@objectstack/lint 17.0.0-rc.5 → 17.0.0

package/dist/runtime.js

@@ -1,9 +1,13 @@
 // src/validate-expressions.ts
-import { validateExpression, collectCelRootIdentifiers } from "@objectstack/formula";
+import { validateExpression, collectCelRootIdentifiers, parseCelToAst as parseCelToAst2, SCOPE_ROOTS } from "@objectstack/formula";
 import { collectFlowGraphs, resolveFlowNodeExpressions } from "@objectstack/spec/automation";
 
 // src/system-fields.ts
-import { FIELD_GROUP_SYSTEM_FIELDS, resolveInjectedSystemColumns } from "@objectstack/spec/data";
+import {
+  FIELD_GROUP_SYSTEM_FIELDS,
+  resolveInjectedSystemColumns,
+  unprovisionedInjectedColumns
+} from "@objectstack/spec/data";
 import { SystemFieldName } from "@objectstack/spec/system";
 var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
   ...FIELD_GROUP_SYSTEM_FIELDS,
@@ -12,6 +16,34 @@ var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
 function injectedColumnsFor(objectDef) {
   return resolveInjectedSystemColumns(objectDef).names;
 }
+function unprovisionedInjectedColumnsFor(objectDef) {
+  return new Set(unprovisionedInjectedColumns(objectDef));
+}
+function objectDefsOf(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const objects = stack.objects;
+  if (Array.isArray(objects)) return objects.filter((o) => !!o && typeof o === "object");
+  if (objects && typeof objects === "object") {
+    return Object.entries(objects).filter(([, def]) => !!def && typeof def === "object").map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function indexUnprovisionedAnchors(stack) {
+  const index = /* @__PURE__ */ new Map();
+  for (const obj of objectDefsOf(stack)) {
+    const name = typeof obj.name === "string" && obj.name.length > 0 ? obj.name : void 0;
+    if (!name) continue;
+    const anchors = unprovisionedInjectedColumnsFor(obj);
+    if (anchors.size > 0) index.set(name, anchors);
+  }
+  return index;
+}
+function unprovisionedAnchorCause(objectName, field) {
+  return `'${field}' is an injected system column with NO storage behind it: '${objectName}' is an external object (ADR-0015), so the remote database owns its schema and the platform registers this anchor without provisioning a column`;
+}
+function unprovisionedAnchorHint(objectName, field) {
+  return `If the remote table really carries '${field}', declare it in ${objectName}'s own fields (mapped through the external binding's columnMap) so the reference resolves to a column you vouch for; otherwise drop the reference, or opt the object out of the injection (\`ownership: 'none'\` for the ownership anchors, \`systemFields: { audit: false }\` for the audit family).`;
+}
 
 // src/validate-null-guards.ts
 import { parseCelToAst } from "@objectstack/formula";
@@ -245,6 +277,37 @@ function buildFieldIndex(objects) {
   }
   return idx;
 }
+var BOUND_RECORD_ROOTS = ["record", "previous"];
+function isCelNode(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function collectBoundRecordReads(source) {
+  const out = /* @__PURE__ */ new Map();
+  const ast = parseCelToAst2(source);
+  if (!ast) return out;
+  const pending = [ast];
+  while (pending.length > 0) {
+    const celNode = pending.pop();
+    if (!isCelNode(celNode)) continue;
+    if ((celNode.op === "." || celNode.op === ".?") && Array.isArray(celNode.args) && celNode.args.length >= 2) {
+      const [celRecv, seg] = celNode.args;
+      if (typeof seg === "string" && isCelNode(celRecv) && celRecv.op === "id" && typeof celRecv.args === "string" && BOUND_RECORD_ROOTS.includes(celRecv.args)) {
+        if (!out.has(seg)) out.set(seg, `${celRecv.args}.${seg}`);
+      }
+    }
+    const celArgs = celNode.args;
+    if (isCelNode(celArgs)) pending.push(celArgs);
+    else if (Array.isArray(celArgs)) {
+      for (const a of celArgs) {
+        if (isCelNode(a)) pending.push(a);
+        else if (Array.isArray(a)) {
+          for (const b of a) if (isCelNode(b)) pending.push(b);
+        }
+      }
+    }
+  }
+  return out;
+}
 function buildFieldTypeIndex(objects) {
   const idx = /* @__PURE__ */ new Map();
   for (const obj of objects) {
@@ -344,6 +407,29 @@ function validateStackExpressions(stack) {
   const fieldIndex = buildFieldIndex(objects);
   const fieldTypeIndex = buildFieldTypeIndex(objects);
   const nullableIndex = buildNullableFieldIndex(objects);
+  const unprovisionedIndex = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const anchors = unprovisionedInjectedColumnsFor(obj);
+    if (anchors.size > 0) unprovisionedIndex.set(name, anchors);
+  }
+  const warnUnprovisionedAnchors = (where, raw, objectName) => {
+    if (!objectName) return;
+    const anchors = unprovisionedIndex.get(objectName);
+    if (!anchors) return;
+    const source = celSourceOf(raw);
+    if (!source) return;
+    for (const [field, operand] of collectBoundRecordReads(source)) {
+      if (!anchors.has(field)) continue;
+      issues.push({
+        where,
+        message: `\`${operand}\` reads '${field}', an injected system column with NO storage behind it: '${objectName}' is an external object (ADR-0015), so the remote database owns its schema and the platform registers this anchor without provisioning a column. The predicate can never match a real value \u2014 on SQLite it silently degrades to constant-false (HTTP 200, zero rows, no error). If the remote table really carries this column, declare '${field}' in the object's own fields (mapped through the external binding's columnMap) so the reference resolves to a column you vouch for; otherwise drop the reference, or opt the object out of the injection (\`ownership: 'none'\` for the ownership anchors, \`systemFields: { audit: false }\` for the audit family).`,
+        source,
+        severity: "warning"
+      });
+    }
+  };
   const checkNullGuards = (where, subject, raw, objectName, outcome = "fail-closed") => {
     if (!objectName) return;
     const nullableFields = nullableIndex.get(objectName);
@@ -370,6 +456,39 @@ function validateStackExpressions(stack) {
     );
     for (const e of res.errors) issues.push({ where, message: e.message, source: e.source, severity: "error" });
     for (const w of res.warnings) issues.push({ where, message: w.message, source: w.source, severity: "warning" });
+    warnUnprovisionedAnchors(where, raw, objectName);
+  };
+  const FIELD_RULE_BOUND_ROOTS = ["record", "previous", "parent"];
+  const FIELD_RULE_USER_ROOTS = ["current_user", "user", "ctx", "os"];
+  const FIELD_RULE_SLOT_CONSEQUENCE_GENERIC = "the predicate faults, and a faulting rule never produces the verdict you declared \u2014 each slot resolves the fault to its own fallback, and none of those fallbacks is yours";
+  const FIELD_RULE_SLOT_CONSEQUENCE = {
+    visibleWhen: "the predicate faults and the renderer falls back to VISIBLE (`resolveFieldRuleState` evaluates visibility with `fallback: true`, and no server-side gate evaluates a field-level `visibleWhen` at all), leaving the field the test was meant to hide showing for everyone (#6146)",
+    readonlyWhen: "the predicate faults \u2014 and the two ends fault in OPPOSITE directions. The server treats the field as LOCKED (`isReadonlyWhenLocked` will not waive a declared lock it could not evaluate, #4889) and drops your value from the payload, while the form still renders the field editable (`fallback: false`). Per ADR-0057 D10 the server is the one that decides: the field looks writable, the save reports success, and the value silently never lands",
+    requiredWhen: "the predicate faults and the requirement is never enforced anywhere \u2014 the server logs it and SKIPS the check (fail-open, #4977 deliberately did not take #4889's carve-out) and the form does not mark the field required either, so a record saves with the field empty",
+    // Listed rather than left to the `??` below, so the map covers every slot
+    // the field walk passes and the default stays unreachable. `FieldSchema`
+    // declares this key only as a `retiredKey`, which rejects it by name, so
+    // there is no fourth runtime to measure — the honest clause is the generic
+    // one, not a fabricated fourth cell (#6716).
+    conditionalRequired: FIELD_RULE_SLOT_CONSEQUENCE_GENERIC
+  };
+  const checkFieldRuleRoot = (where, slot, raw) => {
+    const source = celSourceOf(raw);
+    if (!source) return;
+    const roots = collectCelRootIdentifiers(source);
+    if (!roots.ok) return;
+    const kept = SCOPE_ROOTS.filter(
+      (r) => !FIELD_RULE_BOUND_ROOTS.includes(r) && roots.roots.includes(r)
+    );
+    if (kept.length === 0) return;
+    const root = FIELD_RULE_USER_ROOTS.find((r) => kept.includes(r)) ?? kept[0];
+    const prescription = FIELD_RULE_USER_ROOTS.includes(root) ? `To gate the CHOICES of a select by user, move the predicate to the option's own \`visibleWhen\` (\`options: [{ \u2026, visibleWhen: \u2026 }]\`) \u2014 per-option is the one \`*When\` surface that binds \`current_user\` and its ADR-0068 aliases. To hide the FIELD by role, declare field-level security on a permission set (\`fields: { '<object>.<field>': { readable: false } }\`), which the server enforces. To gate on record state, rewrite the predicate against \`record\`.` : root === "data" ? `\`data\` is the root of a METADATA form (a \`*.form\` module \u2014 the metadata row being edited); this is an OBJECT field, whose runtime form binds the row as \`record\` \u2014 one key name, two form kinds, two roots. Rewrite \`data.<key>\` as \`record.<field>\`.` : `\`${root}\` is declared platform-wide and bound at OTHER evaluation sites (flow, automation, screen and action predicates), never at the field level. Rewrite the predicate against \`record\` (plus \`previous\`, and \`parent\` on a master-detail line item), or move the decision to a surface that binds \`${root}\`.`;
+    issues.push({
+      where,
+      message: `\`${slot}\` reads \`${root}\`, but a field-level conditional rule binds only \`record\` (plus \`previous\`, and \`parent\` on a master-detail line item) \u2014 \`${root}\` is unbound here, so ${FIELD_RULE_SLOT_CONSEQUENCE[slot] ?? FIELD_RULE_SLOT_CONSEQUENCE_GENERIC}. ` + prescription,
+      source,
+      severity: "error"
+    });
   };
   const checkDeclaredPredicate = (where, raw) => {
     if (raw == null) return;
@@ -403,7 +522,14 @@ function validateStackExpressions(stack) {
           if (retired.length > 0) {
             issues.push({
               where: `${at} \xB7 node '${node.id}' (script) callable`,
-              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + `Run \`os migrate meta --from 16\` to rewrite it automatically.`,
+              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + // #6856 route D (maintainer-ruled): the house sentence names the TOOL's
+              // behaviour, never the retired key's fate — "rewrite it" reads two ways
+              // over a branch that DELETES the key (template/recipients/variables/script),
+              // "rewrite existing sources" only one. Plain-quoted (not a template literal)
+              // so this site is a member of `retired-key-migrate-sentence.test.ts`'s
+              // widened scan (#7030) on the same textual shape as the spec corpus — no
+              // interpolation lives in this clause, so nothing is lost switching quote style.
+              "Run `os migrate meta --from 16` to rewrite existing sources automatically.",
               source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
             });
           } else if (!fn) {
@@ -437,13 +563,27 @@ function validateStackExpressions(stack) {
     for (const [fname, f] of fieldList) {
       for (const key of ["requiredWhen", "readonlyWhen", "conditionalRequired", "visibleWhen"]) {
         check(`object '${objectName}' \xB7 field '${fname}' ${key}`, f[key], objectName, "record");
+        checkFieldRuleRoot(`object '${objectName}' \xB7 field '${fname}' ${key}`, key, f[key]);
+      }
+      for (const [oi, opt] of asArray(f.options).entries()) {
+        const label2 = typeof opt.value === "string" ? `'${opt.value}'` : `#${oi}`;
+        check(
+          `object '${objectName}' \xB7 field '${fname}' option ${label2} visibleWhen`,
+          opt.visibleWhen,
+          objectName,
+          "record"
+        );
       }
-      const roWhenSource = celSourceOf(f.readonlyWhen);
-      if (masters !== 1 && roWhenSource && readsParentRoot(roWhenSource)) {
+      for (const [slot, raw, consequence2] of [
+        ["readonlyWhen", f.readonlyWhen, `the field would be locked on every write`],
+        ["requiredWhen", f.requiredWhen, `the requirement would never be enforced \u2014 the predicate faults, the server logs and skips it, and the field stays optional in the database`]
+      ]) {
+        const source = celSourceOf(raw);
+        if (masters === 1 || !source || !readsParentRoot(source)) continue;
         issues.push({
-          where: `object '${objectName}' \xB7 field '${fname}' readonlyWhen`,
-          message: `\`readonlyWhen\` reads \`parent\`, but object '${objectName}' declares ${masters === 0 ? "no" : `${masters}`} \`master_detail\` relationship${masters === 1 ? "" : "s"} \u2014 so the server has no header record to bind as \`parent\` and the field would be locked on every write. ` + (masters === 0 ? `Declare the owning relationship as \`Field.masterDetail('<master>')\`, or rewrite the predicate against \`record\`.` : `\`parent\` needs exactly one master; name the header explicitly through \`record.<fk>\` state instead, or model the extra relationship as a \`lookup\`.`),
-          source: roWhenSource,
+          where: `object '${objectName}' \xB7 field '${fname}' ${slot}`,
+          message: `\`${slot}\` reads \`parent\`, but object '${objectName}' declares ${masters === 0 ? "no" : `${masters}`} \`master_detail\` relationship${masters === 1 ? "" : "s"} \u2014 so the server has no header record to bind as \`parent\` and ${consequence2}. ` + (masters === 0 ? `Declare the owning relationship as \`Field.masterDetail('<master>')\`, or rewrite the predicate against \`record\`.` : `\`parent\` needs exactly one master; name the header explicitly through \`record.<fk>\` state instead, or model the extra relationship as a \`lookup\`.`),
+          source,
           severity: "error"
         });
       }
@@ -463,6 +603,7 @@ function validateStackExpressions(stack) {
         const fieldWhere = `object '${objectName}' \xB7 field '${fname}' expression`;
         for (const e of res.errors) issues.push({ where: fieldWhere, message: e.message, source: e.source, severity: "error" });
         for (const w of res.warnings) issues.push({ where: fieldWhere, message: w.message, source: w.source, severity: "warning" });
+        warnUnprovisionedAnchors(fieldWhere, f.expression, objectName);
       }
     }
   }
@@ -672,6 +813,46 @@ function validateFunctionalCompleteness(stack) {
   return out;
 }
 
+// src/validate-managed-api-methods.ts
+import {
+  checkManagedApiMethodAffordances,
+  describeManagedApiMethodConflicts
+} from "@objectstack/spec/data";
+var MANAGED_API_METHOD_UNAFFORDABLE = "object/managed-api-method-unaffordable";
+var isRec2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function entriesOf2(v) {
+  if (Array.isArray(v)) {
+    return v.flatMap(
+      (def, i) => isRec2(def) ? [{ name: String(def.name ?? i), def, key: `[${i}]` }] : []
+    );
+  }
+  if (isRec2(v)) {
+    return Object.entries(v).flatMap(
+      ([name, def]) => isRec2(def) ? [{ name, def: { name, ...def }, key: `.${name}` }] : []
+    );
+  }
+  return [];
+}
+function validateManagedApiMethods(stack) {
+  const out = [];
+  if (!isRec2(stack)) return out;
+  for (const [oi, obj] of entriesOf2(stack.objects).entries()) {
+    const conflicts = checkManagedApiMethodAffordances(obj.def);
+    if (conflicts.length === 0) continue;
+    const verbs = conflicts.map((c) => c.verb).join(", ");
+    const flags = [...new Set(conflicts.map((c) => c.needs))];
+    out.push({
+      severity: "error",
+      rule: MANAGED_API_METHOD_UNAFFORDABLE,
+      where: `object "${obj.name}"`,
+      path: `objects[${oi}].enable.apiMethods`,
+      message: `\`managedBy: '${String(obj.def.managedBy)}'\` object "${obj.name}" ` + describeManagedApiMethodConflicts(conflicts) + ` The registry STRIPS [${verbs}] at registration, so this declaration and the API you actually get already disagree \u2014 today the only trace is a line in the boot log.`,
+      hint: `Either add \`userActions: { ${flags.map((f) => `${f}: true`).join(", ")} }\` to the object \u2014 only if the write is genuinely one a user context may perform, and only once the guard enforcing it exists (ADR-0092 D4: affordance never ships ahead of the guard) \u2014 or remove [${verbs}] from \`enable.apiMethods\`, which is what the runtime does for you today.`
+    });
+  }
+  return out;
+}
+
 // src/validate-view-containers.ts
 var VIEW_CONTAINER_SHAPE = "view-container-shape";
 var CONTAINER_SLOT_KEYS = ["list", "form", "listViews", "formViews"];
@@ -689,10 +870,32 @@ function containerViewCount(rec) {
 function validateViewContainers(stack) {
   const out = [];
   if (!stack || typeof stack !== "object") return out;
+  const viewItems = stack.viewItems;
+  if (viewItems != null && asEntries(viewItems).length > 0) {
+    out.push({
+      severity: "error",
+      rule: VIEW_CONTAINER_SHAPE,
+      where: "viewItems",
+      path: "viewItems",
+      message: "`viewItems` is the machine-assembled channel for non-container view artifacts in runtime-assembled manifests (package export, environment artifacts) \u2014 it is not an authoring surface.",
+      hint: "Author views as defineView containers in `views:`; author a standalone view through the metadata door (Studio / `PUT /api/v1/meta/view`), not in stack source."
+    });
+  }
   for (const { key, value } of asEntries(stack.views)) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
     const rec = value;
-    if (rec.viewKind != null) continue;
+    if (rec.viewKind != null) {
+      const label3 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
+      out.push({
+        severity: "error",
+        rule: VIEW_CONTAINER_SHAPE,
+        where: `views${key}${label3}`,
+        path: `views${key}`,
+        message: "A ViewItem record is not a view container: the stack `views:` collection carries containers only \u2014 `viewKind` belongs to a single VIEW, not to the container. The registration loop refuses this entry (#5320).",
+        hint: "Wrap it in a defineView container: defineView({ list: { type, data, columns, ... }, listViews: { ... } }) \u2014 or author the standalone view through the metadata door (Studio / `PUT /api/v1/meta/view`). Machine-assembled manifests carry it under `viewItems:`."
+      });
+      continue;
+    }
     if (containerViewCount(rec) > 0) continue;
     const label2 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
     const hasContainerSlot = CONTAINER_SLOT_KEYS.some((k) => k in rec);
@@ -722,6 +925,7 @@ var MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 var WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 var WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 var DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
+var DASHBOARD_FILTER_FIELD_UNPROVISIONED = "dashboard-filter-field-unprovisioned";
 var LEGACY_ANALYTICS_KEYS = [
   "categoryField",
   "valueField",
@@ -841,6 +1045,7 @@ function validateWidgetBindings(stack) {
     }
     objectFieldTypes.set(o.name, fm);
   }
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const datasetList = asArray3(stack.datasets);
   for (let i = 0; i < datasetList.length; i++) {
     const ds = datasetList[i];
@@ -927,13 +1132,24 @@ function validateWidgetBindings(stack) {
       if (dashFilterDefs.length > 0) {
         const datasetObject = typeof dataset.object === "string" ? dataset.object : void 0;
         const objectFields = datasetObject ? objectFieldTypes.get(datasetObject) : void 0;
-        if (objectFields) {
+        const anchors = datasetObject ? unprovisionedAnchors.get(datasetObject) : void 0;
+        if (objectFields && datasetObject) {
           for (const def of dashFilterDefs) {
             const eff = effectiveFilterField(w, def);
             if (!eff) continue;
             const field = eff.field;
             if (field.includes(".")) continue;
-            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) continue;
+            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) {
+              if (anchors?.has(field)) {
+                push2({
+                  severity: "warning",
+                  rule: DASHBOARD_FILTER_FIELD_UNPROVISIONED,
+                  message: (eff.explicit ? `binds dashboard filter \`${def.name}\` to field \`${field}\` (via filterBindings), but ` : `inherits dashboard filter \`${def.name}(${field})\`, but `) + `${unprovisionedAnchorCause(datasetObject, field)}. The filter is ANDed into this widget's analytics query (#2501), so it can never match a real value \u2014 on SQLite it silently degrades to constant-false and the widget renders empty (HTTP 200, zero rows, no error).`,
+                  hint: `${unprovisionedAnchorHint(datasetObject, field)} A widget can also opt out with filterBindings: { ${def.name}: false }. Suppress with suppressWarnings: ['${DASHBOARD_FILTER_FIELD_UNPROVISIONED}'] if the remote schema resolves it some other way.`
+                });
+              }
+              continue;
+            }
             push2({
               severity: "error",
               rule: DASHBOARD_FILTER_FIELD_UNKNOWN,
@@ -1171,7 +1387,8 @@ function validateDashboardActionRefs(stack) {
 
