@objectstack/lint 17.0.0-rc.6 → 17.0.0

package/dist/index.js

@@ -3,7 +3,11 @@ import { isIncoherentAggregate } from "@objectstack/spec/data";
 import { ChartTypeSchema } from "@objectstack/spec/ui";
 
 // src/system-fields.ts
-import { FIELD_GROUP_SYSTEM_FIELDS, resolveInjectedSystemColumns } from "@objectstack/spec/data";
+import {
+  FIELD_GROUP_SYSTEM_FIELDS,
+  resolveInjectedSystemColumns,
+  unprovisionedInjectedColumns
+} from "@objectstack/spec/data";
 import { SystemFieldName } from "@objectstack/spec/system";
 var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
   ...FIELD_GROUP_SYSTEM_FIELDS,
@@ -12,6 +16,34 @@ var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
 function injectedColumnsFor(objectDef) {
   return resolveInjectedSystemColumns(objectDef).names;
 }
+function unprovisionedInjectedColumnsFor(objectDef) {
+  return new Set(unprovisionedInjectedColumns(objectDef));
+}
+function objectDefsOf(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const objects = stack.objects;
+  if (Array.isArray(objects)) return objects.filter((o) => !!o && typeof o === "object");
+  if (objects && typeof objects === "object") {
+    return Object.entries(objects).filter(([, def]) => !!def && typeof def === "object").map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function indexUnprovisionedAnchors(stack) {
+  const index = /* @__PURE__ */ new Map();
+  for (const obj of objectDefsOf(stack)) {
+    const name = typeof obj.name === "string" && obj.name.length > 0 ? obj.name : void 0;
+    if (!name) continue;
+    const anchors = unprovisionedInjectedColumnsFor(obj);
+    if (anchors.size > 0) index.set(name, anchors);
+  }
+  return index;
+}
+function unprovisionedAnchorCause(objectName, field) {
+  return `'${field}' is an injected system column with NO storage behind it: '${objectName}' is an external object (ADR-0015), so the remote database owns its schema and the platform registers this anchor without provisioning a column`;
+}
+function unprovisionedAnchorHint(objectName, field) {
+  return `If the remote table really carries '${field}', declare it in ${objectName}'s own fields (mapped through the external binding's columnMap) so the reference resolves to a column you vouch for; otherwise drop the reference, or opt the object out of the injection (\`ownership: 'none'\` for the ownership anchors, \`systemFields: { audit: false }\` for the audit family).`;
+}
 
 // src/validate-widget-bindings.ts
 var WIDGET_DATASET_UNKNOWN = "widget-dataset-unknown";
@@ -24,6 +56,7 @@ var MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 var WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 var WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 var DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
+var DASHBOARD_FILTER_FIELD_UNPROVISIONED = "dashboard-filter-field-unprovisioned";
 var LEGACY_ANALYTICS_KEYS = [
   "categoryField",
   "valueField",
@@ -143,6 +176,7 @@ function validateWidgetBindings(stack) {
     }
     objectFieldTypes.set(o.name, fm);
   }
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const datasetList = asArray(stack.datasets);
   for (let i = 0; i < datasetList.length; i++) {
     const ds = datasetList[i];
@@ -229,13 +263,24 @@ function validateWidgetBindings(stack) {
       if (dashFilterDefs.length > 0) {
         const datasetObject = typeof dataset.object === "string" ? dataset.object : void 0;
         const objectFields = datasetObject ? objectFieldTypes.get(datasetObject) : void 0;
-        if (objectFields) {
+        const anchors = datasetObject ? unprovisionedAnchors.get(datasetObject) : void 0;
+        if (objectFields && datasetObject) {
           for (const def of dashFilterDefs) {
             const eff = effectiveFilterField(w, def);
             if (!eff) continue;
             const field = eff.field;
             if (field.includes(".")) continue;
-            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) continue;
+            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) {
+              if (anchors?.has(field)) {
+                push2({
+                  severity: "warning",
+                  rule: DASHBOARD_FILTER_FIELD_UNPROVISIONED,
+                  message: (eff.explicit ? `binds dashboard filter \`${def.name}\` to field \`${field}\` (via filterBindings), but ` : `inherits dashboard filter \`${def.name}(${field})\`, but `) + `${unprovisionedAnchorCause(datasetObject, field)}. The filter is ANDed into this widget's analytics query (#2501), so it can never match a real value \u2014 on SQLite it silently degrades to constant-false and the widget renders empty (HTTP 200, zero rows, no error).`,
+                  hint: `${unprovisionedAnchorHint(datasetObject, field)} A widget can also opt out with filterBindings: { ${def.name}: false }. Suppress with suppressWarnings: ['${DASHBOARD_FILTER_FIELD_UNPROVISIONED}'] if the remote schema resolves it some other way.`
+                });
+              }
+              continue;
+            }
             push2({
               severity: "error",
               rule: DASHBOARD_FILTER_FIELD_UNKNOWN,
@@ -333,7 +378,7 @@ function validateWidgetBindings(stack) {
 }
 
 // src/validate-expressions.ts
-import { validateExpression, collectCelRootIdentifiers, SCOPE_ROOTS } from "@objectstack/formula";
+import { validateExpression, collectCelRootIdentifiers, parseCelToAst as parseCelToAst2, SCOPE_ROOTS } from "@objectstack/formula";
 import { collectFlowGraphs, resolveFlowNodeExpressions } from "@objectstack/spec/automation";
 
 // src/validate-null-guards.ts
@@ -568,6 +613,37 @@ function buildFieldIndex(objects) {
   }
   return idx;
 }
+var BOUND_RECORD_ROOTS = ["record", "previous"];
+function isCelNode(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function collectBoundRecordReads(source) {
+  const out = /* @__PURE__ */ new Map();
+  const ast = parseCelToAst2(source);
+  if (!ast) return out;
+  const pending = [ast];
+  while (pending.length > 0) {
+    const celNode = pending.pop();
+    if (!isCelNode(celNode)) continue;
+    if ((celNode.op === "." || celNode.op === ".?") && Array.isArray(celNode.args) && celNode.args.length >= 2) {
+      const [celRecv, seg] = celNode.args;
+      if (typeof seg === "string" && isCelNode(celRecv) && celRecv.op === "id" && typeof celRecv.args === "string" && BOUND_RECORD_ROOTS.includes(celRecv.args)) {
+        if (!out.has(seg)) out.set(seg, `${celRecv.args}.${seg}`);
+      }
+    }
+    const celArgs = celNode.args;
+    if (isCelNode(celArgs)) pending.push(celArgs);
+    else if (Array.isArray(celArgs)) {
+      for (const a of celArgs) {
+        if (isCelNode(a)) pending.push(a);
+        else if (Array.isArray(a)) {
+          for (const b of a) if (isCelNode(b)) pending.push(b);
+        }
+      }
+    }
+  }
+  return out;
+}
 function buildFieldTypeIndex(objects) {
   const idx = /* @__PURE__ */ new Map();
   for (const obj of objects) {
@@ -667,6 +743,29 @@ function validateStackExpressions(stack) {
   const fieldIndex = buildFieldIndex(objects);
   const fieldTypeIndex = buildFieldTypeIndex(objects);
   const nullableIndex = buildNullableFieldIndex(objects);
+  const unprovisionedIndex = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const anchors = unprovisionedInjectedColumnsFor(obj);
+    if (anchors.size > 0) unprovisionedIndex.set(name, anchors);
+  }
+  const warnUnprovisionedAnchors = (where, raw, objectName) => {
+    if (!objectName) return;
+    const anchors = unprovisionedIndex.get(objectName);
+    if (!anchors) return;
+    const source = celSourceOf(raw);
+    if (!source) return;
+    for (const [field, operand] of collectBoundRecordReads(source)) {
+      if (!anchors.has(field)) continue;
+      issues.push({
+        where,
+        message: `\`${operand}\` reads '${field}', an injected system column with NO storage behind it: '${objectName}' is an external object (ADR-0015), so the remote database owns its schema and the platform registers this anchor without provisioning a column. The predicate can never match a real value \u2014 on SQLite it silently degrades to constant-false (HTTP 200, zero rows, no error). If the remote table really carries this column, declare '${field}' in the object's own fields (mapped through the external binding's columnMap) so the reference resolves to a column you vouch for; otherwise drop the reference, or opt the object out of the injection (\`ownership: 'none'\` for the ownership anchors, \`systemFields: { audit: false }\` for the audit family).`,
+        source,
+        severity: "warning"
+      });
+    }
+  };
   const checkNullGuards = (where, subject, raw, objectName, outcome = "fail-closed") => {
     if (!objectName) return;
     const nullableFields = nullableIndex.get(objectName);
@@ -693,6 +792,7 @@ function validateStackExpressions(stack) {
     );
     for (const e of res.errors) issues.push({ where, message: e.message, source: e.source, severity: "error" });
     for (const w of res.warnings) issues.push({ where, message: w.message, source: w.source, severity: "warning" });
+    warnUnprovisionedAnchors(where, raw, objectName);
   };
   const FIELD_RULE_BOUND_ROOTS = ["record", "previous", "parent"];
   const FIELD_RULE_USER_ROOTS = ["current_user", "user", "ctx", "os"];
@@ -839,6 +939,7 @@ function validateStackExpressions(stack) {
         const fieldWhere = `object '${objectName}' \xB7 field '${fname}' expression`;
         for (const e of res.errors) issues.push({ where: fieldWhere, message: e.message, source: e.source, severity: "error" });
         for (const w of res.warnings) issues.push({ where: fieldWhere, message: w.message, source: w.source, severity: "warning" });
+        warnUnprovisionedAnchors(fieldWhere, f.expression, objectName);
       }
     }
   }
@@ -1389,6 +1490,46 @@ function validateFunctionalCompleteness(stack) {
   return out;
 }
 
+// src/validate-managed-api-methods.ts
+import {
+  checkManagedApiMethodAffordances,
+  describeManagedApiMethodConflicts
+} from "@objectstack/spec/data";
+var MANAGED_API_METHOD_UNAFFORDABLE = "object/managed-api-method-unaffordable";
+var isRec2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function entriesOf2(v) {
+  if (Array.isArray(v)) {
+    return v.flatMap(
+      (def, i) => isRec2(def) ? [{ name: String(def.name ?? i), def, key: `[${i}]` }] : []
+    );
+  }
+  if (isRec2(v)) {
+    return Object.entries(v).flatMap(
+      ([name, def]) => isRec2(def) ? [{ name, def: { name, ...def }, key: `.${name}` }] : []
+    );
+  }
+  return [];
+}
+function validateManagedApiMethods(stack) {
+  const out = [];
+  if (!isRec2(stack)) return out;
+  for (const [oi, obj] of entriesOf2(stack.objects).entries()) {
+    const conflicts = checkManagedApiMethodAffordances(obj.def);
+    if (conflicts.length === 0) continue;
+    const verbs = conflicts.map((c) => c.verb).join(", ");
+    const flags = [...new Set(conflicts.map((c) => c.needs))];
+    out.push({
+      severity: "error",
+      rule: MANAGED_API_METHOD_UNAFFORDABLE,
+      where: `object "${obj.name}"`,
+      path: `objects[${oi}].enable.apiMethods`,
+      message: `\`managedBy: '${String(obj.def.managedBy)}'\` object "${obj.name}" ` + describeManagedApiMethodConflicts(conflicts) + ` The registry STRIPS [${verbs}] at registration, so this declaration and the API you actually get already disagree \u2014 today the only trace is a line in the boot log.`,
+      hint: `Either add \`userActions: { ${flags.map((f) => `${f}: true`).join(", ")} }\` to the object \u2014 only if the write is genuinely one a user context may perform, and only once the guard enforcing it exists (ADR-0092 D4: affordance never ships ahead of the guard) \u2014 or remove [${verbs}] from \`enable.apiMethods\`, which is what the runtime does for you today.`
+    });
+  }
+  return out;
+}
+
 // src/validate-flow-trigger-readiness.ts
 import { TimeRelativeTriggerSchema } from "@objectstack/spec/automation";
 var FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
@@ -1573,7 +1714,7 @@ function validateFlowTriggerReadiness(stack) {
 
 // src/flow-walk.ts
 import { FLOW_REGION_SLOTS_BY_TYPE, FLOW_REGION_CONFIG_KEYS } from "@objectstack/spec/automation";
-function isRec2(v) {
+function isRec3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName(v) {
@@ -1588,7 +1729,7 @@ function flowNodeLabel(node, index) {
   return strName(node.label) ?? strName(node.id) ?? `#${index}`;
 }
 function stripRegions(config) {
-  if (!isRec2(config)) return void 0;
+  if (!isRec3(config)) return void 0;
   let out;
   for (const key of Object.keys(config)) {
     if (!REGION_CONFIG_KEYS.has(key)) continue;
@@ -1599,11 +1740,11 @@ function stripRegions(config) {
 }
 function walkFlowNodes(flow, flowPath) {
   const out = [];
-  if (!isRec2(flow)) return out;
+  if (!isRec3(flow)) return out;
   const visitList = (nodes, basePath, trail, depth) => {
     if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
     nodes.forEach((raw, index) => {
-      if (!isRec2(raw)) return;
+      if (!isRec3(raw)) return;
       const path = `${basePath}[${index}]`;
       out.push({
         node: raw,
@@ -1614,7 +1755,7 @@ function walkFlowNodes(flow, flowPath) {
       });
       const type = strName(raw.type);
       const slots = type ? REGION_SLOTS.get(type) : void 0;
-      if (!slots || !isRec2(raw.config)) return;
+      if (!slots || !isRec3(raw.config)) return;
       const config = raw.config;
       const here = `${type} "${flowNodeLabel(raw, index)}"`;
       for (const slot of slots) {
@@ -1622,7 +1763,7 @@ function walkFlowNodes(flow, flowPath) {
         if (slot === "branches") {
           if (!Array.isArray(value)) continue;
           value.forEach((branch, b) => {
-            if (!isRec2(branch)) return;
+            if (!isRec3(branch)) return;
             const branchName = strName(branch.name) ?? `#${b}`;
             visitList(
               branch.nodes,
@@ -1633,7 +1774,7 @@ function walkFlowNodes(flow, flowPath) {
           });
           continue;
         }
-        if (!isRec2(value)) continue;
+        if (!isRec3(value)) continue;
         visitList(
           value.nodes,
           `${path}.config.${slot}.nodes`,
@@ -1653,6 +1794,7 @@ function joinTrail(trail, segment) {
 // src/validate-flow-template-paths.ts
 var FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 var FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
+var FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
 function asArray5(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -1795,6 +1937,7 @@ function validateFlowTemplatePaths(stack) {
     const obj = objectsByName.get(objectName);
     if (!obj) return;
     const fieldTypes = fieldTypesOf(obj);
+    const unprovisionedAnchors = unprovisionedInjectedColumnsFor(obj);
     const expandSet = declaredExpandOf(flow);
     walkFlowNodes(flow, `flows[${flowIndex}]`).forEach(({ node, path: nodePath, regionTrail, localConfig }, walkIndex) => {
       const nodeLabel = typeof node.type === "string" ? node.type : typeof node.id === "string" ? node.id : `#${walkIndex}`;
@@ -1806,6 +1949,7 @@ function validateFlowTemplatePaths(stack) {
       if (leaves.length === 0) return;
       const seenUnknown = /* @__PURE__ */ new Set();
       const seenTraversal = /* @__PURE__ */ new Set();
+      const seenUnprovisioned = /* @__PURE__ */ new Set();
       for (const leaf of leaves) {
         const inFilter = leaf.inFilter;
         for (const rest of recordRefsIn(leaf.text)) {
@@ -1813,6 +1957,19 @@ function validateFlowTemplatePaths(stack) {
           const hasSubPath = rest.length > 1;
           const nextIsIdentifier = hasSubPath && !/^\d+$/.test(rest[1]);
           const isKnown = fieldTypes.has(head) || IMPLICIT_HEADS.has(head);
+          if (unprovisionedAnchors.has(head)) {
+            if (!seenUnprovisioned.has(head)) {
+              seenUnprovisioned.add(head);
+              findings.push({
+                severity: "warning",
+                rule: FLOW_TEMPLATE_FIELD_UNPROVISIONED,
+                where,
+                path: nodePath,
+                message: (inFilter ? `${nodeType} filter references ` : "template references ") + `'{record.${rest.join(".")}}', and ${unprovisionedAnchorCause(objectName, head)} \u2014 ` + (inFilter ? `the token resolves to nothing on every run, which DROPS the condition from the query instead of narrowing it; the node then refuses to run at execution time (#3810).` : `the token resolves to an empty string on every run (silently).`),
+                hint: unprovisionedAnchorHint(objectName, head)
+              });
+            }
+          }
           if (!isKnown) {
             if (seenUnknown.has(head)) continue;
             seenUnknown.add(head);
@@ -1957,10 +2114,32 @@ function containerViewCount(rec) {
 function validateViewContainers(stack) {
   const out = [];
   if (!stack || typeof stack !== "object") return out;
+  const viewItems = stack.viewItems;
+  if (viewItems != null && asEntries(viewItems).length > 0) {
+    out.push({
+      severity: "error",
+      rule: VIEW_CONTAINER_SHAPE,
+      where: "viewItems",
+      path: "viewItems",
+      message: "`viewItems` is the machine-assembled channel for non-container view artifacts in runtime-assembled manifests (package export, environment artifacts) \u2014 it is not an authoring surface.",
+      hint: "Author views as defineView containers in `views:`; author a standalone view through the metadata door (Studio / `PUT /api/v1/meta/view`), not in stack source."
+    });
+  }
   for (const { key, value } of asEntries(stack.views)) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
     const rec = value;
-    if (rec.viewKind != null) continue;
+    if (rec.viewKind != null) {
+      const label3 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
+      out.push({
+        severity: "error",
+        rule: VIEW_CONTAINER_SHAPE,
+        where: `views${key}${label3}`,
+        path: `views${key}`,
+        message: "A ViewItem record is not a view container: the stack `views:` collection carries containers only \u2014 `viewKind` belongs to a single VIEW, not to the container. The registration loop refuses this entry (#5320).",
+        hint: "Wrap it in a defineView container: defineView({ list: { type, data, columns, ... }, listViews: { ... } }) \u2014 or author the standalone view through the metadata door (Studio / `PUT /api/v1/meta/view`). Machine-assembled manifests carry it under `viewItems:`."
+      });
+      continue;
+    }
     if (containerViewCount(rec) > 0) continue;
     const label2 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
     const hasContainerSlot = CONTAINER_SLOT_KEYS.some((k) => k in rec);
@@ -2408,7 +2587,7 @@ function asArray10(v) {
   }
   return [];
 }
-function isRec3(v) {
+function isRec4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName2(v) {
@@ -2484,7 +2663,7 @@ function distance(a, b) {
 }
 function indexObjectSearchTargets(stack) {
   const fieldsByObject = /* @__PURE__ */ new Map();
-  if (!isRec3(stack)) return fieldsByObject;
+  if (!isRec4(stack)) return fieldsByObject;
   for (const obj of asArray10(stack.objects)) {
     const name = strName2(obj.name);
     if (name) fieldsByObject.set(name, declaredFieldTarget(obj));
@@ -2566,7 +2745,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
 }
 function validateSearchableFields(stack) {
   const findings = [];
-  if (!isRec3(stack)) return findings;
+  if (!isRec4(stack)) return findings;
   const objects = asArray10(stack.objects);
   const fieldsByObject = indexObjectSearchTargets(stack);
   const check = (declared, objectName, where, path, subject, role) => {
@@ -2576,7 +2755,7 @@ function validateSearchableFields(stack) {
   };
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec3(obj)) continue;
+    if (!isRec4(obj)) continue;
     const objName = strName2(obj.name);
     const label2 = objName ? `object "${objName}"` : `objects[${oi}]`;
     check(
@@ -2587,9 +2766,9 @@ function validateSearchableFields(stack) {
       "searchableFields",
       "canonical"
     );
-    if (isRec3(obj.listViews)) {
+    if (isRec4(obj.listViews)) {
       for (const [key, lv] of Object.entries(obj.listViews)) {
-        if (!isRec3(lv)) continue;
+        if (!isRec4(lv)) continue;
         check(
           lv.searchableFields,
           // A built-in list view belongs to its object; an inline `data.object`
@@ -2606,10 +2785,10 @@ function validateSearchableFields(stack) {
   const views = asArray10(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec3(view)) continue;
+    if (!isRec4(view)) continue;
     const viewLabel2 = strName2(view.name) ?? strName2(view.objectName) ?? `#${vi}`;
     const viewObject = strName2(view.objectName) ?? strName2(view.object);
-    if (isRec3(view.list)) {
+    if (isRec4(view.list)) {
       check(
         view.list.searchableFields,
         listViewObject(view.list) ?? viewObject,
@@ -2619,9 +2798,9 @@ function validateSearchableFields(stack) {
         "narrowing"
       );
     }
-    if (isRec3(view.listViews)) {
+    if (isRec4(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
-        if (!isRec3(lv)) continue;
+        if (!isRec4(lv)) continue;
         check(
           lv.searchableFields,
           listViewObject(lv) ?? viewObject,
@@ -2637,11 +2816,11 @@ function validateSearchableFields(stack) {
 }
 function listViewObject(listView) {
   const data = listView.data;
-  return isRec3(data) ? strName2(data.object) : void 0;
+  return isRec4(data) ? strName2(data.object) : void 0;
 }
 
