
  * Surfaces checked:
  *   - dashboard `header.actions[]` — each `{ actionType, actionUrl }`
- *   - dashboard `widgets[].actionUrl` (+ `actionType`) — the per-widget button
+ *
+ * ## The widget branch, and why it is gone (#5010)
+ *
+ * This rule used to check `widgets[].actionUrl` too, describing it as "the
+ * per-widget button" and claiming in this docblock that it "mirrors the objectui
+ * runtime dispatch". It did not: no renderer in either repo has ever drawn a
+ * per-widget action button — all 14 `actionUrl` reads in `DashboardRenderer` are
+ * scoped to `header.actions[]`. So the strictest arm of this rule (a dangling
+ * `script`/`modal` target is an ERROR, i.e. a failed build) was enforcing
+ * referential integrity for a button that could not render. An author could be
+ * blocked from shipping because a control that does not exist pointed at an
+ * action that also did not.
+ *
+ * That inversion — a rule written to delete false affordances, itself sustaining
+ * one — is why the widget keys were retired rather than the check merely
+ * relaxed: `widgets[].actionUrl` / `actionType` / `actionIcon` are now tombstoned
+ * in `@objectstack/spec` 17.0.0, so authoring one is a `tsc` error and a parse
+ * error carrying the prescription. There is no widget target left to resolve.
  *
  * Resolution mirrors the objectui runtime dispatch (`DashboardRenderer` +
  * `DashboardView`) so the lint flags exactly what would fail to resolve at
@@ -860,13 +1035,13 @@ interface DashboardActionRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$i = Record<string, unknown>;
+type AnyRec$k = Record<string, unknown>;
 /**
- * Validate every dashboard header / widget action reference in a stack. Returns
+ * Validate every dashboard header action reference in a stack. Returns
  * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
  * unresolved routes are warnings.
  */
-declare function validateDashboardActionRefs(stack: AnyRec$i): DashboardActionRefFinding[];
+declare function validateDashboardActionRefs(stack: AnyRec$k): DashboardActionRefFinding[];
 
 /**
  * Build-time filter-placeholder diagnostics (issue #3574).
@@ -964,12 +1139,12 @@ interface ObjectRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$h = Record<string, unknown>;
+type AnyRec$j = Record<string, unknown>;
 /**
  * Validate every object-name reference on the surfaces listed in the module
  * header. Returns findings (empty = clean).
  */
-declare function validateObjectReferences(stack: AnyRec$h): ObjectRefFinding[];
+declare function validateObjectReferences(stack: AnyRec$j): ObjectRefFinding[];
 
 type ReferenceIntegritySeverity = 'error' | 'warning';
 /**
@@ -1193,7 +1368,7 @@ interface SearchableFieldFinding {
  *   runtime would refuse are flagged (#4830).
  */
 type SearchableFieldRole = 'canonical' | 'narrowing';
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$i = Record<string, unknown>;
 /**
  * Validate every `searchableFields` declaration in the stack — the object's own
  * (the canonical set, ADR-0061) and the list views that narrow it. Returns
@@ -1204,7 +1379,7 @@ type AnyRec$g = Record<string, unknown>;
  * `validate-react-page-props` — the gate that already parses that source —
  * runs the same `checkSearchableFieldList` core on it (#4329).
  */
-declare function validateSearchableFields(stack: AnyRec$g): SearchableFieldFinding[];
+declare function validateSearchableFields(stack: AnyRec$i): SearchableFieldFinding[];
 
 declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
 type ActionNameRefSeverity = 'error' | 'warning';
@@ -1222,12 +1397,12 @@ interface ActionNameRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$f = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /**
  * Validate every name-bound action reference in a stack. Returns findings
  * (empty = clean).
  */
-declare function validateActionNameRefs(stack: AnyRec$f): ActionNameRefFinding[];
+declare function validateActionNameRefs(stack: AnyRec$h): ActionNameRefFinding[];
 
 /**
  * [ADR-0078 Phase 3 — Tier-A `action-locations`] An action nobody placed.
@@ -1294,12 +1469,12 @@ interface ActionLocationsFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$e = Record<string, unknown>;
+type AnyRec$g = Record<string, unknown>;
 /**
  * Flag every action that declares no placement and that no view places by
  * name. Returns findings (empty = clean).
  */
-declare function validateActionLocations(stack: AnyRec$e): ActionLocationsFinding[];
+declare function validateActionLocations(stack: AnyRec$g): ActionLocationsFinding[];
 
