@objectstack/lint 17.0.0-rc.6 → 17.1.0

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import { Manifest } from '@objectstack/sdui-parser';
+import { SearchFieldMeta } from '@objectstack/spec/data';
 import { Options } from 'ajv';
 import { AccessMatrixParsed } from '@objectstack/spec/security';
-export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimeStackContext, m as authoringRulesFor, r as runAuthoringRules, n as runRuntimeAuthoringRules, o as runtimeAuthoringRulesFor, p as runtimeGatedTypes, s as splitBySeverity, q as stackKeyForType } from './runtime-B50yywI_.js';
+export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimePackageScope, m as RuntimeStackContext, n as authoringRulesFor, o as buildRuntimeWriteSnapshots, p as narrowObjectsToPackageClosure, r as runAuthoringRules, q as runRuntimeAuthoringRules, s as runtimeAuthoringRulesFor, t as runtimeGatedTypes, u as splitBySeverity, v as stackKeyForType } from './runtime-s3X9D9hm.js';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -68,6 +69,14 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  *   single-form cutover removed. The dashboard renderer routes dataset-bound
  *   widgets through `DatasetWidget` and never reads these, so they are a
  *   silent no-op. Steers the author onto `dataset`+`dimensions`+`values`.
+ * - `dashboard-filter-field-unprovisioned` (#8340) — the filter's effective
+ *   field RESOLVES (it is a registry-injected system column, so
+ *   `dashboard-filter-field-unknown` above rightly stays silent) but the bound
+ *   object is ADR-0015 `external`, where the platform registers the anchor and
+ *   provisions no storage for it. The filter is still ANDed into the query, so
+ *   the widget renders empty instead of crashing — the silent-degradation half
+ *   of the same invariant, warned rather than errored because this pass cannot
+ *   see the remote schema (#8116's severity reasoning).
  *
  * Warnings can be deliberately suppressed per widget via
  * `suppressWarnings: ['<rule-id>']`; errors cannot — they describe a
@@ -83,6 +92,7 @@ declare const MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 declare const WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 declare const WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 declare const DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
+declare const DASHBOARD_FILTER_FIELD_UNPROVISIONED = "dashboard-filter-field-unprovisioned";
 type WidgetBindingSeverity = 'error' | 'warning';
 interface WidgetBindingFinding {
     /** `error` = unresolvable binding (broken page); `warning` = advisory. */
@@ -98,7 +108,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$F = Record<string, unknown>;
+type AnyRec$G = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -106,7 +116,7 @@ type AnyRec$F = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$F): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$G): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -119,12 +129,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$E = Record<string, unknown>;
+type AnyRec$F = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$E): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$F): ExprIssue[];
 
 /**
  * The corrective sentence, lifted **verbatim** from `unevaluableRuleError` in
@@ -305,7 +315,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$D = Record<string, unknown>;
+type AnyRec$E = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -315,7 +325,7 @@ type AnyRec$D = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$D): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$E): ListViewModeFinding[];
 
 type FunctionalCompletenessSeverity = 'error' | 'warning';
 interface FunctionalCompletenessFinding {
@@ -335,6 +345,37 @@ interface FunctionalCompletenessFinding {
  */
 declare function validateFunctionalCompleteness(stack: unknown): FunctionalCompletenessFinding[];
 