 // src/validate-filter-tokens.ts
 import { classifyFilterToken, CONTEXT_TOKENS } from "@objectstack/spec/data";
-var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
+
+// src/filter-walk.ts
 var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
 function asArray5(v) {
   if (Array.isArray(v)) return v;
@@ -1183,7 +1400,62 @@ function asArray5(v) {
 function label(v, fallback) {
   return typeof v === "string" && v.length > 0 ? v : fallback;
 }
+function scanForFilters(node, path, where, visit, seen = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object") return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, visit, seen));
+    return;
+  }
+  for (const [k, v] of Object.entries(node)) {
+    const childPath = `${path}.${k}`;
+    if (FILTER_KEYS.has(k)) {
+      visit({ value: v, path: childPath, where });
+      continue;
+    }
+    scanForFilters(v, childPath, where, visit, seen);
+  }
+}
+function walkAuthoredFilters(stack, surfaces, visit) {
+  if (!stack || typeof stack !== "object") return;
+  for (const { key, kind } of surfaces) {
+    const items = asArray5(stack[key]);
+    items.forEach((item, i) => {
+      const name = label(item.name ?? item.id, `#${i}`);
+      if (kind === "dashboard") {
+        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
+        widgets.forEach((w, wi) => {
+          const wName = label(w.id ?? w.title, `#${wi}`);
+          scanForFilters(
+            w,
+            `${key}[${i}].widgets[${wi}]`,
+            `dashboard "${name}" \xB7 widget "${wName}"`,
+            visit,
+            /* @__PURE__ */ new Set()
+          );
+        });
+        const { widgets: _skip, ...rest } = item;
+        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, visit, /* @__PURE__ */ new Set());
+        return;
+      }
+      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, visit, /* @__PURE__ */ new Set());
+    });
+  }
+}
+
+// src/validate-filter-tokens.ts
+var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
 var KNOWN_LIST = CONTEXT_TOKENS.join("}, {");
+var TOKEN_FILTER_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" }
+];
 function walkFilterValues(node, path, where, out, seen) {
   if (node === null || node === void 0) return;
   if (typeof node === "string") {
@@ -1212,58 +1484,132 @@ function walkFilterValues(node, path, where, out, seen) {
     walkFilterValues(v, `${path}.${k}`, where, out, seen);
   }
 }
-function scanForFilters(node, path, where, out, seen) {
-  if (!node || typeof node !== "object") return;
-  if (seen.has(node)) return;
-  seen.add(node);
-  if (Array.isArray(node)) {
-    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, out, seen));
+function validateFilterTokens(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const out = [];
+  walkAuthoredFilters(stack, TOKEN_FILTER_SURFACES, ({ value, path, where }) => {
+    walkFilterValues(value, path, where, out, /* @__PURE__ */ new Set());
+  });
+  return out;
+}
+
+// src/validate-empty-combinators.ts
+import { reduceFilterVerdict } from "@objectstack/spec/data";
+var FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
+var FILTER_EMPTY_NODE = "filter-empty-node";
+var EMPTY_COMBINATOR_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" },
+  { key: "flows", kind: "flow" }
+];
+function isFilterNode(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+var VERDICT_OF = {
+  $and: reduceFilterVerdict({ $and: [] }),
+  $or: reduceFilterVerdict({ $or: [] }),
+  $not: reduceFilterVerdict({ $not: {} }),
+  node: reduceFilterVerdict({}),
+  /** One TRUE disjunct absorbs its `$or`: the sibling branches stop mattering. */
+  orWithEmptyBranch: reduceFilterVerdict({ $or: [{ status: "open" }, {}] })
+};
+function rows(verdict) {
+  if (verdict === "true") return "matches EVERY row";
+  if (verdict === "false") return "matches NO row";
+  return "carries a real predicate";
+}
+var MATCH_NONE_SPELLING = "If you really do want a predicate that selects nothing, `{ <field>: { $in: [] } }` is the declared spelling for it (an empty `$in` list matches nothing, on every backend) \u2014 it says so where an empty combinator only implies it.";
+var OMIT_THE_KEY = 'To express "no filter", DELETE the key \u2014 an absent `filter` and a filter that reduces to TRUE run identically, and only the absent key says so to the next reader (and to the next AI author that copies this metadata).';
+function emitEmptyCombinator(key, path, ctx) {
+  const spelling = key === "$not" ? "`$not: {}`" : `\`${key}: []\``;
+  const message = key === "$and" ? `\`$and: []\` is a conjunction of ZERO conditions. Under the #5322 identity ruling it ${rows(VERDICT_OF.$and)} \u2014 the key is authored, and it constrains nothing, so this surface reads as filtered and is not.` : key === "$or" ? `\`$or: []\` is a disjunction of ZERO branches. Under the #5322 identity ruling it ${rows(VERDICT_OF.$or)}: this surface renders permanently empty, and on a read scope it hides every row (fail-closed by design \u2014 #5134).` : `\`$not: {}\` negates an EMPTY node. An empty node is TRUE and NOT TRUE is FALSE, so it ${rows(VERDICT_OF.$not)} \u2014 the opposite of the "no filter" an empty operand looks like.`;
+  const hint = key === "$and" ? `${OMIT_THE_KEY} To express a constraint, put the conditions in the array. ${MATCH_NONE_SPELLING}` : key === "$or" ? `If you meant "no filter", this is its OPPOSITE: emptying the array does not relax the filter, it closes it. ${OMIT_THE_KEY} If you meant to offer alternatives, put the branches in the array. ${MATCH_NONE_SPELLING}` : `Put the condition you are negating inside \`$not\` (\`{ $not: { status: 'closed' } }\`). ${OMIT_THE_KEY} ${MATCH_NONE_SPELLING}`;
+  ctx.out.push({
+    severity: "error",
+    rule: FILTER_EMPTY_COMBINATOR,
+    where: ctx.where,
+    path,
+    message: `${message} A literal ${spelling} is not an authoring surface (#5330).`,
+    hint: `${hint} A PROGRAMMATIC producer that loops to zero operands keeps the runtime identity unchanged \u2014 this rule judges only what is written in the metadata.`
+  });
+}
+function emitEmptyNode(position, path, ctx) {
+  if (position === "root") {
+    ctx.out.push({
+      severity: "error",
+      rule: FILTER_EMPTY_NODE,
+      where: ctx.where,
+      path,
+      message: `An EMPTY filter node (\`{}\`) is authored here. Under the #5322 identity ruling an empty node is TRUE \u2014 it ${rows(VERDICT_OF.node)}, exactly as if the key were absent \u2014 so a filter is declared and enforces nothing.`,
+      hint: `${OMIT_THE_KEY} If you meant to constrain something, write the condition into the node. ${MATCH_NONE_SPELLING}`
+    });
     return;
   }
-  for (const [k, v] of Object.entries(node)) {
-    const childPath = `${path}.${k}`;
-    if (FILTER_KEYS.has(k)) {
-      walkFilterValues(v, childPath, where, out, /* @__PURE__ */ new Set());
+  if (position === "or-branch") {
+    ctx.out.push({
+      severity: "error",
+      rule: FILTER_EMPTY_NODE,
+      where: ctx.where,
+      path,
+      message: `An EMPTY branch (\`{}\`) of a \`$or\`. An empty node is TRUE, and one TRUE disjunct ABSORBS the whole disjunction (\`{ $or: [{ status: 'open' }, {}] }\` ${rows(VERDICT_OF.orWithEmptyBranch)}), so every branch you wrote beside it is dead.`,
+      hint: "Delete the empty branch \u2014 the `$or` then means what it looks like. If it was meant to carry a condition, write it. (A compiler that DROPPED the empty branch instead would silently NARROW the scope to the surviving branches, which is why the runtime absorbs rather than filters \u2014 #5297.)"
+    });
+    return;
+  }
+  ctx.out.push({
+    severity: "error",
+    rule: FILTER_EMPTY_NODE,
+    where: ctx.where,
+    path,
+    message: "An EMPTY branch (`{}`) of a `$and`. An empty node is TRUE \u2014 the AND identity \u2014 so the branch contributes no condition and the conjunction means whatever its other branches mean.",
+    hint: "Delete the empty branch, or write the condition it was meant to carry. A branch that constrains nothing is indistinguishable from one whose condition was lost in an edit."
+  });
+}
+function scanNodeKeys(node, path, ctx) {
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "$and" || key === "$or") {
+      if (!Array.isArray(value)) continue;
+      if (value.length === 0) {
+        emitEmptyCombinator(key, `${path}.${key}`, ctx);
+        continue;
+      }
+      value.forEach((element, index) => {
+        scanBranch(element, `${path}.${key}[${index}]`, key === "$and" ? "and-branch" : "or-branch", ctx);
+      });
+      continue;
+    }
+    if (key === "$not") {
+      if (!isFilterNode(value)) continue;
+      if (Object.keys(value).length === 0) {
+        emitEmptyCombinator("$not", `${path}.$not`, ctx);
+        continue;
+      }
+      scanNodeKeys(value, `${path}.$not`, ctx);
       continue;
     }
-    scanForFilters(v, childPath, where, out, seen);
   }
 }
-function validateFilterTokens(stack) {
+function scanBranch(value, path, position, ctx) {
+  if (!isFilterNode(value)) return;
+  if (Object.keys(value).length === 0) {
+    emitEmptyNode(position, path, ctx);
+    return;
+  }
+  scanNodeKeys(value, path, ctx);
+}
+function validateEmptyCombinators(stack) {
   if (!stack || typeof stack !== "object") return [];
   const out = [];
-  const surfaces = [
-    ["dashboards", "dashboard"],
-    ["objects", "object"],
-    ["views", "view"],
-    ["reports", "report"],
-    ["datasets", "dataset"],
-    ["pages", "page"],
-    ["apps", "app"]
-  ];
-  for (const [key, kind] of surfaces) {
-    const items = asArray5(stack[key]);
-    items.forEach((item, i) => {
-      const name = label(item.name ?? item.id, `#${i}`);
-      if (kind === "dashboard") {
-        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
-        widgets.forEach((w, wi) => {
-          const wName = label(w.id ?? w.title, `#${wi}`);
-          scanForFilters(
-            w,
-            `${key}[${i}].widgets[${wi}]`,
-            `dashboard "${name}" \xB7 widget "${wName}"`,
-            out,
-            /* @__PURE__ */ new Set()
-          );
-        });
-        const { widgets: _skip, ...rest } = item;
-        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, out, /* @__PURE__ */ new Set());
-        return;
-      }
-      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, out, /* @__PURE__ */ new Set());
-    });
-  }
+  walkAuthoredFilters(stack, EMPTY_COMBINATOR_SURFACES, ({ value, path, where }) => {
+    scanBranch(value, path, "root", { where, out });
+  });
   return out;
 }
 
@@ -1463,6 +1809,7 @@ function validateObjectReferences(stack) {
 // src/validate-searchable-fields.ts
 import {
   resolveSearchFieldResolution,
+  isVirtualSearchField,
   SEARCHABLE_TEXTUAL_TYPES,
   SEARCHABLE_ENUM_TYPES,
   SEARCH_AUTO_EXCLUDED_FIELDS
@@ -1476,7 +1823,7 @@ function asArray7(v) {
   }
   return [];
 }
-function isRec2(v) {
+function isRec3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName3(v) {
@@ -1552,7 +1899,7 @@ function distance2(a, b) {
 }
 function indexObjectSearchTargets(stack) {
   const fieldsByObject = /* @__PURE__ */ new Map();
-  if (!isRec2(stack)) return fieldsByObject;
+  if (!isRec3(stack)) return fieldsByObject;
   for (const obj of asArray7(stack.objects)) {
     const name = strName3(obj.name);
     if (name) fieldsByObject.set(name, declaredFieldTarget(obj));
@@ -1580,7 +1927,19 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
         where,
         path: `${path}[${i}]`,
         message: `${subject} entry "${name}" is not a field on object "${objectName}". The declaration is stale: searching it can never match, and the engine silently drops it \u2014 leaving a narrower search than declared, or the auto-default set once every entry is dropped.` + (dotted ? "" : suggest3(name, known)),
-        hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a formula field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+        hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a stored text field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+      });
+      continue;
+    }
+    if (isVirtualSearchField(target.fields[name])) {
+      const vtype = target.fields[name]?.type;
+      findings.push({
+        severity: "error",
+        rule: SEARCHABLE_FIELD_UNSEARCHABLE,
+        where,
+        path: `${path}[${i}]`,
+        message: `${subject} entry "${name}" on object "${objectName}" is a virtual '${vtype}' field: its value is computed on read and never stored, so no driver materializes a column for 'search' to scan and the entry can never match. It reads as search coverage and delivers none \u2014 the runtime used to admit it verbatim because the declaration named it (#6674).`,
+        hint: `Mirror the computed value onto a stored text field on "${objectName}" and declare that instead, or drop "${name}". At runtime the ingress gate now refuses this entry with 400 INVALID_FIELD, the same answer a stale entry gets (#4254).`
       });
       continue;
     }
@@ -1615,14 +1974,14 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       where,
       path: `${path}[${i}]`,
       message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...SEARCHABLE_TEXTUAL_TYPES, ...SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
-      hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a text/formula field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
+      hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a stored text field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
     });
   }
   return findings;
 }
 function validateSearchableFields(stack) {
   const findings = [];
-  if (!isRec2(stack)) return findings;
+  if (!isRec3(stack)) return findings;
   const objects = asArray7(stack.objects);
   const fieldsByObject = indexObjectSearchTargets(stack);
   const check = (declared, objectName, where, path, subject, role) => {
@@ -1632,7 +1991,7 @@ function validateSearchableFields(stack) {
   };
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec2(obj)) continue;
+    if (!isRec3(obj)) continue;
     const objName = strName3(obj.name);
     const label2 = objName ? `object "${objName}"` : `objects[${oi}]`;
     check(
@@ -1643,9 +2002,9 @@ function validateSearchableFields(stack) {
       "searchableFields",
       "canonical"
     );
-    if (isRec2(obj.listViews)) {
+    if (isRec3(obj.listViews)) {
       for (const [key, lv] of Object.entries(obj.listViews)) {
-        if (!isRec2(lv)) continue;
+        if (!isRec3(lv)) continue;
         check(
           lv.searchableFields,
           // A built-in list view belongs to its object; an inline `data.object`
@@ -1662,10 +2021,10 @@ function validateSearchableFields(stack) {
   const views = asArray7(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec2(view)) continue;
+    if (!isRec3(view)) continue;
     const viewLabel2 = strName3(view.name) ?? strName3(view.objectName) ?? `#${vi}`;
     const viewObject = strName3(view.objectName) ?? strName3(view.object);
-    if (isRec2(view.list)) {
+    if (isRec3(view.list)) {
       check(
         view.list.searchableFields,
         listViewObject(view.list) ?? viewObject,
@@ -1675,9 +2034,9 @@ function validateSearchableFields(stack) {
         "narrowing"
       );
     }
-    if (isRec2(view.listViews)) {
+    if (isRec3(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
-        if (!isRec2(lv)) continue;
+        if (!isRec3(lv)) continue;
         check(
           lv.searchableFields,
           listViewObject(lv) ?? viewObject,
@@ -1693,11 +2052,11 @@ function validateSearchableFields(stack) {
 }
 function listViewObject(listView) {
   const data = listView.data;
-  return isRec2(data) ? strName3(data.object) : void 0;
+  return isRec3(data) ? strName3(data.object) : void 0;
 }
 
 // src/page-walk.ts
-function isRec3(v) {
+function isRec4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName4(v) {
@@ -1710,19 +2069,19 @@ function isSourceAuthoredPage(page) {
 }
 function walkPageComponents(page, pagePath) {
   const out = [];
-  if (!isRec3(page) || isSourceAuthoredPage(page)) return out;
+  if (!isRec4(page) || isSourceAuthoredPage(page)) return out;
   const pageObject = strName4(page.object);
   const visit = (node, path, inheritedObject) => {
-    if (!isRec3(node)) return;
-    const props = isRec3(node.properties) ? node.properties : void 0;
-    const dataSource = isRec3(node.dataSource) ? node.dataSource : void 0;
+    if (!isRec4(node)) return;
+    const props = isRec4(node.properties) ? node.properties : void 0;
+    const dataSource = isRec4(node.dataSource) ? node.dataSource : void 0;
     const objectName = strName4(dataSource?.object) ?? strName4(props?.object) ?? inheritedObject;
     out.push({ component: node, path, objectName });
     if (!props) return;
     if (Array.isArray(props.items)) {
       for (let i = 0; i < props.items.length; i++) {
         const item = props.items[i];
-        if (!isRec3(item) || !Array.isArray(item.children)) continue;
+        if (!isRec4(item) || !Array.isArray(item.children)) continue;
         for (let c = 0; c < item.children.length; c++) {
           visit(item.children[c], `${path}.properties.items[${i}].children[${c}]`, objectName);
         }
@@ -1744,12 +2103,12 @@ function walkPageComponents(page, pagePath) {
   const regions = Array.isArray(page.regions) ? page.regions : [];
   for (let r = 0; r < regions.length; r++) {
     const region = regions[r];
-    if (!isRec3(region) || !Array.isArray(region.components)) continue;
+    if (!isRec4(region) || !Array.isArray(region.components)) continue;
     for (let c = 0; c < region.components.length; c++) {
       visit(region.components[c], `${pagePath}.regions[${r}].components[${c}]`, pageObject);
     }
   }
-  const slots = isRec3(page.slots) ? page.slots : void 0;
+  const slots = isRec4(page.slots) ? page.slots : void 0;
   if (slots) {
     for (const [slot, value] of Object.entries(slots)) {
       const list3 = Array.isArray(value) ? value : [value];
@@ -1934,6 +2293,15 @@ function validateActionNameRefs(stack) {
             "Navigation action item"
           );
         }
+        const runAction = strName5(nav.runAction);
+        if (nav.type === "object" && runAction) {
+          check(
+            runAction,
+            `app "${appName}" \xB7 nav "${strName5(nav.id) ?? `#${ni}`}"`,
+            `${navPath}.runAction`,
+            "Navigation deep-link auto-run"
+          );
+        }
         if (Array.isArray(nav.children)) walkNav(nav.children, `${navPath}.children`);
       }
     };
@@ -1948,6 +2316,7 @@ function validateActionNameRefs(stack) {
 
 // src/validate-page-field-bindings.ts
 var PAGE_FIELD_UNKNOWN = "page-field-unknown";
+var PAGE_FIELD_UNPROVISIONED = "page-field-unprovisioned";
 function asArray9(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -1958,7 +2327,7 @@ function asArray9(v) {
 function strName6(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function isRec4(v) {
+function isRec5(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function fieldRefsFrom(value, basePath) {
@@ -1969,7 +2338,7 @@ function fieldRefsFrom(value, basePath) {
       out.push({ name: bare, path });
       return;
     }
-    if (!isRec4(v)) return;
+    if (!isRec5(v)) return;
     const named = strName6(v.field) ?? strName6(v.name);
     if (named) out.push({ name: named, path: `${path}.${strName6(v.field) ? "field" : "name"}` });
   };
@@ -1999,8 +2368,21 @@ var COMPONENT_FIELD_SPECS = {
   "element:number": { props: ["field"] },
   "element:filter": { props: ["fields"] },
   "element:form": { props: ["fields"] },
-  // The schema says `displayField`; real pages author `labelField`. Accept both.
-  "element:record_picker": { props: ["displayField", "labelField", "searchFields"] }
+  // `labelField` is the one field-bearing prop this element declares. Its former
+  // companions `displayField` (renamed to `labelField`, ADR-0087 D2) and
+  // `searchFields` (deleted, ADR-0049) were retired in #5775 and are
+  // `retiredKey()` tombstones on `ElementRecordPickerPropsSchema` — so no
+  // spec-conformant page carries either, and this rule's job (resolve a field
+  // NAME against the object) is not the question a retired key raises (#6629).
+  //
+  // A non-conformant page that writes one anyway is not left unattended: the
+  // #5068 props gate reports the key with its rename/delete prescription. That
+  // gate is advisory and CLI-only and lives in a different registry
+  // (`authoring-rules`) from this suite, so it neither precedes nor suppresses
+  // this rule — what these two entries actually added was a SECOND finding,
+  // saying a field named by a key that no longer exists does not exist either.
+  // The prescription is the useful half; this half was noise on top of it.
+  "element:record_picker": { props: ["labelField"] }
 };
 var RELATED_LIST_TYPE = "record:related_list";
 function componentFieldRefs(type, props, basePath, sep = ".") {
@@ -2014,15 +2396,15 @@ function componentFieldRefs(type, props, basePath, sep = ".") {
     const sections = Array.isArray(props[key]) ? props[key] : [];
     for (let si = 0; si < sections.length; si++) {
       const section = sections[si];
-      if (!isRec4(section)) continue;
+      if (!isRec5(section)) continue;
       refs.push(...fieldRefsFrom(section.fields, `${basePath}${sep}${key}[${si}].fields`));
     }
   }
   return refs;
 }
 function relatedListFieldRefs(props, basePath, sep = ".") {
-  const add = isRec4(props.add) ? props.add : void 0;
-  const picker = add && isRec4(add.picker) ? add.picker : void 0;
+  const add = isRec5(props.add) ? props.add : void 0;
+  const picker = add && isRec5(add.picker) ? add.picker : void 0;
   const at = (key) => `${basePath}${sep}${key}`;
   return {
     relatedObject: strName6(props.objectName),
@@ -2043,7 +2425,7 @@ function relatedListFieldRefs(props, basePath, sep = ".") {
 }
 function indexObjectFields(stack) {
   const objectFields = /* @__PURE__ */ new Map();
-  if (!isRec4(stack)) return objectFields;
+  if (!isRec5(stack)) return objectFields;
   for (const obj of asArray9(stack.objects)) {
     const name = strName6(obj.name);
     if (!name) continue;
@@ -2056,14 +2438,27 @@ function indexObjectFields(stack) {
   }
   return objectFields;
 }
-function checkFieldRefs(refs, objectName, objectFields, where, consequence2 = "skipped") {
+function checkFieldRefs(refs, objectName, objectFields, where, consequence2 = "skipped", unprovisionedAnchors) {
   const findings = [];
   if (!objectName) return findings;
   const known = objectFields.get(objectName);
   if (!known) return findings;
+  const anchors = unprovisionedAnchors?.get(objectName);
   for (const ref of refs) {
     if (ref.name.includes(".")) continue;
-    if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) continue;
+    if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) {
+      if (anchors?.has(ref.name)) {
+        findings.push({
+          severity: "warning",
+          rule: PAGE_FIELD_UNPROVISIONED,
+          where,
+          path: ref.path,
+          message: `field "${ref.name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, ref.name)}` + (consequence2 === "queried" ? ' \u2014 it is used in a QUERY, so the predicate can never match a real value: on SQLite it silently degrades to constant-false and the surface renders an empty result that looks exactly like "there is no data".' : " \u2014 the component renders it, blank, on every record."),
+          hint: unprovisionedAnchorHint(objectName, ref.name)
+        });
+      }
+      continue;
+    }
     findings.push({
       severity: consequence2 === "queried" ? "error" : "warning",
       rule: PAGE_FIELD_UNKNOWN,
@@ -2079,17 +2474,20 @@ function validatePageFieldBindings(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const objectFields = indexObjectFields(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const pages = asArray9(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
     const pageName = strName6(page.name) ?? `#${pi}`;
     const checkRefs = (refs, objectName, where) => {
-      findings.push(...checkFieldRefs(refs, objectName, objectFields, where));
+      findings.push(
+        ...checkFieldRefs(refs, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+      );
     };
     for (const { component, path, objectName } of walkPageComponents(page, `pages[${pi}]`)) {
       const type = strName6(component.type);
-      const props = isRec4(component.properties) ? component.properties : void 0;
+      const props = isRec5(component.properties) ? component.properties : void 0;
       if (!type || !props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -2104,7 +2502,7 @@ function validatePageFieldBindings(stack) {
       if (!refs) continue;
       checkRefs(refs, objectName, where);
     }
-    const cfg = isRec4(page.interfaceConfig) ? page.interfaceConfig : void 0;
+    const cfg = isRec5(page.interfaceConfig) ? page.interfaceConfig : void 0;
     if (cfg) {
       const cfgObject = strName6(cfg.source) ?? strName6(page.object);
       const base = `pages[${pi}].interfaceConfig`;
@@ -2113,7 +2511,7 @@ function validatePageFieldBindings(stack) {
         ...sortFieldRefs(cfg.sort, `${base}.sort`),
         ...fieldRefsFrom(cfg.filterBy, `${base}.filterBy`)
       ];
-      const userFilters = isRec4(cfg.userFilters) ? cfg.userFilters : void 0;
+      const userFilters = isRec5(cfg.userFilters) ? cfg.userFilters : void 0;
       if (userFilters) {
         refs.push(...fieldRefsFrom(userFilters.fields, `${base}.userFilters.fields`));
       }
@@ -2141,7 +2539,7 @@ function strName7(v) {
 function strList2(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function isRec5(v) {
+function isRec6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function distance4(a, b) {
@@ -2270,10 +2668,10 @@ function validateChartBindings(stack) {
   const reports = asArray10(stack.reports);
   for (let ri = 0; ri < reports.length; ri++) {
     const report = reports[ri];
-    if (!isRec5(report)) continue;
+    if (!isRec6(report)) continue;
     const reportName = strName7(report.name) ?? `#${ri}`;
     const checkReportChart = (chart, dataset, values, where, path) => {
-      if (!isRec5(chart)) return;
+      if (!isRec6(chart)) return;
       check({
         dataset,
         // `values` is the report's measure SELECTION, not a chart ref; feeding
@@ -2297,7 +2695,7 @@ function validateChartBindings(stack) {
     const blocks = Array.isArray(report.blocks) ? report.blocks : [];
     for (let bi = 0; bi < blocks.length; bi++) {
       const block = blocks[bi];
-      if (!isRec5(block)) continue;
+      if (!isRec6(block)) continue;
       checkReportChart(
         block.chart,
         strName7(block.dataset),
@@ -2308,9 +2706,9 @@ function validateChartBindings(stack) {
     }
   }
   const checkListChart = (container, where, path) => {
-    if (!isRec5(container)) return;
+    if (!isRec6(container)) return;
     const chart = container.chart;
-    if (!isRec5(chart)) return;
+    if (!isRec6(chart)) return;
     check({
       dataset: strName7(chart.dataset),
       dimensions: { names: strList2(chart.dimensions), path: `${path}.chart.dimensions` },
@@ -2322,10 +2720,10 @@ function validateChartBindings(stack) {
   const views = asArray10(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec5(view)) continue;
+    if (!isRec6(view)) continue;
     const viewName = strName7(view.name) ?? strName7(view.objectName) ?? `#${vi}`;
     checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
-    if (isRec5(view.listViews)) {
+    if (isRec6(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
         checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
       }
@@ -2334,7 +2732,7 @@ function validateChartBindings(stack) {
   const objects = asArray10(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec5(obj) || !isRec5(obj.listViews)) continue;
+    if (!isRec6(obj) || !isRec6(obj.listViews)) continue;
     const objName = strName7(obj.name) ?? `#${oi}`;
     for (const [key, lv] of Object.entries(obj.listViews)) {
       checkListChart(
@@ -2347,10 +2745,10 @@ function validateChartBindings(stack) {
   const pages = asArray10(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec5(page)) continue;
+    if (!isRec6(page)) continue;
     const pageName = strName7(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const props = isRec5(component.properties) ? component.properties : void 0;
+      const props = isRec6(component.properties) ? component.properties : void 0;
       if (!props || !strName7(props.dataset)) continue;
       const axisRefs = asArray10(props.yAxis).map((a, ai) => ({ name: strName7(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
       const seriesRefs = asArray10(props.series).map((s, si) => ({ name: strName7(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
@@ -2500,10 +2898,10 @@ function validateNavAccess(stack) {
 
