@objectstack/lint 17.0.0-rc.4 → 17.0.0-rc.6

package/dist/runtime.cjs

@@ -400,6 +400,38 @@ function validateStackExpressions(stack) {
     for (const e of res.errors) issues.push({ where, message: e.message, source: e.source, severity: "error" });
     for (const w of res.warnings) issues.push({ where, message: w.message, source: w.source, severity: "warning" });
   };
+  const FIELD_RULE_BOUND_ROOTS = ["record", "previous", "parent"];
+  const FIELD_RULE_USER_ROOTS = ["current_user", "user", "ctx", "os"];
+  const FIELD_RULE_SLOT_CONSEQUENCE_GENERIC = "the predicate faults, and a faulting rule never produces the verdict you declared \u2014 each slot resolves the fault to its own fallback, and none of those fallbacks is yours";
+  const FIELD_RULE_SLOT_CONSEQUENCE = {
+    visibleWhen: "the predicate faults and the renderer falls back to VISIBLE (`resolveFieldRuleState` evaluates visibility with `fallback: true`, and no server-side gate evaluates a field-level `visibleWhen` at all), leaving the field the test was meant to hide showing for everyone (#6146)",
+    readonlyWhen: "the predicate faults \u2014 and the two ends fault in OPPOSITE directions. The server treats the field as LOCKED (`isReadonlyWhenLocked` will not waive a declared lock it could not evaluate, #4889) and drops your value from the payload, while the form still renders the field editable (`fallback: false`). Per ADR-0057 D10 the server is the one that decides: the field looks writable, the save reports success, and the value silently never lands",
+    requiredWhen: "the predicate faults and the requirement is never enforced anywhere \u2014 the server logs it and SKIPS the check (fail-open, #4977 deliberately did not take #4889's carve-out) and the form does not mark the field required either, so a record saves with the field empty",
+    // Listed rather than left to the `??` below, so the map covers every slot
+    // the field walk passes and the default stays unreachable. `FieldSchema`
+    // declares this key only as a `retiredKey`, which rejects it by name, so
+    // there is no fourth runtime to measure — the honest clause is the generic
+    // one, not a fabricated fourth cell (#6716).
+    conditionalRequired: FIELD_RULE_SLOT_CONSEQUENCE_GENERIC
+  };
+  const checkFieldRuleRoot = (where, slot, raw) => {
+    const source = celSourceOf(raw);
+    if (!source) return;
+    const roots = (0, import_formula2.collectCelRootIdentifiers)(source);
+    if (!roots.ok) return;
+    const kept = import_formula2.SCOPE_ROOTS.filter(
+      (r) => !FIELD_RULE_BOUND_ROOTS.includes(r) && roots.roots.includes(r)
+    );
+    if (kept.length === 0) return;
+    const root = FIELD_RULE_USER_ROOTS.find((r) => kept.includes(r)) ?? kept[0];
+    const prescription = FIELD_RULE_USER_ROOTS.includes(root) ? `To gate the CHOICES of a select by user, move the predicate to the option's own \`visibleWhen\` (\`options: [{ \u2026, visibleWhen: \u2026 }]\`) \u2014 per-option is the one \`*When\` surface that binds \`current_user\` and its ADR-0068 aliases. To hide the FIELD by role, declare field-level security on a permission set (\`fields: { '<object>.<field>': { readable: false } }\`), which the server enforces. To gate on record state, rewrite the predicate against \`record\`.` : root === "data" ? `\`data\` is the root of a METADATA form (a \`*.form\` module \u2014 the metadata row being edited); this is an OBJECT field, whose runtime form binds the row as \`record\` \u2014 one key name, two form kinds, two roots. Rewrite \`data.<key>\` as \`record.<field>\`.` : `\`${root}\` is declared platform-wide and bound at OTHER evaluation sites (flow, automation, screen and action predicates), never at the field level. Rewrite the predicate against \`record\` (plus \`previous\`, and \`parent\` on a master-detail line item), or move the decision to a surface that binds \`${root}\`.`;
+    issues.push({
+      where,
+      message: `\`${slot}\` reads \`${root}\`, but a field-level conditional rule binds only \`record\` (plus \`previous\`, and \`parent\` on a master-detail line item) \u2014 \`${root}\` is unbound here, so ${FIELD_RULE_SLOT_CONSEQUENCE[slot] ?? FIELD_RULE_SLOT_CONSEQUENCE_GENERIC}. ` + prescription,
+      source,
+      severity: "error"
+    });
+  };
   const checkDeclaredPredicate = (where, raw) => {
     if (raw == null) return;
     const res = (0, import_formula2.validateExpression)("predicate", raw);
@@ -432,7 +464,14 @@ function validateStackExpressions(stack) {
           if (retired.length > 0) {
             issues.push({
               where: `${at} \xB7 node '${node.id}' (script) callable`,
-              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + `Run \`os migrate meta --from 16\` to rewrite it automatically.`,
+              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + // #6856 route D (maintainer-ruled): the house sentence names the TOOL's
+              // behaviour, never the retired key's fate — "rewrite it" reads two ways
+              // over a branch that DELETES the key (template/recipients/variables/script),
+              // "rewrite existing sources" only one. Plain-quoted (not a template literal)
+              // so this site is a member of `retired-key-migrate-sentence.test.ts`'s
+              // widened scan (#7030) on the same textual shape as the spec corpus — no
+              // interpolation lives in this clause, so nothing is lost switching quote style.
+              "Run `os migrate meta --from 16` to rewrite existing sources automatically.",
               source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
             });
           } else if (!fn) {
@@ -466,13 +505,27 @@ function validateStackExpressions(stack) {
     for (const [fname, f] of fieldList) {
       for (const key of ["requiredWhen", "readonlyWhen", "conditionalRequired", "visibleWhen"]) {
         check(`object '${objectName}' \xB7 field '${fname}' ${key}`, f[key], objectName, "record");
+        checkFieldRuleRoot(`object '${objectName}' \xB7 field '${fname}' ${key}`, key, f[key]);
       }
-      const roWhenSource = celSourceOf(f.readonlyWhen);
-      if (masters !== 1 && roWhenSource && readsParentRoot(roWhenSource)) {
+      for (const [oi, opt] of asArray(f.options).entries()) {
+        const label2 = typeof opt.value === "string" ? `'${opt.value}'` : `#${oi}`;
+        check(
+          `object '${objectName}' \xB7 field '${fname}' option ${label2} visibleWhen`,
+          opt.visibleWhen,
+          objectName,
+          "record"
+        );
+      }
+      for (const [slot, raw, consequence2] of [
+        ["readonlyWhen", f.readonlyWhen, `the field would be locked on every write`],
+        ["requiredWhen", f.requiredWhen, `the requirement would never be enforced \u2014 the predicate faults, the server logs and skips it, and the field stays optional in the database`]
+      ]) {
+        const source = celSourceOf(raw);
+        if (masters === 1 || !source || !readsParentRoot(source)) continue;
         issues.push({
-          where: `object '${objectName}' \xB7 field '${fname}' readonlyWhen`,
-          message: `\`readonlyWhen\` reads \`parent\`, but object '${objectName}' declares ${masters === 0 ? "no" : `${masters}`} \`master_detail\` relationship${masters === 1 ? "" : "s"} \u2014 so the server has no header record to bind as \`parent\` and the field would be locked on every write. ` + (masters === 0 ? `Declare the owning relationship as \`Field.masterDetail('<master>')\`, or rewrite the predicate against \`record\`.` : `\`parent\` needs exactly one master; name the header explicitly through \`record.<fk>\` state instead, or model the extra relationship as a \`lookup\`.`),
-          source: roWhenSource,
+          where: `object '${objectName}' \xB7 field '${fname}' ${slot}`,
+          message: `\`${slot}\` reads \`parent\`, but object '${objectName}' declares ${masters === 0 ? "no" : `${masters}`} \`master_detail\` relationship${masters === 1 ? "" : "s"} \u2014 so the server has no header record to bind as \`parent\` and ${consequence2}. ` + (masters === 0 ? `Declare the owning relationship as \`Field.masterDetail('<master>')\`, or rewrite the predicate against \`record\`.` : `\`parent\` needs exactly one master; name the header explicitly through \`record.<fk>\` state instead, or model the extra relationship as a \`lookup\`.`),
+          source,
           severity: "error"
         });
       }
@@ -1196,7 +1249,8 @@ function validateDashboardActionRefs(stack) {
 
 // src/validate-filter-tokens.ts
 var import_data3 = require("@objectstack/spec/data");
-var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
+
+// src/filter-walk.ts
 var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
 function asArray5(v) {
   if (Array.isArray(v)) return v;
@@ -1208,7 +1262,62 @@ function asArray5(v) {
 function label(v, fallback) {
   return typeof v === "string" && v.length > 0 ? v : fallback;
 }
+function scanForFilters(node, path, where, visit, seen = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object") return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, visit, seen));
+    return;
+  }
+  for (const [k, v] of Object.entries(node)) {
+    const childPath = `${path}.${k}`;
+    if (FILTER_KEYS.has(k)) {
+      visit({ value: v, path: childPath, where });
+      continue;
+    }
+    scanForFilters(v, childPath, where, visit, seen);
+  }
+}
+function walkAuthoredFilters(stack, surfaces, visit) {
+  if (!stack || typeof stack !== "object") return;
+  for (const { key, kind } of surfaces) {
+    const items = asArray5(stack[key]);
+    items.forEach((item, i) => {
+      const name = label(item.name ?? item.id, `#${i}`);
+      if (kind === "dashboard") {
+        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
+        widgets.forEach((w, wi) => {
+          const wName = label(w.id ?? w.title, `#${wi}`);
+          scanForFilters(
+            w,
+            `${key}[${i}].widgets[${wi}]`,
+            `dashboard "${name}" \xB7 widget "${wName}"`,
+            visit,
+            /* @__PURE__ */ new Set()
+          );
+        });
+        const { widgets: _skip, ...rest } = item;
+        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, visit, /* @__PURE__ */ new Set());
+        return;
+      }
+      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, visit, /* @__PURE__ */ new Set());
+    });
+  }
+}
+
+// src/validate-filter-tokens.ts
+var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
 var KNOWN_LIST = import_data3.CONTEXT_TOKENS.join("}, {");
+var TOKEN_FILTER_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" }
+];
 function walkFilterValues(node, path, where, out, seen) {
   if (node === null || node === void 0) return;
   if (typeof node === "string") {
@@ -1237,58 +1346,132 @@ function walkFilterValues(node, path, where, out, seen) {
     walkFilterValues(v, `${path}.${k}`, where, out, seen);
   }
 }
-function scanForFilters(node, path, where, out, seen) {
-  if (!node || typeof node !== "object") return;
-  if (seen.has(node)) return;
-  seen.add(node);
-  if (Array.isArray(node)) {
-    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, out, seen));
+function validateFilterTokens(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const out = [];
+  walkAuthoredFilters(stack, TOKEN_FILTER_SURFACES, ({ value, path, where }) => {
+    walkFilterValues(value, path, where, out, /* @__PURE__ */ new Set());
+  });
+  return out;
+}
+
+// src/validate-empty-combinators.ts
+var import_data4 = require("@objectstack/spec/data");
+var FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
+var FILTER_EMPTY_NODE = "filter-empty-node";
+var EMPTY_COMBINATOR_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" },
+  { key: "flows", kind: "flow" }
+];
+function isFilterNode(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+var VERDICT_OF = {
+  $and: (0, import_data4.reduceFilterVerdict)({ $and: [] }),
+  $or: (0, import_data4.reduceFilterVerdict)({ $or: [] }),
+  $not: (0, import_data4.reduceFilterVerdict)({ $not: {} }),
+  node: (0, import_data4.reduceFilterVerdict)({}),
+  /** One TRUE disjunct absorbs its `$or`: the sibling branches stop mattering. */
+  orWithEmptyBranch: (0, import_data4.reduceFilterVerdict)({ $or: [{ status: "open" }, {}] })
+};
+function rows(verdict) {
+  if (verdict === "true") return "matches EVERY row";
+  if (verdict === "false") return "matches NO row";
+  return "carries a real predicate";
+}
+var MATCH_NONE_SPELLING = "If you really do want a predicate that selects nothing, `{ <field>: { $in: [] } }` is the declared spelling for it (an empty `$in` list matches nothing, on every backend) \u2014 it says so where an empty combinator only implies it.";
+var OMIT_THE_KEY = 'To express "no filter", DELETE the key \u2014 an absent `filter` and a filter that reduces to TRUE run identically, and only the absent key says so to the next reader (and to the next AI author that copies this metadata).';
+function emitEmptyCombinator(key, path, ctx) {
+  const spelling = key === "$not" ? "`$not: {}`" : `\`${key}: []\``;
+  const message = key === "$and" ? `\`$and: []\` is a conjunction of ZERO conditions. Under the #5322 identity ruling it ${rows(VERDICT_OF.$and)} \u2014 the key is authored, and it constrains nothing, so this surface reads as filtered and is not.` : key === "$or" ? `\`$or: []\` is a disjunction of ZERO branches. Under the #5322 identity ruling it ${rows(VERDICT_OF.$or)}: this surface renders permanently empty, and on a read scope it hides every row (fail-closed by design \u2014 #5134).` : `\`$not: {}\` negates an EMPTY node. An empty node is TRUE and NOT TRUE is FALSE, so it ${rows(VERDICT_OF.$not)} \u2014 the opposite of the "no filter" an empty operand looks like.`;
+  const hint = key === "$and" ? `${OMIT_THE_KEY} To express a constraint, put the conditions in the array. ${MATCH_NONE_SPELLING}` : key === "$or" ? `If you meant "no filter", this is its OPPOSITE: emptying the array does not relax the filter, it closes it. ${OMIT_THE_KEY} If you meant to offer alternatives, put the branches in the array. ${MATCH_NONE_SPELLING}` : `Put the condition you are negating inside \`$not\` (\`{ $not: { status: 'closed' } }\`). ${OMIT_THE_KEY} ${MATCH_NONE_SPELLING}`;
+  ctx.out.push({
+    severity: "error",
+    rule: FILTER_EMPTY_COMBINATOR,
+    where: ctx.where,
+    path,
+    message: `${message} A literal ${spelling} is not an authoring surface (#5330).`,
+    hint: `${hint} A PROGRAMMATIC producer that loops to zero operands keeps the runtime identity unchanged \u2014 this rule judges only what is written in the metadata.`
+  });
+}
+function emitEmptyNode(position, path, ctx) {
+  if (position === "root") {
+    ctx.out.push({
+      severity: "error",
+      rule: FILTER_EMPTY_NODE,
+      where: ctx.where,
+      path,
+      message: `An EMPTY filter node (\`{}\`) is authored here. Under the #5322 identity ruling an empty node is TRUE \u2014 it ${rows(VERDICT_OF.node)}, exactly as if the key were absent \u2014 so a filter is declared and enforces nothing.`,
+      hint: `${OMIT_THE_KEY} If you meant to constrain something, write the condition into the node. ${MATCH_NONE_SPELLING}`
+    });
     return;
   }
-  for (const [k, v] of Object.entries(node)) {
-    const childPath = `${path}.${k}`;
-    if (FILTER_KEYS.has(k)) {
-      walkFilterValues(v, childPath, where, out, /* @__PURE__ */ new Set());
+  if (position === "or-branch") {
+    ctx.out.push({
+      severity: "error",
+      rule: FILTER_EMPTY_NODE,
+      where: ctx.where,
+      path,
+      message: `An EMPTY branch (\`{}\`) of a \`$or\`. An empty node is TRUE, and one TRUE disjunct ABSORBS the whole disjunction (\`{ $or: [{ status: 'open' }, {}] }\` ${rows(VERDICT_OF.orWithEmptyBranch)}), so every branch you wrote beside it is dead.`,
+      hint: "Delete the empty branch \u2014 the `$or` then means what it looks like. If it was meant to carry a condition, write it. (A compiler that DROPPED the empty branch instead would silently NARROW the scope to the surviving branches, which is why the runtime absorbs rather than filters \u2014 #5297.)"
+    });
+    return;
+  }
+  ctx.out.push({
+    severity: "error",
+    rule: FILTER_EMPTY_NODE,
+    where: ctx.where,
+    path,
+    message: "An EMPTY branch (`{}`) of a `$and`. An empty node is TRUE \u2014 the AND identity \u2014 so the branch contributes no condition and the conjunction means whatever its other branches mean.",
+    hint: "Delete the empty branch, or write the condition it was meant to carry. A branch that constrains nothing is indistinguishable from one whose condition was lost in an edit."
+  });
+}
+function scanNodeKeys(node, path, ctx) {
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "$and" || key === "$or") {
+      if (!Array.isArray(value)) continue;
+      if (value.length === 0) {
+        emitEmptyCombinator(key, `${path}.${key}`, ctx);
+        continue;
+      }
+      value.forEach((element, index) => {
+        scanBranch(element, `${path}.${key}[${index}]`, key === "$and" ? "and-branch" : "or-branch", ctx);
+      });
+      continue;
+    }
+    if (key === "$not") {
+      if (!isFilterNode(value)) continue;
+      if (Object.keys(value).length === 0) {
+        emitEmptyCombinator("$not", `${path}.$not`, ctx);
+        continue;
+      }
+      scanNodeKeys(value, `${path}.$not`, ctx);
       continue;
     }
-    scanForFilters(v, childPath, where, out, seen);
   }
 }
-function validateFilterTokens(stack) {
+function scanBranch(value, path, position, ctx) {
+  if (!isFilterNode(value)) return;
+  if (Object.keys(value).length === 0) {
+    emitEmptyNode(position, path, ctx);
+    return;
+  }
+  scanNodeKeys(value, path, ctx);
+}
+function validateEmptyCombinators(stack) {
   if (!stack || typeof stack !== "object") return [];
   const out = [];
-  const surfaces = [
-    ["dashboards", "dashboard"],
-    ["objects", "object"],
-    ["views", "view"],
-    ["reports", "report"],
-    ["datasets", "dataset"],
-    ["pages", "page"],
-    ["apps", "app"]
-  ];
-  for (const [key, kind] of surfaces) {
-    const items = asArray5(stack[key]);
-    items.forEach((item, i) => {
-      const name = label(item.name ?? item.id, `#${i}`);
-      if (kind === "dashboard") {
-        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
-        widgets.forEach((w, wi) => {
-          const wName = label(w.id ?? w.title, `#${wi}`);
-          scanForFilters(
-            w,
-            `${key}[${i}].widgets[${wi}]`,
-            `dashboard "${name}" \xB7 widget "${wName}"`,
-            out,
-            /* @__PURE__ */ new Set()
-          );
-        });
-        const { widgets: _skip, ...rest } = item;
-        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, out, /* @__PURE__ */ new Set());
-        return;
-      }
-      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, out, /* @__PURE__ */ new Set());
-    });
-  }
+  walkAuthoredFilters(stack, EMPTY_COMBINATOR_SURFACES, ({ value, path, where }) => {
+    scanBranch(value, path, "root", { where, out });
+  });
   return out;
 }
 