+/**
+ * Stable diagnostic id. Named for the CONTRADICTION rather than for the strip,
+ * because at authoring time nothing has been stripped yet — the declaration is
+ * simply advertising something the object cannot honour.
+ */
+declare const MANAGED_API_METHOD_UNAFFORDABLE = "object/managed-api-method-unaffordable";
+interface ManagedApiMethodFinding {
+    /**
+     * Always `error`. The contradiction is decidable from the object's own
+     * declaration — no call graph, no runtime state — and shipping it means the
+     * metadata claims an API surface the registry will silently take away.
+     */
+    severity: 'error';
+    rule: typeof MANAGED_API_METHOD_UNAFFORDABLE;
+    /** Human-readable location, e.g. `object "sys_environment"`. */
+    where: string;
+    /** Config path, e.g. `objects[2].enable.apiMethods`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/**
+ * Walk every object declaration in the stack through the shared
+ * managed-affordance predicate.
+ *
+ * One finding per object, not per verb: an object declaring both `create` and
+ * `update` against an all-locked bucket has ONE authoring mistake, and the fix
+ * — open the affordances or drop the verbs — is a single edit.
+ */
+declare function validateManagedApiMethods(stack: unknown): ManagedApiMethodFinding[];
+
 type FlowTriggerReadinessSeverity = 'error' | 'warning';
 interface FlowTriggerReadinessFinding {
     severity: FlowTriggerReadinessSeverity;
@@ -399,7 +440,7 @@ declare const FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-des
  *     call sites that each skip it.
  */
 declare const FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
-type AnyRec$C = Record<string, unknown>;
+type AnyRec$D = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  *
@@ -408,7 +449,7 @@ type AnyRec$C = Record<string, unknown>;
  * owns the `timeRelative` descriptor's contract, which is the point: the rule
  * ASKS that schema rather than restating it.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$C): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$D): FlowTriggerReadinessFinding[];
 
 type FlowTemplatePathSeverity = 'error' | 'warning';
 interface FlowTemplatePathFinding {
@@ -423,12 +464,13 @@ interface FlowTemplatePathFinding {
 }
 declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
-type AnyRec$B = Record<string, unknown>;
+declare const FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
+type AnyRec$C = Record<string, unknown>;
 /**
  * Validate `{record.<path>}` template references across every record-change
  * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTemplatePaths(stack: AnyRec$B): FlowTemplatePathFinding[];
+declare function validateFlowTemplatePaths(stack: AnyRec$C): FlowTemplatePathFinding[];
 
 type ReadonlyFlowWriteSeverity = 'error' | 'warning';
 interface ReadonlyFlowWriteFinding {
@@ -443,12 +485,12 @@ interface ReadonlyFlowWriteFinding {
 }
 declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-type AnyRec$A = Record<string, unknown>;
+type AnyRec$B = Record<string, unknown>;
 /**
  * Validate flow `update_record` writes against target-object readonly
  * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateReadonlyFlowWrites(stack: AnyRec$A): ReadonlyFlowWriteFinding[];
+declare function validateReadonlyFlowWrites(stack: AnyRec$B): ReadonlyFlowWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -485,14 +527,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$z = Record<string, unknown>;
+type AnyRec$A = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$z): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$A): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -505,8 +547,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$y = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$y, opts?: {
+type AnyRec$z = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$z, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -519,8 +561,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$x = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$x): ReactPageFinding[];
+type AnyRec$y = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$y): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -531,13 +573,14 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$w = Record<string, unknown>;
+type AnyRec$x = Record<string, unknown>;
 declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+declare const REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 declare const REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 declare const REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
-declare function validateReactPageProps(stack: AnyRec$w): ReactPropFinding[];
+declare function validateReactPageProps(stack: AnyRec$x): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -549,8 +592,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$v = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$v): SourceStyleFinding[];
+type AnyRec$w = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$w): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -594,19 +637,20 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$u = Record<string, unknown>;
+type AnyRec$v = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$u): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$v): RecordTitleFinding[];
 
 declare const FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 declare const FIELD_GROUP_EMPTY = "field-group-empty";
 declare const FIELD_GROUP_SHADOWED = "field-group-shadowed";
 declare const SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
+declare const SEMANTIC_ROLE_FIELD_UNPROVISIONED = "semantic-role-field-unprovisioned";
 type SemanticRoleSeverity = 'error' | 'warning';
 interface SemanticRoleFinding {
     /** Always `warning` today — all three rules are advisory (see module note). */
@@ -622,13 +666,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$t = Record<string, unknown>;
+type AnyRec$u = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$t): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$u): SemanticRoleFinding[];
 