 // src/validate-nav-target-refs.ts
 var NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
-var isRec6 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec7 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray13(v) {
-  if (Array.isArray(v)) return v.filter(isRec6);
-  if (isRec6(v)) return Object.entries(v).map(([name, def]) => isRec6(def) ? { name, ...def } : { name });
+  if (Array.isArray(v)) return v.filter(isRec7);
+  if (isRec7(v)) return Object.entries(v).map(([name, def]) => isRec7(def) ? { name, ...def } : { name });
   return [];
 }
 function strName9(v) {
@@ -2525,7 +2923,7 @@ function namesOf(collection) {
 }
 function validateNavTargetRefs(stack) {
   const findings = [];
-  if (!isRec6(stack)) return findings;
+  if (!isRec7(stack)) return findings;
   const apps = asArray13(stack.apps);
   if (apps.length === 0) return findings;
   const declared = /* @__PURE__ */ new Map();
@@ -2537,7 +2935,7 @@ function validateNavTargetRefs(stack) {
     const walk = (items, basePath) => {
       if (!Array.isArray(items)) return;
       for (const [ni, raw] of items.entries()) {
-        if (!isRec6(raw)) continue;
+        if (!isRec7(raw)) continue;
         const nav = raw;
         const navPath = `${basePath}[${ni}]`;
         for (const [type, prop, collection, noun] of NAV_TARGETS) {
@@ -2568,34 +2966,141 @@ function validateNavTargetRefs(stack) {
   return findings;
 }
 
-// src/validate-translation-references.ts
-import { hasPlatformObjectPrefix as hasPlatformObjectPrefix2, isPlatformProvidedObjectName as isPlatformProvidedObjectName3 } from "@objectstack/spec/system";
-var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
-var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec7(v) {
-  return !!v && typeof v === "object" && !Array.isArray(v);
-}
+// src/validate-nav-object-servability.ts
+import { canServeApiOperation } from "@objectstack/spec/data";
+var NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
+var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray14(v) {
-  if (Array.isArray(v)) return v;
-  if (isRec7(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec7(def) ? def : {} }));
+  if (Array.isArray(v)) return v.filter(isRec8);
+  if (isRec8(v)) return Object.entries(v).map(([name, def]) => isRec8(def) ? { name, ...def } : { name });
   return [];
 }
 function strName10(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function distance5(a, b) {
-  const m = a.length;
-  const n = b.length;
-  if (m === 0) return n;
-  if (n === 0) return m;
-  let prev = Array.from({ length: n + 1 }, (_, j) => j);
-  for (let i = 1; i <= m; i++) {
-    const curr = [i, ...new Array(n).fill(0)];
-    for (let j = 1; j <= n; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+var isInterpolated3 = (s) => s.includes("${") || s.includes("{");
+function validateNavObjectServability(stack) {
+  const findings = [];
+  if (!isRec8(stack)) return findings;
+  const apps = asArray14(stack.apps);
+  if (apps.length === 0) return findings;
+  const ownEnable = /* @__PURE__ */ new Map();
+  const objects = asArray14(stack.objects);
+  for (const [oi, obj] of objects.entries()) {
+    const n = strName10(obj.name);
+    if (!n) continue;
+    ownEnable.set(n, { enable: obj.enable, path: `objects[${oi}].enable` });
+  }
+  if (ownEnable.size === 0) return findings;
+  for (const [ai, app] of apps.entries()) {
+    const appName = strName10(app.name) ?? `#${ai}`;
+    const walk = (items, basePath) => {
+      if (!Array.isArray(items)) return;
+      for (const [ni, raw] of items.entries()) {
+        if (!isRec8(raw)) continue;
+        const nav = raw;
+        const navPath = `${basePath}[${ni}]`;
+        if (nav.type === "object") {
+          const target = strName10(nav.objectName);
+          const declared = target && !isInterpolated3(target) ? ownEnable.get(target) : void 0;
+          if (target && declared && !canServeApiOperation(declared.enable, "list")) {
+            const enable = isRec8(declared.enable) ? declared.enable : {};
+            const apiDisabled = enable.apiEnabled === false;
+            const condition = apiDisabled ? "`enable.apiEnabled: false`" : "`enable.apiMethods` does not grant `list`" + (Array.isArray(enable.apiMethods) ? ` (declared: ${enable.apiMethods.length === 0 ? "[] \u2014 deny-all" : enable.apiMethods.map((m) => `\`${String(m)}\``).join(", ")})` : "");
+            const answer = apiDisabled ? "404 `OBJECT_API_DISABLED`" : "405 `OBJECT_API_METHOD_NOT_ALLOWED`";
+            const offendingKey = apiDisabled ? `${declared.path}.apiEnabled` : `${declared.path}.apiMethods`;
+            findings.push({
+              severity: "error",
+              rule: NAV_OBJECT_UNSERVABLE,
+              where: `app "${appName}" \xB7 nav "${strName10(nav.id) ?? strName10(nav.label) ?? `#${ni}`}"`,
+              // The nav entry is where the dead row is authored; the `enable`
+              // key that condemns it is named in the message, because the fix
+              // may belong at either end.
+              path: `${navPath}.objectName`,
+              message: `Navigation targets object "${target}", which cannot serve a list: ${condition} (\`${offendingKey}\`), so the list request answers ${answer} for EVERY user \u2014 platform administrators included, since that gate reads only the object's \`enable\` block and never the caller. The entry cannot be rescued with \`requiredPermissions\`: they are independent conditions. The server prunes this entry from the served \`/meta\` payload (#7912), so publishing it ships a menu row that silently is not there.`,
+              hint: `Remove the nav entry, or make "${target}" listable by setting \`enable.apiEnabled: true\` and granting \`list\` in \`enable.apiMethods\`. \u26D4 Do NOT open the API on an object that is disabled on purpose \u2014 several platform objects hold credential material and are API-disabled deliberately; for those the entry is the mistake, not the \`enable\` block.`
+            });
+          }
+        }
+        if (Array.isArray(nav.children)) walk(nav.children, `${navPath}.children`);
+      }
+    };
+    walk(app.navigation, `apps[${ai}].navigation`);
+    for (const [ari, area] of asArray14(app.areas).entries()) {
+      walk(area.items, `apps[${ai}].areas[${ari}].items`);
+      walk(area.navigation, `apps[${ai}].areas[${ari}].navigation`);
     }
-    prev = curr;
+  }
+  return findings;
+}
+
+// src/validate-translation-references.ts
+import { expandViewContainer } from "@objectstack/spec";
+import { hasPlatformObjectPrefix as hasPlatformObjectPrefix2, isPlatformProvidedObjectName as isPlatformProvidedObjectName3 } from "@objectstack/spec/system";
+
+// src/view-walk.ts
+function isRec9(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName11(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function viewObjectName(view) {
+  return strName11(view.objectName) ?? strName11(view.object) ?? (isRec9(view.data) ? strName11(view.data.object) : void 0);
+}
+function viewContainerSites(view, basePath) {
+  if (!isRec9(view)) return [];
+  const sites = [{ view, path: basePath, surface: "", kind: "self" }];
+  if (isRec9(view.form)) {
+    sites.push({ view: view.form, path: `${basePath}.form`, surface: "form", kind: "form" });
+  }
+  for (const key of ["listViews", "formViews"]) {
+    const container = view[key];
+    if (!isRec9(container)) continue;
+    const kind = key === "listViews" ? "listView" : "formView";
+    for (const [subKey, sub] of Object.entries(container)) {
+      if (!isRec9(sub)) continue;
+      sites.push({
+        view: sub,
+        path: `${basePath}.${key}.${subKey}`,
+        surface: `${key}.${subKey}`,
+        kind
+      });
+    }
+  }
+  return sites;
+}
+function formViewSites(view, basePath) {
+  return viewContainerSites(view, basePath).filter((site) => site.kind !== "listView");
+}
+
+// src/validate-translation-references.ts
+var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
+var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
+function isRec10(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function asArray15(v) {
+  if (Array.isArray(v)) return v;
+  if (isRec10(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec10(def) ? def : {} }));
+  return [];
+}
+function strName12(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function distance5(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
   }
   return prev[n];
 }
@@ -2640,30 +3145,52 @@ function collectViewRecord(view, factsFor) {
   };
   const addSections = (container, binding) => {
     if (!binding) return;
-    for (const section of asArray14(container.sections)) {
-      const sectionName = strName10(section.name);
+    for (const section of asArray15(container.sections)) {
+      const sectionName = strName12(section.name);
       if (sectionName) factsFor(binding).sections.add(sectionName);
     }
   };
-  const listBinding = isRec7(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec7(view.list)) addView(listBinding, strName10(view.list.name));
-  addView(recordObject ?? listBinding, strName10(view.name));
-  for (const key of ["listViews", "formViews"]) {
-    const container = view[key];
-    if (!isRec7(container)) continue;
-    for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec7(sub)) continue;
+  const listBinding = isRec10(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec10(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
+  addView(recordObject ?? listBinding, strName12(view.name));
+  const named = namedViewKeys(view);
+  for (const family of ["listViews", "formViews"]) {
+    const container = view[family];
+    if (!isRec10(container)) continue;
+    const registryKeys = family === "listViews" ? named.list : named.form;
+    let at = 0;
+    for (const sub of Object.values(container)) {
+      if (!sub || typeof sub !== "object") continue;
+      const registryKey = registryKeys[at++];
+      if (!isRec10(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
-      addView(binding, subKey);
-      addView(binding, strName10(sub.name));
+      addView(binding, registryKey);
       addSections(sub, binding);
     }
   }
-  if (isRec7(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  if (isRec10(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
   addSections(view, recordObject ?? listBinding);
 }
-function viewObjectName(view) {
-  return strName10(view.objectName) ?? strName10(view.object) ?? (isRec7(view.data) ? strName10(view.data.object) : void 0);
+function defaultListViewKey(object, container) {
+  if (!object || !isRec10(container.list)) return void 0;
+  const item = expandViewContainer(object, container).find(
+    (i) => i.viewKind === "list" && i.isDefault
+  );
+  if (!item) return void 0;
+  const prefix = `${object}.`;
+  return item.name.startsWith(prefix) ? item.name.slice(prefix.length) : item.name;
+}
+function namedViewKeys(container) {
+  const object = "probe";
+  const prefix = `${object}.`;
+  const bare = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : name;
+  const countEntries = (v) => isRec10(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
+  const listCount = countEntries(container.listViews);
+  const formCount = countEntries(container.formViews);
+  if (!listCount && !formCount) return { list: [], form: [] };
+  const items = expandViewContainer(object, container);
+  const keysOf2 = (kind, count) => items.filter((i) => i.viewKind === kind).slice(0, count).map((i) => bare(i.name));
+  return { list: keysOf2("list", listCount), form: keysOf2("form", formCount) };
 }
 function readOptions(field) {
   const raw = field.options;
@@ -2675,14 +3202,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec7(opt)) continue;
-      const value = strName10(opt.value);
+      if (!isRec10(opt)) continue;
+      const value = strName12(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName10(opt.label);
+      const label2 = strName12(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec7(raw)) {
+  } else if (isRec10(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -2702,48 +3229,48 @@ function buildUniverse(stack) {
     }
     return facts;
   };
-  for (const obj of asArray14(stack.objects)) {
-    const objectName = strName10(obj.name);
+  for (const obj of asArray15(stack.objects)) {
+    const objectName = strName12(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
-    for (const field of asArray14(obj.fields)) {
-      const fieldName = strName10(field.name);
+    for (const field of asArray15(obj.fields)) {
+      const fieldName = strName12(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
-    for (const action of asArray14(obj.actions)) {
-      const actionName = strName10(action.name);
+    for (const action of asArray15(obj.actions)) {
+      const actionName = strName12(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
-    for (const view of asArray14(obj.views)) {
-      collectViewRecord({ ...view, object: strName10(view.object) ?? objectName }, factsFor);
+    for (const view of asArray15(obj.views)) {
+      collectViewRecord({ ...view, object: strName12(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
-    for (const group of asArray14(obj.fieldGroups)) {
-      const key = strName10(group.key) ?? strName10(group.name);
+    for (const group of asArray15(obj.fieldGroups)) {
+      const key = strName12(group.key) ?? strName12(group.name);
       if (key) facts.sections.add(key);
     }
   }
-  for (const view of asArray14(stack.views)) {
+  for (const view of asArray15(stack.views)) {
     collectViewRecord(view, factsFor);
   }
-  const pages = asArray14(stack.pages);
+  const pages = asArray15(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec7(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec10(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      for (const section of asArray14(props.sections)) {
-        const sectionName = strName10(section.name);
+      for (const section of asArray15(props.sections)) {
+        const sectionName = strName12(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
   }
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
-  for (const action of asArray14(stack.actions)) {
-    const actionName = strName10(action.name);
+  for (const action of asArray15(stack.actions)) {
+    const actionName = strName12(action.name);
     if (!actionName) continue;
-    const owner = strName10(action.objectName) ?? strName10(action.object);
+    const owner = strName12(action.objectName) ?? strName12(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -2757,41 +3284,41 @@ function buildUniverse(stack) {
     }
   }
   const apps = /* @__PURE__ */ new Map();
-  for (const app of asArray14(stack.apps)) {
-    const appName = strName10(app.name);
+  for (const app of asArray15(stack.apps)) {
+    const appName = strName12(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
-      for (const item of asArray14(items)) {
-        const id = strName10(item.id);
+      for (const item of asArray15(items)) {
+        const id = strName12(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
-    for (const area of asArray14(app.areas)) {
-      const areaId = strName10(area.id);
+    for (const area of asArray15(app.areas)) {
+      const areaId = strName12(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
     apps.set(appName, navIds);
   }
   const dashboards = /* @__PURE__ */ new Map();
-  for (const dash of asArray14(stack.dashboards)) {
-    const dashName = strName10(dash.name);
+  for (const dash of asArray15(stack.dashboards)) {
+    const dashName = strName12(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
-    for (const widget of asArray14(dash.widgets)) {
-      const id = strName10(widget.id) ?? strName10(widget.name);
+    for (const widget of asArray15(dash.widgets)) {
+      const id = strName12(widget.id) ?? strName12(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray14(isRec7(dash.header) ? dash.header.actions : void 0),
-      ...asArray14(dash.actions)
+      ...asArray15(isRec10(dash.header) ? dash.header.actions : void 0),
+      ...asArray15(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName10(action.actionUrl) ?? strName10(action.url) ?? strName10(action.name);
+      const key = strName12(action.actionUrl) ?? strName12(action.url) ?? strName12(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -2803,7 +3330,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec7(stack)) return findings;
+  if (!isRec10(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -2812,13 +3339,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec7(bundle)) continue;
+    if (!isRec10(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec7(rawData)) continue;
+      if (!isRec10(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec7(rawNode)) continue;
+        if (!isRec10(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -2844,7 +3371,7 @@ function validateTranslationReferences(stack) {
             );
             continue;
           }
-          if (!isRec7(rawField)) continue;
+          if (!isRec10(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -2926,7 +3453,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec7(rawApp)) continue;
+        if (!isRec10(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
@@ -2949,7 +3476,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec7(rawDash)) continue;
+        if (!isRec10(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
@@ -2974,7 +3501,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec7(v) ? v : {};
+  return isRec10(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -2986,7 +3513,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName10(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName12(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -3005,11 +3532,11 @@ function checkOptionKeys(findings, ctx) {
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec7(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec10(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
-  for (const param of asArray14(ctx.action.params)) {
-    const name = strName10(param.name) ?? strName10(param.field);
+  for (const param of asArray15(ctx.action.params)) {
+    const name = strName12(param.name) ?? strName12(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -3025,78 +3552,60 @@ function checkActionParams(findings, ctx) {
   }
 }
 
-// src/validate-translatable-sections.ts
-var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
-function isRec8(v) {
+// src/collection-entries.ts
+function isRec11(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName11(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function viewObjectName2(view) {
-  return strName11(view.objectName) ?? strName11(view.object) ?? (isRec8(view.data) ? strName11(view.data.object) : void 0);
-}
 function collectionEntries(v, base) {
   if (Array.isArray(v)) {
     const out = [];
     for (let i = 0; i < v.length; i++) {
-      if (isRec8(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
+      if (isRec11(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
     }
     return out;
   }
-  if (isRec8(v)) {
-    return Object.entries(v).filter(([, def]) => isRec8(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
+  if (isRec11(v)) {
+    return Object.entries(v).filter(([, def]) => isRec11(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
   }
   return [];
 }
+
+// src/validate-translatable-sections.ts
+var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
+function isRec12(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName13(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
 function viewLabel(view) {
-  const name = strName11(view.name);
+  const name = strName13(view.name);
   return name ? `view "${name}"` : "";
 }
 function joinWhere(...parts) {
   return parts.filter((p) => p.length > 0).join(" \xB7 ");
 }
 function collectViewSites(view, basePath, label2, sites) {
-  const recordObject = viewObjectName2(view);
-  const listBinding = isRec8(view.list) ? viewObjectName2(view.list) ?? recordObject : void 0;
-  const bindingOf = (container) => viewObjectName2(container) ?? recordObject;
-  sites.push({
-    path: `${basePath}.sections`,
-    surface: label2,
-    objectName: recordObject ?? listBinding,
-    sections: view.sections
-  });
-  if (isRec8(view.form)) {
+  const recordObject = viewObjectName(view);
+  const listBinding = isRec12(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
+  for (const site of viewContainerSites(view, basePath)) {
     sites.push({
-      path: `${basePath}.form.sections`,
-      surface: joinWhere(label2, "form"),
-      objectName: bindingOf(view.form) ?? listBinding,
-      sections: view.form.sections
+      path: `${site.path}.sections`,
+      surface: joinWhere(label2, site.surface),
+      objectName: viewObjectName(site.view) ?? recordObject ?? listBinding,
+      sections: site.view.sections
     });
   }
-  for (const key of ["listViews", "formViews"]) {
-    const container = view[key];
-    if (!isRec8(container)) continue;
-    for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec8(sub)) continue;
-      sites.push({
-        path: `${basePath}.${key}.${subKey}.sections`,
-        surface: joinWhere(label2, `${key}.${subKey}`),
-        objectName: bindingOf(sub) ?? listBinding,
-        sections: sub.sections
-      });
-    }
-  }
 }
 function translatedObjectNames(stack) {
   const out = /* @__PURE__ */ new Set();
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   for (const bundle of bundles) {
-    if (!isRec8(bundle)) continue;
+    if (!isRec12(bundle)) continue;
     for (const data of Object.values(bundle)) {
-      if (!isRec8(data) || !isRec8(data.objects)) continue;
+      if (!isRec12(data) || !isRec12(data.objects)) continue;
       for (const [objectName, node] of Object.entries(data.objects)) {
-        if (isRec8(node)) out.add(objectName);
+        if (isRec12(node)) out.add(objectName);
       }
     }
   }
@@ -3108,22 +3617,22 @@ function suggestedName(label2) {
 }
 function validateTranslatableSections(stack) {
   const findings = [];
-  if (!isRec8(stack)) return findings;
+  if (!isRec12(stack)) return findings;
   const translated = translatedObjectNames(stack);
   if (translated.size === 0) return findings;
   const sites = [];
   for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
-    const objectName = strName11(obj.name);
+    const objectName = strName13(obj.name);
     if (!objectName) continue;
     for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
       collectViewSites(
-        { ...view, object: strName11(view.object) ?? objectName },
+        { ...view, object: strName13(view.object) ?? objectName },
         path,
         viewLabel(view),
         sites
       );
     }
-    if (isRec8(obj.listViews)) {
+    if (isRec12(obj.listViews)) {
       collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
     }
   }
@@ -3131,13 +3640,13 @@ function validateTranslatableSections(stack) {
     collectViewSites(view, path, viewLabel(view), sites);
   }
   for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
-    const pageName = strName11(page.name);
+    const pageName = strName13(page.name);
     const pageLabel = pageName ? `page "${pageName}"` : "";
     for (const walked of walkPageComponents(page, pagePath)) {
       if (!walked.objectName) continue;
-      const props = isRec8(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec12(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      const type = strName11(walked.component.type) ?? "component";
+      const type = strName13(walked.component.type) ?? "component";
       sites.push({
         path: `${walked.path}.properties.sections`,
         surface: joinWhere(pageLabel, type),
@@ -3152,9 +3661,9 @@ function validateTranslatableSections(stack) {
     if (!Array.isArray(site.sections)) continue;
     for (let i = 0; i < site.sections.length; i++) {
       const section = site.sections[i];
-      if (!isRec8(section)) continue;
-      if (strName11(section.name)) continue;
-      const heading = strName11(section.label) ?? strName11(section.title);
+      if (!isRec12(section)) continue;
+      if (strName13(section.name)) continue;
+      const heading = strName13(section.label);
       if (!heading) continue;
       const slug = suggestedName(heading);
       findings.push({
@@ -3172,10 +3681,10 @@ function validateTranslatableSections(stack) {
 