@@ -1482,7 +1665,7 @@ function validateObjectReferences(stack) {
 }
 
 // src/validate-searchable-fields.ts
-var import_data4 = require("@objectstack/spec/data");
+var import_data5 = require("@objectstack/spec/data");
 var SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
 var SEARCHABLE_FIELD_UNSEARCHABLE = "searchable-field-unsearchable";
 function asArray7(v) {
@@ -1530,7 +1713,7 @@ function resolveAllowedSet(target) {
     fields = { ...fields };
     for (const f of systemDeclared) fields[f] = {};
   }
-  const { allowed, source } = (0, import_data4.resolveSearchFieldResolution)({
+  const { allowed, source } = (0, import_data5.resolveSearchFieldResolution)({
     fields,
     searchableFields: target.searchableFields,
     displayField: target.displayField
@@ -1596,7 +1779,19 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
         where,
         path: `${path}[${i}]`,
         message: `${subject} entry "${name}" is not a field on object "${objectName}". The declaration is stale: searching it can never match, and the engine silently drops it \u2014 leaving a narrower search than declared, or the auto-default set once every entry is dropped.` + (dotted ? "" : suggest3(name, known)),
-        hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a formula field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+        hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a stored text field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+      });
+      continue;
+    }
+    if ((0, import_data5.isVirtualSearchField)(target.fields[name])) {
+      const vtype = target.fields[name]?.type;
+      findings.push({
+        severity: "error",
+        rule: SEARCHABLE_FIELD_UNSEARCHABLE,
+        where,
+        path: `${path}[${i}]`,
+        message: `${subject} entry "${name}" on object "${objectName}" is a virtual '${vtype}' field: its value is computed on read and never stored, so no driver materializes a column for 'search' to scan and the entry can never match. It reads as search coverage and delivers none \u2014 the runtime used to admit it verbatim because the declaration named it (#6674).`,
+        hint: `Mirror the computed value onto a stored text field on "${objectName}" and declare that instead, or drop "${name}". At runtime the ingress gate now refuses this entry with 400 INVALID_FIELD, the same answer a stale entry gets (#4254).`
       });
       continue;
     }
@@ -1616,7 +1811,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
     }
     const isReference = meta?.type === "lookup" || meta?.type === "master_detail";
     let why;
-    if (import_data4.SEARCH_AUTO_EXCLUDED_FIELDS.has(name)) {
+    if (import_data5.SEARCH_AUTO_EXCLUDED_FIELDS.has(name)) {
       why = "a system/audit column, which the auto-default set never includes";
     } else if (meta?.hidden) {
       why = "hidden";
@@ -1630,8 +1825,8 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       rule: SEARCHABLE_FIELD_UNSEARCHABLE,
       where,
       path: `${path}[${i}]`,
-      message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...import_data4.SEARCHABLE_TEXTUAL_TYPES, ...import_data4.SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
-      hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a text/formula field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
+      message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...import_data5.SEARCHABLE_TEXTUAL_TYPES, ...import_data5.SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
+      hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a stored text field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
     });
   }
   return findings;
@@ -1950,6 +2145,15 @@ function validateActionNameRefs(stack) {
             "Navigation action item"
           );
         }
+        const runAction = strName5(nav.runAction);
+        if (nav.type === "object" && runAction) {
+          check(
+            runAction,
+            `app "${appName}" \xB7 nav "${strName5(nav.id) ?? `#${ni}`}"`,
+            `${navPath}.runAction`,
+            "Navigation deep-link auto-run"
+          );
+        }
         if (Array.isArray(nav.children)) walkNav(nav.children, `${navPath}.children`);
       }
     };
@@ -2015,8 +2219,21 @@ var COMPONENT_FIELD_SPECS = {
   "element:number": { props: ["field"] },
   "element:filter": { props: ["fields"] },
   "element:form": { props: ["fields"] },
-  // The schema says `displayField`; real pages author `labelField`. Accept both.
-  "element:record_picker": { props: ["displayField", "labelField", "searchFields"] }
+  // `labelField` is the one field-bearing prop this element declares. Its former
+  // companions `displayField` (renamed to `labelField`, ADR-0087 D2) and
+  // `searchFields` (deleted, ADR-0049) were retired in #5775 and are
+  // `retiredKey()` tombstones on `ElementRecordPickerPropsSchema` — so no
+  // spec-conformant page carries either, and this rule's job (resolve a field
+  // NAME against the object) is not the question a retired key raises (#6629).
+  //
+  // A non-conformant page that writes one anyway is not left unattended: the
+  // #5068 props gate reports the key with its rename/delete prescription. That
+  // gate is advisory and CLI-only and lives in a different registry
+  // (`authoring-rules`) from this suite, so it neither precedes nor suppresses
+  // this rule — what these two entries actually added was a SECOND finding,
+  // saying a field named by a key that no longer exists does not exist either.
+  // The prescription is the useful half; this half was noise on top of it.
+  "element:record_picker": { props: ["labelField"] }
 };
 var RELATED_LIST_TYPE = "record:related_list";
 function componentFieldRefs(type, props, basePath, sep = ".") {
@@ -2585,18 +2802,57 @@ function validateNavTargetRefs(stack) {
 }
 
 // src/validate-translation-references.ts
+var import_spec = require("@objectstack/spec");
 var import_system4 = require("@objectstack/spec/system");
+
+// src/view-walk.ts
+function isRec7(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName10(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function viewObjectName(view) {
+  return strName10(view.objectName) ?? strName10(view.object) ?? (isRec7(view.data) ? strName10(view.data.object) : void 0);
+}
+function viewContainerSites(view, basePath) {
+  if (!isRec7(view)) return [];
+  const sites = [{ view, path: basePath, surface: "", kind: "self" }];
+  if (isRec7(view.form)) {
+    sites.push({ view: view.form, path: `${basePath}.form`, surface: "form", kind: "form" });
+  }
+  for (const key of ["listViews", "formViews"]) {
+    const container = view[key];
+    if (!isRec7(container)) continue;
+    const kind = key === "listViews" ? "listView" : "formView";
+    for (const [subKey, sub] of Object.entries(container)) {
+      if (!isRec7(sub)) continue;
+      sites.push({
+        view: sub,
+        path: `${basePath}.${key}.${subKey}`,
+        surface: `${key}.${subKey}`,
+        kind
+      });
+    }
+  }
+  return sites;
+}
+function formViewSites(view, basePath) {
+  return viewContainerSites(view, basePath).filter((site) => site.kind !== "listView");
+}
+
+// src/validate-translation-references.ts
 var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec7(v) {
+function isRec8(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function asArray14(v) {
   if (Array.isArray(v)) return v;
-  if (isRec7(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec7(def) ? def : {} }));
+  if (isRec8(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec8(def) ? def : {} }));
   return [];
 }
-function strName10(v) {
+function strName11(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance5(a, b) {
@@ -2657,29 +2913,51 @@ function collectViewRecord(view, factsFor) {
   const addSections = (container, binding) => {
     if (!binding) return;
     for (const section of asArray14(container.sections)) {
-      const sectionName = strName10(section.name);
+      const sectionName = strName11(section.name);
       if (sectionName) factsFor(binding).sections.add(sectionName);
     }
   };
-  const listBinding = isRec7(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec7(view.list)) addView(listBinding, strName10(view.list.name));
-  addView(recordObject ?? listBinding, strName10(view.name));
-  for (const key of ["listViews", "formViews"]) {
-    const container = view[key];
-    if (!isRec7(container)) continue;
-    for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec7(sub)) continue;
+  const listBinding = isRec8(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec8(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
+  addView(recordObject ?? listBinding, strName11(view.name));
+  const named = namedViewKeys(view);
+  for (const family of ["listViews", "formViews"]) {
+    const container = view[family];
+    if (!isRec8(container)) continue;
+    const registryKeys = family === "listViews" ? named.list : named.form;
+    let at = 0;
+    for (const sub of Object.values(container)) {
+      if (!sub || typeof sub !== "object") continue;
+      const registryKey = registryKeys[at++];
+      if (!isRec8(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
-      addView(binding, subKey);
-      addView(binding, strName10(sub.name));
+      addView(binding, registryKey);
       addSections(sub, binding);
     }
   }
-  if (isRec7(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  if (isRec8(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
   addSections(view, recordObject ?? listBinding);
 }
-function viewObjectName(view) {
-  return strName10(view.objectName) ?? strName10(view.object) ?? (isRec7(view.data) ? strName10(view.data.object) : void 0);
+function defaultListViewKey(object, container) {
+  if (!object || !isRec8(container.list)) return void 0;
+  const item = (0, import_spec.expandViewContainer)(object, container).find(
+    (i) => i.viewKind === "list" && i.isDefault
+  );
+  if (!item) return void 0;
+  const prefix = `${object}.`;
+  return item.name.startsWith(prefix) ? item.name.slice(prefix.length) : item.name;
+}
+function namedViewKeys(container) {
+  const object = "probe";
+  const prefix = `${object}.`;
+  const bare = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : name;
+  const countEntries = (v) => isRec8(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
+  const listCount = countEntries(container.listViews);
+  const formCount = countEntries(container.formViews);
+  if (!listCount && !formCount) return { list: [], form: [] };
+  const items = (0, import_spec.expandViewContainer)(object, container);
+  const keysOf2 = (kind, count) => items.filter((i) => i.viewKind === kind).slice(0, count).map((i) => bare(i.name));
+  return { list: keysOf2("list", listCount), form: keysOf2("form", formCount) };
 }
 function readOptions(field) {
   const raw = field.options;
@@ -2691,14 +2969,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec7(opt)) continue;
-      const value = strName10(opt.value);
+      if (!isRec8(opt)) continue;
+      const value = strName11(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName10(opt.label);
+      const label2 = strName11(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec7(raw)) {
+  } else if (isRec8(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -2719,23 +2997,23 @@ function buildUniverse(stack) {
     return facts;
   };
   for (const obj of asArray14(stack.objects)) {
-    const objectName = strName10(obj.name);
+    const objectName = strName11(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
     for (const field of asArray14(obj.fields)) {
-      const fieldName = strName10(field.name);
+      const fieldName = strName11(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
     for (const action of asArray14(obj.actions)) {
-      const actionName = strName10(action.name);
+      const actionName = strName11(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
     for (const view of asArray14(obj.views)) {
-      collectViewRecord({ ...view, object: strName10(view.object) ?? objectName }, factsFor);
+      collectViewRecord({ ...view, object: strName11(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
     for (const group of asArray14(obj.fieldGroups)) {
-      const key = strName10(group.key) ?? strName10(group.name);
+      const key = strName11(group.key) ?? strName11(group.name);
       if (key) facts.sections.add(key);
     }
   }
@@ -2746,10 +3024,10 @@ function buildUniverse(stack) {
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec7(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec8(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
       for (const section of asArray14(props.sections)) {
-        const sectionName = strName10(section.name);
+        const sectionName = strName11(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
@@ -2757,9 +3035,9 @@ function buildUniverse(stack) {
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
   for (const action of asArray14(stack.actions)) {
-    const actionName = strName10(action.name);
+    const actionName = strName11(action.name);
     if (!actionName) continue;
-    const owner = strName10(action.objectName) ?? strName10(action.object);
+    const owner = strName11(action.objectName) ?? strName11(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -2774,19 +3052,19 @@ function buildUniverse(stack) {
   }
   const apps = /* @__PURE__ */ new Map();
   for (const app of asArray14(stack.apps)) {
-    const appName = strName10(app.name);
+    const appName = strName11(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
       for (const item of asArray14(items)) {
-        const id = strName10(item.id);
+        const id = strName11(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
     for (const area of asArray14(app.areas)) {
-      const areaId = strName10(area.id);
+      const areaId = strName11(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
@@ -2794,20 +3072,20 @@ function buildUniverse(stack) {
   }
   const dashboards = /* @__PURE__ */ new Map();
   for (const dash of asArray14(stack.dashboards)) {
-    const dashName = strName10(dash.name);
+    const dashName = strName11(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
     for (const widget of asArray14(dash.widgets)) {
-      const id = strName10(widget.id) ?? strName10(widget.name);
+      const id = strName11(widget.id) ?? strName11(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray14(isRec7(dash.header) ? dash.header.actions : void 0),
+      ...asArray14(isRec8(dash.header) ? dash.header.actions : void 0),
       ...asArray14(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName10(action.actionUrl) ?? strName10(action.url) ?? strName10(action.name);
+      const key = strName11(action.actionUrl) ?? strName11(action.url) ?? strName11(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -2819,7 +3097,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec7(stack)) return findings;
+  if (!isRec8(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -2828,13 +3106,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec7(bundle)) continue;
+    if (!isRec8(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec7(rawData)) continue;
+      if (!isRec8(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec7(rawNode)) continue;
+        if (!isRec8(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -2860,7 +3138,7 @@ function validateTranslationReferences(stack) {
             );
             continue;
           }
-          if (!isRec7(rawField)) continue;
+          if (!isRec8(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -2942,7 +3220,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec7(rawApp)) continue;
+        if (!isRec8(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
@@ -2965,7 +3243,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec7(rawDash)) continue;
+        if (!isRec8(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
@@ -2990,7 +3268,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec7(v) ? v : {};
+  return isRec8(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -3002,7 +3280,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName10(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName11(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -3021,11 +3299,11 @@ function checkOptionKeys(findings, ctx) {
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec7(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec8(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
   for (const param of asArray14(ctx.action.params)) {
-    const name = strName10(param.name) ?? strName10(param.field);
+    const name = strName11(param.name) ?? strName11(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -3041,78 +3319,60 @@ function checkActionParams(findings, ctx) {
   }
 }
 
