@objectstack/lint 17.0.0-rc.6 → 17.0.0

package/dist/runtime.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/runtime.ts
 var runtime_exports = {};
 __export(runtime_exports, {
+  buildRuntimeWriteSnapshots: () => buildRuntimeWriteSnapshots,
   runRuntimeAuthoringRules: () => runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor: () => runtimeAuthoringRulesFor,
   runtimeGatedTypes: () => runtimeGatedTypes,
@@ -41,6 +42,34 @@ var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
 function injectedColumnsFor(objectDef) {
   return (0, import_data.resolveInjectedSystemColumns)(objectDef).names;
 }
+function unprovisionedInjectedColumnsFor(objectDef) {
+  return new Set((0, import_data.unprovisionedInjectedColumns)(objectDef));
+}
+function objectDefsOf(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const objects = stack.objects;
+  if (Array.isArray(objects)) return objects.filter((o) => !!o && typeof o === "object");
+  if (objects && typeof objects === "object") {
+    return Object.entries(objects).filter(([, def]) => !!def && typeof def === "object").map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function indexUnprovisionedAnchors(stack) {
+  const index = /* @__PURE__ */ new Map();
+  for (const obj of objectDefsOf(stack)) {
+    const name = typeof obj.name === "string" && obj.name.length > 0 ? obj.name : void 0;
+    if (!name) continue;
+    const anchors = unprovisionedInjectedColumnsFor(obj);
+    if (anchors.size > 0) index.set(name, anchors);
+  }
+  return index;
+}
+function unprovisionedAnchorCause(objectName, field) {
+  return `'${field}' is an injected system column with NO storage behind it: '${objectName}' is an external object (ADR-0015), so the remote database owns its schema and the platform registers this anchor without provisioning a column`;
+}
+function unprovisionedAnchorHint(objectName, field) {
+  return `If the remote table really carries '${field}', declare it in ${objectName}'s own fields (mapped through the external binding's columnMap) so the reference resolves to a column you vouch for; otherwise drop the reference, or opt the object out of the injection (\`ownership: 'none'\` for the ownership anchors, \`systemFields: { audit: false }\` for the audit family).`;
+}
 
 // src/validate-null-guards.ts
 var import_formula = require("@objectstack/formula");
@@ -274,6 +303,37 @@ function buildFieldIndex(objects) {
   }
   return idx;
 }
+var BOUND_RECORD_ROOTS = ["record", "previous"];
+function isCelNode(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+function collectBoundRecordReads(source) {
+  const out = /* @__PURE__ */ new Map();
+  const ast = (0, import_formula2.parseCelToAst)(source);
+  if (!ast) return out;
+  const pending = [ast];
+  while (pending.length > 0) {
+    const celNode = pending.pop();
+    if (!isCelNode(celNode)) continue;
+    if ((celNode.op === "." || celNode.op === ".?") && Array.isArray(celNode.args) && celNode.args.length >= 2) {
+      const [celRecv, seg] = celNode.args;
+      if (typeof seg === "string" && isCelNode(celRecv) && celRecv.op === "id" && typeof celRecv.args === "string" && BOUND_RECORD_ROOTS.includes(celRecv.args)) {
+        if (!out.has(seg)) out.set(seg, `${celRecv.args}.${seg}`);
+      }
+    }
+    const celArgs = celNode.args;
+    if (isCelNode(celArgs)) pending.push(celArgs);
+    else if (Array.isArray(celArgs)) {
+      for (const a of celArgs) {
+        if (isCelNode(a)) pending.push(a);
+        else if (Array.isArray(a)) {
+          for (const b of a) if (isCelNode(b)) pending.push(b);
+        }
+      }
+    }
+  }
+  return out;
+}
 function buildFieldTypeIndex(objects) {
   const idx = /* @__PURE__ */ new Map();
   for (const obj of objects) {
@@ -373,6 +433,29 @@ function validateStackExpressions(stack) {
   const fieldIndex = buildFieldIndex(objects);
   const fieldTypeIndex = buildFieldTypeIndex(objects);
   const nullableIndex = buildNullableFieldIndex(objects);
+  const unprovisionedIndex = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const anchors = unprovisionedInjectedColumnsFor(obj);
+    if (anchors.size > 0) unprovisionedIndex.set(name, anchors);
+  }
+  const warnUnprovisionedAnchors = (where, raw, objectName) => {
+    if (!objectName) return;
+    const anchors = unprovisionedIndex.get(objectName);
+    if (!anchors) return;
+    const source = celSourceOf(raw);
+    if (!source) return;
+    for (const [field, operand] of collectBoundRecordReads(source)) {
+      if (!anchors.has(field)) continue;
+      issues.push({
+        where,
+        message: `\`${operand}\` reads '${field}', an injected system column with NO storage behind it: '${objectName}' is an external object (ADR-0015), so the remote database owns its schema and the platform registers this anchor without provisioning a column. The predicate can never match a real value \u2014 on SQLite it silently degrades to constant-false (HTTP 200, zero rows, no error). If the remote table really carries this column, declare '${field}' in the object's own fields (mapped through the external binding's columnMap) so the reference resolves to a column you vouch for; otherwise drop the reference, or opt the object out of the injection (\`ownership: 'none'\` for the ownership anchors, \`systemFields: { audit: false }\` for the audit family).`,
+        source,
+        severity: "warning"
+      });
+    }
+  };
   const checkNullGuards = (where, subject, raw, objectName, outcome = "fail-closed") => {
     if (!objectName) return;
     const nullableFields = nullableIndex.get(objectName);
@@ -399,6 +482,7 @@ function validateStackExpressions(stack) {
     );
     for (const e of res.errors) issues.push({ where, message: e.message, source: e.source, severity: "error" });
     for (const w of res.warnings) issues.push({ where, message: w.message, source: w.source, severity: "warning" });
+    warnUnprovisionedAnchors(where, raw, objectName);
   };
   const FIELD_RULE_BOUND_ROOTS = ["record", "previous", "parent"];
   const FIELD_RULE_USER_ROOTS = ["current_user", "user", "ctx", "os"];
@@ -545,6 +629,7 @@ function validateStackExpressions(stack) {
         const fieldWhere = `object '${objectName}' \xB7 field '${fname}' expression`;
         for (const e of res.errors) issues.push({ where: fieldWhere, message: e.message, source: e.source, severity: "error" });
         for (const w of res.warnings) issues.push({ where: fieldWhere, message: w.message, source: w.source, severity: "warning" });
+        warnUnprovisionedAnchors(fieldWhere, f.expression, objectName);
       }
     }
   }
@@ -750,6 +835,43 @@ function validateFunctionalCompleteness(stack) {
   return out;
 }
 
+// src/validate-managed-api-methods.ts
+var import_data2 = require("@objectstack/spec/data");
+var MANAGED_API_METHOD_UNAFFORDABLE = "object/managed-api-method-unaffordable";
+var isRec2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function entriesOf2(v) {
+  if (Array.isArray(v)) {
+    return v.flatMap(
+      (def, i) => isRec2(def) ? [{ name: String(def.name ?? i), def, key: `[${i}]` }] : []
+    );
+  }
+  if (isRec2(v)) {
+    return Object.entries(v).flatMap(
+      ([name, def]) => isRec2(def) ? [{ name, def: { name, ...def }, key: `.${name}` }] : []
+    );
+  }
+  return [];
+}
+function validateManagedApiMethods(stack) {
+  const out = [];
+  if (!isRec2(stack)) return out;
+  for (const [oi, obj] of entriesOf2(stack.objects).entries()) {
+    const conflicts = (0, import_data2.checkManagedApiMethodAffordances)(obj.def);
+    if (conflicts.length === 0) continue;
+    const verbs = conflicts.map((c) => c.verb).join(", ");
+    const flags = [...new Set(conflicts.map((c) => c.needs))];
+    out.push({
+      severity: "error",
+      rule: MANAGED_API_METHOD_UNAFFORDABLE,
+      where: `object "${obj.name}"`,
+      path: `objects[${oi}].enable.apiMethods`,
+      message: `\`managedBy: '${String(obj.def.managedBy)}'\` object "${obj.name}" ` + (0, import_data2.describeManagedApiMethodConflicts)(conflicts) + ` The registry STRIPS [${verbs}] at registration, so this declaration and the API you actually get already disagree \u2014 today the only trace is a line in the boot log.`,
+      hint: `Either add \`userActions: { ${flags.map((f) => `${f}: true`).join(", ")} }\` to the object \u2014 only if the write is genuinely one a user context may perform, and only once the guard enforcing it exists (ADR-0092 D4: affordance never ships ahead of the guard) \u2014 or remove [${verbs}] from \`enable.apiMethods\`, which is what the runtime does for you today.`
+    });
+  }
+  return out;
+}
+
 // src/validate-view-containers.ts
 var VIEW_CONTAINER_SHAPE = "view-container-shape";
 var CONTAINER_SLOT_KEYS = ["list", "form", "listViews", "formViews"];
@@ -767,10 +889,32 @@ function containerViewCount(rec) {
 function validateViewContainers(stack) {
   const out = [];
   if (!stack || typeof stack !== "object") return out;
+  const viewItems = stack.viewItems;
+  if (viewItems != null && asEntries(viewItems).length > 0) {
+    out.push({
+      severity: "error",
+      rule: VIEW_CONTAINER_SHAPE,
+      where: "viewItems",
+      path: "viewItems",
+      message: "`viewItems` is the machine-assembled channel for non-container view artifacts in runtime-assembled manifests (package export, environment artifacts) \u2014 it is not an authoring surface.",
+      hint: "Author views as defineView containers in `views:`; author a standalone view through the metadata door (Studio / `PUT /api/v1/meta/view`), not in stack source."
+    });
+  }
   for (const { key, value } of asEntries(stack.views)) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
     const rec = value;
-    if (rec.viewKind != null) continue;
+    if (rec.viewKind != null) {
+      const label3 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
+      out.push({
+        severity: "error",
+        rule: VIEW_CONTAINER_SHAPE,
+        where: `views${key}${label3}`,
+        path: `views${key}`,
+        message: "A ViewItem record is not a view container: the stack `views:` collection carries containers only \u2014 `viewKind` belongs to a single VIEW, not to the container. The registration loop refuses this entry (#5320).",
+        hint: "Wrap it in a defineView container: defineView({ list: { type, data, columns, ... }, listViews: { ... } }) \u2014 or author the standalone view through the metadata door (Studio / `PUT /api/v1/meta/view`). Machine-assembled manifests carry it under `viewItems:`."
+      });
+      continue;
+    }
     if (containerViewCount(rec) > 0) continue;
     const label2 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
     const hasContainerSlot = CONTAINER_SLOT_KEYS.some((k) => k in rec);
@@ -788,7 +932,7 @@ function validateViewContainers(stack) {
 }
 
 // src/validate-widget-bindings.ts
-var import_data2 = require("@objectstack/spec/data");
+var import_data3 = require("@objectstack/spec/data");
 var import_ui = require("@objectstack/spec/ui");
 var WIDGET_DATASET_UNKNOWN = "widget-dataset-unknown";
 var WIDGET_DIMENSION_UNKNOWN = "widget-dimension-unknown";
@@ -800,6 +944,7 @@ var MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 var WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 var WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 var DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
+var DASHBOARD_FILTER_FIELD_UNPROVISIONED = "dashboard-filter-field-unprovisioned";
 var LEGACY_ANALYTICS_KEYS = [
   "categoryField",
   "valueField",
@@ -919,6 +1064,7 @@ function validateWidgetBindings(stack) {
     }
     objectFieldTypes.set(o.name, fm);
   }
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const datasetList = asArray3(stack.datasets);
   for (let i = 0; i < datasetList.length; i++) {
     const ds = datasetList[i];
@@ -931,7 +1077,7 @@ function validateWidgetBindings(stack) {
       const aggregate = typeof m.aggregate === "string" ? m.aggregate : void 0;
       if (!field || !aggregate) continue;
       const ftype = fieldTypes.get(field);
-      if (ftype && (0, import_data2.isIncoherentAggregate)(aggregate, ftype)) {
+      if (ftype && (0, import_data3.isIncoherentAggregate)(aggregate, ftype)) {
         findings.push({
           severity: "warning",
           rule: MEASURE_AGGREGATE_INCOHERENT,
@@ -1005,13 +1151,24 @@ function validateWidgetBindings(stack) {
       if (dashFilterDefs.length > 0) {
         const datasetObject = typeof dataset.object === "string" ? dataset.object : void 0;
         const objectFields = datasetObject ? objectFieldTypes.get(datasetObject) : void 0;
-        if (objectFields) {
+        const anchors = datasetObject ? unprovisionedAnchors.get(datasetObject) : void 0;
+        if (objectFields && datasetObject) {
           for (const def of dashFilterDefs) {
             const eff = effectiveFilterField(w, def);
             if (!eff) continue;
             const field = eff.field;
             if (field.includes(".")) continue;
-            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) continue;
+            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) {
+              if (anchors?.has(field)) {
+                push2({
+                  severity: "warning",
+                  rule: DASHBOARD_FILTER_FIELD_UNPROVISIONED,
+                  message: (eff.explicit ? `binds dashboard filter \`${def.name}\` to field \`${field}\` (via filterBindings), but ` : `inherits dashboard filter \`${def.name}(${field})\`, but `) + `${unprovisionedAnchorCause(datasetObject, field)}. The filter is ANDed into this widget's analytics query (#2501), so it can never match a real value \u2014 on SQLite it silently degrades to constant-false and the widget renders empty (HTTP 200, zero rows, no error).`,
+                  hint: `${unprovisionedAnchorHint(datasetObject, field)} A widget can also opt out with filterBindings: { ${def.name}: false }. Suppress with suppressWarnings: ['${DASHBOARD_FILTER_FIELD_UNPROVISIONED}'] if the remote schema resolves it some other way.`
+                });
+              }
+              continue;
+            }
             push2({
               severity: "error",
               rule: DASHBOARD_FILTER_FIELD_UNKNOWN,
@@ -1248,7 +1405,7 @@ function validateDashboardActionRefs(stack) {
 }
 
 // src/validate-filter-tokens.ts
-var import_data3 = require("@objectstack/spec/data");
+var import_data4 = require("@objectstack/spec/data");
 
 // src/filter-walk.ts
 var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
@@ -1308,7 +1465,7 @@ function walkAuthoredFilters(stack, surfaces, visit) {
 
 // src/validate-filter-tokens.ts
 var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
-var KNOWN_LIST = import_data3.CONTEXT_TOKENS.join("}, {");
+var KNOWN_LIST = import_data4.CONTEXT_TOKENS.join("}, {");
 var TOKEN_FILTER_SURFACES = [
   { key: "dashboards", kind: "dashboard" },
   { key: "objects", kind: "object" },
@@ -1321,7 +1478,7 @@ var TOKEN_FILTER_SURFACES = [
 function walkFilterValues(node, path, where, out, seen) {
   if (node === null || node === void 0) return;
   if (typeof node === "string") {
-    const cls = (0, import_data3.classifyFilterToken)(node);
+    const cls = (0, import_data4.classifyFilterToken)(node);
     if (cls?.kind === "unknown") {
       const suggestion = cls.suggestion;
       out.push({
@@ -1356,7 +1513,7 @@ function validateFilterTokens(stack) {
 }
 
 // src/validate-empty-combinators.ts
-var import_data4 = require("@objectstack/spec/data");
+var import_data5 = require("@objectstack/spec/data");
 var FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
 var FILTER_EMPTY_NODE = "filter-empty-node";
 var EMPTY_COMBINATOR_SURFACES = [
@@ -1375,12 +1532,12 @@ function isFilterNode(value) {
   return proto === Object.prototype || proto === null;
 }
 var VERDICT_OF = {
-  $and: (0, import_data4.reduceFilterVerdict)({ $and: [] }),
-  $or: (0, import_data4.reduceFilterVerdict)({ $or: [] }),
-  $not: (0, import_data4.reduceFilterVerdict)({ $not: {} }),
-  node: (0, import_data4.reduceFilterVerdict)({}),
+  $and: (0, import_data5.reduceFilterVerdict)({ $and: [] }),
+  $or: (0, import_data5.reduceFilterVerdict)({ $or: [] }),
+  $not: (0, import_data5.reduceFilterVerdict)({ $not: {} }),
+  node: (0, import_data5.reduceFilterVerdict)({}),
   /** One TRUE disjunct absorbs its `$or`: the sibling branches stop mattering. */
-  orWithEmptyBranch: (0, import_data4.reduceFilterVerdict)({ $or: [{ status: "open" }, {}] })
+  orWithEmptyBranch: (0, import_data5.reduceFilterVerdict)({ $or: [{ status: "open" }, {}] })
 };
 function rows(verdict) {
   if (verdict === "true") return "matches EVERY row";
@@ -1665,7 +1822,7 @@ function validateObjectReferences(stack) {
 }
 