 // src/flow-walk.ts
 import { FLOW_REGION_SLOTS_BY_TYPE, FLOW_REGION_CONFIG_KEYS } from "@objectstack/spec/automation";
-function isRec9(v) {
+function isRec13(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName12(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var REGION_SLOTS = new Map(
@@ -3184,10 +3693,10 @@ var REGION_SLOTS = new Map(
 var REGION_CONFIG_KEYS = FLOW_REGION_CONFIG_KEYS;
 var MAX_REGION_DEPTH = 16;
 function flowNodeLabel(node, index) {
-  return strName12(node.label) ?? strName12(node.id) ?? `#${index}`;
+  return strName14(node.label) ?? strName14(node.id) ?? `#${index}`;
 }
 function stripRegions(config) {
-  if (!isRec9(config)) return void 0;
+  if (!isRec13(config)) return void 0;
   let out;
   for (const key of Object.keys(config)) {
     if (!REGION_CONFIG_KEYS.has(key)) continue;
@@ -3198,11 +3707,11 @@ function stripRegions(config) {
 }
 function walkFlowNodes(flow, flowPath) {
   const out = [];
-  if (!isRec9(flow)) return out;
+  if (!isRec13(flow)) return out;
   const visitList = (nodes, basePath, trail, depth) => {
     if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
     nodes.forEach((raw, index) => {
-      if (!isRec9(raw)) return;
+      if (!isRec13(raw)) return;
       const path = `${basePath}[${index}]`;
       out.push({
         node: raw,
@@ -3211,9 +3720,9 @@ function walkFlowNodes(flow, flowPath) {
         regionTrail: trail,
         depth
       });
-      const type = strName12(raw.type);
+      const type = strName14(raw.type);
       const slots = type ? REGION_SLOTS.get(type) : void 0;
-      if (!slots || !isRec9(raw.config)) return;
+      if (!slots || !isRec13(raw.config)) return;
       const config = raw.config;
       const here = `${type} "${flowNodeLabel(raw, index)}"`;
       for (const slot of slots) {
@@ -3221,8 +3730,8 @@ function walkFlowNodes(flow, flowPath) {
         if (slot === "branches") {
           if (!Array.isArray(value)) continue;
           value.forEach((branch, b) => {
-            if (!isRec9(branch)) return;
-            const branchName = strName12(branch.name) ?? `#${b}`;
+            if (!isRec13(branch)) return;
+            const branchName = strName14(branch.name) ?? `#${b}`;
             visitList(
               branch.nodes,
               `${path}.config.branches[${b}].nodes`,
@@ -3232,7 +3741,7 @@ function walkFlowNodes(flow, flowPath) {
           });
           continue;
         }
-        if (!isRec9(value)) continue;
+        if (!isRec13(value)) continue;
         visitList(
           value.nodes,
           `${path}.config.${slot}.nodes`,
@@ -3252,7 +3761,8 @@ function joinTrail(trail, segment) {
 // src/validate-flow-template-paths.ts
 var FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 var FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
-function asArray15(v) {
+var FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
+function asArray16(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({
@@ -3281,7 +3791,7 @@ var FILTER_GUARDED_NODE_TYPES = /* @__PURE__ */ new Set([
 ]);
 function fieldTypesOf(obj) {
   const types = /* @__PURE__ */ new Map();
-  for (const f of asArray15(obj.fields)) {
+  for (const f of asArray16(obj.fields)) {
     if (typeof f.name === "string") {
       types.set(f.name, typeof f.type === "string" ? f.type : "");
     }
@@ -3378,10 +3888,10 @@ function declaredExpandOf(flow) {
 }
 function validateFlowTemplatePaths(stack) {
   const findings = [];
-  const flows = asArray15(stack.flows);
+  const flows = asArray16(stack.flows);
   if (flows.length === 0) return findings;
   const objectsByName = /* @__PURE__ */ new Map();
-  for (const obj of asArray15(stack.objects)) {
+  for (const obj of asArray16(stack.objects)) {
     if (typeof obj.name === "string") objectsByName.set(obj.name, obj);
   }
   flows.forEach((flow, flowIndex) => {
@@ -3394,6 +3904,7 @@ function validateFlowTemplatePaths(stack) {
     const obj = objectsByName.get(objectName);
     if (!obj) return;
     const fieldTypes = fieldTypesOf(obj);
+    const unprovisionedAnchors = unprovisionedInjectedColumnsFor(obj);
     const expandSet = declaredExpandOf(flow);
     walkFlowNodes(flow, `flows[${flowIndex}]`).forEach(({ node, path: nodePath, regionTrail, localConfig }, walkIndex) => {
       const nodeLabel = typeof node.type === "string" ? node.type : typeof node.id === "string" ? node.id : `#${walkIndex}`;
@@ -3405,6 +3916,7 @@ function validateFlowTemplatePaths(stack) {
       if (leaves.length === 0) return;
       const seenUnknown = /* @__PURE__ */ new Set();
       const seenTraversal = /* @__PURE__ */ new Set();
+      const seenUnprovisioned = /* @__PURE__ */ new Set();
       for (const leaf of leaves) {
         const inFilter = leaf.inFilter;
         for (const rest of recordRefsIn(leaf.text)) {
@@ -3412,6 +3924,19 @@ function validateFlowTemplatePaths(stack) {
           const hasSubPath = rest.length > 1;
           const nextIsIdentifier = hasSubPath && !/^\d+$/.test(rest[1]);
           const isKnown = fieldTypes.has(head) || IMPLICIT_HEADS.has(head);
+          if (unprovisionedAnchors.has(head)) {
+            if (!seenUnprovisioned.has(head)) {
+              seenUnprovisioned.add(head);
+              findings.push({
+                severity: "warning",
+                rule: FLOW_TEMPLATE_FIELD_UNPROVISIONED,
+                where,
+                path: nodePath,
+                message: (inFilter ? `${nodeType} filter references ` : "template references ") + `'{record.${rest.join(".")}}', and ${unprovisionedAnchorCause(objectName, head)} \u2014 ` + (inFilter ? `the token resolves to nothing on every run, which DROPS the condition from the query instead of narrowing it; the node then refuses to run at execution time (#3810).` : `the token resolves to an empty string on every run (silently).`),
+                hint: unprovisionedAnchorHint(objectName, head)
+              });
+            }
+          }
           if (!isKnown) {
             if (seenUnknown.has(head)) continue;
             seenUnknown.add(head);
@@ -3450,14 +3975,14 @@ function validateFlowTemplatePaths(stack) {
 
 // src/validate-ai-surface-affinity.ts
 var AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
-function asArray16(v) {
+function asArray17(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName13(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -3467,18 +3992,18 @@ function validateAiSurfaceAffinity(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
-  for (const skill of asArray16(stack.skills)) {
-    const n = strName13(skill.name);
+  for (const skill of asArray17(stack.skills)) {
+    const n = strName15(skill.name);
     if (n) skillsByName.set(n, skill);
   }
-  const agents = asArray16(stack.agents);
+  const agents = asArray17(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName13(agent.name) ?? `#${ai}`;
+    const agentName = strName15(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName13(skillRefs[si]);
+      const ref = strName15(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -3500,14 +4025,14 @@ function validateAiSurfaceAffinity(stack) {
 // src/validate-ai-tool-references.ts
 import { PLATFORM_PROVIDED_TOOL_NAMES, PLATFORM_TOOL_FAMILY_PREFIXES } from "@objectstack/spec/system";
 var AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
-function asArray17(v) {
+function asArray18(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName14(v) {
+function strName16(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance6(a, b) {
@@ -3548,26 +4073,26 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName14(aiRec.description)) return false;
-  const type = strName14(action.type);
+  if (!strName16(aiRec.description)) return false;
+  const type = strName16(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
 }
 function collectToolUniverse(stack) {
   const universe = new Set(PLATFORM_PROVIDED_TOOL_NAMES);
-  for (const tool of asArray17(stack.tools)) {
-    const n = strName14(tool.name);
+  for (const tool of asArray18(stack.tools)) {
+    const n = strName16(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
-    for (const action of asArray17(actions)) {
-      const n = strName14(action.name);
+    for (const action of asArray18(actions)) {
+      const n = strName16(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
   addActionFamily(stack.actions);
-  for (const obj of asArray17(stack.objects)) {
+  for (const obj of asArray18(stack.objects)) {
     addActionFamily(obj.actions);
   }
   return universe;
@@ -3575,13 +4100,13 @@ function collectToolUniverse(stack) {
 function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
-    for (const action of asArray17(actions)) {
-      const n = strName14(action.name);
+    for (const action of asArray18(actions)) {
+      const n = strName16(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
   scan(stack.actions);
-  for (const obj of asArray17(stack.objects)) scan(obj.actions);
+  for (const obj of asArray18(stack.objects)) scan(obj.actions);
   return names;
 }
 function validateAiToolReferences(stack) {
@@ -3599,13 +4124,13 @@ function validateAiToolReferences(stack) {
     }
     return universe.has(ref);
   };
-  const skills = asArray17(stack.skills);
+  const skills = asArray18(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName14(skill.name) ?? `#${si}`;
+    const skillName = strName16(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName14(refs[ti]);
+      const ref = strName16(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -3624,24 +4149,25 @@ function validateAiToolReferences(stack) {
 
 // src/validate-ai-agent-authoring.ts
 var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
-function asArray18(v) {
+var DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
+function asArray19(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName15(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
 function validateAiAgentAuthoring(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const agents = asArray18(stack.agents);
+  const agents = asArray19(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName15(agent.name) ?? `#${ai}`;
+    const name = strName17(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -3653,6 +4179,22 @@ function validateAiAgentAuthoring(stack) {
       hint: isPlatformName ? `Remove the declaration; the platform owns "${name}". Extend it with skills instead.` : `Delete the agent and express its capability as skills. Everything an agent carried that a skill does not is persona text: move the useful parts of \`instructions\` into the skills' own instructions.` + (skillCount > 0 ? ` The ${skillCount} skill${skillCount === 1 ? "" : "s"} this agent references already carry the capability \u2014 they attach to the platform agent by \`surface\` affinity, so nothing is lost by dropping the persona.` : ``)
     });
   }
+  const roster = [...PLATFORM_AGENT_NAMES].join(", ");
+  const apps = asArray19(stack.apps);
+  for (let appIdx = 0; appIdx < apps.length; appIdx++) {
+    const app = apps[appIdx];
+    const defaultAgent = strName17(app.defaultAgent);
+    if (!defaultAgent || PLATFORM_AGENT_NAMES.has(defaultAgent)) continue;
+    const appName = strName17(app.name) ?? `#${appIdx}`;
+    findings.push({
+      severity: "warning",
+      rule: DEFAULT_AGENT_OUTSIDE_ROSTER,
+      where: `app "${appName}".defaultAgent`,
+      path: `apps[${appIdx}].defaultAgent`,
+      message: `app "${appName}" pins \`defaultAgent\` to "${defaultAgent}", which is not in the platform agent roster (${roster}). The kernel ships exactly two agents (ADR-0063 \xA72) and resolves this key against them and their legacy aliases only \u2014 an unrecognized name is not rejected, it silently falls back to the platform default at runtime, so the pin has no effect and the value drifts from what actually serves the app.`,
+      hint: `Set \`defaultAgent\` to one of the platform agent names: ${roster}. If the goal is a dedicated persona or capability, express it as skills instead \u2014 they attach to "ask" / "build" by surface affinity, not as a custom \`defaultAgent\` value.`
+    });
+  }
   return findings;
 }
 
@@ -3739,24 +4281,24 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec10 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray19(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec10(x));
-  if (isRec10(v)) {
+var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray20(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec14(x));
+  if (isRec14(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec10(def) ? def : {}
+      ...isRec14(def) ? def : {}
     }));
   }
   return [];
 }
 function indexObjectFields2(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const obj of asArray19(stack.objects)) {
+  for (const obj of asArray20(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const names = /* @__PURE__ */ new Set();
-    for (const f of asArray19(obj.fields)) {
+    for (const f of asArray20(obj.fields)) {
       if (typeof f.name === "string" && f.name) names.add(f.name);
     }
     out.set(name, names);
@@ -3886,12 +4428,12 @@ ${source}
 }
 function validateHookBodyWrites(stack) {
   const findings = [];
-  const hooks = asArray19(stack.hooks);
+  const hooks = asArray20(stack.hooks);
   if (hooks.length === 0) return findings;
   let objectFields = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec10(body) || body.language !== "js") return;
+    if (!isRec14(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
@@ -3962,13 +4504,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec11 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray20(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec11(x));
-  if (isRec11(v)) {
+var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray21(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec15(x));
+  if (isRec15(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec11(def) ? def : {}
+      ...isRec15(def) ? def : {}
     }));
   }
   return [];
@@ -3982,11 +4524,11 @@ function collectActionBodies(stack) {
   const sites = [];
   const seen = /* @__PURE__ */ new Set();
   const collect = (actions, pathPrefix, parentObject) => {
-    asArray20(actions).forEach((action, index) => {
+    asArray21(actions).forEach((action, index) => {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec11(body) || body.language !== "js") return;
+      if (!isRec15(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -3997,7 +4539,7 @@ function collectActionBodies(stack) {
     });
   };
   collect(stack.actions, "actions");
-  asArray20(stack.objects).forEach((obj, objIndex) => {
+  asArray21(stack.objects).forEach((obj, objIndex) => {
     const parentObject = typeof obj.name === "string" && obj.name ? obj.name : void 0;
     collect(obj.actions, `objects[${objIndex}].actions`, parentObject);
   });
@@ -4005,7 +4547,7 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec11(stack)) return findings;
+  if (!isRec15(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
@@ -4063,13 +4605,13 @@ function fixHint2(field, declared) {
 import { findClosestMatches as findClosestMatches3, formatSuggestion as formatSuggestion3 } from "@objectstack/spec/shared";
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
-var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray21(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec12(x));
-  if (isRec12(v)) {
+var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray22(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec16(x));
+  if (isRec16(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec12(def) ? def : {}
+      ...isRec16(def) ? def : {}
     }));
   }
   return [];
@@ -4082,8 +4624,8 @@ function readLiteralObjectName(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec12(stack)) return findings;
-  const flows = asArray21(stack.flows);
+  if (!isRec16(stack)) return findings;
+  const flows = asArray22(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
   flows.forEach((flow, flowIndex) => {
@@ -4091,10 +4633,10 @@ function validateFlowNodeWrites(stack) {
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec12(node.config) ? node.config : void 0;
+      const config = isRec16(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec12(fields)) return;
+      if (!isRec16(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName(config);
@@ -4128,7 +4670,7 @@ function fixHint3(field, declared) {
 // src/validate-readonly-flow-writes.ts
 var FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 var FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-function asArray22(v) {
+function asArray23(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({
@@ -4169,9 +4711,9 @@ function readLiteralObjectName2(config) {
 }
 function validateReadonlyFlowWrites(stack) {
   const findings = [];
-  const flows = asArray22(stack.flows);
+  const flows = asArray23(stack.flows);
   if (flows.length === 0) return findings;
-  const roIndex = buildReadonlyIndex(asArray22(stack.objects));
+  const roIndex = buildReadonlyIndex(asArray23(stack.objects));
   flows.forEach((flow, flowIndex) => {
     if (flow.runAs === "system") return;
     const runAs = flow.runAs === "user" || flow.runAs === "system" ? flow.runAs : "user";
@@ -4230,11 +4772,11 @@ import {
 import { VALID_AST_OPERATORS } from "@objectstack/spec/data";
 
 // src/zod-issue-format.ts
-var isRec13 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var valueAtPath = (root, path) => {
   let cur = root;
   for (const key of path) {
-    if (!isRec13(cur) && !Array.isArray(cur)) return void 0;
+    if (!isRec17(cur) && !Array.isArray(cur)) return void 0;
     cur = cur[key];
   }
   return cur;
@@ -4279,7 +4821,7 @@ function loadTypeScript2() {
   }
   return cachedTs2;
 }
-var asArray23 = (v) => Array.isArray(v) ? v : [];
+var asArray24 = (v) => Array.isArray(v) ? v : [];
 var BLOCKS = new Map(
   REACT_BLOCKS.map((b) => [
     b.tag,
@@ -4367,12 +4909,13 @@ function filterAttrValue(tsc, sf, attr) {
   return perPosition(init.expression);
 }
 var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+var REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 var REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 function checkChartDrillDown(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec14(raw)) {
+  if (!isRec18(raw)) {
     push2(
       "error",
       REACT_CHART_DRILLDOWN_INVALID,
@@ -4395,7 +4938,7 @@ function checkChartDrillDown(raw, push2) {
 }
 function checkChartAggregate(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec14(raw)) {
+  if (!isRec18(raw)) {
     push2(
       "error",
       REACT_CHART_AGGREGATE_INVALID,
@@ -4410,7 +4953,7 @@ function checkChartAggregate(raw, push2) {
       "warning",
       REACT_CHART_AGGREGATE_INVALID,
       "aggregate.groupBy is not set, so the aggregate returns ONE ungrouped row and the chart plots a single point.",
-      "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. Deliberate single-value charts are tolerated at warning level for now: ChartAggregateSchema declares groupBy required while ObjectChart honours its absence by falling back to xAxisKey \u2014 objectstack#5583 decides which of the two moves."
+      "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. objectstack#5583 ruled that an ungrouped single-value chart is NOT a supported <ObjectChart> shape \u2014 groupBy stays required, and a single number belongs in an object-metric block instead. This stays a warning rather than an error only because promoting it is its own step."
     );
   }
   const parsed = ChartAggregateSchema.safeParse(raw);
@@ -4426,9 +4969,9 @@ function checkChartAggregate(raw, push2) {
     );
   }
 }
-var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec18 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
-function checkObjectChart(attrs, objectFields, findings) {
+function checkObjectChart(attrs, objectFields, findings, unprovisionedAnchors = /* @__PURE__ */ new Map()) {
   const { values, where, path } = attrs;
   const push2 = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
   checkChartDrillDown(values.get("drillDown"), push2);
@@ -4436,18 +4979,29 @@ function checkObjectChart(attrs, objectFields, findings) {
   const aggregate = values.get("aggregate");
   checkChartAggregate(aggregate, push2);
   if (aggregate === void 0 || aggregate === NOT_STATIC) return;
-  if (!isRec14(aggregate)) return;
+  if (!isRec18(aggregate)) return;
   const fn = strOf(aggregate.function);
   const field = strOf(aggregate.field);
   const groupBy = aggregate.groupBy;
-  const groupByField = strOf(groupBy) ?? (isRec14(groupBy) ? strOf(groupBy.field) : void 0);
+  const groupByField = strOf(groupBy) ?? (isRec18(groupBy) ? strOf(groupBy.field) : void 0);
   const objectName = strOf(values.get("objectName"));
   const known = objectName ? objectFields.get(objectName) : void 0;
   if (objectName && known) {
+    const anchors = unprovisionedAnchors.get(objectName);
     const fieldRef = (name, prop) => {
       if (!name) return;
       if (name.includes(".")) return;
-      if (known.has(name) || SYSTEM_FIELDS.has(name)) return;
+      if (known.has(name) || SYSTEM_FIELDS.has(name)) {
+        if (anchors?.has(name)) {
+          push2(
+            "warning",
+            REACT_CHART_FIELD_UNPROVISIONED,
+            `aggregate.${prop} "${name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, name)} \u2014 the aggregate query reads a column that is empty on every row, so the chart ${prop === "groupBy" ? "groups everything into one empty bucket" : "aggregates nothing"} instead of failing.`,
+            unprovisionedAnchorHint(objectName, name)
+          );
+        }
+        return;
+      }
       push2(
         "error",
         REACT_CHART_FIELD_UNKNOWN,
@@ -4473,18 +5027,18 @@ function checkObjectChart(attrs, objectFields, findings) {
     );
   };
   const xAxisRaw = values.get("xAxis");
-  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec14(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec18(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
   const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
   axisRef(categoryAxis, categoryProp);
   const yAxisRaw = values.get("yAxis");
   const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
   for (const a of yAxisList) {
-    axisRef(strOf(a) ?? (isRec14(a) ? strOf(a.field) : void 0), "yAxis[].field");
+    axisRef(strOf(a) ?? (isRec18(a) ? strOf(a.field) : void 0), "yAxis[].field");
   }
   const series = values.get("series");
   if (Array.isArray(series)) {
     for (const s of series) {
-      if (!isRec14(s)) continue;
+      if (!isRec18(s)) continue;
       const dataKey = strOf(s.dataKey);
       axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
     }
@@ -4540,7 +5094,7 @@ function subformFieldRefs(value, basePath) {
   if (!Array.isArray(value)) return { child, parent };
   for (let i = 0; i < value.length; i++) {
     const sub = value[i];
-    if (!isRec14(sub)) continue;
+    if (!isRec18(sub)) continue;
     const at = (key) => `${basePath}[${i}].${key}`;
     child.push({
       objectName: strOf(sub.childObject),
@@ -4585,20 +5139,20 @@ function reactFieldRefs(spec, values, basePath) {
   }
   for (const key of spec.nestedFields ?? []) {
     const v = readable(key);
-    if (isRec14(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+    if (isRec18(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
   }
   for (const key of spec.sections ?? []) {
     const v = readable(key);
     if (!Array.isArray(v)) continue;
     for (let i = 0; i < v.length; i++) {
       const section = v[i];
-      if (!isRec14(section)) continue;
+      if (!isRec18(section)) continue;
       own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
     }
   }
   for (const key of spec.keyedByField ?? []) {
     const v = readable(key);
-    if (!isRec14(v)) continue;
+    if (!isRec18(v)) continue;
     for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
   }
   for (const key of spec.filterArrays ?? []) {
@@ -4606,22 +5160,30 @@ function reactFieldRefs(spec, values, basePath) {
   }
   return { own, queried };
 }
-function checkBlockFieldProps(tag, values, objectFields, where, path) {
+function checkBlockFieldProps(tag, values, objectFields, where, path, unprovisionedAnchors) {
   const objectName = strOf(values.get("objectName"));
   const out = [];
   const spec = REACT_FIELD_SPECS[tag];
   if (spec) {
     const { own, queried } = reactFieldRefs(spec, values, path);
-    out.push(...checkFieldRefs(own, objectName, objectFields, where));
-    out.push(...checkFieldRefs(queried, objectName, objectFields, where, "queried"));
+    out.push(
+      ...checkFieldRefs(own, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+    );
+    out.push(
+      ...checkFieldRefs(queried, objectName, objectFields, where, "queried", unprovisionedAnchors)
+    );
   }
   if (tag === "ObjectForm") {
     const raw = values.get("subforms");
     const subs = subformFieldRefs(raw === NOT_STATIC ? void 0 : raw, `${path}${PATH_SEP}subforms`);
     for (const sub of subs.child) {
-      out.push(...checkFieldRefs(sub.refs, sub.objectName, objectFields, where));
+      out.push(
+        ...checkFieldRefs(sub.refs, sub.objectName, objectFields, where, "skipped", unprovisionedAnchors)
+      );
     }
-    out.push(...checkFieldRefs(subs.parent, objectName, objectFields, where));
+    out.push(
+      ...checkFieldRefs(subs.parent, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+    );
   }
   const schemaType = tag === "Block" ? strOf(values.get("type")) : SCHEMA_TYPE_BY_TAG.get(tag);
   if (schemaType && COMPONENT_FIELD_SPECS[schemaType]) {
@@ -4630,7 +5192,9 @@ function checkBlockFieldProps(tag, values, objectFields, where, path) {
         componentFieldRefs(schemaType, readableProps(values), path, PATH_SEP) ?? [],
         objectName,
         objectFields,
-        where
+        where,
+        "skipped",
+        unprovisionedAnchors
       )
     );
   }
@@ -4662,8 +5226,9 @@ function localComponentNames(tsc, sf) {
 function validateReactPageProps(stack) {
   const findings = [];
   const objectFields = indexObjectFields(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const searchTargets = indexObjectSearchTargets(stack);
-  const pages = asArray23(stack.pages);
+  const pages = asArray24(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -4744,7 +5309,7 @@ function validateReactPageProps(stack) {
             }
           }
           if (tag === "ObjectChart" && !hasSpread) {
-            checkObjectChart({ values, where, path }, objectFields, findings);
+            checkObjectChart({ values, where, path }, objectFields, findings, unprovisionedAnchors);
           }
           if (tag === "ListView" && !hasSpread) {
             findings.push(
@@ -4760,7 +5325,7 @@ function validateReactPageProps(stack) {
           }
           if (!hasSpread) {
             findings.push(
-              ...checkBlockFieldProps(tag, values, objectFields, where, path)
+              ...checkBlockFieldProps(tag, values, objectFields, where, path, unprovisionedAnchors)
             );
           }
         }
@@ -4787,6 +5352,15 @@ var REFERENCE_INTEGRITY_RULES = [
   // `action` is deliberately absent (validateActionNameRefs owns it) and so is
   // `component` (an unregistered ref renders a named diagnostic, not silence).
   { name: "validateNavTargetRefs", run: validateNavTargetRefs },
+  // [#7912] The THIRD question about a nav entry, after "does the target
+  // resolve?" (above) and "is it granted?" (`validateNavAccess`): can the
+  // destination serve at all? An object's own `enable` block can make its list
+  // answer 404/405 for every persona, and no gate authorable on the entry
+  // expresses that — which is how #7544's dead row survived review for a year.
+  // The server now prunes such an entry from the `/meta` payload; the
+  // maintainer ruling of 2026-08-12 makes THIS the mandatory companion, so the
+  // prune is never silent to the author who wrote the row.
+  { name: "validateNavObjectServability", run: validateNavObjectServability },
   { name: "validateTranslationReferences", run: validateTranslationReferences },
   // The same family from the other end (#5417). Its sibling above asks "does
   // this bundle key resolve?"; this one asks "is there a key at all?" — a form
@@ -4885,13 +5459,13 @@ import { ComponentPropsMap } from "@objectstack/spec/ui";
 import { lintUnknownKeysAgainstSchema } from "@objectstack/spec";
 var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
 var COMPONENT_PROPS_INVALID = "component-props-invalid";
-function isRec15(v) {
+function isRec19(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName16(v) {
+function strName18(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function asArray24(v) {
+function asArray25(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -4902,23 +5476,36 @@ var PROPS_SCHEMAS = ComponentPropsMap;
 var DATASOURCE_SUPPLIED_PROP = "object";
 function suppliedByDataSource(issue, component) {
   if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
-  const dataSource = isRec15(component.dataSource) ? component.dataSource : void 0;
-  return strName16(dataSource?.object) !== void 0;
+  const dataSource = isRec19(component.dataSource) ? component.dataSource : void 0;
+  return strName18(dataSource?.object) !== void 0;
+}
+function unrecognizedKeysFromUnionArm(issue) {
+  if (issue.code !== "invalid_union") return void 0;
+  const arms = issue.errors;
+  if (!arms || arms.length === 0) return void 0;
+  let found;
+  for (const arm of arms) {
+    const keyIssues = arm.filter((inner) => inner.code === "unrecognized_keys");
+    if (keyIssues.length === 0) continue;
+    if (keyIssues.length !== arm.length || found) return void 0;
+    found = keyIssues[0];
+  }
+  return found;
 }
 function validateComponentProps(stack) {
   const findings = [];
-  if (!isRec15(stack)) return findings;
-  const pages = asArray24(stack.pages);
+  if (!isRec19(stack)) return findings;
+  const pages = asArray25(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec15(page)) continue;
-    const pageName = strName16(page.name) ?? `#${pi}`;
+    if (!isRec19(page)) continue;
+    const pageName = strName18(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName16(component.type);
+      const type = strName18(component.type);
       if (!type) continue;
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec15(component.properties) ? component.properties : void 0;
+      const props = isRec19(component.properties) ? component.properties : void 0;
       if (!props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -4937,6 +5524,20 @@ function validateComponentProps(stack) {
       for (const issue of parsed.error?.issues ?? []) {
         if (suppliedByDataSource(issue, component)) continue;
         const at = issue.path.length ? `${base}.${issue.path.join(".")}` : base;
+        const armIssue = unrecognizedKeysFromUnionArm(issue);
+        if (armIssue) {
+          for (const key of armIssue.keys ?? []) {
+            findings.push({
+              severity: "warning",
+              rule: COMPONENT_PROPS_UNKNOWN_KEY,
+              where,
+              path: `${at}.${key}`,
+              message: `\`${key}\` is not a prop \`${type}\` declares (ComponentPropsMap, @objectstack/spec/ui): ${armIssue.message}`,
+              hint: `Remove \`${key}\`, or declare it on \`${type}\`'s props schema if the component honours it.`
+            });
+          }
+          continue;
+        }
         if (issue.code === "unrecognized_keys") {
           for (const key of issue.keys ?? []) {
             findings.push({
@@ -5167,7 +5768,7 @@ function looksLikeTailwind(className) {
     return false;
   });
 }
-function asArray25(v) {
+function asArray26(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5260,13 +5861,13 @@ function checkNode(node, pageName, path, findings) {
 }
 function validateResponsiveStyles(stack) {
   const findings = [];
-  const pages = asArray25(stack.pages);
+  const pages = asArray26(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     const pageName = typeof page.name === "string" ? page.name : `pages[${p}]`;
-    const regions = asArray25(page.regions);
+    const regions = asArray26(page.regions);
     for (let r = 0; r < regions.length; r++) {
-      const components = asArray25(regions[r].components);
+      const components = asArray26(regions[r].components);
       for (let c = 0; c < components.length; c++) {
         checkNode(components[c], pageName, `pages[${p}].regions[${r}].components[${c}]`, findings);
       }
@@ -5277,10 +5878,10 @@ function validateResponsiveStyles(stack) {
 