 declare const FORM_FIELD_UNKNOWN = "form-field-unknown";
 declare const FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
@@ -647,12 +691,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$s = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$s): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$t): FormLayoutFinding[];
 
 declare const VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 declare const VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
@@ -669,12 +713,24 @@ type VisibilitySeverity = 'error' | 'warning';
 /**
  * Which binding environment the linted surface belongs to (ADR-0089 §Context):
  * - `runtime`  — `*.view.ts` / `*.page.ts`; binds `record` + `current_user` (+ `page`).
- * - `metadata` — `*.form.ts` metadata-editing forms; binds `data` (the row under edit).
+ * - `metadata` — metadata-editing forms (a `*.form.ts` module, or a form view
+ *   declaring `data: { provider: 'schema', schemaId }`); binds `data` (the row
+ *   under edit).
  */
 type VisibilityLayer = 'runtime' | 'metadata';
 /** Options for {@link validateVisibilityPredicates}. */
 interface VisibilityOptions {
-    /** Binding layer of the surface being linted. Defaults to `'runtime'`. */
+    /**
+     * Binding layer for the sites whose layer the metadata does not state.
+     * Defaults to `'runtime'`.
+     *
+     * A form view that declares `data: { provider: 'schema', schemaId }` DOES
+     * state it — the metadata-admin evaluator renders that surface and binds the
+     * row under edit as `data` — so such a site is judged at `'metadata'`
+     * regardless of this option (#7815; see the module note §Which layer a site is
+     * on). Pass `'metadata'` to cover the forms that do not carry that data source
+     * either, which is what a file-aware caller linting a `*.form.ts` does.
+     */
     layer?: VisibilityLayer;
 }
 interface VisibilityFinding {
@@ -696,7 +752,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$r = Record<string, unknown>;
+type AnyRec$s = Record<string, unknown>;
 /**
  * Validate conditional-visibility predicates across authored views and pages.
  *
@@ -712,17 +768,30 @@ type AnyRec$r = Record<string, unknown>;
  * `visibility-predicate-over-budget` (#7217) and `visibility-bare-identifier`
  * (#6128) are `error` and the caller is expected to fail the build on them.
  *
- * The binding-root check is layer-directional (ADR-0089 D3): pass
- * `opts.layer = 'metadata'` when linting a `*.form.ts` metadata-editing form (so a
- * `record.`-rooted predicate is flagged), or leave it at the `'runtime'` default for
- * `*.view.ts` / `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The
- * syntax and bare-identifier checks are layer-agnostic.
+ * The binding-root check is layer-directional (ADR-0089 D3). A form view that
+ * declares `data: { provider: 'schema', schemaId }` is judged at `metadata` on
+ * its own say-so (#7815); for every other site pass `opts.layer = 'metadata'`
+ * when linting a `*.form.ts` metadata-editing form (so a `record.`-rooted
+ * predicate is flagged), or leave it at the `'runtime'` default for `*.view.ts` /
+ * `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The syntax and
+ * bare-identifier checks are layer-agnostic — but the ROOT their hints prescribe