 // src/validate-searchable-fields.ts
-var import_data5 = require("@objectstack/spec/data");
+var import_data6 = require("@objectstack/spec/data");
 var SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
 var SEARCHABLE_FIELD_UNSEARCHABLE = "searchable-field-unsearchable";
 function asArray7(v) {
@@ -1675,7 +1832,7 @@ function asArray7(v) {
   }
   return [];
 }
-function isRec2(v) {
+function isRec3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName3(v) {
@@ -1713,7 +1870,7 @@ function resolveAllowedSet(target) {
     fields = { ...fields };
     for (const f of systemDeclared) fields[f] = {};
   }
-  const { allowed, source } = (0, import_data5.resolveSearchFieldResolution)({
+  const { allowed, source } = (0, import_data6.resolveSearchFieldResolution)({
     fields,
     searchableFields: target.searchableFields,
     displayField: target.displayField
@@ -1751,7 +1908,7 @@ function distance2(a, b) {
 }
 function indexObjectSearchTargets(stack) {
   const fieldsByObject = /* @__PURE__ */ new Map();
-  if (!isRec2(stack)) return fieldsByObject;
+  if (!isRec3(stack)) return fieldsByObject;
   for (const obj of asArray7(stack.objects)) {
     const name = strName3(obj.name);
     if (name) fieldsByObject.set(name, declaredFieldTarget(obj));
@@ -1783,7 +1940,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       });
       continue;
     }
-    if ((0, import_data5.isVirtualSearchField)(target.fields[name])) {
+    if ((0, import_data6.isVirtualSearchField)(target.fields[name])) {
       const vtype = target.fields[name]?.type;
       findings.push({
         severity: "error",
@@ -1811,7 +1968,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
     }
     const isReference = meta?.type === "lookup" || meta?.type === "master_detail";
     let why;
-    if (import_data5.SEARCH_AUTO_EXCLUDED_FIELDS.has(name)) {
+    if (import_data6.SEARCH_AUTO_EXCLUDED_FIELDS.has(name)) {
       why = "a system/audit column, which the auto-default set never includes";
     } else if (meta?.hidden) {
       why = "hidden";
@@ -1825,7 +1982,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       rule: SEARCHABLE_FIELD_UNSEARCHABLE,
       where,
       path: `${path}[${i}]`,
-      message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...import_data5.SEARCHABLE_TEXTUAL_TYPES, ...import_data5.SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
+      message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...import_data6.SEARCHABLE_TEXTUAL_TYPES, ...import_data6.SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
       hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a stored text field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
     });
   }
@@ -1833,7 +1990,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
 }
 function validateSearchableFields(stack) {
   const findings = [];
-  if (!isRec2(stack)) return findings;
+  if (!isRec3(stack)) return findings;
   const objects = asArray7(stack.objects);
   const fieldsByObject = indexObjectSearchTargets(stack);
   const check = (declared, objectName, where, path, subject, role) => {
@@ -1843,7 +2000,7 @@ function validateSearchableFields(stack) {
   };
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec2(obj)) continue;
+    if (!isRec3(obj)) continue;
     const objName = strName3(obj.name);
     const label2 = objName ? `object "${objName}"` : `objects[${oi}]`;
     check(
@@ -1854,9 +2011,9 @@ function validateSearchableFields(stack) {
       "searchableFields",
       "canonical"
     );
-    if (isRec2(obj.listViews)) {
+    if (isRec3(obj.listViews)) {
       for (const [key, lv] of Object.entries(obj.listViews)) {
-        if (!isRec2(lv)) continue;
+        if (!isRec3(lv)) continue;
         check(
           lv.searchableFields,
           // A built-in list view belongs to its object; an inline `data.object`
@@ -1873,10 +2030,10 @@ function validateSearchableFields(stack) {
   const views = asArray7(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec2(view)) continue;
+    if (!isRec3(view)) continue;
     const viewLabel2 = strName3(view.name) ?? strName3(view.objectName) ?? `#${vi}`;
     const viewObject = strName3(view.objectName) ?? strName3(view.object);
-    if (isRec2(view.list)) {
+    if (isRec3(view.list)) {
       check(
         view.list.searchableFields,
         listViewObject(view.list) ?? viewObject,
@@ -1886,9 +2043,9 @@ function validateSearchableFields(stack) {
         "narrowing"
       );
     }
-    if (isRec2(view.listViews)) {
+    if (isRec3(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
-        if (!isRec2(lv)) continue;
+        if (!isRec3(lv)) continue;
         check(
           lv.searchableFields,
           listViewObject(lv) ?? viewObject,
@@ -1904,11 +2061,11 @@ function validateSearchableFields(stack) {
 }
 function listViewObject(listView) {
   const data = listView.data;
-  return isRec2(data) ? strName3(data.object) : void 0;
+  return isRec3(data) ? strName3(data.object) : void 0;
 }
 
 // src/page-walk.ts
-function isRec3(v) {
+function isRec4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName4(v) {
@@ -1921,19 +2078,19 @@ function isSourceAuthoredPage(page) {
 }
 function walkPageComponents(page, pagePath) {
   const out = [];
-  if (!isRec3(page) || isSourceAuthoredPage(page)) return out;
+  if (!isRec4(page) || isSourceAuthoredPage(page)) return out;
   const pageObject = strName4(page.object);
   const visit = (node, path, inheritedObject) => {
-    if (!isRec3(node)) return;
-    const props = isRec3(node.properties) ? node.properties : void 0;
-    const dataSource = isRec3(node.dataSource) ? node.dataSource : void 0;
+    if (!isRec4(node)) return;
+    const props = isRec4(node.properties) ? node.properties : void 0;
+    const dataSource = isRec4(node.dataSource) ? node.dataSource : void 0;
     const objectName = strName4(dataSource?.object) ?? strName4(props?.object) ?? inheritedObject;
     out.push({ component: node, path, objectName });
     if (!props) return;
     if (Array.isArray(props.items)) {
       for (let i = 0; i < props.items.length; i++) {
         const item = props.items[i];
-        if (!isRec3(item) || !Array.isArray(item.children)) continue;
+        if (!isRec4(item) || !Array.isArray(item.children)) continue;
         for (let c = 0; c < item.children.length; c++) {
           visit(item.children[c], `${path}.properties.items[${i}].children[${c}]`, objectName);
         }
@@ -1955,12 +2112,12 @@ function walkPageComponents(page, pagePath) {
   const regions = Array.isArray(page.regions) ? page.regions : [];
   for (let r = 0; r < regions.length; r++) {
     const region = regions[r];
-    if (!isRec3(region) || !Array.isArray(region.components)) continue;
+    if (!isRec4(region) || !Array.isArray(region.components)) continue;
     for (let c = 0; c < region.components.length; c++) {
       visit(region.components[c], `${pagePath}.regions[${r}].components[${c}]`, pageObject);
     }
   }
-  const slots = isRec3(page.slots) ? page.slots : void 0;
+  const slots = isRec4(page.slots) ? page.slots : void 0;
   if (slots) {
     for (const [slot, value] of Object.entries(slots)) {
       const list3 = Array.isArray(value) ? value : [value];
@@ -2168,6 +2325,7 @@ function validateActionNameRefs(stack) {
 
 // src/validate-page-field-bindings.ts
 var PAGE_FIELD_UNKNOWN = "page-field-unknown";
+var PAGE_FIELD_UNPROVISIONED = "page-field-unprovisioned";
 function asArray9(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -2178,7 +2336,7 @@ function asArray9(v) {
 function strName6(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function isRec4(v) {
+function isRec5(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function fieldRefsFrom(value, basePath) {
@@ -2189,7 +2347,7 @@ function fieldRefsFrom(value, basePath) {
       out.push({ name: bare, path });
       return;
     }
-    if (!isRec4(v)) return;
+    if (!isRec5(v)) return;
     const named = strName6(v.field) ?? strName6(v.name);
     if (named) out.push({ name: named, path: `${path}.${strName6(v.field) ? "field" : "name"}` });
   };
@@ -2247,15 +2405,15 @@ function componentFieldRefs(type, props, basePath, sep = ".") {
     const sections = Array.isArray(props[key]) ? props[key] : [];
     for (let si = 0; si < sections.length; si++) {
       const section = sections[si];
-      if (!isRec4(section)) continue;
+      if (!isRec5(section)) continue;
       refs.push(...fieldRefsFrom(section.fields, `${basePath}${sep}${key}[${si}].fields`));
     }
   }
   return refs;
 }
 function relatedListFieldRefs(props, basePath, sep = ".") {
-  const add = isRec4(props.add) ? props.add : void 0;
-  const picker = add && isRec4(add.picker) ? add.picker : void 0;
+  const add = isRec5(props.add) ? props.add : void 0;
+  const picker = add && isRec5(add.picker) ? add.picker : void 0;
   const at = (key) => `${basePath}${sep}${key}`;
   return {
     relatedObject: strName6(props.objectName),
@@ -2276,7 +2434,7 @@ function relatedListFieldRefs(props, basePath, sep = ".") {
 }
 function indexObjectFields(stack) {
   const objectFields = /* @__PURE__ */ new Map();
-  if (!isRec4(stack)) return objectFields;
+  if (!isRec5(stack)) return objectFields;
   for (const obj of asArray9(stack.objects)) {
     const name = strName6(obj.name);
     if (!name) continue;
@@ -2289,14 +2447,27 @@ function indexObjectFields(stack) {
   }
   return objectFields;
 }
-function checkFieldRefs(refs, objectName, objectFields, where, consequence2 = "skipped") {
+function checkFieldRefs(refs, objectName, objectFields, where, consequence2 = "skipped", unprovisionedAnchors) {
   const findings = [];
   if (!objectName) return findings;
   const known = objectFields.get(objectName);
   if (!known) return findings;
+  const anchors = unprovisionedAnchors?.get(objectName);
   for (const ref of refs) {
     if (ref.name.includes(".")) continue;
-    if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) continue;
+    if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) {
+      if (anchors?.has(ref.name)) {
+        findings.push({
+          severity: "warning",
+          rule: PAGE_FIELD_UNPROVISIONED,
+          where,
+          path: ref.path,
+          message: `field "${ref.name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, ref.name)}` + (consequence2 === "queried" ? ' \u2014 it is used in a QUERY, so the predicate can never match a real value: on SQLite it silently degrades to constant-false and the surface renders an empty result that looks exactly like "there is no data".' : " \u2014 the component renders it, blank, on every record."),
+          hint: unprovisionedAnchorHint(objectName, ref.name)
+        });
+      }
+      continue;
+    }
     findings.push({
       severity: consequence2 === "queried" ? "error" : "warning",
       rule: PAGE_FIELD_UNKNOWN,
@@ -2312,17 +2483,20 @@ function validatePageFieldBindings(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const objectFields = indexObjectFields(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const pages = asArray9(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
     const pageName = strName6(page.name) ?? `#${pi}`;
     const checkRefs = (refs, objectName, where) => {
-      findings.push(...checkFieldRefs(refs, objectName, objectFields, where));
+      findings.push(
+        ...checkFieldRefs(refs, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+      );
     };
     for (const { component, path, objectName } of walkPageComponents(page, `pages[${pi}]`)) {
       const type = strName6(component.type);
-      const props = isRec4(component.properties) ? component.properties : void 0;
+      const props = isRec5(component.properties) ? component.properties : void 0;
       if (!type || !props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -2337,7 +2511,7 @@ function validatePageFieldBindings(stack) {
       if (!refs) continue;
       checkRefs(refs, objectName, where);
     }
-    const cfg = isRec4(page.interfaceConfig) ? page.interfaceConfig : void 0;
+    const cfg = isRec5(page.interfaceConfig) ? page.interfaceConfig : void 0;
     if (cfg) {
       const cfgObject = strName6(cfg.source) ?? strName6(page.object);
       const base = `pages[${pi}].interfaceConfig`;
@@ -2346,7 +2520,7 @@ function validatePageFieldBindings(stack) {
         ...sortFieldRefs(cfg.sort, `${base}.sort`),
         ...fieldRefsFrom(cfg.filterBy, `${base}.filterBy`)
       ];
-      const userFilters = isRec4(cfg.userFilters) ? cfg.userFilters : void 0;
+      const userFilters = isRec5(cfg.userFilters) ? cfg.userFilters : void 0;
       if (userFilters) {
         refs.push(...fieldRefsFrom(userFilters.fields, `${base}.userFilters.fields`));
       }
@@ -2374,7 +2548,7 @@ function strName7(v) {
 function strList2(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function isRec5(v) {
+function isRec6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function distance4(a, b) {
@@ -2503,10 +2677,10 @@ function validateChartBindings(stack) {
   const reports = asArray10(stack.reports);
   for (let ri = 0; ri < reports.length; ri++) {
     const report = reports[ri];
-    if (!isRec5(report)) continue;
+    if (!isRec6(report)) continue;
     const reportName = strName7(report.name) ?? `#${ri}`;
     const checkReportChart = (chart, dataset, values, where, path) => {
-      if (!isRec5(chart)) return;
+      if (!isRec6(chart)) return;
       check({
         dataset,
         // `values` is the report's measure SELECTION, not a chart ref; feeding
@@ -2530,7 +2704,7 @@ function validateChartBindings(stack) {
     const blocks = Array.isArray(report.blocks) ? report.blocks : [];
     for (let bi = 0; bi < blocks.length; bi++) {
       const block = blocks[bi];
-      if (!isRec5(block)) continue;
+      if (!isRec6(block)) continue;
       checkReportChart(
         block.chart,
         strName7(block.dataset),
@@ -2541,9 +2715,9 @@ function validateChartBindings(stack) {
     }
   }
   const checkListChart = (container, where, path) => {
-    if (!isRec5(container)) return;
+    if (!isRec6(container)) return;
     const chart = container.chart;
-    if (!isRec5(chart)) return;
+    if (!isRec6(chart)) return;
     check({
       dataset: strName7(chart.dataset),
       dimensions: { names: strList2(chart.dimensions), path: `${path}.chart.dimensions` },
@@ -2555,10 +2729,10 @@ function validateChartBindings(stack) {
   const views = asArray10(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec5(view)) continue;
+    if (!isRec6(view)) continue;
     const viewName = strName7(view.name) ?? strName7(view.objectName) ?? `#${vi}`;
     checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
-    if (isRec5(view.listViews)) {
+    if (isRec6(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
         checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
       }
@@ -2567,7 +2741,7 @@ function validateChartBindings(stack) {
   const objects = asArray10(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec5(obj) || !isRec5(obj.listViews)) continue;
+    if (!isRec6(obj) || !isRec6(obj.listViews)) continue;
     const objName = strName7(obj.name) ?? `#${oi}`;
     for (const [key, lv] of Object.entries(obj.listViews)) {
       checkListChart(
@@ -2580,10 +2754,10 @@ function validateChartBindings(stack) {
   const pages = asArray10(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec5(page)) continue;
+    if (!isRec6(page)) continue;
     const pageName = strName7(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const props = isRec5(component.properties) ? component.properties : void 0;
+      const props = isRec6(component.properties) ? component.properties : void 0;
       if (!props || !strName7(props.dataset)) continue;
       const axisRefs = asArray10(props.yAxis).map((a, ai) => ({ name: strName7(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
       const seriesRefs = asArray10(props.series).map((s, si) => ({ name: strName7(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
@@ -2733,10 +2907,10 @@ function validateNavAccess(stack) {
 
 // src/validate-nav-target-refs.ts
 var NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
-var isRec6 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec7 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray13(v) {
-  if (Array.isArray(v)) return v.filter(isRec6);
-  if (isRec6(v)) return Object.entries(v).map(([name, def]) => isRec6(def) ? { name, ...def } : { name });
+  if (Array.isArray(v)) return v.filter(isRec7);
+  if (isRec7(v)) return Object.entries(v).map(([name, def]) => isRec7(def) ? { name, ...def } : { name });
   return [];
 }
 function strName9(v) {
@@ -2758,7 +2932,7 @@ function namesOf(collection) {
 }
 function validateNavTargetRefs(stack) {
   const findings = [];
-  if (!isRec6(stack)) return findings;
+  if (!isRec7(stack)) return findings;
   const apps = asArray13(stack.apps);
   if (apps.length === 0) return findings;
   const declared = /* @__PURE__ */ new Map();
@@ -2770,7 +2944,7 @@ function validateNavTargetRefs(stack) {
     const walk = (items, basePath) => {
       if (!Array.isArray(items)) return;
       for (const [ni, raw] of items.entries()) {
-        if (!isRec6(raw)) continue;
+        if (!isRec7(raw)) continue;
         const nav = raw;
         const navPath = `${basePath}[${ni}]`;
         for (const [type, prop, collection, noun] of NAV_TARGETS) {
@@ -2801,32 +2975,100 @@ function validateNavTargetRefs(stack) {
   return findings;
 }
 
+// src/validate-nav-object-servability.ts
+var import_data7 = require("@objectstack/spec/data");
+var NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
+var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray14(v) {
+  if (Array.isArray(v)) return v.filter(isRec8);
+  if (isRec8(v)) return Object.entries(v).map(([name, def]) => isRec8(def) ? { name, ...def } : { name });
+  return [];
+}
+function strName10(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var isInterpolated3 = (s) => s.includes("${") || s.includes("{");
+function validateNavObjectServability(stack) {
+  const findings = [];
+  if (!isRec8(stack)) return findings;
+  const apps = asArray14(stack.apps);
+  if (apps.length === 0) return findings;
+  const ownEnable = /* @__PURE__ */ new Map();
+  const objects = asArray14(stack.objects);
+  for (const [oi, obj] of objects.entries()) {
+    const n = strName10(obj.name);
+    if (!n) continue;
+    ownEnable.set(n, { enable: obj.enable, path: `objects[${oi}].enable` });
+  }
+  if (ownEnable.size === 0) return findings;
+  for (const [ai, app] of apps.entries()) {
+    const appName = strName10(app.name) ?? `#${ai}`;
+    const walk = (items, basePath) => {
+      if (!Array.isArray(items)) return;
+      for (const [ni, raw] of items.entries()) {
+        if (!isRec8(raw)) continue;
+        const nav = raw;
+        const navPath = `${basePath}[${ni}]`;
+        if (nav.type === "object") {
+          const target = strName10(nav.objectName);
+          const declared = target && !isInterpolated3(target) ? ownEnable.get(target) : void 0;
+          if (target && declared && !(0, import_data7.canServeApiOperation)(declared.enable, "list")) {
+            const enable = isRec8(declared.enable) ? declared.enable : {};
+            const apiDisabled = enable.apiEnabled === false;
+            const condition = apiDisabled ? "`enable.apiEnabled: false`" : "`enable.apiMethods` does not grant `list`" + (Array.isArray(enable.apiMethods) ? ` (declared: ${enable.apiMethods.length === 0 ? "[] \u2014 deny-all" : enable.apiMethods.map((m) => `\`${String(m)}\``).join(", ")})` : "");
+            const answer = apiDisabled ? "404 `OBJECT_API_DISABLED`" : "405 `OBJECT_API_METHOD_NOT_ALLOWED`";
+            const offendingKey = apiDisabled ? `${declared.path}.apiEnabled` : `${declared.path}.apiMethods`;
+            findings.push({
+              severity: "error",
+              rule: NAV_OBJECT_UNSERVABLE,
+              where: `app "${appName}" \xB7 nav "${strName10(nav.id) ?? strName10(nav.label) ?? `#${ni}`}"`,
+              // The nav entry is where the dead row is authored; the `enable`
+              // key that condemns it is named in the message, because the fix
+              // may belong at either end.
+              path: `${navPath}.objectName`,
+              message: `Navigation targets object "${target}", which cannot serve a list: ${condition} (\`${offendingKey}\`), so the list request answers ${answer} for EVERY user \u2014 platform administrators included, since that gate reads only the object's \`enable\` block and never the caller. The entry cannot be rescued with \`requiredPermissions\`: they are independent conditions. The server prunes this entry from the served \`/meta\` payload (#7912), so publishing it ships a menu row that silently is not there.`,
+              hint: `Remove the nav entry, or make "${target}" listable by setting \`enable.apiEnabled: true\` and granting \`list\` in \`enable.apiMethods\`. \u26D4 Do NOT open the API on an object that is disabled on purpose \u2014 several platform objects hold credential material and are API-disabled deliberately; for those the entry is the mistake, not the \`enable\` block.`
+            });
+          }
+        }
+        if (Array.isArray(nav.children)) walk(nav.children, `${navPath}.children`);
+      }
+    };
+    walk(app.navigation, `apps[${ai}].navigation`);
+    for (const [ari, area] of asArray14(app.areas).entries()) {
+      walk(area.items, `apps[${ai}].areas[${ari}].items`);
+      walk(area.navigation, `apps[${ai}].areas[${ari}].navigation`);
+    }
+  }
+  return findings;
+}
+
 // src/validate-translation-references.ts
 var import_spec = require("@objectstack/spec");
 var import_system4 = require("@objectstack/spec/system");
 