 // src/validate-jsx-pages.ts
 import { parseJsx, compile } from "@objectstack/sdui-parser";
-var asArray26 = (v) => Array.isArray(v) ? v : [];
+var asArray27 = (v) => Array.isArray(v) ? v : [];
 function validateJsxPages(stack, opts = {}) {
   const findings = [];
-  const pages = asArray26(stack.pages);
+  const pages = asArray27(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "html" && page.kind !== "jsx") continue;
@@ -5327,10 +5928,10 @@ function loadSucraseTransform() {
   }
   return cachedTransform;
 }
-var asArray27 = (v) => Array.isArray(v) ? v : [];
+var asArray28 = (v) => Array.isArray(v) ? v : [];
 function validateReactPages(stack) {
   const findings = [];
-  const pages = asArray27(stack.pages);
+  const pages = asArray28(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -5367,11 +5968,11 @@ function validateReactPages(stack) {
 
 // src/validate-page-source-styling.ts
 var PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-var asArray28 = (v) => Array.isArray(v) ? v : [];
+var asArray29 = (v) => Array.isArray(v) ? v : [];
 var CLASSNAME_ATTR = /\bclassName\s*=\s*["'{]/g;
 function validatePageSourceStyling(stack) {
   const findings = [];
-  const pages = asArray28(stack.pages);
+  const pages = asArray29(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page) continue;
@@ -5399,7 +6000,7 @@ function validatePageSourceStyling(stack) {
 // src/validate-capability-references.ts
 import { PLATFORM_CAPABILITY_NAMES } from "@objectstack/spec/security";
 var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
-function asArray29(v) {
+function asArray30(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5424,13 +6025,13 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(PLATFORM_CAPABILITY_NAMES);
-  for (const cap of asArray29(stack.capabilities)) {
+  for (const cap of asArray30(stack.capabilities)) {
     if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
   }
-  for (const ps of asArray29(stack.permissions)) {
+  for (const ps of asArray30(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
-  for (const seed of asArray29(stack.data)) {
+  for (const seed of asArray30(stack.data)) {
     if (seed.object !== "sys_capability") continue;
     for (const rec of Array.isArray(seed.records) ? seed.records : []) {
       const name = rec?.name;
@@ -5449,7 +6050,7 @@ function validateCapabilityReferences(stack) {
       hint
     });
   };
-  const objects = asArray29(stack.objects);
+  const objects = asArray30(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -5458,27 +6059,27 @@ function validateCapabilityReferences(stack) {
     for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
       flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
     }
-    const fields = asArray29(obj.fields);
+    const fields = asArray30(obj.fields);
     for (const f of fields) {
       const fname = typeof f.name === "string" ? f.name : "(field)";
       for (const cap of asCapArray(f.requiredPermissions)) {
         flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
       }
     }
-    for (const [ai, action] of asArray29(obj.actions).entries()) {
+    for (const [ai, action] of asArray30(obj.actions).entries()) {
       const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
       for (const cap of asCapArray(action.requiredPermissions)) {
         flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
       }
     }
   }
-  for (const [i, action] of asArray29(stack.actions).entries()) {
+  for (const [i, action] of asArray30(stack.actions).entries()) {
     const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
     for (const cap of asCapArray(action.requiredPermissions)) {
       flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
     }
   }
-  const apps = asArray29(stack.apps);
+  const apps = asArray30(stack.apps);
   for (let i = 0; i < apps.length; i++) {
     const app = apps[i];
     if (!app || typeof app !== "object") continue;
@@ -5511,8 +6112,9 @@ var FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
 var FLOW_TRIGGER_UNKNOWN_EVENT = "flow-trigger-unknown-event";
 var FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID = "flow-time-relative-descriptor-invalid";
 var FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-descriptor-unroutable";
+var FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
 var VALID_RECORD_TRIGGER = /^record-(?:before|after)-(?:create|insert|update|delete|write)$/;
-function asArray30(v) {
+function asArray31(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({
@@ -5528,6 +6130,11 @@ function renderNonObject(v) {
   if (t === "bigint") return `${String(v)}n (a bigint)`;
   return `a ${t}`;
 }
+function renderTriggerToken(v) {
+  if (typeof v === "string") return `'${v}'`;
+  const json = JSON.stringify(v);
+  return json === void 0 ? `a ${typeof v}` : json;
+}
 function startNodeOf(flow) {
   const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
   const index = nodes.findIndex((n) => n?.type === "start");
@@ -5535,10 +6142,10 @@ function startNodeOf(flow) {
 }
 function validateFlowTriggerReadiness(stack) {
   const findings = [];
-  const flows = asArray30(stack.flows);
+  const flows = asArray31(stack.flows);
   if (flows.length === 0) return findings;
   const objectNames = new Set(
-    asArray30(stack.objects).map((o) => typeof o.name === "string" ? o.name : void 0).filter((n) => !!n)
+    asArray31(stack.objects).map((o) => typeof o.name === "string" ? o.name : void 0).filter((n) => !!n)
   );
   flows.forEach((flow, flowIndex) => {
     const flowName = typeof flow.name === "string" ? flow.name : `#${flowIndex}`;
@@ -5647,6 +6254,25 @@ function validateFlowTriggerReadiness(stack) {
         hint: `config.timeRelative describes WHICH records to sweep \u2014 an object: { object, dateField, and exactly one of withinDays | offsetDays } (plus optional filter / maxRecords). A cadence like 'daily' is not a descriptor: HOW OFTEN the sweep runs is the sibling key config.schedule on the same start node (it defaults to daily, so it is usually omitted). See TimeRelativeTriggerSchema and content/docs/references/automation/time-relative-trigger.mdx.`
       });
     }
+    const routesToSomeTrigger = isRecordTriggered2 || isArrayRecordTriggered || isTimeRelative || config.schedule != null || flow.type === "schedule" || flow.type === "api" || triggerType === "api";
+    if (start && flow.type === "record_change" && !routesToSomeTrigger) {
+      const hasTriggerType = config.triggerType != null;
+      findings.push({
+        // `error` (#5762's criterion, applied to a fourth id). The verdict is
+        // the engine's own routing chain — literal `startsWith`/`typeof` tests
+        // with no registry lookup in them — so no installed package can make
+        // this token resolve. `registerTrigger` is keyed by the RESOLVED type,
+        // which is the near-miss worth stating: a plugin can supply the
+        // record-change trigger itself, and it still would not help, because
+        // the flow never reaches the point of asking for one.
+        severity: "error",
+        rule: FLOW_TRIGGER_UNROUTABLE,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
+        message: `declares type: 'record_change' but ` + (hasTriggerType ? `its start node's triggerType is ${renderTriggerToken(config.triggerType)}, which the engine routes to NO trigger` : `its start node has no triggerType at all, so there is nothing for the engine to route`) + ` \u2014 it binds a record-change flow only for a token starting with 'record-', so this flow is demoted to a manual one and never fires. Nothing NAMES it: the unbound-flow audit resolves the same binding and skips the flow as "manual \u2014 nothing to bind", so neither the boot warning nor the startup summary lists it; the only trace is the banner's flow count being one higher than its bound count.`,
+        hint: `Use record-{before,after}-{create,update,delete,write} ('write' is create OR update in one flow, #3427; create/insert are synonyms). If the flow really is launched by hand or from a screen, declare type: 'autolaunched' or 'screen' instead of 'record_change' \u2014 those types have no trigger to be missing.`
+      });
+    }
     if (isAutoTriggered && (flow.status == null || flow.status === "draft")) {
       findings.push({
         severity: "warning",
@@ -5692,7 +6318,7 @@ var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
 };
-function asArray31(v) {
+function asArray32(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5702,7 +6328,7 @@ function asArray31(v) {
 function validateApprovalApprovers(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const flows = asArray31(stack.flows);
+  const flows = asArray32(stack.flows);
   const validTypes = new Set(ApproverType.options);
   for (let fi = 0; fi < flows.length; fi++) {
     const flow = flows[fi];
@@ -5885,7 +6511,7 @@ function validateApprovalApprovers(stack) {
 import { objectTitleCompleteness } from "@objectstack/spec/data";
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
-function asArray32(v) {
+function asArray33(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5894,7 +6520,7 @@ function asArray32(v) {
 }
 function validateRecordTitle(stack) {
   const findings = [];
-  const objects = asArray32(stack.objects);
+  const objects = asArray33(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
@@ -5930,7 +6556,8 @@ var FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 var FIELD_GROUP_EMPTY = "field-group-empty";
 var FIELD_GROUP_SHADOWED = "field-group-shadowed";
 var SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
-function asArray33(v) {
+var SEMANTIC_ROLE_FIELD_UNPROVISIONED = "semantic-role-field-unprovisioned";
+function asArray34(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5939,7 +6566,7 @@ function asArray33(v) {
 }
 function validateSemanticRoles(stack) {
   const findings = [];
-  const objects = asArray33(stack.objects);
+  const objects = asArray34(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -5948,6 +6575,15 @@ function validateSemanticRoles(stack) {
     const path = `objects[${i}]`;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? obj.fields : {};
     const fieldNames = /* @__PURE__ */ new Set([...Object.keys(fields), ...injectedColumnsFor(obj)]);
+    const unprovisioned = unprovisionedInjectedColumnsFor(obj);
+    const unprovisionedPointer = (slot, entry) => ({
+      severity: "warning",
+      rule: SEMANTIC_ROLE_FIELD_UNPROVISIONED,
+      where,
+      path: `${path}.${slot}`,
+      message: `${objName}: ${slot} points at "${entry}", an injected system column with no storage behind it \u2014 this object is external (ADR-0015), so the platform registers the anchor but the remote schema owns the table and no column backs it. Every consumer renders it empty on every record.`,
+      hint: `If the remote table really carries "${entry}", declare it in the object's own fields (mapped through the external binding's columnMap); otherwise point ${slot} at a real remote column.`
+    });
     const declaredGroups = new Set(
       (Array.isArray(obj.fieldGroups) ? obj.fieldGroups : []).filter((g) => !!g && typeof g === "object").map((g) => g.key).filter((k) => typeof k === "string" && k.length > 0)
     );
@@ -5989,10 +6625,16 @@ function validateSemanticRoles(stack) {
         message: `${objName}: stageField "${stage}" is not a field on this object \u2014 consumers fall back to heuristic stage detection`,
         hint: `Point stageField at an existing select/status field, or set stageField: false to declare the object has no linear lifecycle.`
       });
+    } else if (typeof stage === "string" && unprovisioned.has(stage)) {
+      findings.push(unprovisionedPointer("stageField", stage));
     }
     const highlights = Array.isArray(obj.highlightFields) ? obj.highlightFields : Array.isArray(obj.compactLayout) ? obj.compactLayout : [];
     for (const entry of highlights) {
-      if (typeof entry !== "string" || entry.length === 0 || fieldNames.has(entry)) continue;
+      if (typeof entry !== "string" || entry.length === 0) continue;
+      if (fieldNames.has(entry)) {
+        if (unprovisioned.has(entry)) findings.push(unprovisionedPointer("highlightFields", entry));
+        continue;
+      }
       findings.push({
         severity: "warning",
         rule: SEMANTIC_ROLE_FIELD_UNKNOWN,
@@ -6006,7 +6648,7 @@ function validateSemanticRoles(stack) {
       (h) => typeof h === "string" && h.length > 0
     );
     if (declaredStrings.length > 0 && declaredGroups.size > 0) {
-      const declaredTitle = [obj.nameField, obj.primaryField, obj.displayNameField].find((v) => typeof v === "string" && v.length > 0 && fieldNames.has(v));
+      const declaredTitle = [obj.nameField, obj.displayNameField].find((v) => typeof v === "string" && v.length > 0 && fieldNames.has(v));
       const titleField = declaredTitle ?? ["name", "full_name", "title", "subject", "display_name"].find((c) => fieldNames.has(c));
       const stripSet = new Set(
         declaredStrings.filter((h) => h !== titleField).slice(0, 4)
@@ -6034,13 +6676,19 @@ function validateSemanticRoles(stack) {
 // src/validate-form-layout.ts
 var FORM_FIELD_UNKNOWN = "form-field-unknown";
 var FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
-function asArray34(v) {
+function asArray35(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
+function isRec20(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName19(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
 function fieldNameOf(entry) {
   if (typeof entry === "string") return entry.length > 0 ? entry : null;
   if (entry && typeof entry === "object" && !Array.isArray(entry)) {
@@ -6049,60 +6697,53 @@ function fieldNameOf(entry) {
   }
   return null;
 }
-function boundObject(view) {
-  const data = view.data;
-  if (data && typeof data === "object" && typeof data.object === "string") {
-    return data.object;
-  }
-  return typeof view.objectName === "string" ? view.objectName : void 0;
-}
 function validateFormLayout(stack) {
   const findings = [];
   const objectFields = /* @__PURE__ */ new Map();
-  for (const obj of asArray34(stack.objects)) {
+  for (const obj of asArray35(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? Object.keys(obj.fields) : [];
     objectFields.set(name, new Set(fields));
   }
-  const views = asArray34(stack.views);
-  for (let i = 0; i < views.length; i++) {
-    const view = views[i];
-    if (!view || typeof view !== "object") continue;
-    const sections = Array.isArray(view.sections) ? view.sections : null;
-    if (!sections) continue;
-    const viewName = typeof view.name === "string" ? view.name : `(view ${i})`;
-    const objName = boundObject(view);
-    const known = objName ? objectFields.get(objName) : void 0;
-    const where = `view "${viewName}"`;
-    const base = `views[${i}]`;
-    for (let s = 0; s < sections.length; s++) {
-      const sec = sections[s];
-      const secFields = sec && typeof sec === "object" && Array.isArray(sec.fields) ? sec.fields : [];
-      for (let f = 0; f < secFields.length; f++) {
-        const entry = secFields[f];
-        const fname = fieldNameOf(entry);
-        const fpath = `${base}.sections[${s}].fields[${f}]`;
-        if (fname && known && !known.has(fname)) {
-          findings.push({
-            severity: "warning",
-            rule: FORM_FIELD_UNKNOWN,
-            where,
-            path: fpath,
-            message: `${viewName}: field "${fname}" is not a field on object "${objName}" \u2014 it is silently skipped and never renders on the form`,
-            hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
-          });
-        }
-        const colSpan = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.colSpan : void 0;
-        if (colSpan != null) {
-          findings.push({
-            severity: "warning",
-            rule: FORM_COLSPAN_ABSOLUTE,
-            where,
-            path: `${fpath}.colSpan`,
-            message: `${viewName}: field "${fname ?? "?"}" sets absolute colSpan ${String(colSpan)} \u2014 the form's column count is derived per surface (mobile 1 / modal 2 / page 3-4), so a fixed span only aligns at one width`,
-            hint: `Prefer span: 'full' (whole row at any column count), or omit for auto width. The renderer clamps colSpan to the current column count.`
-          });
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = strName19(view.name) ?? strName19(view.object) ?? viewPath;
+    const containerObject = viewObjectName(view);
+    for (const site of formViewSites(view, viewPath)) {
+      const objName = viewObjectName(site.view) ?? containerObject;
+      const known = objName ? objectFields.get(objName) : void 0;
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const sec = sections[s];
+          const secFields = isRec20(sec) && Array.isArray(sec.fields) ? sec.fields : [];
+          for (let f = 0; f < secFields.length; f++) {
+            const entry = secFields[f];
+            const fname = fieldNameOf(entry);
+            const fpath = `${site.path}.${bucket}[${s}].fields[${f}]`;
+            if (fname && known && !known.has(fname)) {
+              findings.push({
+                severity: "warning",
+                rule: FORM_FIELD_UNKNOWN,
+                where,
+                path: fpath,
+                message: `${viewName}: field "${fname}" is not a field on object "${objName}" \u2014 it is silently skipped and never renders on the form`,
+                hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
+              });
+            }
+            const colSpan = isRec20(entry) ? entry.colSpan : void 0;
+            if (colSpan != null) {
+              findings.push({
+                severity: "warning",
+                rule: FORM_COLSPAN_ABSOLUTE,
+                where,
+                path: `${fpath}.colSpan`,
+                message: `${viewName}: field "${fname ?? "?"}" sets absolute colSpan ${String(colSpan)} \u2014 the form's column count is derived per surface (mobile 1 / modal 2 / page 3-4), so a fixed span only aligns at one width`,
+                hint: `Prefer span: 'full' (whole row at any column count), or omit for auto width. The renderer clamps colSpan to the current column count.`
+              });
+            }
+          }
         }
       }
     }
@@ -6201,17 +6842,75 @@ function validateSeedStateMachine(stack) {
 }
 