 /**
  * Shared page-component traversal for the lint rules that inspect
@@ -1325,7 +1500,29 @@ declare function validateActionLocations(stack: AnyRec$e): ActionLocationsFindin
  *     author never wrote, so those pages are skipped here and covered by
  *     `validate-jsx-pages` / `validate-react-page-props` instead.
  */
-type AnyRec$d = Record<string, unknown>;
+type AnyRec$f = Record<string, unknown>;
+/** A visited component plus everything needed to locate and bind it. */
+interface WalkedComponent {
+    /** The component record itself. */
+    component: AnyRec$f;
+    /** Config path, e.g. `pages[0].regions[1].components[2]`. */
+    path: string;
+    /**
+     * The object this component binds against, by precedence:
+     * `dataSource.object` → `properties.object` → the page's `object`.
+     * `undefined` when nothing in the chain names one.
+     */
+    objectName?: string;
+}
+/** Is this page authored as `source` (so its `regions` must not be linted)? */
+declare function isSourceAuthoredPage(page: AnyRec$f): boolean;
+/**
+ * Walk every component on a page, depth-first, yielding each with its config
+ * path and resolved object binding. Source-authored pages yield nothing.
+ *
+ * `pagePath` is the caller's path prefix for the page (e.g. `pages[3]`).
+ */
+declare function walkPageComponents(page: AnyRec$f, pagePath: string): WalkedComponent[];
 
 /**
  * [ADR-0078 — completeness] Field-reference integrity for page components
@@ -1399,7 +1596,33 @@ interface PageFieldFinding {
     hint: string;
 }
 
-declare function validatePageFieldBindings(stack: AnyRec$d): PageFieldFinding[];
+declare function validatePageFieldBindings(stack: AnyRec$f): PageFieldFinding[];
+
+/** A key authored in `properties` that the type's props schema does not declare. */
+declare const COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
+/** A value in `properties` that the type's props schema rejects. */
+declare const COMPONENT_PROPS_INVALID = "component-props-invalid";
+/**
+ * Advisory on every finding this rule emits — see the module header. The type
+ * is a single literal rather than a union so the tier claim in
+ * `authoring-rules.ts` is provable from this file's source, which is exactly
+ * what `authoring-rule-wiring.test.ts` reads it for.
+ */
+type ComponentPropsSeverity = 'warning';
+interface ComponentPropsFinding {
+    severity: ComponentPropsSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `page "task_detail" · record:highlights`. */
+    where: string;
+    /** Config path, e.g. `pages[0].regions[1].components[0].properties.titel`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+declare function validateComponentProps(stack: AnyRec$f): ComponentPropsFinding[];
 
 /**
  * [ADR-0021 — semantic layer] Chart-binding integrity for the surfaces the
@@ -1456,7 +1679,102 @@ interface ChartBindingFinding {
     hint: string;
 }
 