 // src/view-walk.ts
-function isRec7(v) {
+function isRec9(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName10(v) {
+function strName11(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function viewObjectName(view) {
-  return strName10(view.objectName) ?? strName10(view.object) ?? (isRec7(view.data) ? strName10(view.data.object) : void 0);
+  return strName11(view.objectName) ?? strName11(view.object) ?? (isRec9(view.data) ? strName11(view.data.object) : void 0);
 }
 function viewContainerSites(view, basePath) {
-  if (!isRec7(view)) return [];
+  if (!isRec9(view)) return [];
   const sites = [{ view, path: basePath, surface: "", kind: "self" }];
-  if (isRec7(view.form)) {
+  if (isRec9(view.form)) {
     sites.push({ view: view.form, path: `${basePath}.form`, surface: "form", kind: "form" });
   }
   for (const key of ["listViews", "formViews"]) {
     const container = view[key];
-    if (!isRec7(container)) continue;
+    if (!isRec9(container)) continue;
     const kind = key === "listViews" ? "listView" : "formView";
     for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec7(sub)) continue;
+      if (!isRec9(sub)) continue;
       sites.push({
         view: sub,
         path: `${basePath}.${key}.${subKey}`,
@@ -2844,15 +3086,15 @@ function formViewSites(view, basePath) {
 // src/validate-translation-references.ts
 var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec8(v) {
+function isRec10(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function asArray14(v) {
+function asArray15(v) {
   if (Array.isArray(v)) return v;
-  if (isRec8(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec8(def) ? def : {} }));
+  if (isRec10(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec10(def) ? def : {} }));
   return [];
 }
-function strName11(v) {
+function strName12(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance5(a, b) {
@@ -2912,34 +3154,34 @@ function collectViewRecord(view, factsFor) {
   };
   const addSections = (container, binding) => {
     if (!binding) return;
-    for (const section of asArray14(container.sections)) {
-      const sectionName = strName11(section.name);
+    for (const section of asArray15(container.sections)) {
+      const sectionName = strName12(section.name);
       if (sectionName) factsFor(binding).sections.add(sectionName);
     }
   };
-  const listBinding = isRec8(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec8(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
-  addView(recordObject ?? listBinding, strName11(view.name));
+  const listBinding = isRec10(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec10(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
+  addView(recordObject ?? listBinding, strName12(view.name));
   const named = namedViewKeys(view);
   for (const family of ["listViews", "formViews"]) {
     const container = view[family];
-    if (!isRec8(container)) continue;
+    if (!isRec10(container)) continue;
     const registryKeys = family === "listViews" ? named.list : named.form;
     let at = 0;
     for (const sub of Object.values(container)) {
       if (!sub || typeof sub !== "object") continue;
       const registryKey = registryKeys[at++];
-      if (!isRec8(sub)) continue;
+      if (!isRec10(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
       addView(binding, registryKey);
       addSections(sub, binding);
     }
   }
-  if (isRec8(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  if (isRec10(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
   addSections(view, recordObject ?? listBinding);
 }
 function defaultListViewKey(object, container) {
-  if (!object || !isRec8(container.list)) return void 0;
+  if (!object || !isRec10(container.list)) return void 0;
   const item = (0, import_spec.expandViewContainer)(object, container).find(
     (i) => i.viewKind === "list" && i.isDefault
   );
@@ -2951,7 +3193,7 @@ function namedViewKeys(container) {
   const object = "probe";
   const prefix = `${object}.`;
   const bare = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : name;
-  const countEntries = (v) => isRec8(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
+  const countEntries = (v) => isRec10(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
   const listCount = countEntries(container.listViews);
   const formCount = countEntries(container.formViews);
   if (!listCount && !formCount) return { list: [], form: [] };
@@ -2969,14 +3211,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec8(opt)) continue;
-      const value = strName11(opt.value);
+      if (!isRec10(opt)) continue;
+      const value = strName12(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName11(opt.label);
+      const label2 = strName12(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec8(raw)) {
+  } else if (isRec10(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -2996,48 +3238,48 @@ function buildUniverse(stack) {
     }
     return facts;
   };
-  for (const obj of asArray14(stack.objects)) {
-    const objectName = strName11(obj.name);
+  for (const obj of asArray15(stack.objects)) {
+    const objectName = strName12(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
-    for (const field of asArray14(obj.fields)) {
-      const fieldName = strName11(field.name);
+    for (const field of asArray15(obj.fields)) {
+      const fieldName = strName12(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
-    for (const action of asArray14(obj.actions)) {
-      const actionName = strName11(action.name);
+    for (const action of asArray15(obj.actions)) {
+      const actionName = strName12(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
-    for (const view of asArray14(obj.views)) {
-      collectViewRecord({ ...view, object: strName11(view.object) ?? objectName }, factsFor);
+    for (const view of asArray15(obj.views)) {
+      collectViewRecord({ ...view, object: strName12(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
-    for (const group of asArray14(obj.fieldGroups)) {
-      const key = strName11(group.key) ?? strName11(group.name);
+    for (const group of asArray15(obj.fieldGroups)) {
+      const key = strName12(group.key) ?? strName12(group.name);
       if (key) facts.sections.add(key);
     }
   }
-  for (const view of asArray14(stack.views)) {
+  for (const view of asArray15(stack.views)) {
     collectViewRecord(view, factsFor);
   }
-  const pages = asArray14(stack.pages);
+  const pages = asArray15(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec8(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec10(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      for (const section of asArray14(props.sections)) {
-        const sectionName = strName11(section.name);
+      for (const section of asArray15(props.sections)) {
+        const sectionName = strName12(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
   }
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
-  for (const action of asArray14(stack.actions)) {
-    const actionName = strName11(action.name);
+  for (const action of asArray15(stack.actions)) {
+    const actionName = strName12(action.name);
     if (!actionName) continue;
-    const owner = strName11(action.objectName) ?? strName11(action.object);
+    const owner = strName12(action.objectName) ?? strName12(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -3051,41 +3293,41 @@ function buildUniverse(stack) {
     }
   }
   const apps = /* @__PURE__ */ new Map();
-  for (const app of asArray14(stack.apps)) {
-    const appName = strName11(app.name);
+  for (const app of asArray15(stack.apps)) {
+    const appName = strName12(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
-      for (const item of asArray14(items)) {
-        const id = strName11(item.id);
+      for (const item of asArray15(items)) {
+        const id = strName12(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
-    for (const area of asArray14(app.areas)) {
-      const areaId = strName11(area.id);
+    for (const area of asArray15(app.areas)) {
+      const areaId = strName12(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
     apps.set(appName, navIds);
   }
   const dashboards = /* @__PURE__ */ new Map();
-  for (const dash of asArray14(stack.dashboards)) {
-    const dashName = strName11(dash.name);
+  for (const dash of asArray15(stack.dashboards)) {
+    const dashName = strName12(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
-    for (const widget of asArray14(dash.widgets)) {
-      const id = strName11(widget.id) ?? strName11(widget.name);
+    for (const widget of asArray15(dash.widgets)) {
+      const id = strName12(widget.id) ?? strName12(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray14(isRec8(dash.header) ? dash.header.actions : void 0),
-      ...asArray14(dash.actions)
+      ...asArray15(isRec10(dash.header) ? dash.header.actions : void 0),
+      ...asArray15(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName11(action.actionUrl) ?? strName11(action.url) ?? strName11(action.name);
+      const key = strName12(action.actionUrl) ?? strName12(action.url) ?? strName12(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -3097,7 +3339,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec8(stack)) return findings;
+  if (!isRec10(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -3106,13 +3348,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec8(bundle)) continue;
+    if (!isRec10(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec8(rawData)) continue;
+      if (!isRec10(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec8(rawNode)) continue;
+        if (!isRec10(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -3138,7 +3380,7 @@ function validateTranslationReferences(stack) {
             );
             continue;
           }
-          if (!isRec8(rawField)) continue;
+          if (!isRec10(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -3220,7 +3462,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec8(rawApp)) continue;
+        if (!isRec10(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
@@ -3243,7 +3485,7 @@ function validateTranslationReferences(stack) {
           );
           continue;
         }
-        if (!isRec8(rawDash)) continue;
+        if (!isRec10(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
@@ -3268,7 +3510,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec8(v) ? v : {};
+  return isRec10(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -3280,7 +3522,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName11(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName12(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -3299,11 +3541,11 @@ function checkOptionKeys(findings, ctx) {
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec8(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec10(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
-  for (const param of asArray14(ctx.action.params)) {
-    const name = strName11(param.name) ?? strName11(param.field);
+  for (const param of asArray15(ctx.action.params)) {
+    const name = strName12(param.name) ?? strName12(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -3320,33 +3562,33 @@ function checkActionParams(findings, ctx) {
 }
 
 // src/collection-entries.ts
-function isRec9(v) {
+function isRec11(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function collectionEntries(v, base) {
   if (Array.isArray(v)) {
     const out = [];
     for (let i = 0; i < v.length; i++) {
-      if (isRec9(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
+      if (isRec11(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
     }
     return out;
   }
-  if (isRec9(v)) {
-    return Object.entries(v).filter(([, def]) => isRec9(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
+  if (isRec11(v)) {
+    return Object.entries(v).filter(([, def]) => isRec11(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
   }
   return [];
 }
 
 // src/validate-translatable-sections.ts
 var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
-function isRec10(v) {
+function isRec12(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName12(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function viewLabel(view) {
-  const name = strName12(view.name);
+  const name = strName13(view.name);
   return name ? `view "${name}"` : "";
 }
 function joinWhere(...parts) {
@@ -3354,7 +3596,7 @@ function joinWhere(...parts) {
 }
 function collectViewSites(view, basePath, label2, sites) {
   const recordObject = viewObjectName(view);
-  const listBinding = isRec10(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
+  const listBinding = isRec12(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
   for (const site of viewContainerSites(view, basePath)) {
     sites.push({
       path: `${site.path}.sections`,
@@ -3368,11 +3610,11 @@ function translatedObjectNames(stack) {
   const out = /* @__PURE__ */ new Set();
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   for (const bundle of bundles) {
-    if (!isRec10(bundle)) continue;
+    if (!isRec12(bundle)) continue;
     for (const data of Object.values(bundle)) {
-      if (!isRec10(data) || !isRec10(data.objects)) continue;
+      if (!isRec12(data) || !isRec12(data.objects)) continue;
       for (const [objectName, node] of Object.entries(data.objects)) {
-        if (isRec10(node)) out.add(objectName);
+        if (isRec12(node)) out.add(objectName);
       }
     }
   }
@@ -3384,22 +3626,22 @@ function suggestedName(label2) {
 }
 function validateTranslatableSections(stack) {
   const findings = [];
-  if (!isRec10(stack)) return findings;
+  if (!isRec12(stack)) return findings;
   const translated = translatedObjectNames(stack);
   if (translated.size === 0) return findings;
   const sites = [];
   for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
-    const objectName = strName12(obj.name);
+    const objectName = strName13(obj.name);
     if (!objectName) continue;
     for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
       collectViewSites(
-        { ...view, object: strName12(view.object) ?? objectName },
+        { ...view, object: strName13(view.object) ?? objectName },
         path,
         viewLabel(view),
         sites
       );
     }
-    if (isRec10(obj.listViews)) {
+    if (isRec12(obj.listViews)) {
       collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
     }
   }
@@ -3407,13 +3649,13 @@ function validateTranslatableSections(stack) {
     collectViewSites(view, path, viewLabel(view), sites);
   }
   for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
-    const pageName = strName12(page.name);
+    const pageName = strName13(page.name);
     const pageLabel = pageName ? `page "${pageName}"` : "";
     for (const walked of walkPageComponents(page, pagePath)) {
       if (!walked.objectName) continue;
-      const props = isRec10(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec12(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      const type = strName12(walked.component.type) ?? "component";
+      const type = strName13(walked.component.type) ?? "component";
       sites.push({
         path: `${walked.path}.properties.sections`,
         surface: joinWhere(pageLabel, type),
@@ -3428,9 +3670,9 @@ function validateTranslatableSections(stack) {
     if (!Array.isArray(site.sections)) continue;
     for (let i = 0; i < site.sections.length; i++) {
       const section = site.sections[i];
-      if (!isRec10(section)) continue;
-      if (strName12(section.name)) continue;
-      const heading = strName12(section.label);
+      if (!isRec12(section)) continue;
+      if (strName13(section.name)) continue;
+      const heading = strName13(section.label);
       if (!heading) continue;
       const slug = suggestedName(heading);
       findings.push({
@@ -3448,10 +3690,10 @@ function validateTranslatableSections(stack) {
 
 // src/flow-walk.ts
 var import_automation2 = require("@objectstack/spec/automation");
-function isRec11(v) {
+function isRec13(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName13(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var REGION_SLOTS = new Map(
@@ -3460,10 +3702,10 @@ var REGION_SLOTS = new Map(
 var REGION_CONFIG_KEYS = import_automation2.FLOW_REGION_CONFIG_KEYS;
 var MAX_REGION_DEPTH = 16;
 function flowNodeLabel(node, index) {
-  return strName13(node.label) ?? strName13(node.id) ?? `#${index}`;
+  return strName14(node.label) ?? strName14(node.id) ?? `#${index}`;
 }
 function stripRegions(config) {
-  if (!isRec11(config)) return void 0;
+  if (!isRec13(config)) return void 0;
   let out;
   for (const key of Object.keys(config)) {
     if (!REGION_CONFIG_KEYS.has(key)) continue;
@@ -3474,11 +3716,11 @@ function stripRegions(config) {
 }
 function walkFlowNodes(flow, flowPath) {
   const out = [];
-  if (!isRec11(flow)) return out;
+  if (!isRec13(flow)) return out;
   const visitList = (nodes, basePath, trail, depth) => {
     if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
     nodes.forEach((raw, index) => {
-      if (!isRec11(raw)) return;
+      if (!isRec13(raw)) return;
       const path = `${basePath}[${index}]`;
       out.push({
         node: raw,
@@ -3487,9 +3729,9 @@ function walkFlowNodes(flow, flowPath) {
         regionTrail: trail,
         depth
       });
-      const type = strName13(raw.type);
+      const type = strName14(raw.type);
       const slots = type ? REGION_SLOTS.get(type) : void 0;
-      if (!slots || !isRec11(raw.config)) return;
+      if (!slots || !isRec13(raw.config)) return;
       const config = raw.config;
       const here = `${type} "${flowNodeLabel(raw, index)}"`;
       for (const slot of slots) {
@@ -3497,8 +3739,8 @@ function walkFlowNodes(flow, flowPath) {
         if (slot === "branches") {
           if (!Array.isArray(value)) continue;
           value.forEach((branch, b) => {
-            if (!isRec11(branch)) return;
-            const branchName = strName13(branch.name) ?? `#${b}`;
+            if (!isRec13(branch)) return;
+            const branchName = strName14(branch.name) ?? `#${b}`;
             visitList(
               branch.nodes,
               `${path}.config.branches[${b}].nodes`,
@@ -3508,7 +3750,7 @@ function walkFlowNodes(flow, flowPath) {
           });
           continue;
         }
-        if (!isRec11(value)) continue;
+        if (!isRec13(value)) continue;
         visitList(
           value.nodes,
           `${path}.config.${slot}.nodes`,
@@ -3528,7 +3770,8 @@ function joinTrail(trail, segment) {
 // src/validate-flow-template-paths.ts
 var FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 var FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
-function asArray15(v) {
+var FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
+function asArray16(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({
@@ -3557,7 +3800,7 @@ var FILTER_GUARDED_NODE_TYPES = /* @__PURE__ */ new Set([
 ]);
 function fieldTypesOf(obj) {
   const types = /* @__PURE__ */ new Map();
-  for (const f of asArray15(obj.fields)) {
+  for (const f of asArray16(obj.fields)) {
     if (typeof f.name === "string") {
       types.set(f.name, typeof f.type === "string" ? f.type : "");
     }
@@ -3654,10 +3897,10 @@ function declaredExpandOf(flow) {
 }
 function validateFlowTemplatePaths(stack) {
   const findings = [];
-  const flows = asArray15(stack.flows);
+  const flows = asArray16(stack.flows);
   if (flows.length === 0) return findings;
   const objectsByName = /* @__PURE__ */ new Map();
-  for (const obj of asArray15(stack.objects)) {
+  for (const obj of asArray16(stack.objects)) {
     if (typeof obj.name === "string") objectsByName.set(obj.name, obj);
   }
   flows.forEach((flow, flowIndex) => {
@@ -3670,6 +3913,7 @@ function validateFlowTemplatePaths(stack) {
     const obj = objectsByName.get(objectName);
     if (!obj) return;
     const fieldTypes = fieldTypesOf(obj);
+    const unprovisionedAnchors = unprovisionedInjectedColumnsFor(obj);
     const expandSet = declaredExpandOf(flow);
     walkFlowNodes(flow, `flows[${flowIndex}]`).forEach(({ node, path: nodePath, regionTrail, localConfig }, walkIndex) => {
       const nodeLabel = typeof node.type === "string" ? node.type : typeof node.id === "string" ? node.id : `#${walkIndex}`;
@@ -3681,6 +3925,7 @@ function validateFlowTemplatePaths(stack) {
       if (leaves.length === 0) return;
       const seenUnknown = /* @__PURE__ */ new Set();
       const seenTraversal = /* @__PURE__ */ new Set();
+      const seenUnprovisioned = /* @__PURE__ */ new Set();
       for (const leaf of leaves) {
         const inFilter = leaf.inFilter;
         for (const rest of recordRefsIn(leaf.text)) {
@@ -3688,6 +3933,19 @@ function validateFlowTemplatePaths(stack) {
           const hasSubPath = rest.length > 1;
           const nextIsIdentifier = hasSubPath && !/^\d+$/.test(rest[1]);
           const isKnown = fieldTypes.has(head) || IMPLICIT_HEADS.has(head);
+          if (unprovisionedAnchors.has(head)) {
+            if (!seenUnprovisioned.has(head)) {
+              seenUnprovisioned.add(head);
+              findings.push({
+                severity: "warning",
+                rule: FLOW_TEMPLATE_FIELD_UNPROVISIONED,
+                where,
+                path: nodePath,
+                message: (inFilter ? `${nodeType} filter references ` : "template references ") + `'{record.${rest.join(".")}}', and ${unprovisionedAnchorCause(objectName, head)} \u2014 ` + (inFilter ? `the token resolves to nothing on every run, which DROPS the condition from the query instead of narrowing it; the node then refuses to run at execution time (#3810).` : `the token resolves to an empty string on every run (silently).`),
+                hint: unprovisionedAnchorHint(objectName, head)
+              });
+            }
+          }
           if (!isKnown) {
             if (seenUnknown.has(head)) continue;
             seenUnknown.add(head);
@@ -3726,14 +3984,14 @@ function validateFlowTemplatePaths(stack) {
 