 // src/validate-visibility-predicates.ts
-var VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
+import {
+  collectCelRootIdentifiers as collectCelRootIdentifiers3,
+  firstUndeclaredReference,
+  parseCelToAst as parseCelToAst3,
+  parseCelToAstWithReason
+} from "@objectstack/formula";
+
+// src/predicate-rhs-position.ts
+function isNode2(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+var EQUALITY_OPS = /* @__PURE__ */ new Set(["==", "!="]);
+var COMPREHENSION_MACROS = /* @__PURE__ */ new Set(["all", "exists", "exists_one", "map", "filter"]);
+function bareId(node) {
+  if (!isNode2(node)) return null;
+  return node.op === "id" && typeof node.args === "string" ? node.args : null;
+}
+function bareRhsOnlyIdentifiers(ast) {
+  const rhs = /* @__PURE__ */ new Set();
+  const elsewhere = /* @__PURE__ */ new Set();
+  const walk = (node, suppressible) => {
+    if (Array.isArray(node)) {
+      for (const child of node) walk(child, suppressible);
+      return;
+    }
+    if (!isNode2(node)) return;
+    const args = node.args;
+    if (node.op === "rcall" && Array.isArray(args) && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+      walk(args[1], suppressible);
+      walk(args[2], false);
+      return;
+    }
+    if (typeof node.op === "string" && EQUALITY_OPS.has(node.op) && Array.isArray(args) && args.length === 2) {
+      const right = suppressible ? bareId(args[1]) : null;
+      walk(args[0], suppressible);
+      if (right !== null) {
+        rhs.add(right);
+        return;
+      }
+      walk(args[1], suppressible);
+      return;
+    }
+    const name = bareId(node);
+    if (name !== null) {
+      elsewhere.add(name);
+      return;
+    }
+    walk(args, suppressible);
+  };
+  walk(ast, true);
+  for (const name of elsewhere) rhs.delete(name);
+  return rhs;
+}
+function isRec21(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function schemaIdOf(view) {
+  const data = view.data;
+  if (!isRec21(data)) return void 0;
+  if (data.provider !== "schema") return void 0;
+  return typeof data.schemaId === "string" ? data.schemaId : void 0;
+}
+
+// src/validate-visibility-predicates.ts
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
+var VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
+var VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
+var VISIBILITY_PREDICATE_OVER_BUDGET = "visibility-predicate-over-budget";
 var CANONICAL = "visibleWhen";
-var ALIASES = ["visibleOn", "visibility"];
-function asArray35(v) {
-  if (Array.isArray(v)) return v;
-  if (v && typeof v === "object") {
-    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
-  }
-  return [];
-}
 function predicateSource(v) {
   if (typeof v === "string") return v;
   if (v && typeof v === "object" && typeof v.source === "string") {
@@ -6222,31 +6921,85 @@ function predicateSource(v) {
 function usesRoot(source, root) {
   return new RegExp(`(^|[^.\\w$])${root}\\.\\w`).test(source);
 }
-var MISLAYER_BY_LAYER = {
+function withoutStringLiterals(source) {
+  return source.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"/g, (lit) => " ".repeat(lit.length));
+}
+var NON_CEL_SPELLINGS = [
+  { wrote: "===", cel: "==", example: "record.country == 'USA'", re: /===/ },
+  { wrote: "!==", cel: "!=", example: "record.country != 'USA'", re: /!==/ },
+  { wrote: "<>", cel: "!=", example: "record.country != 'USA'", re: /<>/ },
+  { wrote: "and", cel: "&&", example: "record.a == 1 && record.b == 2", re: /(?<![.\w$])and(?![\w$])/i },
+  { wrote: "or", cel: "||", example: "record.a == 1 || record.b == 2", re: /(?<![.\w$])or(?![\w$])/i },
+  { wrote: "not", cel: "!", example: "!record.archived", re: /(?<![.\w$])not(?![\w$])/i },
+  // Assignment where a comparison was meant. Last, and fenced off from every
+  // operator that legitimately contains `=` (`==`, `!=`, `<=`, `>=`).
+  { wrote: "=", cel: "==", example: "record.status == 'open'", re: /(?<![=!<>])=(?!=)/ }
+];
+function quoteSource(source) {
+  const flat = source.replace(/\s+/g, " ").trim();
+  return flat.length > 120 ? `${flat.slice(0, 117)}...` : flat;
+}
+function celRefusal(source) {
+  if (!source.trim()) return null;
+  const parsed = parseCelToAstWithReason(source);
+  if (parsed.ok || parsed.kind === "empty") return null;
+  if (parsed.kind === "bounds") return { kind: "bounds", overrun: parsed.overrun };
+  const identifiers = collectCelRootIdentifiers3(source);
+  const detail = identifiers.ok ? "the expression could not be parsed" : identifiers.error.split("\n")[0].trim();
+  const scannable = withoutStringLiterals(source);
+  return { kind: "syntax", detail, token: NON_CEL_SPELLINGS.find((s) => s.re.test(scannable)) ?? null };
+}
+function boundName(overrun) {
+  return overrun.limit && overrun.limitValue !== null ? `the \`${overrun.limit}\` budget (platform limit ${overrun.limitValue})` : "one of the platform's parse budgets";
+}
+var VIEW_PAGE_EXTRA_ROOTS = ["current_user", "page"];
+function isNode3(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function namespaceRoots(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) namespaceRoots(child, out);
+    return;
+  }
+  if (!isNode3(node)) return;
+  const args = node.args;
+  if (Array.isArray(args)) {
+    const receiver = node.op === "rcall" ? args[1] : args[0];
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode3(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+      out.add(receiver.args);
+    }
+  }
+  namespaceRoots(args, out);
+}
+function firstBareIdentifier(source, literalRhs) {
+  const ast = parseCelToAst3(source);
+  if (!ast) return null;
+  const rooted = /* @__PURE__ */ new Set();
+  namespaceRoots(ast, rooted);
+  const literalSlot = literalRhs ? bareRhsOnlyIdentifiers(ast) : [];
+  return firstUndeclaredReference(source, [
+    ...VIEW_PAGE_EXTRA_ROOTS,
+    ...rooted,
+    ...literalSlot
+  ]);
+}
+var CANONICAL_ROOT_BY_LAYER = {
+  runtime: "record",
+  metadata: "data"
+};
+var MISLAYER_BY_LAYER = {
   runtime: {
     forbiddenRoot: "data",
-    message: "visibility predicate is rooted at `data.` \u2014 that is the metadata-editing-form root (a `*.form.ts` row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
+    message: "visibility predicate is rooted at `data.` \u2014 that is the root a metadata-editing form binds (the row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
     hint: "Runtime record surfaces bind `record` + `current_user` (pages also expose `page.<var>`). Use e.g. `record.status == 'open'` instead of `data.status == 'open'`."
   },
   metadata: {
     forbiddenRoot: "record",
-    message: "visibility predicate is rooted at `record.` \u2014 that is the runtime record-surface root (a `*.view.ts` / `*.page.ts` live record), not a metadata-editing form. A `*.form.ts` predicate that binds `record.` never matches and the element renders unconditionally (ADR-0089).",
+    message: "visibility predicate is rooted at `record.` \u2014 that is the root a runtime view/page surface binds (the live record), not the root a metadata-editing form binds. On a metadata-editing form \u2014 the row under edit \u2014 a `record.`-rooted predicate never matches and the element renders unconditionally (ADR-0089).",
     hint: "Metadata-editing forms bind `data` (the row under edit). Use e.g. `data.type == 'grid'` instead of `record.type == 'grid'`."
   }
 };
-function checkElement(el, where, path, layer, findings) {
-  for (const alias of ALIASES) {
-    if (el[alias] !== void 0) {
-      findings.push({
-        severity: "warning",
-        rule: VISIBILITY_ALIAS_DEPRECATED,
-        where,
-        path: `${path}.${alias}`,
-        message: `\`${alias}\` is the deprecated spelling of the conditional-visibility predicate (ADR-0089). It still works \u2014 it is normalized to \`visibleWhen\` at parse \u2014 but the canonical key is \`visibleWhen\`.`,
-        hint: `Rename the key \`${alias}\` \u2192 \`visibleWhen\` (same CEL value).`
-      });
-    }
-  }
+function checkElement(el, where, path, layer, findings, literalRhs = false) {
   const raw = el[CANONICAL] ?? el.visibleOn ?? el.visibility;
   const source = predicateSource(raw);
   const rule = MISLAYER_BY_LAYER[layer];
@@ -6260,50 +7013,380 @@ function checkElement(el, where, path, layer, findings) {
       hint: rule.hint
     });
   }
+  const refusal = source ? celRefusal(source) : null;
+  if (source && refusal?.kind === "bounds") {
+    const bound = boundName(refusal.overrun);
+    const root = CANONICAL_ROOT_BY_LAYER[layer];
+    findings.push({
+      severity: "error",
+      rule: VISIBILITY_PREDICATE_OVER_BUDGET,
+      where,
+      path,
+      message: `visibility predicate is syntactically valid CEL but overruns ${bound} (${refusal.overrun.summary}) (predicate: \`${quoteSource(source)}\`). The canonical front end refuses it, so it can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+      hint: `There is no syntax or dialect error to correct here \u2014 this is a SIZE fault, not a dialect mistake, so re-spelling the predicate will not fix it. Make it smaller, or move the work off the predicate: (1) collapse a long \`${root}.f == 'a' || ${root}.f == 'b' || \u2026\` chain into a single \`${root}.f in ['a', 'b', \u2026]\`, which is far fewer AST nodes (\`maxListElements\` is 64, so a very large set needs option 2); (2) precompute the heavy part into a formula/rollup field on the object and test that one field instead. Logic genuinely this large is not element visibility \u2014 compute it once on the record rather than re-deriving it in every predicate that needs it.`
+    });
+  }
+  if (source && refusal?.kind === "syntax") {
+    findings.push({
+      severity: "error",
+      rule: VISIBILITY_PREDICATE_SYNTAX,
+      where,
+      path,
+      message: `visibility predicate is not valid CEL \u2014 ${refusal.detail} (predicate: \`${quoteSource(source)}\`). A predicate that does not parse can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+      hint: refusal.token ? `\`${refusal.token.wrote}\` is not a CEL operator \u2014 CEL spells it \`${refusal.token.cel}\`. Replace \`${refusal.token.wrote}\` with \`${refusal.token.cel}\`, e.g. \`${refusal.token.example}\`.` : `Visibility predicates are bare CEL, e.g. \`record.status == 'open'\`. Spellings from other languages do not parse: write \`==\` (not \`===\`), \`!=\` (not \`!==\` or \`<>\`), \`&&\` (not \`and\`), \`||\` (not \`or\`), \`!\` (not \`not\`).`
+    });
+  }
+  if (source && !refusal) {
+    const bare = firstBareIdentifier(source, literalRhs);
+    if (bare) {
+      const root = CANONICAL_ROOT_BY_LAYER[layer];
+      findings.push({
+        severity: "error",
+        rule: VISIBILITY_BARE_IDENTIFIER,
+        where,
+        path,
+        message: `visibility predicate references \`${bare}\` as a bare identifier. Values are bound under a namespace on this surface \u2014 they are never flattened to top level \u2014 so \`${bare}\` resolves to nothing, the predicate can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
+        hint: `Write \`${root}.${bare}\` instead of \`${bare}\`` + (layer === "runtime" ? " (runtime view/page surfaces bind `record` + `current_user`; a page component also exposes page state as `page.<var>`)." : " (a metadata-editing form binds the row under edit as `data`).")
+      });
+    }
+  }
 }
 function isFieldObject(entry) {
   return !!entry && typeof entry === "object" && !Array.isArray(entry);
 }
 function validateVisibilityPredicates(stack, opts = {}) {
-  const layer = opts.layer ?? "runtime";
+  const declaredLayer = opts.layer ?? "runtime";
   const findings = [];
-  const views = asArray35(stack.views);
-  for (let i = 0; i < views.length; i++) {
-    const view = views[i];
-    if (!view || typeof view !== "object") continue;
-    const viewName = typeof view.name === "string" ? view.name : `(view ${i})`;
-    const where = `view "${viewName}"`;
-    for (const bucket of ["sections", "groups"]) {
-      const sections = Array.isArray(view[bucket]) ? view[bucket] : [];
-      for (let s = 0; s < sections.length; s++) {
-        const sec = sections[s];
-        if (!sec || typeof sec !== "object") continue;
-        const secPath = `views[${i}].${bucket}[${s}]`;
-        checkElement(sec, where, secPath, layer, findings);
-        const secFields = Array.isArray(sec.fields) ? sec.fields : [];
-        for (let f = 0; f < secFields.length; f++) {
-          const entry = secFields[f];
-          if (isFieldObject(entry)) {
-            checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
+    for (const site of formViewSites(view, viewPath)) {
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      const schemaBound = schemaIdOf(site.view) !== void 0;
+      const literalRhs = schemaBound;
+      const layer = schemaBound ? "metadata" : declaredLayer;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const sec = sections[s];
+          if (!sec || typeof sec !== "object") continue;
+          const secPath = `${site.path}.${bucket}[${s}]`;
+          checkElement(sec, where, secPath, layer, findings, literalRhs);
+          const secFields = Array.isArray(sec.fields) ? sec.fields : [];
+          for (let f = 0; f < secFields.length; f++) {
+            const entry = secFields[f];
+            if (isFieldObject(entry)) {
+              checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings, literalRhs);
+            }
           }
         }
       }
     }
   }
-  const pages = asArray35(stack.pages);
-  for (let i = 0; i < pages.length; i++) {
-    const page = pages[i];
-    if (!page || typeof page !== "object") continue;
-    const pageName = typeof page.name === "string" ? page.name : `(page ${i})`;
-    const where = `page "${pageName}"`;
-    const regions = Array.isArray(page.regions) ? page.regions : [];
-    for (let r = 0; r < regions.length; r++) {
-      const region = regions[r];
-      const components = region && typeof region === "object" && Array.isArray(region.components) ? region.components : [];
-      for (let c = 0; c < components.length; c++) {
-        const comp = components[c];
-        if (comp && typeof comp === "object") {
-          checkElement(comp, where, `pages[${i}].regions[${r}].components[${c}]`, layer, findings);
+  for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
+    const pageName = typeof page.name === "string" ? page.name : void 0;
+    const where = `page "${pageName ?? pagePath}"`;
+    for (const walked of walkPageComponents(page, pagePath)) {
+      checkElement(walked.component, where, walked.path, declaredLayer, findings);
+    }
+  }
+  return findings;
+}
+
+// src/validate-predicate-path-refs.ts
+import { parseCelToAst as parseCelToAst4 } from "@objectstack/formula";
+import { getMetadataTypeSchema } from "@objectstack/spec/kernel";
+import { findClosestMatches as findClosestMatches4, formatSuggestion as formatSuggestion4 } from "@objectstack/spec";
+var PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
+var PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
+var PREDICATE_RHS_PATH_SHAPED = "predicate-rhs-path-shaped";
+var PREDICATE_KEYS = ["visibleWhen", "visibleOn"];
+var ROOT = "data";
+function defOf(schema) {
+  if (!schema || typeof schema !== "object" && typeof schema !== "function") return void 0;
+  const s = schema;
+  return s.def ?? s._def;
+}
+function peel(schema, depth = 0) {
+  if (!schema || depth > 25) return schema;
+  const d = defOf(schema);
+  if (!d) return schema;
+  switch (d.type) {
+    case "optional":
+    case "nullable":
+    case "default":
+    case "prefault":
+    case "readonly":
+    case "catch":
+    case "nonoptional":
+      return peel(d.innerType, depth + 1);
+    case "lazy":
+      return peel(d.getter(), depth + 1);
+    case "pipe": {
+      const inner = peel(d.in, depth + 1);
+      return defOf(inner)?.type === "transform" ? peel(d.out, depth + 1) : inner;
+    }
+    default:
+      return schema;
+  }
+}
+function optionsOf(d) {
+  return Array.isArray(d?.options) ? d.options : [];
+}
+function keysOf(schema, depth = 0) {
+  if (depth > 25) return null;
+  const u = peel(schema);
+  const d = defOf(u);
+  if (d?.type === "object") return Object.keys(d.shape ?? u.shape ?? {});
+  if (d?.type === "union" || d?.type === "discriminated_union") {
+    const all = /* @__PURE__ */ new Set();
+    let keyBearing = false;
+    for (const option of optionsOf(d)) {
+      const k = keysOf(option, depth + 1);
+      if (!k) continue;
+      keyBearing = true;
+      for (const key of k) all.add(key);
+    }
+    return keyBearing ? [...all] : null;
+  }
+  if (d?.type === "intersection") {
+    const left = keysOf(d.left, depth + 1);
+    const right = keysOf(d.right, depth + 1);
+    if (!left && !right) return null;
+    return [.../* @__PURE__ */ new Set([...left ?? [], ...right ?? []])];
+  }
+  return null;
+}
+function propertyOf(schema, key, depth = 0) {
+  if (depth > 25) return void 0;
+  const u = peel(schema);
+  const d = defOf(u);
+  if (d?.type === "object") return (d.shape ?? u.shape ?? {})[key];
+  if (d?.type === "union" || d?.type === "discriminated_union") {
+    for (const option of optionsOf(d)) {
+      const found = propertyOf(option, key, depth + 1);
+      if (found !== void 0) return found;
+    }
+  }
+  if (d?.type === "intersection") {
+    return propertyOf(d.left, key, depth + 1) ?? propertyOf(d.right, key, depth + 1);
+  }
+  return void 0;
+}
+function rowScopeOf(scope, key) {
+  const prop = propertyOf(scope, key);
+  if (prop === void 0) return void 0;
+  let node = peel(prop);
+  for (let i = 0; i < 25; i++) {
+    const d = defOf(node);
+    if (d?.type === "array") node = peel(d.element);
+    else if (d?.type === "record") node = peel(d.valueType);
+    else return node;
+  }
+  return node;
+}
+function stepInto(scope, segment) {
+  const u = peel(scope);
+  const d = defOf(u);
+  if (d?.type === "record") return { kind: "declared", next: d.valueType };
+  const declared = keysOf(u);
+  if (declared === null) return { kind: "opaque" };
+  if (!declared.includes(segment)) return { kind: "undeclared", declared };
+  return { kind: "declared", next: propertyOf(u, segment) };
+}
+function isNode4(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function memberChain(node) {
+  if (!isNode4(node)) return null;
+  if (node.op === "id" && typeof node.args === "string") return [node.args];
+  if (node.op === "." && Array.isArray(node.args) && typeof node.args[1] === "string") {
+    const head = memberChain(node.args[0]);
+    return head ? [...head, node.args[1]] : null;
+  }
+  return null;
+}
+function rootedPaths(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) rootedPaths(child, out);
+    return;
+  }
+  if (!isNode4(node)) return;
+  if (node.op === ".") {
+    const chain = memberChain(node);
+    if (chain && chain[0] === ROOT && chain.length > 1) {
+      out.push(chain.slice(1));
+      return;
+    }
+  }
+  rootedPaths(node.args, out);
+}
+var PATH_SHAPED_RHS = /^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*$/;
+function equalitySites(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) equalitySites(child, out);
+    return;
+  }
+  if (!isNode4(node)) return;
+  const args = node.args;
+  if (node.op === "rcall" && Array.isArray(args) && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+    equalitySites(args[1], out);
+    return;
+  }
+  if (typeof node.op === "string" && EQUALITY_OPS.has(node.op) && Array.isArray(args) && args.length === 2) {
+    out.push({ op: node.op, right: args[1] });
+  }
+  equalitySites(args, out);
+}
+function classifyIdentifiers(node, values, excluded) {
+  if (Array.isArray(node)) {
+    for (const child of node) classifyIdentifiers(child, values, excluded);
+    return;
+  }
+  if (!isNode4(node)) return;
+  const args = node.args;
+  if (Array.isArray(args)) {
+    const receiver = node.op === "rcall" ? args[1] : args[0];
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode4(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+      excluded.add(receiver.args);
+    }
+    if (node.op === "rcall" && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+      const macroArgs = args[2];
+      if (Array.isArray(macroArgs) && macroArgs.length >= 2) {
+        const bound = macroArgs[0];
+        if (isNode4(bound) && bound.op === "id" && typeof bound.args === "string") {
+          excluded.add(bound.args);
+        }
+      }
+    }
+  }
+  if (node.op === "id" && typeof node.args === "string") {
+    values.add(node.args);
+    return;
+  }
+  classifyIdentifiers(args, values, excluded);
+}
+function predicateSource2(v) {
+  if (typeof v === "string") return v;
+  if (v && typeof v === "object" && typeof v.source === "string") {
+    return v.source;
+  }
+  return void 0;
+}
+function isRec22(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function checkPredicate(source, scope, where, path, findings) {
+  const ast = parseCelToAst4(source);
+  if (!ast) return;
+  const paths = [];
+  rootedPaths(ast, paths);
+  for (const segments of paths) {
+    let cursor = scope;
+    const walked = [];
+    for (const segment of segments) {
+      const step = stepInto(cursor, segment);
+      if (step.kind === "opaque") break;
+      if (step.kind === "undeclared") {
+        const full = [ROOT, ...walked, segment].join(".");
+        const container = walked.length ? `${ROOT}.${walked.join(".")}` : ROOT;
+        findings.push({
+          severity: "error",
+          rule: PREDICATE_PATH_UNRESOLVED,
+          where,
+          path,
+          message: `predicate references \`${full}\`, which the target schema does not declare \u2014 \`${segment}\` is not a key of \`${container}\`. The reference resolves to nothing, so the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149).`,
+          hint: `${formatSuggestion4(findClosestMatches4(segment, step.declared)) || `\`${container}\` declares: ${step.declared.slice(0, 12).sort().join(", ")}`} Every reference must resolve against the schema the form edits.`
+        });
+        break;
+      }
+      walked.push(segment);
+      cursor = step.next;
+    }
+  }
+  const declaredHere = keysOf(scope);
+  const rhsOnly = bareRhsOnlyIdentifiers(ast);
+  if (declaredHere) {
+    const values = /* @__PURE__ */ new Set();
+    const excluded = /* @__PURE__ */ new Set();
+    classifyIdentifiers(ast, values, excluded);
+    for (const id of values) {
+      if (excluded.has(id) || rhsOnly.has(id) || !declaredHere.includes(id)) continue;
+      findings.push({
+        severity: "error",
+        rule: PREDICATE_PATH_UNROOTED,
+        where,
+        path,
+        message: `predicate references \`${id}\` as a bare identifier, but \`${id}\` is a key of the schema this form edits \u2014 the binding root was dropped. Values are bound under \`${ROOT}\` and are never flattened to top level, so \`${id}\` resolves to nothing, the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149, #6254).`,
+        hint: `Write \`${ROOT}.${id}\` instead of \`${id}\`. A metadata-editing form binds the row under edit as \`${ROOT}\` at every depth \u2014 inside a repeater \`${ROOT}\` is the ROW, but it is still spelled \`${ROOT}\` (there is no implicit row scope).`
+      });
+    }
+  }
+  const sites = [];
+  equalitySites(ast, sites);
+  for (const { op, right } of sites) {
+    const chain = memberChain(right);
+    if (!chain) continue;
+    const text = chain.join(".");
+    if (!PATH_SHAPED_RHS.test(text)) continue;
+    const dotted = chain.length > 1;
+    findings.push({
+      severity: dotted ? "error" : "warning",
+      rule: PREDICATE_RHS_PATH_SHAPED,
+      where,
+      path,
+      message: dotted ? `predicate compares against \`${text}\` on the RIGHT of \`${op}\`, which is a path but is not evaluated as one. A metadata-editing form resolves paths on the LEFT of \`${op}\` only; the right-hand side goes to the literal parser, so \`${text}\` is compared as the literal string "${text}". The verdict therefore does not depend on the right-hand path at all: \`a == ${text}\` is FALSE even when both sides hold the same value, and \`a != ${text}\` is correspondingly TRUE. An \`==\` written this way hides the element on every row, and nothing in the console says why (objectui#4049).` : `predicate compares against the unquoted word \`${text}\` on the RIGHT of \`${op}\`. The right-hand side of \`${op}\` is a literal, never a reference, so this is read as the literal string "${text}" \u2014 which is probably what you meant, and is why it appears to work. It is outside the declared subset all the same (\`path == 'literal'\`), and it stops working when this surface moves to the real CEL evaluator, where a bare \`${text}\` resolves to nothing (objectui#4049). The token also reads as a \`${ROOT}.\` root someone dropped, so this one finding carries BOTH readings: which one you meant is the thing no linter can know, and it changes the fix (#7696).`,
+      hint: dotted ? `Two sanctioned spellings. (1) If you meant the TEXT, quote it: \`${op} '${text}'\`. (2) If you meant the PATH, restructure so the path is on the LEFT and a literal is on the right \u2014 comparing one path against another is outside the subset this surface renders, which is \`path == 'literal'\` / \`path != 'literal'\` and nothing wider. There is no third spelling that compares two paths here.` : `Two sanctioned spellings, and you must pick \u2014 they are not the same predicate. (1) If you meant the TEXT \`${text}\`, quote it: \`${op} '${text}'\`. That is what this renders as today, so it changes no behaviour and is the fix unless you know otherwise. (2) If you meant the FIELD \`${ROOT}.${text}\`, move it to the LEFT and put a literal on the right, e.g. \`${ROOT}.${text} == 'yes'\`. \u26D4 Do NOT simply add the root in place: \`${op} ${ROOT}.${text}\` is a path on the RIGHT, which this surface parses as the literal string "${ROOT}.${text}" \u2014 it is refused by this same rule at \`error\`, and it is FALSE on every row. The subset here is \`path == 'literal'\` and nothing wider.`
+    });
+  }
+}
+function walkFields(entries, scope, where, base, findings, depth) {
+  if (!Array.isArray(entries) || depth > 12) return;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    if (!isRec22(entry)) continue;
+    const path = `${base}[${i}]`;
+    for (const key of PREDICATE_KEYS) {
+      const source = predicateSource2(entry[key]);
+      if (source !== void 0 && source.trim()) {
+        checkPredicate(source, scope, where, `${path}.${key}`, findings);
+        break;
+      }
+    }
+    if (Array.isArray(entry.fields) && entry.fields.length > 0 && typeof entry.field === "string") {
+      const row = scope === void 0 ? void 0 : rowScopeOf(scope, entry.field);
+      walkFields(entry.fields, row, where, `${path}.fields`, findings, depth + 1);
+    }
+  }
+}
+function validatePredicatePathRefs(stack, opts = {}) {
+  const resolveSchema = opts.resolveSchema ?? ((schemaId) => getMetadataTypeSchema(schemaId));
+  const findings = [];
+  for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
+    const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
+    for (const site of formViewSites(view, viewPath)) {
+      const schemaId = schemaIdOf(site.view);
+      if (!schemaId) continue;
+      let root;
+      try {
+        root = resolveSchema(schemaId);
+      } catch {
+        root = void 0;
+      }
+      const where = site.surface ? `view "${viewName}" \xB7 ${site.surface} (schema "${schemaId}")` : `view "${viewName}" (schema "${schemaId}")`;
+      for (const bucket of ["sections", "groups"]) {
+        const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
+        for (let s = 0; s < sections.length; s++) {
+          const section = sections[s];
+          if (!isRec22(section)) continue;
+          const sectionPath = `${site.path}.${bucket}[${s}]`;
+          for (const key of PREDICATE_KEYS) {
+            const source = predicateSource2(section[key]);
+            if (source !== void 0 && source.trim()) {
+              checkPredicate(source, root, where, `${sectionPath}.${key}`, findings);
+              break;
+            }
+          }
+          walkFields(section.fields, root, where, `${sectionPath}.fields`, findings, 0);
         }
       }
     }
@@ -6325,6 +7408,7 @@ var SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
 var SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
 var SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 var SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
+var SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
 var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
 var OWD_ALIAS_FIX = {
   read: "public_read",
@@ -6370,6 +7454,13 @@ function firstMasterDetailField(obj) {
   }
   return void 0;
 }
+function resolveCbpRelation(obj) {
+  const entries = asArray36(obj.fields);
+  const pick = (pred) => entries.find((f) => pred(f) && refOf(f));
+  const found = pick((f) => f.type === "master_detail" && !!f.required) ?? pick((f) => f.type === "master_detail") ?? pick((f) => f.type === "lookup" && !!f.required);
+  if (!found) return void 0;
+  return { field: String(found.name ?? "?"), type: String(found.type), master: refOf(found) };
+}
 function grantsObjectAccess(p) {
   return p.allowRead === true || p.allowCreate === true || p.allowEdit === true || p.allowDelete === true || p.viewAllRecords === true || p.modifyAllRecords === true;
 }
@@ -6415,6 +7506,16 @@ function validateSecurityPosture(stack, opts) {
         });
       }
     }
+    if (owd === "controlled_by_parent" && !resolveCbpRelation(obj)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_CBP_NO_RELATION,
+        where: `object "${objName}"`,
+        path: `${objPath}.sharingModel`,
+        message: `"${objName}" declares sharingModel 'controlled_by_parent' but has no relation the platform can derive access from. ADR-0055 resolves the master through a required master_detail, then any master_detail, then a required lookup \u2014 each of which must also name a reference target \u2014 and this object matches none of the three. At runtime every read is DENIED and every write is refused with 422 INVALID_METADATA (#7474), so the object is unusable rather than merely locked down.`,
+        hint: `Add the master relation this object is derived from, e.g. fields.parent: { type: 'master_detail', reference: '<master_object>', required: true }. If the object has no master, its baseline is its own decision \u2014 use sharingModel: 'private' (owner + shares), 'public_read', or 'public_read_write'.`
+      });
+    }
     if (typeof external === "string") {
       if (OWD_ALIAS_FIX[external]) {
         findings.push({
@@ -6480,53 +7581,6 @@ function validateSecurityPosture(stack, opts) {
       }
     }
   }
-  const flagRole = (kind, name, label2, where, path) => {
-    if (identifierHasRoleToken(name)) {
-      findings.push({
-        severity: "error",
-        rule: SECURITY_ROLE_WORD,
-        where,
-        path,
-        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
-        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
-      });
-    } else if (labelHasRoleWord(label2)) {
-      findings.push({
-        severity: "error",
-        rule: SECURITY_ROLE_WORD,
-        where,
-        path: `${path.replace(/\.name$/, "")}.label`,
-        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
-        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
-      });
-    }
-  };
-  for (let i = 0; i < objects.length; i++) {
-    const obj = objects[i];
-    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
-    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
-    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray36(obj.fields)) {
-      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
-    }
-    for (const [ai, action] of asArray36(obj.actions).entries()) {
-      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
-    }
-  }
-  for (let i = 0; i < permissionSets.length; i++) {
-    const ps = permissionSets[i];
-    if (!ps || typeof ps !== "object") continue;
-    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
-  }
-  for (const [i, pos] of asArray36(stack.positions).entries()) {
-    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
-  }
-  for (const [i, app] of asArray36(stack.apps).entries()) {
-    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
-  }
-  for (const [i, book] of asArray36(stack.books).entries()) {
-    flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
-  }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
@@ -6647,6 +7701,60 @@ function validateSecurityPosture(stack, opts) {
   }
   return findings;
 }
+function validateSecurityRoleWord(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objects = asArray36(stack.objects);
+  const permissionSets = asArray36(stack.permissions);
+  const flagRole = (kind, name, label2, where, path) => {
+    if (identifierHasRoleToken(name)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path,
+        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
+        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
+      });
+    } else if (labelHasRoleWord(label2)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path: `${path.replace(/\.name$/, "")}.label`,
+        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
+        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
+      });
+    }
+  };
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
+    for (const f of asArray36(obj.fields)) {
+      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
+    }
+    for (const [ai, action] of asArray36(obj.actions).entries()) {
+      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
+    }
+  }
+  for (let i = 0; i < permissionSets.length; i++) {
+    const ps = permissionSets[i];
+    if (!ps || typeof ps !== "object") continue;
+    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
+  }
+  for (const [i, pos] of asArray36(stack.positions).entries()) {
+    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
+  }
+  for (const [i, app] of asArray36(stack.apps).entries()) {
+    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
+  }
+  for (const [i, book] of asArray36(stack.books).entries()) {
+    flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
+  }
+  return findings;
+}
 
