@objectstack/lint 17.0.0-rc.4 → 17.0.0-rc.6

package/dist/index.js

@@ -333,7 +333,7 @@ function validateWidgetBindings(stack) {
 }
 
 // src/validate-expressions.ts
-import { validateExpression, collectCelRootIdentifiers } from "@objectstack/formula";
+import { validateExpression, collectCelRootIdentifiers, SCOPE_ROOTS } from "@objectstack/formula";
 import { collectFlowGraphs, resolveFlowNodeExpressions } from "@objectstack/spec/automation";
 
 // src/validate-null-guards.ts
@@ -694,6 +694,38 @@ function validateStackExpressions(stack) {
     for (const e of res.errors) issues.push({ where, message: e.message, source: e.source, severity: "error" });
     for (const w of res.warnings) issues.push({ where, message: w.message, source: w.source, severity: "warning" });
   };
+  const FIELD_RULE_BOUND_ROOTS = ["record", "previous", "parent"];
+  const FIELD_RULE_USER_ROOTS = ["current_user", "user", "ctx", "os"];
+  const FIELD_RULE_SLOT_CONSEQUENCE_GENERIC = "the predicate faults, and a faulting rule never produces the verdict you declared \u2014 each slot resolves the fault to its own fallback, and none of those fallbacks is yours";
+  const FIELD_RULE_SLOT_CONSEQUENCE = {
+    visibleWhen: "the predicate faults and the renderer falls back to VISIBLE (`resolveFieldRuleState` evaluates visibility with `fallback: true`, and no server-side gate evaluates a field-level `visibleWhen` at all), leaving the field the test was meant to hide showing for everyone (#6146)",
+    readonlyWhen: "the predicate faults \u2014 and the two ends fault in OPPOSITE directions. The server treats the field as LOCKED (`isReadonlyWhenLocked` will not waive a declared lock it could not evaluate, #4889) and drops your value from the payload, while the form still renders the field editable (`fallback: false`). Per ADR-0057 D10 the server is the one that decides: the field looks writable, the save reports success, and the value silently never lands",
+    requiredWhen: "the predicate faults and the requirement is never enforced anywhere \u2014 the server logs it and SKIPS the check (fail-open, #4977 deliberately did not take #4889's carve-out) and the form does not mark the field required either, so a record saves with the field empty",
+    // Listed rather than left to the `??` below, so the map covers every slot
+    // the field walk passes and the default stays unreachable. `FieldSchema`
+    // declares this key only as a `retiredKey`, which rejects it by name, so
+    // there is no fourth runtime to measure — the honest clause is the generic
+    // one, not a fabricated fourth cell (#6716).
+    conditionalRequired: FIELD_RULE_SLOT_CONSEQUENCE_GENERIC
+  };
+  const checkFieldRuleRoot = (where, slot, raw) => {
+    const source = celSourceOf(raw);
+    if (!source) return;
+    const roots = collectCelRootIdentifiers(source);
+    if (!roots.ok) return;
+    const kept = SCOPE_ROOTS.filter(
+      (r) => !FIELD_RULE_BOUND_ROOTS.includes(r) && roots.roots.includes(r)
+    );
+    if (kept.length === 0) return;
+    const root = FIELD_RULE_USER_ROOTS.find((r) => kept.includes(r)) ?? kept[0];
+    const prescription = FIELD_RULE_USER_ROOTS.includes(root) ? `To gate the CHOICES of a select by user, move the predicate to the option's own \`visibleWhen\` (\`options: [{ \u2026, visibleWhen: \u2026 }]\`) \u2014 per-option is the one \`*When\` surface that binds \`current_user\` and its ADR-0068 aliases. To hide the FIELD by role, declare field-level security on a permission set (\`fields: { '<object>.<field>': { readable: false } }\`), which the server enforces. To gate on record state, rewrite the predicate against \`record\`.` : root === "data" ? `\`data\` is the root of a METADATA form (a \`*.form\` module \u2014 the metadata row being edited); this is an OBJECT field, whose runtime form binds the row as \`record\` \u2014 one key name, two form kinds, two roots. Rewrite \`data.<key>\` as \`record.<field>\`.` : `\`${root}\` is declared platform-wide and bound at OTHER evaluation sites (flow, automation, screen and action predicates), never at the field level. Rewrite the predicate against \`record\` (plus \`previous\`, and \`parent\` on a master-detail line item), or move the decision to a surface that binds \`${root}\`.`;
+    issues.push({
+      where,
+      message: `\`${slot}\` reads \`${root}\`, but a field-level conditional rule binds only \`record\` (plus \`previous\`, and \`parent\` on a master-detail line item) \u2014 \`${root}\` is unbound here, so ${FIELD_RULE_SLOT_CONSEQUENCE[slot] ?? FIELD_RULE_SLOT_CONSEQUENCE_GENERIC}. ` + prescription,
+      source,
+      severity: "error"
+    });
+  };
   const checkDeclaredPredicate = (where, raw) => {
     if (raw == null) return;
     const res = validateExpression("predicate", raw);
@@ -726,7 +758,14 @@ function validateStackExpressions(stack) {
           if (retired.length > 0) {
             issues.push({
               where: `${at} \xB7 node '${node.id}' (script) callable`,
-              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + `Run \`os migrate meta --from 16\` to rewrite it automatically.`,
+              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + // #6856 route D (maintainer-ruled): the house sentence names the TOOL's
+              // behaviour, never the retired key's fate — "rewrite it" reads two ways
+              // over a branch that DELETES the key (template/recipients/variables/script),
+              // "rewrite existing sources" only one. Plain-quoted (not a template literal)
+              // so this site is a member of `retired-key-migrate-sentence.test.ts`'s
+              // widened scan (#7030) on the same textual shape as the spec corpus — no
+              // interpolation lives in this clause, so nothing is lost switching quote style.
+              "Run `os migrate meta --from 16` to rewrite existing sources automatically.",
               source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
             });
           } else if (!fn) {
@@ -760,13 +799,27 @@ function validateStackExpressions(stack) {
     for (const [fname, f] of fieldList) {
       for (const key of ["requiredWhen", "readonlyWhen", "conditionalRequired", "visibleWhen"]) {
         check(`object '${objectName}' \xB7 field '${fname}' ${key}`, f[key], objectName, "record");
+        checkFieldRuleRoot(`object '${objectName}' \xB7 field '${fname}' ${key}`, key, f[key]);
+      }
+      for (const [oi, opt] of asArray2(f.options).entries()) {
+        const label2 = typeof opt.value === "string" ? `'${opt.value}'` : `#${oi}`;
+        check(
+          `object '${objectName}' \xB7 field '${fname}' option ${label2} visibleWhen`,
+          opt.visibleWhen,
+          objectName,
+          "record"
+        );
       }
-      const roWhenSource = celSourceOf(f.readonlyWhen);
-      if (masters !== 1 && roWhenSource && readsParentRoot(roWhenSource)) {
+      for (const [slot, raw, consequence2] of [
+        ["readonlyWhen", f.readonlyWhen, `the field would be locked on every write`],
+        ["requiredWhen", f.requiredWhen, `the requirement would never be enforced \u2014 the predicate faults, the server logs and skips it, and the field stays optional in the database`]
+      ]) {
+        const source = celSourceOf(raw);
+        if (masters === 1 || !source || !readsParentRoot(source)) continue;
         issues.push({
-          where: `object '${objectName}' \xB7 field '${fname}' readonlyWhen`,
-          message: `\`readonlyWhen\` reads \`parent\`, but object '${objectName}' declares ${masters === 0 ? "no" : `${masters}`} \`master_detail\` relationship${masters === 1 ? "" : "s"} \u2014 so the server has no header record to bind as \`parent\` and the field would be locked on every write. ` + (masters === 0 ? `Declare the owning relationship as \`Field.masterDetail('<master>')\`, or rewrite the predicate against \`record\`.` : `\`parent\` needs exactly one master; name the header explicitly through \`record.<fk>\` state instead, or model the extra relationship as a \`lookup\`.`),
-          source: roWhenSource,
+          where: `object '${objectName}' \xB7 field '${fname}' ${slot}`,
+          message: `\`${slot}\` reads \`parent\`, but object '${objectName}' declares ${masters === 0 ? "no" : `${masters}`} \`master_detail\` relationship${masters === 1 ? "" : "s"} \u2014 so the server has no header record to bind as \`parent\` and ${consequence2}. ` + (masters === 0 ? `Declare the owning relationship as \`Field.masterDetail('<master>')\`, or rewrite the predicate against \`record\`.` : `\`parent\` needs exactly one master; name the header explicitly through \`record.<fk>\` state instead, or model the extra relationship as a \`lookup\`.`),
+          source,
           severity: "error"
         });
       }
@@ -859,6 +912,347 @@ function validateStackExpressions(stack) {
   return issues;
 }
 
+// src/lint-startup-registry-verdict.ts
+import { createRequire } from "module";
+var cachedTs = null;
+function loadTypeScript() {
+  if (cachedTs) return cachedTs;
+  const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
+  try {
+    cachedTs = createRequire(anchor)("typescript");
+  } catch (err) {
+    throw new Error(
+      `@objectstack/lint: checking plugin source for startup registry verdicts requires the "typescript" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "typescript" in the image; it is only loaded when plugin source is actually checked.`
+    );
+  }
+  return cachedTs;
+}
+var STARTUP_OPEN_VOCABULARY_VERDICT = "startup-open-vocabulary-verdict";
+var STARTUP_VERDICT_ASSERTIVE_WORDING = "startup-verdict-assertive-wording";
+var OPEN_VOCABULARY_PROBES = /* @__PURE__ */ new Map([
+  [
+    "getRegisteredNodeTypes",
+    "ADR-0018 keeps the flow node-type vocabulary open and runtime-extensible \u2014 a plugin registers its executor from its own init()/start(), which can be after this line (#4771)"
+  ],
+  [
+    "knownNodeTypes",
+    "ADR-0018 keeps the flow node-type vocabulary open and runtime-extensible \u2014 a plugin registers its executor from its own init()/start(), which can be after this line (#4771)"
+  ],
+  [
+    "getUnknownNodeTypeAudit",
+    'the unknown-node-type audit is a snapshot of an OPEN vocabulary a plugin can still extend during boot; it is read-only by design and answers "unknown as of now", never "unknown for this deployment" (#4771)'
+  ],
+  [
+    "getActionDescriptors",
+    'ADR-0018 action descriptors are published by plugins during boot, so a type missing from them here means "not published YET" (#4771)'
+  ],
+  [
+    "getRegisteredExecutors",
+    "executors are contributed by plugins during boot \u2014 an executor missing here may simply be a plugin that has not started"
+  ],
+  [
+    "listExecutors",
+    "executors are contributed by plugins during boot \u2014 an executor missing here may simply be a plugin that has not started"
+  ],
+  [
+    "getRegisteredTools",
+    "AI tools are contributed by plugins during boot, so the registered set is not final until every plugin has started"
+  ],
+  [
+    "listConnectors",
+    "connectors are contributed by plugins during boot (StackSchema.connectors documents provider-bound instances registered by plugins), so the list is not final until every plugin has started"
+  ],
+  [
+    "getRegisteredConnectors",
+    "connectors are contributed by plugins during boot, so the registered set is not final until every plugin has started"
+  ],
+  [
+    "listCapabilities",
+    "ADR-0066 capabilities are declared by every installed package, so the set is not final until every plugin has contributed its declarations"
+  ],
+  [
+    "getRegisteredCapabilities",
+    "ADR-0066 capabilities are declared by every installed package, so the set is not final until every plugin has contributed its declarations"
+  ],
+  [
+    "listProviders",
+    "providers are contributed by plugins during boot \u2014 a provider missing here may simply be a plugin that has not started"
+  ],
+  [
+    "getRegisteredProviders",
+    "providers are contributed by plugins during boot \u2014 a provider missing here may simply be a plugin that has not started"
+  ]
+]);
+var PRE_SEAL_PHASES = /* @__PURE__ */ new Map([
+  ["constructor", "the constructor runs at composition time \u2014 before ANY plugin has been initialized"],
+  ["init", "another plugin's init() may not have run yet (ADR-0116), so the vocabulary is still filling"],
+  [
+    "start",
+    "sibling plugins' start() have not all run, and ADR-0018 lets a plugin register its contributions from start() \u2014 the vocabulary is still filling"
+  ]
+]);
+var SEAL_MARKERS = ["seal"];
+var VERDICT_LEVELS = /* @__PURE__ */ new Set(["warn", "error", "fatal"]);
+var ALL_LEVELS = /* @__PURE__ */ new Set(["warn", "error", "fatal", "info", "debug", "trace", "log"]);
+var PERSISTENCE_CALLEES = /* @__PURE__ */ new Set(["insert", "insertOne", "update", "updateOne", "upsert", "save", "saveMetaItem"]);
+var ASSERTIVE_PHRASES = [
+  "will fail",
+  "fails at execution",
+  "nothing will register",
+  "no plugin provides",
+  "is not installed",
+  "is not configured",
+  "you need",
+  "you must install",
+  "must be provisioned"
+];
+var HEDGE_PHRASES = [
+  "not yet",
+  "yet been registered",
+  "so far",
+  "as of",
+  "may still",
+  "might still",
+  "still be registered",
+  "has started",
+  "have started"
+];
+var STARTUP_VERDICT_HINT = 'Take one of the three shapes the fixes took: (1) resolve where the value is USED, not where you start \u2014 a lazy accessor or a `kernel:ready`/`kernel:bootstrapped` hook sees a provider that registered later (`createLazyCacheRateLimitStorage()` in plugin-auth, #4772); (2) seal the vocabulary, then judge \u2014 have the host declare the moment it can no longer grow and draw the conclusion there (`AutomationEngine.sealNodeTypeVocabulary()`, called at `kernel:bootstrapped`, #4771); (3) order the verdict AFTER the mutation it describes, so it cannot attest to a state this same boot goes on to contradict (the ADR-0104 attestation, #4769). If the conclusion must stay here, keep the two worlds apart in the wording: "no executor registered YET (as of plugin start)" is true; "will fail at execution time" is a claim about a world that has not finished forming.';
+function isFunctionLike(t, node) {
+  return t.isFunctionDeclaration(node) || t.isFunctionExpression(node) || t.isArrowFunction(node) || t.isMethodDeclaration(node) || t.isConstructorDeclaration(node) || t.isGetAccessorDeclaration(node) || t.isSetAccessorDeclaration(node);
+}
+function walkSameTick(t, node, visit) {
+  node.forEachChild((child) => {
+    if (isFunctionLike(t, child) || t.isClassDeclaration(child) || t.isClassExpression(child)) return;
+    visit(child);
+    walkSameTick(t, child, visit);
+  });
+}
+function walkAll(t, node, visit) {
+  node.forEachChild((child) => {
+    visit(child);
+    walkAll(t, child, visit);
+  });
+}
+function calleeName(t, node) {
+  if (!t.isCallExpression(node)) return void 0;
+  const expr = node.expression;
+  if (t.isIdentifier(expr)) return expr.text;
+  if (t.isPropertyAccessExpression(expr) && t.isIdentifier(expr.name)) return expr.name.text;
+  return void 0;
+}
+function loggerLevel(t, node) {
+  if (!t.isCallExpression(node)) return void 0;
+  const expr = node.expression;
+  if (!t.isPropertyAccessExpression(expr) || !t.isIdentifier(expr.name)) return void 0;
+  const level = expr.name.text;
+  if (!ALL_LEVELS.has(level)) return void 0;
+  const receiver = expr.expression;
+  let receiverName;
+  if (t.isIdentifier(receiver)) receiverName = receiver.text;
+  else if (t.isPropertyAccessExpression(receiver) && t.isIdentifier(receiver.name)) receiverName = receiver.name.text;
+  if (!receiverName) return void 0;
+  return /^(logger|log|console)$/i.test(receiverName) ? level : void 0;
+}
+function literalText(t, node) {
+  const parts = [];
+  const take = (n) => {
+    if (t.isStringLiteralLike(n)) parts.push(n.text);
+    else if (t.isTemplateHead(n) || t.isTemplateMiddle(n) || t.isTemplateTail(n)) parts.push(n.text);
+  };
+  take(node);
+  walkAll(t, node, take);
+  return parts.join(" ").toLowerCase();
+}
+function mentionsSeal(t, node) {
+  let found = false;
+  const visit = (n) => {
+    if (found) return;
+    if (t.isIdentifier(n)) {
+      const lower = n.text.toLowerCase();
+      if (SEAL_MARKERS.some((m) => lower.includes(m))) found = true;
+    }
+  };
+  visit(node);
+  walkAll(t, node, visit);
+  return found;
+}
+function moduleLevelMutableBindings(t, sf) {
+  const names = /* @__PURE__ */ new Set();
+  for (const st of sf.statements) {
+    if (!t.isVariableStatement(st)) continue;
+    if (st.declarationList.flags & t.NodeFlags.Const) continue;
+    for (const d of st.declarationList.declarations) {
+      if (t.isIdentifier(d.name)) names.add(d.name.text);
+    }
+  }
+  return names;
+}
+function indexFunctionBodies(t, sf) {
+  const byName = /* @__PURE__ */ new Map();
+  walkAll(t, sf, (node) => {
+    if (t.isFunctionDeclaration(node) && node.name && node.body) byName.set(node.name.text, node.body);
+    else if (t.isMethodDeclaration(node) && t.isIdentifier(node.name) && node.body) byName.set(node.name.text, node.body);
+    else if (t.isVariableDeclaration(node) && t.isIdentifier(node.name) && node.initializer && (t.isArrowFunction(node.initializer) || t.isFunctionExpression(node.initializer)) && node.initializer.body) {
+      byName.set(node.name.text, node.initializer.body);
+    }
+  });
+  return byName;
+}
+function collectLifecycleUnits(t, sf) {
+  const units = [];
+  const readClass = (node) => {
+    const phases = [];
+    let hasLifecycle = false;
+    for (const member of node.members) {
+      if (t.isMethodDeclaration(member) && t.isIdentifier(member.name)) {
+        if (member.name.text === "init" || member.name.text === "start") hasLifecycle = true;
+      } else if (t.isPropertyDeclaration(member) && t.isIdentifier(member.name) && (member.name.text === "init" || member.name.text === "start") && member.initializer && (t.isArrowFunction(member.initializer) || t.isFunctionExpression(member.initializer))) {
+        hasLifecycle = true;
+      }
+    }
+    if (!hasLifecycle) return;
+    for (const member of node.members) {
+      if (t.isConstructorDeclaration(member) && member.body) {
+        phases.push({ phase: "constructor", body: member.body });
+      } else if (t.isMethodDeclaration(member) && t.isIdentifier(member.name) && member.body) {
+        if (PRE_SEAL_PHASES.has(member.name.text)) phases.push({ phase: member.name.text, body: member.body });
+      } else if (t.isPropertyDeclaration(member) && t.isIdentifier(member.name) && PRE_SEAL_PHASES.has(member.name.text) && member.initializer && (t.isArrowFunction(member.initializer) || t.isFunctionExpression(member.initializer)) && member.initializer.body) {
+        phases.push({ phase: member.name.text, body: member.initializer.body });
+      }
+    }
+    if (phases.length) units.push({ label: node.name?.text ?? "<anonymous class>", phases });
+  };
+  const readObjectLiteral = (node) => {
+    const phases = [];
+    let name;
+    let hasLifecycle = false;
+    for (const prop of node.properties) {
+      if (!t.isPropertyAssignment(prop) || !t.isIdentifier(prop.name)) continue;
+      const key = prop.name.text;
+      if (key === "name" && t.isStringLiteralLike(prop.initializer)) name = prop.initializer.text;
+      if ((key === "init" || key === "start") && isFunctionLike(t, prop.initializer)) hasLifecycle = true;
+      if (PRE_SEAL_PHASES.has(key) && (t.isArrowFunction(prop.initializer) || t.isFunctionExpression(prop.initializer)) && prop.initializer.body) {
+        phases.push({ phase: key, body: prop.initializer.body });
+      }
+    }
+    if (!name || !hasLifecycle || !phases.length) return;
+    units.push({ label: `${name} (object plugin)`, phases });
+  };
+  walkAll(t, sf, (node) => {
+    if (t.isClassDeclaration(node) || t.isClassExpression(node)) readClass(node);
+    else if (t.isObjectLiteralExpression(node)) readObjectLiteral(node);
+  });
+  return units;
+}
+function findStartupRegistryVerdicts(source, options = {}) {
+  if (!source || !source.trim()) return [];
+  let mentionsAny = false;
+  for (const probe of OPEN_VOCABULARY_PROBES.keys()) {
+    if (source.includes(probe)) {
+      mentionsAny = true;
+      break;
+    }
+  }
+  if (!mentionsAny) return [];
+  const t = loadTypeScript();
+  const fileLabel = options.file ?? "source";
+  let sf;
+  try {
+    sf = t.createSourceFile(fileLabel, source, t.ScriptTarget.Latest, true, t.ScriptKind.TS);
+  } catch {
+    return [];
+  }
+  const findings = [];
+  const moduleBindings = moduleLevelMutableBindings(t, sf);
+  const functionBodies = indexFunctionBodies(t, sf);
+  const lineOf = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+  for (const unit of collectLifecycleUnits(t, sf)) {
+    for (const { phase, body } of unit.phases) {
+      const scopes = [];
+      const seenNames = /* @__PURE__ */ new Set();
+      const collect = (b, depth) => {
+        scopes.push(b);
+        if (depth >= 2) return;
+        walkSameTick(t, b, (child) => {
+          const name = calleeName(t, child);
+          if (!name || seenNames.has(name)) return;
+          const helper = functionBodies.get(name);
+          if (!helper) return;
+          seenNames.add(name);
+          collect(helper, depth + 1);
+        });
+      };
+      collect(body, 0);
+      const reads = [];
+      for (const scope of scopes) {
+        walkSameTick(t, scope, (node) => {
+          const name = calleeName(t, node);
+          if (name && OPEN_VOCABULARY_PROBES.has(name)) reads.push({ probe: name, node });
+        });
+      }
+      if (!reads.length) continue;
+      if (scopes.some((scope) => mentionsSeal(t, scope))) continue;
+      const records = [];
+      for (const scope of scopes) {
+        walkSameTick(t, scope, (node) => {
+          const level = loggerLevel(t, node);
+          if (level && VERDICT_LEVELS.has(level)) {
+            records.push({ kind: "announced", detail: `${level} log`, line: lineOf(node), node });
+            return;
+          }
+          const cn = calleeName(t, node);
+          if (cn && PERSISTENCE_CALLEES.has(cn)) {
+            records.push({ kind: "persisted", detail: `${cn}()`, line: lineOf(node), node });
+            return;
+          }
+          if (t.isBinaryExpression(node) && node.operatorToken.kind === t.SyntaxKind.EqualsToken) {
+            const lhs = node.left;
+            let target;
+            if (t.isPropertyAccessExpression(lhs) && t.isIdentifier(lhs.name)) {
+              target = lhs.expression.kind === t.SyntaxKind.ThisKeyword ? `this.${lhs.name.text}` : `<obj>.${lhs.name.text}`;
+            } else if (t.isIdentifier(lhs) && moduleBindings.has(lhs.text)) {
+              target = `module-level \`${lhs.text}\``;
+            }
+            if (target) records.push({ kind: "cached", detail: target, line: lineOf(node), node });
+          }
+        });
+      }
+      if (!records.length) continue;
+      const read = reads[0];
+      const record = records[0];
+      const where = `${unit.label}.${phase}${phase === "constructor" ? "" : "()"}`;
+      const note = OPEN_VOCABULARY_PROBES.get(read.probe);
+      const phaseNote = PRE_SEAL_PHASES.get(phase);
+      findings.push({
+        severity: "warning",
+        rule: STARTUP_OPEN_VOCABULARY_VERDICT,
+        where,
+        path: `${fileLabel}:${lineOf(read.node)}`,
+        message: `\`${read.probe}()\` reads a vocabulary that is still filling, and the conclusion is recorded (${record.kind}: ${record.detail}, line ${record.line}). ${note}; ${phaseNote}. "absent" here has two meanings the recorded verdict cannot tell apart \u2014 no provider in this deployment, or a provider that registers later in this same boot \u2014 and nothing retracts the record when the second one turns out to be the case (#4771 / #4772).`,
+        hint: STARTUP_VERDICT_HINT
+      });
+      for (const rec of records) {
+        if (rec.kind !== "announced") continue;
+        const text = literalText(t, rec.node);
+        if (!text) continue;
+        if (HEDGE_PHRASES.some((h) => text.includes(h))) continue;
+        const hit = ASSERTIVE_PHRASES.find((p) => text.includes(p));
+        if (!hit) continue;
+        findings.push({
+          severity: "warning",
+          rule: STARTUP_VERDICT_ASSERTIVE_WORDING,
+          where,
+          path: `${fileLabel}:${rec.line}`,
+          message: `the diagnostic says "${hit}" about a vocabulary that can still grow during this boot. #4771 printed "will fail at execution time" for eight approval flows 0.8s before the executor that runs them was registered, and a deployment that genuinely lacked the plugin printed the identical eight \u2014 so the line could not tell an operator which of the two they had. #4772's remedy ("you need Redis") sent operators to fix a problem they did not have, and connecting Redis did not change the message.`,
+          hint: STARTUP_VERDICT_HINT
+        });
+      }
+    }
+  }
+  return findings;
+}
+
 // src/validate-list-view-mode.ts
 var LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
 function asArray3(v) {
@@ -1002,6 +1396,7 @@ var FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
 var FLOW_TRIGGER_UNKNOWN_EVENT = "flow-trigger-unknown-event";
 var FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID = "flow-time-relative-descriptor-invalid";
 var FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-descriptor-unroutable";
+var FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
 var VALID_RECORD_TRIGGER = /^record-(?:before|after)-(?:create|insert|update|delete|write)$/;
 function asArray4(v) {
   if (Array.isArray(v)) return v;
@@ -1019,6 +1414,11 @@ function renderNonObject(v) {
   if (t === "bigint") return `${String(v)}n (a bigint)`;
   return `a ${t}`;
 }
+function renderTriggerToken(v) {
+  if (typeof v === "string") return `'${v}'`;
+  const json = JSON.stringify(v);
+  return json === void 0 ? `a ${typeof v}` : json;
+}
 function startNodeOf(flow) {
   const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
   const index = nodes.findIndex((n) => n?.type === "start");
@@ -1138,6 +1538,25 @@ function validateFlowTriggerReadiness(stack) {
         hint: `config.timeRelative describes WHICH records to sweep \u2014 an object: { object, dateField, and exactly one of withinDays | offsetDays } (plus optional filter / maxRecords). A cadence like 'daily' is not a descriptor: HOW OFTEN the sweep runs is the sibling key config.schedule on the same start node (it defaults to daily, so it is usually omitted). See TimeRelativeTriggerSchema and content/docs/references/automation/time-relative-trigger.mdx.`
       });
     }
+    const routesToSomeTrigger = isRecordTriggered2 || isArrayRecordTriggered || isTimeRelative || config.schedule != null || flow.type === "schedule" || flow.type === "api" || triggerType === "api";
+    if (start && flow.type === "record_change" && !routesToSomeTrigger) {
+      const hasTriggerType = config.triggerType != null;
+      findings.push({
+        // `error` (#5762's criterion, applied to a fourth id). The verdict is
+        // the engine's own routing chain — literal `startsWith`/`typeof` tests
+        // with no registry lookup in them — so no installed package can make
+        // this token resolve. `registerTrigger` is keyed by the RESOLVED type,
+        // which is the near-miss worth stating: a plugin can supply the
+        // record-change trigger itself, and it still would not help, because
+        // the flow never reaches the point of asking for one.
+        severity: "error",
+        rule: FLOW_TRIGGER_UNROUTABLE,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
+        message: `declares type: 'record_change' but ` + (hasTriggerType ? `its start node's triggerType is ${renderTriggerToken(config.triggerType)}, which the engine routes to NO trigger` : `its start node has no triggerType at all, so there is nothing for the engine to route`) + ` \u2014 it binds a record-change flow only for a token starting with 'record-', so this flow is demoted to a manual one and never fires. Nothing NAMES it: the unbound-flow audit resolves the same binding and skips the flow as "manual \u2014 nothing to bind", so neither the boot warning nor the startup summary lists it; the only trace is the banner's flow count being one higher than its bound count.`,
+        hint: `Use record-{before,after}-{create,update,delete,write} ('write' is create OR update in one flow, #3427; create/insert are synonyms). If the flow really is launched by hand or from a screen, declare type: 'autolaunched' or 'screen' instead of 'record_change' \u2014 those types have no trigger to be missing.`
+      });
+    }
     if (isAutoTriggered && (flow.status == null || flow.status === "draft")) {
       findings.push({
         severity: "warning",
@@ -1907,13 +2326,13 @@ function validateJsxPages(stack, opts = {}) {
 }
 