 // src/validate-ai-surface-affinity.ts
 var AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
-function asArray16(v) {
+function asArray17(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName14(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -3743,18 +4001,18 @@ function validateAiSurfaceAffinity(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
-  for (const skill of asArray16(stack.skills)) {
-    const n = strName14(skill.name);
+  for (const skill of asArray17(stack.skills)) {
+    const n = strName15(skill.name);
     if (n) skillsByName.set(n, skill);
   }
-  const agents = asArray16(stack.agents);
+  const agents = asArray17(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName14(agent.name) ?? `#${ai}`;
+    const agentName = strName15(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName14(skillRefs[si]);
+      const ref = strName15(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -3776,14 +4034,14 @@ function validateAiSurfaceAffinity(stack) {
 // src/validate-ai-tool-references.ts
 var import_system5 = require("@objectstack/spec/system");
 var AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
-function asArray17(v) {
+function asArray18(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName15(v) {
+function strName16(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function distance6(a, b) {
@@ -3824,26 +4082,26 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName15(aiRec.description)) return false;
-  const type = strName15(action.type);
+  if (!strName16(aiRec.description)) return false;
+  const type = strName16(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
 }
 function collectToolUniverse(stack) {
   const universe = new Set(import_system5.PLATFORM_PROVIDED_TOOL_NAMES);
-  for (const tool of asArray17(stack.tools)) {
-    const n = strName15(tool.name);
+  for (const tool of asArray18(stack.tools)) {
+    const n = strName16(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
-    for (const action of asArray17(actions)) {
-      const n = strName15(action.name);
+    for (const action of asArray18(actions)) {
+      const n = strName16(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
   addActionFamily(stack.actions);
-  for (const obj of asArray17(stack.objects)) {
+  for (const obj of asArray18(stack.objects)) {
     addActionFamily(obj.actions);
   }
   return universe;
@@ -3851,13 +4109,13 @@ function collectToolUniverse(stack) {
 function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
-    for (const action of asArray17(actions)) {
-      const n = strName15(action.name);
+    for (const action of asArray18(actions)) {
+      const n = strName16(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
   scan(stack.actions);
-  for (const obj of asArray17(stack.objects)) scan(obj.actions);
+  for (const obj of asArray18(stack.objects)) scan(obj.actions);
   return names;
 }
 function validateAiToolReferences(stack) {
@@ -3875,13 +4133,13 @@ function validateAiToolReferences(stack) {
     }
     return universe.has(ref);
   };
-  const skills = asArray17(stack.skills);
+  const skills = asArray18(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName15(skill.name) ?? `#${si}`;
+    const skillName = strName16(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName15(refs[ti]);
+      const ref = strName16(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -3901,24 +4159,24 @@ function validateAiToolReferences(stack) {
 // src/validate-ai-agent-authoring.ts
 var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
 var DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
-function asArray18(v) {
+function asArray19(v) {
   if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName16(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
 function validateAiAgentAuthoring(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const agents = asArray18(stack.agents);
+  const agents = asArray19(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName16(agent.name) ?? `#${ai}`;
+    const name = strName17(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -3931,12 +4189,12 @@ function validateAiAgentAuthoring(stack) {
     });
   }
   const roster = [...PLATFORM_AGENT_NAMES].join(", ");
-  const apps = asArray18(stack.apps);
+  const apps = asArray19(stack.apps);
   for (let appIdx = 0; appIdx < apps.length; appIdx++) {
     const app = apps[appIdx];
-    const defaultAgent = strName16(app.defaultAgent);
+    const defaultAgent = strName17(app.defaultAgent);
     if (!defaultAgent || PLATFORM_AGENT_NAMES.has(defaultAgent)) continue;
-    const appName = strName16(app.name) ?? `#${appIdx}`;
+    const appName = strName17(app.name) ?? `#${appIdx}`;
     findings.push({
       severity: "warning",
       rule: DEFAULT_AGENT_OUTSIDE_ROSTER,
@@ -4033,24 +4291,24 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec12 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray19(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec12(x));
-  if (isRec12(v)) {
+var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray20(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec14(x));
+  if (isRec14(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec12(def) ? def : {}
+      ...isRec14(def) ? def : {}
     }));
   }
   return [];
 }
 function indexObjectFields2(stack) {
   const out = /* @__PURE__ */ new Map();
-  for (const obj of asArray19(stack.objects)) {
+  for (const obj of asArray20(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const names = /* @__PURE__ */ new Set();
-    for (const f of asArray19(obj.fields)) {
+    for (const f of asArray20(obj.fields)) {
       if (typeof f.name === "string" && f.name) names.add(f.name);
     }
     out.set(name, names);
@@ -4180,12 +4438,12 @@ ${source}
 }
 function validateHookBodyWrites(stack) {
   const findings = [];
-  const hooks = asArray19(stack.hooks);
+  const hooks = asArray20(stack.hooks);
   if (hooks.length === 0) return findings;
   let objectFields = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec12(body) || body.language !== "js") return;
+    if (!isRec14(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
@@ -4256,13 +4514,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec13 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray20(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec13(x));
-  if (isRec13(v)) {
+var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray21(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec15(x));
+  if (isRec15(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec13(def) ? def : {}
+      ...isRec15(def) ? def : {}
     }));
   }
   return [];
@@ -4276,11 +4534,11 @@ function collectActionBodies(stack) {
   const sites = [];
   const seen = /* @__PURE__ */ new Set();
   const collect = (actions, pathPrefix, parentObject) => {
-    asArray20(actions).forEach((action, index) => {
+    asArray21(actions).forEach((action, index) => {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec13(body) || body.language !== "js") return;
+      if (!isRec15(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -4291,7 +4549,7 @@ function collectActionBodies(stack) {
     });
   };
   collect(stack.actions, "actions");
-  asArray20(stack.objects).forEach((obj, objIndex) => {
+  asArray21(stack.objects).forEach((obj, objIndex) => {
     const parentObject = typeof obj.name === "string" && obj.name ? obj.name : void 0;
     collect(obj.actions, `objects[${objIndex}].actions`, parentObject);
   });
@@ -4299,7 +4557,7 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec13(stack)) return findings;
+  if (!isRec15(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
@@ -4357,13 +4615,13 @@ function fixHint2(field, declared) {
 var import_shared3 = require("@objectstack/spec/shared");
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
-var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray21(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec14(x));
-  if (isRec14(v)) {
+var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray22(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec16(x));
+  if (isRec16(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec14(def) ? def : {}
+      ...isRec16(def) ? def : {}
     }));
   }
   return [];
@@ -4376,8 +4634,8 @@ function readLiteralObjectName(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec14(stack)) return findings;
-  const flows = asArray21(stack.flows);
+  if (!isRec16(stack)) return findings;
+  const flows = asArray22(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
   flows.forEach((flow, flowIndex) => {
@@ -4385,10 +4643,10 @@ function validateFlowNodeWrites(stack) {
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec14(node.config) ? node.config : void 0;
+      const config = isRec16(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec14(fields)) return;
+      if (!isRec16(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName(config);
@@ -4422,7 +4680,7 @@ function fixHint3(field, declared) {
 // src/validate-readonly-flow-writes.ts
 var FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 var FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-function asArray22(v) {
+function asArray23(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({
@@ -4463,9 +4721,9 @@ function readLiteralObjectName2(config) {
 }
 function validateReadonlyFlowWrites(stack) {
   const findings = [];
-  const flows = asArray22(stack.flows);
+  const flows = asArray23(stack.flows);
   if (flows.length === 0) return findings;
-  const roIndex = buildReadonlyIndex(asArray22(stack.objects));
+  const roIndex = buildReadonlyIndex(asArray23(stack.objects));
   flows.forEach((flow, flowIndex) => {
     if (flow.runAs === "system") return;
     const runAs = flow.runAs === "user" || flow.runAs === "system" ? flow.runAs : "user";
@@ -4513,14 +4771,14 @@ function validateReadonlyFlowWrites(stack) {
 // src/validate-react-page-props.ts
 var import_node_module2 = require("module");
 var import_ui2 = require("@objectstack/spec/ui");
-var import_data6 = require("@objectstack/spec/data");
+var import_data8 = require("@objectstack/spec/data");
 
 // src/zod-issue-format.ts
-var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var valueAtPath = (root, path) => {
   let cur = root;
   for (const key of path) {
-    if (!isRec15(cur) && !Array.isArray(cur)) return void 0;
+    if (!isRec17(cur) && !Array.isArray(cur)) return void 0;
     cur = cur[key];
   }
   return cur;
@@ -4566,7 +4824,7 @@ function loadTypeScript2() {
   }
   return cachedTs2;
 }
-var asArray23 = (v) => Array.isArray(v) ? v : [];
+var asArray24 = (v) => Array.isArray(v) ? v : [];
 var BLOCKS = new Map(
   import_ui2.REACT_BLOCKS.map((b) => [
     b.tag,
@@ -4654,12 +4912,13 @@ function filterAttrValue(tsc, sf, attr) {
   return perPosition(init.expression);
 }
 var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+var REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 var REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 function checkChartDrillDown(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec16(raw)) {
+  if (!isRec18(raw)) {
     push2(
       "error",
       REACT_CHART_DRILLDOWN_INVALID,
@@ -4682,7 +4941,7 @@ function checkChartDrillDown(raw, push2) {
 }
 function checkChartAggregate(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec16(raw)) {
+  if (!isRec18(raw)) {
     push2(
       "error",
       REACT_CHART_AGGREGATE_INVALID,
@@ -4713,9 +4972,9 @@ function checkChartAggregate(raw, push2) {
     );
   }
 }
-var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec18 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
-function checkObjectChart(attrs, objectFields, findings) {
+function checkObjectChart(attrs, objectFields, findings, unprovisionedAnchors = /* @__PURE__ */ new Map()) {
   const { values, where, path } = attrs;
   const push2 = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
   checkChartDrillDown(values.get("drillDown"), push2);
@@ -4723,18 +4982,29 @@ function checkObjectChart(attrs, objectFields, findings) {
   const aggregate = values.get("aggregate");
   checkChartAggregate(aggregate, push2);
   if (aggregate === void 0 || aggregate === NOT_STATIC) return;
-  if (!isRec16(aggregate)) return;
+  if (!isRec18(aggregate)) return;
   const fn = strOf(aggregate.function);
   const field = strOf(aggregate.field);
   const groupBy = aggregate.groupBy;
-  const groupByField = strOf(groupBy) ?? (isRec16(groupBy) ? strOf(groupBy.field) : void 0);
+  const groupByField = strOf(groupBy) ?? (isRec18(groupBy) ? strOf(groupBy.field) : void 0);
   const objectName = strOf(values.get("objectName"));
   const known = objectName ? objectFields.get(objectName) : void 0;
   if (objectName && known) {
+    const anchors = unprovisionedAnchors.get(objectName);
     const fieldRef = (name, prop) => {
       if (!name) return;
       if (name.includes(".")) return;
-      if (known.has(name) || SYSTEM_FIELDS.has(name)) return;
+      if (known.has(name) || SYSTEM_FIELDS.has(name)) {
+        if (anchors?.has(name)) {
+          push2(
+            "warning",
+            REACT_CHART_FIELD_UNPROVISIONED,
+            `aggregate.${prop} "${name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, name)} \u2014 the aggregate query reads a column that is empty on every row, so the chart ${prop === "groupBy" ? "groups everything into one empty bucket" : "aggregates nothing"} instead of failing.`,
+            unprovisionedAnchorHint(objectName, name)
+          );
+        }
+        return;
+      }
       push2(
         "error",
         REACT_CHART_FIELD_UNKNOWN,
@@ -4760,18 +5030,18 @@ function checkObjectChart(attrs, objectFields, findings) {
     );
   };
   const xAxisRaw = values.get("xAxis");
-  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec16(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec18(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
   const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
   axisRef(categoryAxis, categoryProp);
   const yAxisRaw = values.get("yAxis");
   const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
   for (const a of yAxisList) {
-    axisRef(strOf(a) ?? (isRec16(a) ? strOf(a.field) : void 0), "yAxis[].field");
+    axisRef(strOf(a) ?? (isRec18(a) ? strOf(a.field) : void 0), "yAxis[].field");
   }
   const series = values.get("series");
   if (Array.isArray(series)) {
     for (const s of series) {
-      if (!isRec16(s)) continue;
+      if (!isRec18(s)) continue;
       const dataKey = strOf(s.dataKey);
       axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
     }
@@ -4827,7 +5097,7 @@ function subformFieldRefs(value, basePath) {
   if (!Array.isArray(value)) return { child, parent };
   for (let i = 0; i < value.length; i++) {
     const sub = value[i];
-    if (!isRec16(sub)) continue;
+    if (!isRec18(sub)) continue;
     const at = (key) => `${basePath}[${i}].${key}`;
     child.push({
       objectName: strOf(sub.childObject),
@@ -4852,7 +5122,7 @@ function filterFieldRefs(node, basePath, out) {
     for (let i = 0; i < node.length; i++) filterFieldRefs(node[i], `${basePath}[${i}]`, out);
     return;
   }
-  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data6.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
+  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data8.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
     out.push({ name: head, path: `${basePath}[0]` });
   }
 }
@@ -4872,20 +5142,20 @@ function reactFieldRefs(spec, values, basePath) {
   }
   for (const key of spec.nestedFields ?? []) {
     const v = readable(key);
-    if (isRec16(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+    if (isRec18(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
   }
   for (const key of spec.sections ?? []) {
     const v = readable(key);
     if (!Array.isArray(v)) continue;
     for (let i = 0; i < v.length; i++) {
       const section = v[i];
-      if (!isRec16(section)) continue;
+      if (!isRec18(section)) continue;
       own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
     }
   }
   for (const key of spec.keyedByField ?? []) {
     const v = readable(key);
-    if (!isRec16(v)) continue;
+    if (!isRec18(v)) continue;
     for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
   }
   for (const key of spec.filterArrays ?? []) {
@@ -4893,22 +5163,30 @@ function reactFieldRefs(spec, values, basePath) {
   }
   return { own, queried };
 }
-function checkBlockFieldProps(tag, values, objectFields, where, path) {
+function checkBlockFieldProps(tag, values, objectFields, where, path, unprovisionedAnchors) {
   const objectName = strOf(values.get("objectName"));
   const out = [];
   const spec = REACT_FIELD_SPECS[tag];
   if (spec) {
     const { own, queried } = reactFieldRefs(spec, values, path);
-    out.push(...checkFieldRefs(own, objectName, objectFields, where));
-    out.push(...checkFieldRefs(queried, objectName, objectFields, where, "queried"));
+    out.push(
+      ...checkFieldRefs(own, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+    );
+    out.push(
+      ...checkFieldRefs(queried, objectName, objectFields, where, "queried", unprovisionedAnchors)
+    );
   }
   if (tag === "ObjectForm") {
     const raw = values.get("subforms");
     const subs = subformFieldRefs(raw === NOT_STATIC ? void 0 : raw, `${path}${PATH_SEP}subforms`);
     for (const sub of subs.child) {
-      out.push(...checkFieldRefs(sub.refs, sub.objectName, objectFields, where));
+      out.push(
+        ...checkFieldRefs(sub.refs, sub.objectName, objectFields, where, "skipped", unprovisionedAnchors)
+      );
     }
-    out.push(...checkFieldRefs(subs.parent, objectName, objectFields, where));
+    out.push(
+      ...checkFieldRefs(subs.parent, objectName, objectFields, where, "skipped", unprovisionedAnchors)
+    );
   }
   const schemaType = tag === "Block" ? strOf(values.get("type")) : SCHEMA_TYPE_BY_TAG.get(tag);
   if (schemaType && COMPONENT_FIELD_SPECS[schemaType]) {
@@ -4917,7 +5195,9 @@ function checkBlockFieldProps(tag, values, objectFields, where, path) {
         componentFieldRefs(schemaType, readableProps(values), path, PATH_SEP) ?? [],
         objectName,
         objectFields,
-        where
+        where,
+        "skipped",
+        unprovisionedAnchors
       )
     );
   }
@@ -4949,8 +5229,9 @@ function localComponentNames(tsc, sf) {
 function validateReactPageProps(stack) {
   const findings = [];
   const objectFields = indexObjectFields(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const searchTargets = indexObjectSearchTargets(stack);
-  const pages = asArray23(stack.pages);
+  const pages = asArray24(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -5031,7 +5312,7 @@ function validateReactPageProps(stack) {
             }
           }
           if (tag === "ObjectChart" && !hasSpread) {
-            checkObjectChart({ values, where, path }, objectFields, findings);
+            checkObjectChart({ values, where, path }, objectFields, findings, unprovisionedAnchors);
           }
           if (tag === "ListView" && !hasSpread) {
             findings.push(
@@ -5047,7 +5328,7 @@ function validateReactPageProps(stack) {
           }
           if (!hasSpread) {
             findings.push(
-              ...checkBlockFieldProps(tag, values, objectFields, where, path)
+              ...checkBlockFieldProps(tag, values, objectFields, where, path, unprovisionedAnchors)
             );
           }
         }
@@ -5074,6 +5355,15 @@ var REFERENCE_INTEGRITY_RULES = [
   // `action` is deliberately absent (validateActionNameRefs owns it) and so is
   // `component` (an unregistered ref renders a named diagnostic, not silence).
   { name: "validateNavTargetRefs", run: validateNavTargetRefs },
+  // [#7912] The THIRD question about a nav entry, after "does the target
+  // resolve?" (above) and "is it granted?" (`validateNavAccess`): can the
+  // destination serve at all? An object's own `enable` block can make its list
+  // answer 404/405 for every persona, and no gate authorable on the entry
+  // expresses that — which is how #7544's dead row survived review for a year.
+  // The server now prunes such an entry from the `/meta` payload; the
+  // maintainer ruling of 2026-08-12 makes THIS the mandatory companion, so the
+  // prune is never silent to the author who wrote the row.
+  { name: "validateNavObjectServability", run: validateNavObjectServability },
   { name: "validateTranslationReferences", run: validateTranslationReferences },
   // The same family from the other end (#5417). Its sibling above asks "does
   // this bundle key resolve?"; this one asks "is there a key at all?" — a form
@@ -5172,13 +5462,13 @@ var import_ui3 = require("@objectstack/spec/ui");
 var import_spec2 = require("@objectstack/spec");
 var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
 var COMPONENT_PROPS_INVALID = "component-props-invalid";
-function isRec17(v) {
+function isRec19(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName17(v) {
+function strName18(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function asArray24(v) {
+function asArray25(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5189,23 +5479,36 @@ var PROPS_SCHEMAS = import_ui3.ComponentPropsMap;
 var DATASOURCE_SUPPLIED_PROP = "object";
 function suppliedByDataSource(issue, component) {
   if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
-  const dataSource = isRec17(component.dataSource) ? component.dataSource : void 0;
-  return strName17(dataSource?.object) !== void 0;
+  const dataSource = isRec19(component.dataSource) ? component.dataSource : void 0;
+  return strName18(dataSource?.object) !== void 0;
+}
+function unrecognizedKeysFromUnionArm(issue) {
+  if (issue.code !== "invalid_union") return void 0;
+  const arms = issue.errors;
+  if (!arms || arms.length === 0) return void 0;
+  let found;
+  for (const arm of arms) {
+    const keyIssues = arm.filter((inner) => inner.code === "unrecognized_keys");
+    if (keyIssues.length === 0) continue;
+    if (keyIssues.length !== arm.length || found) return void 0;
+    found = keyIssues[0];
+  }
+  return found;
 }
 function validateComponentProps(stack) {
   const findings = [];
-  if (!isRec17(stack)) return findings;
-  const pages = asArray24(stack.pages);
+  if (!isRec19(stack)) return findings;
+  const pages = asArray25(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec17(page)) continue;
-    const pageName = strName17(page.name) ?? `#${pi}`;
+    if (!isRec19(page)) continue;
+    const pageName = strName18(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName17(component.type);
+      const type = strName18(component.type);
       if (!type) continue;
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec17(component.properties) ? component.properties : void 0;
+      const props = isRec19(component.properties) ? component.properties : void 0;
       if (!props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -5224,6 +5527,20 @@ function validateComponentProps(stack) {
       for (const issue of parsed.error?.issues ?? []) {
         if (suppliedByDataSource(issue, component)) continue;
         const at = issue.path.length ? `${base}.${issue.path.join(".")}` : base;
+        const armIssue = unrecognizedKeysFromUnionArm(issue);
+        if (armIssue) {
+          for (const key of armIssue.keys ?? []) {
+            findings.push({
+              severity: "warning",
+              rule: COMPONENT_PROPS_UNKNOWN_KEY,
+              where,
+              path: `${at}.${key}`,
+              message: `\`${key}\` is not a prop \`${type}\` declares (ComponentPropsMap, @objectstack/spec/ui): ${armIssue.message}`,
+              hint: `Remove \`${key}\`, or declare it on \`${type}\`'s props schema if the component honours it.`
+            });
+          }
+          continue;
+        }
         if (issue.code === "unrecognized_keys") {
           for (const key of issue.keys ?? []) {
             findings.push({
@@ -5454,7 +5771,7 @@ function looksLikeTailwind(className) {
     return false;
   });
 }
-function asArray25(v) {
+function asArray26(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5547,13 +5864,13 @@ function checkNode(node, pageName, path, findings) {
 }
 function validateResponsiveStyles(stack) {
   const findings = [];
-  const pages = asArray25(stack.pages);
+  const pages = asArray26(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     const pageName = typeof page.name === "string" ? page.name : `pages[${p}]`;
-    const regions = asArray25(page.regions);
+    const regions = asArray26(page.regions);
     for (let r = 0; r < regions.length; r++) {
-      const components = asArray25(regions[r].components);
+      const components = asArray26(regions[r].components);
       for (let c = 0; c < components.length; c++) {
         checkNode(components[c], pageName, `pages[${p}].regions[${r}].components[${c}]`, findings);
       }
@@ -5564,10 +5881,10 @@ function validateResponsiveStyles(stack) {
 