+ * is not, which is the second half of what #7815 fixes.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$r, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$s, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
 declare const PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
-/** Both rules GATE — see the module note for why each is safe at `error`. */
+/**
+ * A `==` / `!=` RIGHT-hand side that is path-shaped — an unquoted identifier
+ * chain (#7659). See the module note's §The right-hand side for the two
+ * severities this one id carries and why they are not the same defect.
+ */
+declare const PREDICATE_RHS_PATH_SHAPED = "predicate-rhs-path-shaped";
+/**
+ * The two path-RESOLUTION rules always GATE; {@link PREDICATE_RHS_PATH_SHAPED}
+ * gates on a dotted chain and is advisory on a bare word — see the module note
+ * for why the same shape earns two answers.
+ */
 type PredicatePathSeverity = 'error' | 'warning';
 interface PredicatePathFinding {
     severity: PredicatePathSeverity;
@@ -751,7 +820,7 @@ interface PredicatePathOptions {
      */
     resolveSchema?: (schemaId: string) => unknown;
 }
-type AnyRec$q = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Refuse a metadata-form predicate that names a path the target schema does not
  * declare (#7010).
@@ -765,15 +834,22 @@ type AnyRec$q = Record<string, unknown>;
  * resolves, is skipped: see the module note for why the `record.*` layer is out
  * of scope rather than merely unimplemented.
  *
- * Both rules emit `error` and the caller is expected to fail the build on them.
- * The corpus measurement behind that severity is on the PR for #7010: over the
- * shipped `METADATA_FORM_REGISTRY` (17 forms, 46 predicates) the count is **0**
- * for both, and 16 for `predicate-path-unrooted` once #6254's pre-fix
- * `object.form.ts` is restored.
+ * Both path-resolution rules emit `error` and the caller is expected to fail the
+ * build on them. The corpus measurement behind that severity is on the PR for
+ * #7010: over the shipped `METADATA_FORM_REGISTRY` (17 forms, 46 predicates) the
+ * count is **0** for both, and 16 for `predicate-path-unrooted` once #6254's
+ * pre-fix `object.form.ts` is restored.
+ *
+ * The third rule, `predicate-rhs-path-shaped` (#7659), asks a different question
+ * about the same predicates — whether a `==` / `!=` RIGHT-hand side is
+ * path-shaped, which the renderer parses as a literal — and carries two
+ * severities: `error` on a dotted chain, `warning` on a bare word. Its corpus
+ * count over the same shipped forms is **0** at both severities. See the module
+ * note.
  *
  * Returns findings (empty = clean).
  */
-declare function validatePredicatePathRefs(stack: AnyRec$q, opts?: PredicatePathOptions): PredicatePathFinding[];
+declare function validatePredicatePathRefs(stack: AnyRec$r, opts?: PredicatePathOptions): PredicatePathFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -791,12 +867,12 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$p = Record<string, unknown>;
+type AnyRec$q = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$p): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$q): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
@@ -822,12 +898,12 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$o = Record<string, unknown>;
+type AnyRec$p = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$o): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$p): ApprovalApproverFinding[];
 