-declare function validateChartBindings(stack: AnyRec$d): ChartBindingFinding[];
+declare function validateChartBindings(stack: AnyRec$f): ChartBindingFinding[];
+
+type RuleCompilabilitySeverity = 'error';
+interface RuleCompilabilityFinding {
+    severity: RuleCompilabilitySeverity;
+    /** Stable diagnostic rule id (`--json` consumers and allowlists key on it). */
+    rule: string;
+    /** Human-readable location, e.g. `object 'account' · validation 'tax_id_format'`. */
+    where: string;
+    /** Config path, e.g. `objects.account.validations.tax_id_format.regex`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/** A `format` rule whose `regex` `new RegExp(...)` refuses to compile. */
+declare const VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
+/** A `json_schema` rule whose `schema` ajv refuses to compile. */
+declare const VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
+/**
+ * The ajv options the runtime's shared instance is constructed with
+ * (`rule-validator.ts`). Exported so the parity test can assert BOTH halves —
+ * that this object is what the gate compiles with, and that the runtime source
+ * still says the same thing.
+ */
+declare const RUNTIME_AJV_OPTIONS: Options;
+type AnyRec$e = Record<string, unknown>;
+/** One authored validation rule, located for a finding. */
+interface WalkedValidationRule {
+    /** The rule record itself — a top-level entry, or a `conditional` branch. */
+    rule: AnyRec$e;
+    /** The declaring object's `name`, or `(unnamed object)`. */
+    objectName: string;
+    /** The nesting-aware rule name as prose: `'outer' → 'inner'`. */
+    label: string;
+    /** Human-readable location: `object 'account' · validation 'outer' → 'inner'`. */
+    where: string;
+    /** Config path of the rule: `objects.account.validations.outer.then.inner`. */
+    basePath: string;
+}
+/**
+ * Reject every object validation rule whose static artifact — a `format` rule's
+ * `regex`, a `json_schema` rule's `schema` — the runtime's own compiler cannot
+ * compile. Pure `(stack) => Finding[]`; never throws.
+ */
+declare function validateRuleCompilability(stack: unknown): RuleCompilabilityFinding[];
+
+type RuleSchemaFormatSeverity = 'error';
+interface RuleSchemaFormatFinding {
+    severity: RuleSchemaFormatSeverity;
+    /** Stable diagnostic rule id (`--json` consumers and allowlists key on it). */
+    rule: string;
+    /** Human-readable location, e.g. `object 'account' · validation 'support_shape'`. */
+    where: string;
+    /**
+     * Config path of the offending keyword — the rule's `schema` key followed by
+     * the RFC 6901 JSON Pointer into it, e.g.
+     * `objects.account.validations.support_shape.schema#/properties/email/format`.
+     */
+    path: string;
+    message: string;
+    hint: string;
+}
+/** A `json_schema` rule naming a `format` the runtime's ajv has not registered. */
+declare const VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
+/**
+ * Depth cap on the schema walk. Not a cycle guard for parsed metadata — that is
+ * a tree — but the same cheap promise `flow-walk.ts`'s `MAX_REGION_DEPTH` and
+ * `validate-rule-compilability.ts`'s `MAX_RULE_NESTING_DEPTH` make: `os lint`
+ * never parses, so it hands this walker whatever object the author's module
+ * actually built, and `const s = { type: 'object' }; s.properties = { self: s };`
+ * is a two-line accident. Well past any reviewable schema.
+ */
+declare const MAX_SCHEMA_WALK_DEPTH = 32;
+/**
+ * The registered name closest to `name`, or `null` when nothing is close enough
+ * to be worth suggesting.
+ *
+ * The budget scales with the typo's own length — three edits on a twelve-letter
+ * name is a plausible slip, three edits on a four-letter one is a different word
+ * — so a genuinely invented name (`shoe_size`) gets no suggestion instead of a
+ * confident wrong one. Comparison is case-insensitive on the authored side so
+ * `Email` is diagnosed as the case typo it is; ajv's own lookup is
+ * case-SENSITIVE, which is exactly why `Email` is unregistered in the first
+ * place. Ties break alphabetically, so the suggestion is stable.
+ */
+declare function nearestRegisteredFormat(name: string, registered: readonly string[]): string | null;
+/**
+ * Reject every `json_schema` validation rule that names a `format` the runtime's
+ * ajv has not registered — the keyword ajv logs once and drops, leaving the rule
+ * declared and inert. Pure `(stack) => Finding[]`.
+ *
+ * Lazier than the compile gate on purpose: the registered set is only asked for
+ * once a schema actually NAMES a format, so a stack whose `json_schema` rules
+ * use none never loads ajv at all (`lazy-deps.test.ts` pins this).
+ */
+declare function validateRuleSchemaFormats(stack: unknown): RuleSchemaFormatFinding[];
 
 declare const NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
 type NavAccessSeverity = 'error' | 'warning';
@@ -1474,12 +1792,12 @@ interface NavAccessFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$c = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /**
  * Validate that every object a stack's navigation exposes is readable by at
  * least one permission set the stack declares. Returns findings (empty = clean).
  */
-declare function validateNavAccess(stack: AnyRec$c): NavAccessFinding[];
+declare function validateNavAccess(stack: AnyRec$d): NavAccessFinding[];
 