-// src/validate-translatable-sections.ts
-var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
-function isRec8(v) {
+// src/collection-entries.ts
+function isRec9(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName11(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function viewObjectName2(view) {
-  return strName11(view.objectName) ?? strName11(view.object) ?? (isRec8(view.data) ? strName11(view.data.object) : void 0);
-}
 function collectionEntries(v, base) {
   if (Array.isArray(v)) {
     const out = [];
     for (let i = 0; i < v.length; i++) {
-      if (isRec8(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
+      if (isRec9(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
     }
     return out;
   }
-  if (isRec8(v)) {
-    return Object.entries(v).filter(([, def]) => isRec8(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
+  if (isRec9(v)) {
+    return Object.entries(v).filter(([, def]) => isRec9(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
   }
   return [];
 }
+
+// src/validate-translatable-sections.ts
+var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
+function isRec10(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName12(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
 function viewLabel(view) {
-  const name = strName11(view.name);
+  const name = strName12(view.name);
   return name ? `view "${name}"` : "";
 }
 function joinWhere(...parts) {
   return parts.filter((p) => p.length > 0).join(" \xB7 ");
 }
 function collectViewSites(view, basePath, label2, sites) {
-  const recordObject = viewObjectName2(view);
-  const listBinding = isRec8(view.list) ? viewObjectName2(view.list) ?? recordObject : void 0;
-  const bindingOf = (container) => viewObjectName2(container) ?? recordObject;
-  sites.push({
-    path: `${basePath}.sections`,
-    surface: label2,
-    objectName: recordObject ?? listBinding,
-    sections: view.sections
-  });
-  if (isRec8(view.form)) {
+  const recordObject = viewObjectName(view);
+  const listBinding = isRec10(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
+  for (const site of viewContainerSites(view, basePath)) {
     sites.push({
-      path: `${basePath}.form.sections`,
-      surface: joinWhere(label2, "form"),
-      objectName: bindingOf(view.form) ?? listBinding,
-      sections: view.form.sections
+      path: `${site.path}.sections`,
+      surface: joinWhere(label2, site.surface),
+      objectName: viewObjectName(site.view) ?? recordObject ?? listBinding,
+      sections: site.view.sections
     });
   }
-  for (const key of ["listViews", "formViews"]) {
-    const container = view[key];
-    if (!isRec8(container)) continue;
-    for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec8(sub)) continue;
-      sites.push({
-        path: `${basePath}.${key}.${subKey}.sections`,
-        surface: joinWhere(label2, `${key}.${subKey}`),
-        objectName: bindingOf(sub) ?? listBinding,
-        sections: sub.sections
-      });
-    }
-  }
 }
 function translatedObjectNames(stack) {
   const out = /* @__PURE__ */ new Set();
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   for (const bundle of bundles) {
-    if (!isRec8(bundle)) continue;
+    if (!isRec10(bundle)) continue;
     for (const data of Object.values(bundle)) {
-      if (!isRec8(data) || !isRec8(data.objects)) continue;
+      if (!isRec10(data) || !isRec10(data.objects)) continue;
       for (const [objectName, node] of Object.entries(data.objects)) {
-        if (isRec8(node)) out.add(objectName);
+        if (isRec10(node)) out.add(objectName);
       }
     }
   }
@@ -3124,22 +3384,22 @@ function suggestedName(label2) {
 }
 function validateTranslatableSections(stack) {
   const findings = [];
-  if (!isRec8(stack)) return findings;
+  if (!isRec10(stack)) return findings;
   const translated = translatedObjectNames(stack);
   if (translated.size === 0) return findings;
   const sites = [];
   for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
-    const objectName = strName11(obj.name);
+    const objectName = strName12(obj.name);
     if (!objectName) continue;
     for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
       collectViewSites(
-        { ...view, object: strName11(view.object) ?? objectName },
+        { ...view, object: strName12(view.object) ?? objectName },
         path,
         viewLabel(view),
         sites
       );
     }
-    if (isRec8(obj.listViews)) {
+    if (isRec10(obj.listViews)) {
       collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
     }
   }
@@ -3147,13 +3407,13 @@ function validateTranslatableSections(stack) {
     collectViewSites(view, path, viewLabel(view), sites);
   }
   for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
-    const pageName = strName11(page.name);
+    const pageName = strName12(page.name);
     const pageLabel = pageName ? `page "${pageName}"` : "";
     for (const walked of walkPageComponents(page, pagePath)) {
       if (!walked.objectName) continue;
-      const props = isRec8(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec10(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      const type = strName11(walked.component.type) ?? "component";
+      const type = strName12(walked.component.type) ?? "component";
       sites.push({
         path: `${walked.path}.properties.sections`,
         surface: joinWhere(pageLabel, type),
@@ -3168,9 +3428,9 @@ function validateTranslatableSections(stack) {
     if (!Array.isArray(site.sections)) continue;
     for (let i = 0; i < site.sections.length; i++) {
       const section = site.sections[i];
-      if (!isRec8(section)) continue;
-      if (strName11(section.name)) continue;
-      const heading = strName11(section.label) ?? strName11(section.title);
+      if (!isRec10(section)) continue;
+      if (strName12(section.name)) continue;
+      const heading = strName12(section.label);
       if (!heading) continue;
       const slug = suggestedName(heading);
       findings.push({
@@ -3188,10 +3448,10 @@ function validateTranslatableSections(stack) {
 
 // src/flow-walk.ts
 var import_automation2 = require("@objectstack/spec/automation");
-function isRec9(v) {
+function isRec11(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName12(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var REGION_SLOTS = new Map(
@@ -3200,10 +3460,10 @@ var REGION_SLOTS = new Map(
 var REGION_CONFIG_KEYS = import_automation2.FLOW_REGION_CONFIG_KEYS;
 var MAX_REGION_DEPTH = 16;
 function flowNodeLabel(node, index) {
-  return strName12(node.label) ?? strName12(node.id) ?? `#${index}`;
+  return strName13(node.label) ?? strName13(node.id) ?? `#${index}`;
 }
 function stripRegions(config) {
-  if (!isRec9(config)) return void 0;
+  if (!isRec11(config)) return void 0;
   let out;
   for (const key of Object.keys(config)) {
     if (!REGION_CONFIG_KEYS.has(key)) continue;
@@ -3214,11 +3474,11 @@ function stripRegions(config) {
 }
 function walkFlowNodes(flow, flowPath) {
   const out = [];
-  if (!isRec9(flow)) return out;
+  if (!isRec11(flow)) return out;
   const visitList = (nodes, basePath, trail, depth) => {
     if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
     nodes.forEach((raw, index) => {
-      if (!isRec9(raw)) return;
+      if (!isRec11(raw)) return;
       const path = `${basePath}[${index}]`;
       out.push({
         node: raw,
@@ -3227,9 +3487,9 @@ function walkFlowNodes(flow, flowPath) {
         regionTrail: trail,
         depth
       });
-      const type = strName12(raw.type);
+      const type = strName13(raw.type);
       const slots = type ? REGION_SLOTS.get(type) : void 0;
-      if (!slots || !isRec9(raw.config)) return;
+      if (!slots || !isRec11(raw.config)) return;
       const config = raw.config;
       const here = `${type} "${flowNodeLabel(raw, index)}"`;
       for (const slot of slots) {
@@ -3237,8 +3497,8 @@ function walkFlowNodes(flow, flowPath) {
         if (slot === "branches") {
           if (!Array.isArray(value)) continue;
           value.forEach((branch, b) => {
-            if (!isRec9(branch)) return;
-            const branchName = strName12(branch.name) ?? `#${b}`;
+            if (!isRec11(branch)) return;
+            const branchName = strName13(branch.name) ?? `#${b}`;
             visitList(
               branch.nodes,
               `${path}.config.branches[${b}].nodes`,
@@ -3248,7 +3508,7 @@ function walkFlowNodes(flow, flowPath) {
           });
           continue;
         }
-        if (!isRec9(value)) continue;
+        if (!isRec11(value)) continue;
         visitList(
           value.nodes,
           `${path}.config.${slot}.nodes`,
@@ -3473,7 +3733,7 @@ function asArray16(v) {
   }
   return [];
 }
-function strName13(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -3484,17 +3744,17 @@ function validateAiSurfaceAffinity(stack) {
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
   for (const skill of asArray16(stack.skills)) {
-    const n = strName13(skill.name);
+    const n = strName14(skill.name);
     if (n) skillsByName.set(n, skill);
   }
   const agents = asArray16(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName13(agent.name) ?? `#${ai}`;
+    const agentName = strName14(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName13(skillRefs[si]);
+      const ref = strName14(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -3523,7 +3783,7 @@ function asArray17(v) {
   }
   return [];
 }
-function strName14(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance6(a, b) {
@@ -3564,8 +3824,8 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName14(aiRec.description)) return false;
-  const type = strName14(action.type);
+  if (!strName15(aiRec.description)) return false;
+  const type = strName15(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
@@ -3573,12 +3833,12 @@ function materialisesAsTool(action) {
 function collectToolUniverse(stack) {
   const universe = new Set(import_system5.PLATFORM_PROVIDED_TOOL_NAMES);
   for (const tool of asArray17(stack.tools)) {
-    const n = strName14(tool.name);
+    const n = strName15(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
     for (const action of asArray17(actions)) {
-      const n = strName14(action.name);
+      const n = strName15(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
@@ -3592,7 +3852,7 @@ function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
     for (const action of asArray17(actions)) {
-      const n = strName14(action.name);
+      const n = strName15(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
@@ -3618,10 +3878,10 @@ function validateAiToolReferences(stack) {
   const skills = asArray17(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName14(skill.name) ?? `#${si}`;
+    const skillName = strName15(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName14(refs[ti]);
+      const ref = strName15(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -3640,6 +3900,7 @@ function validateAiToolReferences(stack) {
 
 // src/validate-ai-agent-authoring.ts
 var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
+var DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
 function asArray18(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
@@ -3647,7 +3908,7 @@ function asArray18(v) {
   }
   return [];
 }
-function strName15(v) {
+function strName16(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
@@ -3657,7 +3918,7 @@ function validateAiAgentAuthoring(stack) {
   const agents = asArray18(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName15(agent.name) ?? `#${ai}`;
+    const name = strName16(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -3669,6 +3930,22 @@ function validateAiAgentAuthoring(stack) {
       hint: isPlatformName ? `Remove the declaration; the platform owns "${name}". Extend it with skills instead.` : `Delete the agent and express its capability as skills. Everything an agent carried that a skill does not is persona text: move the useful parts of \`instructions\` into the skills' own instructions.` + (skillCount > 0 ? ` The ${skillCount} skill${skillCount === 1 ? "" : "s"} this agent references already carry the capability \u2014 they attach to the platform agent by \`surface\` affinity, so nothing is lost by dropping the persona.` : ``)
     });
   }
+  const roster = [...PLATFORM_AGENT_NAMES].join(", ");
+  const apps = asArray18(stack.apps);
+  for (let appIdx = 0; appIdx < apps.length; appIdx++) {
+    const app = apps[appIdx];
+    const defaultAgent = strName16(app.defaultAgent);
+    if (!defaultAgent || PLATFORM_AGENT_NAMES.has(defaultAgent)) continue;
+    const appName = strName16(app.name) ?? `#${appIdx}`;
+    findings.push({
+      severity: "warning",
+      rule: DEFAULT_AGENT_OUTSIDE_ROSTER,
+      where: `app "${appName}".defaultAgent`,
+      path: `apps[${appIdx}].defaultAgent`,
+      message: `app "${appName}" pins \`defaultAgent\` to "${defaultAgent}", which is not in the platform agent roster (${roster}). The kernel ships exactly two agents (ADR-0063 \xA72) and resolves this key against them and their legacy aliases only \u2014 an unrecognized name is not rejected, it silently falls back to the platform default at runtime, so the pin has no effect and the value drifts from what actually serves the app.`,
+      hint: `Set \`defaultAgent\` to one of the platform agent names: ${roster}. If the goal is a dedicated persona or capability, express it as skills instead \u2014 they attach to "ask" / "build" by surface affinity, not as a custom \`defaultAgent\` value.`
+    });
+  }
   return findings;
 }
 
@@ -3756,13 +4033,13 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec10 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray19(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec10(x));
-  if (isRec10(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec12(x));
+  if (isRec12(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec10(def) ? def : {}
+      ...isRec12(def) ? def : {}
     }));
   }
   return [];
@@ -3908,7 +4185,7 @@ function validateHookBodyWrites(stack) {
   let objectFields = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec10(body) || body.language !== "js") return;
+    if (!isRec12(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
@@ -3979,13 +4256,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec11 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec13 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray20(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec11(x));
-  if (isRec11(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec13(x));
+  if (isRec13(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec11(def) ? def : {}
+      ...isRec13(def) ? def : {}
     }));
   }
   return [];
@@ -4003,7 +4280,7 @@ function collectActionBodies(stack) {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec11(body) || body.language !== "js") return;
+      if (!isRec13(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -4022,7 +4299,7 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec11(stack)) return findings;
+  if (!isRec13(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
@@ -4080,13 +4357,13 @@ function fixHint2(field, declared) {
 var import_shared3 = require("@objectstack/spec/shared");
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
-var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray21(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec12(x));
-  if (isRec12(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec14(x));
+  if (isRec14(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec12(def) ? def : {}
+      ...isRec14(def) ? def : {}
     }));
   }
   return [];
@@ -4099,7 +4376,7 @@ function readLiteralObjectName(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec12(stack)) return findings;
+  if (!isRec14(stack)) return findings;
   const flows = asArray21(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
@@ -4108,10 +4385,10 @@ function validateFlowNodeWrites(stack) {
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec12(node.config) ? node.config : void 0;
+      const config = isRec14(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec12(fields)) return;
+      if (!isRec14(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName(config);
@@ -4236,14 +4513,14 @@ function validateReadonlyFlowWrites(stack) {
 // src/validate-react-page-props.ts
 var import_node_module2 = require("module");
 var import_ui2 = require("@objectstack/spec/ui");
-var import_data5 = require("@objectstack/spec/data");
+var import_data6 = require("@objectstack/spec/data");
 