 // src/page-walk.ts
-function isRec4(v) {
+function isRec5(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName3(v) {
@@ -2654,19 +2833,19 @@ function isSourceAuthoredPage(page) {
 }
 function walkPageComponents(page, pagePath) {
   const out = [];
-  if (!isRec4(page) || isSourceAuthoredPage(page)) return out;
+  if (!isRec5(page) || isSourceAuthoredPage(page)) return out;
   const pageObject = strName3(page.object);
   const visit = (node, path, inheritedObject) => {
-    if (!isRec4(node)) return;
-    const props = isRec4(node.properties) ? node.properties : void 0;
-    const dataSource = isRec4(node.dataSource) ? node.dataSource : void 0;
+    if (!isRec5(node)) return;
+    const props = isRec5(node.properties) ? node.properties : void 0;
+    const dataSource = isRec5(node.dataSource) ? node.dataSource : void 0;
     const objectName = strName3(dataSource?.object) ?? strName3(props?.object) ?? inheritedObject;
     out.push({ component: node, path, objectName });
     if (!props) return;
     if (Array.isArray(props.items)) {
       for (let i = 0; i < props.items.length; i++) {
         const item = props.items[i];
-        if (!isRec4(item) || !Array.isArray(item.children)) continue;
+        if (!isRec5(item) || !Array.isArray(item.children)) continue;
         for (let c = 0; c < item.children.length; c++) {
           visit(item.children[c], `${path}.properties.items[${i}].children[${c}]`, objectName);
         }
@@ -2688,12 +2867,12 @@ function walkPageComponents(page, pagePath) {
   const regions = Array.isArray(page.regions) ? page.regions : [];
   for (let r = 0; r < regions.length; r++) {
     const region = regions[r];
-    if (!isRec4(region) || !Array.isArray(region.components)) continue;
+    if (!isRec5(region) || !Array.isArray(region.components)) continue;
     for (let c = 0; c < region.components.length; c++) {
       visit(region.components[c], `${pagePath}.regions[${r}].components[${c}]`, pageObject);
     }
   }
-  const slots = isRec4(page.slots) ? page.slots : void 0;
+  const slots = isRec5(page.slots) ? page.slots : void 0;
   if (slots) {
     for (const [slot, value] of Object.entries(slots)) {
       const list3 = Array.isArray(value) ? value : [value];
@@ -2708,6 +2887,7 @@ function walkPageComponents(page, pagePath) {
 
 // src/validate-page-field-bindings.ts
 var PAGE_FIELD_UNKNOWN = "page-field-unknown";
+var PAGE_FIELD_UNPROVISIONED = "page-field-unprovisioned";
 function asArray11(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -2718,7 +2898,7 @@ function asArray11(v) {
 function strName4(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function isRec5(v) {
+function isRec6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function fieldRefsFrom(value, basePath) {
@@ -2729,7 +2909,7 @@ function fieldRefsFrom(value, basePath) {
       out.push({ name: bare, path });
       return;
     }
-    if (!isRec5(v)) return;
+    if (!isRec6(v)) return;
     const named = strName4(v.field) ?? strName4(v.name);
     if (named) out.push({ name: named, path: `${path}.${strName4(v.field) ? "field" : "name"}` });
   };
@@ -2787,15 +2967,15 @@ function componentFieldRefs(type, props, basePath, sep = ".") {
     const sections = Array.isArray(props[key]) ? props[key] : [];
     for (let si = 0; si < sections.length; si++) {
       const section = sections[si];
-      if (!isRec5(section)) continue;
+      if (!isRec6(section)) continue;
       refs.push(...fieldRefsFrom(section.fields, `${basePath}${sep}${key}[${si}].fields`));
     }
   }
   return refs;
 }
 function relatedListFieldRefs(props, basePath, sep = ".") {
-  const add = isRec5(props.add) ? props.add : void 0;
-  const picker = add && isRec5(add.picker) ? add.picker : void 0;
+  const add = isRec6(props.add) ? props.add : void 0;
+  const picker = add && isRec6(add.picker) ? add.picker : void 0;
   const at = (key) => `${basePath}${sep}${key}`;
   return {
     relatedObject: strName4(props.objectName),
@@ -2816,7 +2996,7 @@ function relatedListFieldRefs(props, basePath, sep = ".") {
 }
 function indexObjectFields(stack) {
   const objectFields = /* @__PURE__ */ new Map();
-  if (!isRec5(stack)) return objectFields;
+  if (!isRec6(stack)) return objectFields;
   for (const obj of asArray11(stack.objects)) {
     const name = strName4(obj.name);
     if (!name) continue;
@@ -2829,14 +3009,27 @@ function indexObjectFields(stack) {
   }
   return objectFields;
 }
-function checkFieldRefs(refs, objectName, objectFields, where, consequence2 = "skipped") {
+function checkFieldRefs(refs, objectName, objectFields, where, consequence2 = "skipped", unprovisionedAnchors) {
   const findings = [];
   if (!objectName) return findings;
   const known = objectFields.get(objectName);
   if (!known) return findings;
+  const anchors = unprovisionedAnchors?.get(objectName);
   for (const ref of refs) {
     if (ref.name.includes(".")) continue;
-    if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) continue;
+    if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) {
+      if (anchors?.has(ref.name)) {
+        findings.push({
+          severity: "warning",
+          rule: PAGE_FIELD_UNPROVISIONED,
+          where,
+          path: ref.path,
+          message: `field "${ref.name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, ref.name)}` + (consequence2 === "queried" ? ' \u2014 it is used in a QUERY, so the predicate can never match a real value: on SQLite it silently degrades to constant-false and the surface renders an empty result that looks exactly like "there is no data".' : " \u2014 the component renders it, blank, on every record."),
+          hint: unprovisionedAnchorHint(objectName, ref.name)
+        });
+      }
+      continue;
+    }
     findings.push({
       severity: consequence2 === "queried" ? "error" : "warning",
       rule: PAGE_FIELD_UNKNOWN,
@@ -2852,17 +3045,20 @@ function validatePageFieldBindings(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const objectFields = indexObjectFields(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const pages = asArray11(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
     const pageName = strName4(page.name) ?? `#${pi}`;
     const checkRefs = (refs, objectName, where) => {
-      findings.push(...checkFieldRefs(refs, objectName, objectFields, where));
+      findings.push(
+        ...checkFieldRefs(refs, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+      );
     };
     for (const { component, path, objectName } of walkPageComponents(page, `pages[${pi}]`)) {
       const type = strName4(component.type);
-      const props = isRec5(component.properties) ? component.properties : void 0;
+      const props = isRec6(component.properties) ? component.properties : void 0;
       if (!type || !props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -2877,7 +3073,7 @@ function validatePageFieldBindings(stack) {
       if (!refs) continue;
       checkRefs(refs, objectName, where);
     }
-    const cfg = isRec5(page.interfaceConfig) ? page.interfaceConfig : void 0;
+    const cfg = isRec6(page.interfaceConfig) ? page.interfaceConfig : void 0;
     if (cfg) {
       const cfgObject = strName4(cfg.source) ?? strName4(page.object);
       const base = `pages[${pi}].interfaceConfig`;
@@ -2886,7 +3082,7 @@ function validatePageFieldBindings(stack) {
         ...sortFieldRefs(cfg.sort, `${base}.sort`),
         ...fieldRefsFrom(cfg.filterBy, `${base}.filterBy`)
       ];
-      const userFilters = isRec5(cfg.userFilters) ? cfg.userFilters : void 0;
+      const userFilters = isRec6(cfg.userFilters) ? cfg.userFilters : void 0;
       if (userFilters) {
         refs.push(...fieldRefsFrom(userFilters.fields, `${base}.userFilters.fields`));
       }
@@ -2897,11 +3093,11 @@ function validatePageFieldBindings(stack) {
 }
 
 // src/zod-issue-format.ts
-var isRec6 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec7 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var valueAtPath = (root, path) => {
   let cur = root;
   for (const key of path) {
-    if (!isRec6(cur) && !Array.isArray(cur)) return void 0;
+    if (!isRec7(cur) && !Array.isArray(cur)) return void 0;
     cur = cur[key];
   }
   return cur;
@@ -3034,12 +3230,13 @@ function filterAttrValue(tsc, sf, attr) {
   return perPosition(init.expression);
 }
 var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+var REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 var REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 function checkChartDrillDown(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec7(raw)) {
+  if (!isRec8(raw)) {
     push2(
       "error",
       REACT_CHART_DRILLDOWN_INVALID,
@@ -3062,7 +3259,7 @@ function checkChartDrillDown(raw, push2) {
 }
 function checkChartAggregate(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec7(raw)) {
+  if (!isRec8(raw)) {
     push2(
       "error",
       REACT_CHART_AGGREGATE_INVALID,
@@ -3093,9 +3290,9 @@ function checkChartAggregate(raw, push2) {
     );
   }
 }
-var isRec7 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
-function checkObjectChart(attrs, objectFields, findings) {
+function checkObjectChart(attrs, objectFields, findings, unprovisionedAnchors = /* @__PURE__ */ new Map()) {
   const { values, where, path } = attrs;
   const push2 = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
   checkChartDrillDown(values.get("drillDown"), push2);
@@ -3103,18 +3300,29 @@ function checkObjectChart(attrs, objectFields, findings) {
   const aggregate = values.get("aggregate");
   checkChartAggregate(aggregate, push2);
   if (aggregate === void 0 || aggregate === NOT_STATIC) return;
-  if (!isRec7(aggregate)) return;
+  if (!isRec8(aggregate)) return;
   const fn = strOf(aggregate.function);
   const field = strOf(aggregate.field);
   const groupBy = aggregate.groupBy;
-  const groupByField = strOf(groupBy) ?? (isRec7(groupBy) ? strOf(groupBy.field) : void 0);
+  const groupByField = strOf(groupBy) ?? (isRec8(groupBy) ? strOf(groupBy.field) : void 0);
   const objectName = strOf(values.get("objectName"));
   const known = objectName ? objectFields.get(objectName) : void 0;
   if (objectName && known) {
+    const anchors = unprovisionedAnchors.get(objectName);
     const fieldRef = (name, prop) => {
       if (!name) return;
       if (name.includes(".")) return;
-      if (known.has(name) || SYSTEM_FIELDS.has(name)) return;
+      if (known.has(name) || SYSTEM_FIELDS.has(name)) {
+        if (anchors?.has(name)) {
+          push2(
+            "warning",
+            REACT_CHART_FIELD_UNPROVISIONED,
+            `aggregate.${prop} "${name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, name)} \u2014 the aggregate query reads a column that is empty on every row, so the chart ${prop === "groupBy" ? "groups everything into one empty bucket" : "aggregates nothing"} instead of failing.`,
+            unprovisionedAnchorHint(objectName, name)
+          );
+        }
+        return;
+      }
       push2(
         "error",
         REACT_CHART_FIELD_UNKNOWN,
@@ -3140,18 +3348,18 @@ function checkObjectChart(attrs, objectFields, findings) {
     );
   };
   const xAxisRaw = values.get("xAxis");
-  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec7(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec8(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
   const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
   axisRef(categoryAxis, categoryProp);
   const yAxisRaw = values.get("yAxis");
   const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
   for (const a of yAxisList) {
-    axisRef(strOf(a) ?? (isRec7(a) ? strOf(a.field) : void 0), "yAxis[].field");
+    axisRef(strOf(a) ?? (isRec8(a) ? strOf(a.field) : void 0), "yAxis[].field");
   }
   const series = values.get("series");
   if (Array.isArray(series)) {
     for (const s of series) {
-      if (!isRec7(s)) continue;
+      if (!isRec8(s)) continue;
       const dataKey = strOf(s.dataKey);
       axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
     }
@@ -3207,7 +3415,7 @@ function subformFieldRefs(value, basePath) {
   if (!Array.isArray(value)) return { child, parent };
   for (let i = 0; i < value.length; i++) {
     const sub = value[i];
-    if (!isRec7(sub)) continue;
+    if (!isRec8(sub)) continue;
     const at = (key) => `${basePath}[${i}].${key}`;
     child.push({
       objectName: strOf(sub.childObject),
@@ -3252,20 +3460,20 @@ function reactFieldRefs(spec, values, basePath) {
   }
   for (const key of spec.nestedFields ?? []) {
     const v = readable(key);
-    if (isRec7(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+    if (isRec8(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
   }
   for (const key of spec.sections ?? []) {
     const v = readable(key);
     if (!Array.isArray(v)) continue;
     for (let i = 0; i < v.length; i++) {
       const section = v[i];
-      if (!isRec7(section)) continue;
+      if (!isRec8(section)) continue;
       own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
     }
   }
   for (const key of spec.keyedByField ?? []) {
     const v = readable(key);
-    if (!isRec7(v)) continue;
+    if (!isRec8(v)) continue;
     for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
   }
   for (const key of spec.filterArrays ?? []) {
@@ -3273,22 +3481,30 @@ function reactFieldRefs(spec, values, basePath) {
   }
   return { own, queried };
 }
-function checkBlockFieldProps(tag, values, objectFields, where, path) {
+function checkBlockFieldProps(tag, values, objectFields, where, path, unprovisionedAnchors) {
   const objectName = strOf(values.get("objectName"));
   const out = [];
   const spec = REACT_FIELD_SPECS[tag];
   if (spec) {
     const { own, queried } = reactFieldRefs(spec, values, path);
-    out.push(...checkFieldRefs(own, objectName, objectFields, where));
-    out.push(...checkFieldRefs(queried, objectName, objectFields, where, "queried"));
+    out.push(
+      ...checkFieldRefs(own, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+    );
+    out.push(
+      ...checkFieldRefs(queried, objectName, objectFields, where, "queried", unprovisionedAnchors)
+    );
   }
   if (tag === "ObjectForm") {
     const raw = values.get("subforms");
     const subs = subformFieldRefs(raw === NOT_STATIC ? void 0 : raw, `${path}${PATH_SEP}subforms`);
     for (const sub of subs.child) {
-      out.push(...checkFieldRefs(sub.refs, sub.objectName, objectFields, where));
+      out.push(
+        ...checkFieldRefs(sub.refs, sub.objectName, objectFields, where, "skipped", unprovisionedAnchors)
+      );
     }
-    out.push(...checkFieldRefs(subs.parent, objectName, objectFields, where));
+    out.push(
+      ...checkFieldRefs(subs.parent, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+    );
   }
   const schemaType = tag === "Block" ? strOf(values.get("type")) : SCHEMA_TYPE_BY_TAG.get(tag);
   if (schemaType && COMPONENT_FIELD_SPECS[schemaType]) {
@@ -3297,7 +3513,9 @@ function checkBlockFieldProps(tag, values, objectFields, where, path) {
         componentFieldRefs(schemaType, readableProps(values), path, PATH_SEP) ?? [],
         objectName,
         objectFields,
-        where
+        where,
+        "skipped",
+        unprovisionedAnchors
       )
     );
   }
@@ -3329,6 +3547,7 @@ function localComponentNames(tsc, sf) {
 function validateReactPageProps(stack) {
   const findings = [];
   const objectFields = indexObjectFields(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const searchTargets = indexObjectSearchTargets(stack);
   const pages = asArray12(stack.pages);
   for (let p = 0; p < pages.length; p++) {
@@ -3411,7 +3630,7 @@ function validateReactPageProps(stack) {
             }
           }
           if (tag === "ObjectChart" && !hasSpread) {
-            checkObjectChart({ values, where, path }, objectFields, findings);
+            checkObjectChart({ values, where, path }, objectFields, findings, unprovisionedAnchors);
           }
           if (tag === "ListView" && !hasSpread) {
             findings.push(
@@ -3427,7 +3646,7 @@ function validateReactPageProps(stack) {
           }
           if (!hasSpread) {
             findings.push(
-              ...checkBlockFieldProps(tag, values, objectFields, where, path)
+              ...checkBlockFieldProps(tag, values, objectFields, where, path, unprovisionedAnchors)
             );
           }
         }
@@ -3519,6 +3738,7 @@ var FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 var FIELD_GROUP_EMPTY = "field-group-empty";
 var FIELD_GROUP_SHADOWED = "field-group-shadowed";
 var SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
+var SEMANTIC_ROLE_FIELD_UNPROVISIONED = "semantic-role-field-unprovisioned";
 function asArray15(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -3537,6 +3757,15 @@ function validateSemanticRoles(stack) {
     const path = `objects[${i}]`;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? obj.fields : {};
     const fieldNames = /* @__PURE__ */ new Set([...Object.keys(fields), ...injectedColumnsFor(obj)]);
+    const unprovisioned = unprovisionedInjectedColumnsFor(obj);
+    const unprovisionedPointer = (slot, entry) => ({
+      severity: "warning",
+      rule: SEMANTIC_ROLE_FIELD_UNPROVISIONED,
+      where,
+      path: `${path}.${slot}`,
+      message: `${objName}: ${slot} points at "${entry}", an injected system column with no storage behind it \u2014 this object is external (ADR-0015), so the platform registers the anchor but the remote schema owns the table and no column backs it. Every consumer renders it empty on every record.`,
+      hint: `If the remote table really carries "${entry}", declare it in the object's own fields (mapped through the external binding's columnMap); otherwise point ${slot} at a real remote column.`
+    });
     const declaredGroups = new Set(
       (Array.isArray(obj.fieldGroups) ? obj.fieldGroups : []).filter((g) => !!g && typeof g === "object").map((g) => g.key).filter((k) => typeof k === "string" && k.length > 0)
     );
@@ -3578,10 +3807,16 @@ function validateSemanticRoles(stack) {
         message: `${objName}: stageField "${stage}" is not a field on this object \u2014 consumers fall back to heuristic stage detection`,
         hint: `Point stageField at an existing select/status field, or set stageField: false to declare the object has no linear lifecycle.`
       });
+    } else if (typeof stage === "string" && unprovisioned.has(stage)) {
+      findings.push(unprovisionedPointer("stageField", stage));
     }
     const highlights = Array.isArray(obj.highlightFields) ? obj.highlightFields : Array.isArray(obj.compactLayout) ? obj.compactLayout : [];
     for (const entry of highlights) {
-      if (typeof entry !== "string" || entry.length === 0 || fieldNames.has(entry)) continue;
+      if (typeof entry !== "string" || entry.length === 0) continue;
+      if (fieldNames.has(entry)) {
+        if (unprovisioned.has(entry)) findings.push(unprovisionedPointer("highlightFields", entry));
+        continue;
+      }
       findings.push({
         severity: "warning",
         rule: SEMANTIC_ROLE_FIELD_UNKNOWN,
@@ -3621,45 +3856,45 @@ function validateSemanticRoles(stack) {
 }
 