 declare const TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 declare const TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
@@ -1498,12 +1816,35 @@ interface TranslationRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$b = Record<string, unknown>;
+type AnyRec$c = Record<string, unknown>;
 /**
  * Validate every reference a translation bundle makes against the metadata it
  * claims to translate. Returns findings (empty = clean).
  */
-declare function validateTranslationReferences(stack: AnyRec$b): TranslationRefFinding[];
+declare function validateTranslationReferences(stack: AnyRec$c): TranslationRefFinding[];
+
+declare const TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
+type TranslatableSectionSeverity = 'warning';
+interface TranslatableSectionFinding {
+    /** Always `warning` — one heading stays in the source locale; nothing breaks. */
+    severity: TranslatableSectionSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "crm_case" · view "case_views" · formViews.create`. */
+    where: string;
+    /** Config path, e.g. `views[0].formViews.create.sections[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$b = Record<string, unknown>;
+/**
+ * Report every form/detail section that declares a heading but no `name`, on an
+ * object the stack actually translates. Returns findings (empty = clean).
+ */
+declare function validateTranslatableSections(stack: AnyRec$b): TranslatableSectionFinding[];
 
 /**
  * [ADR-0064 §3] Skill ↔ agent surface affinity (issue #3820).
@@ -1842,45 +2183,6 @@ declare function buildAccessMatrix(stack: AnyRec$4): AccessMatrix;
  */
 declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
 
-/**
- * Build-time lint for flow authoring ANTI-PATTERNS — metadata that is valid
- * (passes schema + expression checks) but is semantically a footgun at runtime.
- * Most are emitted as WARNINGS: they guide the author (very often an AI
- * generating templates) toward the robust pattern without failing the build on
- * a technically-legal construct.
- *
- * A finding carrying `severity: 'error'` FAILS the build. The bar is: **no
- * reading of the author's metadata does what it says, deterministically, on
- * every run.** Warning about such a shape is just a slower way of finding out.
- * That covers two kinds, and only these:
- *
- *  - **The runtime refuses.** {@link FLOW_RUNAS_UNSCOPED} — a user-less trigger
- *    with `runAs:'user'` has no identity to scope to, so the data operation is
- *    refused outright (#3760).
- *  - **The declaration is inert and the route silently differs from what is
- *    written.** {@link FLOW_BRANCH_LABEL_UNMATCHED} — a decision computes a
- *    branch no out-edge carries, so the branch is discarded and every out-edge
- *    is considered instead. {@link FLOW_DEFAULT_EDGE_WITH_CONDITION} — an edge
- *    that is both the default and conditional; the condition wins and the
- *    marker routes nothing. Neither *fails*; both are wrong every time, and
- *    silently, which is worse (#4414).
- *
- * The bar is deliberately about *provability*, not severity of consequence. A
- * shape with a legitimate reading stays a warning even when it is usually a
- * mistake — {@link FLOW_DECISION_UNCONDITIONAL_BRANCH} is normally a guard that
- * does not guard, but a decision with one guarded and one unconditional out-edge
- * is a legal "maybe notify, always continue" fan-out, and
- * {@link FLOW_MULTIPLE_DEFAULT_EDGES} can genuinely mean "when nothing matched,
- * do both". Failing a customer's build on a shape we cannot prove wrong is a
- * worse trade than letting the warning be ignored.
- *
- * #1874 — time-relative rules via record-change date-EQUALITY. A start-node
- * trigger condition like `end_date == daysFromNow(60)` on a `record-*` trigger
- * only fires if the record happens to be written on that exact day; the robust
- * shape is a daily SCHEDULE trigger + a range query. We flag the equality form
- * specifically (range operators `>=`/`<=` are not flagged — they're the building
- * block of the correct pattern), keeping false positives near zero.
- */
 interface FlowLintFinding {
     where: string;
     message: string;
@@ -1908,6 +2210,12 @@ declare const FLOW_BARE_DOLLAR_REF = "flow-bare-dollar-reference";
 declare const FLOW_APPROVAL_REVISE_DEAD_END = "flow-approval-revise-dead-end";
 declare const FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE = "flow-approval-revise-unmarked-backedge";
 declare const FLOW_APPROVAL_REVISE_DISABLED = "flow-approval-revise-disabled";
+/**
+ * #3823 — the `revise` edge targets a node that is not the service-owned revise
+ * window. `error`: `ApprovalService.sendBack` refuses this metadata outright
+ * (see {@link scanApprovalReviseLoops}).
+ */
+declare const FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED = "flow-approval-revise-target-not-service-owned";
 /**
  * #3760 — renamed from `flow-schedule-runas-unscoped`. The old id named the
  * *schedule*, which was never the boundary: the rule is about a trigger that
@@ -1923,8 +2231,22 @@ declare const FLOW_MULTIPLE_DEFAULT_EDGES = "flow-multiple-default-edges";
 /** #4414 — `config.condition` on a node whose executor never reads it. */
 declare const FLOW_INERT_NODE_CONDITION = "flow-inert-node-condition";
 /**
- * Lint every flow's start node for known authoring anti-patterns. Returns a
- * (possibly empty) list of advisory findings — never throws, never fails a build.
+ * #5482 — a `delete_record` / `update_record` node that declares `multi: true`
+ * and bounds it with NOTHING: the whole-object write, by declaration.
+ *
+ * Named descriptor-first per the family note on
+ * `flow-time-relative-descriptor-invalid` in `validate-flow-trigger-readiness.ts`
+ * (`flow-<descriptor>-<verdict>`, #5496): the descriptor is the
+ * `multi` bulk declaration on a write node, the verdict is that no predicate
+ * bounds it. See {@link scanUnboundedBulkWrites} for why this is a warning and
+ * how it divides labour with the #3810 run-time guard.
+ */
+declare const FLOW_MULTI_WRITE_UNFILTERED = "flow-multi-write-unfiltered";
+/**
+ * Lint every flow for known authoring anti-patterns — its own graph AND every
+ * nested ADR-0031 region (#5383). Returns a (possibly empty) list of findings;
+ * never throws. A finding marked `severity: 'error'` fails the build, and since
+ * #5383 it can be raised by a node inside a `loop` body too.
  */
 declare function lintFlowPatterns(stack: AnyRec$3): FlowLintFinding[];
 