 // src/zod-issue-format.ts
-var isRec13 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var valueAtPath = (root, path) => {
   let cur = root;
   for (const key of path) {
-    if (!isRec13(cur) && !Array.isArray(cur)) return void 0;
+    if (!isRec15(cur) && !Array.isArray(cur)) return void 0;
     cur = cur[key];
   }
   return cur;
@@ -4382,7 +4659,7 @@ var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 var REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 function checkChartDrillDown(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec14(raw)) {
+  if (!isRec16(raw)) {
     push2(
       "error",
       REACT_CHART_DRILLDOWN_INVALID,
@@ -4405,7 +4682,7 @@ function checkChartDrillDown(raw, push2) {
 }
 function checkChartAggregate(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec14(raw)) {
+  if (!isRec16(raw)) {
     push2(
       "error",
       REACT_CHART_AGGREGATE_INVALID,
@@ -4420,7 +4697,7 @@ function checkChartAggregate(raw, push2) {
       "warning",
       REACT_CHART_AGGREGATE_INVALID,
       "aggregate.groupBy is not set, so the aggregate returns ONE ungrouped row and the chart plots a single point.",
-      "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. Deliberate single-value charts are tolerated at warning level for now: ChartAggregateSchema declares groupBy required while ObjectChart honours its absence by falling back to xAxisKey \u2014 objectstack#5583 decides which of the two moves."
+      "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. objectstack#5583 ruled that an ungrouped single-value chart is NOT a supported <ObjectChart> shape \u2014 groupBy stays required, and a single number belongs in an object-metric block instead. This stays a warning rather than an error only because promoting it is its own step."
     );
   }
   const parsed = import_ui2.ChartAggregateSchema.safeParse(raw);
@@ -4436,7 +4713,7 @@ function checkChartAggregate(raw, push2) {
     );
   }
 }
-var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
 function checkObjectChart(attrs, objectFields, findings) {
   const { values, where, path } = attrs;
@@ -4446,11 +4723,11 @@ function checkObjectChart(attrs, objectFields, findings) {
   const aggregate = values.get("aggregate");
   checkChartAggregate(aggregate, push2);
   if (aggregate === void 0 || aggregate === NOT_STATIC) return;
-  if (!isRec14(aggregate)) return;
+  if (!isRec16(aggregate)) return;
   const fn = strOf(aggregate.function);
   const field = strOf(aggregate.field);
   const groupBy = aggregate.groupBy;
-  const groupByField = strOf(groupBy) ?? (isRec14(groupBy) ? strOf(groupBy.field) : void 0);
+  const groupByField = strOf(groupBy) ?? (isRec16(groupBy) ? strOf(groupBy.field) : void 0);
   const objectName = strOf(values.get("objectName"));
   const known = objectName ? objectFields.get(objectName) : void 0;
   if (objectName && known) {
@@ -4483,18 +4760,18 @@ function checkObjectChart(attrs, objectFields, findings) {
     );
   };
   const xAxisRaw = values.get("xAxis");
-  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec14(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec16(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
   const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
   axisRef(categoryAxis, categoryProp);
   const yAxisRaw = values.get("yAxis");
   const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
   for (const a of yAxisList) {
-    axisRef(strOf(a) ?? (isRec14(a) ? strOf(a.field) : void 0), "yAxis[].field");
+    axisRef(strOf(a) ?? (isRec16(a) ? strOf(a.field) : void 0), "yAxis[].field");
   }
   const series = values.get("series");
   if (Array.isArray(series)) {
     for (const s of series) {
-      if (!isRec14(s)) continue;
+      if (!isRec16(s)) continue;
       const dataKey = strOf(s.dataKey);
       axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
     }
@@ -4550,7 +4827,7 @@ function subformFieldRefs(value, basePath) {
   if (!Array.isArray(value)) return { child, parent };
   for (let i = 0; i < value.length; i++) {
     const sub = value[i];
-    if (!isRec14(sub)) continue;
+    if (!isRec16(sub)) continue;
     const at = (key) => `${basePath}[${i}].${key}`;
     child.push({
       objectName: strOf(sub.childObject),
@@ -4575,7 +4852,7 @@ function filterFieldRefs(node, basePath, out) {
     for (let i = 0; i < node.length; i++) filterFieldRefs(node[i], `${basePath}[${i}]`, out);
     return;
   }
-  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data5.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
+  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data6.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
     out.push({ name: head, path: `${basePath}[0]` });
   }
 }
@@ -4595,20 +4872,20 @@ function reactFieldRefs(spec, values, basePath) {
   }
   for (const key of spec.nestedFields ?? []) {
     const v = readable(key);
-    if (isRec14(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+    if (isRec16(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
   }
   for (const key of spec.sections ?? []) {
     const v = readable(key);
     if (!Array.isArray(v)) continue;
     for (let i = 0; i < v.length; i++) {
       const section = v[i];
-      if (!isRec14(section)) continue;
+      if (!isRec16(section)) continue;
       own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
     }
   }
   for (const key of spec.keyedByField ?? []) {
     const v = readable(key);
-    if (!isRec14(v)) continue;
+    if (!isRec16(v)) continue;
     for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
   }
   for (const key of spec.filterArrays ?? []) {
@@ -4892,13 +5169,13 @@ function validateReferenceIntegrity(stack) {
 
 // src/validate-component-props.ts
 var import_ui3 = require("@objectstack/spec/ui");
-var import_spec = require("@objectstack/spec");
+var import_spec2 = require("@objectstack/spec");
 var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
 var COMPONENT_PROPS_INVALID = "component-props-invalid";
-function isRec15(v) {
+function isRec17(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName16(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function asArray24(v) {
@@ -4912,27 +5189,27 @@ var PROPS_SCHEMAS = import_ui3.ComponentPropsMap;
 var DATASOURCE_SUPPLIED_PROP = "object";
 function suppliedByDataSource(issue, component) {
   if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
-  const dataSource = isRec15(component.dataSource) ? component.dataSource : void 0;
-  return strName16(dataSource?.object) !== void 0;
+  const dataSource = isRec17(component.dataSource) ? component.dataSource : void 0;
+  return strName17(dataSource?.object) !== void 0;
 }
 function validateComponentProps(stack) {
   const findings = [];
-  if (!isRec15(stack)) return findings;
+  if (!isRec17(stack)) return findings;
   const pages = asArray24(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec15(page)) continue;
-    const pageName = strName16(page.name) ?? `#${pi}`;
+    if (!isRec17(page)) continue;
+    const pageName = strName17(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName16(component.type);
+      const type = strName17(component.type);
       if (!type) continue;
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec15(component.properties) ? component.properties : void 0;
+      const props = isRec17(component.properties) ? component.properties : void 0;
       if (!props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
-      for (const f of (0, import_spec.lintUnknownKeysAgainstSchema)(schema, props, type, base)) {
+      for (const f of (0, import_spec2.lintUnknownKeysAgainstSchema)(schema, props, type, base)) {
         findings.push({
           severity: "warning",
           rule: COMPONENT_PROPS_UNKNOWN_KEY,
@@ -5522,6 +5799,7 @@ var FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
 var FLOW_TRIGGER_UNKNOWN_EVENT = "flow-trigger-unknown-event";
 var FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID = "flow-time-relative-descriptor-invalid";
 var FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-descriptor-unroutable";
+var FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
 var VALID_RECORD_TRIGGER = /^record-(?:before|after)-(?:create|insert|update|delete|write)$/;
 function asArray30(v) {
   if (Array.isArray(v)) return v;
@@ -5539,6 +5817,11 @@ function renderNonObject(v) {
   if (t === "bigint") return `${String(v)}n (a bigint)`;
   return `a ${t}`;
 }
+function renderTriggerToken(v) {
+  if (typeof v === "string") return `'${v}'`;
+  const json = JSON.stringify(v);
+  return json === void 0 ? `a ${typeof v}` : json;
+}
 function startNodeOf(flow) {
   const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
   const index = nodes.findIndex((n) => n?.type === "start");
@@ -5658,6 +5941,25 @@ function validateFlowTriggerReadiness(stack) {
         hint: `config.timeRelative describes WHICH records to sweep \u2014 an object: { object, dateField, and exactly one of withinDays | offsetDays } (plus optional filter / maxRecords). A cadence like 'daily' is not a descriptor: HOW OFTEN the sweep runs is the sibling key config.schedule on the same start node (it defaults to daily, so it is usually omitted). See TimeRelativeTriggerSchema and content/docs/references/automation/time-relative-trigger.mdx.`
       });
     }
+    const routesToSomeTrigger = isRecordTriggered2 || isArrayRecordTriggered || isTimeRelative || config.schedule != null || flow.type === "schedule" || flow.type === "api" || triggerType === "api";
+    if (start && flow.type === "record_change" && !routesToSomeTrigger) {
+      const hasTriggerType = config.triggerType != null;
+      findings.push({
+        // `error` (#5762's criterion, applied to a fourth id). The verdict is
+        // the engine's own routing chain — literal `startsWith`/`typeof` tests
+        // with no registry lookup in them — so no installed package can make
+        // this token resolve. `registerTrigger` is keyed by the RESOLVED type,
+        // which is the near-miss worth stating: a plugin can supply the
+        // record-change trigger itself, and it still would not help, because
+        // the flow never reaches the point of asking for one.
+        severity: "error",
+        rule: FLOW_TRIGGER_UNROUTABLE,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
+        message: `declares type: 'record_change' but ` + (hasTriggerType ? `its start node's triggerType is ${renderTriggerToken(config.triggerType)}, which the engine routes to NO trigger` : `its start node has no triggerType at all, so there is nothing for the engine to route`) + ` \u2014 it binds a record-change flow only for a token starting with 'record-', so this flow is demoted to a manual one and never fires. Nothing NAMES it: the unbound-flow audit resolves the same binding and skips the flow as "manual \u2014 nothing to bind", so neither the boot warning nor the startup summary lists it; the only trace is the banner's flow count being one higher than its bound count.`,
+        hint: `Use record-{before,after}-{create,update,delete,write} ('write' is create OR update in one flow, #3427; create/insert are synonyms). If the flow really is launched by hand or from a screen, declare type: 'autolaunched' or 'screen' instead of 'record_change' \u2014 those types have no trigger to be missing.`
+      });
+    }
     if (isAutoTriggered && (flow.status == null || flow.status === "draft")) {
       findings.push({
         severity: "warning",
@@ -5674,7 +5976,7 @@ function validateFlowTriggerReadiness(stack) {
 
 // src/validate-approval-approvers.ts
 var import_automation4 = require("@objectstack/spec/automation");
-var import_spec2 = require("@objectstack/spec");
+var import_spec3 = require("@objectstack/spec");
 var import_formula3 = require("@objectstack/formula");
 var APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 var APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
@@ -5689,8 +5991,8 @@ var APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED = "approval-approver-cross-org-unsup
 var EXPRESSION_ROOTS = /* @__PURE__ */ new Set(["current", "trigger", "vars"]);
 var RESERVED_OUTPUT_KEYS = /* @__PURE__ */ new Set(["decision", "requestId"]);
 var GROUP_ROUTED_TYPES = /* @__PURE__ */ new Set(["position", "team", "department"]);
-var MEMBERSHIP_TIERS = new Set(import_spec2.BUILTIN_MEMBERSHIP_ROLES);
-var MEMBERSHIP_TIER_LIST = import_spec2.BUILTIN_MEMBERSHIP_ROLES.join("/");
+var MEMBERSHIP_TIERS = new Set(import_spec3.BUILTIN_MEMBERSHIP_ROLES);
+var MEMBERSHIP_TIER_LIST = import_spec3.BUILTIN_MEMBERSHIP_ROLES.join("/");
 var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
@@ -5885,7 +6187,7 @@ function validateApprovalApprovers(stack) {
 }
 