 // src/validate-react-pages.ts
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 var cachedTransform = null;
 function loadSucraseTransform() {
   if (cachedTransform) return cachedTransform;
   const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
   try {
-    cachedTransform = createRequire(anchor)("sucrase").transform;
+    cachedTransform = createRequire2(anchor)("sucrase").transform;
   } catch (err) {
     throw new Error(
       `@objectstack/lint: validating a kind:'react' page requires the "sucrase" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "sucrase" in the image; it is only loaded when a react-source page is validated.`
@@ -1960,7 +2379,7 @@ function validateReactPages(stack) {
 }
 
 // src/validate-react-page-props.ts
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 import {
   REACT_BLOCKS,
   RECORD_CONTEXT_BLOCK_TAGS,
@@ -1975,6 +2394,7 @@ import { VALID_AST_OPERATORS } from "@objectstack/spec/data";
 // src/validate-searchable-fields.ts
 import {
   resolveSearchFieldResolution,
+  isVirtualSearchField,
   SEARCHABLE_TEXTUAL_TYPES,
   SEARCHABLE_ENUM_TYPES,
   SEARCH_AUTO_EXCLUDED_FIELDS
@@ -2092,7 +2512,19 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
         where,
         path: `${path}[${i}]`,
         message: `${subject} entry "${name}" is not a field on object "${objectName}". The declaration is stale: searching it can never match, and the engine silently drops it \u2014 leaving a narrower search than declared, or the auto-default set once every entry is dropped.` + (dotted ? "" : suggest2(name, known)),
-        hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a formula field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+        hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a stored text field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+      });
+      continue;
+    }
+    if (isVirtualSearchField(target.fields[name])) {
+      const vtype = target.fields[name]?.type;
+      findings.push({
+        severity: "error",
+        rule: SEARCHABLE_FIELD_UNSEARCHABLE,
+        where,
+        path: `${path}[${i}]`,
+        message: `${subject} entry "${name}" on object "${objectName}" is a virtual '${vtype}' field: its value is computed on read and never stored, so no driver materializes a column for 'search' to scan and the entry can never match. It reads as search coverage and delivers none \u2014 the runtime used to admit it verbatim because the declaration named it (#6674).`,
+        hint: `Mirror the computed value onto a stored text field on "${objectName}" and declare that instead, or drop "${name}". At runtime the ingress gate now refuses this entry with 400 INVALID_FIELD, the same answer a stale entry gets (#4254).`
       });
       continue;
     }
@@ -2127,7 +2559,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       where,
       path: `${path}[${i}]`,
       message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...SEARCHABLE_TEXTUAL_TYPES, ...SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
-      hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a text/formula field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
+      hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a stored text field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
     });
   }
   return findings;
@@ -2327,8 +2759,21 @@ var COMPONENT_FIELD_SPECS = {
   "element:number": { props: ["field"] },
   "element:filter": { props: ["fields"] },
   "element:form": { props: ["fields"] },
-  // The schema says `displayField`; real pages author `labelField`. Accept both.
-  "element:record_picker": { props: ["displayField", "labelField", "searchFields"] }
+  // `labelField` is the one field-bearing prop this element declares. Its former
+  // companions `displayField` (renamed to `labelField`, ADR-0087 D2) and
+  // `searchFields` (deleted, ADR-0049) were retired in #5775 and are
+  // `retiredKey()` tombstones on `ElementRecordPickerPropsSchema` — so no
+  // spec-conformant page carries either, and this rule's job (resolve a field
+  // NAME against the object) is not the question a retired key raises (#6629).
+  //
+  // A non-conformant page that writes one anyway is not left unattended: the
+  // #5068 props gate reports the key with its rename/delete prescription. That
+  // gate is advisory and CLI-only and lives in a different registry
+  // (`authoring-rules`) from this suite, so it neither precedes nor suppresses
+  // this rule — what these two entries actually added was a SECOND finding,
+  // saying a field named by a key that no longer exists does not exist either.
+  // The prescription is the useful half; this half was noise on top of it.
+  "element:record_picker": { props: ["labelField"] }
 };
 var RELATED_LIST_TYPE = "record:related_list";
 function componentFieldRefs(type, props, basePath, sep = ".") {
@@ -2488,18 +2933,18 @@ function describeIssue(issue, root, depth = 0) {
 }
 
 // src/validate-react-page-props.ts
-var cachedTs = null;
-function loadTypeScript() {
-  if (cachedTs) return cachedTs;
+var cachedTs2 = null;
+function loadTypeScript2() {
+  if (cachedTs2) return cachedTs2;
   const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
   try {
-    cachedTs = createRequire2(anchor)("typescript");
+    cachedTs2 = createRequire3(anchor)("typescript");
   } catch (err) {
     throw new Error(
       `@objectstack/lint: validating a kind:'react' page requires the "typescript" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "typescript" in the image; it is only loaded when a react-source page is validated.`
     );
   }
-  return cachedTs;
+  return cachedTs2;
 }
 var asArray12 = (v) => Array.isArray(v) ? v : [];
 var BLOCKS = new Map(
@@ -2632,7 +3077,7 @@ function checkChartAggregate(raw, push2) {
       "warning",
       REACT_CHART_AGGREGATE_INVALID,
       "aggregate.groupBy is not set, so the aggregate returns ONE ungrouped row and the chart plots a single point.",
-      "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. Deliberate single-value charts are tolerated at warning level for now: ChartAggregateSchema declares groupBy required while ObjectChart honours its absence by falling back to xAxisKey \u2014 objectstack#5583 decides which of the two moves."
+      "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. objectstack#5583 ruled that an ungrouped single-value chart is NOT a supported <ObjectChart> shape \u2014 groupBy stays required, and a single number belongs in an object-metric block instead. This stays a warning rather than an error only because promoting it is its own step."
     );
   }
   const parsed = ChartAggregateSchema.safeParse(raw);
@@ -2892,7 +3337,7 @@ function validateReactPageProps(stack) {
     const source = page.source;
     if (typeof source !== "string" || source.trim() === "") continue;
     const name = String(page.name ?? `#${p}`);
-    const tsc = loadTypeScript();
+    const tsc = loadTypeScript2();
     let sf;
     try {
       sf = tsc.createSourceFile("page.tsx", source, tsc.ScriptTarget.Latest, true, tsc.ScriptKind.TSX);
@@ -3150,7 +3595,7 @@ function validateSemanticRoles(stack) {
       (h) => typeof h === "string" && h.length > 0
     );
     if (declaredStrings.length > 0 && declaredGroups.size > 0) {
-      const declaredTitle = [obj.nameField, obj.primaryField, obj.displayNameField].find((v) => typeof v === "string" && v.length > 0 && fieldNames.has(v));
+      const declaredTitle = [obj.nameField, obj.displayNameField].find((v) => typeof v === "string" && v.length > 0 && fieldNames.has(v));
       const titleField = declaredTitle ?? ["name", "full_name", "title", "subject", "display_name"].find((c) => fieldNames.has(c));
       const stripSet = new Set(
         declaredStrings.filter((h) => h !== titleField).slice(0, 4)
@@ -3175,6 +3620,60 @@ function validateSemanticRoles(stack) {
   return findings;
 }
 
+// src/collection-entries.ts
+function isRec8(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function collectionEntries(v, base) {
+  if (Array.isArray(v)) {
+    const out = [];
+    for (let i = 0; i < v.length; i++) {
+      if (isRec8(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
+    }
+    return out;
+  }
+  if (isRec8(v)) {
+    return Object.entries(v).filter(([, def]) => isRec8(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
+  }
+  return [];
+}
+
+// src/view-walk.ts
+function isRec9(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName5(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function viewObjectName(view) {
+  return strName5(view.objectName) ?? strName5(view.object) ?? (isRec9(view.data) ? strName5(view.data.object) : void 0);
+}
+function viewContainerSites(view, basePath) {
+  if (!isRec9(view)) return [];
+  const sites = [{ view, path: basePath, surface: "", kind: "self" }];
+  if (isRec9(view.form)) {
+    sites.push({ view: view.form, path: `${basePath}.form`, surface: "form", kind: "form" });
+  }
+  for (const key of ["listViews", "formViews"]) {
+    const container = view[key];
+    if (!isRec9(container)) continue;
+    const kind = key === "listViews" ? "listView" : "formView";
+    for (const [subKey, sub] of Object.entries(container)) {
+      if (!isRec9(sub)) continue;
+      sites.push({
+        view: sub,
+        path: `${basePath}.${key}.${subKey}`,
+        surface: `${key}.${subKey}`,
+        kind
+      });
+    }
+  }
+  return sites;
+}
+function formViewSites(view, basePath) {
+  return viewContainerSites(view, basePath).filter((site) => site.kind !== "listView");
+}
+
 // src/validate-form-layout.ts
 var FORM_FIELD_UNKNOWN = "form-field-unknown";
 var FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
@@ -3185,6 +3684,12 @@ function asArray16(v) {
   }
   return [];
 }
+function isRec10(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName6(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
 function fieldNameOf(entry) {
   if (typeof entry === "string") return entry.length > 0 ? entry : null;
   if (entry && typeof entry === "object" && !Array.isArray(entry)) {
@@ -3193,13 +3698,6 @@ function fieldNameOf(entry) {
   }
   return null;
 }
-function boundObject(view) {
-  const data = view.data;
-  if (data && typeof data === "object" && typeof data.object === "string") {
-    return data.object;
-  }
-  return typeof view.objectName === "string" ? view.objectName : void 0;
-}
 function validateFormLayout(stack) {
   const findings = [];
   const objectFields = /* @__PURE__ */ new Map();
@@ -3209,44 +3707,44 @@ function validateFormLayout(stack) {
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? Object.keys(obj.fields) : [];
     objectFields.set(name, new Set(fields));
   }
-  const views = asArray16(stack.views);
-  for (let i = 0; i < views.length; i++) {
-    const view = views[i];
-    if (!view || typeof view !== "object") continue;
-    const sections = Array.isArray(view.sections) ? view.sections : null;
-    if (!sections) continue;
-    const viewName = typeof view.name === "string" ? view.name : `(view ${i})`;
-    const objName = boundObject(view);
-    const known = objName ? objectFields.get(objName) : void 0;
-    const where = `view "${viewName}"`;
-    const base = `views[${i}]`;
-    for (let s = 0; s < sections.length; s++) {
-      const sec = sections[s];
-      const secFields = sec && typeof sec === "object" && Array.isArray(sec.fields) ? sec.fields : [];
-      for (let f = 0; f < secFields.length; f++) {
-        const entry = secFields[f];
-        const fname = fieldNameOf(entry);
-        const fpath = `${base}.sections[${s}].fields[${f}]`;
-        if (fname && known && !known.has(fname)) {
-          findings.push({
-            severity: "warning",
-            rule: FORM_FIELD_UNKNOWN,
-            where,
-            path: fpath,
-            message: `${viewName}: field "${fname}" is not a field on object "${objName}" \u2014 it is silently skipped and never renders on the form`,
-            hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
-          });
-        }
-        const colSpan = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.colSpan : void 0;
-        if (colSpan != null) {
-          findings.push({
-            severity: "warning",
-            rule: FORM_COLSPAN_ABSOLUTE,
-            where,
-            path: `${fpath}.colSpan`,
-            message: `${viewName}: field "${fname ?? "?"}" sets absolute colSpan ${String(colSpan)} \u2014 the form's column count is derived per surface (mobile 1 / modal 2 / page 3-4), so a fixed span only aligns at one width`,
-            hint: `Prefer span: 'full' (whole row at any column count), or omit for auto width. The renderer clamps colSpan to the current column count.`
-          });
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = strName6(view.name) ?? strName6(view.object) ?? viewPath;
+    const containerObject = viewObjectName(view);
+    for (const site of formViewSites(view, viewPath)) {
+      const objName = viewObjectName(site.view) ?? containerObject;
+      const known = objName ? objectFields.get(objName) : void 0;
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const sec = sections[s];
+          const secFields = isRec10(sec) && Array.isArray(sec.fields) ? sec.fields : [];
+          for (let f = 0; f < secFields.length; f++) {
+            const entry = secFields[f];
+            const fname = fieldNameOf(entry);
+            const fpath = `${site.path}.${bucket}[${s}].fields[${f}]`;
+            if (fname && known && !known.has(fname)) {
+              findings.push({
+                severity: "warning",
+                rule: FORM_FIELD_UNKNOWN,
+                where,
+                path: fpath,
+                message: `${viewName}: field "${fname}" is not a field on object "${objName}" \u2014 it is silently skipped and never renders on the form`,
+                hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
+              });
+            }
+            const colSpan = isRec10(entry) ? entry.colSpan : void 0;
+            if (colSpan != null) {
+              findings.push({
+                severity: "warning",
+                rule: FORM_COLSPAN_ABSOLUTE,
+                where,
+                path: `${fpath}.colSpan`,
+                message: `${viewName}: field "${fname ?? "?"}" sets absolute colSpan ${String(colSpan)} \u2014 the form's column count is derived per surface (mobile 1 / modal 2 / page 3-4), so a fixed span only aligns at one width`,
+                hint: `Prefer span: 'full' (whole row at any column count), or omit for auto width. The renderer clamps colSpan to the current column count.`
+              });
+            }
+          }
         }
       }
     }
@@ -3255,17 +3753,17 @@ function validateFormLayout(stack) {
 }
 