@@ -2003,36 +2325,86 @@ interface LintIssue {
     fix?: string;
 }
 declare const UNIQUE_DOUBLE_DECLARATION = "unique/double-declaration";
-/**
- * R10 — the same column carries BOTH a field-level `unique: true` and an
- * object-level single-column unique index (#3991).
- *
- * The two spellings are deliberately different (see `IndexSchema`): field-level
- * `unique: true` is tenant-scoped since #3696 — it materializes as
- * `(organization_id, col)`, unique *within* the tenant — while a declared index
- * is materialized over exactly the columns listed, i.e. platform-wide. Both are
- * legitimate on their own; together on one column they are never right:
- *
- *   - On a tenant-scoped object they CONTRADICT. The stricter one wins
- *     physically, so the global index enforces uniqueness and the tenant
- *     composite becomes a constraint nothing can ever trip. One of the two
- *     intents the author wrote is silently discarded.
- *   - On a tenancy-less object they are exactly REDUNDANT — both describe the
- *     same single-column unique index, under the same generated name.
- *
- * Tenancy is deliberately NOT inferred here: `organization_id` is injected by
- * the kernel at registration rather than authored, so an authoring-time guess
- * would be wrong half the time. The combination is worth flagging either way,
- * and the message names both readings so the author picks the one they meant.
- *
- * A field declared `unique: 'global'` is exempt: it already says
- * platform-wide, so the declared index restates the same intent rather than
- * contradicting it (still redundant, but not a silent loss of meaning).
+declare const UNIQUE_UNSCOPED_DECLARED_INDEX = "unique/unscoped-declared-index";
+declare const UNIQUE_LEGACY_ORGANIZATION_COMPOSITE = "unique/legacy-organization-composite";
+/**
+ * R11 (ADR-0120 D5a) — a declared index carries bare `unique: true`: the one
+ * spelling whose scope is unstated.
+ *
+ * Positional intent is the #4986 trap: an author writes
+ * `indexes: [{ fields: ['name'], unique: true }]` on an organization-scoped
+ * object, intends "unique per organization", and silently gets
+ * installation-wide. This rule fires on the SPELLING alone — deliberately no
+ * tenancy or posture inference (`organization_id` is kernel-injected at
+ * registration, not authored, so an authoring-time guess would be wrong half
+ * the time; that dead end is documented on #4698). Both replacement words are
+ * checkable at authoring time, which is what makes this the first gate in the
+ * #4986 saga that can actually run here.
+ *
+ * 17.x: warning. Protocol 18 rejects the spelling at validate/publish (#5082).
+ * Advisory — never fails a build in 17.x.
+ *
+ * Wiring: own AUTHORING_RULES entry (validate/build), and `lintDataModel`
+ * calls it for `os lint` — each command reports each finding exactly once.
+ */
+declare function lintUnscopedDeclaredIndexes(objects: any[]): LintIssue[];
+/**
+ * R10 (ADR-0120 D5b) — the same single column carries BOTH a field-level
+ * `unique` and a declared single-column unique index (#3991), judged in the
+ * scope vocabulary. Each side states (or positionally implies) a boundary —
+ * field: `true`/`'organization'` = per-organization, `'global'` =
+ * installation-wide; declared index: `'global'` (or bare `true`, its
+ * deprecated spelling) = installation-wide, `'organization'` =
+ * per-organization — giving four quadrants:
+ *
+ *   - Different scopes (field per-organization × index `'global'`, or field
+ *     `'global'` × index `'organization'`): CONTRADICTION. The installation-wide
+ *     index is physically stricter and wins; the per-organization constraint
+ *     can never be tripped. One declared intent is silently dead.
+ *   - Same scope (both per-organization, or both installation-wide):
+ *     REDUNDANCY — the same index declared twice.
+ *
+ * Tenancy is deliberately NOT inferred here — the quadrants are judged from