 // src/collection-entries.ts
-function isRec8(v) {
+function isRec9(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function collectionEntries(v, base) {
   if (Array.isArray(v)) {
     const out = [];
     for (let i = 0; i < v.length; i++) {
-      if (isRec8(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
+      if (isRec9(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
     }
     return out;
   }
-  if (isRec8(v)) {
-    return Object.entries(v).filter(([, def]) => isRec8(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
+  if (isRec9(v)) {
+    return Object.entries(v).filter(([, def]) => isRec9(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
   }
   return [];
 }
 
 // src/view-walk.ts
-function isRec9(v) {
+function isRec10(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName5(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function viewObjectName(view) {
-  return strName5(view.objectName) ?? strName5(view.object) ?? (isRec9(view.data) ? strName5(view.data.object) : void 0);
+  return strName5(view.objectName) ?? strName5(view.object) ?? (isRec10(view.data) ? strName5(view.data.object) : void 0);
 }
 function viewContainerSites(view, basePath) {
-  if (!isRec9(view)) return [];
+  if (!isRec10(view)) return [];
   const sites = [{ view, path: basePath, surface: "", kind: "self" }];
-  if (isRec9(view.form)) {
+  if (isRec10(view.form)) {
     sites.push({ view: view.form, path: `${basePath}.form`, surface: "form", kind: "form" });
   }
   for (const key of ["listViews", "formViews"]) {
     const container = view[key];
-    if (!isRec9(container)) continue;
+    if (!isRec10(container)) continue;
     const kind = key === "listViews" ? "listView" : "formView";
     for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec9(sub)) continue;
+      if (!isRec10(sub)) continue;
       sites.push({
         view: sub,
         path: `${basePath}.${key}.${subKey}`,
@@ -3684,7 +3919,7 @@ function asArray16(v) {
   }
   return [];
 }
-function isRec10(v) {
+function isRec11(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName6(v) {
@@ -3718,7 +3953,7 @@ function validateFormLayout(stack) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const sec = sections[s];
-          const secFields = isRec10(sec) && Array.isArray(sec.fields) ? sec.fields : [];
+          const secFields = isRec11(sec) && Array.isArray(sec.fields) ? sec.fields : [];
           for (let f = 0; f < secFields.length; f++) {
             const entry = secFields[f];
             const fname = fieldNameOf(entry);
@@ -3733,7 +3968,7 @@ function validateFormLayout(stack) {
                 hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
               });
             }
-            const colSpan = isRec10(entry) ? entry.colSpan : void 0;
+            const colSpan = isRec11(entry) ? entry.colSpan : void 0;
             if (colSpan != null) {
               findings.push({
                 severity: "warning",
@@ -3756,9 +3991,67 @@ function validateFormLayout(stack) {
 import {
   collectCelRootIdentifiers as collectCelRootIdentifiers2,
   firstUndeclaredReference,
-  parseCelToAst as parseCelToAst2,
+  parseCelToAst as parseCelToAst3,
   parseCelToAstWithReason
 } from "@objectstack/formula";
+
+// src/predicate-rhs-position.ts
+function isNode2(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+var EQUALITY_OPS = /* @__PURE__ */ new Set(["==", "!="]);
+var COMPREHENSION_MACROS = /* @__PURE__ */ new Set(["all", "exists", "exists_one", "map", "filter"]);
+function bareId(node) {
+  if (!isNode2(node)) return null;
+  return node.op === "id" && typeof node.args === "string" ? node.args : null;
+}
+function bareRhsOnlyIdentifiers(ast) {
+  const rhs = /* @__PURE__ */ new Set();
+  const elsewhere = /* @__PURE__ */ new Set();
+  const walk = (node, suppressible) => {
+    if (Array.isArray(node)) {
+      for (const child of node) walk(child, suppressible);
+      return;
+    }
+    if (!isNode2(node)) return;
+    const args = node.args;
+    if (node.op === "rcall" && Array.isArray(args) && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+      walk(args[1], suppressible);
+      walk(args[2], false);
+      return;
+    }
+    if (typeof node.op === "string" && EQUALITY_OPS.has(node.op) && Array.isArray(args) && args.length === 2) {
+      const right = suppressible ? bareId(args[1]) : null;
+      walk(args[0], suppressible);
+      if (right !== null) {
+        rhs.add(right);
+        return;
+      }
+      walk(args[1], suppressible);
+      return;
+    }
+    const name = bareId(node);
+    if (name !== null) {
+      elsewhere.add(name);
+      return;
+    }
+    walk(args, suppressible);
+  };
+  walk(ast, true);
+  for (const name of elsewhere) rhs.delete(name);
+  return rhs;
+}
+function isRec12(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function schemaIdOf(view) {
+  const data = view.data;
+  if (!isRec12(data)) return void 0;
+  if (data.provider !== "schema") return void 0;
+  return typeof data.schemaId === "string" ? data.schemaId : void 0;
+}
+
+// src/validate-visibility-predicates.ts
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 var VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
 var VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
@@ -3806,7 +4099,7 @@ function boundName(overrun) {
   return overrun.limit && overrun.limitValue !== null ? `the \`${overrun.limit}\` budget (platform limit ${overrun.limitValue})` : "one of the platform's parse budgets";
 }
 var VIEW_PAGE_EXTRA_ROOTS = ["current_user", "page"];
-function isNode2(v) {
+function isNode3(v) {
   return !!v && typeof v === "object" && typeof v.op === "string";
 }
 function namespaceRoots(node, out) {
@@ -3814,22 +4107,27 @@ function namespaceRoots(node, out) {
     for (const child of node) namespaceRoots(child, out);
     return;
   }
-  if (!isNode2(node)) return;
+  if (!isNode3(node)) return;
   const args = node.args;
   if (Array.isArray(args)) {
     const receiver = node.op === "rcall" ? args[1] : args[0];
-    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode2(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode3(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
       out.add(receiver.args);
     }
   }
   namespaceRoots(args, out);
 }
-function firstBareIdentifier(source) {
-  const ast = parseCelToAst2(source);
+function firstBareIdentifier(source, literalRhs) {
+  const ast = parseCelToAst3(source);
   if (!ast) return null;
   const rooted = /* @__PURE__ */ new Set();
   namespaceRoots(ast, rooted);
-  return firstUndeclaredReference(source, [...VIEW_PAGE_EXTRA_ROOTS, ...rooted]);
+  const literalSlot = literalRhs ? bareRhsOnlyIdentifiers(ast) : [];
+  return firstUndeclaredReference(source, [
+    ...VIEW_PAGE_EXTRA_ROOTS,
+    ...rooted,
+    ...literalSlot
+  ]);
 }
 var CANONICAL_ROOT_BY_LAYER = {
   runtime: "record",
@@ -3838,16 +4136,16 @@ var CANONICAL_ROOT_BY_LAYER = {
 var MISLAYER_BY_LAYER = {
   runtime: {
     forbiddenRoot: "data",
-    message: "visibility predicate is rooted at `data.` \u2014 that is the metadata-editing-form root (a `*.form.ts` row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
+    message: "visibility predicate is rooted at `data.` \u2014 that is the root a metadata-editing form binds (the row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
     hint: "Runtime record surfaces bind `record` + `current_user` (pages also expose `page.<var>`). Use e.g. `record.status == 'open'` instead of `data.status == 'open'`."
   },
   metadata: {
     forbiddenRoot: "record",
-    message: "visibility predicate is rooted at `record.` \u2014 that is the runtime record-surface root (a `*.view.ts` / `*.page.ts` live record), not a metadata-editing form. A `*.form.ts` predicate that binds `record.` never matches and the element renders unconditionally (ADR-0089).",
+    message: "visibility predicate is rooted at `record.` \u2014 that is the root a runtime view/page surface binds (the live record), not the root a metadata-editing form binds. On a metadata-editing form \u2014 the row under edit \u2014 a `record.`-rooted predicate never matches and the element renders unconditionally (ADR-0089).",
     hint: "Metadata-editing forms bind `data` (the row under edit). Use e.g. `data.type == 'grid'` instead of `record.type == 'grid'`."
   }
 };
-function checkElement(el, where, path, layer, findings) {
+function checkElement(el, where, path, layer, findings, literalRhs = false) {
   const raw = el[CANONICAL] ?? el.visibleOn ?? el.visibility;
   const source = predicateSource(raw);
   const rule = MISLAYER_BY_LAYER[layer];
@@ -3885,7 +4183,7 @@ function checkElement(el, where, path, layer, findings) {
     });
   }
   if (source && !refusal) {
-    const bare = firstBareIdentifier(source);
+    const bare = firstBareIdentifier(source, literalRhs);
     if (bare) {
       const root = CANONICAL_ROOT_BY_LAYER[layer];
       findings.push({
@@ -3894,7 +4192,7 @@ function checkElement(el, where, path, layer, findings) {
         where,
         path,
         message: `visibility predicate references \`${bare}\` as a bare identifier. Values are bound under a namespace on this surface \u2014 they are never flattened to top level \u2014 so \`${bare}\` resolves to nothing, the predicate can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
-        hint: `Write \`${root}.${bare}\` instead of \`${bare}\`` + (layer === "runtime" ? " (runtime view/page surfaces bind `record` + `current_user`; a page component also exposes page state as `page.<var>`)." : " (a `*.form.ts` metadata-editing form binds the row under edit as `data`).")
+        hint: `Write \`${root}.${bare}\` instead of \`${bare}\`` + (layer === "runtime" ? " (runtime view/page surfaces bind `record` + `current_user`; a page component also exposes page state as `page.<var>`)." : " (a metadata-editing form binds the row under edit as `data`).")
       });
     }
   }
@@ -3903,24 +4201,27 @@ function isFieldObject(entry) {
   return !!entry && typeof entry === "object" && !Array.isArray(entry);
 }
 function validateVisibilityPredicates(stack, opts = {}) {
-  const layer = opts.layer ?? "runtime";
+  const declaredLayer = opts.layer ?? "runtime";
   const findings = [];
   for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
     const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
     for (const site of formViewSites(view, viewPath)) {
       const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      const schemaBound = schemaIdOf(site.view) !== void 0;
+      const literalRhs = schemaBound;
+      const layer = schemaBound ? "metadata" : declaredLayer;
       for (const bucket of ["sections", "groups"]) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const sec = sections[s];
           if (!sec || typeof sec !== "object") continue;
           const secPath = `${site.path}.${bucket}[${s}]`;
-          checkElement(sec, where, secPath, layer, findings);
+          checkElement(sec, where, secPath, layer, findings, literalRhs);
           const secFields = Array.isArray(sec.fields) ? sec.fields : [];
           for (let f = 0; f < secFields.length; f++) {
             const entry = secFields[f];
             if (isFieldObject(entry)) {
-              checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+              checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings, literalRhs);
             }
           }
         }
@@ -3931,21 +4232,21 @@ function validateVisibilityPredicates(stack, opts = {}) {
     const pageName = typeof page.name === "string" ? page.name : void 0;
     const where = `page "${pageName ?? pagePath}"`;
     for (const walked of walkPageComponents(page, pagePath)) {
-      checkElement(walked.component, where, walked.path, layer, findings);
+      checkElement(walked.component, where, walked.path, declaredLayer, findings);
     }
   }
   return findings;
 }
 