 // src/validate-jsx-pages.ts
 var import_sdui_parser = require("@objectstack/sdui-parser");
-var asArray26 = (v) => Array.isArray(v) ? v : [];
+var asArray27 = (v) => Array.isArray(v) ? v : [];
 function validateJsxPages(stack, opts = {}) {
   const findings = [];
-  const pages = asArray26(stack.pages);
+  const pages = asArray27(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "html" && page.kind !== "jsx") continue;
@@ -5615,10 +5932,10 @@ function loadSucraseTransform() {
   }
   return cachedTransform;
 }
-var asArray27 = (v) => Array.isArray(v) ? v : [];
+var asArray28 = (v) => Array.isArray(v) ? v : [];
 function validateReactPages(stack) {
   const findings = [];
-  const pages = asArray27(stack.pages);
+  const pages = asArray28(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -5655,11 +5972,11 @@ function validateReactPages(stack) {
 
 // src/validate-page-source-styling.ts
 var PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-var asArray28 = (v) => Array.isArray(v) ? v : [];
+var asArray29 = (v) => Array.isArray(v) ? v : [];
 var CLASSNAME_ATTR = /\bclassName\s*=\s*["'{]/g;
 function validatePageSourceStyling(stack) {
   const findings = [];
-  const pages = asArray28(stack.pages);
+  const pages = asArray29(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page) continue;
@@ -5687,7 +6004,7 @@ function validatePageSourceStyling(stack) {
 // src/validate-capability-references.ts
 var import_security = require("@objectstack/spec/security");
 var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
-function asArray29(v) {
+function asArray30(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -5712,13 +6029,13 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(import_security.PLATFORM_CAPABILITY_NAMES);
-  for (const cap of asArray29(stack.capabilities)) {
+  for (const cap of asArray30(stack.capabilities)) {
     if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
   }
-  for (const ps of asArray29(stack.permissions)) {
+  for (const ps of asArray30(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
-  for (const seed of asArray29(stack.data)) {
+  for (const seed of asArray30(stack.data)) {
     if (seed.object !== "sys_capability") continue;
     for (const rec of Array.isArray(seed.records) ? seed.records : []) {
       const name = rec?.name;
@@ -5737,7 +6054,7 @@ function validateCapabilityReferences(stack) {
       hint
     });
   };
-  const objects = asArray29(stack.objects);
+  const objects = asArray30(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -5746,27 +6063,27 @@ function validateCapabilityReferences(stack) {
     for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
       flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
     }
-    const fields = asArray29(obj.fields);
+    const fields = asArray30(obj.fields);
     for (const f of fields) {
       const fname = typeof f.name === "string" ? f.name : "(field)";
       for (const cap of asCapArray(f.requiredPermissions)) {
         flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
       }
     }
-    for (const [ai, action] of asArray29(obj.actions).entries()) {
+    for (const [ai, action] of asArray30(obj.actions).entries()) {
       const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
       for (const cap of asCapArray(action.requiredPermissions)) {
         flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
       }
     }
   }
-  for (const [i, action] of asArray29(stack.actions).entries()) {
+  for (const [i, action] of asArray30(stack.actions).entries()) {
     const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
     for (const cap of asCapArray(action.requiredPermissions)) {
       flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
     }
   }
-  const apps = asArray29(stack.apps);
+  const apps = asArray30(stack.apps);
   for (let i = 0; i < apps.length; i++) {
     const app = apps[i];
     if (!app || typeof app !== "object") continue;
@@ -5801,7 +6118,7 @@ var FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID = "flow-time-relative-descriptor-inval
 var FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-descriptor-unroutable";
 var FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
 var VALID_RECORD_TRIGGER = /^record-(?:before|after)-(?:create|insert|update|delete|write)$/;
-function asArray30(v) {
+function asArray31(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({
@@ -5829,10 +6146,10 @@ function startNodeOf(flow) {
 }
 function validateFlowTriggerReadiness(stack) {
   const findings = [];
-  const flows = asArray30(stack.flows);
+  const flows = asArray31(stack.flows);
   if (flows.length === 0) return findings;
   const objectNames = new Set(
-    asArray30(stack.objects).map((o) => typeof o.name === "string" ? o.name : void 0).filter((n) => !!n)
+    asArray31(stack.objects).map((o) => typeof o.name === "string" ? o.name : void 0).filter((n) => !!n)
   );
   flows.forEach((flow, flowIndex) => {
     const flowName = typeof flow.name === "string" ? flow.name : `#${flowIndex}`;
@@ -5997,7 +6314,7 @@ var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
 };
-function asArray31(v) {
+function asArray32(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6007,7 +6324,7 @@ function asArray31(v) {
 function validateApprovalApprovers(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const flows = asArray31(stack.flows);
+  const flows = asArray32(stack.flows);
   const validTypes = new Set(import_automation4.ApproverType.options);
   for (let fi = 0; fi < flows.length; fi++) {
     const flow = flows[fi];
@@ -6187,10 +6504,10 @@ function validateApprovalApprovers(stack) {
 }
 
 // src/validate-record-title.ts
-var import_data7 = require("@objectstack/spec/data");
+var import_data9 = require("@objectstack/spec/data");
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
-function asArray32(v) {
+function asArray33(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6199,7 +6516,7 @@ function asArray32(v) {
 }
 function validateRecordTitle(stack) {
   const findings = [];
-  const objects = asArray32(stack.objects);
+  const objects = asArray33(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
@@ -6215,7 +6532,7 @@ function validateRecordTitle(stack) {
         hint: `titleFormat is a render-only template the server cannot return or query, and an explicit nameField now takes precedence. For a single-field title set nameField: '<field>'. For a composite title, add a formula field (returnType: 'text') and designate it via nameField.`
       });
     }
-    const completeness = (0, import_data7.objectTitleCompleteness)(obj);
+    const completeness = (0, import_data9.objectTitleCompleteness)(obj);
     if (completeness.status === "none") {
       findings.push({
         severity: "warning",
@@ -6235,7 +6552,8 @@ var FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 var FIELD_GROUP_EMPTY = "field-group-empty";
 var FIELD_GROUP_SHADOWED = "field-group-shadowed";
 var SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
-function asArray33(v) {
+var SEMANTIC_ROLE_FIELD_UNPROVISIONED = "semantic-role-field-unprovisioned";
+function asArray34(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -6244,7 +6562,7 @@ function asArray33(v) {
 }
 function validateSemanticRoles(stack) {
   const findings = [];
-  const objects = asArray33(stack.objects);
+  const objects = asArray34(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -6253,6 +6571,15 @@ function validateSemanticRoles(stack) {
     const path = `objects[${i}]`;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? obj.fields : {};
     const fieldNames = /* @__PURE__ */ new Set([...Object.keys(fields), ...injectedColumnsFor(obj)]);
+    const unprovisioned = unprovisionedInjectedColumnsFor(obj);
+    const unprovisionedPointer = (slot, entry) => ({
+      severity: "warning",
+      rule: SEMANTIC_ROLE_FIELD_UNPROVISIONED,
+      where,
+      path: `${path}.${slot}`,
+      message: `${objName}: ${slot} points at "${entry}", an injected system column with no storage behind it \u2014 this object is external (ADR-0015), so the platform registers the anchor but the remote schema owns the table and no column backs it. Every consumer renders it empty on every record.`,
+      hint: `If the remote table really carries "${entry}", declare it in the object's own fields (mapped through the external binding's columnMap); otherwise point ${slot} at a real remote column.`
+    });
     const declaredGroups = new Set(
       (Array.isArray(obj.fieldGroups) ? obj.fieldGroups : []).filter((g) => !!g && typeof g === "object").map((g) => g.key).filter((k) => typeof k === "string" && k.length > 0)
     );
@@ -6294,10 +6621,16 @@ function validateSemanticRoles(stack) {
         message: `${objName}: stageField "${stage}" is not a field on this object \u2014 consumers fall back to heuristic stage detection`,
         hint: `Point stageField at an existing select/status field, or set stageField: false to declare the object has no linear lifecycle.`
       });
+    } else if (typeof stage === "string" && unprovisioned.has(stage)) {
+      findings.push(unprovisionedPointer("stageField", stage));
     }
     const highlights = Array.isArray(obj.highlightFields) ? obj.highlightFields : Array.isArray(obj.compactLayout) ? obj.compactLayout : [];
     for (const entry of highlights) {
-      if (typeof entry !== "string" || entry.length === 0 || fieldNames.has(entry)) continue;
+      if (typeof entry !== "string" || entry.length === 0) continue;
+      if (fieldNames.has(entry)) {
+        if (unprovisioned.has(entry)) findings.push(unprovisionedPointer("highlightFields", entry));
+        continue;
+      }
       findings.push({
         severity: "warning",
         rule: SEMANTIC_ROLE_FIELD_UNKNOWN,
@@ -6339,17 +6672,17 @@ function validateSemanticRoles(stack) {
 // src/validate-form-layout.ts
 var FORM_FIELD_UNKNOWN = "form-field-unknown";
 var FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
-function asArray34(v) {
+function asArray35(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function isRec18(v) {
+function isRec20(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName18(v) {
+function strName19(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function fieldNameOf(entry) {
@@ -6363,14 +6696,14 @@ function fieldNameOf(entry) {
 function validateFormLayout(stack) {
   const findings = [];
   const objectFields = /* @__PURE__ */ new Map();
-  for (const obj of asArray34(stack.objects)) {
+  for (const obj of asArray35(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? Object.keys(obj.fields) : [];
     objectFields.set(name, new Set(fields));
   }
   for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
-    const viewName = strName18(view.name) ?? strName18(view.object) ?? viewPath;
+    const viewName = strName19(view.name) ?? strName19(view.object) ?? viewPath;
     const containerObject = viewObjectName(view);
     for (const site of formViewSites(view, viewPath)) {
       const objName = viewObjectName(site.view) ?? containerObject;
@@ -6380,7 +6713,7 @@ function validateFormLayout(stack) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const sec = sections[s];
-          const secFields = isRec18(sec) && Array.isArray(sec.fields) ? sec.fields : [];
+          const secFields = isRec20(sec) && Array.isArray(sec.fields) ? sec.fields : [];
           for (let f = 0; f < secFields.length; f++) {
             const entry = secFields[f];
             const fname = fieldNameOf(entry);
@@ -6395,7 +6728,7 @@ function validateFormLayout(stack) {
                 hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
               });
             }
-            const colSpan = isRec18(entry) ? entry.colSpan : void 0;
+            const colSpan = isRec20(entry) ? entry.colSpan : void 0;
             if (colSpan != null) {
               findings.push({
                 severity: "warning",
@@ -6506,6 +6839,64 @@ function validateSeedStateMachine(stack) {
 