 // src/validate-visibility-predicates.ts
-var VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
+import {
+  collectCelRootIdentifiers as collectCelRootIdentifiers2,
+  firstUndeclaredReference,
+  parseCelToAst as parseCelToAst2,
+  parseCelToAstWithReason
+} from "@objectstack/formula";
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
+var VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
+var VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
+var VISIBILITY_PREDICATE_OVER_BUDGET = "visibility-predicate-over-budget";
 var CANONICAL = "visibleWhen";
-var ALIASES = ["visibleOn", "visibility"];
-function asArray17(v) {
-  if (Array.isArray(v)) return v;
-  if (v && typeof v === "object") {
-    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
-  }
-  return [];
-}
 function predicateSource(v) {
   if (typeof v === "string") return v;
   if (v && typeof v === "object" && typeof v.source === "string") {
@@ -3276,6 +3774,67 @@ function predicateSource(v) {
 function usesRoot(source, root) {
   return new RegExp(`(^|[^.\\w$])${root}\\.\\w`).test(source);
 }
+function withoutStringLiterals(source) {
+  return source.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"/g, (lit) => " ".repeat(lit.length));
+}
+var NON_CEL_SPELLINGS = [
+  { wrote: "===", cel: "==", example: "record.country == 'USA'", re: /===/ },
+  { wrote: "!==", cel: "!=", example: "record.country != 'USA'", re: /!==/ },
+  { wrote: "<>", cel: "!=", example: "record.country != 'USA'", re: /<>/ },
+  { wrote: "and", cel: "&&", example: "record.a == 1 && record.b == 2", re: /(?<![.\w$])and(?![\w$])/i },
+  { wrote: "or", cel: "||", example: "record.a == 1 || record.b == 2", re: /(?<![.\w$])or(?![\w$])/i },
+  { wrote: "not", cel: "!", example: "!record.archived", re: /(?<![.\w$])not(?![\w$])/i },
+  // Assignment where a comparison was meant. Last, and fenced off from every
+  // operator that legitimately contains `=` (`==`, `!=`, `<=`, `>=`).
+  { wrote: "=", cel: "==", example: "record.status == 'open'", re: /(?<![=!<>])=(?!=)/ }
+];
+function quoteSource(source) {
+  const flat = source.replace(/\s+/g, " ").trim();
+  return flat.length > 120 ? `${flat.slice(0, 117)}...` : flat;
+}
+function celRefusal(source) {
+  if (!source.trim()) return null;
+  const parsed = parseCelToAstWithReason(source);
+  if (parsed.ok || parsed.kind === "empty") return null;
+  if (parsed.kind === "bounds") return { kind: "bounds", overrun: parsed.overrun };
+  const identifiers = collectCelRootIdentifiers2(source);
+  const detail = identifiers.ok ? "the expression could not be parsed" : identifiers.error.split("\n")[0].trim();
+  const scannable = withoutStringLiterals(source);
+  return { kind: "syntax", detail, token: NON_CEL_SPELLINGS.find((s) => s.re.test(scannable)) ?? null };
+}
+function boundName(overrun) {
+  return overrun.limit && overrun.limitValue !== null ? `the \`${overrun.limit}\` budget (platform limit ${overrun.limitValue})` : "one of the platform's parse budgets";
+}
+var VIEW_PAGE_EXTRA_ROOTS = ["current_user", "page"];
+function isNode2(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function namespaceRoots(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) namespaceRoots(child, out);
+    return;
+  }
+  if (!isNode2(node)) return;
+  const args = node.args;
+  if (Array.isArray(args)) {
+    const receiver = node.op === "rcall" ? args[1] : args[0];
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode2(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+      out.add(receiver.args);
+    }
+  }
+  namespaceRoots(args, out);
+}
+function firstBareIdentifier(source) {
+  const ast = parseCelToAst2(source);
+  if (!ast) return null;
+  const rooted = /* @__PURE__ */ new Set();
+  namespaceRoots(ast, rooted);
+  return firstUndeclaredReference(source, [...VIEW_PAGE_EXTRA_ROOTS, ...rooted]);
+}
+var CANONICAL_ROOT_BY_LAYER = {
+  runtime: "record",
+  metadata: "data"
+};
 var MISLAYER_BY_LAYER = {
   runtime: {
     forbiddenRoot: "data",
@@ -3289,18 +3848,6 @@ var MISLAYER_BY_LAYER = {
   }
 };
 function checkElement(el, where, path, layer, findings) {
-  for (const alias of ALIASES) {
-    if (el[alias] !== void 0) {
-      findings.push({
-        severity: "warning",
-        rule: VISIBILITY_ALIAS_DEPRECATED,
-        where,
-        path: `${path}.${alias}`,
-        message: `\`${alias}\` is the deprecated spelling of the conditional-visibility predicate (ADR-0089). It still works \u2014 it is normalized to \`visibleWhen\` at parse \u2014 but the canonical key is \`visibleWhen\`.`,
-        hint: `Rename the key \`${alias}\` \u2192 \`visibleWhen\` (same CEL value).`
-      });
-    }
-  }
   const raw = el[CANONICAL] ?? el.visibleOn ?? el.visibility;
   const source = predicateSource(raw);
   const rule = MISLAYER_BY_LAYER[layer];
@@ -3314,6 +3861,43 @@ function checkElement(el, where, path, layer, findings) {
       hint: rule.hint
     });
   }
+  const refusal = source ? celRefusal(source) : null;
+  if (source && refusal?.kind === "bounds") {
+    const bound = boundName(refusal.overrun);
+    const root = CANONICAL_ROOT_BY_LAYER[layer];
+    findings.push({
+      severity: "error",
+      rule: VISIBILITY_PREDICATE_OVER_BUDGET,
+      where,
+      path,
+      message: `visibility predicate is syntactically valid CEL but overruns ${bound} (${refusal.overrun.summary}) (predicate: \`${quoteSource(source)}\`). The canonical front end refuses it, so it can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+      hint: `There is no syntax or dialect error to correct here \u2014 this is a SIZE fault, not a dialect mistake, so re-spelling the predicate will not fix it. Make it smaller, or move the work off the predicate: (1) collapse a long \`${root}.f == 'a' || ${root}.f == 'b' || \u2026\` chain into a single \`${root}.f in ['a', 'b', \u2026]\`, which is far fewer AST nodes (\`maxListElements\` is 64, so a very large set needs option 2); (2) precompute the heavy part into a formula/rollup field on the object and test that one field instead. Logic genuinely this large is not element visibility \u2014 compute it once on the record rather than re-deriving it in every predicate that needs it.`
+    });
+  }
+  if (source && refusal?.kind === "syntax") {
+    findings.push({
+      severity: "error",
+      rule: VISIBILITY_PREDICATE_SYNTAX,
+      where,
+      path,
+      message: `visibility predicate is not valid CEL \u2014 ${refusal.detail} (predicate: \`${quoteSource(source)}\`). A predicate that does not parse can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+      hint: refusal.token ? `\`${refusal.token.wrote}\` is not a CEL operator \u2014 CEL spells it \`${refusal.token.cel}\`. Replace \`${refusal.token.wrote}\` with \`${refusal.token.cel}\`, e.g. \`${refusal.token.example}\`.` : `Visibility predicates are bare CEL, e.g. \`record.status == 'open'\`. Spellings from other languages do not parse: write \`==\` (not \`===\`), \`!=\` (not \`!==\` or \`<>\`), \`&&\` (not \`and\`), \`||\` (not \`or\`), \`!\` (not \`not\`).`
+    });
+  }
+  if (source && !refusal) {
+    const bare = firstBareIdentifier(source);
+    if (bare) {
+      const root = CANONICAL_ROOT_BY_LAYER[layer];
+      findings.push({
+        severity: "error",
+        rule: VISIBILITY_BARE_IDENTIFIER,
+        where,
+        path,
+        message: `visibility predicate references \`${bare}\` as a bare identifier. Values are bound under a namespace on this surface \u2014 they are never flattened to top level \u2014 so \`${bare}\` resolves to nothing, the predicate can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+        hint: `Write \`${root}.${bare}\` instead of \`${bare}\`` + (layer === "runtime" ? " (runtime view/page surfaces bind `record` + `current_user`; a page component also exposes page state as `page.<var>`)." : " (a `*.form.ts` metadata-editing form binds the row under edit as `data`).")
+      });
+    }
+  }
 }
 function isFieldObject(entry) {
   return !!entry && typeof entry === "object" && !Array.isArray(entry);
@@ -3321,43 +3905,304 @@ function isFieldObject(entry) {
 function validateVisibilityPredicates(stack, opts = {}) {
   const layer = opts.layer ?? "runtime";
   const findings = [];
-  const views = asArray17(stack.views);
-  for (let i = 0; i < views.length; i++) {
-    const view = views[i];
-    if (!view || typeof view !== "object") continue;
-    const viewName = typeof view.name === "string" ? view.name : `(view ${i})`;
-    const where = `view "${viewName}"`;
-    for (const bucket of ["sections", "groups"]) {
-      const sections = Array.isArray(view[bucket]) ? view[bucket] : [];
-      for (let s = 0; s < sections.length; s++) {
-        const sec = sections[s];
-        if (!sec || typeof sec !== "object") continue;
-        const secPath = `views[${i}].${bucket}[${s}]`;
-        checkElement(sec, where, secPath, layer, findings);
-        const secFields = Array.isArray(sec.fields) ? sec.fields : [];
-        for (let f = 0; f < secFields.length; f++) {
-          const entry = secFields[f];
-          if (isFieldObject(entry)) {
-            checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
+    for (const site of formViewSites(view, viewPath)) {
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const sec = sections[s];
+          if (!sec || typeof sec !== "object") continue;
+          const secPath = `${site.path}.${bucket}[${s}]`;
+          checkElement(sec, where, secPath, layer, findings);
+          const secFields = Array.isArray(sec.fields) ? sec.fields : [];
+          for (let f = 0; f < secFields.length; f++) {
+            const entry = secFields[f];
+            if (isFieldObject(entry)) {
+              checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+            }
           }
         }
       }
     }
   }
-  const pages = asArray17(stack.pages);
-  for (let i = 0; i < pages.length; i++) {
-    const page = pages[i];
-    if (!page || typeof page !== "object") continue;
-    const pageName = typeof page.name === "string" ? page.name : `(page ${i})`;
-    const where = `page "${pageName}"`;
-    const regions = Array.isArray(page.regions) ? page.regions : [];
-    for (let r = 0; r < regions.length; r++) {
-      const region = regions[r];
-      const components = region && typeof region === "object" && Array.isArray(region.components) ? region.components : [];
-      for (let c = 0; c < components.length; c++) {
-        const comp = components[c];
-        if (comp && typeof comp === "object") {
-          checkElement(comp, where, `pages[${i}].regions[${r}].components[${c}]`, layer, findings);
+  for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
+    const pageName = typeof page.name === "string" ? page.name : void 0;
+    const where = `page "${pageName ?? pagePath}"`;
+    for (const walked of walkPageComponents(page, pagePath)) {
+      checkElement(walked.component, where, walked.path, layer, findings);
+    }
+  }
+  return findings;
+}
+
+// src/validate-predicate-path-refs.ts
+import { parseCelToAst as parseCelToAst3 } from "@objectstack/formula";
+import { getMetadataTypeSchema } from "@objectstack/spec/kernel";
+import { findClosestMatches, formatSuggestion } from "@objectstack/spec";
+var PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
+var PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
+var PREDICATE_KEYS = ["visibleWhen", "visibleOn"];
+var ROOT = "data";
+var COMPREHENSION_MACROS = /* @__PURE__ */ new Set(["all", "exists", "exists_one", "map", "filter"]);
+function defOf(schema) {
+  if (!schema || typeof schema !== "object" && typeof schema !== "function") return void 0;
+  const s = schema;
+  return s.def ?? s._def;
+}
+function peel(schema, depth = 0) {
+  if (!schema || depth > 25) return schema;
+  const d = defOf(schema);
+  if (!d) return schema;
+  switch (d.type) {
+    case "optional":
+    case "nullable":
+    case "default":
+    case "prefault":
+    case "readonly":
+    case "catch":
+    case "nonoptional":
+      return peel(d.innerType, depth + 1);
+    case "lazy":
+      return peel(d.getter(), depth + 1);
+    case "pipe": {
+      const inner = peel(d.in, depth + 1);
+      return defOf(inner)?.type === "transform" ? peel(d.out, depth + 1) : inner;
+    }
+    default:
+      return schema;
+  }
+}
+function optionsOf(d) {
+  return Array.isArray(d?.options) ? d.options : [];
+}
+function keysOf(schema, depth = 0) {
+  if (depth > 25) return null;
+  const u = peel(schema);
+  const d = defOf(u);
+  if (d?.type === "object") return Object.keys(d.shape ?? u.shape ?? {});
+  if (d?.type === "union" || d?.type === "discriminated_union") {
+    const all = /* @__PURE__ */ new Set();
+    let keyBearing = false;
+    for (const option of optionsOf(d)) {
+      const k = keysOf(option, depth + 1);
+      if (!k) continue;
+      keyBearing = true;
+      for (const key of k) all.add(key);
+    }
+    return keyBearing ? [...all] : null;
+  }
+  if (d?.type === "intersection") {
+    const left = keysOf(d.left, depth + 1);
+    const right = keysOf(d.right, depth + 1);
+    if (!left && !right) return null;
+    return [.../* @__PURE__ */ new Set([...left ?? [], ...right ?? []])];
+  }
+  return null;
+}
+function propertyOf(schema, key, depth = 0) {
+  if (depth > 25) return void 0;
+  const u = peel(schema);
+  const d = defOf(u);
+  if (d?.type === "object") return (d.shape ?? u.shape ?? {})[key];
+  if (d?.type === "union" || d?.type === "discriminated_union") {
+    for (const option of optionsOf(d)) {
+      const found = propertyOf(option, key, depth + 1);
+      if (found !== void 0) return found;
+    }
+  }
+  if (d?.type === "intersection") {
+    return propertyOf(d.left, key, depth + 1) ?? propertyOf(d.right, key, depth + 1);
+  }
+  return void 0;
+}
+function rowScopeOf(scope, key) {
+  const prop = propertyOf(scope, key);
+  if (prop === void 0) return void 0;
+  let node = peel(prop);
+  for (let i = 0; i < 25; i++) {
+    const d = defOf(node);
+    if (d?.type === "array") node = peel(d.element);
+    else if (d?.type === "record") node = peel(d.valueType);
+    else return node;
+  }
+  return node;
+}
+function stepInto(scope, segment) {
+  const u = peel(scope);
+  const d = defOf(u);
+  if (d?.type === "record") return { kind: "declared", next: d.valueType };
+  const declared = keysOf(u);
+  if (declared === null) return { kind: "opaque" };
+  if (!declared.includes(segment)) return { kind: "undeclared", declared };
+  return { kind: "declared", next: propertyOf(u, segment) };
+}
+function isNode3(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function memberChain(node) {
+  if (!isNode3(node)) return null;
+  if (node.op === "id" && typeof node.args === "string") return [node.args];
+  if (node.op === "." && Array.isArray(node.args) && typeof node.args[1] === "string") {
+    const head = memberChain(node.args[0]);
+    return head ? [...head, node.args[1]] : null;
+  }
+  return null;
+}
+function rootedPaths(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) rootedPaths(child, out);
+    return;
+  }
+  if (!isNode3(node)) return;
+  if (node.op === ".") {
+    const chain = memberChain(node);
+    if (chain && chain[0] === ROOT && chain.length > 1) {
+      out.push(chain.slice(1));
+      return;
+    }
+  }
+  rootedPaths(node.args, out);
+}
+function classifyIdentifiers(node, values, excluded) {
+  if (Array.isArray(node)) {
+    for (const child of node) classifyIdentifiers(child, values, excluded);
+    return;
+  }
+  if (!isNode3(node)) return;
+  const args = node.args;
+  if (Array.isArray(args)) {
+    const receiver = node.op === "rcall" ? args[1] : args[0];
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode3(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+      excluded.add(receiver.args);
+    }
+    if (node.op === "rcall" && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+      const macroArgs = args[2];
+      if (Array.isArray(macroArgs) && macroArgs.length >= 2) {
+        const bound = macroArgs[0];
+        if (isNode3(bound) && bound.op === "id" && typeof bound.args === "string") {
+          excluded.add(bound.args);
+        }
+      }
+    }
+  }
+  if (node.op === "id" && typeof node.args === "string") {
+    values.add(node.args);
+    return;
+  }
+  classifyIdentifiers(args, values, excluded);
+}
+function predicateSource2(v) {
+  if (typeof v === "string") return v;
+  if (v && typeof v === "object" && typeof v.source === "string") {
+    return v.source;
+  }
+  return void 0;
+}
+function isRec11(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function schemaIdOf(view) {
+  const data = view.data;
+  if (!isRec11(data)) return void 0;
+  if (data.provider !== "schema") return void 0;
+  return typeof data.schemaId === "string" ? data.schemaId : void 0;
+}
+function checkPredicate(source, scope, where, path, findings) {
+  const ast = parseCelToAst3(source);
+  if (!ast) return;
+  const paths = [];
+  rootedPaths(ast, paths);
+  for (const segments of paths) {
+    let cursor = scope;
+    const walked = [];
+    for (const segment of segments) {
+      const step = stepInto(cursor, segment);
+      if (step.kind === "opaque") break;
+      if (step.kind === "undeclared") {
+        const full = [ROOT, ...walked, segment].join(".");
+        const container = walked.length ? `${ROOT}.${walked.join(".")}` : ROOT;
+        findings.push({
+          severity: "error",
+          rule: PREDICATE_PATH_UNRESOLVED,
+          where,
+          path,
+          message: `predicate references \`${full}\`, which the target schema does not declare \u2014 \`${segment}\` is not a key of \`${container}\`. The reference resolves to nothing, so the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149).`,
+          hint: `${formatSuggestion(findClosestMatches(segment, step.declared)) || `\`${container}\` declares: ${step.declared.slice(0, 12).sort().join(", ")}`} Every reference must resolve against the schema the form edits.`
+        });
+        break;
+      }
+      walked.push(segment);
+      cursor = step.next;
+    }
+  }
+  const declaredHere = keysOf(scope);
+  if (!declaredHere) return;
+  const values = /* @__PURE__ */ new Set();
+  const excluded = /* @__PURE__ */ new Set();
+  classifyIdentifiers(ast, values, excluded);
+  for (const id of values) {
+    if (excluded.has(id) || !declaredHere.includes(id)) continue;
+    findings.push({
+      severity: "error",
+      rule: PREDICATE_PATH_UNROOTED,
+      where,
+      path,
+      message: `predicate references \`${id}\` as a bare identifier, but \`${id}\` is a key of the schema this form edits \u2014 the binding root was dropped. Values are bound under \`${ROOT}\` and are never flattened to top level, so \`${id}\` resolves to nothing, the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149, #6254).`,
+      hint: `Write \`${ROOT}.${id}\` instead of \`${id}\`. A metadata-editing form binds the row under edit as \`${ROOT}\` at every depth \u2014 inside a repeater \`${ROOT}\` is the ROW, but it is still spelled \`${ROOT}\` (there is no implicit row scope).`
+    });
+  }
+}
+function walkFields(entries, scope, where, base, findings, depth) {
+  if (!Array.isArray(entries) || depth > 12) return;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    if (!isRec11(entry)) continue;
+    const path = `${base}[${i}]`;
+    for (const key of PREDICATE_KEYS) {
+      const source = predicateSource2(entry[key]);
+      if (source !== void 0 && source.trim()) {
+        checkPredicate(source, scope, where, `${path}.${key}`, findings);
+        break;
+      }
+    }
+    if (Array.isArray(entry.fields) && entry.fields.length > 0 && typeof entry.field === "string") {
+      const row = scope === void 0 ? void 0 : rowScopeOf(scope, entry.field);
+      walkFields(entry.fields, row, where, `${path}.fields`, findings, depth + 1);
+    }
+  }
+}
+function validatePredicatePathRefs(stack, opts = {}) {
+  const resolveSchema = opts.resolveSchema ?? ((schemaId) => getMetadataTypeSchema(schemaId));
+  const findings = [];
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
+    for (const site of formViewSites(view, viewPath)) {
+      const schemaId = schemaIdOf(site.view);
+      if (!schemaId) continue;
+      let root;
+      try {
+        root = resolveSchema(schemaId);
+      } catch {
+        continue;
+      }
+      if (!root) continue;
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface} (schema "${schemaId}")` : `view "${viewName}" (schema "${schemaId}")`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const section = sections[s];
+          if (!isRec11(section)) continue;
+          const sectionPath = `${site.path}.${bucket}[${s}]`;
+          for (const key of PREDICATE_KEYS) {
+            const source = predicateSource2(section[key]);
+            if (source !== void 0 && source.trim()) {
+              checkPredicate(source, root, where, `${sectionPath}.${key}`, findings);
+              break;
+            }
+          }
+          walkFields(section.fields, root, where, `${sectionPath}.fields`, findings, 0);
         }
       }
     }
@@ -3368,7 +4213,7 @@ function validateVisibilityPredicates(stack, opts = {}) {
 // src/validate-capability-references.ts
 import { PLATFORM_CAPABILITY_NAMES } from "@objectstack/spec/security";
 var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
-function asArray18(v) {
+function asArray17(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -3393,13 +4238,13 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(PLATFORM_CAPABILITY_NAMES);
-  for (const cap of asArray18(stack.capabilities)) {
+  for (const cap of asArray17(stack.capabilities)) {
     if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
   }
-  for (const ps of asArray18(stack.permissions)) {
+  for (const ps of asArray17(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
-  for (const seed of asArray18(stack.data)) {
+  for (const seed of asArray17(stack.data)) {
     if (seed.object !== "sys_capability") continue;
     for (const rec of Array.isArray(seed.records) ? seed.records : []) {
       const name = rec?.name;
@@ -3418,7 +4263,7 @@ function validateCapabilityReferences(stack) {
       hint
     });
   };
-  const objects = asArray18(stack.objects);
+  const objects = asArray17(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -3427,27 +4272,27 @@ function validateCapabilityReferences(stack) {
     for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
       flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
     }
-    const fields = asArray18(obj.fields);
+    const fields = asArray17(obj.fields);
     for (const f of fields) {
       const fname = typeof f.name === "string" ? f.name : "(field)";
       for (const cap of asCapArray(f.requiredPermissions)) {
         flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
       }
     }
-    for (const [ai, action] of asArray18(obj.actions).entries()) {
+    for (const [ai, action] of asArray17(obj.actions).entries()) {
       const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
       for (const cap of asCapArray(action.requiredPermissions)) {
         flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
       }
     }
   }
-  for (const [i, action] of asArray18(stack.actions).entries()) {
+  for (const [i, action] of asArray17(stack.actions).entries()) {
     const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
     for (const cap of asCapArray(action.requiredPermissions)) {
       flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
     }
   }
-  const apps = asArray18(stack.apps);
+  const apps = asArray17(stack.apps);
   for (let i = 0; i < apps.length; i++) {
     const app = apps[i];
     if (!app || typeof app !== "object") continue;
@@ -3484,7 +4329,7 @@ import {
   normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
 import { BUILTIN_MEMBERSHIP_ROLES } from "@objectstack/spec";
-import { collectCelRootIdentifiers as collectCelRootIdentifiers2 } from "@objectstack/formula";
+import { collectCelRootIdentifiers as collectCelRootIdentifiers3 } from "@objectstack/formula";
 var APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 var APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
 var APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
@@ -3504,7 +4349,7 @@ var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
 };
-function asArray19(v) {
+function asArray18(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -3514,7 +4359,7 @@ function asArray19(v) {
 function validateApprovalApprovers(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const flows = asArray19(stack.flows);
+  const flows = asArray18(stack.flows);
   const validTypes = new Set(ApproverType.options);
   for (let fi = 0; fi < flows.length; fi++) {
     const flow = flows[fi];
@@ -3559,7 +4404,7 @@ function validateApprovalApprovers(stack) {
               hint: `Write a CEL expression over current.* (the record's live state at node entry), trigger.* (the submit-time snapshot) or vars.* (flow variables), e.g. current.approvers_dynamic or vars.approval_lead.picked_departments.`
             });
           } else {
-            const parsed = collectCelRootIdentifiers2(source);
+            const parsed = collectCelRootIdentifiers3(source);
             if (!parsed.ok) {
               findings.push({
                 severity: "error",
@@ -3809,7 +4654,7 @@ var OWD_WIDTH = {
   public_read: 1,
   public_read_write: 2
 };
-function asArray20(v) {
+function asArray19(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -3835,7 +4680,7 @@ function refOf(def) {
   return typeof r === "string" && r ? r : void 0;
 }
 function firstMasterDetailField(obj) {
-  for (const f of asArray20(obj.fields)) {
+  for (const f of asArray19(obj.fields)) {
     if (f.type === "master_detail") {
       return { name: String(f.name ?? "?"), parent: refOf(f) };
     }
@@ -3848,8 +4693,8 @@ function grantsObjectAccess(p) {
 function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray20(stack.objects);
-  const permissionSets = asArray20(stack.permissions);
+  const objects = asArray19(stack.objects);
+  const permissionSets = asArray19(stack.permissions);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -3978,10 +4823,10 @@ function validateSecurityPosture(stack, opts) {
     if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
     flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray20(obj.fields)) {
+    for (const f of asArray19(obj.fields)) {
       flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
     }
-    for (const [ai, action] of asArray20(obj.actions).entries()) {
+    for (const [ai, action] of asArray19(obj.actions).entries()) {
       flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
     }
   }
@@ -3990,19 +4835,19 @@ function validateSecurityPosture(stack, opts) {
     if (!ps || typeof ps !== "object") continue;
     flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
   }
-  for (const [i, pos] of asArray20(stack.positions).entries()) {
+  for (const [i, pos] of asArray19(stack.positions).entries()) {
     flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
   }
-  for (const [i, app] of asArray20(stack.apps).entries()) {
+  for (const [i, app] of asArray19(stack.apps).entries()) {
     flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
   }
-  for (const [i, book] of asArray20(stack.books).entries()) {
+  for (const [i, book] of asArray19(stack.books).entries()) {
     flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
   }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
-  for (const [i, book] of asArray20(stack.books).entries()) {
+  for (const [i, book] of asArray19(stack.books).entries()) {
     const audience = book.audience;
     if (!audience || typeof audience !== "object") continue;
     const setName = audience.permissionSet;
@@ -4080,7 +4925,7 @@ function validateSecurityPosture(stack, opts) {
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
   const nowMs = opts?.nowMs ?? Date.now();
-  for (const [i, seed] of asArray20(stack.data).entries()) {
+  for (const [i, seed] of asArray19(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
     if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
     const records = Array.isArray(seed.records) ? seed.records : [];
@@ -4125,7 +4970,7 @@ var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
 var ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
 var ORG_PARENT_FIELD = "parent_organization_id";
 var BU_TREE_RECIPIENT_TYPES = /* @__PURE__ */ new Set(["business_unit", "unit_and_subordinates"]);
-function asArray21(v) {
+function asArray20(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -4155,9 +5000,9 @@ var INHERITANCE_HINT = `Remove the ${ORG_PARENT_FIELD} reference. Cross-organiza
 function validateOrgAxisRedLines(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  const permissionSets = asArray21(cfg.permissions);
+  const permissionSets = asArray20(cfg.permissions);
   permissionSets.forEach((ps, psIndex) => {
-    asArray21(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+    asArray20(ps.rowLevelSecurity).forEach((policy, pIndex) => {
       for (const clause of ["using", "check"]) {
         if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
         findings.push({
@@ -4171,7 +5016,7 @@ function validateOrgAxisRedLines(stack) {
       }
     });
   });
-  asArray21(cfg.sharingRules).forEach((rule, rIndex) => {
+  asArray20(cfg.sharingRules).forEach((rule, rIndex) => {
     const slots = [
       { key: "condition", text: expressionText(rule.condition) },
       { key: "sharedWith", text: JSON.stringify(rule.sharedWith ?? "") ?? "" }
@@ -4189,9 +5034,9 @@ function validateOrgAxisRedLines(stack) {
     }
   });
   const tenancyDisabledObjects = new Set(
-    asArray21(cfg.objects).filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
+    asArray20(cfg.objects).filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
   );
-  asArray21(cfg.sharingRules).forEach((rule, rIndex) => {
+  asArray20(cfg.sharingRules).forEach((rule, rIndex) => {
     const target = str(rule.object);
     if (!target || !tenancyDisabledObjects.has(target)) return;
     const sharedWith = rule.sharedWith;
@@ -4214,7 +5059,7 @@ function validateOrgAxisRedLines(stack) {
 import { compileCelToFilter } from "@objectstack/formula";
 var SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
 var SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
-function asArray22(v) {
+function asArray21(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -4241,7 +5086,7 @@ var PUSHDOWN_SUBSET = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in
 function validateSharingRuleEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  asArray22(cfg.sharingRules).forEach((rule, index) => {
+  asArray21(cfg.sharingRules).forEach((rule, index) => {
     const input = toCompilerInput(rule.condition);
     if (input === null) return;
     const result = compileCelToFilter(input, { variables: {} });
@@ -4277,10 +5122,16 @@ function validateSharingRuleEnforceability(stack) {
 }
 