 // src/validate-predicate-path-refs.ts
-import { parseCelToAst as parseCelToAst3 } from "@objectstack/formula";
+import { parseCelToAst as parseCelToAst4 } from "@objectstack/formula";
 import { getMetadataTypeSchema } from "@objectstack/spec/kernel";
 import { findClosestMatches, formatSuggestion } from "@objectstack/spec";
 var PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
 var PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
+var PREDICATE_RHS_PATH_SHAPED = "predicate-rhs-path-shaped";
 var PREDICATE_KEYS = ["visibleWhen", "visibleOn"];
 var ROOT = "data";
-var COMPREHENSION_MACROS = /* @__PURE__ */ new Set(["all", "exists", "exists_one", "map", "filter"]);
 function defOf(schema) {
   if (!schema || typeof schema !== "object" && typeof schema !== "function") return void 0;
   const s = schema;
@@ -4038,11 +4339,11 @@ function stepInto(scope, segment) {
   if (!declared.includes(segment)) return { kind: "undeclared", declared };
   return { kind: "declared", next: propertyOf(u, segment) };
 }
-function isNode3(v) {
+function isNode4(v) {
   return !!v && typeof v === "object" && typeof v.op === "string";
 }
 function memberChain(node) {
-  if (!isNode3(node)) return null;
+  if (!isNode4(node)) return null;
   if (node.op === "id" && typeof node.args === "string") return [node.args];
   if (node.op === "." && Array.isArray(node.args) && typeof node.args[1] === "string") {
     const head = memberChain(node.args[0]);
@@ -4055,7 +4356,7 @@ function rootedPaths(node, out) {
     for (const child of node) rootedPaths(child, out);
     return;
   }
-  if (!isNode3(node)) return;
+  if (!isNode4(node)) return;
   if (node.op === ".") {
     const chain = memberChain(node);
     if (chain && chain[0] === ROOT && chain.length > 1) {
@@ -4065,23 +4366,40 @@ function rootedPaths(node, out) {
   }
   rootedPaths(node.args, out);
 }
+var PATH_SHAPED_RHS = /^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*$/;
+function equalitySites(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) equalitySites(child, out);
+    return;
+  }
+  if (!isNode4(node)) return;
+  const args = node.args;
+  if (node.op === "rcall" && Array.isArray(args) && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+    equalitySites(args[1], out);
+    return;
+  }
+  if (typeof node.op === "string" && EQUALITY_OPS.has(node.op) && Array.isArray(args) && args.length === 2) {
+    out.push({ op: node.op, right: args[1] });
+  }
+  equalitySites(args, out);
+}
 function classifyIdentifiers(node, values, excluded) {
   if (Array.isArray(node)) {
     for (const child of node) classifyIdentifiers(child, values, excluded);
     return;
   }
-  if (!isNode3(node)) return;
+  if (!isNode4(node)) return;
   const args = node.args;
   if (Array.isArray(args)) {
     const receiver = node.op === "rcall" ? args[1] : args[0];
-    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode3(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode4(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
       excluded.add(receiver.args);
     }
     if (node.op === "rcall" && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
       const macroArgs = args[2];
       if (Array.isArray(macroArgs) && macroArgs.length >= 2) {
         const bound = macroArgs[0];
-        if (isNode3(bound) && bound.op === "id" && typeof bound.args === "string") {
+        if (isNode4(bound) && bound.op === "id" && typeof bound.args === "string") {
           excluded.add(bound.args);
         }
       }
@@ -4100,17 +4418,11 @@ function predicateSource2(v) {
   }
   return void 0;
 }
-function isRec11(v) {
+function isRec13(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function schemaIdOf(view) {
-  const data = view.data;
-  if (!isRec11(data)) return void 0;
-  if (data.provider !== "schema") return void 0;
-  return typeof data.schemaId === "string" ? data.schemaId : void 0;
-}
 function checkPredicate(source, scope, where, path, findings) {
-  const ast = parseCelToAst3(source);
+  const ast = parseCelToAst4(source);
   if (!ast) return;
   const paths = [];
   rootedPaths(ast, paths);
@@ -4138,19 +4450,38 @@ function checkPredicate(source, scope, where, path, findings) {
     }
   }
   const declaredHere = keysOf(scope);
-  if (!declaredHere) return;
-  const values = /* @__PURE__ */ new Set();
-  const excluded = /* @__PURE__ */ new Set();
-  classifyIdentifiers(ast, values, excluded);
-  for (const id of values) {
-    if (excluded.has(id) || !declaredHere.includes(id)) continue;
+  const rhsOnly = bareRhsOnlyIdentifiers(ast);
+  if (declaredHere) {
+    const values = /* @__PURE__ */ new Set();
+    const excluded = /* @__PURE__ */ new Set();
+    classifyIdentifiers(ast, values, excluded);
+    for (const id of values) {
+      if (excluded.has(id) || rhsOnly.has(id) || !declaredHere.includes(id)) continue;
+      findings.push({
+        severity: "error",
+        rule: PREDICATE_PATH_UNROOTED,
+        where,
+        path,
+        message: `predicate references \`${id}\` as a bare identifier, but \`${id}\` is a key of the schema this form edits \u2014 the binding root was dropped. Values are bound under \`${ROOT}\` and are never flattened to top level, so \`${id}\` resolves to nothing, the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149, #6254).`,
+        hint: `Write \`${ROOT}.${id}\` instead of \`${id}\`. A metadata-editing form binds the row under edit as \`${ROOT}\` at every depth \u2014 inside a repeater \`${ROOT}\` is the ROW, but it is still spelled \`${ROOT}\` (there is no implicit row scope).`
+      });
+    }
+  }
+  const sites = [];
+  equalitySites(ast, sites);
+  for (const { op, right } of sites) {
+    const chain = memberChain(right);
+    if (!chain) continue;
+    const text = chain.join(".");
+    if (!PATH_SHAPED_RHS.test(text)) continue;
+    const dotted = chain.length > 1;
     findings.push({
-      severity: "error",
-      rule: PREDICATE_PATH_UNROOTED,
+      severity: dotted ? "error" : "warning",
+      rule: PREDICATE_RHS_PATH_SHAPED,
       where,
       path,
-      message: `predicate references \`${id}\` as a bare identifier, but \`${id}\` is a key of the schema this form edits \u2014 the binding root was dropped. Values are bound under \`${ROOT}\` and are never flattened to top level, so \`${id}\` resolves to nothing, the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149, #6254).`,
-      hint: `Write \`${ROOT}.${id}\` instead of \`${id}\`. A metadata-editing form binds the row under edit as \`${ROOT}\` at every depth \u2014 inside a repeater \`${ROOT}\` is the ROW, but it is still spelled \`${ROOT}\` (there is no implicit row scope).`
+      message: dotted ? `predicate compares against \`${text}\` on the RIGHT of \`${op}\`, which is a path but is not evaluated as one. A metadata-editing form resolves paths on the LEFT of \`${op}\` only; the right-hand side goes to the literal parser, so \`${text}\` is compared as the literal string "${text}". The verdict therefore does not depend on the right-hand path at all: \`a == ${text}\` is FALSE even when both sides hold the same value, and \`a != ${text}\` is correspondingly TRUE. An \`==\` written this way hides the element on every row, and nothing in the console says why (objectui#4049).` : `predicate compares against the unquoted word \`${text}\` on the RIGHT of \`${op}\`. The right-hand side of \`${op}\` is a literal, never a reference, so this is read as the literal string "${text}" \u2014 which is probably what you meant, and is why it appears to work. It is outside the declared subset all the same (\`path == 'literal'\`), and it stops working when this surface moves to the real CEL evaluator, where a bare \`${text}\` resolves to nothing (objectui#4049). The token also reads as a \`${ROOT}.\` root someone dropped, so this one finding carries BOTH readings: which one you meant is the thing no linter can know, and it changes the fix (#7696).`,
+      hint: dotted ? `Two sanctioned spellings. (1) If you meant the TEXT, quote it: \`${op} '${text}'\`. (2) If you meant the PATH, restructure so the path is on the LEFT and a literal is on the right \u2014 comparing one path against another is outside the subset this surface renders, which is \`path == 'literal'\` / \`path != 'literal'\` and nothing wider. There is no third spelling that compares two paths here.` : `Two sanctioned spellings, and you must pick \u2014 they are not the same predicate. (1) If you meant the TEXT \`${text}\`, quote it: \`${op} '${text}'\`. That is what this renders as today, so it changes no behaviour and is the fix unless you know otherwise. (2) If you meant the FIELD \`${ROOT}.${text}\`, move it to the LEFT and put a literal on the right, e.g. \`${ROOT}.${text} == 'yes'\`. \u26D4 Do NOT simply add the root in place: \`${op} ${ROOT}.${text}\` is a path on the RIGHT, which this surface parses as the literal string "${ROOT}.${text}" \u2014 it is refused by this same rule at \`error\`, and it is FALSE on every row. The subset here is \`path == 'literal'\` and nothing wider.`
     });
   }
 }
@@ -4158,7 +4489,7 @@ function walkFields(entries, scope, where, base, findings, depth) {
   if (!Array.isArray(entries) || depth > 12) return;
   for (let i = 0; i < entries.length; i++) {
     const entry = entries[i];
-    if (!isRec11(entry)) continue;
+    if (!isRec13(entry)) continue;
     const path = `${base}[${i}]`;
     for (const key of PREDICATE_KEYS) {
       const source = predicateSource2(entry[key]);
@@ -4185,15 +4516,14 @@ function validatePredicatePathRefs(stack, opts = {}) {
       try {
         root = resolveSchema(schemaId);
       } catch {
-        continue;
+        root = void 0;
       }
-      if (!root) continue;
       const where = site.surface ? `view "${viewName}" \xB7 ${site.surface} (schema "${schemaId}")` : `view "${viewName}" (schema "${schemaId}")`;
       for (const bucket of ["sections", "groups"]) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const section = sections[s];
-          if (!isRec11(section)) continue;
+          if (!isRec13(section)) continue;
           const sectionPath = `${site.path}.${bucket}[${s}]`;
           for (const key of PREDICATE_KEYS) {
             const source = predicateSource2(section[key]);
@@ -4642,6 +4972,7 @@ var SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
 var SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
 var SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 var SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
+var SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
 var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
 var OWD_ALIAS_FIX = {
   read: "public_read",
@@ -4687,6 +5018,13 @@ function firstMasterDetailField(obj) {
   }
   return void 0;
 }
+function resolveCbpRelation(obj) {
+  const entries = asArray19(obj.fields);
+  const pick = (pred) => entries.find((f) => pred(f) && refOf(f));
+  const found = pick((f) => f.type === "master_detail" && !!f.required) ?? pick((f) => f.type === "master_detail") ?? pick((f) => f.type === "lookup" && !!f.required);
+  if (!found) return void 0;
+  return { field: String(found.name ?? "?"), type: String(found.type), master: refOf(found) };
+}
 function grantsObjectAccess(p) {
   return p.allowRead === true || p.allowCreate === true || p.allowEdit === true || p.allowDelete === true || p.viewAllRecords === true || p.modifyAllRecords === true;
 }
@@ -4732,6 +5070,16 @@ function validateSecurityPosture(stack, opts) {
         });
       }
     }
+    if (owd === "controlled_by_parent" && !resolveCbpRelation(obj)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_CBP_NO_RELATION,
+        where: `object "${objName}"`,
+        path: `${objPath}.sharingModel`,
+        message: `"${objName}" declares sharingModel 'controlled_by_parent' but has no relation the platform can derive access from. ADR-0055 resolves the master through a required master_detail, then any master_detail, then a required lookup \u2014 each of which must also name a reference target \u2014 and this object matches none of the three. At runtime every read is DENIED and every write is refused with 422 INVALID_METADATA (#7474), so the object is unusable rather than merely locked down.`,
+        hint: `Add the master relation this object is derived from, e.g. fields.parent: { type: 'master_detail', reference: '<master_object>', required: true }. If the object has no master, its baseline is its own decision \u2014 use sharingModel: 'private' (owner + shares), 'public_read', or 'public_read_write'.`
+      });
+    }
     if (typeof external === "string") {
       if (OWD_ALIAS_FIX[external]) {
         findings.push({
@@ -4797,53 +5145,6 @@ function validateSecurityPosture(stack, opts) {
       }
     }
   }
-  const flagRole = (kind, name, label2, where, path) => {
-    if (identifierHasRoleToken(name)) {
-      findings.push({
-        severity: "error",
-        rule: SECURITY_ROLE_WORD,
-        where,
-        path,
-        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
-        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
-      });
-    } else if (labelHasRoleWord(label2)) {
-      findings.push({
-        severity: "error",
-        rule: SECURITY_ROLE_WORD,
-        where,
-        path: `${path.replace(/\.name$/, "")}.label`,
-        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
-        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
-      });
-    }
-  };
-  for (let i = 0; i < objects.length; i++) {
-    const obj = objects[i];
-    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
-    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
-    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray19(obj.fields)) {
-      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
-    }
-    for (const [ai, action] of asArray19(obj.actions).entries()) {
-      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
-    }
-  }
-  for (let i = 0; i < permissionSets.length; i++) {
-    const ps = permissionSets[i];
-    if (!ps || typeof ps !== "object") continue;
-    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
-  }
-  for (const [i, pos] of asArray19(stack.positions).entries()) {
-    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
-  }
-  for (const [i, app] of asArray19(stack.apps).entries()) {
-    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
-  }
-  for (const [i, book] of asArray19(stack.books).entries()) {
-    flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
-  }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
@@ -4964,6 +5265,60 @@ function validateSecurityPosture(stack, opts) {
   }
   return findings;
 }
+function validateSecurityRoleWord(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objects = asArray19(stack.objects);
+  const permissionSets = asArray19(stack.permissions);
+  const flagRole = (kind, name, label2, where, path) => {
+    if (identifierHasRoleToken(name)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path,
+        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
+        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
+      });
+    } else if (labelHasRoleWord(label2)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path: `${path.replace(/\.name$/, "")}.label`,
+        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
+        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
+      });
+    }
+  };
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
+    for (const f of asArray19(obj.fields)) {
+      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
+    }
+    for (const [ai, action] of asArray19(obj.actions).entries()) {
+      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
+    }
+  }
+  for (let i = 0; i < permissionSets.length; i++) {
+    const ps = permissionSets[i];
+    if (!ps || typeof ps !== "object") continue;
+    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
+  }
+  for (const [i, pos] of asArray19(stack.positions).entries()) {
+    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
+  }
+  for (const [i, app] of asArray19(stack.apps).entries()) {
+    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
+  }
+  for (const [i, book] of asArray19(stack.books).entries()) {
+    flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
+  }
+  return findings;
+}
 
 // src/validate-org-axis-red-lines.ts
 var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
@@ -5773,10 +6128,10 @@ function validateObjectReferences(stack) {
 
 // src/validate-nav-target-refs.ts
 var NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
-var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray26(v) {
-  if (Array.isArray(v)) return v.filter(isRec12);
-  if (isRec12(v)) return Object.entries(v).map(([name, def]) => isRec12(def) ? { name, ...def } : { name });
+  if (Array.isArray(v)) return v.filter(isRec14);
+  if (isRec14(v)) return Object.entries(v).map(([name, def]) => isRec14(def) ? { name, ...def } : { name });
   return [];
 }
 function strName9(v) {
@@ -5798,7 +6153,7 @@ function namesOf(collection) {
 }
 function validateNavTargetRefs(stack) {
   const findings = [];
-  if (!isRec12(stack)) return findings;
+  if (!isRec14(stack)) return findings;
   const apps = asArray26(stack.apps);
   if (apps.length === 0) return findings;
   const declared = /* @__PURE__ */ new Map();
@@ -5810,7 +6165,7 @@ function validateNavTargetRefs(stack) {
     const walk = (items, basePath) => {
       if (!Array.isArray(items)) return;
       for (const [ni, raw] of items.entries()) {
-        if (!isRec12(raw)) continue;
+        if (!isRec14(raw)) continue;
         const nav = raw;
         const navPath = `${basePath}[${ni}]`;
         for (const [type, prop, collection, noun] of NAV_TARGETS) {
@@ -5841,16 +6196,84 @@ function validateNavTargetRefs(stack) {
   return findings;
 }
 