 // src/validate-visibility-predicates.ts
 var import_formula4 = require("@objectstack/formula");
+
+// src/predicate-rhs-position.ts
+function isNode2(v) {
+  return !!v && typeof v === "object" && typeof v.op === "string";
+}
+var EQUALITY_OPS = /* @__PURE__ */ new Set(["==", "!="]);
+var COMPREHENSION_MACROS = /* @__PURE__ */ new Set(["all", "exists", "exists_one", "map", "filter"]);
+function bareId(node) {
+  if (!isNode2(node)) return null;
+  return node.op === "id" && typeof node.args === "string" ? node.args : null;
+}
+function bareRhsOnlyIdentifiers(ast) {
+  const rhs = /* @__PURE__ */ new Set();
+  const elsewhere = /* @__PURE__ */ new Set();
+  const walk = (node, suppressible) => {
+    if (Array.isArray(node)) {
+      for (const child of node) walk(child, suppressible);
+      return;
+    }
+    if (!isNode2(node)) return;
+    const args = node.args;
+    if (node.op === "rcall" && Array.isArray(args) && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+      walk(args[1], suppressible);
+      walk(args[2], false);
+      return;
+    }
+    if (typeof node.op === "string" && EQUALITY_OPS.has(node.op) && Array.isArray(args) && args.length === 2) {
+      const right = suppressible ? bareId(args[1]) : null;
+      walk(args[0], suppressible);
+      if (right !== null) {
+        rhs.add(right);
+        return;
+      }
+      walk(args[1], suppressible);
+      return;
+    }
+    const name = bareId(node);
+    if (name !== null) {
+      elsewhere.add(name);
+      return;
+    }
+    walk(args, suppressible);
+  };
+  walk(ast, true);
+  for (const name of elsewhere) rhs.delete(name);
+  return rhs;
+}
+function isRec21(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function schemaIdOf(view) {
+  const data = view.data;
+  if (!isRec21(data)) return void 0;
+  if (data.provider !== "schema") return void 0;
+  return typeof data.schemaId === "string" ? data.schemaId : void 0;
+}
+
+// src/validate-visibility-predicates.ts
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 var VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
 var VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
@@ -6553,7 +6944,7 @@ function boundName(overrun) {
   return overrun.limit && overrun.limitValue !== null ? `the \`${overrun.limit}\` budget (platform limit ${overrun.limitValue})` : "one of the platform's parse budgets";
 }
 var VIEW_PAGE_EXTRA_ROOTS = ["current_user", "page"];
-function isNode2(v) {
+function isNode3(v) {
   return !!v && typeof v === "object" && typeof v.op === "string";
 }
 function namespaceRoots(node, out) {
@@ -6561,22 +6952,27 @@ function namespaceRoots(node, out) {
     for (const child of node) namespaceRoots(child, out);
     return;
   }
-  if (!isNode2(node)) return;
+  if (!isNode3(node)) return;
   const args = node.args;
   if (Array.isArray(args)) {
     const receiver = node.op === "rcall" ? args[1] : args[0];
-    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode2(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode3(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
       out.add(receiver.args);
     }
   }
   namespaceRoots(args, out);
 }
-function firstBareIdentifier(source) {
+function firstBareIdentifier(source, literalRhs) {
   const ast = (0, import_formula4.parseCelToAst)(source);
   if (!ast) return null;
   const rooted = /* @__PURE__ */ new Set();
   namespaceRoots(ast, rooted);
-  return (0, import_formula4.firstUndeclaredReference)(source, [...VIEW_PAGE_EXTRA_ROOTS, ...rooted]);
+  const literalSlot = literalRhs ? bareRhsOnlyIdentifiers(ast) : [];
+  return (0, import_formula4.firstUndeclaredReference)(source, [
+    ...VIEW_PAGE_EXTRA_ROOTS,
+    ...rooted,
+    ...literalSlot
+  ]);
 }
 var CANONICAL_ROOT_BY_LAYER = {
   runtime: "record",
@@ -6585,16 +6981,16 @@ var CANONICAL_ROOT_BY_LAYER = {
 var MISLAYER_BY_LAYER = {
   runtime: {
     forbiddenRoot: "data",
-    message: "visibility predicate is rooted at `data.` \u2014 that is the metadata-editing-form root (a `*.form.ts` row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
+    message: "visibility predicate is rooted at `data.` \u2014 that is the root a metadata-editing form binds (the row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
     hint: "Runtime record surfaces bind `record` + `current_user` (pages also expose `page.<var>`). Use e.g. `record.status == 'open'` instead of `data.status == 'open'`."
   },
   metadata: {
     forbiddenRoot: "record",
-    message: "visibility predicate is rooted at `record.` \u2014 that is the runtime record-surface root (a `*.view.ts` / `*.page.ts` live record), not a metadata-editing form. A `*.form.ts` predicate that binds `record.` never matches and the element renders unconditionally (ADR-0089).",
+    message: "visibility predicate is rooted at `record.` \u2014 that is the root a runtime view/page surface binds (the live record), not the root a metadata-editing form binds. On a metadata-editing form \u2014 the row under edit \u2014 a `record.`-rooted predicate never matches and the element renders unconditionally (ADR-0089).",
     hint: "Metadata-editing forms bind `data` (the row under edit). Use e.g. `data.type == 'grid'` instead of `record.type == 'grid'`."
   }
 };
-function checkElement(el, where, path, layer, findings) {
+function checkElement(el, where, path, layer, findings, literalRhs = false) {
   const raw = el[CANONICAL] ?? el.visibleOn ?? el.visibility;
   const source = predicateSource(raw);
   const rule = MISLAYER_BY_LAYER[layer];
@@ -6632,7 +7028,7 @@ function checkElement(el, where, path, layer, findings) {
     });
   }
   if (source && !refusal) {
-    const bare = firstBareIdentifier(source);
+    const bare = firstBareIdentifier(source, literalRhs);
     if (bare) {
       const root = CANONICAL_ROOT_BY_LAYER[layer];
       findings.push({
@@ -6641,7 +7037,7 @@ function checkElement(el, where, path, layer, findings) {
         where,
         path,
         message: `visibility predicate references \`${bare}\` as a bare identifier. Values are bound under a namespace on this surface \u2014 they are never flattened to top level \u2014 so \`${bare}\` resolves to nothing, the predicate can never evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like one with no predicate at all (#5149).`,
-        hint: `Write \`${root}.${bare}\` instead of \`${bare}\`` + (layer === "runtime" ? " (runtime view/page surfaces bind `record` + `current_user`; a page component also exposes page state as `page.<var>`)." : " (a `*.form.ts` metadata-editing form binds the row under edit as `data`).")
+        hint: `Write \`${root}.${bare}\` instead of \`${bare}\`` + (layer === "runtime" ? " (runtime view/page surfaces bind `record` + `current_user`; a page component also exposes page state as `page.<var>`)." : " (a metadata-editing form binds the row under edit as `data`).")
       });
     }
   }
@@ -6650,24 +7046,27 @@ function isFieldObject(entry) {
   return !!entry && typeof entry === "object" && !Array.isArray(entry);
 }
 function validateVisibilityPredicates(stack, opts = {}) {
-  const layer = opts.layer ?? "runtime";
+  const declaredLayer = opts.layer ?? "runtime";
   const findings = [];
   for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
     const viewName = typeof view.name === "string" ? view.name : typeof view.object === "string" ? view.object : viewPath;
     for (const site of formViewSites(view, viewPath)) {
       const where = site.surface ? `view "${viewName}" \xB7 ${site.surface}` : `view "${viewName}"`;
+      const schemaBound = schemaIdOf(site.view) !== void 0;
+      const literalRhs = schemaBound;
+      const layer = schemaBound ? "metadata" : declaredLayer;
       for (const bucket of ["sections", "groups"]) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const sec = sections[s];
           if (!sec || typeof sec !== "object") continue;
           const secPath = `${site.path}.${bucket}[${s}]`;
-          checkElement(sec, where, secPath, layer, findings);
+          checkElement(sec, where, secPath, layer, findings, literalRhs);
           const secFields = Array.isArray(sec.fields) ? sec.fields : [];
           for (let f = 0; f < secFields.length; f++) {
             const entry = secFields[f];
             if (isFieldObject(entry)) {
-              checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+              checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings, literalRhs);
             }
           }
         }
@@ -6678,7 +7077,7 @@ function validateVisibilityPredicates(stack, opts = {}) {
     const pageName = typeof page.name === "string" ? page.name : void 0;
     const where = `page "${pageName ?? pagePath}"`;
     for (const walked of walkPageComponents(page, pagePath)) {
-      checkElement(walked.component, where, walked.path, layer, findings);
+      checkElement(walked.component, where, walked.path, declaredLayer, findings);
     }
   }
   return findings;
@@ -6690,9 +7089,9 @@ var import_kernel2 = require("@objectstack/spec/kernel");
 var import_spec4 = require("@objectstack/spec");
 var PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
 var PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
+var PREDICATE_RHS_PATH_SHAPED = "predicate-rhs-path-shaped";
 var PREDICATE_KEYS = ["visibleWhen", "visibleOn"];
 var ROOT = "data";
-var COMPREHENSION_MACROS = /* @__PURE__ */ new Set(["all", "exists", "exists_one", "map", "filter"]);
 function defOf(schema) {
   if (!schema || typeof schema !== "object" && typeof schema !== "function") return void 0;
   const s = schema;
@@ -6785,11 +7184,11 @@ function stepInto(scope, segment) {
   if (!declared.includes(segment)) return { kind: "undeclared", declared };
   return { kind: "declared", next: propertyOf(u, segment) };
 }
-function isNode3(v) {
+function isNode4(v) {
   return !!v && typeof v === "object" && typeof v.op === "string";
 }
 function memberChain(node) {
-  if (!isNode3(node)) return null;
+  if (!isNode4(node)) return null;
   if (node.op === "id" && typeof node.args === "string") return [node.args];
   if (node.op === "." && Array.isArray(node.args) && typeof node.args[1] === "string") {
     const head = memberChain(node.args[0]);
@@ -6802,7 +7201,7 @@ function rootedPaths(node, out) {
     for (const child of node) rootedPaths(child, out);
     return;
   }
-  if (!isNode3(node)) return;
+  if (!isNode4(node)) return;
   if (node.op === ".") {
     const chain = memberChain(node);
     if (chain && chain[0] === ROOT && chain.length > 1) {
@@ -6812,23 +7211,40 @@ function rootedPaths(node, out) {
   }
   rootedPaths(node.args, out);
 }
+var PATH_SHAPED_RHS = /^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*$/;
+function equalitySites(node, out) {
+  if (Array.isArray(node)) {
+    for (const child of node) equalitySites(child, out);
+    return;
+  }
+  if (!isNode4(node)) return;
+  const args = node.args;
+  if (node.op === "rcall" && Array.isArray(args) && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
+    equalitySites(args[1], out);
+    return;
+  }
+  if (typeof node.op === "string" && EQUALITY_OPS.has(node.op) && Array.isArray(args) && args.length === 2) {
+    out.push({ op: node.op, right: args[1] });
+  }
+  equalitySites(args, out);
+}
 function classifyIdentifiers(node, values, excluded) {
   if (Array.isArray(node)) {
     for (const child of node) classifyIdentifiers(child, values, excluded);
     return;
   }
-  if (!isNode3(node)) return;
+  if (!isNode4(node)) return;
   const args = node.args;
   if (Array.isArray(args)) {
     const receiver = node.op === "rcall" ? args[1] : args[0];
-    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode3(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
+    if ((node.op === "." || node.op === ".?" || node.op === "[]" || node.op === "rcall") && isNode4(receiver) && receiver.op === "id" && typeof receiver.args === "string") {
       excluded.add(receiver.args);
     }
     if (node.op === "rcall" && typeof args[0] === "string" && COMPREHENSION_MACROS.has(args[0])) {
       const macroArgs = args[2];
       if (Array.isArray(macroArgs) && macroArgs.length >= 2) {
         const bound = macroArgs[0];
-        if (isNode3(bound) && bound.op === "id" && typeof bound.args === "string") {
+        if (isNode4(bound) && bound.op === "id" && typeof bound.args === "string") {
           excluded.add(bound.args);
         }
       }
@@ -6847,15 +7263,9 @@ function predicateSource2(v) {
   }
   return void 0;
 }
-function isRec19(v) {
+function isRec22(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function schemaIdOf(view) {
-  const data = view.data;
-  if (!isRec19(data)) return void 0;
-  if (data.provider !== "schema") return void 0;
-  return typeof data.schemaId === "string" ? data.schemaId : void 0;
-}
 function checkPredicate(source, scope, where, path, findings) {
   const ast = (0, import_formula5.parseCelToAst)(source);
   if (!ast) return;
@@ -6885,19 +7295,38 @@ function checkPredicate(source, scope, where, path, findings) {
     }
   }
   const declaredHere = keysOf(scope);
-  if (!declaredHere) return;
-  const values = /* @__PURE__ */ new Set();
-  const excluded = /* @__PURE__ */ new Set();
-  classifyIdentifiers(ast, values, excluded);
-  for (const id of values) {
-    if (excluded.has(id) || !declaredHere.includes(id)) continue;
+  const rhsOnly = bareRhsOnlyIdentifiers(ast);
+  if (declaredHere) {
+    const values = /* @__PURE__ */ new Set();
+    const excluded = /* @__PURE__ */ new Set();
+    classifyIdentifiers(ast, values, excluded);
+    for (const id of values) {
+      if (excluded.has(id) || rhsOnly.has(id) || !declaredHere.includes(id)) continue;
+      findings.push({
+        severity: "error",
+        rule: PREDICATE_PATH_UNROOTED,
+        where,
+        path,
+        message: `predicate references \`${id}\` as a bare identifier, but \`${id}\` is a key of the schema this form edits \u2014 the binding root was dropped. Values are bound under \`${ROOT}\` and are never flattened to top level, so \`${id}\` resolves to nothing, the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149, #6254).`,
+        hint: `Write \`${ROOT}.${id}\` instead of \`${id}\`. A metadata-editing form binds the row under edit as \`${ROOT}\` at every depth \u2014 inside a repeater \`${ROOT}\` is the ROW, but it is still spelled \`${ROOT}\` (there is no implicit row scope).`
+      });
+    }
+  }
+  const sites = [];
+  equalitySites(ast, sites);
+  for (const { op, right } of sites) {
+    const chain = memberChain(right);
+    if (!chain) continue;
+    const text = chain.join(".");
+    if (!PATH_SHAPED_RHS.test(text)) continue;
+    const dotted = chain.length > 1;
     findings.push({
-      severity: "error",
-      rule: PREDICATE_PATH_UNROOTED,
+      severity: dotted ? "error" : "warning",
+      rule: PREDICATE_RHS_PATH_SHAPED,
       where,
       path,
-      message: `predicate references \`${id}\` as a bare identifier, but \`${id}\` is a key of the schema this form edits \u2014 the binding root was dropped. Values are bound under \`${ROOT}\` and are never flattened to top level, so \`${id}\` resolves to nothing, the predicate can never evaluate and the console falls OPEN: the element renders unconditionally and looks exactly like one carrying no predicate at all (#5149, #6254).`,
-      hint: `Write \`${ROOT}.${id}\` instead of \`${id}\`. A metadata-editing form binds the row under edit as \`${ROOT}\` at every depth \u2014 inside a repeater \`${ROOT}\` is the ROW, but it is still spelled \`${ROOT}\` (there is no implicit row scope).`
+      message: dotted ? `predicate compares against \`${text}\` on the RIGHT of \`${op}\`, which is a path but is not evaluated as one. A metadata-editing form resolves paths on the LEFT of \`${op}\` only; the right-hand side goes to the literal parser, so \`${text}\` is compared as the literal string "${text}". The verdict therefore does not depend on the right-hand path at all: \`a == ${text}\` is FALSE even when both sides hold the same value, and \`a != ${text}\` is correspondingly TRUE. An \`==\` written this way hides the element on every row, and nothing in the console says why (objectui#4049).` : `predicate compares against the unquoted word \`${text}\` on the RIGHT of \`${op}\`. The right-hand side of \`${op}\` is a literal, never a reference, so this is read as the literal string "${text}" \u2014 which is probably what you meant, and is why it appears to work. It is outside the declared subset all the same (\`path == 'literal'\`), and it stops working when this surface moves to the real CEL evaluator, where a bare \`${text}\` resolves to nothing (objectui#4049). The token also reads as a \`${ROOT}.\` root someone dropped, so this one finding carries BOTH readings: which one you meant is the thing no linter can know, and it changes the fix (#7696).`,
+      hint: dotted ? `Two sanctioned spellings. (1) If you meant the TEXT, quote it: \`${op} '${text}'\`. (2) If you meant the PATH, restructure so the path is on the LEFT and a literal is on the right \u2014 comparing one path against another is outside the subset this surface renders, which is \`path == 'literal'\` / \`path != 'literal'\` and nothing wider. There is no third spelling that compares two paths here.` : `Two sanctioned spellings, and you must pick \u2014 they are not the same predicate. (1) If you meant the TEXT \`${text}\`, quote it: \`${op} '${text}'\`. That is what this renders as today, so it changes no behaviour and is the fix unless you know otherwise. (2) If you meant the FIELD \`${ROOT}.${text}\`, move it to the LEFT and put a literal on the right, e.g. \`${ROOT}.${text} == 'yes'\`. \u26D4 Do NOT simply add the root in place: \`${op} ${ROOT}.${text}\` is a path on the RIGHT, which this surface parses as the literal string "${ROOT}.${text}" \u2014 it is refused by this same rule at \`error\`, and it is FALSE on every row. The subset here is \`path == 'literal'\` and nothing wider.`
     });
   }
 }
@@ -6905,7 +7334,7 @@ function walkFields(entries, scope, where, base, findings, depth) {
   if (!Array.isArray(entries) || depth > 12) return;
   for (let i = 0; i < entries.length; i++) {
     const entry = entries[i];
-    if (!isRec19(entry)) continue;
+    if (!isRec22(entry)) continue;
     const path = `${base}[${i}]`;
     for (const key of PREDICATE_KEYS) {
       const source = predicateSource2(entry[key]);
@@ -6932,15 +7361,14 @@ function validatePredicatePathRefs(stack, opts = {}) {
       try {
         root = resolveSchema(schemaId);
       } catch {
-        continue;
+        root = void 0;
       }
-      if (!root) continue;
       const where = site.surface ? `view "${viewName}" \xB7 ${site.surface} (schema "${schemaId}")` : `view "${viewName}" (schema "${schemaId}")`;
       for (const bucket of ["sections", "groups"]) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const section = sections[s];
-          if (!isRec19(section)) continue;
+          if (!isRec22(section)) continue;
           const sectionPath = `${site.path}.${bucket}[${s}]`;
           for (const key of PREDICATE_KEYS) {
             const source = predicateSource2(section[key]);
@@ -6971,6 +7399,7 @@ var SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
 var SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
 var SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 var SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
+var SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
 var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
 var OWD_ALIAS_FIX = {
   read: "public_read",
@@ -6983,7 +7412,7 @@ var OWD_WIDTH = {
   public_read: 1,
   public_read_write: 2
 };
-function asArray35(v) {
+function asArray36(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -7009,21 +7438,28 @@ function refOf(def) {
   return typeof r === "string" && r ? r : void 0;
 }
 function firstMasterDetailField(obj) {
-  for (const f of asArray35(obj.fields)) {
+  for (const f of asArray36(obj.fields)) {
     if (f.type === "master_detail") {
       return { name: String(f.name ?? "?"), parent: refOf(f) };
     }
   }
   return void 0;
 }
+function resolveCbpRelation(obj) {
+  const entries = asArray36(obj.fields);
+  const pick = (pred) => entries.find((f) => pred(f) && refOf(f));
+  const found = pick((f) => f.type === "master_detail" && !!f.required) ?? pick((f) => f.type === "master_detail") ?? pick((f) => f.type === "lookup" && !!f.required);
+  if (!found) return void 0;
+  return { field: String(found.name ?? "?"), type: String(found.type), master: refOf(found) };
+}
 function grantsObjectAccess(p) {
   return p.allowRead === true || p.allowCreate === true || p.allowEdit === true || p.allowDelete === true || p.viewAllRecords === true || p.modifyAllRecords === true;
 }
 function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray35(stack.objects);
-  const permissionSets = asArray35(stack.permissions);
+  const objects = asArray36(stack.objects);
+  const permissionSets = asArray36(stack.permissions);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -7061,6 +7497,16 @@ function validateSecurityPosture(stack, opts) {
         });
       }
     }
+    if (owd === "controlled_by_parent" && !resolveCbpRelation(obj)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_CBP_NO_RELATION,
+        where: `object "${objName}"`,
+        path: `${objPath}.sharingModel`,
+        message: `"${objName}" declares sharingModel 'controlled_by_parent' but has no relation the platform can derive access from. ADR-0055 resolves the master through a required master_detail, then any master_detail, then a required lookup \u2014 each of which must also name a reference target \u2014 and this object matches none of the three. At runtime every read is DENIED and every write is refused with 422 INVALID_METADATA (#7474), so the object is unusable rather than merely locked down.`,
+        hint: `Add the master relation this object is derived from, e.g. fields.parent: { type: 'master_detail', reference: '<master_object>', required: true }. If the object has no master, its baseline is its own decision \u2014 use sharingModel: 'private' (owner + shares), 'public_read', or 'public_read_write'.`
+      });
+    }
     if (typeof external === "string") {
       if (OWD_ALIAS_FIX[external]) {
         findings.push({
@@ -7126,57 +7572,10 @@ function validateSecurityPosture(stack, opts) {
       }
     }
   }
-  const flagRole = (kind, name, label2, where, path) => {
-    if (identifierHasRoleToken(name)) {
-      findings.push({
-        severity: "error",
-        rule: SECURITY_ROLE_WORD,
-        where,
-        path,
-        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
-        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
-      });
-    } else if (labelHasRoleWord(label2)) {
-      findings.push({
-        severity: "error",
-        rule: SECURITY_ROLE_WORD,
-        where,
-        path: `${path.replace(/\.name$/, "")}.label`,
-        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
-        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
-      });
-    }
-  };
-  for (let i = 0; i < objects.length; i++) {
-    const obj = objects[i];
-    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
-    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
-    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray35(obj.fields)) {
-      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
-    }
-    for (const [ai, action] of asArray35(obj.actions).entries()) {
-      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
-    }
-  }
-  for (let i = 0; i < permissionSets.length; i++) {
-    const ps = permissionSets[i];
-    if (!ps || typeof ps !== "object") continue;
-    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
-  }
-  for (const [i, pos] of asArray35(stack.positions).entries()) {
-    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
-  }
-  for (const [i, app] of asArray35(stack.apps).entries()) {
-    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
-  }
-  for (const [i, book] of asArray35(stack.books).entries()) {
-    flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
-  }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
-  for (const [i, book] of asArray35(stack.books).entries()) {
+  for (const [i, book] of asArray36(stack.books).entries()) {
     const audience = book.audience;
     if (!audience || typeof audience !== "object") continue;
     const setName = audience.permissionSet;
@@ -7254,7 +7653,7 @@ function validateSecurityPosture(stack, opts) {
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
   const nowMs = opts?.nowMs ?? Date.now();
-  for (const [i, seed] of asArray35(stack.data).entries()) {
+  for (const [i, seed] of asArray36(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
     if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
     const records = Array.isArray(seed.records) ? seed.records : [];
@@ -7293,13 +7692,67 @@ function validateSecurityPosture(stack, opts) {
   }
   return findings;
 }
+function validateSecurityRoleWord(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objects = asArray36(stack.objects);
+  const permissionSets = asArray36(stack.permissions);
+  const flagRole = (kind, name, label2, where, path) => {
+    if (identifierHasRoleToken(name)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path,
+        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
+        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
+      });
+    } else if (labelHasRoleWord(label2)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path: `${path.replace(/\.name$/, "")}.label`,
+        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
+        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
+      });
+    }
+  };
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
+    for (const f of asArray36(obj.fields)) {
+      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
+    }
+    for (const [ai, action] of asArray36(obj.actions).entries()) {
+      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
+    }
+  }
+  for (let i = 0; i < permissionSets.length; i++) {
+    const ps = permissionSets[i];
+    if (!ps || typeof ps !== "object") continue;
+    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
+  }
+  for (const [i, pos] of asArray36(stack.positions).entries()) {
+    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
+  }
+  for (const [i, app] of asArray36(stack.apps).entries()) {
+    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
+  }
+  for (const [i, book] of asArray36(stack.books).entries()) {
+    flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
+  }
+  return findings;
+}
 