 // src/validate-rls-predicate-enforceability.ts
-import { isPushdownableCel, isSupportedRlsExpression, sqlPredicateToCel } from "@objectstack/formula";
+import {
+  isPushdownableCel,
+  isSupportedRlsExpression,
+  parseCelToAstWithReason as parseCelToAstWithReason2,
+  sqlPredicateToCel
+} from "@objectstack/formula";
 var RLS_PREDICATE_UNENFORCEABLE = "rls-predicate-unenforceable";
 var RLS_PREDICATE_UNPARSEABLE = "rls-predicate-unparseable";
-function asArray23(v) {
+var RLS_PREDICATE_OVER_BUDGET = "rls-predicate-over-budget";
+function asArray22(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -4291,6 +5142,13 @@ function str3(v) {
   return typeof v === "string" ? v : "";
 }
 var PUSHDOWN_SUBSET2 = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in`, `&&` `||` `!`, `== null` / `!= null`, and the string methods `startsWith` / `endsWith` / `contains` \u2014 over SINGLE-column field paths (ADR-0058 D2), compared against a literal or a `current_user.*` value.";
+function boundsOverrunOf(bridged) {
+  const parsed = parseCelToAstWithReason2(bridged);
+  return !parsed.ok && parsed.kind === "bounds" ? parsed.overrun : null;
+}
+function quote(source) {
+  return source.length > 200 ? `${source.slice(0, 197)}...` : source;
+}
 function consequence(clause) {
   const dropped = 'so `RLSCompiler` DROPS the policy at request time (one WARN line \u2014 "has an uncompilable predicate \u2026 and was DROPPED (no enforcement)" \u2014 is the only signal, and nothing reports it at authoring time). ';
   return clause === "using" ? dropped + "When it is the only applicable policy for that object and operation, `compileFilter` returns the `RLS_DENY_FILTER` sentinel instead, which is AND-ed onto the where clause: every select / update / delete on the object matches ZERO rows. When other policies also apply, this one just vanishes from the OR and grants none of the access it appears to." : dropped + "On the ADR-0058 D4 write path that leaves the post-image `check` as the `RLS_DENY_FILTER` sentinel, which no record can satisfy: every insert / update the policy governs fails with `PermissionDeniedError`. The policy reads as a write rule and behaves as a blanket refusal.";
@@ -4298,20 +5156,36 @@ function consequence(clause) {
 function validateRlsPredicateEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  asArray23(cfg.permissions).forEach((ps, psIndex) => {
-    asArray23(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+  asArray22(cfg.permissions).forEach((ps, psIndex) => {
+    asArray22(ps.rowLevelSecurity).forEach((policy, pIndex) => {
       for (const clause of ["using", "check"]) {
         const source = str3(policy[clause]);
         if (!source.trim()) continue;
         if (isSupportedRlsExpression(source)) continue;
-        const why = isPushdownableCel(sqlPredicateToCel(source));
+        const bridged = sqlPredicateToCel(source);
+        const why = isPushdownableCel(bridged);
         const detail = why.ok ? "" : why.detail;
         const parseError = !why.ok && why.reason === "parse-error";
+        const overrun = parseError ? boundsOverrunOf(bridged) : null;
         const psName = str3(ps.name) || String(psIndex);
         const policyName = str3(policy.name) || String(pIndex);
         const object = str3(policy.object);
         const where = `permission set "${psName}" policy "${policyName}"` + (object ? ` on object "${object}"` : "");
         const path = `permissions[${psIndex}].rowLevelSecurity[${pIndex}].${clause}`;
+        if (overrun) {
+          const bound = overrun.limit ?? "an unnamed platform CEL bound";
+          const budget = overrun.limitValue !== null ? ` (platform limit ${overrun.limitValue})` : "";
+          const measured = overrun.measured !== null ? `, this predicate measures ${overrun.measured}` : "";
+          findings.push({
+            severity: "error",
+            rule: RLS_PREDICATE_OVER_BUDGET,
+            where,
+            path,
+            message: `RLS ${clause} \`${quote(source)}\` is syntactically valid, lowerable CEL but overruns the platform parse bound ${bound}${budget}${measured} (${overrun.summary}), ` + consequence(clause),
+            hint: `There is no syntax or dialect error to correct here \u2014 the predicate is well-formed CEL and is simply too large for ${bound}${budget}, so the fix is to make it smaller or to move the work off the predicate. (1) Collapse a long \`field == a || field == b || \u2026\` chain into a single \`field in [a, b, \u2026]\`, which is far fewer AST nodes (\`maxListElements\` is 64, so a very large set needs option 2). (2) Pre-resolve the set into a membership key the runtime exposes and test \`field in current_user.<key>\` (ADR-0105 D11) \u2014 one comparison whatever the set size. (3) Denormalise a repeated sub-expression onto this object as a formula/rollup field and test that single column. (4) Split a TOP-LEVEL \`||\` across several \`rowLevelSecurity\` policies: applicable policies are OR-ed, so that is equivalent \u2014 but never split a top-level \`&&\` this way, which would WIDEN access rather than preserve it. Logic genuinely this large is not a row filter: move it to a hook or action body (\`ScriptBody { language: 'js' }\`, the L2 sandboxed surface).`
+          });
+          continue;
+        }
         if (parseError) {
           findings.push({
             severity: "error",
@@ -4340,14 +5214,14 @@ function validateRlsPredicateEnforceability(stack) {
 // src/validate-dashboard-action-refs.ts
 var DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
 var DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
-function asArray24(v) {
+function asArray23(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName5(v) {
+function strName7(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var MODAL_VERB_RE = /^(?:create|new|add|edit|update)_(.+)$/;
@@ -4364,7 +5238,7 @@ var URL_COLLECTION_TO_STACK_KEY = {
   views: "views"
 };
 function viewContainerName(item) {
-  return strName5(item.name) ?? strName5(item.id) ?? strName5(item.object) ?? strName5(item.list?.data && item.list.data.object) ?? strName5(item.form?.data && item.form.data.object);
+  return strName7(item.name) ?? strName7(item.id) ?? strName7(item.object) ?? strName7(item.list?.data && item.list.data.object) ?? strName7(item.form?.data && item.form.data.object);
 }
 function collectKnownTargets(stack) {
   const actions = /* @__PURE__ */ new Set();
@@ -4374,22 +5248,22 @@ function collectKnownTargets(stack) {
   const pages = /* @__PURE__ */ new Set();
   const views = /* @__PURE__ */ new Set();
   const collectNames = (v, into, name) => {
-    for (const item of asArray24(v)) {
+    for (const item of asArray23(v)) {
       if (!item || typeof item !== "object") continue;
       const n = name(item);
       if (n) into.add(n);
     }
   };
-  collectNames(stack.actions, actions, (a) => strName5(a.name));
-  for (const obj of asArray24(stack.objects)) {
+  collectNames(stack.actions, actions, (a) => strName7(a.name));
+  for (const obj of asArray23(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
-    const n = strName5(obj.name);
+    const n = strName7(obj.name);
     if (n) objects.add(n);
-    collectNames(obj.actions, actions, (a) => strName5(a.name));
+    collectNames(obj.actions, actions, (a) => strName7(a.name));
   }
-  collectNames(stack.reports, reports, (r) => strName5(r.name));
-  collectNames(stack.dashboards, dashboards, (d) => strName5(d.name));
-  collectNames(stack.pages, pages, (p) => strName5(p.name));
+  collectNames(stack.reports, reports, (r) => strName7(r.name));
+  collectNames(stack.dashboards, dashboards, (d) => strName7(d.name));
+  collectNames(stack.pages, pages, (p) => strName7(p.name));
   collectNames(stack.views, views, viewContainerName);
   for (const o of objects) views.add(o);
   return { actions, objects, reports, dashboards, pages, views };
@@ -4421,14 +5295,14 @@ function resolveUrlRoute(target, known) {
 function validateDashboardActionRefs(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const dashboards = asArray24(stack.dashboards);
+  const dashboards = asArray23(stack.dashboards);
   if (dashboards.length === 0) return findings;
   const known = collectKnownTargets(stack);
   const checkOne = (action, where, path) => {
-    const target = strName5(action.actionUrl);
+    const target = strName7(action.actionUrl);
     if (!target) return;
     if (target.includes("${")) return;
-    const actionType = strName5(action.actionType) ?? "url";
+    const actionType = strName7(action.actionType) ?? "url";
     if (actionType === "script" || actionType === "modal") {
       if (resolveActionTarget(actionType, target, known)) return;
       const kindWord = actionType === "script" ? "script" : "modal";
@@ -4459,13 +5333,13 @@ function validateDashboardActionRefs(stack) {
   for (let di = 0; di < dashboards.length; di++) {
     const dash = dashboards[di];
     if (!dash || typeof dash !== "object") continue;
-    const dashName = strName5(dash.name) ?? `(dashboard ${di})`;
+    const dashName = strName7(dash.name) ?? `(dashboard ${di})`;
     const dashPath = `dashboards[${di}]`;
-    const headerActions = asArray24(dash.header?.actions);
+    const headerActions = asArray23(dash.header?.actions);
     for (let ai = 0; ai < headerActions.length; ai++) {
       const action = headerActions[ai];
       if (!action || typeof action !== "object") continue;
-      const label2 = strName5(action.label) ?? strName5(action.actionUrl) ?? `#${ai}`;
+      const label2 = strName7(action.label) ?? strName7(action.actionUrl) ?? `#${ai}`;
       checkOne(
         action,
         `dashboard "${dashName}" \xB7 header action "${label2}"`,
@@ -4478,19 +5352,75 @@ function validateDashboardActionRefs(stack) {
 
 // src/validate-filter-tokens.ts
 import { classifyFilterToken, CONTEXT_TOKENS } from "@objectstack/spec/data";
-var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
+
+// src/filter-walk.ts
 var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
-function asArray25(v) {
+function asArray24(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
-  return [];
-}
-function label(v, fallback) {
-  return typeof v === "string" && v.length > 0 ? v : fallback;
+  return [];
+}
+function label(v, fallback) {
+  return typeof v === "string" && v.length > 0 ? v : fallback;
+}
+function scanForFilters(node, path, where, visit, seen = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object") return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, visit, seen));
+    return;
+  }
+  for (const [k, v] of Object.entries(node)) {
+    const childPath = `${path}.${k}`;
+    if (FILTER_KEYS.has(k)) {
+      visit({ value: v, path: childPath, where });
+      continue;
+    }
+    scanForFilters(v, childPath, where, visit, seen);
+  }
+}
+function walkAuthoredFilters(stack, surfaces, visit) {
+  if (!stack || typeof stack !== "object") return;
+  for (const { key, kind } of surfaces) {
+    const items = asArray24(stack[key]);
+    items.forEach((item, i) => {
+      const name = label(item.name ?? item.id, `#${i}`);
+      if (kind === "dashboard") {
+        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
+        widgets.forEach((w, wi) => {
+          const wName = label(w.id ?? w.title, `#${wi}`);
+          scanForFilters(
+            w,
+            `${key}[${i}].widgets[${wi}]`,
+            `dashboard "${name}" \xB7 widget "${wName}"`,
+            visit,
+            /* @__PURE__ */ new Set()
+          );
+        });
+        const { widgets: _skip, ...rest } = item;
+        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, visit, /* @__PURE__ */ new Set());
+        return;
+      }
+      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, visit, /* @__PURE__ */ new Set());
+    });
+  }
 }
+
+// src/validate-filter-tokens.ts
+var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
 var KNOWN_LIST = CONTEXT_TOKENS.join("}, {");
+var TOKEN_FILTER_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" }
+];
 function walkFilterValues(node, path, where, out, seen) {
   if (node === null || node === void 0) return;
   if (typeof node === "string") {
@@ -4519,58 +5449,132 @@ function walkFilterValues(node, path, where, out, seen) {
     walkFilterValues(v, `${path}.${k}`, where, out, seen);
   }
 }
-function scanForFilters(node, path, where, out, seen) {
-  if (!node || typeof node !== "object") return;
-  if (seen.has(node)) return;
-  seen.add(node);
-  if (Array.isArray(node)) {
-    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, out, seen));
+function validateFilterTokens(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const out = [];
+  walkAuthoredFilters(stack, TOKEN_FILTER_SURFACES, ({ value, path, where }) => {
+    walkFilterValues(value, path, where, out, /* @__PURE__ */ new Set());
+  });
+  return out;
+}
+
+// src/validate-empty-combinators.ts
+import { reduceFilterVerdict } from "@objectstack/spec/data";
+var FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
+var FILTER_EMPTY_NODE = "filter-empty-node";
+var EMPTY_COMBINATOR_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" },
+  { key: "flows", kind: "flow" }
+];
+function isFilterNode(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+var VERDICT_OF = {
+  $and: reduceFilterVerdict({ $and: [] }),
+  $or: reduceFilterVerdict({ $or: [] }),
+  $not: reduceFilterVerdict({ $not: {} }),
+  node: reduceFilterVerdict({}),
+  /** One TRUE disjunct absorbs its `$or`: the sibling branches stop mattering. */
+  orWithEmptyBranch: reduceFilterVerdict({ $or: [{ status: "open" }, {}] })
+};
+function rows(verdict) {
+  if (verdict === "true") return "matches EVERY row";
+  if (verdict === "false") return "matches NO row";
+  return "carries a real predicate";
+}
+var MATCH_NONE_SPELLING = "If you really do want a predicate that selects nothing, `{ <field>: { $in: [] } }` is the declared spelling for it (an empty `$in` list matches nothing, on every backend) \u2014 it says so where an empty combinator only implies it.";
+var OMIT_THE_KEY = 'To express "no filter", DELETE the key \u2014 an absent `filter` and a filter that reduces to TRUE run identically, and only the absent key says so to the next reader (and to the next AI author that copies this metadata).';
+function emitEmptyCombinator(key, path, ctx) {
+  const spelling = key === "$not" ? "`$not: {}`" : `\`${key}: []\``;
+  const message = key === "$and" ? `\`$and: []\` is a conjunction of ZERO conditions. Under the #5322 identity ruling it ${rows(VERDICT_OF.$and)} \u2014 the key is authored, and it constrains nothing, so this surface reads as filtered and is not.` : key === "$or" ? `\`$or: []\` is a disjunction of ZERO branches. Under the #5322 identity ruling it ${rows(VERDICT_OF.$or)}: this surface renders permanently empty, and on a read scope it hides every row (fail-closed by design \u2014 #5134).` : `\`$not: {}\` negates an EMPTY node. An empty node is TRUE and NOT TRUE is FALSE, so it ${rows(VERDICT_OF.$not)} \u2014 the opposite of the "no filter" an empty operand looks like.`;
+  const hint = key === "$and" ? `${OMIT_THE_KEY} To express a constraint, put the conditions in the array. ${MATCH_NONE_SPELLING}` : key === "$or" ? `If you meant "no filter", this is its OPPOSITE: emptying the array does not relax the filter, it closes it. ${OMIT_THE_KEY} If you meant to offer alternatives, put the branches in the array. ${MATCH_NONE_SPELLING}` : `Put the condition you are negating inside \`$not\` (\`{ $not: { status: 'closed' } }\`). ${OMIT_THE_KEY} ${MATCH_NONE_SPELLING}`;
+  ctx.out.push({
+    severity: "error",
+    rule: FILTER_EMPTY_COMBINATOR,
+    where: ctx.where,
+    path,
+    message: `${message} A literal ${spelling} is not an authoring surface (#5330).`,
+    hint: `${hint} A PROGRAMMATIC producer that loops to zero operands keeps the runtime identity unchanged \u2014 this rule judges only what is written in the metadata.`
+  });
+}
+function emitEmptyNode(position, path, ctx) {
+  if (position === "root") {
+    ctx.out.push({
+      severity: "error",
+      rule: FILTER_EMPTY_NODE,
+      where: ctx.where,
+      path,
+      message: `An EMPTY filter node (\`{}\`) is authored here. Under the #5322 identity ruling an empty node is TRUE \u2014 it ${rows(VERDICT_OF.node)}, exactly as if the key were absent \u2014 so a filter is declared and enforces nothing.`,
+      hint: `${OMIT_THE_KEY} If you meant to constrain something, write the condition into the node. ${MATCH_NONE_SPELLING}`
+    });
     return;
   }
-  for (const [k, v] of Object.entries(node)) {
-    const childPath = `${path}.${k}`;
-    if (FILTER_KEYS.has(k)) {
-      walkFilterValues(v, childPath, where, out, /* @__PURE__ */ new Set());
+  if (position === "or-branch") {
+    ctx.out.push({
+      severity: "error",
+      rule: FILTER_EMPTY_NODE,
+      where: ctx.where,
+      path,
+      message: `An EMPTY branch (\`{}\`) of a \`$or\`. An empty node is TRUE, and one TRUE disjunct ABSORBS the whole disjunction (\`{ $or: [{ status: 'open' }, {}] }\` ${rows(VERDICT_OF.orWithEmptyBranch)}), so every branch you wrote beside it is dead.`,
+      hint: "Delete the empty branch \u2014 the `$or` then means what it looks like. If it was meant to carry a condition, write it. (A compiler that DROPPED the empty branch instead would silently NARROW the scope to the surviving branches, which is why the runtime absorbs rather than filters \u2014 #5297.)"
+    });
+    return;
+  }
+  ctx.out.push({
+    severity: "error",
+    rule: FILTER_EMPTY_NODE,
+    where: ctx.where,
+    path,
+    message: "An EMPTY branch (`{}`) of a `$and`. An empty node is TRUE \u2014 the AND identity \u2014 so the branch contributes no condition and the conjunction means whatever its other branches mean.",
+    hint: "Delete the empty branch, or write the condition it was meant to carry. A branch that constrains nothing is indistinguishable from one whose condition was lost in an edit."
+  });
+}
+function scanNodeKeys(node, path, ctx) {
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "$and" || key === "$or") {
+      if (!Array.isArray(value)) continue;
+      if (value.length === 0) {
+        emitEmptyCombinator(key, `${path}.${key}`, ctx);
+        continue;
+      }
+      value.forEach((element, index) => {
+        scanBranch(element, `${path}.${key}[${index}]`, key === "$and" ? "and-branch" : "or-branch", ctx);
+      });
+      continue;
+    }
+    if (key === "$not") {
+      if (!isFilterNode(value)) continue;
+      if (Object.keys(value).length === 0) {
+        emitEmptyCombinator("$not", `${path}.$not`, ctx);
+        continue;
+      }
+      scanNodeKeys(value, `${path}.$not`, ctx);
       continue;
     }
-    scanForFilters(v, childPath, where, out, seen);
   }
 }
-function validateFilterTokens(stack) {
+function scanBranch(value, path, position, ctx) {
+  if (!isFilterNode(value)) return;
+  if (Object.keys(value).length === 0) {
+    emitEmptyNode(position, path, ctx);
+    return;
+  }
+  scanNodeKeys(value, path, ctx);
+}
+function validateEmptyCombinators(stack) {
   if (!stack || typeof stack !== "object") return [];
   const out = [];
-  const surfaces = [
-    ["dashboards", "dashboard"],
-    ["objects", "object"],
-    ["views", "view"],
-    ["reports", "report"],
-    ["datasets", "dataset"],
-    ["pages", "page"],
-    ["apps", "app"]
-  ];
-  for (const [key, kind] of surfaces) {
-    const items = asArray25(stack[key]);
-    items.forEach((item, i) => {
-      const name = label(item.name ?? item.id, `#${i}`);
-      if (kind === "dashboard") {
-        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
-        widgets.forEach((w, wi) => {
-          const wName = label(w.id ?? w.title, `#${wi}`);
-          scanForFilters(
-            w,
-            `${key}[${i}].widgets[${wi}]`,
-            `dashboard "${name}" \xB7 widget "${wName}"`,
-            out,
-            /* @__PURE__ */ new Set()
-          );
-        });
-        const { widgets: _skip, ...rest } = item;
-        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, out, /* @__PURE__ */ new Set());
-        return;
-      }
-      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, out, /* @__PURE__ */ new Set());
-    });
-  }
+  walkAuthoredFilters(stack, EMPTY_COMBINATOR_SURFACES, ({ value, path, where }) => {
+    scanBranch(value, path, "root", { where, out });
+  });
   return out;
 }
 