+// src/validate-nav-object-servability.ts
+import { canServeApiOperation } from "@objectstack/spec/data";
+var NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
+var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray27(v) {
+  if (Array.isArray(v)) return v.filter(isRec15);
+  if (isRec15(v)) return Object.entries(v).map(([name, def]) => isRec15(def) ? { name, ...def } : { name });
+  return [];
+}
+function strName10(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var isInterpolated3 = (s) => s.includes("${") || s.includes("{");
+function validateNavObjectServability(stack) {
+  const findings = [];
+  if (!isRec15(stack)) return findings;
+  const apps = asArray27(stack.apps);
+  if (apps.length === 0) return findings;
+  const ownEnable = /* @__PURE__ */ new Map();
+  const objects = asArray27(stack.objects);
+  for (const [oi, obj] of objects.entries()) {
+    const n = strName10(obj.name);
+    if (!n) continue;
+    ownEnable.set(n, { enable: obj.enable, path: `objects[${oi}].enable` });
+  }
+  if (ownEnable.size === 0) return findings;
+  for (const [ai, app] of apps.entries()) {
+    const appName = strName10(app.name) ?? `#${ai}`;
+    const walk = (items, basePath) => {
+      if (!Array.isArray(items)) return;
+      for (const [ni, raw] of items.entries()) {
+        if (!isRec15(raw)) continue;
+        const nav = raw;
+        const navPath = `${basePath}[${ni}]`;
+        if (nav.type === "object") {
+          const target = strName10(nav.objectName);
+          const declared = target && !isInterpolated3(target) ? ownEnable.get(target) : void 0;
+          if (target && declared && !canServeApiOperation(declared.enable, "list")) {
+            const enable = isRec15(declared.enable) ? declared.enable : {};
+            const apiDisabled = enable.apiEnabled === false;
+            const condition = apiDisabled ? "`enable.apiEnabled: false`" : "`enable.apiMethods` does not grant `list`" + (Array.isArray(enable.apiMethods) ? ` (declared: ${enable.apiMethods.length === 0 ? "[] \u2014 deny-all" : enable.apiMethods.map((m) => `\`${String(m)}\``).join(", ")})` : "");
+            const answer = apiDisabled ? "404 `OBJECT_API_DISABLED`" : "405 `OBJECT_API_METHOD_NOT_ALLOWED`";
+            const offendingKey = apiDisabled ? `${declared.path}.apiEnabled` : `${declared.path}.apiMethods`;
+            findings.push({
+              severity: "error",
+              rule: NAV_OBJECT_UNSERVABLE,
+              where: `app "${appName}" \xB7 nav "${strName10(nav.id) ?? strName10(nav.label) ?? `#${ni}`}"`,
+              // The nav entry is where the dead row is authored; the `enable`
+              // key that condemns it is named in the message, because the fix
+              // may belong at either end.
+              path: `${navPath}.objectName`,
+              message: `Navigation targets object "${target}", which cannot serve a list: ${condition} (\`${offendingKey}\`), so the list request answers ${answer} for EVERY user \u2014 platform administrators included, since that gate reads only the object's \`enable\` block and never the caller. The entry cannot be rescued with \`requiredPermissions\`: they are independent conditions. The server prunes this entry from the served \`/meta\` payload (#7912), so publishing it ships a menu row that silently is not there.`,
+              hint: `Remove the nav entry, or make "${target}" listable by setting \`enable.apiEnabled: true\` and granting \`list\` in \`enable.apiMethods\`. \u26D4 Do NOT open the API on an object that is disabled on purpose \u2014 several platform objects hold credential material and are API-disabled deliberately; for those the entry is the mistake, not the \`enable\` block.`
+            });
+          }
+        }
+        if (Array.isArray(nav.children)) walk(nav.children, `${navPath}.children`);
+      }
+    };
+    walk(app.navigation, `apps[${ai}].navigation`);
+    for (const [ari, area] of asArray27(app.areas).entries()) {
+      walk(area.items, `apps[${ai}].areas[${ari}].items`);
+      walk(area.navigation, `apps[${ai}].areas[${ari}].navigation`);
+    }
+  }
+  return findings;
+}
+
 // src/validate-action-name-refs.ts
 var ACTION_NAME_UNDEFINED = "action-name-undefined";
-function asArray27(v) {
+function asArray28(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName10(v) {
+function strName11(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList(v) {
@@ -5887,14 +6310,14 @@ function suggest4(target, known) {
 }
 function collectActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
-  for (const action of asArray27(stack.actions)) {
-    const n = strName10(action?.name);
+  for (const action of asArray28(stack.actions)) {
+    const n = strName11(action?.name);
     if (n) names.add(n);
   }
-  for (const obj of asArray27(stack.objects)) {
+  for (const obj of asArray28(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
-    for (const action of asArray27(obj.actions)) {
-      const n = strName10(action?.name);
+    for (const action of asArray28(obj.actions)) {
+      const n = strName11(action?.name);
       if (n) names.add(n);
     }
   }
@@ -5937,7 +6360,7 @@ function validateActionNameRefs(stack) {
       if (!def || typeof def !== "object") continue;
       if (def.execution !== "aggregate") continue;
       if (def.actionDef !== void 0) continue;
-      const name = strName10(def.name);
+      const name = strName11(def.name);
       if (!name) continue;
       check(
         name,
@@ -5948,11 +6371,11 @@ function validateActionNameRefs(stack) {
       );
     }
   };
-  const views = asArray27(stack.views);
+  const views = asArray28(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
     if (!view || typeof view !== "object") continue;
-    const viewName = strName10(view.name) ?? strName10(view.object) ?? `#${vi}`;
+    const viewName = strName11(view.name) ?? strName11(view.object) ?? `#${vi}`;
     const owner = `view "${viewName}"`;
     checkListContainer(view.list, owner, "list", `views[${vi}].list`);
     const listViews = view.listViews;
@@ -5962,22 +6385,22 @@ function validateActionNameRefs(stack) {
       }
     }
   }
-  const objects = asArray27(stack.objects);
+  const objects = asArray28(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
     const objListViews = obj.listViews;
     if (!objListViews || typeof objListViews !== "object" || Array.isArray(objListViews)) continue;
-    const owner = `object "${strName10(obj.name) ?? `#${oi}`}"`;
+    const owner = `object "${strName11(obj.name) ?? `#${oi}`}"`;
     for (const [key, lv] of Object.entries(objListViews)) {
       checkListContainer(lv, owner, `listViews.${key}`, `objects[${oi}].listViews.${key}`);
     }
   }
-  const pages = asArray27(stack.pages);
+  const pages = asArray28(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
-    const pageName = strName10(page.name) ?? `#${pi}`;
+    const pageName = strName11(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
       const props = component.properties;
       if (!props || typeof props !== "object") continue;
@@ -5985,39 +6408,39 @@ function validateActionNameRefs(stack) {
       for (let ai = 0; ai < names.length; ai++) {
         check(
           names[ai],
-          `page "${pageName}" \xB7 component "${strName10(component.type) ?? "?"}"`,
+          `page "${pageName}" \xB7 component "${strName11(component.type) ?? "?"}"`,
           `${path}.properties.actionNames[${ai}]`,
           "Quick-actions bar"
         );
       }
     }
   }
-  const apps = asArray27(stack.apps);
+  const apps = asArray28(stack.apps);
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName10(app.name) ?? `#${ai}`;
+    const appName = strName11(app.name) ?? `#${ai}`;
     const walkNav = (items, basePath) => {
-      const navItems = asArray27(items);
+      const navItems = asArray28(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
         const actionDef = nav.actionDef;
-        const actionName = strName10(actionDef?.actionName);
+        const actionName = strName11(actionDef?.actionName);
         if (nav.type === "action" && actionName) {
           check(
             actionName,
-            `app "${appName}" \xB7 nav "${strName10(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName11(nav.id) ?? `#${ni}`}"`,
             `${navPath}.actionDef.actionName`,
             "Navigation action item"
           );
         }
-        const runAction = strName10(nav.runAction);
+        const runAction = strName11(nav.runAction);
         if (nav.type === "object" && runAction) {
           check(
             runAction,
-            `app "${appName}" \xB7 nav "${strName10(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName11(nav.id) ?? `#${ni}`}"`,
             `${navPath}.runAction`,
             "Navigation deep-link auto-run"
           );
@@ -6026,7 +6449,7 @@ function validateActionNameRefs(stack) {
       }
     };
     walkNav(app.navigation, `apps[${ai}].navigation`);
-    const areas = asArray27(app.areas);
+    const areas = asArray28(app.areas);
     for (let ri = 0; ri < areas.length; ri++) {
       walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
@@ -6036,14 +6459,14 @@ function validateActionNameRefs(stack) {
 
 // src/validate-action-locations.ts
 var ACTION_NO_PLACEMENT = "action-no-placement";
-function asArray28(v) {
+function asArray29(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName11(v) {
+function strName12(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList2(v) {
@@ -6057,8 +6480,8 @@ function collectNamePlacedActions(stack) {
     for (const key of ["rowActions", "bulkActions"]) {
       for (const n of strList2(list3[key])) placed.add(n);
     }
-    for (const def of asArray28(list3.bulkActionDefs)) {
-      const n = strName11(def?.name);
+    for (const def of asArray29(list3.bulkActionDefs)) {
+      const n = strName12(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -6066,12 +6489,12 @@ function collectNamePlacedActions(stack) {
     if (!listViews || typeof listViews !== "object" || Array.isArray(listViews)) return;
     for (const lv of Object.values(listViews)) harvest(lv);
   };
-  for (const view of asArray28(stack.views)) {
+  for (const view of asArray29(stack.views)) {
     if (!view || typeof view !== "object") continue;
     harvest(view.list);
     harvestListViews(view.listViews);
   }
-  for (const obj of asArray28(stack.objects)) {
+  for (const obj of asArray29(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     harvestListViews(obj.listViews);
   }
@@ -6084,7 +6507,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName11(action.name);
+    const name = strName12(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -6096,13 +6519,13 @@ function validateActionLocations(stack) {
       hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
     });
   };
-  const actions = asArray28(stack.actions);
+  const actions = asArray29(stack.actions);
   for (let i = 0; i < actions.length; i++) check(actions[i], `actions[${i}]`);
-  const objects = asArray28(stack.objects);
+  const objects = asArray29(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
-    const own = asArray28(obj.actions);
+    const own = asArray29(obj.actions);
     for (let ai = 0; ai < own.length; ai++) check(own[ai], `objects[${oi}].actions[${ai}]`);
   }
   return findings;
@@ -6113,13 +6536,13 @@ import { ComponentPropsMap } from "@objectstack/spec/ui";
 import { lintUnknownKeysAgainstSchema } from "@objectstack/spec";
 var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
 var COMPONENT_PROPS_INVALID = "component-props-invalid";
-function isRec13(v) {
+function isRec16(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName12(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function asArray29(v) {
+function asArray30(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6130,23 +6553,36 @@ var PROPS_SCHEMAS = ComponentPropsMap;
 var DATASOURCE_SUPPLIED_PROP = "object";
 function suppliedByDataSource(issue, component) {
   if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
-  const dataSource = isRec13(component.dataSource) ? component.dataSource : void 0;
-  return strName12(dataSource?.object) !== void 0;
+  const dataSource = isRec16(component.dataSource) ? component.dataSource : void 0;
+  return strName13(dataSource?.object) !== void 0;
+}
+function unrecognizedKeysFromUnionArm(issue) {
+  if (issue.code !== "invalid_union") return void 0;
+  const arms = issue.errors;
+  if (!arms || arms.length === 0) return void 0;
+  let found;
+  for (const arm of arms) {
+    const keyIssues = arm.filter((inner) => inner.code === "unrecognized_keys");
+    if (keyIssues.length === 0) continue;
+    if (keyIssues.length !== arm.length || found) return void 0;
+    found = keyIssues[0];
+  }
+  return found;
 }
 function validateComponentProps(stack) {
   const findings = [];
-  if (!isRec13(stack)) return findings;
-  const pages = asArray29(stack.pages);
+  if (!isRec16(stack)) return findings;
+  const pages = asArray30(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec13(page)) continue;
-    const pageName = strName12(page.name) ?? `#${pi}`;
+    if (!isRec16(page)) continue;
+    const pageName = strName13(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName12(component.type);
+      const type = strName13(component.type);
       if (!type) continue;
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec13(component.properties) ? component.properties : void 0;
+      const props = isRec16(component.properties) ? component.properties : void 0;
       if (!props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -6165,6 +6601,20 @@ function validateComponentProps(stack) {
       for (const issue of parsed.error?.issues ?? []) {
         if (suppliedByDataSource(issue, component)) continue;
         const at = issue.path.length ? `${base}.${issue.path.join(".")}` : base;
+        const armIssue = unrecognizedKeysFromUnionArm(issue);
+        if (armIssue) {
+          for (const key of armIssue.keys ?? []) {
+            findings.push({
+              severity: "warning",
+              rule: COMPONENT_PROPS_UNKNOWN_KEY,
+              where,
+              path: `${at}.${key}`,
+              message: `\`${key}\` is not a prop \`${type}\` declares (ComponentPropsMap, @objectstack/spec/ui): ${armIssue.message}`,
+              hint: `Remove \`${key}\`, or declare it on \`${type}\`'s props schema if the component honours it.`
+            });
+          }
+          continue;
+        }
         if (issue.code === "unrecognized_keys") {
           for (const key of issue.keys ?? []) {
             findings.push({
@@ -6197,20 +6647,20 @@ var CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
 var CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
 var CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
 var CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
-function asArray30(v) {
+function asArray31(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName13(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function isRec14(v) {
+function isRec17(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function distance4(a, b) {
@@ -6248,17 +6698,17 @@ function list2(names) {
 }
 function indexDatasets(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const ds of asArray30(stack.datasets)) {
-    const name = strName13(ds.name);
+  for (const ds of asArray31(stack.datasets)) {
+    const name = strName14(ds.name);
     if (!name) continue;
     const dimensions = /* @__PURE__ */ new Set();
-    for (const d of asArray30(ds.dimensions)) {
-      const n = strName13(d.name);
+    for (const d of asArray31(ds.dimensions)) {
+      const n = strName14(d.name);
       if (n) dimensions.add(n);
     }
     const measures = /* @__PURE__ */ new Set();
-    for (const m of asArray30(ds.measures)) {
-      const n = strName13(m.name);
+    for (const m of asArray31(ds.measures)) {
+      const n = strName14(m.name);
       if (n) measures.add(n);
     }
     out.set(name, { dimensions, measures });
@@ -6336,29 +6786,29 @@ function validateChartBindings(stack) {
     if (binding.yAxis) measureRef(binding.yAxis.name, binding.yAxis.path, selected);
     for (const s of binding.series ?? []) measureRef(s.name, s.path, selected);
   };
-  const reports = asArray30(stack.reports);
+  const reports = asArray31(stack.reports);
   for (let ri = 0; ri < reports.length; ri++) {
     const report = reports[ri];
-    if (!isRec14(report)) continue;
-    const reportName = strName13(report.name) ?? `#${ri}`;
+    if (!isRec17(report)) continue;
+    const reportName = strName14(report.name) ?? `#${ri}`;
     const checkReportChart = (chart, dataset, values, where, path) => {
-      if (!isRec14(chart)) return;
+      if (!isRec17(chart)) return;
       check({
         dataset,
         // `values` is the report's measure SELECTION, not a chart ref; feeding
         // it in lets the yAxis "declared but not selected" check work without
         // reporting the selection itself twice.
         values: { names: values, path: `${path}.values` },
-        xAxis: strName13(chart.xAxis) ? { name: strName13(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
-        yAxis: strName13(chart.yAxis) ? { name: strName13(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
-        series: asArray30(chart.series).map((s, si) => ({ name: strName13(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
+        xAxis: strName14(chart.xAxis) ? { name: strName14(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
+        yAxis: strName14(chart.yAxis) ? { name: strName14(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
+        series: asArray31(chart.series).map((s, si) => ({ name: strName14(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
         where,
         path: `${path}.chart`
       });
     };
     checkReportChart(
       report.chart,
-      strName13(report.dataset),
+      strName14(report.dataset),
       strList3(report.values),
       `report "${reportName}" \xB7 chart`,
       `reports[${ri}]`
@@ -6366,45 +6816,45 @@ function validateChartBindings(stack) {
     const blocks = Array.isArray(report.blocks) ? report.blocks : [];
     for (let bi = 0; bi < blocks.length; bi++) {
       const block = blocks[bi];
-      if (!isRec14(block)) continue;
+      if (!isRec17(block)) continue;
       checkReportChart(
         block.chart,
-        strName13(block.dataset),
+        strName14(block.dataset),
         strList3(block.values),
-        `report "${reportName}" \xB7 block "${strName13(block.name) ?? `#${bi}`}" chart`,
+        `report "${reportName}" \xB7 block "${strName14(block.name) ?? `#${bi}`}" chart`,
         `reports[${ri}].blocks[${bi}]`
       );
     }
   }
   const checkListChart = (container, where, path) => {
-    if (!isRec14(container)) return;
+    if (!isRec17(container)) return;
     const chart = container.chart;
-    if (!isRec14(chart)) return;
+    if (!isRec17(chart)) return;
     check({
-      dataset: strName13(chart.dataset),
+      dataset: strName14(chart.dataset),
       dimensions: { names: strList3(chart.dimensions), path: `${path}.chart.dimensions` },
       values: { names: strList3(chart.values), path: `${path}.chart.values` },
       where,
       path: `${path}.chart`
     });
   };
-  const views = asArray30(stack.views);
+  const views = asArray31(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec14(view)) continue;
-    const viewName = strName13(view.name) ?? strName13(view.objectName) ?? `#${vi}`;
+    if (!isRec17(view)) continue;
+    const viewName = strName14(view.name) ?? strName14(view.objectName) ?? `#${vi}`;
     checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
-    if (isRec14(view.listViews)) {
+    if (isRec17(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
         checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
       }
     }
   }
-  const objects = asArray30(stack.objects);
+  const objects = asArray31(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec14(obj) || !isRec14(obj.listViews)) continue;
-    const objName = strName13(obj.name) ?? `#${oi}`;
+    if (!isRec17(obj) || !isRec17(obj.listViews)) continue;
+    const objName = strName14(obj.name) ?? `#${oi}`;
     for (const [key, lv] of Object.entries(obj.listViews)) {
       checkListChart(
         lv,
@@ -6413,22 +6863,22 @@ function validateChartBindings(stack) {
       );
     }
   }
-  const pages = asArray30(stack.pages);
+  const pages = asArray31(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec14(page)) continue;
-    const pageName = strName13(page.name) ?? `#${pi}`;
+    if (!isRec17(page)) continue;
+    const pageName = strName14(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const props = isRec14(component.properties) ? component.properties : void 0;
-      if (!props || !strName13(props.dataset)) continue;
-      const axisRefs = asArray30(props.yAxis).map((a, ai) => ({ name: strName13(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
-      const seriesRefs = asArray30(props.series).map((s, si) => ({ name: strName13(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
+      const props = isRec17(component.properties) ? component.properties : void 0;
+      if (!props || !strName14(props.dataset)) continue;
+      const axisRefs = asArray31(props.yAxis).map((a, ai) => ({ name: strName14(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
+      const seriesRefs = asArray31(props.series).map((s, si) => ({ name: strName14(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
       check({
-        dataset: strName13(props.dataset),
+        dataset: strName14(props.dataset),
         dimensions: { names: strList3(props.dimensions), path: `${path}.properties.dimensions` },
         values: { names: strList3(props.values), path: `${path}.properties.values` },
         series: [...axisRefs, ...seriesRefs],
-        where: `page "${pageName}" \xB7 ${strName13(component.type) ?? "chart"}`,
+        where: `page "${pageName}" \xB7 ${strName14(component.type) ?? "chart"}`,
         path: `${path}.properties`
       });
     }
@@ -6441,11 +6891,11 @@ import { createRequire as createRequire4 } from "module";
 var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
 var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
 var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
-var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray31(v) {
-  if (Array.isArray(v)) return v.filter(isRec15);
-  if (isRec15(v)) {
-    return Object.entries(v).filter(([, def]) => isRec15(def)).map(([name, def]) => ({ name, ...def }));
+var isRec18 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray32(v) {
+  if (Array.isArray(v)) return v.filter(isRec18);
+  if (isRec18(v)) {
+    return Object.entries(v).filter(([, def]) => isRec18(def)).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
@@ -6462,7 +6912,7 @@ function loadAjv() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
     );
   }
-  const ctor = isRec15(mod) && "default" in mod ? mod.default : mod;
+  const ctor = isRec18(mod) && "default" in mod ? mod.default : mod;
   cachedAjv = ctor;
   return ctor;
 }
@@ -6477,7 +6927,7 @@ function loadAddFormats() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
     );
   }
-  const plugin = isRec15(mod) && "default" in mod ? mod.default : mod;
+  const plugin = isRec18(mod) && "default" in mod ? mod.default : mod;
   cachedAddFormats = plugin;
   return plugin;
 }
@@ -6507,17 +6957,17 @@ function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
   if (depth >= MAX_RULE_NESTING_DEPTH) return out;
   for (const branch of ["then", "otherwise"]) {
     const nested = rule[branch];
-    if (isRec15(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+    if (isRec18(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
   }
   return out;
 }
 function walkObjectValidationRules(stack) {
   const walked = [];
-  if (!isRec15(stack)) return walked;
-  for (const obj of asArray31(stack.objects)) {
+  if (!isRec18(stack)) return walked;
+  for (const obj of asArray32(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     const validations = obj.validations;
-    for (const authored of asArray31(validations)) {
+    for (const authored of asArray32(validations)) {
       for (const { rule, label: label2, path } of flattenRules(authored, "", "")) {
         walked.push({
           rule,
@@ -6548,7 +6998,7 @@ function validateRuleCompilability(stack) {
         });
       }
     }
-    if (rule.type === "json_schema" && isRec15(rule.schema)) {
+    if (rule.type === "json_schema" && isRec18(rule.schema)) {
       try {
         createRuntimeAjv().compile(rule.schema);
       } catch (err) {
@@ -6568,7 +7018,7 @@ function validateRuleCompilability(stack) {
 