 // src/validate-org-axis-red-lines.ts
 var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
@@ -6805,9 +7913,15 @@ function validateSharingRuleEnforceability(stack) {
 }
 
 // src/validate-rls-predicate-enforceability.ts
-import { isPushdownableCel, isSupportedRlsExpression, sqlPredicateToCel } from "@objectstack/formula";
+import {
+  isPushdownableCel,
+  isSupportedRlsExpression,
+  parseCelToAstWithReason as parseCelToAstWithReason2,
+  sqlPredicateToCel
+} from "@objectstack/formula";
 var RLS_PREDICATE_UNENFORCEABLE = "rls-predicate-unenforceable";
 var RLS_PREDICATE_UNPARSEABLE = "rls-predicate-unparseable";
+var RLS_PREDICATE_OVER_BUDGET = "rls-predicate-over-budget";
 function asArray39(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -6819,6 +7933,13 @@ function str3(v) {
   return typeof v === "string" ? v : "";
 }
 var PUSHDOWN_SUBSET2 = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in`, `&&` `||` `!`, `== null` / `!= null`, and the string methods `startsWith` / `endsWith` / `contains` \u2014 over SINGLE-column field paths (ADR-0058 D2), compared against a literal or a `current_user.*` value.";
+function boundsOverrunOf(bridged) {
+  const parsed = parseCelToAstWithReason2(bridged);
+  return !parsed.ok && parsed.kind === "bounds" ? parsed.overrun : null;
+}
+function quote(source) {
+  return source.length > 200 ? `${source.slice(0, 197)}...` : source;
+}
 function consequence(clause) {
   const dropped = 'so `RLSCompiler` DROPS the policy at request time (one WARN line \u2014 "has an uncompilable predicate \u2026 and was DROPPED (no enforcement)" \u2014 is the only signal, and nothing reports it at authoring time). ';
   return clause === "using" ? dropped + "When it is the only applicable policy for that object and operation, `compileFilter` returns the `RLS_DENY_FILTER` sentinel instead, which is AND-ed onto the where clause: every select / update / delete on the object matches ZERO rows. When other policies also apply, this one just vanishes from the OR and grants none of the access it appears to." : dropped + "On the ADR-0058 D4 write path that leaves the post-image `check` as the `RLS_DENY_FILTER` sentinel, which no record can satisfy: every insert / update the policy governs fails with `PermissionDeniedError`. The policy reads as a write rule and behaves as a blanket refusal.";
@@ -6832,14 +7953,30 @@ function validateRlsPredicateEnforceability(stack) {
         const source = str3(policy[clause]);
         if (!source.trim()) continue;
         if (isSupportedRlsExpression(source)) continue;
-        const why = isPushdownableCel(sqlPredicateToCel(source));
+        const bridged = sqlPredicateToCel(source);
+        const why = isPushdownableCel(bridged);
         const detail = why.ok ? "" : why.detail;
         const parseError = !why.ok && why.reason === "parse-error";
+        const overrun = parseError ? boundsOverrunOf(bridged) : null;
         const psName = str3(ps.name) || String(psIndex);
         const policyName = str3(policy.name) || String(pIndex);
         const object = str3(policy.object);
         const where = `permission set "${psName}" policy "${policyName}"` + (object ? ` on object "${object}"` : "");
         const path = `permissions[${psIndex}].rowLevelSecurity[${pIndex}].${clause}`;
+        if (overrun) {
+          const bound = overrun.limit ?? "an unnamed platform CEL bound";
+          const budget = overrun.limitValue !== null ? ` (platform limit ${overrun.limitValue})` : "";
+          const measured = overrun.measured !== null ? `, this predicate measures ${overrun.measured}` : "";
+          findings.push({
+            severity: "error",
+            rule: RLS_PREDICATE_OVER_BUDGET,
+            where,
+            path,
+            message: `RLS ${clause} \`${quote(source)}\` is syntactically valid, lowerable CEL but overruns the platform parse bound ${bound}${budget}${measured} (${overrun.summary}), ` + consequence(clause),
+            hint: `There is no syntax or dialect error to correct here \u2014 the predicate is well-formed CEL and is simply too large for ${bound}${budget}, so the fix is to make it smaller or to move the work off the predicate. (1) Collapse a long \`field == a || field == b || \u2026\` chain into a single \`field in [a, b, \u2026]\`, which is far fewer AST nodes (\`maxListElements\` is 64, so a very large set needs option 2). (2) Pre-resolve the set into a membership key the runtime exposes and test \`field in current_user.<key>\` (ADR-0105 D11) \u2014 one comparison whatever the set size. (3) Denormalise a repeated sub-expression onto this object as a formula/rollup field and test that single column. (4) Split a TOP-LEVEL \`||\` across several \`rowLevelSecurity\` policies: applicable policies are OR-ed, so that is equivalent \u2014 but never split a top-level \`&&\` this way, which would WIDEN access rather than preserve it. Logic genuinely this large is not a row filter: move it to a hook or action body (\`ScriptBody { language: 'js' }\`, the L2 sandboxed surface).`
+          });
+          continue;
+        }
         if (parseError) {
           findings.push({
             severity: "error",
@@ -6870,11 +8007,11 @@ import { createRequire as createRequire4 } from "module";
 var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
 var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
 var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
-var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec23 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray40(v) {
-  if (Array.isArray(v)) return v.filter(isRec16);
-  if (isRec16(v)) {
-    return Object.entries(v).filter(([, def]) => isRec16(def)).map(([name, def]) => ({ name, ...def }));
+  if (Array.isArray(v)) return v.filter(isRec23);
+  if (isRec23(v)) {
+    return Object.entries(v).filter(([, def]) => isRec23(def)).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
@@ -6891,7 +8028,7 @@ function loadAjv() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
     );
   }
-  const ctor = isRec16(mod) && "default" in mod ? mod.default : mod;
+  const ctor = isRec23(mod) && "default" in mod ? mod.default : mod;
   cachedAjv = ctor;
   return ctor;
 }
@@ -6906,7 +8043,7 @@ function loadAddFormats() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
     );
   }
-  const plugin = isRec16(mod) && "default" in mod ? mod.default : mod;
+  const plugin = isRec23(mod) && "default" in mod ? mod.default : mod;
   cachedAddFormats = plugin;
   return plugin;
 }
@@ -6936,13 +8073,13 @@ function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
   if (depth >= MAX_RULE_NESTING_DEPTH) return out;
   for (const branch of ["then", "otherwise"]) {
     const nested = rule[branch];
-    if (isRec16(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+    if (isRec23(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
   }
   return out;
 }
 function walkObjectValidationRules(stack) {
   const walked = [];
-  if (!isRec16(stack)) return walked;
+  if (!isRec23(stack)) return walked;
   for (const obj of asArray40(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     const validations = obj.validations;
@@ -6977,7 +8114,7 @@ function validateRuleCompilability(stack) {
         });
       }
     }
-    if (rule.type === "json_schema" && isRec16(rule.schema)) {
+    if (rule.type === "json_schema" && isRec23(rule.schema)) {
       try {
         createRuntimeAjv().compile(rule.schema);
       } catch (err) {
@@ -6997,7 +8134,7 @@ function validateRuleCompilability(stack) {
 