@@ -4583,14 +5587,14 @@ import {
 var PLATFORM_NAMES = [...PLATFORM_PROVIDED_OBJECT_NAMES];
 var OBJECT_REFERENCE_UNKNOWN = "object-reference-unknown";
 var OBJECT_REFERENCE_UNREGISTERED_PLATFORM = "object-reference-unregistered-platform";
-function asArray26(v) {
+function asArray25(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName6(v) {
+function strName8(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function isInterpolated(target) {
@@ -4630,14 +5634,14 @@ function distance2(a, b) {
 function validateObjectReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray26(stack.objects);
+  const objects = asArray25(stack.objects);
   const ownObjects = /* @__PURE__ */ new Set();
   for (const obj of objects) {
-    const n = strName6(obj.name);
+    const n = strName8(obj.name);
     if (n) ownObjects.add(n);
   }
   const check = (target, where, path, subject, fix) => {
-    const name = strName6(target);
+    const name = strName8(target);
     if (!name) return;
     if (isInterpolated(name)) return;
     if (ownObjects.has(name)) return;
@@ -4663,21 +5667,21 @@ function validateObjectReferences(stack) {
     });
   };
   const checkActionParams2 = (action, actionPath, actionLabel) => {
-    const params = asArray26(action.params);
+    const params = asArray25(action.params);
     for (let pi = 0; pi < params.length; pi++) {
       const param = params[pi];
       if (!param || typeof param !== "object") continue;
-      const paramLabel = strName6(param.name) ?? strName6(param.field) ?? `#${pi}`;
+      const paramLabel = strName8(param.name) ?? strName8(param.field) ?? `#${pi}`;
       const where = `${actionLabel} \xB7 param "${paramLabel}"`;
       check(
-        strName6(param.reference),
+        strName8(param.reference),
         where,
         `${actionPath}.params[${pi}].reference`,
         "record-picker target",
         "Without a resolvable target the picker degrades to a raw record-id text input."
       );
       check(
-        strName6(param.objectOverride),
+        strName8(param.objectOverride),
         where,
         `${actionPath}.params[${pi}].objectOverride`,
         "field-backed param object",
@@ -4685,70 +5689,70 @@ function validateObjectReferences(stack) {
       );
     }
   };
-  const globalActions = asArray26(stack.actions);
+  const globalActions = asArray25(stack.actions);
   for (let ai = 0; ai < globalActions.length; ai++) {
     const action = globalActions[ai];
     if (!action || typeof action !== "object") continue;
-    checkActionParams2(action, `actions[${ai}]`, `action "${strName6(action.name) ?? `#${ai}`}"`);
+    checkActionParams2(action, `actions[${ai}]`, `action "${strName8(action.name) ?? `#${ai}`}"`);
   }
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
-    const objName = strName6(obj.name) ?? `#${oi}`;
-    const objActions = asArray26(obj.actions);
+    const objName = strName8(obj.name) ?? `#${oi}`;
+    const objActions = asArray25(obj.actions);
     for (let ai = 0; ai < objActions.length; ai++) {
       const action = objActions[ai];
       if (!action || typeof action !== "object") continue;
       checkActionParams2(
         action,
         `objects[${oi}].actions[${ai}]`,
-        `object "${objName}" \xB7 action "${strName6(action.name) ?? `#${ai}`}"`
+        `object "${objName}" \xB7 action "${strName8(action.name) ?? `#${ai}`}"`
       );
     }
   }
-  const dashboards = asArray26(stack.dashboards);
+  const dashboards = asArray25(stack.dashboards);
   for (let di = 0; di < dashboards.length; di++) {
     const dash = dashboards[di];
     if (!dash || typeof dash !== "object") continue;
-    const dashName = strName6(dash.name) ?? `#${di}`;
-    const filters = asArray26(dash.globalFilters);
+    const dashName = strName8(dash.name) ?? `#${di}`;
+    const filters = asArray25(dash.globalFilters);
     for (let fi = 0; fi < filters.length; fi++) {
       const filter = filters[fi];
       if (!filter || typeof filter !== "object") continue;
       const optionsFrom = filter.optionsFrom;
       if (!optionsFrom || typeof optionsFrom !== "object") continue;
       check(
-        strName6(optionsFrom.object),
-        `dashboard "${dashName}" \xB7 filter "${strName6(filter.name) ?? `#${fi}`}"`,
+        strName8(optionsFrom.object),
+        `dashboard "${dashName}" \xB7 filter "${strName8(filter.name) ?? `#${fi}`}"`,
         `dashboards[${di}].globalFilters[${fi}].optionsFrom.object`,
         "filter options source",
         "The dropdown fetches its options from this object; an unknown one renders an always-empty filter."
       );
     }
   }
-  const apps = asArray26(stack.apps);
+  const apps = asArray25(stack.apps);
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName6(app.name) ?? `#${ai}`;
+    const appName = strName8(app.name) ?? `#${ai}`;
     const walkNav = (items, basePath) => {
-      const navItems = asArray26(items);
+      const navItems = asArray25(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
-        const navId = strName6(nav.id) ?? `#${ni}`;
+        const navId = strName8(nav.id) ?? `#${ni}`;
         const where = `app "${appName}" \xB7 nav "${navId}"`;
         const navPath = `${basePath}[${ni}]`;
         check(
-          strName6(nav.requiresObject),
+          strName8(nav.requiresObject),
           where,
           `${navPath}.requiresObject`,
           "capability gate object",
           "The entry is hidden unless this object is registered, so a typo hides it permanently \u2014 and it suppresses the nav cross-reference check that would have caught the target."
         );
-        if (nav.requiresObject && strName6(nav.objectName)) {
+        if (nav.requiresObject && strName8(nav.objectName)) {
           check(
-            strName6(nav.objectName),
+            strName8(nav.objectName),
             where,
             `${navPath}.objectName`,
             "navigation target",
@@ -4759,7 +5763,7 @@ function validateObjectReferences(stack) {
       }
     };
     walkNav(app.navigation, `apps[${ai}].navigation`);
-    const areas = asArray26(app.areas);
+    const areas = asArray25(app.areas);
     for (let ri = 0; ri < areas.length; ri++) {
       walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
@@ -4769,13 +5773,13 @@ function validateObjectReferences(stack) {
 
 // src/validate-nav-target-refs.ts
 var NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
-var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray27(v) {
-  if (Array.isArray(v)) return v.filter(isRec8);
-  if (isRec8(v)) return Object.entries(v).map(([name, def]) => isRec8(def) ? { name, ...def } : { name });
+var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray26(v) {
+  if (Array.isArray(v)) return v.filter(isRec12);
+  if (isRec12(v)) return Object.entries(v).map(([name, def]) => isRec12(def) ? { name, ...def } : { name });
   return [];
 }
-function strName7(v) {
+function strName9(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var isInterpolated2 = (s) => s.includes("${") || s.includes("{");
@@ -4786,32 +5790,32 @@ var NAV_TARGETS = [
 ];
 function namesOf(collection) {
   const out = /* @__PURE__ */ new Set();
-  for (const entry of asArray27(collection)) {
-    const n = strName7(entry.name);
+  for (const entry of asArray26(collection)) {
+    const n = strName9(entry.name);
     if (n) out.add(n);
   }
   return out;
 }
 function validateNavTargetRefs(stack) {
   const findings = [];
-  if (!isRec8(stack)) return findings;
-  const apps = asArray27(stack.apps);
+  if (!isRec12(stack)) return findings;
+  const apps = asArray26(stack.apps);
   if (apps.length === 0) return findings;
   const declared = /* @__PURE__ */ new Map();
   for (const [, , collection] of NAV_TARGETS) {
     declared.set(collection, namesOf(stack[collection]));
   }
   for (const [ai, app] of apps.entries()) {
-    const appName = strName7(app.name) ?? `#${ai}`;
+    const appName = strName9(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
       if (!Array.isArray(items)) return;
       for (const [ni, raw] of items.entries()) {
-        if (!isRec8(raw)) continue;
+        if (!isRec12(raw)) continue;
         const nav = raw;
         const navPath = `${basePath}[${ni}]`;
         for (const [type, prop, collection, noun] of NAV_TARGETS) {
           if (nav.type !== type) continue;
-          const target = strName7(nav[prop]);
+          const target = strName9(nav[prop]);
           if (!target || isInterpolated2(target)) continue;
           const known = declared.get(collection);
           if (known.has(target)) continue;
@@ -4819,7 +5823,7 @@ function validateNavTargetRefs(stack) {
           findings.push({
             severity: "warning",
             rule: NAV_TARGET_UNRESOLVED,
-            where: `app "${appName}" \xB7 nav "${strName7(nav.id) ?? strName7(nav.label) ?? `#${ni}`}"`,
+            where: `app "${appName}" \xB7 nav "${strName9(nav.id) ?? strName9(nav.label) ?? `#${ni}`}"`,
             path: `${navPath}.${prop}`,
             message: `Navigation targets ${noun} '${target}', which this stack does not declare in \`${collection}\`. ` + (emptyCollection ? `The stack declares NO ${collection} at all, so \`defineStack\`'s own cross-reference check skipped this entry entirely (it is gated on \`${collection === "pages" ? "pageNames" : collection === "reports" ? "reportNames" : "dashboardNames"}.size > 0\`) \u2014 nothing else will report it. ` : "") + `The entry renders in the sidebar and resolves to nothing when clicked. If another package provides this ${noun}, this is expected and advisory only.`,
             hint: `Declare the ${noun} in \`${collection}\`, correct the name, or remove the nav entry if the ${noun} is gone.`
@@ -4829,7 +5833,7 @@ function validateNavTargetRefs(stack) {
       }
     };
     walk(app.navigation, `apps[${ai}].navigation`);
-    for (const [ari, area] of asArray27(app.areas).entries()) {
+    for (const [ari, area] of asArray26(app.areas).entries()) {
       walk(area.items, `apps[${ai}].areas[${ari}].items`);
       walk(area.navigation, `apps[${ai}].areas[${ari}].navigation`);
     }
@@ -4839,14 +5843,14 @@ function validateNavTargetRefs(stack) {
 
 // src/validate-action-name-refs.ts
 var ACTION_NAME_UNDEFINED = "action-name-undefined";
-function asArray28(v) {
+function asArray27(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName8(v) {
+function strName10(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList(v) {
@@ -4883,14 +5887,14 @@ function suggest4(target, known) {
 }
 function collectActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
-  for (const action of asArray28(stack.actions)) {
-    const n = strName8(action?.name);
+  for (const action of asArray27(stack.actions)) {
+    const n = strName10(action?.name);
     if (n) names.add(n);
   }
-  for (const obj of asArray28(stack.objects)) {
+  for (const obj of asArray27(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
-    for (const action of asArray28(obj.actions)) {
-      const n = strName8(action?.name);
+    for (const action of asArray27(obj.actions)) {
+      const n = strName10(action?.name);
       if (n) names.add(n);
     }
   }
@@ -4933,7 +5937,7 @@ function validateActionNameRefs(stack) {
       if (!def || typeof def !== "object") continue;
       if (def.execution !== "aggregate") continue;
       if (def.actionDef !== void 0) continue;
-      const name = strName8(def.name);
+      const name = strName10(def.name);
       if (!name) continue;
       check(
         name,
@@ -4944,11 +5948,11 @@ function validateActionNameRefs(stack) {
       );
     }
   };
-  const views = asArray28(stack.views);
+  const views = asArray27(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
     if (!view || typeof view !== "object") continue;
-    const viewName = strName8(view.name) ?? strName8(view.object) ?? `#${vi}`;
+    const viewName = strName10(view.name) ?? strName10(view.object) ?? `#${vi}`;
     const owner = `view "${viewName}"`;
     checkListContainer(view.list, owner, "list", `views[${vi}].list`);
     const listViews = view.listViews;
@@ -4958,22 +5962,22 @@ function validateActionNameRefs(stack) {
       }
     }
   }
-  const objects = asArray28(stack.objects);
+  const objects = asArray27(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
     const objListViews = obj.listViews;
     if (!objListViews || typeof objListViews !== "object" || Array.isArray(objListViews)) continue;
-    const owner = `object "${strName8(obj.name) ?? `#${oi}`}"`;
+    const owner = `object "${strName10(obj.name) ?? `#${oi}`}"`;
     for (const [key, lv] of Object.entries(objListViews)) {
       checkListContainer(lv, owner, `listViews.${key}`, `objects[${oi}].listViews.${key}`);
     }
   }
-  const pages = asArray28(stack.pages);
+  const pages = asArray27(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
-    const pageName = strName8(page.name) ?? `#${pi}`;
+    const pageName = strName10(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
       const props = component.properties;
       if (!props || typeof props !== "object") continue;
@@ -4981,39 +5985,48 @@ function validateActionNameRefs(stack) {
       for (let ai = 0; ai < names.length; ai++) {
         check(
           names[ai],
-          `page "${pageName}" \xB7 component "${strName8(component.type) ?? "?"}"`,
+          `page "${pageName}" \xB7 component "${strName10(component.type) ?? "?"}"`,
           `${path}.properties.actionNames[${ai}]`,
           "Quick-actions bar"
         );
       }
     }
   }
-  const apps = asArray28(stack.apps);
+  const apps = asArray27(stack.apps);
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName8(app.name) ?? `#${ai}`;
+    const appName = strName10(app.name) ?? `#${ai}`;
     const walkNav = (items, basePath) => {
-      const navItems = asArray28(items);
+      const navItems = asArray27(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
         const actionDef = nav.actionDef;
-        const actionName = strName8(actionDef?.actionName);
+        const actionName = strName10(actionDef?.actionName);
         if (nav.type === "action" && actionName) {
           check(
             actionName,
-            `app "${appName}" \xB7 nav "${strName8(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName10(nav.id) ?? `#${ni}`}"`,
             `${navPath}.actionDef.actionName`,
             "Navigation action item"
           );
         }
+        const runAction = strName10(nav.runAction);
+        if (nav.type === "object" && runAction) {
+          check(
+            runAction,
+            `app "${appName}" \xB7 nav "${strName10(nav.id) ?? `#${ni}`}"`,
+            `${navPath}.runAction`,
+            "Navigation deep-link auto-run"
+          );
+        }
         if (Array.isArray(nav.children)) walkNav(nav.children, `${navPath}.children`);
       }
     };
     walkNav(app.navigation, `apps[${ai}].navigation`);
-    const areas = asArray28(app.areas);
+    const areas = asArray27(app.areas);
     for (let ri = 0; ri < areas.length; ri++) {
       walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
@@ -5023,14 +6036,14 @@ function validateActionNameRefs(stack) {
 