 // src/validate-org-axis-red-lines.ts
 var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
 var ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
 var ORG_PARENT_FIELD = "parent_organization_id";
 var BU_TREE_RECIPIENT_TYPES = /* @__PURE__ */ new Set(["business_unit", "unit_and_subordinates"]);
-function asArray36(v) {
+function asArray37(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -7329,9 +7782,9 @@ var INHERITANCE_HINT = `Remove the ${ORG_PARENT_FIELD} reference. Cross-organiza
 function validateOrgAxisRedLines(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  const permissionSets = asArray36(cfg.permissions);
+  const permissionSets = asArray37(cfg.permissions);
   permissionSets.forEach((ps, psIndex) => {
-    asArray36(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+    asArray37(ps.rowLevelSecurity).forEach((policy, pIndex) => {
       for (const clause of ["using", "check"]) {
         if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
         findings.push({
@@ -7345,7 +7798,7 @@ function validateOrgAxisRedLines(stack) {
       }
     });
   });
-  asArray36(cfg.sharingRules).forEach((rule, rIndex) => {
+  asArray37(cfg.sharingRules).forEach((rule, rIndex) => {
     const slots = [
       { key: "condition", text: expressionText(rule.condition) },
       { key: "sharedWith", text: JSON.stringify(rule.sharedWith ?? "") ?? "" }
@@ -7363,9 +7816,9 @@ function validateOrgAxisRedLines(stack) {
     }
   });
   const tenancyDisabledObjects = new Set(
-    asArray36(cfg.objects).filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
+    asArray37(cfg.objects).filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
   );
-  asArray36(cfg.sharingRules).forEach((rule, rIndex) => {
+  asArray37(cfg.sharingRules).forEach((rule, rIndex) => {
     const target = str(rule.object);
     if (!target || !tenancyDisabledObjects.has(target)) return;
     const sharedWith = rule.sharedWith;
@@ -7388,7 +7841,7 @@ function validateOrgAxisRedLines(stack) {
 var import_formula6 = require("@objectstack/formula");
 var SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
 var SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
-function asArray37(v) {
+function asArray38(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -7415,7 +7868,7 @@ var PUSHDOWN_SUBSET = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in
 function validateSharingRuleEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  asArray37(cfg.sharingRules).forEach((rule, index) => {
+  asArray38(cfg.sharingRules).forEach((rule, index) => {
     const input = toCompilerInput(rule.condition);
     if (input === null) return;
     const result = (0, import_formula6.compileCelToFilter)(input, { variables: {} });
@@ -7455,7 +7908,7 @@ var import_formula7 = require("@objectstack/formula");
 var RLS_PREDICATE_UNENFORCEABLE = "rls-predicate-unenforceable";
 var RLS_PREDICATE_UNPARSEABLE = "rls-predicate-unparseable";
 var RLS_PREDICATE_OVER_BUDGET = "rls-predicate-over-budget";
-function asArray38(v) {
+function asArray39(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -7480,8 +7933,8 @@ function consequence(clause) {
 function validateRlsPredicateEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
-  asArray38(cfg.permissions).forEach((ps, psIndex) => {
-    asArray38(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+  asArray39(cfg.permissions).forEach((ps, psIndex) => {
+    asArray39(ps.rowLevelSecurity).forEach((policy, pIndex) => {
       for (const clause of ["using", "check"]) {
         const source = str3(policy[clause]);
         if (!source.trim()) continue;
@@ -7541,11 +7994,11 @@ var import_meta4 = {};
 var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
 var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
 var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
-var isRec20 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-function asArray39(v) {
-  if (Array.isArray(v)) return v.filter(isRec20);
-  if (isRec20(v)) {
-    return Object.entries(v).filter(([, def]) => isRec20(def)).map(([name, def]) => ({ name, ...def }));
+var isRec23 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray40(v) {
+  if (Array.isArray(v)) return v.filter(isRec23);
+  if (isRec23(v)) {
+    return Object.entries(v).filter(([, def]) => isRec23(def)).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
@@ -7562,7 +8015,7 @@ function loadAjv() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
     );
   }
-  const ctor = isRec20(mod) && "default" in mod ? mod.default : mod;
+  const ctor = isRec23(mod) && "default" in mod ? mod.default : mod;
   cachedAjv = ctor;
   return ctor;
 }
@@ -7577,7 +8030,7 @@ function loadAddFormats() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
     );
   }
-  const plugin = isRec20(mod) && "default" in mod ? mod.default : mod;
+  const plugin = isRec23(mod) && "default" in mod ? mod.default : mod;
   cachedAddFormats = plugin;
   return plugin;
 }
@@ -7607,17 +8060,17 @@ function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
   if (depth >= MAX_RULE_NESTING_DEPTH) return out;
   for (const branch of ["then", "otherwise"]) {
     const nested = rule[branch];
-    if (isRec20(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+    if (isRec23(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
   }
   return out;
 }
 function walkObjectValidationRules(stack) {
   const walked = [];
-  if (!isRec20(stack)) return walked;
-  for (const obj of asArray39(stack.objects)) {
+  if (!isRec23(stack)) return walked;
+  for (const obj of asArray40(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     const validations = obj.validations;
-    for (const authored of asArray39(validations)) {
+    for (const authored of asArray40(validations)) {
       for (const { rule, label: label2, path } of flattenRules(authored, "", "")) {
         walked.push({
           rule,
@@ -7648,7 +8101,7 @@ function validateRuleCompilability(stack) {
         });
       }
     }
-    if (rule.type === "json_schema" && isRec20(rule.schema)) {
+    if (rule.type === "json_schema" && isRec23(rule.schema)) {
       try {
         createRuntimeAjv().compile(rule.schema);
       } catch (err) {
@@ -7668,7 +8121,7 @@ function validateRuleCompilability(stack) {
 
 // src/validate-rule-schema-formats.ts
 var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
-var isRec21 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec24 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var SUBSCHEMA_KEYS = [
   "additionalItems",
   "additionalProperties",
@@ -7692,7 +8145,7 @@ var SUBSCHEMA_MAP_KEYS = [
 var MAX_SCHEMA_WALK_DEPTH = 32;
 var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
 function collectFormatUses(schema, pointer, out, depth) {
-  if (!isRec21(schema)) return;
+  if (!isRec24(schema)) return;
   if (typeof schema.format === "string") {
     out.push({ pointer: `${pointer}/format`, name: schema.format });
   }
@@ -7711,7 +8164,7 @@ function collectFormatUses(schema, pointer, out, depth) {
   }
   for (const key of SUBSCHEMA_MAP_KEYS) {
     const value = schema[key];
-    if (!isRec21(value)) continue;
+    if (!isRec24(value)) continue;
     for (const [name, entry] of Object.entries(value)) {
       collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
     }
@@ -7719,13 +8172,13 @@ function collectFormatUses(schema, pointer, out, depth) {
   const items = schema.items;
   if (Array.isArray(items)) {
     items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
-  } else if (isRec21(items)) {
+  } else if (isRec24(items)) {
     collectFormatUses(items, `${pointer}/items`, out, depth + 1);
   }
   const dependencies = schema.dependencies;
-  if (isRec21(dependencies)) {
+  if (isRec24(dependencies)) {
     for (const [name, entry] of Object.entries(dependencies)) {
-      if (!isRec21(entry)) continue;
+      if (!isRec24(entry)) continue;
       collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
     }
   }
@@ -7764,7 +8217,7 @@ function validateRuleSchemaFormats(stack) {
   const findings = [];
   const pending = [];
   for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
-    if (rule.type !== "json_schema" || !isRec21(rule.schema)) continue;
+    if (rule.type !== "json_schema" || !isRec24(rule.schema)) continue;
     const uses = [];
     collectFormatUses(rule.schema, "", uses, 0);
     for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
@@ -7790,14 +8243,14 @@ function validateRuleSchemaFormats(stack) {
 
 // src/validate-action-locations.ts
 var ACTION_NO_PLACEMENT = "action-no-placement";
-function asArray40(v) {
+function asArray41(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName19(v) {
+function strName20(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
@@ -7811,8 +8264,8 @@ function collectNamePlacedActions(stack) {
     for (const key of ["rowActions", "bulkActions"]) {
       for (const n of strList3(list3[key])) placed.add(n);
     }
-    for (const def of asArray40(list3.bulkActionDefs)) {
-      const n = strName19(def?.name);
+    for (const def of asArray41(list3.bulkActionDefs)) {
+      const n = strName20(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -7820,12 +8273,12 @@ function collectNamePlacedActions(stack) {
     if (!listViews || typeof listViews !== "object" || Array.isArray(listViews)) return;
     for (const lv of Object.values(listViews)) harvest(lv);
   };
-  for (const view of asArray40(stack.views)) {
+  for (const view of asArray41(stack.views)) {
     if (!view || typeof view !== "object") continue;
     harvest(view.list);
     harvestListViews(view.listViews);
   }
-  for (const obj of asArray40(stack.objects)) {
+  for (const obj of asArray41(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     harvestListViews(obj.listViews);
   }
@@ -7838,7 +8291,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName19(action.name);
+    const name = strName20(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -7850,13 +8303,13 @@ function validateActionLocations(stack) {
       hint: "Add the surface it belongs on, e.g. `locations: ['record_header']` (or `list_item`, `list_toolbar`, `record_more`, `record_section`, `record_related`); or place it from a list view's `bulkActions` / `bulkActionDefs` if it acts on a selection. If it is meant to be callable over REST / MCP / AI with no UI surface, say so explicitly with `locations: []` \u2014 an empty array is the documented headless shape and is never flagged."
     });
   };
-  const actions = asArray40(stack.actions);
+  const actions = asArray41(stack.actions);
   for (let i = 0; i < actions.length; i++) check(actions[i], `actions[${i}]`);
-  const objects = asArray40(stack.objects);
+  const objects = asArray41(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
     if (!obj || typeof obj !== "object") continue;
-    const own = asArray40(obj.actions);
+    const own = asArray41(obj.actions);
     for (let ai = 0; ai < own.length; ai++) check(own[ai], `objects[${oi}].actions[${ai}]`);
   }
   return findings;
@@ -7864,8 +8317,8 @@ function validateActionLocations(stack) {
 
 // src/lint-flow-patterns.ts
 var import_automation5 = require("@objectstack/spec/automation");
-var import_data8 = require("@objectstack/spec/data");
-function asArray41(v) {
+var import_data10 = require("@objectstack/spec/data");
+function asArray42(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -8139,7 +8592,7 @@ function scanBranchRouting(at, nodes, edges, findings) {
 function filterCarriesNoCondition(filter) {
   if (filter === void 0 || filter === null) return true;
   if (typeof filter !== "object" || Array.isArray(filter)) return false;
-  return (0, import_data8.reduceFilterVerdict)(filter) === "true";
+  return (0, import_data10.reduceFilterVerdict)(filter) === "true";
 }
 function describeUnboundedFilter(filter) {
   if (filter === void 0 || filter === null) return "no `filter` key";
@@ -8249,7 +8702,7 @@ function scanApprovalReviseLoops(at, nodes, edges, findings) {
 }
 function lintFlowPatterns(stack) {
   const findings = [];
-  for (const flow of asArray41(stack.flows)) {
+  for (const flow of asArray42(stack.flows)) {
     const flowName = typeof flow.name === "string" ? flow.name : "(unnamed flow)";
     const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
     const edges = Array.isArray(flow.edges) ? flow.edges : [];
@@ -8347,7 +8800,7 @@ var import_node_fs = require("fs");
 var import_meta5 = {};
 var LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
 var LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
-function asArray42(v) {
+function asArray43(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -8484,11 +8937,11 @@ function lintLivenessProperties(stack) {
   const findings = [];
   const objectWarn = loadWarnMap(dir, "object");
   const fieldWarn = loadWarnMap(dir, "field");
-  for (const obj of asArray42(stack.objects)) {
+  for (const obj of asArray43(stack.objects)) {
     const objName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     if (objectWarn.size > 0) checkItem("object", obj, `object '${objName}'`, objectWarn, findings);
     if (fieldWarn.size > 0) {
-      for (const field of asArray42(obj.fields)) {
+      for (const field of asArray43(obj.fields)) {
         const fieldName = typeof field.name === "string" ? field.name : "(unnamed field)";
         checkItem("field", field, `object '${objName}' \xB7 field '${fieldName}'`, fieldWarn, findings);
       }
@@ -8497,7 +8950,7 @@ function lintLivenessProperties(stack) {
   for (const { type, key } of TYPE_COLLECTIONS) {
     const warnMap = loadWarnMap(dir, type);
     if (warnMap.size === 0) continue;
-    for (const item of asArray42(stack[key])) {
+    for (const item of asArray43(stack[key])) {
       const name = typeof item.name === "string" ? item.name : typeof item.object === "string" ? item.object : `(unnamed ${type})`;
       checkItem(type, item, `${type} '${name}'`, warnMap, findings);
     }
@@ -8506,12 +8959,12 @@ function lintLivenessProperties(stack) {
 }
 
 // src/lint-autonumber-formats.ts
-var import_data9 = require("@objectstack/spec/data");
+var import_data11 = require("@objectstack/spec/data");
 var AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
 var AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
 var AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
 var AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
-function asArray43(v) {
+function asArray44(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -8520,9 +8973,9 @@ function asArray43(v) {
 }
 function lintAutonumberFormats(stack) {
   const findings = [];
-  for (const obj of asArray43(stack.objects)) {
+  for (const obj of asArray44(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
-    const fields = asArray43(obj.fields);
+    const fields = asArray44(obj.fields);
     const fieldMeta = /* @__PURE__ */ new Map();
     for (const f of fields) {
       if (typeof f.name === "string") fieldMeta.set(f.name, { required: f.required === true });
@@ -8532,8 +8985,8 @@ function lintAutonumberFormats(stack) {
       const name = typeof f.name === "string" ? f.name : "(unnamed field)";
       const fmt = typeof f.autonumberFormat === "string" ? f.autonumberFormat : typeof f.format === "string" ? f.format : "";
       if (!fmt) continue;
-      const tokens = (0, import_data9.parseAutonumberFormat)(fmt);
-      const refs = (0, import_data9.referencedFields)(tokens);
+      const tokens = (0, import_data11.parseAutonumberFormat)(fmt);
+      const refs = (0, import_data11.referencedFields)(tokens);
       const where = `object '${objectName}' \xB7 field '${name}' (autonumber "${fmt}")`;
       for (const t of tokens) {
         if (t.kind !== "literal") continue;
@@ -8588,7 +9041,7 @@ function lintAutonumberFormats(stack) {
 
 // src/lint-view-refs.ts
 var import_spec5 = require("@objectstack/spec");
-function asArray44(v) {
+function asArray45(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   return [];
@@ -8616,7 +9069,7 @@ function lintViewRefs(stack) {
     s.add(kind);
   };
   const containers = [];
-  for (const v of asArray44(stack.views)) {
+  for (const v of asArray45(stack.views)) {
     if (v.viewKind) {
       if (typeof v.name === "string") indexKind(v.name, v.viewKind === "form" ? "form" : "list");
       continue;
@@ -8625,7 +9078,7 @@ function lintViewRefs(stack) {
     const object = viewContainerObjectName(v);
     if (object) containers.push({ object, container: v });
   }
-  for (const obj of asArray44(stack.objects)) {
+  for (const obj of asArray45(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
     if (!object) continue;
     if (obj.list || obj.form || obj.listViews || obj.formViews) {
@@ -8679,11 +9132,11 @@ function lintViewRefs(stack) {
       });
     }
   };
-  for (const obj of asArray44(stack.objects)) {
+  for (const obj of asArray45(stack.objects)) {
     const object = typeof obj.name === "string" ? obj.name : void 0;
-    for (const action of asArray44(obj.actions)) checkAction(action, object);
+    for (const action of asArray45(obj.actions)) checkAction(action, object);
   }
-  for (const action of asArray44(stack.actions)) checkAction(action);
+  for (const action of asArray45(stack.actions)) checkAction(action);
   return findings;
 }
 