 type SeedReplaySafetySeverity = 'error' | 'warning';
 interface SeedReplaySafetyFinding {
@@ -841,7 +917,7 @@ interface SeedReplaySafetyFinding {
     hint: string;
 }
 declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
-type AnyRec$n = Record<string, unknown>;
+type AnyRec$o = Record<string, unknown>;
 /**
  * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
  * mode, which duplicates its rows on every replay boot (framework#3434). Returns
@@ -851,7 +927,7 @@ type AnyRec$n = Record<string, unknown>;
  * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
  * with no `data` array yields no findings.
  */
-declare function validateSeedReplaySafety(stack: AnyRec$n): SeedReplaySafetyFinding[];
+declare function validateSeedReplaySafety(stack: AnyRec$o): SeedReplaySafetyFinding[];
 
 type SeedStateMachineSeverity = 'warning';
 interface SeedStateMachineFinding {
@@ -865,7 +941,7 @@ interface SeedStateMachineFinding {
     hint: string;
 }
 declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
-type AnyRec$m = Record<string, unknown>;
+type AnyRec$n = Record<string, unknown>;
 /**
  * Flag every seed record whose `state_machine`-governed field carries a value
  * the machine does not declare (framework#3433 follow-up). Returns the findings
@@ -878,7 +954,7 @@ type AnyRec$m = Record<string, unknown>;
  * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
  * statically compared to the declared-state set.
  */
-declare function validateSeedStateMachine(stack: AnyRec$m): SeedStateMachineFinding[];
+declare function validateSeedStateMachine(stack: AnyRec$n): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -892,6 +968,7 @@ declare const SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungrant
 declare const SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
 declare const SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 declare const SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
+declare const SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
 type SecuritySeverity = 'error' | 'warning' | 'info';
 interface SecurityFinding {
     severity: SecuritySeverity;
@@ -906,7 +983,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$l = Record<string, unknown>;
+type AnyRec$m = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -914,9 +991,38 @@ type AnyRec$l = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$l, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$m, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
+/**
+ * [ADR-0090 D3] The `security-role-word` vocabulary freeze, as its own rule.
+ *
+ * Scope: security-relevant identifiers/labels across SIX collections — objects
+ * (names, field names, action names), permission sets, positions, apps, books.
+ * Pages/views/components are NOT scanned — `role` there is HTML/ARIA
+ * semantics, not permission vocabulary. The sole platform exception
+ * (better-auth `sys_member.role`) is a system object, which app stacks never
+ * author. Books entered the security-relevant set when `book.audience` became
+ * a permission-model reference (ADR-0046 §6.7 / ADR-0090).
+ *
+ * ## Why this is a separate function from {@link validateSecurityPosture}
+ *
+ * [#8310] Not taste — a surface boundary. When the rest of the D7 block
+ * crossed onto the runtime publish surface (`runtimeTypes: ['seed',
+ * 'permission', 'book']` — `object` measured dirty and is escalated, see the
+ * registry comment), this rule could not go with it: the per-write snapshot
+ * (`runtime-gate.ts`) neither carries nor maps `positions` / `apps`, both of
+ * which are `allowRuntimeCreate: true` — so wiring it through the shared
+ * entry would have enforced ONE rule id for a strict subset of its six
+ * collections. That is the #7220 failure shape (a door that refuses a
+ * permission set named `role_manager` while a position named `sales_role`
+ * walks through), and
+ * the registry refuses to build it in either direction. The rule therefore
+ * stays behind WHOLE, on its own CLI-only registry entry, until the snapshot
+ * carries `positions`/`apps` and both types are gated — at which point it
+ * crosses whole, in one edit, as its own entry.
+ */
+declare function validateSecurityRoleWord(stack: AnyRec$m): SecurityFinding[];
 