 // src/validate-action-locations.ts
 var ACTION_NO_PLACEMENT = "action-no-placement";
-function asArray29(v) {
+function asArray28(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName9(v) {
+function strName11(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList2(v) {
@@ -5044,8 +6057,8 @@ function collectNamePlacedActions(stack) {
     for (const key of ["rowActions", "bulkActions"]) {
       for (const n of strList2(list3[key])) placed.add(n);
     }
-    for (const def of asArray29(list3.bulkActionDefs)) {
-      const n = strName9(def?.name);
+    for (const def of asArray28(list3.bulkActionDefs)) {
+      const n = strName11(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -5053,12 +6066,12 @@ function collectNamePlacedActions(stack) {
     if (!listViews || typeof listViews !== "object" || Array.isArray(listViews)) return;
     for (const lv of Object.values(listViews)) harvest(lv);
   };
-  for (const view of asArray29(stack.views)) {
+  for (const view of asArray28(stack.views)) {
     if (!view || typeof view !== "object") continue;
     harvest(view.list);
     harvestListViews(view.listViews);
   }
-  for (const obj of asArray29(stack.objects)) {
+  for (const obj of asArray28(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     harvestListViews(obj.listViews);
   }
@@ -5071,7 +6084,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName9(action.name);
+    const name = strName11(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -5080,16 +6093,16 @@ function validateActionLocations(stack) {
       where: `action "${name}"`,
       path,
       message: `Action "${name}" declares no \`locations\` and no view places it by name, so it renders on no surface \u2014 the button exists in metadata and nowhere in the UI.`,
-      hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`, `global_nav`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
+      hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
     });
   };
-  const actions = asArray29(stack.actions);
+  const actions = asArray28(stack.actions);
   for (let i = 0; i < actions.length; i++) check(actions[i], `actions[${i}]`);
-  const objects = asArray29(stack.objects);
+  const objects = asArray28(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
-    const own = asArray29(obj.actions);
+    const own = asArray28(obj.actions);
     for (let ai = 0; ai < own.length; ai++) check(own[ai], `objects[${oi}].actions[${ai}]`);
   }
   return findings;
@@ -5100,13 +6113,13 @@ import { ComponentPropsMap } from "@objectstack/spec/ui";
 import { lintUnknownKeysAgainstSchema } from "@objectstack/spec";
 var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
 var COMPONENT_PROPS_INVALID = "component-props-invalid";
-function isRec9(v) {
+function isRec13(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName10(v) {
+function strName12(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function asArray30(v) {
+function asArray29(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5117,23 +6130,23 @@ var PROPS_SCHEMAS = ComponentPropsMap;
 var DATASOURCE_SUPPLIED_PROP = "object";
 function suppliedByDataSource(issue, component) {
   if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
-  const dataSource = isRec9(component.dataSource) ? component.dataSource : void 0;
-  return strName10(dataSource?.object) !== void 0;
+  const dataSource = isRec13(component.dataSource) ? component.dataSource : void 0;
+  return strName12(dataSource?.object) !== void 0;
 }
 function validateComponentProps(stack) {
   const findings = [];
-  if (!isRec9(stack)) return findings;
-  const pages = asArray30(stack.pages);
+  if (!isRec13(stack)) return findings;
+  const pages = asArray29(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec9(page)) continue;
-    const pageName = strName10(page.name) ?? `#${pi}`;
+    if (!isRec13(page)) continue;
+    const pageName = strName12(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName10(component.type);
+      const type = strName12(component.type);
       if (!type) continue;
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec9(component.properties) ? component.properties : void 0;
+      const props = isRec13(component.properties) ? component.properties : void 0;
       if (!props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -5184,20 +6197,20 @@ var CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
 var CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
 var CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
 var CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
-function asArray31(v) {
+function asArray30(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName11(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function isRec10(v) {
+function isRec14(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function distance4(a, b) {
@@ -5235,17 +6248,17 @@ function list2(names) {
 }
 function indexDatasets(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const ds of asArray31(stack.datasets)) {
-    const name = strName11(ds.name);
+  for (const ds of asArray30(stack.datasets)) {
+    const name = strName13(ds.name);
     if (!name) continue;
     const dimensions = /* @__PURE__ */ new Set();
-    for (const d of asArray31(ds.dimensions)) {
-      const n = strName11(d.name);
+    for (const d of asArray30(ds.dimensions)) {
+      const n = strName13(d.name);
       if (n) dimensions.add(n);
     }
     const measures = /* @__PURE__ */ new Set();
-    for (const m of asArray31(ds.measures)) {
-      const n = strName11(m.name);
+    for (const m of asArray30(ds.measures)) {
+      const n = strName13(m.name);
       if (n) measures.add(n);
     }
     out.set(name, { dimensions, measures });
@@ -5323,29 +6336,29 @@ function validateChartBindings(stack) {
     if (binding.yAxis) measureRef(binding.yAxis.name, binding.yAxis.path, selected);
     for (const s of binding.series ?? []) measureRef(s.name, s.path, selected);
   };
-  const reports = asArray31(stack.reports);
+  const reports = asArray30(stack.reports);
   for (let ri = 0; ri < reports.length; ri++) {
     const report = reports[ri];
-    if (!isRec10(report)) continue;
-    const reportName = strName11(report.name) ?? `#${ri}`;
+    if (!isRec14(report)) continue;
+    const reportName = strName13(report.name) ?? `#${ri}`;
     const checkReportChart = (chart, dataset, values, where, path) => {
-      if (!isRec10(chart)) return;
+      if (!isRec14(chart)) return;
       check({
         dataset,
         // `values` is the report's measure SELECTION, not a chart ref; feeding
         // it in lets the yAxis "declared but not selected" check work without
         // reporting the selection itself twice.
         values: { names: values, path: `${path}.values` },
-        xAxis: strName11(chart.xAxis) ? { name: strName11(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
-        yAxis: strName11(chart.yAxis) ? { name: strName11(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
-        series: asArray31(chart.series).map((s, si) => ({ name: strName11(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
+        xAxis: strName13(chart.xAxis) ? { name: strName13(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
+        yAxis: strName13(chart.yAxis) ? { name: strName13(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
+        series: asArray30(chart.series).map((s, si) => ({ name: strName13(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
         where,
         path: `${path}.chart`
       });
     };
     checkReportChart(
       report.chart,
-      strName11(report.dataset),
+      strName13(report.dataset),
       strList3(report.values),
       `report "${reportName}" \xB7 chart`,
       `reports[${ri}]`
@@ -5353,45 +6366,45 @@ function validateChartBindings(stack) {
     const blocks = Array.isArray(report.blocks) ? report.blocks : [];
     for (let bi = 0; bi < blocks.length; bi++) {
       const block = blocks[bi];
-      if (!isRec10(block)) continue;
+      if (!isRec14(block)) continue;
       checkReportChart(
         block.chart,
-        strName11(block.dataset),
+        strName13(block.dataset),
         strList3(block.values),
-        `report "${reportName}" \xB7 block "${strName11(block.name) ?? `#${bi}`}" chart`,
+        `report "${reportName}" \xB7 block "${strName13(block.name) ?? `#${bi}`}" chart`,
         `reports[${ri}].blocks[${bi}]`
       );
     }
   }
   const checkListChart = (container, where, path) => {
-    if (!isRec10(container)) return;
+    if (!isRec14(container)) return;
     const chart = container.chart;
-    if (!isRec10(chart)) return;
+    if (!isRec14(chart)) return;
     check({
-      dataset: strName11(chart.dataset),
+      dataset: strName13(chart.dataset),
       dimensions: { names: strList3(chart.dimensions), path: `${path}.chart.dimensions` },
       values: { names: strList3(chart.values), path: `${path}.chart.values` },
       where,
       path: `${path}.chart`
     });
   };
-  const views = asArray31(stack.views);
+  const views = asArray30(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec10(view)) continue;
-    const viewName = strName11(view.name) ?? strName11(view.objectName) ?? `#${vi}`;
+    if (!isRec14(view)) continue;
+    const viewName = strName13(view.name) ?? strName13(view.objectName) ?? `#${vi}`;
     checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
-    if (isRec10(view.listViews)) {
+    if (isRec14(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
         checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
       }
     }
   }
-  const objects = asArray31(stack.objects);
+  const objects = asArray30(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec10(obj) || !isRec10(obj.listViews)) continue;
-    const objName = strName11(obj.name) ?? `#${oi}`;
+    if (!isRec14(obj) || !isRec14(obj.listViews)) continue;
+    const objName = strName13(obj.name) ?? `#${oi}`;
     for (const [key, lv] of Object.entries(obj.listViews)) {
       checkListChart(
         lv,
@@ -5400,22 +6413,22 @@ function validateChartBindings(stack) {
       );
     }
   }
-  const pages = asArray31(stack.pages);
+  const pages = asArray30(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec10(page)) continue;
-    const pageName = strName11(page.name) ?? `#${pi}`;
+    if (!isRec14(page)) continue;
+    const pageName = strName13(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const props = isRec10(component.properties) ? component.properties : void 0;
-      if (!props || !strName11(props.dataset)) continue;
-      const axisRefs = asArray31(props.yAxis).map((a, ai) => ({ name: strName11(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
-      const seriesRefs = asArray31(props.series).map((s, si) => ({ name: strName11(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
+      const props = isRec14(component.properties) ? component.properties : void 0;
+      if (!props || !strName13(props.dataset)) continue;
+      const axisRefs = asArray30(props.yAxis).map((a, ai) => ({ name: strName13(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
+      const seriesRefs = asArray30(props.series).map((s, si) => ({ name: strName13(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
       check({
-        dataset: strName11(props.dataset),
+        dataset: strName13(props.dataset),
         dimensions: { names: strList3(props.dimensions), path: `${path}.properties.dimensions` },
         values: { names: strList3(props.values), path: `${path}.properties.values` },
         series: [...axisRefs, ...seriesRefs],
-        where: `page "${pageName}" \xB7 ${strName11(component.type) ?? "chart"}`,
+        where: `page "${pageName}" \xB7 ${strName13(component.type) ?? "chart"}`,
         path: `${path}.properties`
       });
     }
@@ -5424,15 +6437,15 @@ function validateChartBindings(stack) {
 }
 
 // src/validate-rule-compilability.ts
-import { createRequire as createRequire3 } from "module";
+import { createRequire as createRequire4 } from "module";
 var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
 var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
 var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
-var isRec11 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray32(v) {
-  if (Array.isArray(v)) return v.filter(isRec11);
-  if (isRec11(v)) {
-    return Object.entries(v).filter(([, def]) => isRec11(def)).map(([name, def]) => ({ name, ...def }));
+var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray31(v) {
+  if (Array.isArray(v)) return v.filter(isRec15);
+  if (isRec15(v)) {
+    return Object.entries(v).filter(([, def]) => isRec15(def)).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
@@ -5443,13 +6456,13 @@ function loadAjv() {
   const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
   let mod;
   try {
-    mod = createRequire3(anchor)("ajv");
+    mod = createRequire4(anchor)("ajv");
   } catch (err) {
     throw new Error(
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
     );
   }
-  const ctor = isRec11(mod) && "default" in mod ? mod.default : mod;
+  const ctor = isRec15(mod) && "default" in mod ? mod.default : mod;
   cachedAjv = ctor;
   return ctor;
 }
@@ -5458,13 +6471,13 @@ function loadAddFormats() {
   const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
   let mod;
   try {
-    mod = createRequire3(anchor)("ajv-formats");
+    mod = createRequire4(anchor)("ajv-formats");
   } catch (err) {
     throw new Error(
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
     );
   }
-  const plugin = isRec11(mod) && "default" in mod ? mod.default : mod;
+  const plugin = isRec15(mod) && "default" in mod ? mod.default : mod;
   cachedAddFormats = plugin;
   return plugin;
 }
@@ -5494,17 +6507,17 @@ function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
   if (depth >= MAX_RULE_NESTING_DEPTH) return out;
   for (const branch of ["then", "otherwise"]) {
     const nested = rule[branch];
-    if (isRec11(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+    if (isRec15(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
   }
   return out;
 }
 function walkObjectValidationRules(stack) {
   const walked = [];
-  if (!isRec11(stack)) return walked;
-  for (const obj of asArray32(stack.objects)) {
+  if (!isRec15(stack)) return walked;
+  for (const obj of asArray31(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     const validations = obj.validations;
-    for (const authored of asArray32(validations)) {
+    for (const authored of asArray31(validations)) {
       for (const { rule, label: label2, path } of flattenRules(authored, "", "")) {
         walked.push({
           rule,
@@ -5535,7 +6548,7 @@ function validateRuleCompilability(stack) {
         });
       }
     }
-    if (rule.type === "json_schema" && isRec11(rule.schema)) {
+    if (rule.type === "json_schema" && isRec15(rule.schema)) {
       try {
         createRuntimeAjv().compile(rule.schema);
       } catch (err) {
@@ -5555,7 +6568,7 @@ function validateRuleCompilability(stack) {
 
 // src/validate-rule-schema-formats.ts
 var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
-var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var SUBSCHEMA_KEYS = [
   "additionalItems",
   "additionalProperties",
@@ -5579,7 +6592,7 @@ var SUBSCHEMA_MAP_KEYS = [
 var MAX_SCHEMA_WALK_DEPTH = 32;
 var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
 function collectFormatUses(schema, pointer, out, depth) {
-  if (!isRec12(schema)) return;
+  if (!isRec16(schema)) return;
   if (typeof schema.format === "string") {
     out.push({ pointer: `${pointer}/format`, name: schema.format });
   }
@@ -5598,7 +6611,7 @@ function collectFormatUses(schema, pointer, out, depth) {
   }
   for (const key of SUBSCHEMA_MAP_KEYS) {
     const value = schema[key];
-    if (!isRec12(value)) continue;
+    if (!isRec16(value)) continue;
     for (const [name, entry] of Object.entries(value)) {
       collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
     }
@@ -5606,13 +6619,13 @@ function collectFormatUses(schema, pointer, out, depth) {
   const items = schema.items;
   if (Array.isArray(items)) {
     items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
-  } else if (isRec12(items)) {
+  } else if (isRec16(items)) {
     collectFormatUses(items, `${pointer}/items`, out, depth + 1);
   }
   const dependencies = schema.dependencies;
-  if (isRec12(dependencies)) {
+  if (isRec16(dependencies)) {
     for (const [name, entry] of Object.entries(dependencies)) {
-      if (!isRec12(entry)) continue;
+      if (!isRec16(entry)) continue;
       collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
     }
   }
@@ -5651,7 +6664,7 @@ function validateRuleSchemaFormats(stack) {
   const findings = [];
   const pending = [];
   for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
-    if (rule.type !== "json_schema" || !isRec12(rule.schema)) continue;
+    if (rule.type !== "json_schema" || !isRec16(rule.schema)) continue;
     const uses = [];
     collectFormatUses(rule.schema, "", uses, 0);
     for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
@@ -5679,7 +6692,7 @@ function validateRuleSchemaFormats(stack) {
 import { isPlatformProvidedObjectName as isPlatformProvidedObjectName2 } from "@objectstack/spec/system";
 
 // src/build-access-matrix.ts
-function asArray33(v) {
+function asArray32(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5690,13 +6703,13 @@ function buildAccessMatrix(stack) {
   const entries = [];
   if (!stack || typeof stack !== "object") return { version: 1, entries };
   const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray33(stack.objects)) {
+  for (const obj of asArray32(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : "";
     if (!name) continue;
     const owd = obj.sharingModel ?? obj.security?.sharingModel;
     if (typeof owd === "string") owdByObject.set(name, owd);
   }
-  for (const ps of asArray33(stack.permissions)) {
+  for (const ps of asArray32(stack.permissions)) {
     const psName = typeof ps.name === "string" ? ps.name : "";
     if (!psName) continue;
     const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
@@ -5769,34 +6782,34 @@ function diffAccessMatrix(before, after) {
 
 // src/validate-nav-access.ts
 var NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
-function asArray34(v) {
+function asArray33(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName12(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function collectNavExposures(stack) {
   const out = [];
-  const apps = asArray34(stack.apps);
+  const apps = asArray33(stack.apps);
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName12(app.name) ?? `#${ai}`;
+    const appName = strName14(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
-      const navItems = asArray34(items);
+      const navItems = asArray33(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
-        const objectName = strName12(nav.objectName);
+        const objectName = strName14(nav.objectName);
         if (nav.type === "object" && objectName) {
           out.push({
             objectName,
-            where: `app "${appName}" \xB7 nav "${strName12(nav.id) ?? `#${ni}`}"`,
+            where: `app "${appName}" \xB7 nav "${strName14(nav.id) ?? `#${ni}`}"`,
             path: `${navPath}.objectName`
           });
         }
@@ -5804,7 +6817,7 @@ function collectNavExposures(stack) {
       }
     };
     walk(app.navigation, `apps[${ai}].navigation`);
-    const areas = asArray34(app.areas);
+    const areas = asArray33(app.areas);
     for (let ri = 0; ri < areas.length; ri++) {
       walk(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
@@ -5814,13 +6827,13 @@ function collectNavExposures(stack) {
 function validateNavAccess(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const permissionSets = asArray34(stack.permissions);
+  const permissionSets = asArray33(stack.permissions);
   if (permissionSets.length === 0) return findings;
   const exposures = collectNavExposures(stack);
   if (exposures.length === 0) return findings;
   const ownObjects = /* @__PURE__ */ new Set();
-  for (const obj of asArray34(stack.objects)) {
-    const n = strName12(obj.name);
+  for (const obj of asArray33(stack.objects)) {
+    const n = strName14(obj.name);
     if (n) ownObjects.add(n);
   }
   const readable = /* @__PURE__ */ new Set();
@@ -5849,18 +6862,19 @@ function validateNavAccess(stack) {
 }
 
 // src/validate-translation-references.ts
+import { expandViewContainer } from "@objectstack/spec";
 import { hasPlatformObjectPrefix as hasPlatformObjectPrefix2, isPlatformProvidedObjectName as isPlatformProvidedObjectName3 } from "@objectstack/spec/system";
 var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec13(v) {
+function isRec17(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function asArray35(v) {
+function asArray34(v) {
   if (Array.isArray(v)) return v;
-  if (isRec13(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec13(def) ? def : {} }));
+  if (isRec17(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec17(def) ? def : {} }));
   return [];
 }
-function strName13(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance5(a, b) {
@@ -5920,30 +6934,52 @@ function collectViewRecord(view, factsFor) {
   };
   const addSections = (container, binding) => {
     if (!binding) return;
-    for (const section of asArray35(container.sections)) {
-      const sectionName = strName13(section.name);
+    for (const section of asArray34(container.sections)) {
+      const sectionName = strName15(section.name);
       if (sectionName) factsFor(binding).sections.add(sectionName);
     }
   };
-  const listBinding = isRec13(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec13(view.list)) addView(listBinding, strName13(view.list.name));
-  addView(recordObject ?? listBinding, strName13(view.name));
-  for (const key of ["listViews", "formViews"]) {
-    const container = view[key];
-    if (!isRec13(container)) continue;
-    for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec13(sub)) continue;
+  const listBinding = isRec17(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec17(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
+  addView(recordObject ?? listBinding, strName15(view.name));
+  const named = namedViewKeys(view);
+  for (const family of ["listViews", "formViews"]) {
+    const container = view[family];
+    if (!isRec17(container)) continue;
+    const registryKeys = family === "listViews" ? named.list : named.form;
+    let at = 0;
+    for (const sub of Object.values(container)) {
+      if (!sub || typeof sub !== "object") continue;
+      const registryKey = registryKeys[at++];
+      if (!isRec17(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
-      addView(binding, subKey);
-      addView(binding, strName13(sub.name));
+      addView(binding, registryKey);
       addSections(sub, binding);
     }
   }
-  if (isRec13(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  if (isRec17(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
   addSections(view, recordObject ?? listBinding);
 }
-function viewObjectName(view) {
-  return strName13(view.objectName) ?? strName13(view.object) ?? (isRec13(view.data) ? strName13(view.data.object) : void 0);
+function defaultListViewKey(object, container) {
+  if (!object || !isRec17(container.list)) return void 0;
+  const item = expandViewContainer(object, container).find(
+    (i) => i.viewKind === "list" && i.isDefault
+  );
+  if (!item) return void 0;
+  const prefix = `${object}.`;
+  return item.name.startsWith(prefix) ? item.name.slice(prefix.length) : item.name;
+}
+function namedViewKeys(container) {
+  const object = "probe";
+  const prefix = `${object}.`;
+  const bare = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : name;
+  const countEntries = (v) => isRec17(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
+  const listCount = countEntries(container.listViews);
+  const formCount = countEntries(container.formViews);
+  if (!listCount && !formCount) return { list: [], form: [] };
+  const items = expandViewContainer(object, container);
+  const keysOf2 = (kind, count) => items.filter((i) => i.viewKind === kind).slice(0, count).map((i) => bare(i.name));
+  return { list: keysOf2("list", listCount), form: keysOf2("form", formCount) };
 }
 function readOptions(field) {
   const raw = field.options;
@@ -5955,14 +6991,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec13(opt)) continue;
-      const value = strName13(opt.value);
+      if (!isRec17(opt)) continue;
+      const value = strName15(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName13(opt.label);
+      const label2 = strName15(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec13(raw)) {
+  } else if (isRec17(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -5982,48 +7018,48 @@ function buildUniverse(stack) {
     }
     return facts;
   };
-  for (const obj of asArray35(stack.objects)) {
-    const objectName = strName13(obj.name);
+  for (const obj of asArray34(stack.objects)) {
+    const objectName = strName15(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
-    for (const field of asArray35(obj.fields)) {
-      const fieldName = strName13(field.name);
+    for (const field of asArray34(obj.fields)) {
+      const fieldName = strName15(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
-    for (const action of asArray35(obj.actions)) {
-      const actionName = strName13(action.name);
+    for (const action of asArray34(obj.actions)) {
+      const actionName = strName15(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
-    for (const view of asArray35(obj.views)) {
-      collectViewRecord({ ...view, object: strName13(view.object) ?? objectName }, factsFor);
+    for (const view of asArray34(obj.views)) {
+      collectViewRecord({ ...view, object: strName15(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
-    for (const group of asArray35(obj.fieldGroups)) {
-      const key = strName13(group.key) ?? strName13(group.name);
+    for (const group of asArray34(obj.fieldGroups)) {
+      const key = strName15(group.key) ?? strName15(group.name);
       if (key) facts.sections.add(key);
     }
   }
-  for (const view of asArray35(stack.views)) {
+  for (const view of asArray34(stack.views)) {
     collectViewRecord(view, factsFor);
   }
-  const pages = asArray35(stack.pages);
+  const pages = asArray34(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec13(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec17(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      for (const section of asArray35(props.sections)) {
-        const sectionName = strName13(section.name);
+      for (const section of asArray34(props.sections)) {
+        const sectionName = strName15(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
   }
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
-  for (const action of asArray35(stack.actions)) {
-    const actionName = strName13(action.name);
+  for (const action of asArray34(stack.actions)) {
+    const actionName = strName15(action.name);
     if (!actionName) continue;
-    const owner = strName13(action.objectName) ?? strName13(action.object);
+    const owner = strName15(action.objectName) ?? strName15(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -6037,41 +7073,41 @@ function buildUniverse(stack) {
     }
   }
   const apps = /* @__PURE__ */ new Map();
-  for (const app of asArray35(stack.apps)) {
-    const appName = strName13(app.name);
+  for (const app of asArray34(stack.apps)) {
+    const appName = strName15(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
-      for (const item of asArray35(items)) {
-        const id = strName13(item.id);
+      for (const item of asArray34(items)) {
+        const id = strName15(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
-    for (const area of asArray35(app.areas)) {
-      const areaId = strName13(area.id);
+    for (const area of asArray34(app.areas)) {
+      const areaId = strName15(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
     apps.set(appName, navIds);
   }
   const dashboards = /* @__PURE__ */ new Map();
-  for (const dash of asArray35(stack.dashboards)) {
-    const dashName = strName13(dash.name);
+  for (const dash of asArray34(stack.dashboards)) {
+    const dashName = strName15(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
-    for (const widget of asArray35(dash.widgets)) {
-      const id = strName13(widget.id) ?? strName13(widget.name);
+    for (const widget of asArray34(dash.widgets)) {
+      const id = strName15(widget.id) ?? strName15(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray35(isRec13(dash.header) ? dash.header.actions : void 0),
-      ...asArray35(dash.actions)
+      ...asArray34(isRec17(dash.header) ? dash.header.actions : void 0),
+      ...asArray34(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName13(action.actionUrl) ?? strName13(action.url) ?? strName13(action.name);
+      const key = strName15(action.actionUrl) ?? strName15(action.url) ?? strName15(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -6083,7 +7119,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec13(stack)) return findings;
+  if (!isRec17(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -6092,13 +7128,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec13(bundle)) continue;
+    if (!isRec17(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec13(rawData)) continue;
+      if (!isRec17(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec13(rawNode)) continue;
+        if (!isRec17(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -6124,7 +7160,7 @@ function validateTranslationReferences(stack) {
             );
             continue;
           }
-          if (!isRec13(rawField)) continue;
+          if (!isRec17(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -6206,7 +7242,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec13(rawApp)) continue;
+        if (!isRec17(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
@@ -6229,7 +7265,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec13(rawDash)) continue;
+        if (!isRec17(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
@@ -6254,7 +7290,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec13(v) ? v : {};
+  return isRec17(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -6266,7 +7302,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName13(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName15(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -6285,11 +7321,11 @@ function checkOptionKeys(findings, ctx) {
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec13(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec17(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
-  for (const param of asArray35(ctx.action.params)) {
-    const name = strName13(param.name) ?? strName13(param.field);
+  for (const param of asArray34(ctx.action.params)) {
+    const name = strName15(param.name) ?? strName15(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -6307,76 +7343,40 @@ function checkActionParams(findings, ctx) {
 