@@ -8818,7 +9271,6 @@ var CLI_ONLY = ["cli"];
 var CLI_AND_RUNTIME = ["cli", "runtime-publish"];
 var RUNTIME_NEEDS_FULL_SNAPSHOT = "P2 (#4463): reads a stack-wide collection the per-write snapshot does not carry, so running it now would report the rest of the tenant's metadata as missing rather than judging this write.";
 var RUNTIME_HEAVY_SOURCE_PARSE = "Not runtime-safe: parses authored source through typescript/sucrase, the two dependencies the kernel boot path must never load (lazy-deps.test.ts). Studio compiles page source on its own path.";
-var RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY = "Deliberate, and not a snapshot limitation: this rule needs only the written item, but every other rule on the `views[]` visibility-predicate surface (validate-visibility-predicates.ts) is CLI-only. Gating one of three sibling verdicts about the same predicate at the Studio door is less predictable than gating none; move the family together, as one measured edit.";
 var RUNTIME_OBJECT_WRITES_P2 = "P2 (#4463): judges an object/field declaration. Object writes are the hottest metadata path in the product, so P1 gates `flow` first and widens once the gate has real traffic behind it.";
 var EXPRESSION_INVALID = "expression-invalid";
 var AUTHORING_RULES = [
@@ -8884,6 +9336,31 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_OBJECT_WRITES_P2,
     run: (stack) => validateFunctionalCompleteness(stack)
   },
+  // [#7521, via cloud#1225] A managed object advertising a generic write verb
+  // in `enable.apiMethods` that its own resolved affordances refuse. Every key
+  // is one we know and each is individually valid, so #4001's unknown-key
+  // rejection and the Zod parse both pass it; the contradiction is only visible
+  // when the two keys are read TOGETHER, which nothing did at authoring time.
+  //
+  // `gating` because the declaration is already false when it ships: objectql's
+  // registry strips the verb at registration, so the metadata advertises an API
+  // the product does not serve. That strip has been correct and silent — a
+  // `console.warn` on every control-plane boot that went unread for the life of
+  // a real divergence (`sys_environment`/`sys_package`). This entry is the
+  // ruling's "close it where the author is"; boot stays warn-and-strip.
+  //
+  // Pre-parse: the predicate reads only authored keys, and the finding must
+  // survive an unrelated schema error elsewhere in the stack.
+  {
+    name: "validateManagedApiMethods",
+    tier: "gating",
+    input: "normalized",
+    commands: ALL,
+    source: "packages/lint/src/validate-managed-api-methods.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    run: (stack) => validateManagedApiMethods(stack)
+  },
   // A view container in `views: []` that registers zero views: nothing appears
   // in the Console, and the schema step cannot tell it from an intentionally
   // empty one. The FLAT-list-view arm no longer needs this tier — `ViewSchema`
@@ -9263,14 +9740,47 @@ var AUTHORING_RULES = [
   // what decides whether any given diagnostic gates, exactly as `lintFlowPatterns`
   // has worked since #3760. The promotion follows the #5762 precedent: a family
   // that gains an `error` finding moves its registry tier in the same edit.
+  //
+  // ─── The `views[]` visibility-predicate FAMILY at the runtime door (#7220) ───
+  //
+  // This entry and `validatePredicatePathRefs` below moved to `runtime-publish`
+  // in ONE edit, on the maintainer's 2026-08-10 ruling, sequenced after #4717's
+  // `advisories` channel landed (PR #7435). Before that move a `view` written
+  // through Studio / REST `/meta` / MCP — the only door most tenants have, and
+  // the door AI authors use — was judged by NONE of the family's rule ids (six
+  // at the time of the move; seven since #7659 added
+  // `predicate-rhs-path-shaped` inside the second entry).
+  //
+  // They move together on purpose, and the two entries carry one comment because
+  // they are one wall: #7214's implementer wired its own rule here alone and then
+  // REVERTED it, because a `view` refused for an unresolvable predicate PATH
+  // while a predicate that does not parse at all walks through the same door is
+  // less predictable than refusing neither. A half-wired wall is worse than an
+  // unwired one, so `authoring-rule-wiring.test.ts` now pins the family property
+  // directly: every id on this surface is gated at the runtime door, or none is.
+  //
+  // The previous `surfaceReason` on THIS entry was `RUNTIME_NEEDS_FULL_SNAPSHOT`,
+  // and re-measuring it at move time found it false: both rule functions read
+  // `stack.views` and `stack.pages` and NO other collection — never `objects` —
+  // so the per-write snapshot the gate builds is not partial for them, it is
+  // complete. (`pages` is simply absent on a `view` write, so the page half
+  // contributes zero findings to both differential passes rather than inventing
+  // any.) The reason was not describing this rule; it was the default a rule got
+  // when nobody measured, which is the #4409/#4463 defect one layer in.
+  //
+  // Runtime input tier: the gate hands the rules the body as persisted, without
+  // `normalizeStackInput`, so the ADR-0087 D2 alias fold does NOT run at this
+  // door. That costs the family nothing — `validateVisibilityPredicates` reads
+  // `visibleWhen ?? visibleOn ?? visibility` itself, canonical-first, precisely
+  // so a caller handing it a raw authored object still gets a verdict.
   {
     name: "validateVisibilityPredicates",
     tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-visibility-predicates.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["view"],
     run: (stack) => validateVisibilityPredicates(stack)
   },
   // #7010 — the same predicate surface, one question further in. The three
@@ -9287,14 +9797,28 @@ var AUTHORING_RULES = [
   // object's addressable path set is NOT closed (lookup traversal, system
   // columns, formula outputs), and an `error` gate over an open set generates
   // false build errors. See the rule's module note.
+  //
+  // #7659 adds a THIRD id here, `predicate-rhs-path-shaped`, which is not a
+  // resolution question at all: the metadata-admin renderer resolves paths only
+  // on the LEFT of `==` / `!=` and hands the right side to its literal parser,
+  // so `data.a == data.b` resolves both sides cleanly, passes the two rules
+  // above, and still compares against the string "data.b" — a constant verdict.
+  // It carries `error` on a dotted chain (no reading under which it worked) and
+  // `warning` on a bare word (`status == active` compares as the text today, so
+  // refusing it would fail a build over metadata that renders correctly). The
+  // per-finding severity is what gates, exactly as `lintFlowPatterns` has worked
+  // since #3760; the entry's `gating` tier is unchanged because it already was.
   {
     name: "validatePredicatePathRefs",
     tier: "gating",
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-predicate-path-refs.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_VISIBILITY_FAMILY_IS_CLI_ONLY,
+    // The second half of the #7220 family move — see the block above the
+    // `validateVisibilityPredicates` entry. This is the rule whose solo wiring
+    // was reverted; it is wired now because its siblings are.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["view"],
     run: (stack) => validatePredicatePathRefs(stack)
   },
   // #1874 — flow authoring anti-patterns. Advisory by default; a finding marked
@@ -9454,16 +9978,110 @@ var AUTHORING_RULES = [
   // a runtime enforcement point (fail-closed OWD default, canonical enum, anchor
   // binding gate, vocabulary freeze), moving the failure from a runtime deny to
   // an author-time fix-it. Per ADR-0049 this is not advisory security.
+  //
+  // [#7576] The `surfaceReason` below is MEASURED. Its predecessor was not, and
+  // was false in both halves — it read: "Already gated at this surface by a
+  // DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on
+  // `object` (`registerAuthoringGate`) that enforces the same OWD posture rules
+  // on every runtime write. Running the linter here as well would double-report
+  // one refusal in two vocabularies."
+  //
+  //  - COVERAGE. `object-posture-gate.ts` reads exactly `sharingModel` and
+  //    `externalSharingModel` through a local `OWD_WIDTH`, and never touches
+  //    `fields`, `permissions`, `books` or `data`. Of the THIRTEEN rule ids this
+  //    block carries it covers ONE — `security-external-wider-than-internal`
+  //    (its R2). The gate's other half, R1 (env-tighten-only, ADR-0086 D1),
+  //    corresponds to no lint rule at all, so it is not coverage in the other
+  //    direction either. Twelve rules were enforced at no runtime door while
+  //    this field said they were.
+  //  - DOUBLE-REPORTING. It cannot happen, and not by luck: `saveMetaItem` runs
+  //    `assertRuntimeAuthoringRules` (this table, 422 `invalid_metadata`) BEFORE
+  //    `runAuthoringGate` (the ADR-0094 gate, 403 `owd_external_wider`), and
+  //    both refuse by THROWING. The first to fire ends the write, so an author
+  //    sees one refusal, never two. The stated cost of moving was imaginary; the
+  //    reason it has not moved is the measured one below.
+  //
+  // The move IS taken now — the #7891 programme's three slices, in order:
+  //
+  //  - #8307: the ADR-0091 seed pair crossed (`runtimeTypes: ['seed']`), with
+  //    the isolation proof that the differential cancels every finding this
+  //    function derives from the sibling collections.
+  //  - #8309: the snapshot repair. The gate used to carry `objects` and
+  //    nothing else, so the three cross-collection rules judged a universe
+  //    missing the collection they compare against (measured: 38 phantom
+  //    `security-master-detail-ungranted` per-write vs 4 whole-stack,
+  //    PR #7886). `RuntimeStackContext` now carries `permissions`/`books` in
+  //    BOTH differential passes and `TYPE_TO_STACK_KEY` maps both types.
+  //  - #8310 slice 1: `runtimeTypes` gains `permission` + `book` (PR #8546).
+  //    `object` measured DIRTY on that tree and was escalated, not forced.
+  //  - #8310 slice 2 (this state): `object` crosses under the maintainer
+  //    ruling recorded on #8310 (2026-08-13, 「接受你的全部建议」): an
+  //    authored OWD is REQUIRED at the runtime object door — an object
+  //    publish with no authored `sharingModel` is refused with the 422 lint
+  //    envelope (`security-owd-unset`); absence is not a decision. The ~16
+  //    objectql/rest suite files that relied on OWD-less publishes were
+  //    repaired honestly (fixtures author their posture), and
+  //    `meta-object-owd-gate.test.ts` re-pins the door ORDER: this table
+  //    answers first (`saveMetaItem` runs it before `runAuthoringGate`), the
+  //    ADR-0094-seam 403 doors answer for what passes lint. The same ruling
+  //    retired the plugin gate's R2 `owd_external_wider` arm as a duplicate
+  //    of this door (R1 env-tighten-only STAYS — no lint rule covers it);
+  //    see `object-posture-gate.ts` and the ADR-0094 amendment.
+  //
+  // `security-role-word` is NOT in this entry any more — that is what the
+  // `validateSecurityRoleWord` entry below records. It judges six collections
+  // (objects, fields, actions, permission sets, positions, apps — plus books),
+  // and `positions`/`apps` are neither carried by the per-write snapshot nor
+  // mapped in `TYPE_TO_STACK_KEY`, so declaring `permission`/`book` on a
+  // function that still contained it would have enforced ONE rule id for a
+  // strict subset of its collections: a door where a permission set named
+  // `role_manager` is refused and a position named `sales_role` walks through
+  // — the #7220 failure this table refuses to build, in either direction. The
+  // rule therefore stays behind WHOLE (#8310's explicit call), as its own
+  // entry.
+  //
+  // This entry remains the rest of the D7 block (12 rule ids) as ONE
+  // registration, not a per-rule split: the baseline/candidate differential is
+  // what keeps a write of one declared type from leaking the other rules'
+  // whole-stack findings — every finding derived from a sibling collection is
+  // produced byte-identically in both passes and cancels in the diff. Only
+  // findings the written item itself adds are attributed to the write.
   {
     name: "validateSecurityPosture",
     tier: "gating",
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-security-posture.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: "Already gated at this surface by a DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on `object` (`registerAuthoringGate`) that enforces the same OWD posture rules on every runtime write. Running the linter here as well would double-report one refusal in two vocabularies. Consolidating the two onto this table is P2 (#4463), and is a merge, not a hole.",
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["seed", "permission", "book", "object"],
     run: (stack) => validateSecurityPosture(stack)
   },
+  // [ADR-0090 D3 / #8310] The vocabulary freeze, split out of
+  // `validateSecurityPosture` the day the rest of that block crossed the
+  // runtime wall — so that it could stay behind WHOLE rather than cross for
+  // three of the six collections it judges (#7220: one rule id must sit on ONE
+  // side of the wall). The split is a surface boundary, not taste: the rule's
+  // verdict and findings are byte-identical to before on every CLI command
+  // (both entries run on all three), and the runtime door does not run it for
+  // ANY type.
+  //
+  // The road to crossing is concrete and short, recorded here so the next
+  // seat prices it correctly: carry `positions`/`apps` in
+  // `RuntimeStackContext` + `CONTEXT_STACK_KEYS`, map both types in
+  // `TYPE_TO_STACK_KEY` (both are `allowRuntimeCreate: true`, so the writes
+  // are real), then declare `runtimeTypes: ['object', 'permission', 'book',
+  // 'position', 'app']` on THIS entry — all six collections in one edit, the
+  // #7220 discipline satisfied.
+  {
+    name: "validateSecurityRoleWord",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-security-posture.ts",
+    surfaces: CLI_ONLY,
+    surfaceReason: "P2 (#4463)/#8310: judges six collections (objects, fields, actions, permission sets, positions, apps \u2014 plus books), and the per-write snapshot neither carries nor maps positions/apps. Wiring it for the mapped types alone would enforce one rule id for three of its six collections \u2014 the #7220 split (an object named sales_role refused while a position named sales_role walks through). It crosses whole \u2014 positions/apps carried, mapped and declared \u2014 or stays behind; it stays behind until that wiring exists.",
+    run: (stack) => validateSecurityRoleWord(stack)
+  },
   // ADR-0105 D6 — the org tree is a REPORTING dimension. An RLS policy or
   // sharing rule that walks it builds a second permission hierarchy (the
   // dual-hierarchy mistake ADR-0057 D5 retired) and cannot widen Layer 0 anyway,
@@ -9514,7 +10132,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-rls-predicate-enforceability.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: "P2 (#4463): the rule reads `stack.permissions[]`, a stack-wide collection the per-write snapshot does not carry, and P1 gates `flow` alone. It is otherwise snapshot-ready \u2014 it needs no other collection \u2014 so widening it is a `runtimeTypes: ['permission_set']` edit once the gate builds that snapshot, not new wiring. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
+    surfaceReason: "The rule reads `stack.permissions[]`, which the per-write snapshot DOES carry since #8309 \u2014 the remaining gap is only the declaration: no `runtimeTypes` names `permission` here, and that flip is a rollout decision on #8310's axis, not a wiring fix. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
     run: (stack) => validateRlsPredicateEnforceability(stack)
   },
   // #4762 — the same "declared but enforces nothing" question, for the two
@@ -9572,8 +10190,34 @@ var TYPE_TO_STACK_KEY = {
   dashboard: "dashboards",
   agent: "agents",
   hook: "hooks",
-  seed: "seeds"
+  // [#7576] `data`, NOT `seeds`. The metadata TYPE is `seed`; the stack KEY that
+  // holds seeds is `data` (`ObjectStackDefinitionSchema.data: z.array(SeedSchema)`)
+  // — a stack has no `seeds` key at all, and `PLURAL_TO_SINGULAR` declares no
+  // mapping onto one either.
+  //
+  // The wrong spelling was INERT rather than harmless, and it is the #4449 shape
+  // one surface over: the wiring guard asks only that a declared type HAS a
+  // mapping, never that the mapping names a key some rule reads. So it would
+  // have stayed green while the gate built `{ objects, seeds: [item] }` for
+  // every seed write and every rule reading `stack.data` saw nothing — wired,
+  // and running on nothing, with `rulesRun` reporting the rules as having run.
+  // Nothing declared `seed` in `runtimeTypes` at the time, so correcting it
+  // changed no behaviour then; it was corrected here, with the measurement
+  // that found it (#7576), rather than left for the rollout card to trip
+  // over. The ADR-0091 seed pair now DOES declare `seed` (#8307), so this
+  // mapping is load-bearing today, not merely inert-and-correct.
+  seed: "data",
+  // [#8309] `permission`/`book` map ahead of their registration (#8310), the
+  // same order `seed` arrived in: the mapping plus the enriched snapshot below
+  // are this card's halves, and the `runtimeTypes` flip is deliberately NOT —
+  // a mapping without a declaring rule is inert by construction (the gate
+  // filters by `runtimeTypes` before it ever consults this table), while a
+  // declaration without the mapping is the wired-onto-nothing state the wiring
+  // guard refuses. Landing the mapping first keeps #8310 a registry data edit.
+  permission: "permissions",
+  book: "books"
 };
+var CONTEXT_STACK_KEYS = ["objects", "permissions", "books"];
 function runtimeAuthoringRulesFor(type) {
   return AUTHORING_RULES.filter(
     (r) => r.surfaces.includes("runtime-publish") && (r.runtimeTypes ?? []).includes(type)
@@ -9591,6 +10235,23 @@ function stackKeyForType(type) {
   return TYPE_TO_STACK_KEY[type] ?? null;
 }
 var fingerprint = (f) => `${f.rule}\0${f.where}\0${f.path}\0${f.message}`;
+function buildRuntimeWriteSnapshots(args) {
+  const stackKey = stackKeyForType(args.type);
+  if (!stackKey) return null;
+  if (!args.item || typeof args.item !== "object") return null;
+  const item = args.item;
+  const itemName = typeof item.name === "string" ? item.name : void 0;
+  const baseline = {};
+  for (const key of CONTEXT_STACK_KEYS) {
+    const collection = args.context?.[key] ?? [];
+    baseline[key] = key === stackKey ? collection.filter((o) => !itemName || o?.name !== itemName) : collection;
+  }
+  const candidate = {
+    ...baseline,
+    [stackKey]: [...baseline[stackKey] ?? [], item]
+  };
+  return { baseline, candidate };
+}
 function runRules(rules, stack, ctx) {
   const findings = [];
   for (const rule of rules) {
@@ -9613,19 +10274,15 @@ function runRuntimeAuthoringRules(args) {
   const rules = runtimeAuthoringRulesFor(args.type);
   const empty = { errors: [], advisories: [], rulesRun: [] };
   if (rules.length === 0) return empty;
-  const stackKey = stackKeyForType(args.type);
-  if (!stackKey) return empty;
-  if (!args.item || typeof args.item !== "object") return empty;
-  const item = args.item;
-  const itemName = typeof item.name === "string" ? item.name : void 0;
-  const contextObjects = args.context?.objects ?? [];
+  const snapshots = buildRuntimeWriteSnapshots({
+    type: args.type,
+    item: args.item,
+    ...args.context !== void 0 ? { context: args.context } : {}
+  });
+  if (!snapshots) return empty;
   const ctx = { sduiManifest: args.sduiManifest };
-  const writesIntoContext = stackKey === "objects";
-  const baselineObjects = writesIntoContext ? contextObjects.filter((o) => !itemName || o?.name !== itemName) : contextObjects;
-  const baseline = { objects: baselineObjects };
-  const candidate = writesIntoContext ? { objects: [...baselineObjects, item] } : { objects: baselineObjects, [stackKey]: [item] };
-  const before = new Set(runRules(rules, baseline, ctx).map(fingerprint));
-  const added = runRules(rules, candidate, ctx).filter((f) => !before.has(fingerprint(f)));
+  const before = new Set(runRules(rules, snapshots.baseline, ctx).map(fingerprint));
+  const added = runRules(rules, snapshots.candidate, ctx).filter((f) => !before.has(fingerprint(f)));
   return {
     errors: added.filter((f) => f.severity === "error"),
     advisories: added.filter((f) => f.severity !== "error"),
@@ -9634,6 +10291,7 @@ function runRuntimeAuthoringRules(args) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  buildRuntimeWriteSnapshots,
   runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor,
   runtimeGatedTypes,