 // src/validate-rule-schema-formats.ts
 var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
-var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec19 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var SUBSCHEMA_KEYS = [
   "additionalItems",
   "additionalProperties",
@@ -6592,7 +7042,7 @@ var SUBSCHEMA_MAP_KEYS = [
 var MAX_SCHEMA_WALK_DEPTH = 32;
 var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
 function collectFormatUses(schema, pointer, out, depth) {
-  if (!isRec16(schema)) return;
+  if (!isRec19(schema)) return;
   if (typeof schema.format === "string") {
     out.push({ pointer: `${pointer}/format`, name: schema.format });
   }
@@ -6611,7 +7061,7 @@ function collectFormatUses(schema, pointer, out, depth) {
   }
   for (const key of SUBSCHEMA_MAP_KEYS) {
     const value = schema[key];
-    if (!isRec16(value)) continue;
+    if (!isRec19(value)) continue;
     for (const [name, entry] of Object.entries(value)) {
       collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
     }
@@ -6619,13 +7069,13 @@ function collectFormatUses(schema, pointer, out, depth) {
   const items = schema.items;
   if (Array.isArray(items)) {
     items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
-  } else if (isRec16(items)) {
+  } else if (isRec19(items)) {
     collectFormatUses(items, `${pointer}/items`, out, depth + 1);
   }
   const dependencies = schema.dependencies;
-  if (isRec16(dependencies)) {
+  if (isRec19(dependencies)) {
     for (const [name, entry] of Object.entries(dependencies)) {
-      if (!isRec16(entry)) continue;
+      if (!isRec19(entry)) continue;
       collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
     }
   }
@@ -6664,7 +7114,7 @@ function validateRuleSchemaFormats(stack) {
   const findings = [];
   const pending = [];
   for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
-    if (rule.type !== "json_schema" || !isRec16(rule.schema)) continue;
+    if (rule.type !== "json_schema" || !isRec19(rule.schema)) continue;
     const uses = [];
     collectFormatUses(rule.schema, "", uses, 0);
     for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
@@ -6692,7 +7142,7 @@ function validateRuleSchemaFormats(stack) {
 import { isPlatformProvidedObjectName as isPlatformProvidedObjectName2 } from "@objectstack/spec/system";
 
 // src/build-access-matrix.ts
-function asArray32(v) {
+function asArray33(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6703,13 +7153,13 @@ function buildAccessMatrix(stack) {
   const entries = [];
   if (!stack || typeof stack !== "object") return { version: 1, entries };
   const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray32(stack.objects)) {
+  for (const obj of asArray33(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : "";
     if (!name) continue;
     const owd = obj.sharingModel ?? obj.security?.sharingModel;
     if (typeof owd === "string") owdByObject.set(name, owd);
   }
-  for (const ps of asArray32(stack.permissions)) {
+  for (const ps of asArray33(stack.permissions)) {
     const psName = typeof ps.name === "string" ? ps.name : "";
     if (!psName) continue;
     const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
@@ -6782,34 +7232,34 @@ function diffAccessMatrix(before, after) {
 
 // src/validate-nav-access.ts
 var NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
-function asArray33(v) {
+function asArray34(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName14(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function collectNavExposures(stack) {
   const out = [];
-  const apps = asArray33(stack.apps);
+  const apps = asArray34(stack.apps);
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName14(app.name) ?? `#${ai}`;
+    const appName = strName15(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
-      const navItems = asArray33(items);
+      const navItems = asArray34(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
-        const objectName = strName14(nav.objectName);
+        const objectName = strName15(nav.objectName);
         if (nav.type === "object" && objectName) {
           out.push({
             objectName,
-            where: `app "${appName}" \xB7 nav "${strName14(nav.id) ?? `#${ni}`}"`,
+            where: `app "${appName}" \xB7 nav "${strName15(nav.id) ?? `#${ni}`}"`,
             path: `${navPath}.objectName`
           });
         }
@@ -6817,7 +7267,7 @@ function collectNavExposures(stack) {
       }
     };
     walk(app.navigation, `apps[${ai}].navigation`);
-    const areas = asArray33(app.areas);
+    const areas = asArray34(app.areas);
     for (let ri = 0; ri < areas.length; ri++) {
       walk(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
@@ -6827,13 +7277,13 @@ function collectNavExposures(stack) {
 function validateNavAccess(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const permissionSets = asArray33(stack.permissions);
+  const permissionSets = asArray34(stack.permissions);
   if (permissionSets.length === 0) return findings;
   const exposures = collectNavExposures(stack);
   if (exposures.length === 0) return findings;
   const ownObjects = /* @__PURE__ */ new Set();
-  for (const obj of asArray33(stack.objects)) {
-    const n = strName14(obj.name);
+  for (const obj of asArray34(stack.objects)) {
+    const n = strName15(obj.name);
     if (n) ownObjects.add(n);
   }
   const readable = /* @__PURE__ */ new Set();
@@ -6866,15 +7316,15 @@ import { expandViewContainer } from "@objectstack/spec";
 import { hasPlatformObjectPrefix as hasPlatformObjectPrefix2, isPlatformProvidedObjectName as isPlatformProvidedObjectName3 } from "@objectstack/spec/system";
 var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec17(v) {
+function isRec20(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function asArray34(v) {
+function asArray35(v) {
   if (Array.isArray(v)) return v;
-  if (isRec17(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec17(def) ? def : {} }));
+  if (isRec20(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec20(def) ? def : {} }));
   return [];
 }
-function strName15(v) {
+function strName16(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance5(a, b) {
@@ -6934,34 +7384,34 @@ function collectViewRecord(view, factsFor) {
   };
   const addSections = (container, binding) => {
     if (!binding) return;
-    for (const section of asArray34(container.sections)) {
-      const sectionName = strName15(section.name);
+    for (const section of asArray35(container.sections)) {
+      const sectionName = strName16(section.name);
       if (sectionName) factsFor(binding).sections.add(sectionName);
     }
   };
-  const listBinding = isRec17(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec17(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
-  addView(recordObject ?? listBinding, strName15(view.name));
+  const listBinding = isRec20(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec20(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
+  addView(recordObject ?? listBinding, strName16(view.name));
   const named = namedViewKeys(view);
   for (const family of ["listViews", "formViews"]) {
     const container = view[family];
-    if (!isRec17(container)) continue;
+    if (!isRec20(container)) continue;
     const registryKeys = family === "listViews" ? named.list : named.form;
     let at = 0;
     for (const sub of Object.values(container)) {
       if (!sub || typeof sub !== "object") continue;
       const registryKey = registryKeys[at++];
-      if (!isRec17(sub)) continue;
+      if (!isRec20(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
       addView(binding, registryKey);
       addSections(sub, binding);
     }
   }
-  if (isRec17(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  if (isRec20(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
   addSections(view, recordObject ?? listBinding);
 }
 function defaultListViewKey(object, container) {
-  if (!object || !isRec17(container.list)) return void 0;
+  if (!object || !isRec20(container.list)) return void 0;
   const item = expandViewContainer(object, container).find(
     (i) => i.viewKind === "list" && i.isDefault
   );
@@ -6973,7 +7423,7 @@ function namedViewKeys(container) {
   const object = "probe";
   const prefix = `${object}.`;
   const bare = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : name;
-  const countEntries = (v) => isRec17(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
+  const countEntries = (v) => isRec20(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
   const listCount = countEntries(container.listViews);
   const formCount = countEntries(container.formViews);
   if (!listCount && !formCount) return { list: [], form: [] };
@@ -6991,14 +7441,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec17(opt)) continue;
-      const value = strName15(opt.value);
+      if (!isRec20(opt)) continue;
+      const value = strName16(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName15(opt.label);
+      const label2 = strName16(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec17(raw)) {
+  } else if (isRec20(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -7018,48 +7468,48 @@ function buildUniverse(stack) {
     }
     return facts;
   };
-  for (const obj of asArray34(stack.objects)) {
-    const objectName = strName15(obj.name);
+  for (const obj of asArray35(stack.objects)) {
+    const objectName = strName16(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
-    for (const field of asArray34(obj.fields)) {
-      const fieldName = strName15(field.name);
+    for (const field of asArray35(obj.fields)) {
+      const fieldName = strName16(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
-    for (const action of asArray34(obj.actions)) {
-      const actionName = strName15(action.name);
+    for (const action of asArray35(obj.actions)) {
+      const actionName = strName16(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
-    for (const view of asArray34(obj.views)) {
-      collectViewRecord({ ...view, object: strName15(view.object) ?? objectName }, factsFor);
+    for (const view of asArray35(obj.views)) {
+      collectViewRecord({ ...view, object: strName16(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
-    for (const group of asArray34(obj.fieldGroups)) {
-      const key = strName15(group.key) ?? strName15(group.name);
+    for (const group of asArray35(obj.fieldGroups)) {
+      const key = strName16(group.key) ?? strName16(group.name);
       if (key) facts.sections.add(key);
     }
   }
-  for (const view of asArray34(stack.views)) {
+  for (const view of asArray35(stack.views)) {
     collectViewRecord(view, factsFor);
   }
-  const pages = asArray34(stack.pages);
+  const pages = asArray35(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec17(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec20(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      for (const section of asArray34(props.sections)) {
-        const sectionName = strName15(section.name);
+      for (const section of asArray35(props.sections)) {
+        const sectionName = strName16(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
   }
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
-  for (const action of asArray34(stack.actions)) {
-    const actionName = strName15(action.name);
+  for (const action of asArray35(stack.actions)) {
+    const actionName = strName16(action.name);
     if (!actionName) continue;
-    const owner = strName15(action.objectName) ?? strName15(action.object);
+    const owner = strName16(action.objectName) ?? strName16(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -7073,41 +7523,41 @@ function buildUniverse(stack) {
     }
   }
   const apps = /* @__PURE__ */ new Map();
-  for (const app of asArray34(stack.apps)) {
-    const appName = strName15(app.name);
+  for (const app of asArray35(stack.apps)) {
+    const appName = strName16(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
-      for (const item of asArray34(items)) {
-        const id = strName15(item.id);
+      for (const item of asArray35(items)) {
+        const id = strName16(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
-    for (const area of asArray34(app.areas)) {
-      const areaId = strName15(area.id);
+    for (const area of asArray35(app.areas)) {
+      const areaId = strName16(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
     apps.set(appName, navIds);
   }
   const dashboards = /* @__PURE__ */ new Map();
-  for (const dash of asArray34(stack.dashboards)) {
-    const dashName = strName15(dash.name);
+  for (const dash of asArray35(stack.dashboards)) {
+    const dashName = strName16(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
-    for (const widget of asArray34(dash.widgets)) {
-      const id = strName15(widget.id) ?? strName15(widget.name);
+    for (const widget of asArray35(dash.widgets)) {
+      const id = strName16(widget.id) ?? strName16(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray34(isRec17(dash.header) ? dash.header.actions : void 0),
-      ...asArray34(dash.actions)
+      ...asArray35(isRec20(dash.header) ? dash.header.actions : void 0),
+      ...asArray35(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName15(action.actionUrl) ?? strName15(action.url) ?? strName15(action.name);
+      const key = strName16(action.actionUrl) ?? strName16(action.url) ?? strName16(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -7119,7 +7569,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec17(stack)) return findings;
+  if (!isRec20(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -7128,13 +7578,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec17(bundle)) continue;
+    if (!isRec20(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec17(rawData)) continue;
+      if (!isRec20(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec17(rawNode)) continue;
+        if (!isRec20(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -7160,7 +7610,7 @@ function validateTranslationReferences(stack) {
             );
             continue;
           }
-          if (!isRec17(rawField)) continue;
+          if (!isRec20(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -7242,7 +7692,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec17(rawApp)) continue;
+        if (!isRec20(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
@@ -7265,7 +7715,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec17(rawDash)) continue;
+        if (!isRec20(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
@@ -7290,7 +7740,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec17(v) ? v : {};
+  return isRec20(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -7302,7 +7752,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName15(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName16(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -7321,11 +7771,11 @@ function checkOptionKeys(findings, ctx) {
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec17(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec20(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
-  for (const param of asArray34(ctx.action.params)) {
-    const name = strName15(param.name) ?? strName15(param.field);
+  for (const param of asArray35(ctx.action.params)) {
+    const name = strName16(param.name) ?? strName16(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -7343,14 +7793,14 @@ function checkActionParams(findings, ctx) {
 
 // src/validate-translatable-sections.ts
 var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
-function isRec18(v) {
+function isRec21(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName16(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function viewLabel(view) {
-  const name = strName16(view.name);
+  const name = strName17(view.name);
   return name ? `view "${name}"` : "";
 }
 function joinWhere(...parts) {
@@ -7358,7 +7808,7 @@ function joinWhere(...parts) {
 }
 function collectViewSites(view, basePath, label2, sites) {
   const recordObject = viewObjectName(view);
-  const listBinding = isRec18(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
+  const listBinding = isRec21(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
   for (const site of viewContainerSites(view, basePath)) {
     sites.push({
       path: `${site.path}.sections`,
@@ -7372,11 +7822,11 @@ function translatedObjectNames(stack) {
   const out = /* @__PURE__ */ new Set();
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   for (const bundle of bundles) {
-    if (!isRec18(bundle)) continue;
+    if (!isRec21(bundle)) continue;
     for (const data of Object.values(bundle)) {
-      if (!isRec18(data) || !isRec18(data.objects)) continue;
+      if (!isRec21(data) || !isRec21(data.objects)) continue;
       for (const [objectName, node] of Object.entries(data.objects)) {
-        if (isRec18(node)) out.add(objectName);
+        if (isRec21(node)) out.add(objectName);
       }
     }
   }
@@ -7388,22 +7838,22 @@ function suggestedName(label2) {
 }
 function validateTranslatableSections(stack) {
   const findings = [];
-  if (!isRec18(stack)) return findings;
+  if (!isRec21(stack)) return findings;
   const translated = translatedObjectNames(stack);
   if (translated.size === 0) return findings;
   const sites = [];
   for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
-    const objectName = strName16(obj.name);
+    const objectName = strName17(obj.name);
     if (!objectName) continue;
     for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
       collectViewSites(
-        { ...view, object: strName16(view.object) ?? objectName },
+        { ...view, object: strName17(view.object) ?? objectName },
         path,
         viewLabel(view),
         sites
       );
     }
-    if (isRec18(obj.listViews)) {
+    if (isRec21(obj.listViews)) {
       collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
     }
   }
@@ -7411,13 +7861,13 @@ function validateTranslatableSections(stack) {
     collectViewSites(view, path, viewLabel(view), sites);
   }
   for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
-    const pageName = strName16(page.name);
+    const pageName = strName17(page.name);
     const pageLabel = pageName ? `page "${pageName}"` : "";
     for (const walked of walkPageComponents(page, pagePath)) {
       if (!walked.objectName) continue;
-      const props = isRec18(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec21(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      const type = strName16(walked.component.type) ?? "component";
+      const type = strName17(walked.component.type) ?? "component";
       sites.push({
         path: `${walked.path}.properties.sections`,
         surface: joinWhere(pageLabel, type),
@@ -7432,9 +7882,9 @@ function validateTranslatableSections(stack) {
     if (!Array.isArray(site.sections)) continue;
     for (let i = 0; i < site.sections.length; i++) {
       const section = site.sections[i];
-      if (!isRec18(section)) continue;
-      if (strName16(section.name)) continue;
-      const heading = strName16(section.label);
+      if (!isRec21(section)) continue;
+      if (strName17(section.name)) continue;
+      const heading = strName17(section.label);
       if (!heading) continue;
       const slug = suggestedName(heading);
       findings.push({
@@ -7452,14 +7902,14 @@ function validateTranslatableSections(stack) {
 