 // src/validate-record-title.ts
-var import_data6 = require("@objectstack/spec/data");
+var import_data7 = require("@objectstack/spec/data");
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
 function asArray32(v) {
@@ -5913,7 +6215,7 @@ function validateRecordTitle(stack) {
         hint: `titleFormat is a render-only template the server cannot return or query, and an explicit nameField now takes precedence. For a single-field title set nameField: '<field>'. For a composite title, add a formula field (returnType: 'text') and designate it via nameField.`
       });
     }
-    const completeness = (0, import_data6.objectTitleCompleteness)(obj);
+    const completeness = (0, import_data7.objectTitleCompleteness)(obj);
     if (completeness.status === "none") {
       findings.push({
         severity: "warning",
@@ -6009,7 +6311,7 @@ function validateSemanticRoles(stack) {
       (h) => typeof h === "string" && h.length > 0
     );
     if (declaredStrings.length > 0 && declaredGroups.size > 0) {
-      const declaredTitle = [obj.nameField, obj.primaryField, obj.displayNameField].find((v) => typeof v === "string" && v.length > 0 && fieldNames.has(v));
+      const declaredTitle = [obj.nameField, obj.displayNameField].find((v) => typeof v === "string" && v.length > 0 && fieldNames.has(v));
       const titleField = declaredTitle ?? ["name", "full_name", "title", "subject", "display_name"].find((c) => fieldNames.has(c));
       const stripSet = new Set(
         declaredStrings.filter((h) => h !== titleField).slice(0, 4)
@@ -6044,6 +6346,12 @@ function asArray34(v) {
   }
   return [];
 }
+function isRec18(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName18(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
 function fieldNameOf(entry) {
   if (typeof entry === "string") return entry.length > 0 ? entry : null;
   if (entry && typeof entry === "object" && !Array.isArray(entry)) {
@@ -6052,13 +6360,6 @@ function fieldNameOf(entry) {
   }
   return null;
 }
-function boundObject(view) {
-  const data = view.data;
-  if (data && typeof data === "object" && typeof data.object === "string") {
-    return data.object;
-  }
-  return typeof view.objectName === "string" ? view.objectName : void 0;
-}
 function validateFormLayout(stack) {
   const findings = [];
   const objectFields = /* @__PURE__ */ new Map();
@@ -6068,44 +6369,44 @@ function validateFormLayout(stack) {
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? Object.keys(obj.fields) : [];
     objectFields.set(name, new Set(fields));
   }
-  const views = asArray34(stack.views);
-  for (let i = 0; i < views.length; i++) {
-    const view = views[i];
-    if (!view || typeof view !== "object") continue;
-    const sections = Array.isArray(view.sections) ? view.sections : null;
-    if (!sections) continue;
-    const viewName = typeof view.name === "string" ? view.name : `(view ${i})`;
-    const objName = boundObject(view);
-    const known = objName ? objectFields.get(objName) : void 0;
-    const where = `view "${viewName}"`;
-    const base = `views[${i}]`;
-    for (let s = 0; s < sections.length; s++) {
-      const sec = sections[s];
-      const secFields = sec && typeof sec === "object" && Array.isArray(sec.fields) ? sec.fields : [];
-      for (let f = 0; f < secFields.length; f++) {
-        const entry = secFields[f];
-        const fname = fieldNameOf(entry);
-        const fpath = `${base}.sections[${s}].fields[${f}]`;
-        if (fname && known && !known.has(fname)) {
-          findings.push({
-            severity: "warning",
-            rule: FORM_FIELD_UNKNOWN,
-            where,
-            path: fpath,
-            message: `${viewName}: field "${fname}" is not a field on object "${objName}" \u2014 it is silently skipped and never renders on the form`,
-            hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
-          });
-        }
-        const colSpan = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.colSpan : void 0;
-        if (colSpan != null) {
-          findings.push({
-            severity: "warning",
-            rule: FORM_COLSPAN_ABSOLUTE,
-            where,
-            path: `${fpath}.colSpan`,
-            message: `${viewName}: field "${fname ?? "?"}" sets absolute colSpan ${String(colSpan)} \u2014 the form's column count is derived per surface (mobile 1 / modal 2 / page 3-4), so a fixed span only aligns at one width`,
-            hint: `Prefer span: 'full' (whole row at any column count), or omit for auto width. The renderer clamps colSpan to the current column count.`
-          });
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = strName18(view.name) ?? strName18(view.object) ?? viewPath;
+    const containerObject = viewObjectName(view);
+    for (const site of formViewSites(view, viewPath)) {
+      const objName = viewObjectName(site.view) ?? containerObject;
+      const known = objName ? objectFields.get(objName) : void 0;
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const sec = sections[s];
+          const secFields = isRec18(sec) && Array.isArray(sec.fields) ? sec.fields : [];
+          for (let f = 0; f < secFields.length; f++) {
+            const entry = secFields[f];
+            const fname = fieldNameOf(entry);
+            const fpath = `${site.path}.${bucket}[${s}].fields[${f}]`;
+            if (fname && known && !known.has(fname)) {
+              findings.push({
+                severity: "warning",
+                rule: FORM_FIELD_UNKNOWN,
+                where,
+                path: fpath,
+                message: `${viewName}: field "${fname}" is not a field on object "${objName}" \u2014 it is silently skipped and never renders on the form`,
+                hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
+              });
+            }
+            const colSpan = isRec18(entry) ? entry.colSpan : void 0;
+            if (colSpan != null) {
+              findings.push({
+                severity: "warning",
+                rule: FORM_COLSPAN_ABSOLUTE,
+                where,
+                path: `${fpath}.colSpan`,
+                message: `${viewName}: field "${fname ?? "?"}" sets absolute colSpan ${String(colSpan)} \u2014 the form's column count is derived per surface (mobile 1 / modal 2 / page 3-4), so a fixed span only aligns at one width`,
+                hint: `Prefer span: 'full' (whole row at any column count), or omit for auto width. The renderer clamps colSpan to the current column count.`
+              });
+            }
+          }
         }
       }
     }
@@ -6204,17 +6505,12 @@ function validateSeedStateMachine(stack) {
 }
 