 /**
  * [ADR-0105 D6] The two organization-axis red lines, enforced at authoring time.
@@ -1029,6 +1135,10 @@ declare function validateOrgAxisRedLines(stack: unknown): OrgAxisFinding[];
 declare const SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
 /** A `condition` reading `current_user.*` — unresolvable when grants are materialized. */
 declare const SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
+/** The anchor object's OWD is already the widest — sharing has nothing to widen. */
+declare const SHARING_RULE_OBJECT_NOT_SHAREABLE = "sharing-rule-object-not-shareable";
+/** The anchor object is a master-detail DETAIL — its shares belong to its master. */
+declare const SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT = "sharing-rule-object-controlled-by-parent";
 type SharingRuleEnforceabilitySeverity = 'error' | 'warning';
 interface SharingRuleEnforceabilityFinding {
     severity: SharingRuleEnforceabilitySeverity;
@@ -1044,8 +1154,9 @@ interface SharingRuleEnforceabilityFinding {
     hint: string;
 }
 /**
- * Gate stack-declared sharing rules on the ONE thing their runtime consumer
- * does with `condition`: lower it to a `criteria_json` filter.
+ * Gate stack-declared sharing rules on the two things their runtime consumers
+ * do with them: lower the `condition` to a `criteria_json` filter, and write a
+ * `sys_record_share` row on the `object` the rule is anchored to.
  *
  * Pure `(stack) => Finding[]`; tolerates the normalized and the parsed tier.
  */
@@ -1118,19 +1229,27 @@ declare function validateRlsPredicateEnforceability(stack: unknown): RlsPredicat
  * in `@objectstack/spec` 17.0.0, so authoring one is a `tsc` error and a parse
  * error carrying the prescription. There is no widget target left to resolve.
  *
- * Resolution mirrors the objectui runtime dispatch (`DashboardRenderer` +
- * `DashboardView`) so the lint flags exactly what would fail to resolve at
- * runtime:
+ * Resolution mirrors the objectui runtime dispatch (`DashboardRenderer`
+ * hands the target to the SHARED `useActionModal` since objectui#4782) so the
+ * lint flags exactly what would fail to resolve at runtime:
  *
  *   actionType 'script' → `actionUrl` must name a DEFINED action (`stack.actions`
  *       or any `object.actions`, by `name`). A script target that names no
  *       defined action fails open at runtime ("action not found"). → ERROR.
  *
- *   actionType 'modal'  → `actionUrl` resolves if it names a defined action, OR
- *       matches the runtime `<verb>_<object>` convention the modalHandler
- *       implements (create_/new_/add_/edit_/update_ + a defined object), OR is a
- *       bare defined object name (the handler falls back to that object's create
- *       form). Otherwise → ERROR.
+ *   actionType 'modal'  → `actionUrl` names a declared PAGE (`stack.pages`), and
+ *       only a page — maintainer ruling objectstack#6739-A (2026-08-09). This
+ *       rule used to accept a defined action name, a bare object name, and the
+ *       `<verb>_<object>` convention (create_/new_/add_/edit_/update_ + object),
+ *       on the claim that it mirrored `DashboardView`'s own modal handler. That
+ *       handler — the convention's last live copy — was deleted by objectui#4782
+ *       (after objectui#4764 retired the object fallback in `useActionModal`):
+ *       the runtime resolves a string modal target against page metadata and
+ *       REFUSES everything else, so each retired limb here blessed a button that
+ *       dispatches to a named refusal at runtime. The ruling explicitly declined
+ *       the middle shape (keep the prefix, reject bare object names): a target
+ *       names the page `create_opportunity`, or it names nothing. Opening an
+ *       object's form is `actionType: 'form'`. Otherwise → ERROR.
  *
  *   actionType 'url'    → a relative in-app path. WARN when a recognizable
  *       `<collection>/<name>` segment (objects/reports/dashboards/pages/views)
@@ -1169,13 +1288,13 @@ interface DashboardActionRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$k = Record<string, unknown>;
+type AnyRec$l = Record<string, unknown>;
 /**
  * Validate every dashboard header action reference in a stack. Returns
  * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
  * unresolved routes are warnings.
  */
-declare function validateDashboardActionRefs(stack: AnyRec$k): DashboardActionRefFinding[];
+declare function validateDashboardActionRefs(stack: AnyRec$l): DashboardActionRefFinding[];
 
 /**
  * Build-time filter-placeholder diagnostics (issue #3574).
@@ -1259,6 +1378,85 @@ interface FilterTokenFinding {
  */
 declare function validateFilterTokens(stack: Record<string, unknown> | undefined | null): FilterTokenFinding[];
 