 // src/validate-translatable-sections.ts
 var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
-function isRec14(v) {
+function isRec18(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName14(v) {
+function strName16(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function viewObjectName2(view) {
-  return strName14(view.objectName) ?? strName14(view.object) ?? (isRec14(view.data) ? strName14(view.data.object) : void 0);
-}
-function collectionEntries(v, base) {
-  if (Array.isArray(v)) {
-    const out = [];
-    for (let i = 0; i < v.length; i++) {
-      if (isRec14(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
-    }
-    return out;
-  }
-  if (isRec14(v)) {
-    return Object.entries(v).filter(([, def]) => isRec14(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
-  }
-  return [];
-}
 function viewLabel(view) {
-  const name = strName14(view.name);
+  const name = strName16(view.name);
   return name ? `view "${name}"` : "";
 }
 function joinWhere(...parts) {
   return parts.filter((p) => p.length > 0).join(" \xB7 ");
 }
 function collectViewSites(view, basePath, label2, sites) {
-  const recordObject = viewObjectName2(view);
-  const listBinding = isRec14(view.list) ? viewObjectName2(view.list) ?? recordObject : void 0;
-  const bindingOf = (container) => viewObjectName2(container) ?? recordObject;
-  sites.push({
-    path: `${basePath}.sections`,
-    surface: label2,
-    objectName: recordObject ?? listBinding,
-    sections: view.sections
-  });
-  if (isRec14(view.form)) {
+  const recordObject = viewObjectName(view);
+  const listBinding = isRec18(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
+  for (const site of viewContainerSites(view, basePath)) {
     sites.push({
-      path: `${basePath}.form.sections`,
-      surface: joinWhere(label2, "form"),
-      objectName: bindingOf(view.form) ?? listBinding,
-      sections: view.form.sections
+      path: `${site.path}.sections`,
+      surface: joinWhere(label2, site.surface),
+      objectName: viewObjectName(site.view) ?? recordObject ?? listBinding,
+      sections: site.view.sections
     });
   }
-  for (const key of ["listViews", "formViews"]) {
-    const container = view[key];
-    if (!isRec14(container)) continue;
-    for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec14(sub)) continue;
-      sites.push({
-        path: `${basePath}.${key}.${subKey}.sections`,
-        surface: joinWhere(label2, `${key}.${subKey}`),
-        objectName: bindingOf(sub) ?? listBinding,
-        sections: sub.sections
-      });
-    }
-  }
 }
 function translatedObjectNames(stack) {
   const out = /* @__PURE__ */ new Set();
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   for (const bundle of bundles) {
-    if (!isRec14(bundle)) continue;
+    if (!isRec18(bundle)) continue;
     for (const data of Object.values(bundle)) {
-      if (!isRec14(data) || !isRec14(data.objects)) continue;
+      if (!isRec18(data) || !isRec18(data.objects)) continue;
       for (const [objectName, node] of Object.entries(data.objects)) {
-        if (isRec14(node)) out.add(objectName);
+        if (isRec18(node)) out.add(objectName);
       }
     }
   }
@@ -6388,22 +7388,22 @@ function suggestedName(label2) {
 }
 function validateTranslatableSections(stack) {
   const findings = [];
-  if (!isRec14(stack)) return findings;
+  if (!isRec18(stack)) return findings;
   const translated = translatedObjectNames(stack);
   if (translated.size === 0) return findings;
   const sites = [];
   for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
-    const objectName = strName14(obj.name);
+    const objectName = strName16(obj.name);
     if (!objectName) continue;
     for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
       collectViewSites(
-        { ...view, object: strName14(view.object) ?? objectName },
+        { ...view, object: strName16(view.object) ?? objectName },
         path,
         viewLabel(view),
         sites
       );
     }
-    if (isRec14(obj.listViews)) {
+    if (isRec18(obj.listViews)) {
       collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
     }
   }
@@ -6411,13 +7411,13 @@ function validateTranslatableSections(stack) {
     collectViewSites(view, path, viewLabel(view), sites);
   }
   for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
-    const pageName = strName14(page.name);
+    const pageName = strName16(page.name);
     const pageLabel = pageName ? `page "${pageName}"` : "";
     for (const walked of walkPageComponents(page, pagePath)) {
       if (!walked.objectName) continue;
-      const props = isRec14(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec18(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      const type = strName14(walked.component.type) ?? "component";
+      const type = strName16(walked.component.type) ?? "component";
       sites.push({
         path: `${walked.path}.properties.sections`,
         surface: joinWhere(pageLabel, type),
@@ -6432,9 +7432,9 @@ function validateTranslatableSections(stack) {
     if (!Array.isArray(site.sections)) continue;
     for (let i = 0; i < site.sections.length; i++) {
       const section = site.sections[i];
-      if (!isRec14(section)) continue;
-      if (strName14(section.name)) continue;
-      const heading = strName14(section.label) ?? strName14(section.title);
+      if (!isRec18(section)) continue;
+      if (strName16(section.name)) continue;
+      const heading = strName16(section.label);
       if (!heading) continue;
       const slug = suggestedName(heading);
       findings.push({
@@ -6452,14 +7452,14 @@ function validateTranslatableSections(stack) {
 
 // src/validate-ai-surface-affinity.ts
 var AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
-function asArray36(v) {
+function asArray35(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName15(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -6469,18 +7469,18 @@ function validateAiSurfaceAffinity(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
-  for (const skill of asArray36(stack.skills)) {
-    const n = strName15(skill.name);
+  for (const skill of asArray35(stack.skills)) {
+    const n = strName17(skill.name);
     if (n) skillsByName.set(n, skill);
   }
-  const agents = asArray36(stack.agents);
+  const agents = asArray35(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName15(agent.name) ?? `#${ai}`;
+    const agentName = strName17(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName15(skillRefs[si]);
+      const ref = strName17(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -6502,14 +7502,14 @@ function validateAiSurfaceAffinity(stack) {
 // src/validate-ai-tool-references.ts
 import { PLATFORM_PROVIDED_TOOL_NAMES, PLATFORM_TOOL_FAMILY_PREFIXES } from "@objectstack/spec/system";
 var AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
-function asArray37(v) {
+function asArray36(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName16(v) {
+function strName18(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance6(a, b) {
@@ -6550,26 +7550,26 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName16(aiRec.description)) return false;
-  const type = strName16(action.type);
+  if (!strName18(aiRec.description)) return false;
+  const type = strName18(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
 }
 function collectToolUniverse(stack) {
   const universe = new Set(PLATFORM_PROVIDED_TOOL_NAMES);
-  for (const tool of asArray37(stack.tools)) {
-    const n = strName16(tool.name);
+  for (const tool of asArray36(stack.tools)) {
+    const n = strName18(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
-    for (const action of asArray37(actions)) {
-      const n = strName16(action.name);
+    for (const action of asArray36(actions)) {
+      const n = strName18(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
   addActionFamily(stack.actions);
-  for (const obj of asArray37(stack.objects)) {
+  for (const obj of asArray36(stack.objects)) {
     addActionFamily(obj.actions);
   }
   return universe;
@@ -6577,13 +7577,13 @@ function collectToolUniverse(stack) {
 function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
-    for (const action of asArray37(actions)) {
-      const n = strName16(action.name);
+    for (const action of asArray36(actions)) {
+      const n = strName18(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
   scan(stack.actions);
-  for (const obj of asArray37(stack.objects)) scan(obj.actions);
+  for (const obj of asArray36(stack.objects)) scan(obj.actions);
   return names;
 }
 function validateAiToolReferences(stack) {
@@ -6601,13 +7601,13 @@ function validateAiToolReferences(stack) {
     }
     return universe.has(ref);
   };
-  const skills = asArray37(stack.skills);
+  const skills = asArray36(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName16(skill.name) ?? `#${si}`;
+    const skillName = strName18(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName16(refs[ti]);
+      const ref = strName18(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -6626,24 +7626,25 @@ function validateAiToolReferences(stack) {
 
 // src/validate-ai-agent-authoring.ts
 var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
-function asArray38(v) {
+var DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
+function asArray37(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName17(v) {
+function strName19(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
 function validateAiAgentAuthoring(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const agents = asArray38(stack.agents);
+  const agents = asArray37(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName17(agent.name) ?? `#${ai}`;
+    const name = strName19(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -6655,24 +7656,40 @@ function validateAiAgentAuthoring(stack) {
       hint: isPlatformName ? `Remove the declaration; the platform owns "${name}". Extend it with skills instead.` : `Delete the agent and express its capability as skills. Everything an agent carried that a skill does not is persona text: move the useful parts of \`instructions\` into the skills' own instructions.` + (skillCount > 0 ? ` The ${skillCount} skill${skillCount === 1 ? "" : "s"} this agent references already carry the capability \u2014 they attach to the platform agent by \`surface\` affinity, so nothing is lost by dropping the persona.` : ``)
     });
   }
+  const roster = [...PLATFORM_AGENT_NAMES].join(", ");
+  const apps = asArray37(stack.apps);
+  for (let appIdx = 0; appIdx < apps.length; appIdx++) {
+    const app = apps[appIdx];
+    const defaultAgent = strName19(app.defaultAgent);
+    if (!defaultAgent || PLATFORM_AGENT_NAMES.has(defaultAgent)) continue;
+    const appName = strName19(app.name) ?? `#${appIdx}`;
+    findings.push({
+      severity: "warning",
+      rule: DEFAULT_AGENT_OUTSIDE_ROSTER,
+      where: `app "${appName}".defaultAgent`,
+      path: `apps[${appIdx}].defaultAgent`,
+      message: `app "${appName}" pins \`defaultAgent\` to "${defaultAgent}", which is not in the platform agent roster (${roster}). The kernel ships exactly two agents (ADR-0063 \xA72) and resolves this key against them and their legacy aliases only \u2014 an unrecognized name is not rejected, it silently falls back to the platform default at runtime, so the pin has no effect and the value drifts from what actually serves the app.`,
+      hint: `Set \`defaultAgent\` to one of the platform agent names: ${roster}. If the goal is a dedicated persona or capability, express it as skills instead \u2014 they attach to "ask" / "build" by surface affinity, not as a custom \`defaultAgent\` value.`
+    });
+  }
   return findings;
 }
 
 // src/validate-hook-body-writes.ts
-import { createRequire as createRequire4 } from "module";
-import { findClosestMatches, formatSuggestion } from "@objectstack/spec/shared";
-var cachedTs2 = null;
-function loadTypeScript2() {
-  if (cachedTs2) return cachedTs2;
+import { createRequire as createRequire5 } from "module";
+import { findClosestMatches as findClosestMatches2, formatSuggestion as formatSuggestion2 } from "@objectstack/spec/shared";
+var cachedTs3 = null;
+function loadTypeScript3() {
+  if (cachedTs3) return cachedTs3;
   const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
   try {
-    cachedTs2 = createRequire4(anchor)("typescript");
+    cachedTs3 = createRequire5(anchor)("typescript");
   } catch (err) {
     throw new Error(
       `@objectstack/lint: checking an L2 (language:'js') hook body requires the "typescript" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "typescript" in the image; it is only loaded when a hook with a JS body is validated.`
     );
   }
-  return cachedTs2;
+  return cachedTs3;
 }
 var HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
 var HOOK_BODY_WRITE_PATTERNS = [
@@ -6747,24 +7764,24 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray39(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec15(x));
-  if (isRec15(v)) {
+var isRec19 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray38(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec19(x));
+  if (isRec19(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec15(def) ? def : {}
+      ...isRec19(def) ? def : {}
     }));
   }
   return [];
 }
 function indexObjectFields2(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const obj of asArray39(stack.objects)) {
+  for (const obj of asArray38(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const names = /* @__PURE__ */ new Set();
-    for (const f of asArray39(obj.fields)) {
+    for (const f of asArray38(obj.fields)) {
       if (typeof f.name === "string" && f.name) names.add(f.name);
     }
     out.set(name, names);
@@ -6783,7 +7800,7 @@ function extractHookBodyWriteSet(source) {
   if (!/\bctx\b/.test(source) && !/\bObject\b/.test(source)) {
     return { writes: [], ctxRecordEscapes: false };
   }
-  const tsc = loadTypeScript2();
+  const tsc = loadTypeScript3();
   const sf = tsc.createSourceFile(
     "hook-body.ts",
     `async function __body(ctx) {
@@ -6894,12 +7911,12 @@ ${source}
 }
 function validateHookBodyWrites(stack) {
   const findings = [];
-  const hooks = asArray39(stack.hooks);
+  const hooks = asArray38(stack.hooks);
   if (hooks.length === 0) return findings;
   let objectFields = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec15(body) || body.language !== "js") return;
+    if (!isRec19(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
@@ -6956,12 +7973,12 @@ function unionCandidates(targetSets) {
   return [...out];
 }
 function fixHint(field, declared) {
-  const suggestion = formatSuggestion(findClosestMatches(field, [...declared, ...IMPLICIT_FIELDS2]));
+  const suggestion = formatSuggestion2(findClosestMatches2(field, [...declared, ...IMPLICIT_FIELDS2]));
   return (suggestion ? `${suggestion} ` : "") + `Fix the field name, or declare '${field}' on the object. Only the literal write patterns in HOOK_BODY_WRITE_PATTERNS are checked \u2014 computed keys, spreads and aliased input are not \u2014 and this warning never blocks a build.`;
 }
 
 // src/validate-action-body-writes.ts
-import { findClosestMatches as findClosestMatches2, formatSuggestion as formatSuggestion2 } from "@objectstack/spec/shared";
+import { findClosestMatches as findClosestMatches3, formatSuggestion as formatSuggestion3 } from "@objectstack/spec/shared";
 var ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
 var ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
 var ACTION_BODY_WRITE_PATTERN_IDS = ["api-crud-literal"];
@@ -6980,13 +7997,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray40(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec16(x));
-  if (isRec16(v)) {
+var isRec20 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray39(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec20(x));
+  if (isRec20(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec16(def) ? def : {}
+      ...isRec20(def) ? def : {}
     }));
   }
   return [];
@@ -7000,11 +8017,11 @@ function collectActionBodies(stack) {
   const sites = [];
   const seen = /* @__PURE__ */ new Set();
   const collect = (actions, pathPrefix, parentObject) => {
-    asArray40(actions).forEach((action, index) => {
+    asArray39(actions).forEach((action, index) => {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec16(body) || body.language !== "js") return;
+      if (!isRec20(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -7015,7 +8032,7 @@ function collectActionBodies(stack) {
     });
   };
   collect(stack.actions, "actions");
-  asArray40(stack.objects).forEach((obj, objIndex) => {
+  asArray39(stack.objects).forEach((obj, objIndex) => {
     const parentObject = typeof obj.name === "string" && obj.name ? obj.name : void 0;
     collect(obj.actions, `objects[${objIndex}].actions`, parentObject);
   });
@@ -7023,7 +8040,7 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec16(stack)) return findings;
+  if (!isRec20(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
@@ -7073,22 +8090,22 @@ function validateActionBodyWrites(stack) {
   return findings;
 }
 function fixHint2(field, declared) {
-  const suggestion = formatSuggestion2(findClosestMatches2(field, [...declared, ...IMPLICIT_FIELDS2]));
+  const suggestion = formatSuggestion3(findClosestMatches3(field, [...declared, ...IMPLICIT_FIELDS2]));
   return (suggestion ? `${suggestion} ` : "") + `Fix the field name, or declare '${field}' on the object. Only the literal write patterns in ACTION_BODY_WRITE_PATTERNS are checked \u2014 an action's ctx.input is its params bag, so it is not a record-write surface and is never resolved against fields \u2014 and this warning never blocks a build.`;
 }
 
 // src/validate-flow-node-writes.ts
-import { findClosestMatches as findClosestMatches3, formatSuggestion as formatSuggestion3 } from "@objectstack/spec/shared";
+import { findClosestMatches as findClosestMatches4, formatSuggestion as formatSuggestion4 } from "@objectstack/spec/shared";
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
 var FLOW_WRITE_NODE_TYPES_DEFERRED = [];
-var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray41(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec17(x));
-  if (isRec17(v)) {
+var isRec21 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray40(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec21(x));
+  if (isRec21(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec17(def) ? def : {}
+      ...isRec21(def) ? def : {}
     }));
   }
   return [];
@@ -7101,8 +8118,8 @@ function readLiteralObjectName2(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec17(stack)) return findings;
-  const flows = asArray41(stack.flows);
+  if (!isRec21(stack)) return findings;
+  const flows = asArray40(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
   flows.forEach((flow, flowIndex) => {
@@ -7110,10 +8127,10 @@ function validateFlowNodeWrites(stack) {
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec17(node.config) ? node.config : void 0;
+      const config = isRec21(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec17(fields)) return;
+      if (!isRec21(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName2(config);
@@ -7140,7 +8157,7 @@ function validateFlowNodeWrites(stack) {
   return findings;
 }
 function fixHint3(field, declared) {
-  const suggestion = formatSuggestion3(findClosestMatches3(field, [...declared, ...IMPLICIT_FIELDS2]));
+  const suggestion = formatSuggestion4(findClosestMatches4(field, [...declared, ...IMPLICIT_FIELDS2]));
   return (suggestion ? `${suggestion} ` : "") + `Fix the field name, or declare '${field}' on the object. This gates the build rather than warning: the key is literal and so is the object, so unlike the hook/action body rules there is nothing here that could have been mis-extracted.`;
 }
 
@@ -7258,7 +8275,8 @@ import {
   APPROVAL_REVISE_NODE_TYPE,
   collectFlowGraphs as collectFlowGraphs2
 } from "@objectstack/spec/automation";
-function asArray42(v) {
+import { reduceFilterVerdict as reduceFilterVerdict2 } from "@objectstack/spec/data";
+function asArray41(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -7532,7 +8550,21 @@ function scanBranchRouting(at, nodes, edges, findings) {
 function filterCarriesNoCondition(filter) {
   if (filter === void 0 || filter === null) return true;
   if (typeof filter !== "object" || Array.isArray(filter)) return false;
-  return Object.keys(filter).length === 0;
+  return reduceFilterVerdict2(filter) === "true";
+}
+function describeUnboundedFilter(filter) {
+  if (filter === void 0 || filter === null) return "no `filter` key";
+  if (Object.keys(filter).length === 0) return "an EMPTY `filter`";
+  return `a \`filter\` that REDUCES TO TRUE (\`${previewFilter(filter)}\`)`;
+}
+function previewFilter(filter) {
+  try {
+    const json = JSON.stringify(filter);
+    if (typeof json !== "string") return typeof filter;
+    return json.length > 80 ? `${json.slice(0, 77)}...` : json;
+  } catch {
+    return typeof filter;
+  }
 }
 function scanUnboundedBulkWrites(at, nodes, findings) {
   for (const node of nodes) {
@@ -7543,10 +8575,10 @@ function scanUnboundedBulkWrites(at, nodes, findings) {
     if (cfg.multi !== true) continue;
     if (!filterCarriesNoCondition(cfg.filter)) continue;
     const objectName = typeof cfg.objectName === "string" && cfg.objectName ? cfg.objectName : "(unnamed object)";
-    const filterState = cfg.filter === void 0 || cfg.filter === null ? "no `filter` key" : "an EMPTY `filter`";
+    const filterState = describeUnboundedFilter(cfg.filter);
     findings.push({
       where: `${at} \xB7 node '${String(node.id)}' (${nodeType})`,
-      message: `declares \`multi: true\` with ${filterState} \u2014 this is a WHOLE-OBJECT write, by declaration: every row of '${objectName}' is ${consequence2.verb} on every run. The executor forwards \`where: {}\` plus the bulk intent, ${consequence2.dispatchNote}, and it lands on \`${consequence2.engineCall}\` with no predicate. Nothing refuses it at run time, so the only feedback is the step's \`acted\` row count \u2014 reported AFTER the rows are gone.`,
+      message: `declares \`multi: true\` with ${filterState} \u2014 this is a WHOLE-OBJECT write, by declaration: every row of '${objectName}' is ${consequence2.verb} on every run. The executor forwards the filter as \`where\` (an absent key becomes \`{}\`) plus the bulk intent, ${consequence2.dispatchNote}, and it lands on \`${consequence2.engineCall}\` bounded by nothing \u2014 a filter that reduces to TRUE constrains no row. Nothing refuses it at run time, so the only feedback is the step's \`acted\` row count \u2014 reported AFTER the rows are gone.`,
       hint: `Write the constraint you mean into \`filter\` (e.g. \`{ status: 'closed' }\` \u2014 see examples/app-showcase \`showcase_inquiry_purge\`, bulk intent bounded by a predicate). If emptying '${objectName}' really is the intent, keep it: this is a warning, not a gate, and the run-time path stays open. Distinct from the #3810 erased-condition guard, which REFUSES this node at run time when a condition you WROTE interpolated to nothing \u2014 that guard is keyed on "a written condition is gone" and deliberately not on "the filter is empty", which is the fact this rule judges at authoring time. (#5482, #5393)`,
       // Warning, not `error`: see the severity policy at the top of this file.
       // The shape has a legitimate reading the engine grants on purpose, so it is
@@ -7628,7 +8660,7 @@ function scanApprovalReviseLoops(at, nodes, edges, findings) {
 }
 function lintFlowPatterns(stack) {
   const findings = [];
-  for (const flow of asArray42(stack.flows)) {
+  for (const flow of asArray41(stack.flows)) {
     const flowName = typeof flow.name === "string" ? flow.name : "(unnamed flow)";
     const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
     const edges = Array.isArray(flow.edges) ? flow.edges : [];
@@ -7720,19 +8752,19 @@ function lintFlowPatterns(stack) {
 }
 