 // src/validate-ai-surface-affinity.ts
 var AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
-function asArray35(v) {
+function asArray36(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName17(v) {
+function strName18(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -7469,18 +7919,18 @@ function validateAiSurfaceAffinity(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
-  for (const skill of asArray35(stack.skills)) {
-    const n = strName17(skill.name);
+  for (const skill of asArray36(stack.skills)) {
+    const n = strName18(skill.name);
     if (n) skillsByName.set(n, skill);
   }
-  const agents = asArray35(stack.agents);
+  const agents = asArray36(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName17(agent.name) ?? `#${ai}`;
+    const agentName = strName18(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName17(skillRefs[si]);
+      const ref = strName18(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -7502,14 +7952,14 @@ function validateAiSurfaceAffinity(stack) {
 // src/validate-ai-tool-references.ts
 import { PLATFORM_PROVIDED_TOOL_NAMES, PLATFORM_TOOL_FAMILY_PREFIXES } from "@objectstack/spec/system";
 var AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
-function asArray36(v) {
+function asArray37(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName18(v) {
+function strName19(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance6(a, b) {
@@ -7550,26 +8000,26 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName18(aiRec.description)) return false;
-  const type = strName18(action.type);
+  if (!strName19(aiRec.description)) return false;
+  const type = strName19(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
 }
 function collectToolUniverse(stack) {
   const universe = new Set(PLATFORM_PROVIDED_TOOL_NAMES);
-  for (const tool of asArray36(stack.tools)) {
-    const n = strName18(tool.name);
+  for (const tool of asArray37(stack.tools)) {
+    const n = strName19(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
-    for (const action of asArray36(actions)) {
-      const n = strName18(action.name);
+    for (const action of asArray37(actions)) {
+      const n = strName19(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
   addActionFamily(stack.actions);
-  for (const obj of asArray36(stack.objects)) {
+  for (const obj of asArray37(stack.objects)) {
     addActionFamily(obj.actions);
   }
   return universe;
@@ -7577,13 +8027,13 @@ function collectToolUniverse(stack) {
 function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
-    for (const action of asArray36(actions)) {
-      const n = strName18(action.name);
+    for (const action of asArray37(actions)) {
+      const n = strName19(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
   scan(stack.actions);
-  for (const obj of asArray36(stack.objects)) scan(obj.actions);
+  for (const obj of asArray37(stack.objects)) scan(obj.actions);
   return names;
 }
 function validateAiToolReferences(stack) {
@@ -7601,13 +8051,13 @@ function validateAiToolReferences(stack) {
     }
     return universe.has(ref);
   };
-  const skills = asArray36(stack.skills);
+  const skills = asArray37(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName18(skill.name) ?? `#${si}`;
+    const skillName = strName19(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName18(refs[ti]);
+      const ref = strName19(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -7627,24 +8077,24 @@ function validateAiToolReferences(stack) {
 // src/validate-ai-agent-authoring.ts
 var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
 var DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
-function asArray37(v) {
+function asArray38(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName19(v) {
+function strName20(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
 function validateAiAgentAuthoring(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const agents = asArray37(stack.agents);
+  const agents = asArray38(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName19(agent.name) ?? `#${ai}`;
+    const name = strName20(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -7657,12 +8107,12 @@ function validateAiAgentAuthoring(stack) {
     });
   }
   const roster = [...PLATFORM_AGENT_NAMES].join(", ");
-  const apps = asArray37(stack.apps);
+  const apps = asArray38(stack.apps);
   for (let appIdx = 0; appIdx < apps.length; appIdx++) {
     const app = apps[appIdx];
-    const defaultAgent = strName19(app.defaultAgent);
+    const defaultAgent = strName20(app.defaultAgent);
     if (!defaultAgent || PLATFORM_AGENT_NAMES.has(defaultAgent)) continue;
-    const appName = strName19(app.name) ?? `#${appIdx}`;
+    const appName = strName20(app.name) ?? `#${appIdx}`;
     findings.push({
       severity: "warning",
       rule: DEFAULT_AGENT_OUTSIDE_ROSTER,
@@ -7764,24 +8214,24 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec19 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray38(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec19(x));
-  if (isRec19(v)) {
+var isRec22 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray39(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec22(x));
+  if (isRec22(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec19(def) ? def : {}
+      ...isRec22(def) ? def : {}
     }));
   }
   return [];
 }
 function indexObjectFields2(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const obj of asArray38(stack.objects)) {
+  for (const obj of asArray39(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const names = /* @__PURE__ */ new Set();
-    for (const f of asArray38(obj.fields)) {
+    for (const f of asArray39(obj.fields)) {
       if (typeof f.name === "string" && f.name) names.add(f.name);
     }
     out.set(name, names);
@@ -7911,12 +8361,12 @@ ${source}
 }
 function validateHookBodyWrites(stack) {
   const findings = [];
-  const hooks = asArray38(stack.hooks);
+  const hooks = asArray39(stack.hooks);
   if (hooks.length === 0) return findings;
   let objectFields = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec19(body) || body.language !== "js") return;
+    if (!isRec22(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
@@ -7997,13 +8447,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec20 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray39(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec20(x));
-  if (isRec20(v)) {
+var isRec23 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray40(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec23(x));
+  if (isRec23(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec20(def) ? def : {}
+      ...isRec23(def) ? def : {}
     }));
   }
   return [];
@@ -8017,11 +8467,11 @@ function collectActionBodies(stack) {
   const sites = [];
   const seen = /* @__PURE__ */ new Set();
   const collect = (actions, pathPrefix, parentObject) => {
-    asArray39(actions).forEach((action, index) => {
+    asArray40(actions).forEach((action, index) => {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec20(body) || body.language !== "js") return;
+      if (!isRec23(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -8032,7 +8482,7 @@ function collectActionBodies(stack) {
     });
   };
   collect(stack.actions, "actions");
-  asArray39(stack.objects).forEach((obj, objIndex) => {
+  asArray40(stack.objects).forEach((obj, objIndex) => {
     const parentObject = typeof obj.name === "string" && obj.name ? obj.name : void 0;
     collect(obj.actions, `objects[${objIndex}].actions`, parentObject);
   });
@@ -8040,7 +8490,7 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec20(stack)) return findings;
+  if (!isRec23(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
@@ -8099,13 +8549,13 @@ import { findClosestMatches as findClosestMatches4, formatSuggestion as formatSu
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
 var FLOW_WRITE_NODE_TYPES_DEFERRED = [];
-var isRec21 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray40(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec21(x));
-  if (isRec21(v)) {
+var isRec24 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray41(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec24(x));
+  if (isRec24(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec21(def) ? def : {}
+      ...isRec24(def) ? def : {}
     }));
   }
   return [];
@@ -8118,8 +8568,8 @@ function readLiteralObjectName2(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec21(stack)) return findings;
-  const flows = asArray40(stack.flows);
+  if (!isRec24(stack)) return findings;
+  const flows = asArray41(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
   flows.forEach((flow, flowIndex) => {
@@ -8127,10 +8577,10 @@ function validateFlowNodeWrites(stack) {
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec21(node.config) ? node.config : void 0;
+      const config = isRec24(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec21(fields)) return;
+      if (!isRec24(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName2(config);
@@ -8176,6 +8626,15 @@ var REFERENCE_INTEGRITY_RULES = [
   // `action` is deliberately absent (validateActionNameRefs owns it) and so is
   // `component` (an unregistered ref renders a named diagnostic, not silence).
   { name: "validateNavTargetRefs", run: validateNavTargetRefs },
+  // [#7912] The THIRD question about a nav entry, after "does the target
+  // resolve?" (above) and "is it granted?" (`validateNavAccess`): can the
+  // destination serve at all? An object's own `enable` block can make its list
+  // answer 404/405 for every persona, and no gate authorable on the entry
+  // expresses that — which is how #7544's dead row survived review for a year.
+  // The server now prunes such an entry from the `/meta` payload; the
+  // maintainer ruling of 2026-08-12 makes THIS the mandatory companion, so the
+  // prune is never silent to the author who wrote the row.
+  { name: "validateNavObjectServability", run: validateNavObjectServability },
   { name: "validateTranslationReferences", run: validateTranslationReferences },
   // The same family from the other end (#5417). Its sibling above asks "does
   // this bundle key resolve?"; this one asks "is there a key at all?" — a form
@@ -8276,7 +8735,7 @@ import {
   collectFlowGraphs as collectFlowGraphs2
 } from "@objectstack/spec/automation";
 import { reduceFilterVerdict as reduceFilterVerdict2 } from "@objectstack/spec/data";
-function asArray41(v) {
+function asArray42(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -8660,7 +9119,7 @@ function scanApprovalReviseLoops(at, nodes, edges, findings) {
 }
 function lintFlowPatterns(stack) {
   const findings = [];
-  for (const flow of asArray41(stack.flows)) {
+  for (const flow of asArray42(stack.flows)) {
     const flowName = typeof flow.name === "string" ? flow.name : "(unnamed flow)";
     const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
     const edges = Array.isArray(flow.edges) ? flow.edges : [];
@@ -8757,7 +9216,7 @@ import { dirname, join } from "path";
 import { existsSync, readFileSync } from "fs";
 var LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
 var LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
-function asArray42(v) {
+function asArray43(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -8894,11 +9353,11 @@ function lintLivenessProperties(stack) {
   const findings = [];
   const objectWarn = loadWarnMap(dir, "object");
   const fieldWarn = loadWarnMap(dir, "field");
-  for (const obj of asArray42(stack.objects)) {
+  for (const obj of asArray43(stack.objects)) {
     const objName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     if (objectWarn.size > 0) checkItem("object", obj, `object '${objName}'`, objectWarn, findings);
     if (fieldWarn.size > 0) {
-      for (const field of asArray42(obj.fields)) {
+      for (const field of asArray43(obj.fields)) {
         const fieldName = typeof field.name === "string" ? field.name : "(unnamed field)";
         checkItem("field", field, `object '${objName}' \xB7 field '${fieldName}'`, fieldWarn, findings);
       }
@@ -8907,7 +9366,7 @@ function lintLivenessProperties(stack) {
   for (const { type, key } of TYPE_COLLECTIONS) {
     const warnMap = loadWarnMap(dir, type);
     if (warnMap.size === 0) continue;
-    for (const item of asArray42(stack[key])) {
+    for (const item of asArray43(stack[key])) {
       const name = typeof item.name === "string" ? item.name : typeof item.object === "string" ? item.object : `(unnamed ${type})`;
       checkItem(type, item, `${type} '${name}'`, warnMap, findings);
     }
@@ -8921,7 +9380,7 @@ var AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
 var AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
 var AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
 var AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
-function asArray43(v) {
+function asArray44(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -8930,9 +9389,9 @@ function asArray43(v) {
 }
 function lintAutonumberFormats(stack) {
   const findings = [];
-  for (const obj of asArray43(stack.objects)) {
+  for (const obj of asArray44(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
-    const fields = asArray43(obj.fields);
+    const fields = asArray44(obj.fields);
     const fieldMeta = /* @__PURE__ */ new Map();
     for (const f of fields) {
       if (typeof f.name === "string") fieldMeta.set(f.name, { required: f.required === true });
@@ -8998,7 +9457,7 @@ function lintAutonumberFormats(stack) {
 
 // src/lint-view-refs.ts
 import { expandViewContainerWithDiagnostics, isAggregatedViewContainer } from "@objectstack/spec";
-function asArray44(v) {
+function asArray45(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -9026,7 +9485,7 @@ function lintViewRefs(stack) {
     s.add(kind);
   };
   const containers = [];
-  for (const v of asArray44(stack.views)) {
+  for (const v of asArray45(stack.views)) {
     if (v.viewKind) {
       if (typeof v.name === "string") indexKind(v.name, v.viewKind === "form" ? "form" : "list");
       continue;
@@ -9035,7 +9494,7 @@ function lintViewRefs(stack) {
     const object = viewContainerObjectName(v);
     if (object) containers.push({ object, container: v });
   }
-  for (const obj of asArray44(stack.objects)) {
+  for (const obj of asArray45(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
     if (!object) continue;
     if (obj.list || obj.form || obj.listViews || obj.formViews) {
@@ -9089,11 +9548,11 @@ function lintViewRefs(stack) {
       });
     }
   };
-  for (const obj of asArray44(stack.objects)) {
+  for (const obj of asArray45(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
-    for (const action of asArray44(obj.actions)) checkAction(action, object);
+    for (const action of asArray45(obj.actions)) checkAction(action, object);
   }
-  for (const action of asArray44(stack.actions)) checkAction(action);
+  for (const action of asArray45(stack.actions)) checkAction(action);
   return findings;
 }
 