 // src/validate-rule-schema-formats.ts
 var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
-var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec24 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var SUBSCHEMA_KEYS = [
   "additionalItems",
   "additionalProperties",
@@ -7021,7 +8158,7 @@ var SUBSCHEMA_MAP_KEYS = [
 var MAX_SCHEMA_WALK_DEPTH = 32;
 var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
 function collectFormatUses(schema, pointer, out, depth) {
-  if (!isRec17(schema)) return;
+  if (!isRec24(schema)) return;
   if (typeof schema.format === "string") {
     out.push({ pointer: `${pointer}/format`, name: schema.format });
   }
@@ -7040,7 +8177,7 @@ function collectFormatUses(schema, pointer, out, depth) {
   }
   for (const key of SUBSCHEMA_MAP_KEYS) {
     const value = schema[key];
-    if (!isRec17(value)) continue;
+    if (!isRec24(value)) continue;
     for (const [name, entry] of Object.entries(value)) {
       collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
     }
@@ -7048,13 +8185,13 @@ function collectFormatUses(schema, pointer, out, depth) {
   const items = schema.items;
   if (Array.isArray(items)) {
     items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
-  } else if (isRec17(items)) {
+  } else if (isRec24(items)) {
     collectFormatUses(items, `${pointer}/items`, out, depth + 1);
   }
   const dependencies = schema.dependencies;
-  if (isRec17(dependencies)) {
+  if (isRec24(dependencies)) {
     for (const [name, entry] of Object.entries(dependencies)) {
-      if (!isRec17(entry)) continue;
+      if (!isRec24(entry)) continue;
       collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
     }
   }
@@ -7093,7 +8230,7 @@ function validateRuleSchemaFormats(stack) {
   const findings = [];
   const pending = [];
   for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
-    if (rule.type !== "json_schema" || !isRec17(rule.schema)) continue;
+    if (rule.type !== "json_schema" || !isRec24(rule.schema)) continue;
     const uses = [];
     collectFormatUses(rule.schema, "", uses, 0);
     for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
@@ -7126,7 +8263,7 @@ function asArray41(v) {
   }
   return [];
 }
-function strName17(v) {
+function strName20(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
@@ -7141,7 +8278,7 @@ function collectNamePlacedActions(stack) {
       for (const n of strList3(list3[key])) placed.add(n);
     }
     for (const def of asArray41(list3.bulkActionDefs)) {
-      const n = strName17(def?.name);
+      const n = strName20(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -7167,7 +8304,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName17(action.name);
+    const name = strName20(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -7176,7 +8313,7 @@ function validateActionLocations(stack) {
       where: `action "${name}"`,
       path,
       message: `Action "${name}" declares no \`locations\` and no view places it by name, so it renders on no surface \u2014 the button exists in metadata and nowhere in the UI.`,
-      hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`, `global_nav`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
+      hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
     });
   };
   const actions = asArray41(stack.actions);
@@ -7197,6 +8334,7 @@ import {
   APPROVAL_REVISE_NODE_TYPE,
   collectFlowGraphs as collectFlowGraphs2
 } from "@objectstack/spec/automation";
+import { reduceFilterVerdict as reduceFilterVerdict2 } from "@objectstack/spec/data";
 function asArray42(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -7471,7 +8609,21 @@ function scanBranchRouting(at, nodes, edges, findings) {
 function filterCarriesNoCondition(filter) {
   if (filter === void 0 || filter === null) return true;
   if (typeof filter !== "object" || Array.isArray(filter)) return false;
-  return Object.keys(filter).length === 0;
+  return reduceFilterVerdict2(filter) === "true";
+}
+function describeUnboundedFilter(filter) {
+  if (filter === void 0 || filter === null) return "no `filter` key";
+  if (Object.keys(filter).length === 0) return "an EMPTY `filter`";
+  return `a \`filter\` that REDUCES TO TRUE (\`${previewFilter(filter)}\`)`;
+}
+function previewFilter(filter) {
+  try {
+    const json = JSON.stringify(filter);
+    if (typeof json !== "string") return typeof filter;
+    return json.length > 80 ? `${json.slice(0, 77)}...` : json;
+  } catch {
+    return typeof filter;
+  }
 }
 function scanUnboundedBulkWrites(at, nodes, findings) {
   for (const node of nodes) {
@@ -7482,10 +8634,10 @@ function scanUnboundedBulkWrites(at, nodes, findings) {
     if (cfg.multi !== true) continue;
     if (!filterCarriesNoCondition(cfg.filter)) continue;
     const objectName = typeof cfg.objectName === "string" && cfg.objectName ? cfg.objectName : "(unnamed object)";
-    const filterState = cfg.filter === void 0 || cfg.filter === null ? "no `filter` key" : "an EMPTY `filter`";
+    const filterState = describeUnboundedFilter(cfg.filter);
     findings.push({
       where: `${at} \xB7 node '${String(node.id)}' (${nodeType})`,
-      message: `declares \`multi: true\` with ${filterState} \u2014 this is a WHOLE-OBJECT write, by declaration: every row of '${objectName}' is ${consequence2.verb} on every run. The executor forwards \`where: {}\` plus the bulk intent, ${consequence2.dispatchNote}, and it lands on \`${consequence2.engineCall}\` with no predicate. Nothing refuses it at run time, so the only feedback is the step's \`acted\` row count \u2014 reported AFTER the rows are gone.`,
+      message: `declares \`multi: true\` with ${filterState} \u2014 this is a WHOLE-OBJECT write, by declaration: every row of '${objectName}' is ${consequence2.verb} on every run. The executor forwards the filter as \`where\` (an absent key becomes \`{}\`) plus the bulk intent, ${consequence2.dispatchNote}, and it lands on \`${consequence2.engineCall}\` bounded by nothing \u2014 a filter that reduces to TRUE constrains no row. Nothing refuses it at run time, so the only feedback is the step's \`acted\` row count \u2014 reported AFTER the rows are gone.`,
       hint: `Write the constraint you mean into \`filter\` (e.g. \`{ status: 'closed' }\` \u2014 see examples/app-showcase \`showcase_inquiry_purge\`, bulk intent bounded by a predicate). If emptying '${objectName}' really is the intent, keep it: this is a warning, not a gate, and the run-time path stays open. Distinct from the #3810 erased-condition guard, which REFUSES this node at run time when a condition you WROTE interpolated to nothing \u2014 that guard is keyed on "a written condition is gone" and deliberately not on "the filter is empty", which is the fact this rule judges at authoring time. (#5482, #5393)`,
       // Warning, not `error`: see the severity policy at the top of this file.
       // The shape has a legitimate reading the engine grants on purpose, so it is
@@ -7786,6 +8938,13 @@ var TYPE_COLLECTIONS = [
   // checks every widget on the dashboard. Registering it here is not optional
   // bookkeeping: without it the ledger would be newly correct and newly
   // silent, which is the shape this lint exists to prevent.
+  //
+  // As of #6774 the dashboard ledger warns on NOTHING — four of those five were
+  // retired in 17.0.0 (#5010) and `colorVariant` went `live` when objectui#3799
+  // gave it a renderer. The type STAYS listed, the resolved state `webhook` and
+  // `email_template` already sit in: a zero-warn entry costs one empty map
+  // lookup, and it means a future regression that re-deadens a widget key warns
+  // on its own instead of waiting for someone to notice this list again.
   { type: "dashboard", key: "dashboards" }
 ];
 function lintLivenessProperties(stack) {
@@ -8157,8 +9316,12 @@ var AUTHORING_RULES = [
     }))
   },
   // ADR-0053 — `userFilters`/`quickFilters` on an object list view ("views"
-  // mode) are silently dropped: `ObjectListViewSchema` omits them, so this must
-  // read the pre-parse tier or the evidence is already gone.
+  // mode). NOT "silently dropped" any more: since #4001 `ObjectListViewSchema`
+  // is strict and refuses `quickFilters` by name, and `ObjectUserFiltersSchema`
+  // refuses `element: 'tabs'` by enum — measured under #6073, `defineStack`
+  // THROWS on both. `normalized` here therefore means "needs no parsed stack"
+  // (so `os lint`, which never parses, can run it), not "sees evidence the
+  // parse would have eaten".
   {
     name: "validateListViewMode",
     tier: "gating",
@@ -8189,9 +9352,38 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_OBJECT_WRITES_P2,
     run: (stack) => validateFunctionalCompleteness(stack)
   },
-  // A flat list-view object in `views: []` parses to an EMPTY container
-  // (ViewSchema strips unknown keys): the schema step passes, zero views
-  // register, and the Console renders nothing. Pre-parse for the same reason.
+  // [#7521, via cloud#1225] A managed object advertising a generic write verb
+  // in `enable.apiMethods` that its own resolved affordances refuse. Every key
+  // is one we know and each is individually valid, so #4001's unknown-key
+  // rejection and the Zod parse both pass it; the contradiction is only visible
+  // when the two keys are read TOGETHER, which nothing did at authoring time.
+  //
+  // `gating` because the declaration is already false when it ships: objectql's
+  // registry strips the verb at registration, so the metadata advertises an API
+  // the product does not serve. That strip has been correct and silent — a
+  // `console.warn` on every control-plane boot that went unread for the life of
+  // a real divergence (`sys_environment`/`sys_package`). This entry is the
+  // ruling's "close it where the author is"; boot stays warn-and-strip.
+  //
+  // Pre-parse: the predicate reads only authored keys, and the finding must
+  // survive an unrelated schema error elsewhere in the stack.
+  {
+    name: "validateManagedApiMethods",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-managed-api-methods.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateManagedApiMethods(stack)
+  },
+  // A view container in `views: []` that registers zero views: nothing appears
+  // in the Console, and the schema step cannot tell it from an intentionally
+  // empty one. The FLAT-list-view arm no longer needs this tier — `ViewSchema`
+  // went strict at #4001, so `defineStack` now REFUSES `{ name, type, columns,
+  // data }` by name with the wrap-it hint (measured under #6073); the arm that
+  // still needs a rule is the all-slots-empty container, whose keys are all
+  // declared and which survives the parse untouched.
   {
     name: "validateViewContainers",
     tier: "gating",
@@ -8241,6 +9433,31 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateFilterTokens(stack)
   },
+  // #5330 — the LITERAL empty combinators (`$and: []`, `$or: []`, `$not: {}`,
+  // `{}`). #5322 ruled their RUNTIME meaning to be the boolean identity, and
+  // this rule does not touch it: it refuses the literal SPELLINGS at authoring
+  // time with a per-shape prescription, which is Prime Directive #12's standard
+  // shape (reject at the producer, never tolerate at the consumer) and #5240's
+  // same-direction precedent one shape over.
+  {
+    name: "validateEmptyCombinators",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-empty-combinators.ts",
+    // The one type #4463's P1 slice opened, and the one this rule most needs:
+    // a flow CRUD node's `config.filter` is where an empty combinator has the
+    // largest blast radius, and the write path is the only door an AI author
+    // uses. This rule needs NO resolution context at all — it judges the filter
+    // literal in isolation — so RUNTIME_NEEDS_FULL_SNAPSHOT does not apply to
+    // it, and widening to the other filter-carrying types (`object`, `view`,
+    // `page`, `dashboard`) is a one-line `runtimeTypes` edit once #4463 P2
+    // opens them at the gate. Making that call here would widen the gate's
+    // dispatch surface on this rule's authority, which is P2's decision.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["flow"],
+    run: (stack) => validateEmptyCombinators(stack)
+  },
   // The reference-integrity suite (#3583 §5 D5) — itself a registry, of the
   // rules that answer "does this name resolve to anything?". It reached all
   // three commands before this file existed; it is an entry here so the two
@@ -8289,6 +9506,16 @@ var AUTHORING_RULES = [
   // `displayField` (#5775) — so gating today would fail the platform's own pages
   // to enforce declarations the platform does not keep. The error upgrade is a
   // separate step, once the warning-period inventory is empty.
+  //
+  // #5775 settled the record picker's half: `displayField` is retired in favour
+  // of the `labelField` the renderer actually reads. Its claim that "the rest of
+  // the keys the renderers honour are declared" did NOT hold — #6776 found five
+  // more (`page:header` `recordChrome`/`showStar`/`showCopyId`,
+  // `page:accordion.variant`, and the tab strip's visual style, whose declared
+  // spelling `page:tabs.type` collided with the component node's own dispatch
+  // key and so was unauthorable in the flat and JSX carriers). All five are
+  // declared as of #6776, the last as the renamed `tabStyle`. What remains
+  // before the error upgrade is #5728 and two page rewrites.
   {
     name: "validateComponentProps",
     tier: "advisory",
@@ -8367,10 +9594,12 @@ var AUTHORING_RULES = [
   //
   // `gating` since #5762, which reviewed the file's rules as one family and
   // split them on a single question: is THIS STACK enough to know the flow is
-  // dead? Three rules answer yes and now emit `error` — a `config.timeRelative`
+  // dead? Four rules answer yes and emit `error` — a `config.timeRelative`
   // the spec's own `TimeRelativeTriggerSchema` refuses, one the engine's routing
-  // predicate cannot route at all, and a `record-*` triggerType outside the
-  // closed token grammar `triggerTypeToHookEvents` maps. None of those verdicts
+  // predicate cannot route at all, a `record-*` triggerType outside the
+  // closed token grammar `triggerTypeToHookEvents` maps, and (#6637) a
+  // `type: 'record_change'` flow whose triggerType the engine's binding resolver
+  // routes nowhere, silently demoting it to a manual flow. None of those verdicts
   // can be changed by installing a package, so there is no reading under which
   // the flow fires. `flow-trigger-unknown-object` deliberately stayed `warning`
   // (the object may come from another installed package — a hedge this rule
@@ -8497,19 +9726,117 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateSeedStateMachine(stack)
   },
-  // ADR-0089 D3b — deprecated visibility aliases and a mis-layered binding root.
-  // Pre-parse: the schema folds `visibleOn`/`visibility` into `visibleWhen`
-  // during parse, so the alias the author wrote is gone from `result.data`.
+  // ADR-0089 D3b — a mis-layered binding root, plus (#6128) the bare-identifier
+  // gate and (#6253) the syntax gate. This entry used to read "pre-parse: the
+  // schema folds `visibleOn`/`visibility` into `visibleWhen` during parse, so
+  // the alias the author wrote is gone from `result.data`". Measured false at
+  // #6073: the ADR-0087 D2 conversions do that fold INSIDE
+  // `normalizeStackInput`, one layer BEFORE this tier, so on every spec-valid
+  // alias site the alias-KEY rule reported zero here too.
+  //
+  // #6318 closed that: `visibility-alias-deprecated` was RETIRED rather than
+  // re-anchored. Re-anchoring would have had to move this entry's input to a
+  // pre-`normalizeStackInput` value that `runAuthoringRules` does not accept —
+  // a change to this package's external input contract, and the maintainer's
+  // call, not a rule file's. Retirement is ADR-0049 (declared ≠ enforced) and
+  // costs no author a signal: the same D2 conversion already shouts through
+  // `warnConversionNotice` in `defineStack`, naming the site, the conversion and
+  // the protocol-16 retirement window — better wording than the rule ever had.
+  //
+  // Every rule left in the family judges the predicate's VALUE, and the value
+  // moves into `visibleWhen` intact, so all three report normally on this tier.
+  // The tier therefore stays `normalized` on its SURVIVING justification (a
+  // finding still reaches the author when an unrelated schema error would stop
+  // the parse — see `AuthoringRuleInputTier`), never on the retired
+  // "pre-parse evidence" one.
+  //
+  // `gating` since #6128: `visibility-bare-identifier` emits `error`. The two
+  // ADR-0089 rules stay advisory findings within it — the tier is a property of
+  // the RULE FUNCTION (can it emit `error`?), and the per-finding severity is
+  // what decides whether any given diagnostic gates, exactly as `lintFlowPatterns`
+  // has worked since #3760. The promotion follows the #5762 precedent: a family
+  // that gains an `error` finding moves its registry tier in the same edit.
+  //
+  // ─── The `views[]` visibility-predicate FAMILY at the runtime door (#7220) ───
+  //
+  // This entry and `validatePredicatePathRefs` below moved to `runtime-publish`
+  // in ONE edit, on the maintainer's 2026-08-10 ruling, sequenced after #4717's
+  // `advisories` channel landed (PR #7435). Before that move a `view` written
+  // through Studio / REST `/meta` / MCP — the only door most tenants have, and
+  // the door AI authors use — was judged by NONE of the family's rule ids (six
+  // at the time of the move; seven since #7659 added
+  // `predicate-rhs-path-shaped` inside the second entry).
+  //
+  // They move together on purpose, and the two entries carry one comment because
+  // they are one wall: #7214's implementer wired its own rule here alone and then
+  // REVERTED it, because a `view` refused for an unresolvable predicate PATH
+  // while a predicate that does not parse at all walks through the same door is
+  // less predictable than refusing neither. A half-wired wall is worse than an
+  // unwired one, so `authoring-rule-wiring.test.ts` now pins the family property
+  // directly: every id on this surface is gated at the runtime door, or none is.
+  //
+  // The previous `surfaceReason` on THIS entry was `RUNTIME_NEEDS_FULL_SNAPSHOT`,
+  // and re-measuring it at move time found it false: both rule functions read
+  // `stack.views` and `stack.pages` and NO other collection — never `objects` —
+  // so the per-write snapshot the gate builds is not partial for them, it is
+  // complete. (`pages` is simply absent on a `view` write, so the page half
+  // contributes zero findings to both differential passes rather than inventing
+  // any.) The reason was not describing this rule; it was the default a rule got
+  // when nobody measured, which is the #4409/#4463 defect one layer in.
+  //
+  // Runtime input tier: the gate hands the rules the body as persisted, without
+  // `normalizeStackInput`, so the ADR-0087 D2 alias fold does NOT run at this
+  // door. That costs the family nothing — `validateVisibilityPredicates` reads
+  // `visibleWhen ?? visibleOn ?? visibility` itself, canonical-first, precisely
+  // so a caller handing it a raw authored object still gets a verdict.
   {
     name: "validateVisibilityPredicates",
-    tier: "advisory",
+    tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-visibility-predicates.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["view"],
     run: (stack) => validateVisibilityPredicates(stack)
   },
+  // #7010 — the same predicate surface, one question further in. The three
+  // ADR-0089 D3b rules above judge a predicate's SHAPE (does it parse, is it
+  // rooted, is the root right for the layer) and never open the target schema,
+  // so `data.tpye == 'formula'` passes all three and still resolves to nothing.
+  // This rule resolves the PATH against the schema the form edits — the closed
+  // `getMetadataTypeSchema` key set — and is therefore immune to the CEL
+  // type-name blind spot that made #6248's gate structurally unable to catch
+  // #6254's 16 bare `type ==` predicates.
+  //
+  // Scoped to schema-bound forms (`data: { provider: 'schema', schemaId }`);
+  // the `record.*` layer is deliberately out of scope because an ObjectQL
+  // object's addressable path set is NOT closed (lookup traversal, system
+  // columns, formula outputs), and an `error` gate over an open set generates
+  // false build errors. See the rule's module note.
+  //
+  // #7659 adds a THIRD id here, `predicate-rhs-path-shaped`, which is not a
+  // resolution question at all: the metadata-admin renderer resolves paths only
+  // on the LEFT of `==` / `!=` and hands the right side to its literal parser,
+  // so `data.a == data.b` resolves both sides cleanly, passes the two rules
+  // above, and still compares against the string "data.b" — a constant verdict.
+  // It carries `error` on a dotted chain (no reading under which it worked) and
+  // `warning` on a bare word (`status == active` compares as the text today, so
+  // refusing it would fail a build over metadata that renders correctly). The
+  // per-finding severity is what gates, exactly as `lintFlowPatterns` has worked
+  // since #3760; the entry's `gating` tier is unchanged because it already was.
+  {
+    name: "validatePredicatePathRefs",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-predicate-path-refs.ts",
+    // The second half of the #7220 family move — see the block above the
+    // `validateVisibilityPredicates` entry. This is the rule whose solo wiring
+    // was reverted; it is wired now because its siblings are.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["view"],
+    run: (stack) => validatePredicatePathRefs(stack)
+  },
   // #1874 — flow authoring anti-patterns. Advisory by default; a finding marked
   // `error` gates. Three do today: `flow-runas-unscoped` (#3760 — metadata the
   // runtime REFUSES to execute), plus `flow-branch-label-unmatched` and
@@ -8667,16 +9994,110 @@ var AUTHORING_RULES = [
   // a runtime enforcement point (fail-closed OWD default, canonical enum, anchor
   // binding gate, vocabulary freeze), moving the failure from a runtime deny to
   // an author-time fix-it. Per ADR-0049 this is not advisory security.
+  //
+  // [#7576] The `surfaceReason` below is MEASURED. Its predecessor was not, and
+  // was false in both halves — it read: "Already gated at this surface by a
+  // DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on
+  // `object` (`registerAuthoringGate`) that enforces the same OWD posture rules
+  // on every runtime write. Running the linter here as well would double-report
+  // one refusal in two vocabularies."
+  //
+  //  - COVERAGE. `object-posture-gate.ts` reads exactly `sharingModel` and
+  //    `externalSharingModel` through a local `OWD_WIDTH`, and never touches
+  //    `fields`, `permissions`, `books` or `data`. Of the THIRTEEN rule ids this
+  //    block carries it covers ONE — `security-external-wider-than-internal`
+  //    (its R2). The gate's other half, R1 (env-tighten-only, ADR-0086 D1),
+  //    corresponds to no lint rule at all, so it is not coverage in the other
+  //    direction either. Twelve rules were enforced at no runtime door while
+  //    this field said they were.
+  //  - DOUBLE-REPORTING. It cannot happen, and not by luck: `saveMetaItem` runs
+  //    `assertRuntimeAuthoringRules` (this table, 422 `invalid_metadata`) BEFORE
+  //    `runAuthoringGate` (the ADR-0094 gate, 403 `owd_external_wider`), and
+  //    both refuse by THROWING. The first to fire ends the write, so an author
+  //    sees one refusal, never two. The stated cost of moving was imaginary; the
+  //    reason it has not moved is the measured one below.
+  //
+  // The move IS taken now — the #7891 programme's three slices, in order:
+  //
+  //  - #8307: the ADR-0091 seed pair crossed (`runtimeTypes: ['seed']`), with
+  //    the isolation proof that the differential cancels every finding this
+  //    function derives from the sibling collections.
+  //  - #8309: the snapshot repair. The gate used to carry `objects` and
+  //    nothing else, so the three cross-collection rules judged a universe
+  //    missing the collection they compare against (measured: 38 phantom
+  //    `security-master-detail-ungranted` per-write vs 4 whole-stack,
+  //    PR #7886). `RuntimeStackContext` now carries `permissions`/`books` in
+  //    BOTH differential passes and `TYPE_TO_STACK_KEY` maps both types.
+  //  - #8310 slice 1: `runtimeTypes` gains `permission` + `book` (PR #8546).
+  //    `object` measured DIRTY on that tree and was escalated, not forced.
+  //  - #8310 slice 2 (this state): `object` crosses under the maintainer
+  //    ruling recorded on #8310 (2026-08-13, 「接受你的全部建议」): an
+  //    authored OWD is REQUIRED at the runtime object door — an object
+  //    publish with no authored `sharingModel` is refused with the 422 lint
+  //    envelope (`security-owd-unset`); absence is not a decision. The ~16
+  //    objectql/rest suite files that relied on OWD-less publishes were
+  //    repaired honestly (fixtures author their posture), and
+  //    `meta-object-owd-gate.test.ts` re-pins the door ORDER: this table
+  //    answers first (`saveMetaItem` runs it before `runAuthoringGate`), the
+  //    ADR-0094-seam 403 doors answer for what passes lint. The same ruling
+  //    retired the plugin gate's R2 `owd_external_wider` arm as a duplicate
+  //    of this door (R1 env-tighten-only STAYS — no lint rule covers it);
+  //    see `object-posture-gate.ts` and the ADR-0094 amendment.
+  //
+  // `security-role-word` is NOT in this entry any more — that is what the
+  // `validateSecurityRoleWord` entry below records. It judges six collections
+  // (objects, fields, actions, permission sets, positions, apps — plus books),
+  // and `positions`/`apps` are neither carried by the per-write snapshot nor
+  // mapped in `TYPE_TO_STACK_KEY`, so declaring `permission`/`book` on a
+  // function that still contained it would have enforced ONE rule id for a
+  // strict subset of its collections: a door where a permission set named
+  // `role_manager` is refused and a position named `sales_role` walks through
+  // — the #7220 failure this table refuses to build, in either direction. The
+  // rule therefore stays behind WHOLE (#8310's explicit call), as its own
+  // entry.
+  //
+  // This entry remains the rest of the D7 block (12 rule ids) as ONE
+  // registration, not a per-rule split: the baseline/candidate differential is
+  // what keeps a write of one declared type from leaking the other rules'
+  // whole-stack findings — every finding derived from a sibling collection is
+  // produced byte-identically in both passes and cancels in the diff. Only
+  // findings the written item itself adds are attributed to the write.
   {
     name: "validateSecurityPosture",
     tier: "gating",
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-security-posture.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: "Already gated at this surface by a DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on `object` (`registerAuthoringGate`) that enforces the same OWD posture rules on every runtime write. Running the linter here as well would double-report one refusal in two vocabularies. Consolidating the two onto this table is P2 (#4463), and is a merge, not a hole.",
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["seed", "permission", "book", "object"],
     run: (stack) => validateSecurityPosture(stack)
   },
+  // [ADR-0090 D3 / #8310] The vocabulary freeze, split out of
+  // `validateSecurityPosture` the day the rest of that block crossed the
+  // runtime wall — so that it could stay behind WHOLE rather than cross for
+  // three of the six collections it judges (#7220: one rule id must sit on ONE
+  // side of the wall). The split is a surface boundary, not taste: the rule's
+  // verdict and findings are byte-identical to before on every CLI command
+  // (both entries run on all three), and the runtime door does not run it for
+  // ANY type.
+  //
+  // The road to crossing is concrete and short, recorded here so the next
+  // seat prices it correctly: carry `positions`/`apps` in
+  // `RuntimeStackContext` + `CONTEXT_STACK_KEYS`, map both types in
+  // `TYPE_TO_STACK_KEY` (both are `allowRuntimeCreate: true`, so the writes
+  // are real), then declare `runtimeTypes: ['object', 'permission', 'book',
+  // 'position', 'app']` on THIS entry — all six collections in one edit, the
+  // #7220 discipline satisfied.
+  {
+    name: "validateSecurityRoleWord",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-security-posture.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: "P2 (#4463)/#8310: judges six collections (objects, fields, actions, permission sets, positions, apps \u2014 plus books), and the per-write snapshot neither carries nor maps positions/apps. Wiring it for the mapped types alone would enforce one rule id for three of its six collections \u2014 the #7220 split (an object named sales_role refused while a position named sales_role walks through). It crosses whole \u2014 positions/apps carried, mapped and declared \u2014 or stays behind; it stays behind until that wiring exists.",
+    run: (stack) => validateSecurityRoleWord(stack)
+  },
   // ADR-0105 D6 — the org tree is a REPORTING dimension. An RLS policy or
   // sharing rule that walks it builds a second permission hierarchy (the
   // dual-hierarchy mistake ADR-0057 D5 retired) and cannot widen Layer 0 anyway,
@@ -8727,7 +10148,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-rls-predicate-enforceability.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: "P2 (#4463): the rule reads `stack.permissions[]`, a stack-wide collection the per-write snapshot does not carry, and P1 gates `flow` alone. It is otherwise snapshot-ready \u2014 it needs no other collection \u2014 so widening it is a `runtimeTypes: ['permission_set']` edit once the gate builds that snapshot, not new wiring. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
+    surfaceReason: "The rule reads `stack.permissions[]`, which the per-write snapshot DOES carry since #8309 \u2014 the remaining gap is only the declaration: no `runtimeTypes` names `permission` here, and that flip is a rollout decision on #8310's axis, not a wiring fix. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
     run: (stack) => validateRlsPredicateEnforceability(stack)
   },
   // #4762 — the same "declared but enforces nothing" question, for the two
@@ -8785,8 +10206,34 @@ var TYPE_TO_STACK_KEY = {
   dashboard: "dashboards",
   agent: "agents",
   hook: "hooks",
-  seed: "seeds"
+  // [#7576] `data`, NOT `seeds`. The metadata TYPE is `seed`; the stack KEY that
+  // holds seeds is `data` (`ObjectStackDefinitionSchema.data: z.array(SeedSchema)`)
+  // — a stack has no `seeds` key at all, and `PLURAL_TO_SINGULAR` declares no
+  // mapping onto one either.
+  //
+  // The wrong spelling was INERT rather than harmless, and it is the #4449 shape
+  // one surface over: the wiring guard asks only that a declared type HAS a
+  // mapping, never that the mapping names a key some rule reads. So it would
+  // have stayed green while the gate built `{ objects, seeds: [item] }` for
+  // every seed write and every rule reading `stack.data` saw nothing — wired,
+  // and running on nothing, with `rulesRun` reporting the rules as having run.
+  // Nothing declared `seed` in `runtimeTypes` at the time, so correcting it
+  // changed no behaviour then; it was corrected here, with the measurement
+  // that found it (#7576), rather than left for the rollout card to trip
+  // over. The ADR-0091 seed pair now DOES declare `seed` (#8307), so this
+  // mapping is load-bearing today, not merely inert-and-correct.
+  seed: "data",
+  // [#8309] `permission`/`book` map ahead of their registration (#8310), the
+  // same order `seed` arrived in: the mapping plus the enriched snapshot below
+  // are this card's halves, and the `runtimeTypes` flip is deliberately NOT —
+  // a mapping without a declaring rule is inert by construction (the gate
+  // filters by `runtimeTypes` before it ever consults this table), while a
+  // declaration without the mapping is the wired-onto-nothing state the wiring
+  // guard refuses. Landing the mapping first keeps #8310 a registry data edit.
+  permission: "permissions",
+  book: "books"
 };
+var CONTEXT_STACK_KEYS = ["objects", "permissions", "books"];
 function runtimeAuthoringRulesFor(type) {
   return AUTHORING_RULES.filter(
     (r) => r.surfaces.includes("runtime-publish") && (r.runtimeTypes ?? []).includes(type)
@@ -8804,6 +10251,23 @@ function stackKeyForType(type) {
   return TYPE_TO_STACK_KEY[type] ?? null;
 }
 var fingerprint = (f) => `${f.rule}\0${f.where}\0${f.path}\0${f.message}`;
+function buildRuntimeWriteSnapshots(args) {
+  const stackKey = stackKeyForType(args.type);
+  if (!stackKey) return null;
+  if (!args.item || typeof args.item !== "object") return null;
+  const item = args.item;
+  const itemName = typeof item.name === "string" ? item.name : void 0;
+  const baseline = {};
+  for (const key of CONTEXT_STACK_KEYS) {
+    const collection = args.context?.[key] ?? [];
+    baseline[key] = key === stackKey ? collection.filter((o) => !itemName || o?.name !== itemName) : collection;
+  }
+  const candidate = {
+    ...baseline,
+    [stackKey]: [...baseline[stackKey] ?? [], item]
+  };
+  return { baseline, candidate };
+}
 function runRules(rules, stack, ctx) {
   const findings = [];
   for (const rule of rules) {
@@ -8826,19 +10290,15 @@ function runRuntimeAuthoringRules(args) {
   const rules = runtimeAuthoringRulesFor(args.type);
   const empty = { errors: [], advisories: [], rulesRun: [] };
   if (rules.length === 0) return empty;
-  const stackKey = stackKeyForType(args.type);
-  if (!stackKey) return empty;
-  if (!args.item || typeof args.item !== "object") return empty;
-  const item = args.item;
-  const itemName = typeof item.name === "string" ? item.name : void 0;
-  const contextObjects = args.context?.objects ?? [];
+  const snapshots = buildRuntimeWriteSnapshots({
+    type: args.type,
+    item: args.item,
+    ...args.context !== void 0 ? { context: args.context } : {}
+  });
+  if (!snapshots) return empty;
   const ctx = { sduiManifest: args.sduiManifest };
-  const writesIntoContext = stackKey === "objects";
-  const baselineObjects = writesIntoContext ? contextObjects.filter((o) => !itemName || o?.name !== itemName) : contextObjects;
-  const baseline = { objects: baselineObjects };
-  const candidate = writesIntoContext ? { objects: [...baselineObjects, item] } : { objects: baselineObjects, [stackKey]: [item] };
-  const before = new Set(runRules(rules, baseline, ctx).map(fingerprint));
-  const added = runRules(rules, candidate, ctx).filter((f) => !before.has(fingerprint(f)));
+  const before = new Set(runRules(rules, snapshots.baseline, ctx).map(fingerprint));
+  const added = runRules(rules, snapshots.candidate, ctx).filter((f) => !before.has(fingerprint(f)));
   return {
     errors: added.filter((f) => f.severity === "error"),
     advisories: added.filter((f) => f.severity !== "error"),
@@ -8846,6 +10306,7 @@ function runRuntimeAuthoringRules(args) {
   };
 }
 export {
+  buildRuntimeWriteSnapshots,
   runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor,
   runtimeGatedTypes,