 // src/validate-visibility-predicates.ts
-var VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
+var import_formula4 = require("@objectstack/formula");
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
+var VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
+var VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
+var VISIBILITY_PREDICATE_OVER_BUDGET = "visibility-predicate-over-budget";
 var CANONICAL = "visibleWhen";
-var ALIASES = ["visibleOn", "visibility"];
-function asArray35(v) {
-  if (Array.isArray(v)) return v;
-  if (v && typeof v === "object") {
-    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
-  }
-  return [];
-}
 function predicateSource(v) {
   if (typeof v === "string") return v;
   if (v && typeof v === "object" && typeof v.source === "string") {
@@ -6225,6 +6521,67 @@ function predicateSource(v) {
 function usesRoot(source, root) {
   return new RegExp(`(^|[^.\\w$])${root}\\.\\w`).test(source);
 }
+function withoutStringLiterals(source) {
+  return source.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"/g, (lit) => " ".repeat(lit.length));
+}
+var NON_CEL_SPELLINGS = [
+  { wrote: "===", cel: "==", example: "record.country == 'USA'", re: /===/ },
+  { wrote: "!==", cel: "!=", example: "record.country != 'USA'", re: /!==/ },
+  { wrote: "<>", cel: "!=", example: "record.country != 'USA'", re: /<>/ },
+  { wrote: "and", cel: "&&", example: "record.a == 1 && record.b == 2", re: /(?<![.\w$])and(?![\w$])/i },
+  { wrote: "or", cel: "||", example: "record.a == 1 || record.b == 2", re: /(?<![.\w$])or(?![\w$])/i },
+  { wrote: "not", cel: "!", example: "!record.archived", re: /(?<![.\w$])not(?![\w$])/i },
+  // Assignment where a comparison was meant. Last, and fenced off from every
+  // operator that legitimately contains `=` (`==`, `!=`, `<=`, `>=`).
+  { wrote: "=", cel: "==", example: "record.status == 'open'", re: /(?<![=!<>])=(?!=)/ }
+];
+function quoteSource(source) {
+  const flat = source.replace(/\s+/g, " ").trim();
+  return flat.length > 120 ? `${flat.slice(0, 117)}...` : flat;
+}
+function celRefusal(source) {
+  if (!source.trim()) return null;
+  const parsed = (0, import_formula4.parseCelToAstWithReason)(source);
+  if (parsed.ok || parsed.kind === "empty") return null;
+  if (parsed.kind === "bounds") return { kind: "bounds", overrun: parsed.overrun };
+  const identifiers = (0, import_formula4.collectCelRootIdentifiers)(source);
+  const detail = identifiers.ok ? "the expression could not be parsed" : identifiers.error.split("\n")[0].trim();
+  const scannable = withoutStringLiterals(source);
+  return { kind: "syntax", detail, token: NON_CEL_SPELLINGS.find((s) => s.re.test(scannable)) ?? null };
+}
+function boundName(overrun) {
+  return overrun.limit && overrun.limitValue !== null ? `the \`${overrun.limit}\` budget (platform limit ${overrun.limitValue})` : "one of the platform's parse budgets";
+}
+var VIEW_PAGE_EXTRA_ROOTS = ["current_user", "page"];
+function isNode2(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function namespaceRoots(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) namespaceRoots(child, out);
+    return;
+  }
+  if (!isNode2(node)) return;
+  const args = node.args;
+  if (Array.isArray(args)) {
+    const receiver = node.op === "rcall" ? args[1] : args[0];
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode2(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+      out.add(receiver.args);
+    }
+  }
+  namespaceRoots(args, out);
+}
+function firstBareIdentifier(source) {
+  const ast = (0, import_formula4.parseCelToAst)(source);
+  if (!ast) return null;
+  const rooted = /* @__PURE__ */ new Set();
+  namespaceRoots(ast, rooted);
+  return (0, import_formula4.firstUndeclaredReference)(source, [...VIEW_PAGE_EXTRA_ROOTS, ...rooted]);
+}
+var CANONICAL_ROOT_BY_LAYER = {
+  runtime: "record",
+  metadata: "data"
+};
 var MISLAYER_BY_LAYER = {
   runtime: {
     forbiddenRoot: "data",
@@ -6238,18 +6595,6 @@ var MISLAYER_BY_LAYER = {
   }
 };
 function checkElement(el, where, path, layer, findings) {
-  for (const alias of ALIASES) {
-    if (el[alias] !== void 0) {
-      findings.push({
-        severity: "warning",
-        rule: VISIBILITY_ALIAS_DEPRECATED,
-        where,
-        path: `${path}.${alias}`,
-        message: `\`${alias}\` is the deprecated spelling of the conditional-visibility predicate (ADR-0089). It still works \u2014 it is normalized to \`visibleWhen\` at parse \u2014 but the canonical key is \`visibleWhen\`.`,
-        hint: `Rename the key \`${alias}\` \u2192 \`visibleWhen\` (same CEL value).`
-      });
-    }
-  }
   const raw = el[CANONICAL] ?? el.visibleOn ?? el.visibility;
   const source = predicateSource(raw);
   const rule = MISLAYER_BY_LAYER[layer];
@@ -6263,6 +6608,43 @@ function checkElement(el, where, path, layer, findings) {
       hint: rule.hint
     });
   }
+  const refusal = source ? celRefusal(source) : null;
+  if (source && refusal?.kind === "bounds") {
+    const bound = boundName(refusal.overrun);
+    const root = CANONICAL_ROOT_BY_LAYER[layer];
+    findings.push({
+      severity: "error",
+      rule: VISIBILITY_PREDICATE_OVER_BUDGET,
+      where,
+      path,
+      message: `visibility predicate is syntactically valid CEL but overruns ${bound} (${refusal.overrun.summary}) (predicate: \`${quoteSource(source)}\`). The canonical front end refuses it, so it can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+      hint: `There is no syntax or dialect error to correct here \u2014 this is a SIZE fault, not a dialect mistake, so re-spelling the predicate will not fix it. Make it smaller, or move the work off the predicate: (1) collapse a long \`${root}.f == 'a' || ${root}.f == 'b' || \u2026\` chain into a single \`${root}.f in ['a', 'b', \u2026]\`, which is far fewer AST nodes (\`maxListElements\` is 64, so a very large set needs option 2); (2) precompute the heavy part into a formula/rollup field on the object and test that one field instead. Logic genuinely this large is not element visibility \u2014 compute it once on the record rather than re-deriving it in every predicate that needs it.`
+    });
+  }
+  if (source && refusal?.kind === "syntax") {
+    findings.push({
+      severity: "error",
+      rule: VISIBILITY_PREDICATE_SYNTAX,
+      where,
+      path,
+      message: `visibility predicate is not valid CEL \u2014 ${refusal.detail} (predicate: \`${quoteSource(source)}\`). A predicate that does not parse can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+      hint: refusal.token ? `\`${refusal.token.wrote}\` is not a CEL operator \u2014 CEL spells it \`${refusal.token.cel}\`. Replace \`${refusal.token.wrote}\` with \`${refusal.token.cel}\`, e.g. \`${refusal.token.example}\`.` : `Visibility predicates are bare CEL, e.g. \`record.status == 'open'\`. Spellings from other languages do not parse: write \`==\` (not \`===\`), \`!=\` (not \`!==\` or \`<>\`), \`&&\` (not \`and\`), \`||\` (not \`or\`), \`!\` (not \`not\`).`
+    });
+  }
+  if (source && !refusal) {
+    const bare = firstBareIdentifier(source);
+    if (bare) {
+      const root = CANONICAL_ROOT_BY_LAYER[layer];
+      findings.push({
+        severity: "error",
+        rule: VISIBILITY_BARE_IDENTIFIER,
+        where,
+        path,
+        message: `visibility predicate references \`${bare}\` as a bare identifier. Values are bound under a namespace on this surface \u2014 they are never flattened to top level \u2014 so \`${bare}\` resolves to nothing, the predicate can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+        hint: `Write \`${root}.${bare}\` instead of \`${bare}\`` + (layer === "runtime" ? " (runtime view/page surfaces bind `record` + `current_user`; a page component also exposes page state as `page.<var>`)." : " (a `*.form.ts` metadata-editing form binds the row under edit as `data`).")
+      });
+    }
+  }
 }
 function isFieldObject(entry) {
   return !!entry && typeof entry === "object" && !Array.isArray(entry);
@@ -6270,43 +6652,304 @@ function isFieldObject(entry) {
 function validateVisibilityPredicates(stack, opts = {}) {
   const layer = opts.layer ?? "runtime";
   const findings = [];
-  const views = asArray35(stack.views);
-  for (let i = 0; i < views.length; i++) {
-    const view = views[i];
-    if (!view || typeof view !== "object") continue;
-    const viewName = typeof view.name === "string" ? view.name : `(view ${i})`;
-    const where = `view "${viewName}"`;
-    for (const bucket of ["sections", "groups"]) {
-      const sections = Array.isArray(view[bucket]) ? view[bucket] : [];
-      for (let s = 0; s < sections.length; s++) {
-        const sec = sections[s];
-        if (!sec || typeof sec !== "object") continue;
-        const secPath = `views[${i}].${bucket}[${s}]`;
-        checkElement(sec, where, secPath, layer, findings);
-        const secFields = Array.isArray(sec.fields) ? sec.fields : [];
-        for (let f = 0; f < secFields.length; f++) {
-          const entry = secFields[f];
-          if (isFieldObject(entry)) {
-            checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
+    for (const site of formViewSites(view, viewPath)) {
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const sec = sections[s];
+          if (!sec || typeof sec !== "object") continue;
+          const secPath = `${site.path}.${bucket}[${s}]`;
+          checkElement(sec, where, secPath, layer, findings);
+          const secFields = Array.isArray(sec.fields) ? sec.fields : [];
+          for (let f = 0; f < secFields.length; f++) {
+            const entry = secFields[f];
+            if (isFieldObject(entry)) {
+              checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+            }
           }
         }
       }
     }
   }
-  const pages = asArray35(stack.pages);
-  for (let i = 0; i < pages.length; i++) {
-    const page = pages[i];
-    if (!page || typeof page !== "object") continue;
-    const pageName = typeof page.name === "string" ? page.name : `(page ${i})`;
-    const where = `page "${pageName}"`;
-    const regions = Array.isArray(page.regions) ? page.regions : [];
-    for (let r = 0; r < regions.length; r++) {
-      const region = regions[r];
-      const components = region && typeof region === "object" && Array.isArray(region.components) ? region.components : [];
-      for (let c = 0; c < components.length; c++) {
-        const comp = components[c];
-        if (comp && typeof comp === "object") {
-          checkElement(comp, where, `pages[${i}].regions[${r}].components[${c}]`, layer, findings);
+  for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
+    const pageName = typeof page.name === "string" ? page.name : void 0;
+    const where = `page "${pageName ?? pagePath}"`;
+    for (const walked of walkPageComponents(page, pagePath)) {
+      checkElement(walked.component, where, walked.path, layer, findings);
+    }
+  }
+  return findings;
+}
+
+// src/validate-predicate-path-refs.ts
+var import_formula5 = require("@objectstack/formula");
+var import_kernel2 = require("@objectstack/spec/kernel");
+var import_spec4 = require("@objectstack/spec");
+var PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
+var PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
+var PREDICATE_KEYS = ["visibleWhen", "visibleOn"];
+var ROOT = "data";
+var COMPREHENSION_MACROS = /* @__PURE__ */ new Set(["all", "exists", "exists_one", "map", "filter"]);
+function defOf(schema) {
+  if (!schema || typeof schema !== "object" && typeof schema !== "function") return void 0;
+  const s = schema;
+  return s.def ?? s._def;
+}
+function peel(schema, depth = 0) {
+  if (!schema || depth > 25) return schema;
+  const d = defOf(schema);
+  if (!d) return schema;
+  switch (d.type) {
+    case "optional":
+    case "nullable":
+    case "default":
+    case "prefault":
+    case "readonly":
+    case "catch":
+    case "nonoptional":
+      return peel(d.innerType, depth + 1);
+    case "lazy":
+      return peel(d.getter(), depth + 1);
+    case "pipe": {
+      const inner = peel(d.in, depth + 1);
+      return defOf(inner)?.type === "transform" ? peel(d.out, depth + 1) : inner;
+    }
+    default:
+      return schema;
+  }
+}
+function optionsOf(d) {
+  return Array.isArray(d?.options) ? d.options : [];
+}
+function keysOf(schema, depth = 0) {
+  if (depth > 25) return null;
+  const u = peel(schema);
+  const d = defOf(u);
+  if (d?.type === "object") return Object.keys(d.shape ?? u.shape ?? {});
+  if (d?.type === "union" || d?.type === "discriminated_union") {
+    const all = /* @__PURE__ */ new Set();
+    let keyBearing = false;
+    for (const option of optionsOf(d)) {
+      const k = keysOf(option, depth + 1);
+      if (!k) continue;
+      keyBearing = true;
+      for (const key of k) all.add(key);
+    }
+    return keyBearing ? [...all] : null;
+  }
+  if (d?.type === "intersection") {
+    const left = keysOf(d.left, depth + 1);
+    const right = keysOf(d.right, depth + 1);
+    if (!left && !right) return null;
+    return [.../* @__PURE__ */ new Set([...left ?? [], ...right ?? []])];
+  }
+  return null;
+}
+function propertyOf(schema, key, depth = 0) {
+  if (depth > 25) return void 0;
+  const u = peel(schema);
+  const d = defOf(u);
+  if (d?.type === "object") return (d.shape ?? u.shape ?? {})[key];
+  if (d?.type === "union" || d?.type === "discriminated_union") {
+    for (const option of optionsOf(d)) {
+      const found = propertyOf(option, key, depth + 1);
+      if (found !== void 0) return found;
+    }
+  }
+  if (d?.type === "intersection") {
+    return propertyOf(d.left, key, depth + 1) ?? propertyOf(d.right, key, depth + 1);
+  }
+  return void 0;
+}
+function rowScopeOf(scope, key) {
+  const prop = propertyOf(scope, key);
+  if (prop === void 0) return void 0;
+  let node = peel(prop);
+  for (let i = 0; i < 25; i++) {
+    const d = defOf(node);
+    if (d?.type === "array") node = peel(d.element);
+    else if (d?.type === "record") node = peel(d.valueType);
+    else return node;
+  }
+  return node;
+}
+function stepInto(scope, segment) {
+  const u = peel(scope);
+  const d = defOf(u);
+  if (d?.type === "record") return { kind: "declared", next: d.valueType };
+  const declared = keysOf(u);
+  if (declared === null) return { kind: "opaque" };
+  if (!declared.includes(segment)) return { kind: "undeclared", declared };
+  return { kind: "declared", next: propertyOf(u, segment) };
+}
+function isNode3(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function memberChain(node) {
+  if (!isNode3(node)) return null;
+  if (node.op === "id" && typeof node.args === "string") return [node.args];
+  if (node.op === "." && Array.isArray(node.args) && typeof node.args[1] === "string") {
+    const head = memberChain(node.args[0]);
+    return head ? [...head, node.args[1]] : null;
+  }
+  return null;
+}
+function rootedPaths(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) rootedPaths(child, out);
+    return;
+  }
+  if (!isNode3(node)) return;
+  if (node.op === ".") {
+    const chain = memberChain(node);
+    if (chain && chain[0] === ROOT && chain.length > 1) {
+      out.push(chain.slice(1));
+      return;
+    }
+  }
+  rootedPaths(node.args, out);
+}
+function classifyIdentifiers(node, values, excluded) {
+  if (Array.isArray(node)) {
+    for (const child of node) classifyIdentifiers(child, values, excluded);
+    return;
+  }
+  if (!isNode3(node)) return;
+  const args = node.args;
+  if (Array.isArray(args)) {
+    const receiver = node.op === "rcall" ? args[1] : args[0];
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode3(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+      excluded.add(receiver.args);
+    }
+    if (node.op === "rcall" && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+      const macroArgs = args[2];
+      if (Array.isArray(macroArgs) && macroArgs.length >= 2) {
+        const bound = macroArgs[0];
+        if (isNode3(bound) && bound.op === "id" && typeof bound.args === "string") {
+          excluded.add(bound.args);
+        }
+      }
+    }
+  }
+  if (node.op === "id" && typeof node.args === "string") {
+    values.add(node.args);
+    return;
+  }
+  classifyIdentifiers(args, values, excluded);
+}
+function predicateSource2(v) {
+  if (typeof v === "string") return v;
+  if (v && typeof v === "object" && typeof v.source === "string") {
+    return v.source;
+  }
+  return void 0;
+}
+function isRec19(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function schemaIdOf(view) {
+  const data = view.data;
+  if (!isRec19(data)) return void 0;
+  if (data.provider !== "schema") return void 0;
+  return typeof data.schemaId === "string" ? data.schemaId : void 0;
+}
+function checkPredicate(source, scope, where, path, findings) {
+  const ast = (0, import_formula5.parseCelToAst)(source);
+  if (!ast) return;
+  const paths = [];
+  rootedPaths(ast, paths);
+  for (const segments of paths) {
+    let cursor = scope;
+    const walked = [];
+    for (const segment of segments) {
+      const step = stepInto(cursor, segment);
+      if (step.kind === "opaque") break;
+      if (step.kind === "undeclared") {
+        const full = [ROOT, ...walked, segment].join(".");
+        const container = walked.length ? `${ROOT}.${walked.join(".")}` : ROOT;
+        findings.push({
+          severity: "error",
+          rule: PREDICATE_PATH_UNRESOLVED,
+          where,
+          path,
+          message: `predicate references \`${full}\`, which the target schema does not declare \u2014 \`${segment}\` is not a key of \`${container}\`. The reference resolves to nothing, so the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149).`,
+          hint: `${(0, import_spec4.formatSuggestion)((0, import_spec4.findClosestMatches)(segment, step.declared)) || `\`${container}\` declares: ${step.declared.slice(0, 12).sort().join(", ")}`} Every reference must resolve against the schema the form edits.`
+        });
+        break;
+      }
+      walked.push(segment);
+      cursor = step.next;
+    }
+  }
+  const declaredHere = keysOf(scope);
+  if (!declaredHere) return;
+  const values = /* @__PURE__ */ new Set();
+  const excluded = /* @__PURE__ */ new Set();
+  classifyIdentifiers(ast, values, excluded);
+  for (const id of values) {
+    if (excluded.has(id) || !declaredHere.includes(id)) continue;
+    findings.push({
+      severity: "error",
+      rule: PREDICATE_PATH_UNROOTED,
+      where,
+      path,
+      message: `predicate references \`${id}\` as a bare identifier, but \`${id}\` is a key of the schema this form edits \u2014 the binding root was dropped. Values are bound under \`${ROOT}\` and are never flattened to top level, so \`${id}\` resolves to nothing, the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149, #6254).`,
+      hint: `Write \`${ROOT}.${id}\` instead of \`${id}\`. A metadata-editing form binds the row under edit as \`${ROOT}\` at every depth \u2014 inside a repeater \`${ROOT}\` is the ROW, but it is still spelled \`${ROOT}\` (there is no implicit row scope).`
+    });
+  }
+}
+function walkFields(entries, scope, where, base, findings, depth) {
+  if (!Array.isArray(entries) || depth > 12) return;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    if (!isRec19(entry)) continue;
+    const path = `${base}[${i}]`;
+    for (const key of PREDICATE_KEYS) {
+      const source = predicateSource2(entry[key]);
+      if (source !== void 0 && source.trim()) {
+        checkPredicate(source, scope, where, `${path}.${key}`, findings);
+        break;
+      }
+    }
+    if (Array.isArray(entry.fields) && entry.fields.length > 0 && typeof entry.field === "string") {
+      const row = scope === void 0 ? void 0 : rowScopeOf(scope, entry.field);
+      walkFields(entry.fields, row, where, `${path}.fields`, findings, depth + 1);
+    }
+  }
+}
+function validatePredicatePathRefs(stack, opts = {}) {
+  const resolveSchema = opts.resolveSchema ?? ((schemaId) => (0, import_kernel2.getMetadataTypeSchema)(schemaId));
+  const findings = [];
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
+    for (const site of formViewSites(view, viewPath)) {
+      const schemaId = schemaIdOf(site.view);
+      if (!schemaId) continue;
+      let root;
+      try {
+        root = resolveSchema(schemaId);
+      } catch {
+        continue;
+      }
+      if (!root) continue;
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface} (schema "${schemaId}")` : `view "${viewName}" (schema "${schemaId}")`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const section = sections[s];
+          if (!isRec19(section)) continue;
+          const sectionPath = `${site.path}.${bucket}[${s}]`;
+          for (const key of PREDICATE_KEYS) {
+            const source = predicateSource2(section[key]);
+            if (source !== void 0 && source.trim()) {
+              checkPredicate(source, root, where, `${sectionPath}.${key}`, findings);
+              break;
+            }
+          }
+          walkFields(section.fields, root, where, `${sectionPath}.fields`, findings, 0);
         }
       }
     }
@@ -6340,7 +6983,7 @@ var OWD_WIDTH = {
   public_read: 1,
   public_read_write: 2
 };
-function asArray36(v) {
+function asArray35(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6366,7 +7009,7 @@ function refOf(def) {
   return typeof r === "string" && r ? r : void 0;
 }
 function firstMasterDetailField(obj) {
-  for (const f of asArray36(obj.fields)) {
+  for (const f of asArray35(obj.fields)) {
     if (f.type === "master_detail") {
       return { name: String(f.name ?? "?"), parent: refOf(f) };
     }
@@ -6379,8 +7022,8 @@ function grantsObjectAccess(p) {
 function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray36(stack.objects);
-  const permissionSets = asArray36(stack.permissions);
+  const objects = asArray35(stack.objects);
+  const permissionSets = asArray35(stack.permissions);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -6509,10 +7152,10 @@ function validateSecurityPosture(stack, opts) {
     if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
     flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray36(obj.fields)) {
+    for (const f of asArray35(obj.fields)) {
       flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
     }
-    for (const [ai, action] of asArray36(obj.actions).entries()) {
+    for (const [ai, action] of asArray35(obj.actions).entries()) {
       flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
     }
   }
@@ -6521,19 +7164,19 @@ function validateSecurityPosture(stack, opts) {
     if (!ps || typeof ps !== "object") continue;
     flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
   }
-  for (const [i, pos] of asArray36(stack.positions).entries()) {
+  for (const [i, pos] of asArray35(stack.positions).entries()) {
     flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
   }
-  for (const [i, app] of asArray36(stack.apps).entries()) {
+  for (const [i, app] of asArray35(stack.apps).entries()) {
     flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
   }
-  for (const [i, book] of asArray36(stack.books).entries()) {
+  for (const [i, book] of asArray35(stack.books).entries()) {
     flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
   }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
-  for (const [i, book] of asArray36(stack.books).entries()) {
+  for (const [i, book] of asArray35(stack.books).entries()) {
     const audience = book.audience;
     if (!audience || typeof audience !== "object") continue;
     const setName = audience.permissionSet;
@@ -6611,7 +7254,7 @@ function validateSecurityPosture(stack, opts) {
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
   const nowMs = opts?.nowMs ?? Date.now();
-  for (const [i, seed] of asArray36(stack.data).entries()) {
+  for (const [i, seed] of asArray35(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
     if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
     const records = Array.isArray(seed.records) ? seed.records : [];
@@ -6656,7 +7299,7 @@ var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
 var ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
 var ORG_PARENT_FIELD = "parent_organization_id";
 var BU_TREE_RECIPIENT_TYPES = /* @__PURE__ */ new Set(["business_unit", "unit_and_subordinates"]);
-function asArray37(v) {
+function asArray36(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6686,9 +7329,9 @@ var INHERITANCE_HINT = `Remove the ${ORG_PARENT_FIELD} reference. Cross-organiza
 function validateOrgAxisRedLines(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  const permissionSets = asArray37(cfg.permissions);
+  const permissionSets = asArray36(cfg.permissions);
   permissionSets.forEach((ps, psIndex) => {
-    asArray37(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+    asArray36(ps.rowLevelSecurity).forEach((policy, pIndex) => {
       for (const clause of ["using", "check"]) {
         if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
         findings.push({
@@ -6702,7 +7345,7 @@ function validateOrgAxisRedLines(stack) {
       }
     });
   });
-  asArray37(cfg.sharingRules).forEach((rule, rIndex) => {
+  asArray36(cfg.sharingRules).forEach((rule, rIndex) => {
     const slots = [
       { key: "condition", text: expressionText(rule.condition) },
       { key: "sharedWith", text: JSON.stringify(rule.sharedWith ?? "") ?? "" }
@@ -6720,9 +7363,9 @@ function validateOrgAxisRedLines(stack) {
     }
   });
   const tenancyDisabledObjects = new Set(
-    asArray37(cfg.objects).filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
+    asArray36(cfg.objects).filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
   );
-  asArray37(cfg.sharingRules).forEach((rule, rIndex) => {
+  asArray36(cfg.sharingRules).forEach((rule, rIndex) => {
     const target = str(rule.object);
     if (!target || !tenancyDisabledObjects.has(target)) return;
     const sharedWith = rule.sharedWith;
@@ -6742,10 +7385,10 @@ function validateOrgAxisRedLines(stack) {
 }
 
 // src/validate-sharing-rule-enforceability.ts
-var import_formula4 = require("@objectstack/formula");
+var import_formula6 = require("@objectstack/formula");
 var SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
 var SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
-function asArray38(v) {
+function asArray37(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6772,10 +7415,10 @@ var PUSHDOWN_SUBSET = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in
 function validateSharingRuleEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  asArray38(cfg.sharingRules).forEach((rule, index) => {
+  asArray37(cfg.sharingRules).forEach((rule, index) => {
     const input = toCompilerInput(rule.condition);
     if (input === null) return;
-    const result = (0, import_formula4.compileCelToFilter)(input, { variables: {} });
+    const result = (0, import_formula6.compileCelToFilter)(input, { variables: {} });
     if (result.ok) return;
     if (result.reason === "parse-error") return;
     const name = str2(rule.name) || String(index);
@@ -6808,10 +7451,11 @@ function validateSharingRuleEnforceability(stack) {
 }
 