@@ -9397,7 +9856,6 @@ var CLI_ONLY = ["cli"];
 var CLI_AND_RUNTIME = ["cli", "runtime-publish"];
 var RUNTIME_NEEDS_FULL_SNAPSHOT = "P2 (#4463): reads a stack-wide collection the per-write snapshot does not carry, so running it now would report the rest of the tenant's metadata as missing rather than judging this write.";
 var RUNTIME_HEAVY_SOURCE_PARSE = "Not runtime-safe: parses authored source through typescript/sucrase, the two dependencies the kernel boot path must never load (lazy-deps.test.ts). Studio compiles page source on its own path.";
-var RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY = "Deliberate, and not a snapshot limitation: this rule needs only the written item, but every other rule on the `views[]` visibility-predicate surface (validate-visibility-predicates.ts) is CLI-only. Gating one of three sibling verdicts about the same predicate at the Studio door is less predictable than gating none; move the family together, as one measured edit.";
 var RUNTIME_OBJECT_WRITES_P2 = "P2 (#4463): judges an object/field declaration. Object writes are the hottest metadata path in the product, so P1 gates `flow` first and widens once the gate has real traffic behind it.";
 var EXPRESSION_INVALID = "expression-invalid";
 var AUTHORING_RULES = [
@@ -9463,6 +9921,31 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_OBJECT_WRITES_P2,
     run: (stack) => validateFunctionalCompleteness(stack)
   },
+  // [#7521, via cloud#1225] A managed object advertising a generic write verb
+  // in `enable.apiMethods` that its own resolved affordances refuse. Every key
+  // is one we know and each is individually valid, so #4001's unknown-key
+  // rejection and the Zod parse both pass it; the contradiction is only visible
+  // when the two keys are read TOGETHER, which nothing did at authoring time.
+  //
+  // `gating` because the declaration is already false when it ships: objectql's
+  // registry strips the verb at registration, so the metadata advertises an API
+  // the product does not serve. That strip has been correct and silent — a
+  // `console.warn` on every control-plane boot that went unread for the life of
+  // a real divergence (`sys_environment`/`sys_package`). This entry is the
+  // ruling's "close it where the author is"; boot stays warn-and-strip.
+  //
+  // Pre-parse: the predicate reads only authored keys, and the finding must
+  // survive an unrelated schema error elsewhere in the stack.
+  {
+    name: "validateManagedApiMethods",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-managed-api-methods.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateManagedApiMethods(stack)
+  },
   // A view container in `views: []` that registers zero views: nothing appears
   // in the Console, and the schema step cannot tell it from an intentionally
   // empty one. The FLAT-list-view arm no longer needs this tier — `ViewSchema`
@@ -9842,14 +10325,47 @@ var AUTHORING_RULES = [
   // what decides whether any given diagnostic gates, exactly as `lintFlowPatterns`
   // has worked since #3760. The promotion follows the #5762 precedent: a family
   // that gains an `error` finding moves its registry tier in the same edit.
+  //
+  // ─── The `views[]` visibility-predicate FAMILY at the runtime door (#7220) ───
+  //
+  // This entry and `validatePredicatePathRefs` below moved to `runtime-publish`
+  // in ONE edit, on the maintainer's 2026-08-10 ruling, sequenced after #4717's
+  // `advisories` channel landed (PR #7435). Before that move a `view` written
+  // through Studio / REST `/meta` / MCP — the only door most tenants have, and
+  // the door AI authors use — was judged by NONE of the family's rule ids (six
+  // at the time of the move; seven since #7659 added
+  // `predicate-rhs-path-shaped` inside the second entry).
+  //
+  // They move together on purpose, and the two entries carry one comment because
+  // they are one wall: #7214's implementer wired its own rule here alone and then
+  // REVERTED it, because a `view` refused for an unresolvable predicate PATH
+  // while a predicate that does not parse at all walks through the same door is
+  // less predictable than refusing neither. A half-wired wall is worse than an
+  // unwired one, so `authoring-rule-wiring.test.ts` now pins the family property
+  // directly: every id on this surface is gated at the runtime door, or none is.
+  //
+  // The previous `surfaceReason` on THIS entry was `RUNTIME_NEEDS_FULL_SNAPSHOT`,
+  // and re-measuring it at move time found it false: both rule functions read
+  // `stack.views` and `stack.pages` and NO other collection — never `objects` —
+  // so the per-write snapshot the gate builds is not partial for them, it is
+  // complete. (`pages` is simply absent on a `view` write, so the page half
+  // contributes zero findings to both differential passes rather than inventing
+  // any.) The reason was not describing this rule; it was the default a rule got
+  // when nobody measured, which is the #4409/#4463 defect one layer in.
+  //
+  // Runtime input tier: the gate hands the rules the body as persisted, without
+  // `normalizeStackInput`, so the ADR-0087 D2 alias fold does NOT run at this
+  // door. That costs the family nothing — `validateVisibilityPredicates` reads
+  // `visibleWhen ?? visibleOn ?? visibility` itself, canonical-first, precisely
+  // so a caller handing it a raw authored object still gets a verdict.
   {
     name: "validateVisibilityPredicates",
     tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-visibility-predicates.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["view"],
     run: (stack) => validateVisibilityPredicates(stack)
   },
   // #7010 — the same predicate surface, one question further in. The three
@@ -9866,14 +10382,28 @@ var AUTHORING_RULES = [
   // object's addressable path set is NOT closed (lookup traversal, system
   // columns, formula outputs), and an `error` gate over an open set generates
   // false build errors. See the rule's module note.
+  //
+  // #7659 adds a THIRD id here, `predicate-rhs-path-shaped`, which is not a
+  // resolution question at all: the metadata-admin renderer resolves paths only
+  // on the LEFT of `==` / `!=` and hands the right side to its literal parser,
+  // so `data.a == data.b` resolves both sides cleanly, passes the two rules
+  // above, and still compares against the string "data.b" — a constant verdict.
+  // It carries `error` on a dotted chain (no reading under which it worked) and
+  // `warning` on a bare word (`status == active` compares as the text today, so
+  // refusing it would fail a build over metadata that renders correctly). The
+  // per-finding severity is what gates, exactly as `lintFlowPatterns` has worked
+  // since #3760; the entry's `gating` tier is unchanged because it already was.
   {
     name: "validatePredicatePathRefs",
     tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-predicate-path-refs.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY,
+    // The second half of the #7220 family move — see the block above the
+    // `validateVisibilityPredicates` entry. This is the rule whose solo wiring
+    // was reverted; it is wired now because its siblings are.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["view"],
     run: (stack) => validatePredicatePathRefs(stack)
   },
   // #1874 — flow authoring anti-patterns. Advisory by default; a finding marked
@@ -10033,16 +10563,110 @@ var AUTHORING_RULES = [
   // a runtime enforcement point (fail-closed OWD default, canonical enum, anchor
   // binding gate, vocabulary freeze), moving the failure from a runtime deny to
   // an author-time fix-it. Per ADR-0049 this is not advisory security.
+  //
+  // [#7576] The `surfaceReason` below is MEASURED. Its predecessor was not, and
+  // was false in both halves — it read: "Already gated at this surface by a
+  // DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on
+  // `object` (`registerAuthoringGate`) that enforces the same OWD posture rules
+  // on every runtime write. Running the linter here as well would double-report
+  // one refusal in two vocabularies."
+  //
+  //  - COVERAGE. `object-posture-gate.ts` reads exactly `sharingModel` and
+  //    `externalSharingModel` through a local `OWD_WIDTH`, and never touches
+  //    `fields`, `permissions`, `books` or `data`. Of the THIRTEEN rule ids this
+  //    block carries it covers ONE — `security-external-wider-than-internal`
+  //    (its R2). The gate's other half, R1 (env-tighten-only, ADR-0086 D1),
+  //    corresponds to no lint rule at all, so it is not coverage in the other
+  //    direction either. Twelve rules were enforced at no runtime door while
+  //    this field said they were.
+  //  - DOUBLE-REPORTING. It cannot happen, and not by luck: `saveMetaItem` runs
+  //    `assertRuntimeAuthoringRules` (this table, 422 `invalid_metadata`) BEFORE
+  //    `runAuthoringGate` (the ADR-0094 gate, 403 `owd_external_wider`), and
+  //    both refuse by THROWING. The first to fire ends the write, so an author
+  //    sees one refusal, never two. The stated cost of moving was imaginary; the
+  //    reason it has not moved is the measured one below.
+  //
+  // The move IS taken now — the #7891 programme's three slices, in order:
+  //
+  //  - #8307: the ADR-0091 seed pair crossed (`runtimeTypes: ['seed']`), with
+  //    the isolation proof that the differential cancels every finding this
+  //    function derives from the sibling collections.
+  //  - #8309: the snapshot repair. The gate used to carry `objects` and
+  //    nothing else, so the three cross-collection rules judged a universe
+  //    missing the collection they compare against (measured: 38 phantom
+  //    `security-master-detail-ungranted` per-write vs 4 whole-stack,
+  //    PR #7886). `RuntimeStackContext` now carries `permissions`/`books` in
+  //    BOTH differential passes and `TYPE_TO_STACK_KEY` maps both types.
+  //  - #8310 slice 1: `runtimeTypes` gains `permission` + `book` (PR #8546).
+  //    `object` measured DIRTY on that tree and was escalated, not forced.
+  //  - #8310 slice 2 (this state): `object` crosses under the maintainer
+  //    ruling recorded on #8310 (2026-08-13, 「接受你的全部建议」): an
+  //    authored OWD is REQUIRED at the runtime object door — an object
+  //    publish with no authored `sharingModel` is refused with the 422 lint
+  //    envelope (`security-owd-unset`); absence is not a decision. The ~16
+  //    objectql/rest suite files that relied on OWD-less publishes were
+  //    repaired honestly (fixtures author their posture), and
+  //    `meta-object-owd-gate.test.ts` re-pins the door ORDER: this table
+  //    answers first (`saveMetaItem` runs it before `runAuthoringGate`), the
+  //    ADR-0094-seam 403 doors answer for what passes lint. The same ruling
+  //    retired the plugin gate's R2 `owd_external_wider` arm as a duplicate
+  //    of this door (R1 env-tighten-only STAYS — no lint rule covers it);
+  //    see `object-posture-gate.ts` and the ADR-0094 amendment.
+  //
+  // `security-role-word` is NOT in this entry any more — that is what the
+  // `validateSecurityRoleWord` entry below records. It judges six collections
+  // (objects, fields, actions, permission sets, positions, apps — plus books),
+  // and `positions`/`apps` are neither carried by the per-write snapshot nor
+  // mapped in `TYPE_TO_STACK_KEY`, so declaring `permission`/`book` on a
+  // function that still contained it would have enforced ONE rule id for a
+  // strict subset of its collections: a door where a permission set named
+  // `role_manager` is refused and a position named `sales_role` walks through
+  // — the #7220 failure this table refuses to build, in either direction. The
+  // rule therefore stays behind WHOLE (#8310's explicit call), as its own
+  // entry.
+  //
+  // This entry remains the rest of the D7 block (12 rule ids) as ONE
+  // registration, not a per-rule split: the baseline/candidate differential is
+  // what keeps a write of one declared type from leaking the other rules'
+  // whole-stack findings — every finding derived from a sibling collection is
+  // produced byte-identically in both passes and cancels in the diff. Only
+  // findings the written item itself adds are attributed to the write.
   {
     name: "validateSecurityPosture",
     tier: "gating",
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-security-posture.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: "Already gated at this surface by a DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on `object` (`registerAuthoringGate`) that enforces the same OWD posture rules on every runtime write. Running the linter here as well would double-report one refusal in two vocabularies. Consolidating the two onto this table is P2 (#4463), and is a merge, not a hole.",
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["seed", "permission", "book", "object"],
     run: (stack) => validateSecurityPosture(stack)
   },
+  // [ADR-0090 D3 / #8310] The vocabulary freeze, split out of
+  // `validateSecurityPosture` the day the rest of that block crossed the
+  // runtime wall — so that it could stay behind WHOLE rather than cross for
+  // three of the six collections it judges (#7220: one rule id must sit on ONE
+  // side of the wall). The split is a surface boundary, not taste: the rule's
+  // verdict and findings are byte-identical to before on every CLI command
+  // (both entries run on all three), and the runtime door does not run it for
+  // ANY type.
+  //
+  // The road to crossing is concrete and short, recorded here so the next
+  // seat prices it correctly: carry `positions`/`apps` in
+  // `RuntimeStackContext` + `CONTEXT_STACK_KEYS`, map both types in
+  // `TYPE_TO_STACK_KEY` (both are `allowRuntimeCreate: true`, so the writes
+  // are real), then declare `runtimeTypes: ['object', 'permission', 'book',
+  // 'position', 'app']` on THIS entry — all six collections in one edit, the
+  // #7220 discipline satisfied.
+  {
+    name: "validateSecurityRoleWord",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-security-posture.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: "P2 (#4463)/#8310: judges six collections (objects, fields, actions, permission sets, positions, apps \u2014 plus books), and the per-write snapshot neither carries nor maps positions/apps. Wiring it for the mapped types alone would enforce one rule id for three of its six collections \u2014 the #7220 split (an object named sales_role refused while a position named sales_role walks through). It crosses whole \u2014 positions/apps carried, mapped and declared \u2014 or stays behind; it stays behind until that wiring exists.",
+    run: (stack) => validateSecurityRoleWord(stack)
+  },
   // ADR-0105 D6 — the org tree is a REPORTING dimension. An RLS policy or
   // sharing rule that walks it builds a second permission hierarchy (the
   // dual-hierarchy mistake ADR-0057 D5 retired) and cannot widen Layer 0 anyway,
@@ -10093,7 +10717,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-rls-predicate-enforceability.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: "P2 (#4463): the rule reads `stack.permissions[]`, a stack-wide collection the per-write snapshot does not carry, and P1 gates `flow` alone. It is otherwise snapshot-ready \u2014 it needs no other collection \u2014 so widening it is a `runtimeTypes: ['permission_set']` edit once the gate builds that snapshot, not new wiring. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
+    surfaceReason: "The rule reads `stack.permissions[]`, which the per-write snapshot DOES carry since #8309 \u2014 the remaining gap is only the declaration: no `runtimeTypes` names `permission` here, and that flip is a rollout decision on #8310's axis, not a wiring fix. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
     run: (stack) => validateRlsPredicateEnforceability(stack)
   },
   // #4762 — the same "declared but enforces nothing" question, for the two
@@ -10169,8 +10793,34 @@ var TYPE_TO_STACK_KEY = {
   dashboard: "dashboards",
   agent: "agents",
   hook: "hooks",
-  seed: "seeds"
+  // [#7576] `data`, NOT `seeds`. The metadata TYPE is `seed`; the stack KEY that
+  // holds seeds is `data` (`ObjectStackDefinitionSchema.data: z.array(SeedSchema)`)
+  // — a stack has no `seeds` key at all, and `PLURAL_TO_SINGULAR` declares no
+  // mapping onto one either.
+  //
+  // The wrong spelling was INERT rather than harmless, and it is the #4449 shape
+  // one surface over: the wiring guard asks only that a declared type HAS a
+  // mapping, never that the mapping names a key some rule reads. So it would
+  // have stayed green while the gate built `{ objects, seeds: [item] }` for
+  // every seed write and every rule reading `stack.data` saw nothing — wired,
+  // and running on nothing, with `rulesRun` reporting the rules as having run.
+  // Nothing declared `seed` in `runtimeTypes` at the time, so correcting it
+  // changed no behaviour then; it was corrected here, with the measurement
+  // that found it (#7576), rather than left for the rollout card to trip
+  // over. The ADR-0091 seed pair now DOES declare `seed` (#8307), so this
+  // mapping is load-bearing today, not merely inert-and-correct.
+  seed: "data",
+  // [#8309] `permission`/`book` map ahead of their registration (#8310), the
+  // same order `seed` arrived in: the mapping plus the enriched snapshot below
+  // are this card's halves, and the `runtimeTypes` flip is deliberately NOT —
+  // a mapping without a declaring rule is inert by construction (the gate
+  // filters by `runtimeTypes` before it ever consults this table), while a
+  // declaration without the mapping is the wired-onto-nothing state the wiring
+  // guard refuses. Landing the mapping first keeps #8310 a registry data edit.
+  permission: "permissions",
+  book: "books"
 };
+var CONTEXT_STACK_KEYS = ["objects", "permissions", "books"];
 function runtimeAuthoringRulesFor(type) {
   return AUTHORING_RULES.filter(
     (r) => r.surfaces.includes("runtime-publish") && (r.runtimeTypes ?? []).includes(type)
@@ -10188,6 +10838,23 @@ function stackKeyForType(type) {
   return TYPE_TO_STACK_KEY[type] ?? null;
 }
 var fingerprint = (f) => `${f.rule}\0${f.where}\0${f.path}\0${f.message}`;
+function buildRuntimeWriteSnapshots(args) {
+  const stackKey = stackKeyForType(args.type);
+  if (!stackKey) return null;
+  if (!args.item || typeof args.item !== "object") return null;
+  const item = args.item;
+  const itemName = typeof item.name === "string" ? item.name : void 0;
+  const baseline = {};
+  for (const key of CONTEXT_STACK_KEYS) {
+    const collection = args.context?.[key] ?? [];
+    baseline[key] = key === stackKey ? collection.filter((o) => !itemName || o?.name !== itemName) : collection;
+  }
+  const candidate = {
+    ...baseline,
+    [stackKey]: [...baseline[stackKey] ?? [], item]
+  };
+  return { baseline, candidate };
+}
 function runRules(rules, stack, ctx) {
   const findings = [];
   for (const rule of rules) {
@@ -10210,19 +10877,15 @@ function runRuntimeAuthoringRules(args) {
   const rules = runtimeAuthoringRulesFor(args.type);
   const empty = { errors: [], advisories: [], rulesRun: [] };
   if (rules.length === 0) return empty;
-  const stackKey = stackKeyForType(args.type);
-  if (!stackKey) return empty;
-  if (!args.item || typeof args.item !== "object") return empty;
-  const item = args.item;
-  const itemName = typeof item.name === "string" ? item.name : void 0;
-  const contextObjects = args.context?.objects ?? [];
+  const snapshots = buildRuntimeWriteSnapshots({
+    type: args.type,
+    item: args.item,
+    ...args.context !== void 0 ? { context: args.context } : {}
+  });
+  if (!snapshots) return empty;
   const ctx = { sduiManifest: args.sduiManifest };
-  const writesIntoContext = stackKey === "objects";
-  const baselineObjects = writesIntoContext ? contextObjects.filter((o) => !itemName || o?.name !== itemName) : contextObjects;
-  const baseline = { objects: baselineObjects };
-  const candidate = writesIntoContext ? { objects: [...baselineObjects, item] } : { objects: baselineObjects, [stackKey]: [item] };
-  const before = new Set(runRules(rules, baseline, ctx).map(fingerprint));
-  const added = runRules(rules, candidate, ctx).filter((f) => !before.has(fingerprint(f)));
+  const before = new Set(runRules(rules, snapshots.baseline, ctx).map(fingerprint));
+  const added = runRules(rules, snapshots.candidate, ctx).filter((f) => !before.has(fingerprint(f)));
   return {
     errors: added.filter((f) => f.severity === "error"),
     advisories: added.filter((f) => f.severity !== "error"),
@@ -10271,6 +10934,7 @@ export {
   DASHBOARD_ACTION_ROUTE_UNRESOLVED,
   DASHBOARD_ACTION_TARGET_UNDEFINED,
   DASHBOARD_FILTER_FIELD_UNKNOWN,
+  DASHBOARD_FILTER_FIELD_UNPROVISIONED,
   DEFAULT_AGENT_OUTSIDE_ROSTER,
   EXPRESSION_INVALID,
   FIELD_GROUP_EMPTY,
@@ -10297,6 +10961,7 @@ export {
   FLOW_NODE_WRITE_UNKNOWN_FIELD,
   FLOW_PHANTOM_AGGREGATION,
   FLOW_RUNAS_UNSCOPED,
+  FLOW_TEMPLATE_FIELD_UNPROVISIONED,
   FLOW_TEMPLATE_LOOKUP_TRAVERSAL,
   FLOW_TEMPLATE_UNKNOWN_FIELD,
   FLOW_TIME_RELATIVE_ANTIPATTERN,
@@ -10318,9 +10983,11 @@ export {
   LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   LIVENESS_DEAD_PROPERTY,
   LIVENESS_EXPERIMENTAL_PROPERTY,
+  MANAGED_API_METHOD_UNAFFORDABLE,
   MAX_SCHEMA_WALK_DEPTH,
   MEASURE_AGGREGATE_INCOHERENT,
   NAV_OBJECT_UNGRANTED,
+  NAV_OBJECT_UNSERVABLE,
   NAV_TARGET_UNRESOLVED,
   NULL_GUARD_HINT,
   OBJECT_REFERENCE_UNKNOWN,
@@ -10329,15 +10996,18 @@ export {
   ORG_AXIS_CROSS_ORG_BU_GRANT,
   ORG_AXIS_PERMISSION_INHERITANCE,
   PAGE_FIELD_UNKNOWN,
+  PAGE_FIELD_UNPROVISIONED,
   PAGE_SOURCE_CLASSNAME,
   PREDICATE_PATH_UNRESOLVED,
   PREDICATE_PATH_UNROOTED,
+  PREDICATE_RHS_PATH_SHAPED,
   PRE_SEAL_PHASES,
   REACT_BLOCK_NEEDS_RECORD_CONTEXT,
   REACT_CHART_AGGREGATE_INVALID,
   REACT_CHART_AXIS_UNKNOWN,
   REACT_CHART_DRILLDOWN_INVALID,
   REACT_CHART_FIELD_UNKNOWN,
+  REACT_CHART_FIELD_UNPROVISIONED,
   REFERENCE_INTEGRITY_RULES,
   RLS_PREDICATE_OVER_BUDGET,
   RLS_PREDICATE_UNENFORCEABLE,
@@ -10348,6 +11018,7 @@ export {
   SEARCHABLE_FIELD_UNSEARCHABLE,
   SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
+  SECURITY_CBP_NO_RELATION,
   SECURITY_DELEGATION_MISSING_REASON,
   SECURITY_EXTERNAL_WIDER,
   SECURITY_FLS_UNQUALIFIED_KEY,
@@ -10361,6 +11032,7 @@ export {
   SEED_INSERT_MODE_DUPLICATES_ON_REPLAY,
   SEED_VALUE_OUTSIDE_STATE_MACHINE,
   SEMANTIC_ROLE_FIELD_UNKNOWN,
+  SEMANTIC_ROLE_FIELD_UNPROVISIONED,
   SHARING_RULE_RUNTIME_VARIABLE_CONDITION,
   SHARING_RULE_UNLOWERABLE_CONDITION,
   STARTUP_OPEN_VOCABULARY_VERDICT,
@@ -10398,6 +11070,7 @@ export {
   WIDGET_MEASURE_UNKNOWN,
   authoringRulesFor,
   buildAccessMatrix,
+  buildRuntimeWriteSnapshots,
   diffAccessMatrix,
   extractHookBodyWriteSet,
   extractHookBodyWrites,
@@ -10441,7 +11114,9 @@ export {
   validateHookBodyWrites,
   validateJsxPages,
   validateListViewMode,
+  validateManagedApiMethods,
   validateNavAccess,
+  validateNavObjectServability,
   validateNavTargetRefs,
   validateObjectReferences,
   validateOrgAxisRedLines,
@@ -10459,6 +11134,7 @@ export {
   validateRuleSchemaFormats,
   validateSearchableFields,
   validateSecurityPosture,
+  validateSecurityRoleWord,
   validateSeedReplaySafety,
   validateSeedStateMachine,
   validateSemanticRoles,