 // src/lint-liveness-properties.ts
-import { createRequire as createRequire5 } from "module";
+import { createRequire as createRequire6 } from "module";
 import { dirname, join } from "path";
 import { existsSync, readFileSync } from "fs";
 var LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
 var LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
-function asArray43(v) {
+function asArray42(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
 }
 function resolveLivenessDir() {
   try {
-    const require2 = createRequire5(import.meta.url);
+    const require2 = createRequire6(import.meta.url);
     const pkgJson = require2.resolve("@objectstack/spec/package.json");
     const dir = join(dirname(pkgJson), "liveness");
     return existsSync(dir) ? dir : null;
@@ -7847,6 +8879,13 @@ var TYPE_COLLECTIONS = [
   // checks every widget on the dashboard. Registering it here is not optional
   // bookkeeping: without it the ledger would be newly correct and newly
   // silent, which is the shape this lint exists to prevent.
+  //
+  // As of #6774 the dashboard ledger warns on NOTHING — four of those five were
+  // retired in 17.0.0 (#5010) and `colorVariant` went `live` when objectui#3799
+  // gave it a renderer. The type STAYS listed, the resolved state `webhook` and
+  // `email_template` already sit in: a zero-warn entry costs one empty map
+  // lookup, and it means a future regression that re-deadens a widget key warns
+  // on its own instead of waiting for someone to notice this list again.
   { type: "dashboard", key: "dashboards" }
 ];
 function lintLivenessProperties(stack) {
@@ -7855,11 +8894,11 @@ function lintLivenessProperties(stack) {
   const findings = [];
   const objectWarn = loadWarnMap(dir, "object");
   const fieldWarn = loadWarnMap(dir, "field");
-  for (const obj of asArray43(stack.objects)) {
+  for (const obj of asArray42(stack.objects)) {
     const objName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     if (objectWarn.size > 0) checkItem("object", obj, `object '${objName}'`, objectWarn, findings);
     if (fieldWarn.size > 0) {
-      for (const field of asArray43(obj.fields)) {
+      for (const field of asArray42(obj.fields)) {
         const fieldName = typeof field.name === "string" ? field.name : "(unnamed field)";
         checkItem("field", field, `object '${objName}' \xB7 field '${fieldName}'`, fieldWarn, findings);
       }
@@ -7868,7 +8907,7 @@ function lintLivenessProperties(stack) {
   for (const { type, key } of TYPE_COLLECTIONS) {
     const warnMap = loadWarnMap(dir, type);
     if (warnMap.size === 0) continue;
-    for (const item of asArray43(stack[key])) {
+    for (const item of asArray42(stack[key])) {
       const name = typeof item.name === "string" ? item.name : typeof item.object === "string" ? item.object : `(unnamed ${type})`;
       checkItem(type, item, `${type} '${name}'`, warnMap, findings);
     }
@@ -7882,7 +8921,7 @@ var AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
 var AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
 var AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
 var AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
-function asArray44(v) {
+function asArray43(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -7891,9 +8930,9 @@ function asArray44(v) {
 }
 function lintAutonumberFormats(stack) {
   const findings = [];
-  for (const obj of asArray44(stack.objects)) {
+  for (const obj of asArray43(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
-    const fields = asArray44(obj.fields);
+    const fields = asArray43(obj.fields);
     const fieldMeta = /* @__PURE__ */ new Map();
     for (const f of fields) {
       if (typeof f.name === "string") fieldMeta.set(f.name, { required: f.required === true });
@@ -7959,7 +8998,7 @@ function lintAutonumberFormats(stack) {
 
 // src/lint-view-refs.ts
 import { expandViewContainerWithDiagnostics, isAggregatedViewContainer } from "@objectstack/spec";
-function asArray45(v) {
+function asArray44(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -7987,7 +9026,7 @@ function lintViewRefs(stack) {
     s.add(kind);
   };
   const containers = [];
-  for (const v of asArray45(stack.views)) {
+  for (const v of asArray44(stack.views)) {
     if (v.viewKind) {
       if (typeof v.name === "string") indexKind(v.name, v.viewKind === "form" ? "form" : "list");
       continue;
@@ -7996,7 +9035,7 @@ function lintViewRefs(stack) {
     const object = viewContainerObjectName(v);
     if (object) containers.push({ object, container: v });
   }
-  for (const obj of asArray45(stack.objects)) {
+  for (const obj of asArray44(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
     if (!object) continue;
     if (obj.list || obj.form || obj.listViews || obj.formViews) {
@@ -8050,11 +9089,11 @@ function lintViewRefs(stack) {
       });
     }
   };
-  for (const obj of asArray45(stack.objects)) {
+  for (const obj of asArray44(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
-    for (const action of asArray45(obj.actions)) checkAction(action, object);
+    for (const action of asArray44(obj.actions)) checkAction(action, object);
   }
-  for (const action of asArray45(stack.actions)) checkAction(action);
+  for (const action of asArray44(stack.actions)) checkAction(action);
   return findings;
 }
 
@@ -8242,13 +9281,14 @@ function lintDataModel(objects) {
     if (!obj?.name) continue;
     const objPath = `objects[${i}]`;
     const fields = fieldEntries2(obj.fields);
-    const hasNameField = !!obj.primaryField || !!obj.titleFormat || fields.some((f) => NAME_LIKE_FIELDS.includes(f.name));
+    const hasNameField = !!obj.nameField || fields.some((f) => NAME_LIKE_FIELDS.includes(f.name));
     if (fields.length > 0 && !hasNameField) {
       issues.push({
         severity: "suggestion",
         rule: "object/missing-name-field",
-        message: `Object "${obj.name}" has no name/title field or primaryField \u2014 records will display as raw IDs`,
-        path: `${objPath}.fields`
+        message: `Object "${obj.name}" has no nameField and no name-like field \u2014 records will display as raw IDs`,
+        path: `${objPath}.fields`,
+        fix: `Set \`nameField: '<field>'\` \u2014 ADR-0079's canonical primary-title pointer \u2014 to a stored text/autonumber field, or to a formula field with \`returnType: 'text'\` for a composite title. A \`titleFormat\` template does NOT count: it is retired (ADR-0079) and render-only, so the server can neither return nor query the title it renders.`
       });
     }
     for (const { name: fieldName, def } of fields) {
@@ -8357,6 +9397,7 @@ var CLI_ONLY = ["cli"];
 var CLI_AND_RUNTIME = ["cli", "runtime-publish"];
 var RUNTIME_NEEDS_FULL_SNAPSHOT = "P2 (#4463): reads a stack-wide collection the per-write snapshot does not carry, so running it now would report the rest of the tenant's metadata as missing rather than judging this write.";
 var RUNTIME_HEAVY_SOURCE_PARSE = "Not runtime-safe: parses authored source through typescript/sucrase, the two dependencies the kernel boot path must never load (lazy-deps.test.ts). Studio compiles page source on its own path.";
+var RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY = "Deliberate, and not a snapshot limitation: this rule needs only the written item, but every other rule on the `views[]` visibility-predicate surface (validate-visibility-predicates.ts) is CLI-only. Gating one of three sibling verdicts about the same predicate at the Studio door is less predictable than gating none; move the family together, as one measured edit.";
 var RUNTIME_OBJECT_WRITES_P2 = "P2 (#4463): judges an object/field declaration. Object writes are the hottest metadata path in the product, so P1 gates `flow` first and widens once the gate has real traffic behind it.";
 var EXPRESSION_INVALID = "expression-invalid";
 var AUTHORING_RULES = [
@@ -8386,8 +9427,12 @@ var AUTHORING_RULES = [
     }))
   },
   // ADR-0053 — `userFilters`/`quickFilters` on an object list view ("views"
-  // mode) are silently dropped: `ObjectListViewSchema` omits them, so this must
-  // read the pre-parse tier or the evidence is already gone.
+  // mode). NOT "silently dropped" any more: since #4001 `ObjectListViewSchema`
+  // is strict and refuses `quickFilters` by name, and `ObjectUserFiltersSchema`
+  // refuses `element: 'tabs'` by enum — measured under #6073, `defineStack`
+  // THROWS on both. `normalized` here therefore means "needs no parsed stack"
+  // (so `os lint`, which never parses, can run it), not "sees evidence the
+  // parse would have eaten".
   {
     name: "validateListViewMode",
     tier: "gating",
@@ -8418,9 +9463,13 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_OBJECT_WRITES_P2,
     run: (stack) => validateFunctionalCompleteness(stack)
   },
-  // A flat list-view object in `views: []` parses to an EMPTY container
-  // (ViewSchema strips unknown keys): the schema step passes, zero views
-  // register, and the Console renders nothing. Pre-parse for the same reason.
+  // A view container in `views: []` that registers zero views: nothing appears
+  // in the Console, and the schema step cannot tell it from an intentionally
+  // empty one. The FLAT-list-view arm no longer needs this tier — `ViewSchema`
+  // went strict at #4001, so `defineStack` now REFUSES `{ name, type, columns,
+  // data }` by name with the wrap-it hint (measured under #6073); the arm that
+  // still needs a rule is the all-slots-empty container, whose keys are all
+  // declared and which survives the parse untouched.
   {
     name: "validateViewContainers",
     tier: "gating",
@@ -8470,6 +9519,31 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateFilterTokens(stack)
   },
+  // #5330 — the LITERAL empty combinators (`$and: []`, `$or: []`, `$not: {}`,
+  // `{}`). #5322 ruled their RUNTIME meaning to be the boolean identity, and
+  // this rule does not touch it: it refuses the literal SPELLINGS at authoring
+  // time with a per-shape prescription, which is Prime Directive #12's standard
+  // shape (reject at the producer, never tolerate at the consumer) and #5240's
+  // same-direction precedent one shape over.
+  {
+    name: "validateEmptyCombinators",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-empty-combinators.ts",
+    // The one type #4463's P1 slice opened, and the one this rule most needs:
+    // a flow CRUD node's `config.filter` is where an empty combinator has the
+    // largest blast radius, and the write path is the only door an AI author
+    // uses. This rule needs NO resolution context at all — it judges the filter
+    // literal in isolation — so RUNTIME_NEEDS_FULL_SNAPSHOT does not apply to
+    // it, and widening to the other filter-carrying types (`object`, `view`,
+    // `page`, `dashboard`) is a one-line `runtimeTypes` edit once #4463 P2
+    // opens them at the gate. Making that call here would widen the gate's
+    // dispatch surface on this rule's authority, which is P2's decision.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => validateEmptyCombinators(stack)
+  },
   // The reference-integrity suite (#3583 §5 D5) — itself a registry, of the
   // rules that answer "does this name resolve to anything?". It reached all
   // three commands before this file existed; it is an entry here so the two
@@ -8518,6 +9592,16 @@ var AUTHORING_RULES = [
   // `displayField` (#5775) — so gating today would fail the platform's own pages
   // to enforce declarations the platform does not keep. The error upgrade is a
   // separate step, once the warning-period inventory is empty.
+  //
+  // #5775 settled the record picker's half: `displayField` is retired in favour
+  // of the `labelField` the renderer actually reads. Its claim that "the rest of
+  // the keys the renderers honour are declared" did NOT hold — #6776 found five
+  // more (`page:header` `recordChrome`/`showStar`/`showCopyId`,
+  // `page:accordion.variant`, and the tab strip's visual style, whose declared
+  // spelling `page:tabs.type` collided with the component node's own dispatch
+  // key and so was unauthorable in the flat and JSX carriers). All five are
+  // declared as of #6776, the last as the renamed `tabStyle`. What remains
+  // before the error upgrade is #5728 and two page rewrites.
   {
     name: "validateComponentProps",
     tier: "advisory",
@@ -8596,10 +9680,12 @@ var AUTHORING_RULES = [
   //
   // `gating` since #5762, which reviewed the file's rules as one family and
   // split them on a single question: is THIS STACK enough to know the flow is
-  // dead? Three rules answer yes and now emit `error` — a `config.timeRelative`
+  // dead? Four rules answer yes and emit `error` — a `config.timeRelative`
   // the spec's own `TimeRelativeTriggerSchema` refuses, one the engine's routing
-  // predicate cannot route at all, and a `record-*` triggerType outside the
-  // closed token grammar `triggerTypeToHookEvents` maps. None of those verdicts
+  // predicate cannot route at all, a `record-*` triggerType outside the
+  // closed token grammar `triggerTypeToHookEvents` maps, and (#6637) a
+  // `type: 'record_change'` flow whose triggerType the engine's binding resolver
+  // routes nowhere, silently demoting it to a manual flow. None of those verdicts
   // can be changed by installing a package, so there is no reading under which
   // the flow fires. `flow-trigger-unknown-object` deliberately stayed `warning`
   // (the object may come from another installed package — a hedge this rule
@@ -8726,12 +9812,39 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateSeedStateMachine(stack)
   },
-  // ADR-0089 D3b — deprecated visibility aliases and a mis-layered binding root.
-  // Pre-parse: the schema folds `visibleOn`/`visibility` into `visibleWhen`
-  // during parse, so the alias the author wrote is gone from `result.data`.
+  // ADR-0089 D3b — a mis-layered binding root, plus (#6128) the bare-identifier
+  // gate and (#6253) the syntax gate. This entry used to read "pre-parse: the
+  // schema folds `visibleOn`/`visibility` into `visibleWhen` during parse, so
+  // the alias the author wrote is gone from `result.data`". Measured false at
+  // #6073: the ADR-0087 D2 conversions do that fold INSIDE
+  // `normalizeStackInput`, one layer BEFORE this tier, so on every spec-valid
+  // alias site the alias-KEY rule reported zero here too.
+  //
+  // #6318 closed that: `visibility-alias-deprecated` was RETIRED rather than
+  // re-anchored. Re-anchoring would have had to move this entry's input to a
+  // pre-`normalizeStackInput` value that `runAuthoringRules` does not accept —
+  // a change to this package's external input contract, and the maintainer's
+  // call, not a rule file's. Retirement is ADR-0049 (declared ≠ enforced) and
+  // costs no author a signal: the same D2 conversion already shouts through
+  // `warnConversionNotice` in `defineStack`, naming the site, the conversion and
+  // the protocol-16 retirement window — better wording than the rule ever had.
+  //
+  // Every rule left in the family judges the predicate's VALUE, and the value
+  // moves into `visibleWhen` intact, so all three report normally on this tier.
+  // The tier therefore stays `normalized` on its SURVIVING justification (a
+  // finding still reaches the author when an unrelated schema error would stop
+  // the parse — see `AuthoringRuleInputTier`), never on the retired
+  // "pre-parse evidence" one.
+  //
+  // `gating` since #6128: `visibility-bare-identifier` emits `error`. The two
+  // ADR-0089 rules stay advisory findings within it — the tier is a property of
+  // the RULE FUNCTION (can it emit `error`?), and the per-finding severity is
+  // what decides whether any given diagnostic gates, exactly as `lintFlowPatterns`
+  // has worked since #3760. The promotion follows the #5762 precedent: a family
+  // that gains an `error` finding moves its registry tier in the same edit.
   {
     name: "validateVisibilityPredicates",
-    tier: "advisory",
+    tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-visibility-predicates.ts",
@@ -8739,6 +9852,30 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateVisibilityPredicates(stack)
   },
+  // #7010 — the same predicate surface, one question further in. The three
+  // ADR-0089 D3b rules above judge a predicate's SHAPE (does it parse, is it
+  // rooted, is the root right for the layer) and never open the target schema,
+  // so `data.tpye == 'formula'` passes all three and still resolves to nothing.
+  // This rule resolves the PATH against the schema the form edits — the closed
+  // `getMetadataTypeSchema` key set — and is therefore immune to the CEL
+  // type-name blind spot that made #6248's gate structurally unable to catch
+  // #6254's 16 bare `type ==` predicates.
+  //
+  // Scoped to schema-bound forms (`data: { provider: 'schema', schemaId }`);
+  // the `record.*` layer is deliberately out of scope because an ObjectQL
+  // object's addressable path set is NOT closed (lookup traversal, system
+  // columns, formula outputs), and an `error` gate over an open set generates
+  // false build errors. See the rule's module note.
+  {
+    name: "validatePredicatePathRefs",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-predicate-path-refs.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY,
+    run: (stack) => validatePredicatePathRefs(stack)
+  },
   // #1874 — flow authoring anti-patterns. Advisory by default; a finding marked
   // `error` gates. Three do today: `flow-runas-unscoped` (#3760 — metadata the
   // runtime REFUSES to execute), plus `flow-branch-label-unmatched` and
@@ -9134,10 +10271,13 @@ export {
   DASHBOARD_ACTION_ROUTE_UNRESOLVED,
   DASHBOARD_ACTION_TARGET_UNDEFINED,
   DASHBOARD_FILTER_FIELD_UNKNOWN,
+  DEFAULT_AGENT_OUTSIDE_ROSTER,
   EXPRESSION_INVALID,
   FIELD_GROUP_EMPTY,
   FIELD_GROUP_SHADOWED,
   FIELD_GROUP_UNDECLARED,
+  FILTER_EMPTY_COMBINATOR,
+  FILTER_EMPTY_NODE,
   FILTER_TOKEN_UNKNOWN,
   FLOW_APPROVAL_REVISE_DEAD_END,
   FLOW_APPROVAL_REVISE_DISABLED,
@@ -9164,6 +10304,7 @@ export {
   FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE,
   FLOW_TRIGGER_UNKNOWN_EVENT,
   FLOW_TRIGGER_UNKNOWN_OBJECT,
+  FLOW_TRIGGER_UNROUTABLE,
   FLOW_UPDATE_READONLY_FIELD,
   FLOW_UPDATE_READONLY_WHEN_FIELD,
   FLOW_WRITE_NODE_TYPES,
@@ -9184,19 +10325,25 @@ export {
   NULL_GUARD_HINT,
   OBJECT_REFERENCE_UNKNOWN,
   OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
+  OPEN_VOCABULARY_PROBES,
   ORG_AXIS_CROSS_ORG_BU_GRANT,
   ORG_AXIS_PERMISSION_INHERITANCE,
   PAGE_FIELD_UNKNOWN,
   PAGE_SOURCE_CLASSNAME,
+  PREDICATE_PATH_UNRESOLVED,
+  PREDICATE_PATH_UNROOTED,
+  PRE_SEAL_PHASES,
   REACT_BLOCK_NEEDS_RECORD_CONTEXT,
   REACT_CHART_AGGREGATE_INVALID,
   REACT_CHART_AXIS_UNKNOWN,
   REACT_CHART_DRILLDOWN_INVALID,
   REACT_CHART_FIELD_UNKNOWN,
   REFERENCE_INTEGRITY_RULES,
+  RLS_PREDICATE_OVER_BUDGET,
   RLS_PREDICATE_UNENFORCEABLE,
   RLS_PREDICATE_UNPARSEABLE,
   RUNTIME_AJV_OPTIONS,
+  SEAL_MARKERS,
   SEARCHABLE_FIELD_UNKNOWN,
   SEARCHABLE_FIELD_UNSEARCHABLE,
   SECURITY_ANCHOR_HIGH_PRIVILEGE,
@@ -9216,6 +10363,9 @@ export {
   SEMANTIC_ROLE_FIELD_UNKNOWN,
   SHARING_RULE_RUNTIME_VARIABLE_CONDITION,
   SHARING_RULE_UNLOWERABLE_CONDITION,
+  STARTUP_OPEN_VOCABULARY_VERDICT,
+  STARTUP_VERDICT_ASSERTIVE_WORDING,
+  STARTUP_VERDICT_HINT,
   STYLE_CLASSNAME_TAILWIND,
   STYLE_NODE_MISSING_ID,
   STYLE_RESPONSIVE_NO_BASE,
@@ -9237,7 +10387,9 @@ export {
   VIEW_KEY_COLLISION,
   VIEW_REF_FORM_TARGET_KIND,
   VIEW_REF_FORM_TARGET_MISSING,
-  VISIBILITY_ALIAS_DEPRECATED,
+  VISIBILITY_BARE_IDENTIFIER,
+  VISIBILITY_PREDICATE_OVER_BUDGET,
+  VISIBILITY_PREDICATE_SYNTAX,
   VISIBILITY_ROOT_MISLAYERED,
   WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN,
@@ -9249,6 +10401,7 @@ export {
   diffAccessMatrix,
   extractHookBodyWriteSet,
   extractHookBodyWrites,
+  findStartupRegistryVerdicts,
   findUnguardedNullableOperands,
   isSourceAuthoredPage,
   lintAutonumberFormats,
@@ -9278,6 +10431,7 @@ export {
   validateChartBindings,
   validateComponentProps,
   validateDashboardActionRefs,
+  validateEmptyCombinators,
   validateFilterTokens,
   validateFlowNodeWrites,
   validateFlowTemplatePaths,
@@ -9293,6 +10447,7 @@ export {
   validateOrgAxisRedLines,
   validatePageFieldBindings,
   validatePageSourceStyling,
+  validatePredicatePathRefs,
   validateReactPageProps,
   validateReactPages,
   validateReadonlyFlowWrites,