 // src/validate-rls-predicate-enforceability.ts
-var import_formula5 = require("@objectstack/formula");
+var import_formula7 = require("@objectstack/formula");
 var RLS_PREDICATE_UNENFORCEABLE = "rls-predicate-unenforceable";
 var RLS_PREDICATE_UNPARSEABLE = "rls-predicate-unparseable";
-function asArray39(v) {
+var RLS_PREDICATE_OVER_BUDGET = "rls-predicate-over-budget";
+function asArray38(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6822,6 +7466,13 @@ function str3(v) {
   return typeof v === "string" ? v : "";
 }
 var PUSHDOWN_SUBSET2 = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in`, `&&` `||` `!`, `== null` / `!= null`, and the string methods `startsWith` / `endsWith` / `contains` \u2014 over SINGLE-column field paths (ADR-0058 D2), compared against a literal or a `current_user.*` value.";
+function boundsOverrunOf(bridged) {
+  const parsed = (0, import_formula7.parseCelToAstWithReason)(bridged);
+  return !parsed.ok && parsed.kind === "bounds" ? parsed.overrun : null;
+}
+function quote(source) {
+  return source.length > 200 ? `${source.slice(0, 197)}...` : source;
+}
 function consequence(clause) {
   const dropped = 'so `RLSCompiler` DROPS the policy at request time (one WARN line \u2014 "has an uncompilable predicate \u2026 and was DROPPED (no enforcement)" \u2014 is the only signal, and nothing reports it at authoring time). ';
   return clause === "using" ? dropped + "When it is the only applicable policy for that object and operation, `compileFilter` returns the `RLS_DENY_FILTER` sentinel instead, which is AND-ed onto the where clause: every select / update / delete on the object matches ZERO rows. When other policies also apply, this one just vanishes from the OR and grants none of the access it appears to." : dropped + "On the ADR-0058 D4 write path that leaves the post-image `check` as the `RLS_DENY_FILTER` sentinel, which no record can satisfy: every insert / update the policy governs fails with `PermissionDeniedError`. The policy reads as a write rule and behaves as a blanket refusal.";
@@ -6829,20 +7480,36 @@ function consequence(clause) {
 function validateRlsPredicateEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  asArray39(cfg.permissions).forEach((ps, psIndex) => {
-    asArray39(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+  asArray38(cfg.permissions).forEach((ps, psIndex) => {
+    asArray38(ps.rowLevelSecurity).forEach((policy, pIndex) => {
       for (const clause of ["using", "check"]) {
         const source = str3(policy[clause]);
         if (!source.trim()) continue;
-        if ((0, import_formula5.isSupportedRlsExpression)(source)) continue;
-        const why = (0, import_formula5.isPushdownableCel)((0, import_formula5.sqlPredicateToCel)(source));
+        if ((0, import_formula7.isSupportedRlsExpression)(source)) continue;
+        const bridged = (0, import_formula7.sqlPredicateToCel)(source);
+        const why = (0, import_formula7.isPushdownableCel)(bridged);
         const detail = why.ok ? "" : why.detail;
         const parseError = !why.ok && why.reason === "parse-error";
+        const overrun = parseError ? boundsOverrunOf(bridged) : null;
         const psName = str3(ps.name) || String(psIndex);
         const policyName = str3(policy.name) || String(pIndex);
         const object = str3(policy.object);
         const where = `permission set "${psName}" policy "${policyName}"` + (object ? ` on object "${object}"` : "");
         const path = `permissions[${psIndex}].rowLevelSecurity[${pIndex}].${clause}`;
+        if (overrun) {
+          const bound = overrun.limit ?? "an unnamed platform CEL bound";
+          const budget = overrun.limitValue !== null ? ` (platform limit ${overrun.limitValue})` : "";
+          const measured = overrun.measured !== null ? `, this predicate measures ${overrun.measured}` : "";
+          findings.push({
+            severity: "error",
+            rule: RLS_PREDICATE_OVER_BUDGET,
+            where,
+            path,
+            message: `RLS ${clause} \`${quote(source)}\` is syntactically valid, lowerable CEL but overruns the platform parse bound ${bound}${budget}${measured} (${overrun.summary}), ` + consequence(clause),
+            hint: `There is no syntax or dialect error to correct here \u2014 the predicate is well-formed CEL and is simply too large for ${bound}${budget}, so the fix is to make it smaller or to move the work off the predicate. (1) Collapse a long \`field == a || field == b || \u2026\` chain into a single \`field in [a, b, \u2026]\`, which is far fewer AST nodes (\`maxListElements\` is 64, so a very large set needs option 2). (2) Pre-resolve the set into a membership key the runtime exposes and test \`field in current_user.<key>\` (ADR-0105 D11) \u2014 one comparison whatever the set size. (3) Denormalise a repeated sub-expression onto this object as a formula/rollup field and test that single column. (4) Split a TOP-LEVEL \`||\` across several \`rowLevelSecurity\` policies: applicable policies are OR-ed, so that is equivalent \u2014 but never split a top-level \`&&\` this way, which would WIDEN access rather than preserve it. Logic genuinely this large is not a row filter: move it to a hook or action body (\`ScriptBody { language: 'js' }\`, the L2 sandboxed surface).`
+          });
+          continue;
+        }
         if (parseError) {
           findings.push({
             severity: "error",
@@ -6874,11 +7541,11 @@ var import_meta4 = {};
 var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
 var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
 var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
-var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray40(v) {
-  if (Array.isArray(v)) return v.filter(isRec16);
-  if (isRec16(v)) {
-    return Object.entries(v).filter(([, def]) => isRec16(def)).map(([name, def]) => ({ name, ...def }));
+var isRec20 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray39(v) {
+  if (Array.isArray(v)) return v.filter(isRec20);
+  if (isRec20(v)) {
+    return Object.entries(v).filter(([, def]) => isRec20(def)).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
@@ -6895,7 +7562,7 @@ function loadAjv() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
     );
   }
-  const ctor = isRec16(mod) && "default" in mod ? mod.default : mod;
+  const ctor = isRec20(mod) && "default" in mod ? mod.default : mod;
   cachedAjv = ctor;
   return ctor;
 }
@@ -6910,7 +7577,7 @@ function loadAddFormats() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
     );
   }
-  const plugin = isRec16(mod) && "default" in mod ? mod.default : mod;
+  const plugin = isRec20(mod) && "default" in mod ? mod.default : mod;
   cachedAddFormats = plugin;
   return plugin;
 }
@@ -6940,17 +7607,17 @@ function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
   if (depth >= MAX_RULE_NESTING_DEPTH) return out;
   for (const branch of ["then", "otherwise"]) {
     const nested = rule[branch];
-    if (isRec16(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+    if (isRec20(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
   }
   return out;
 }
 function walkObjectValidationRules(stack) {
   const walked = [];
-  if (!isRec16(stack)) return walked;
-  for (const obj of asArray40(stack.objects)) {
+  if (!isRec20(stack)) return walked;
+  for (const obj of asArray39(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     const validations = obj.validations;
-    for (const authored of asArray40(validations)) {
+    for (const authored of asArray39(validations)) {
       for (const { rule, label: label2, path } of flattenRules(authored, "", "")) {
         walked.push({
           rule,
@@ -6981,7 +7648,7 @@ function validateRuleCompilability(stack) {
         });
       }
     }
-    if (rule.type === "json_schema" && isRec16(rule.schema)) {
+    if (rule.type === "json_schema" && isRec20(rule.schema)) {
       try {
         createRuntimeAjv().compile(rule.schema);
       } catch (err) {
@@ -7001,7 +7668,7 @@ function validateRuleCompilability(stack) {
 
 // src/validate-rule-schema-formats.ts
 var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
-var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec21 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var SUBSCHEMA_KEYS = [
   "additionalItems",
   "additionalProperties",
@@ -7025,7 +7692,7 @@ var SUBSCHEMA_MAP_KEYS = [
 var MAX_SCHEMA_WALK_DEPTH = 32;
 var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
 function collectFormatUses(schema, pointer, out, depth) {
-  if (!isRec17(schema)) return;
+  if (!isRec21(schema)) return;
   if (typeof schema.format === "string") {
     out.push({ pointer: `${pointer}/format`, name: schema.format });
   }
@@ -7044,7 +7711,7 @@ function collectFormatUses(schema, pointer, out, depth) {
   }
   for (const key of SUBSCHEMA_MAP_KEYS) {
     const value = schema[key];
-    if (!isRec17(value)) continue;
+    if (!isRec21(value)) continue;
     for (const [name, entry] of Object.entries(value)) {
       collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
     }
@@ -7052,13 +7719,13 @@ function collectFormatUses(schema, pointer, out, depth) {
   const items = schema.items;
   if (Array.isArray(items)) {
     items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
-  } else if (isRec17(items)) {
+  } else if (isRec21(items)) {
     collectFormatUses(items, `${pointer}/items`, out, depth + 1);
   }
   const dependencies = schema.dependencies;
-  if (isRec17(dependencies)) {
+  if (isRec21(dependencies)) {
     for (const [name, entry] of Object.entries(dependencies)) {
-      if (!isRec17(entry)) continue;
+      if (!isRec21(entry)) continue;
       collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
     }
   }
@@ -7097,7 +7764,7 @@ function validateRuleSchemaFormats(stack) {
   const findings = [];
   const pending = [];
   for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
-    if (rule.type !== "json_schema" || !isRec17(rule.schema)) continue;
+    if (rule.type !== "json_schema" || !isRec21(rule.schema)) continue;
     const uses = [];
     collectFormatUses(rule.schema, "", uses, 0);
     for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
@@ -7123,14 +7790,14 @@ function validateRuleSchemaFormats(stack) {
 
 // src/validate-action-locations.ts
 var ACTION_NO_PLACEMENT = "action-no-placement";
-function asArray41(v) {
+function asArray40(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName17(v) {
+function strName19(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
@@ -7144,8 +7811,8 @@ function collectNamePlacedActions(stack) {
     for (const key of ["rowActions", "bulkActions"]) {
       for (const n of strList3(list3[key])) placed.add(n);
     }
-    for (const def of asArray41(list3.bulkActionDefs)) {
-      const n = strName17(def?.name);
+    for (const def of asArray40(list3.bulkActionDefs)) {
+      const n = strName19(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -7153,12 +7820,12 @@ function collectNamePlacedActions(stack) {
     if (!listViews || typeof listViews !== "object" || Array.isArray(listViews)) return;
     for (const lv of Object.values(listViews)) harvest(lv);
   };
-  for (const view of asArray41(stack.views)) {
+  for (const view of asArray40(stack.views)) {
     if (!view || typeof view !== "object") continue;
     harvest(view.list);
     harvestListViews(view.listViews);
   }
-  for (const obj of asArray41(stack.objects)) {
+  for (const obj of asArray40(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     harvestListViews(obj.listViews);
   }
@@ -7171,7 +7838,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName17(action.name);
+    const name = strName19(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -7180,16 +7847,16 @@ function validateActionLocations(stack) {
       where: `action "${name}"`,
       path,
       message: `Action "${name}" declares no \`locations\` and no view places it by name, so it renders on no surface \u2014 the button exists in metadata and nowhere in the UI.`,
-      hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`, `global_nav`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
+      hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
     });
   };
-  const actions = asArray41(stack.actions);
+  const actions = asArray40(stack.actions);
   for (let i = 0; i < actions.length; i++) check(actions[i], `actions[${i}]`);
-  const objects = asArray41(stack.objects);
+  const objects = asArray40(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
-    const own = asArray41(obj.actions);
+    const own = asArray40(obj.actions);
     for (let ai = 0; ai < own.length; ai++) check(own[ai], `objects[${oi}].actions[${ai}]`);
   }
   return findings;
@@ -7197,7 +7864,8 @@ function validateActionLocations(stack) {
 
 // src/lint-flow-patterns.ts
 var import_automation5 = require("@objectstack/spec/automation");
-function asArray42(v) {
+var import_data8 = require("@objectstack/spec/data");
+function asArray41(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -7471,7 +8139,21 @@ function scanBranchRouting(at, nodes, edges, findings) {
 function filterCarriesNoCondition(filter) {
   if (filter === void 0 || filter === null) return true;
   if (typeof filter !== "object" || Array.isArray(filter)) return false;
-  return Object.keys(filter).length === 0;
+  return (0, import_data8.reduceFilterVerdict)(filter) === "true";
+}
+function describeUnboundedFilter(filter) {
+  if (filter === void 0 || filter === null) return "no `filter` key";
+  if (Object.keys(filter).length === 0) return "an EMPTY `filter`";
+  return `a \`filter\` that REDUCES TO TRUE (\`${previewFilter(filter)}\`)`;
+}
+function previewFilter(filter) {
+  try {
+    const json = JSON.stringify(filter);
+    if (typeof json !== "string") return typeof filter;
+    return json.length > 80 ? `${json.slice(0, 77)}...` : json;
+  } catch {
+    return typeof filter;
+  }
 }
 function scanUnboundedBulkWrites(at, nodes, findings) {
   for (const node of nodes) {
@@ -7482,10 +8164,10 @@ function scanUnboundedBulkWrites(at, nodes, findings) {
     if (cfg.multi !== true) continue;
     if (!filterCarriesNoCondition(cfg.filter)) continue;
     const objectName = typeof cfg.objectName === "string" && cfg.objectName ? cfg.objectName : "(unnamed object)";
-    const filterState = cfg.filter === void 0 || cfg.filter === null ? "no `filter` key" : "an EMPTY `filter`";
+    const filterState = describeUnboundedFilter(cfg.filter);
     findings.push({
       where: `${at} \xB7 node '${String(node.id)}' (${nodeType})`,
-      message: `declares \`multi: true\` with ${filterState} \u2014 this is a WHOLE-OBJECT write, by declaration: every row of '${objectName}' is ${consequence2.verb} on every run. The executor forwards \`where: {}\` plus the bulk intent, ${consequence2.dispatchNote}, and it lands on \`${consequence2.engineCall}\` with no predicate. Nothing refuses it at run time, so the only feedback is the step's \`acted\` row count \u2014 reported AFTER the rows are gone.`,
+      message: `declares \`multi: true\` with ${filterState} \u2014 this is a WHOLE-OBJECT write, by declaration: every row of '${objectName}' is ${consequence2.verb} on every run. The executor forwards the filter as \`where\` (an absent key becomes \`{}\`) plus the bulk intent, ${consequence2.dispatchNote}, and it lands on \`${consequence2.engineCall}\` bounded by nothing \u2014 a filter that reduces to TRUE constrains no row. Nothing refuses it at run time, so the only feedback is the step's \`acted\` row count \u2014 reported AFTER the rows are gone.`,
       hint: `Write the constraint you mean into \`filter\` (e.g. \`{ status: 'closed' }\` \u2014 see examples/app-showcase \`showcase_inquiry_purge\`, bulk intent bounded by a predicate). If emptying '${objectName}' really is the intent, keep it: this is a warning, not a gate, and the run-time path stays open. Distinct from the #3810 erased-condition guard, which REFUSES this node at run time when a condition you WROTE interpolated to nothing \u2014 that guard is keyed on "a written condition is gone" and deliberately not on "the filter is empty", which is the fact this rule judges at authoring time. (#5482, #5393)`,
       // Warning, not `error`: see the severity policy at the top of this file.
       // The shape has a legitimate reading the engine grants on purpose, so it is
@@ -7567,7 +8249,7 @@ function scanApprovalReviseLoops(at, nodes, edges, findings) {
 }
 function lintFlowPatterns(stack) {
   const findings = [];
-  for (const flow of asArray42(stack.flows)) {
+  for (const flow of asArray41(stack.flows)) {
     const flowName = typeof flow.name === "string" ? flow.name : "(unnamed flow)";
     const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
     const edges = Array.isArray(flow.edges) ? flow.edges : [];
@@ -7665,7 +8347,7 @@ var import_node_fs = require("fs");
 var import_meta5 = {};
 var LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
 var LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
-function asArray43(v) {
+function asArray42(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -7787,6 +8469,13 @@ var TYPE_COLLECTIONS = [
   // checks every widget on the dashboard. Registering it here is not optional
   // bookkeeping: without it the ledger would be newly correct and newly
   // silent, which is the shape this lint exists to prevent.
+  //
+  // As of #6774 the dashboard ledger warns on NOTHING — four of those five were
+  // retired in 17.0.0 (#5010) and `colorVariant` went `live` when objectui#3799
+  // gave it a renderer. The type STAYS listed, the resolved state `webhook` and
+  // `email_template` already sit in: a zero-warn entry costs one empty map
+  // lookup, and it means a future regression that re-deadens a widget key warns
+  // on its own instead of waiting for someone to notice this list again.
   { type: "dashboard", key: "dashboards" }
 ];
 function lintLivenessProperties(stack) {
@@ -7795,11 +8484,11 @@ function lintLivenessProperties(stack) {
   const findings = [];
   const objectWarn = loadWarnMap(dir, "object");
   const fieldWarn = loadWarnMap(dir, "field");
-  for (const obj of asArray43(stack.objects)) {
+  for (const obj of asArray42(stack.objects)) {
     const objName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     if (objectWarn.size > 0) checkItem("object", obj, `object '${objName}'`, objectWarn, findings);
     if (fieldWarn.size > 0) {
-      for (const field of asArray43(obj.fields)) {
+      for (const field of asArray42(obj.fields)) {
         const fieldName = typeof field.name === "string" ? field.name : "(unnamed field)";
         checkItem("field", field, `object '${objName}' \xB7 field '${fieldName}'`, fieldWarn, findings);
       }
@@ -7808,7 +8497,7 @@ function lintLivenessProperties(stack) {
   for (const { type, key } of TYPE_COLLECTIONS) {
     const warnMap = loadWarnMap(dir, type);
     if (warnMap.size === 0) continue;
-    for (const item of asArray43(stack[key])) {
+    for (const item of asArray42(stack[key])) {
       const name = typeof item.name === "string" ? item.name : typeof item.object === "string" ? item.object : `(unnamed ${type})`;
       checkItem(type, item, `${type} '${name}'`, warnMap, findings);
     }
@@ -7817,12 +8506,12 @@ function lintLivenessProperties(stack) {
 }
 