+ * the two spellings alone, which is exactly what the vocabulary buys
+ * (pre-ADR-0120, the contradiction quadrant could only be described
+ * conditionally on unknowable tenancy).
+ *
+ * A composite declared index (`['organization_id', 'email']`) stays exempt:
+ * it is the legacy hand-written organization spelling and agrees with the
+ * field-level default (its `'organization'` respelling nudge is ADR-0120 D5c,
+ * a separate wave).
  *
  * Advisory. The resulting stack is well-defined — the cost is an intent that
  * never takes effect, not a broken artifact — so this never fails a build.
  */
 declare function lintUniqueDeclarations(objects: any[]): LintIssue[];
+/**
+ * R12 (ADR-0120 D5c) — a declared unique index whose column list CONTAINS the
+ * organization column: the hand-written per-organization composite (S6),
+ * predating the vocabulary that can now say so.
+ *
+ * Why this is worth a nudge rather than left alone. The legacy spelling
+ * `{ fields: ['organization_id', 'name'], unique: true }` says "per
+ * organization" to a reader and materializes as a plain composite — and SQL
+ * UNIQUE is NULL-distinct, so on every row where the organization column is
+ * NULL it enforces **nothing** (#5030, measured). On a single-organization
+ * deployment that is *every* row. The `'organization'` respelling is what closes
+ * that hole: the driver makes the LISTED organization column NULL-safe in place
+ * (`COALESCE(organization_id, '__global__')`), so the NULL rows become one
+ * platform bucket that is unique among themselves.
+ *
+ * **Advisory, and deliberately no auto-fix.** ADR-0120 D5c is explicit that the
+ * legacy spelling stays valid and unmigrated forever if untouched — zero forced
+ * drift. Opting in is a real physical tightening that goes through the D4
+ * ceremony (a `recreate_index` gated by the duplicate pre-flight probe), because
+ * the rows the void constraint admitted may still be there. Fixing this on the
+ * author's behalf would schedule that migration without asking.
+ *
+ * Not fired for `unique: 'organization'` — that IS the respelling — nor for a
+ * unique declared on the organization column ALONE, which is not a composite and
+ * has no per-organization reading to recover.
+ */
+declare function lintLegacyOrganizationComposites(objects: any[]): LintIssue[];
 /**
  * Lint the relationship / data-modeling conventions across the full object set.
  * Pure and deterministic — safe to call from both the `lint` command and the
@@ -2040,4 +2412,4 @@ declare function lintUniqueDeclarations(objects: any[]): LintIssue[];
  */
 declare function lintDataModel(objects: any[]): LintIssue[];
 
-export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, type PageFieldFinding, type PageFieldSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_TARGET_UNKNOWN, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findUnguardedNullableOperands, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLivenessProperties, lintUniqueDeclarations, lintViewRefs, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateDashboardActionRefs, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateNavAccess, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateSearchableFields, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateStackExpressions, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };
+export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type ComponentPropsFinding, type ComponentPropsSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, type PageFieldFinding, type PageFieldSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findUnguardedNullableOperands, isSourceAuthoredPage, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, nearestRegisteredFormat, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateDashboardActionRefs, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateNavAccess, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings, walkPageComponents };