 // src/lint-autonumber-formats.ts
-var import_data7 = require("@objectstack/spec/data");
+var import_data9 = require("@objectstack/spec/data");
 var AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
 var AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
 var AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
 var AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
-function asArray44(v) {
+function asArray43(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -7831,9 +8520,9 @@ function asArray44(v) {
 }
 function lintAutonumberFormats(stack) {
   const findings = [];
-  for (const obj of asArray44(stack.objects)) {
+  for (const obj of asArray43(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
-    const fields = asArray44(obj.fields);
+    const fields = asArray43(obj.fields);
     const fieldMeta = /* @__PURE__ */ new Map();
     for (const f of fields) {
       if (typeof f.name === "string") fieldMeta.set(f.name, { required: f.required === true });
@@ -7843,8 +8532,8 @@ function lintAutonumberFormats(stack) {
       const name = typeof f.name === "string" ? f.name : "(unnamed field)";
       const fmt = typeof f.autonumberFormat === "string" ? f.autonumberFormat : typeof f.format === "string" ? f.format : "";
       if (!fmt) continue;
-      const tokens = (0, import_data7.parseAutonumberFormat)(fmt);
-      const refs = (0, import_data7.referencedFields)(tokens);
+      const tokens = (0, import_data9.parseAutonumberFormat)(fmt);
+      const refs = (0, import_data9.referencedFields)(tokens);
       const where = `object '${objectName}' \xB7 field '${name}' (autonumber "${fmt}")`;
       for (const t of tokens) {
         if (t.kind !== "literal") continue;
@@ -7898,8 +8587,8 @@ function lintAutonumberFormats(stack) {
 }
 
 // src/lint-view-refs.ts
-var import_spec3 = require("@objectstack/spec");
-function asArray45(v) {
+var import_spec5 = require("@objectstack/spec");
+function asArray44(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -7927,16 +8616,16 @@ function lintViewRefs(stack) {
     s.add(kind);
   };
   const containers = [];
-  for (const v of asArray45(stack.views)) {
+  for (const v of asArray44(stack.views)) {
     if (v.viewKind) {
       if (typeof v.name === "string") indexKind(v.name, v.viewKind === "form" ? "form" : "list");
       continue;
     }
-    if (!(0, import_spec3.isAggregatedViewContainer)(v)) continue;
+    if (!(0, import_spec5.isAggregatedViewContainer)(v)) continue;
     const object = viewContainerObjectName(v);
     if (object) containers.push({ object, container: v });
   }
-  for (const obj of asArray45(stack.objects)) {
+  for (const obj of asArray44(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
     if (!object) continue;
     if (obj.list || obj.form || obj.listViews || obj.formViews) {
@@ -7944,7 +8633,7 @@ function lintViewRefs(stack) {
     }
   }
   for (const { object, container } of containers) {
-    const { items, collisions } = (0, import_spec3.expandViewContainerWithDiagnostics)(object, container);
+    const { items, collisions } = (0, import_spec5.expandViewContainerWithDiagnostics)(object, container);
     for (const it of items) indexKind(it.name, it.viewKind);
     for (const col of collisions) {
       findings.push({
@@ -7990,11 +8679,11 @@ function lintViewRefs(stack) {
       });
     }
   };
-  for (const obj of asArray45(stack.objects)) {
+  for (const obj of asArray44(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
-    for (const action of asArray45(obj.actions)) checkAction(action, object);
+    for (const action of asArray44(obj.actions)) checkAction(action, object);
   }
-  for (const action of asArray45(stack.actions)) checkAction(action);
+  for (const action of asArray44(stack.actions)) checkAction(action);
   return findings;
 }
 
@@ -8129,6 +8818,7 @@ var CLI_ONLY = ["cli"];
 var CLI_AND_RUNTIME = ["cli", "runtime-publish"];
 var RUNTIME_NEEDS_FULL_SNAPSHOT = "P2 (#4463): reads a stack-wide collection the per-write snapshot does not carry, so running it now would report the rest of the tenant's metadata as missing rather than judging this write.";
 var RUNTIME_HEAVY_SOURCE_PARSE = "Not runtime-safe: parses authored source through typescript/sucrase, the two dependencies the kernel boot path must never load (lazy-deps.test.ts). Studio compiles page source on its own path.";
+var RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY = "Deliberate, and not a snapshot limitation: this rule needs only the written item, but every other rule on the `views[]` visibility-predicate surface (validate-visibility-predicates.ts) is CLI-only. Gating one of three sibling verdicts about the same predicate at the Studio door is less predictable than gating none; move the family together, as one measured edit.";
 var RUNTIME_OBJECT_WRITES_P2 = "P2 (#4463): judges an object/field declaration. Object writes are the hottest metadata path in the product, so P1 gates `flow` first and widens once the gate has real traffic behind it.";
 var EXPRESSION_INVALID = "expression-invalid";
 var AUTHORING_RULES = [
@@ -8158,8 +8848,12 @@ var AUTHORING_RULES = [
     }))
   },
   // ADR-0053 — `userFilters`/`quickFilters` on an object list view ("views"
-  // mode) are silently dropped: `ObjectListViewSchema` omits them, so this must
-  // read the pre-parse tier or the evidence is already gone.
+  // mode). NOT "silently dropped" any more: since #4001 `ObjectListViewSchema`
+  // is strict and refuses `quickFilters` by name, and `ObjectUserFiltersSchema`
+  // refuses `element: 'tabs'` by enum — measured under #6073, `defineStack`
+  // THROWS on both. `normalized` here therefore means "needs no parsed stack"
+  // (so `os lint`, which never parses, can run it), not "sees evidence the
+  // parse would have eaten".
   {
     name: "validateListViewMode",
     tier: "gating",
@@ -8190,9 +8884,13 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_OBJECT_WRITES_P2,
     run: (stack) => validateFunctionalCompleteness(stack)
   },
-  // A flat list-view object in `views: []` parses to an EMPTY container
-  // (ViewSchema strips unknown keys): the schema step passes, zero views
-  // register, and the Console renders nothing. Pre-parse for the same reason.
+  // A view container in `views: []` that registers zero views: nothing appears
+  // in the Console, and the schema step cannot tell it from an intentionally
+  // empty one. The FLAT-list-view arm no longer needs this tier — `ViewSchema`
+  // went strict at #4001, so `defineStack` now REFUSES `{ name, type, columns,
+  // data }` by name with the wrap-it hint (measured under #6073); the arm that
+  // still needs a rule is the all-slots-empty container, whose keys are all
+  // declared and which survives the parse untouched.
   {
     name: "validateViewContainers",
     tier: "gating",
@@ -8242,6 +8940,31 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateFilterTokens(stack)
   },
+  // #5330 — the LITERAL empty combinators (`$and: []`, `$or: []`, `$not: {}`,
+  // `{}`). #5322 ruled their RUNTIME meaning to be the boolean identity, and
+  // this rule does not touch it: it refuses the literal SPELLINGS at authoring
+  // time with a per-shape prescription, which is Prime Directive #12's standard
+  // shape (reject at the producer, never tolerate at the consumer) and #5240's
+  // same-direction precedent one shape over.
+  {
+    name: "validateEmptyCombinators",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-empty-combinators.ts",
+    // The one type #4463's P1 slice opened, and the one this rule most needs:
+    // a flow CRUD node's `config.filter` is where an empty combinator has the
+    // largest blast radius, and the write path is the only door an AI author
+    // uses. This rule needs NO resolution context at all — it judges the filter
+    // literal in isolation — so RUNTIME_NEEDS_FULL_SNAPSHOT does not apply to
+    // it, and widening to the other filter-carrying types (`object`, `view`,
+    // `page`, `dashboard`) is a one-line `runtimeTypes` edit once #4463 P2
+    // opens them at the gate. Making that call here would widen the gate's
+    // dispatch surface on this rule's authority, which is P2's decision.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => validateEmptyCombinators(stack)
+  },
   // The reference-integrity suite (#3583 §5 D5) — itself a registry, of the
   // rules that answer "does this name resolve to anything?". It reached all
   // three commands before this file existed; it is an entry here so the two
@@ -8290,6 +9013,16 @@ var AUTHORING_RULES = [
   // `displayField` (#5775) — so gating today would fail the platform's own pages
   // to enforce declarations the platform does not keep. The error upgrade is a
   // separate step, once the warning-period inventory is empty.
+  //
+  // #5775 settled the record picker's half: `displayField` is retired in favour
+  // of the `labelField` the renderer actually reads. Its claim that "the rest of
+  // the keys the renderers honour are declared" did NOT hold — #6776 found five
+  // more (`page:header` `recordChrome`/`showStar`/`showCopyId`,
+  // `page:accordion.variant`, and the tab strip's visual style, whose declared
+  // spelling `page:tabs.type` collided with the component node's own dispatch
+  // key and so was unauthorable in the flat and JSX carriers). All five are
+  // declared as of #6776, the last as the renamed `tabStyle`. What remains
+  // before the error upgrade is #5728 and two page rewrites.
   {
     name: "validateComponentProps",
     tier: "advisory",
@@ -8368,10 +9101,12 @@ var AUTHORING_RULES = [
   //
   // `gating` since #5762, which reviewed the file's rules as one family and
   // split them on a single question: is THIS STACK enough to know the flow is
-  // dead? Three rules answer yes and now emit `error` — a `config.timeRelative`
+  // dead? Four rules answer yes and emit `error` — a `config.timeRelative`
   // the spec's own `TimeRelativeTriggerSchema` refuses, one the engine's routing
-  // predicate cannot route at all, and a `record-*` triggerType outside the
-  // closed token grammar `triggerTypeToHookEvents` maps. None of those verdicts
+  // predicate cannot route at all, a `record-*` triggerType outside the
+  // closed token grammar `triggerTypeToHookEvents` maps, and (#6637) a
+  // `type: 'record_change'` flow whose triggerType the engine's binding resolver
+  // routes nowhere, silently demoting it to a manual flow. None of those verdicts
   // can be changed by installing a package, so there is no reading under which
   // the flow fires. `flow-trigger-unknown-object` deliberately stayed `warning`
   // (the object may come from another installed package — a hedge this rule
@@ -8498,12 +9233,39 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateSeedStateMachine(stack)
   },
-  // ADR-0089 D3b — deprecated visibility aliases and a mis-layered binding root.
-  // Pre-parse: the schema folds `visibleOn`/`visibility` into `visibleWhen`
-  // during parse, so the alias the author wrote is gone from `result.data`.
+  // ADR-0089 D3b — a mis-layered binding root, plus (#6128) the bare-identifier
+  // gate and (#6253) the syntax gate. This entry used to read "pre-parse: the
+  // schema folds `visibleOn`/`visibility` into `visibleWhen` during parse, so
+  // the alias the author wrote is gone from `result.data`". Measured false at
+  // #6073: the ADR-0087 D2 conversions do that fold INSIDE
+  // `normalizeStackInput`, one layer BEFORE this tier, so on every spec-valid
+  // alias site the alias-KEY rule reported zero here too.
+  //
+  // #6318 closed that: `visibility-alias-deprecated` was RETIRED rather than
+  // re-anchored. Re-anchoring would have had to move this entry's input to a
+  // pre-`normalizeStackInput` value that `runAuthoringRules` does not accept —
+  // a change to this package's external input contract, and the maintainer's
+  // call, not a rule file's. Retirement is ADR-0049 (declared ≠ enforced) and
+  // costs no author a signal: the same D2 conversion already shouts through
+  // `warnConversionNotice` in `defineStack`, naming the site, the conversion and
+  // the protocol-16 retirement window — better wording than the rule ever had.
+  //
+  // Every rule left in the family judges the predicate's VALUE, and the value
+  // moves into `visibleWhen` intact, so all three report normally on this tier.
+  // The tier therefore stays `normalized` on its SURVIVING justification (a
+  // finding still reaches the author when an unrelated schema error would stop
+  // the parse — see `AuthoringRuleInputTier`), never on the retired
+  // "pre-parse evidence" one.
+  //
+  // `gating` since #6128: `visibility-bare-identifier` emits `error`. The two
+  // ADR-0089 rules stay advisory findings within it — the tier is a property of
+  // the RULE FUNCTION (can it emit `error`?), and the per-finding severity is
+  // what decides whether any given diagnostic gates, exactly as `lintFlowPatterns`
+  // has worked since #3760. The promotion follows the #5762 precedent: a family
+  // that gains an `error` finding moves its registry tier in the same edit.
   {
     name: "validateVisibilityPredicates",
-    tier: "advisory",
+    tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-visibility-predicates.ts",
@@ -8511,6 +9273,30 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateVisibilityPredicates(stack)
   },
+  // #7010 — the same predicate surface, one question further in. The three
+  // ADR-0089 D3b rules above judge a predicate's SHAPE (does it parse, is it
+  // rooted, is the root right for the layer) and never open the target schema,
+  // so `data.tpye == 'formula'` passes all three and still resolves to nothing.
+  // This rule resolves the PATH against the schema the form edits — the closed
+  // `getMetadataTypeSchema` key set — and is therefore immune to the CEL
+  // type-name blind spot that made #6248's gate structurally unable to catch
+  // #6254's 16 bare `type ==` predicates.
+  //
+  // Scoped to schema-bound forms (`data: { provider: 'schema', schemaId }`);
+  // the `record.*` layer is deliberately out of scope because an ObjectQL
+  // object's addressable path set is NOT closed (lookup traversal, system
+  // columns, formula outputs), and an `error` gate over an open set generates
+  // false build errors. See the rule's module note.
+  {
+    name: "validatePredicatePathRefs",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-predicate-path-refs.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY,
+    run: (stack) => validatePredicatePathRefs(stack)
+  },
   // #1874 — flow authoring anti-patterns. Advisory by default; a finding marked
   // `error` gates. Three do today: `flow-runas-unscoped` (#3760 — metadata the
   // runtime REFUSES to execute), plus `flow-branch-label-unmatched` and