+/**
+ * Build-time refusal of a bare dashboard date-range PRESET name in an ordering
+ * comparand (#8793 — the ruled C half of #8690).
+ *
+ * `last_7_days` / `last_30_days` / `last_90_days` and their ten calendar
+ * siblings are REAL declared names (`DATE_RANGE_PRESETS`,
+ * `@objectstack/spec/data`) — but only for the dashboard date-filter positions,
+ * where the console lowers them to `{date-macro}` bounds before any query is
+ * sent. Authored as a bare filter comparand, nothing resolves them. Measured
+ * end to end on #8690 (51 rows seeded / 38 in-window):
+ *
+ * ```
+ * $gte "last_30_days"   HTTP 200  count=0    <- silent zero (the defect)
+ * $gte "{30_days_ago}"  HTTP 200  count=38   <- the spelling that works
+ * ```
+ *
+ * The engine now refuses the bare name on a declared temporal field at QUERY
+ * time (`INVALID_FILTER` / 400, PR #8808 — the B half). This rule is the
+ * AUTHORING-time half the ruling shipped alongside it: the error reaches the
+ * author — an AI author in particular, whose correction loop only sees what
+ * can fail the build or the publish — instead of the first viewer of an empty
+ * chart. The same refusal exists in the schema door
+ * (`data/filter.zod.ts`, Mongo-shape carriers only); this rule additionally
+ * reaches the shapes no `FilterConditionSchema` parse touches — view filter
+ * rules (`{ field, operator, value }`) and filter-array triples
+ * (`['created_at', '>=', …]`) — and reports with the located `where` / `path`
+ * the CLI commands render.
+ *
+ * ## The boundary — ordering positions only, in all three shapes
+ *
+ * This rule is field-agnostic, so the judgement rides on POSITION, exactly as
+ * the schema door's #8793 note lays out at length:
+ *
+ * - **Judged:** `$gt` / `$gte` / `$lt` / `$lte` comparands and `$between`
+ *   endpoints (Mongo shape); `>` / `>=` / `<` / `<=` / `between` triples and
+ *   every alias `canonicalAstOperator` folds onto them (`gt`, `after`, …);
+ *   `greater_than` / `less_than` / `greater_than_or_equal` /
+ *   `less_than_or_equal` / `before` / `after` / `between` view filter rules
+ *   and every alias `normalizeFilterOperator` folds onto them. An ORDERED
+ *   comparison against a declared preset name has no legitimate reading.
+ * - **Not judged:** equality and membership (`=`, `equals`, `$eq`, `$ne`,
+ *   `$in`, `$nin`, …). A select/picklist column legitimately stores values
+ *   that collide with preset names (`GlobalFilterSchema`'s own pins protect
+ *   `type: 'select', defaultValue: 'this_quarter'`), and on a declared
+ *   temporal field the engine door still refuses these at query time with the
+ *   field's type in hand.
+ * - **Only the 13 declared names.** A near-miss (`last_60_days`) is not this
+ *   rule's business — on a temporal field the engine's field-typed door
+ *   catches it; judging undeclared strings here would be a guessed superset.
+ *
+ * Both vocabularies' `{placeholder}` spellings never collide with a preset
+ * name (a preset carries no braces), so this rule and `validate-filter-tokens`
+ * cannot double-report one value.
+ */
+declare const FILTER_PRESET_COMPARAND = "filter-preset-comparand";
+type PresetComparandSeverity = 'error' | 'warning';
+interface PresetComparandFinding {
+    /** Always `error` — the runtime refuses the query, or silently returns zero rows. */
+    severity: PresetComparandSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `dashboard "sales" · widget "my_deals"`. */
+    where: string;
+    /** Config path, e.g. `dashboards[0].widgets[2].filter.created_at.$gte`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Validate every authored filter across a stack for bare preset comparands.
+ *
+ * Pure `(stack) => Finding[]`; no I/O. Needs no resolution context — the
+ * judgement is on the filter literal alone — which is what qualifies it for
+ * the runtime publish gate's per-write snapshot.
+ */
+declare function validatePresetComparands(stack: Record<string, unknown> | undefined | null): PresetComparandFinding[];
+
 /** A literal `$and: []` / `$or: []` / `$not: {}` — a combinator with no operands. */
 declare const FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
 /** A literal `{}` where a filter node is authored — the whole filter, or a branch. */
@@ -1305,12 +1503,12 @@ interface ObjectRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$j = Record<string, unknown>;
+type AnyRec$k = Record<string, unknown>;
 /**
  * Validate every object-name reference on the surfaces listed in the module
  * header. Returns findings (empty = clean).
  */
-declare function validateObjectReferences(stack: AnyRec$j): ObjectRefFinding[];
+declare function validateObjectReferences(stack: AnyRec$k): ObjectRefFinding[];
 
 type ReferenceIntegritySeverity = 'error' | 'warning';
 /**
@@ -1414,6 +1612,11 @@ type NavTargetRefFinding = ReferenceIntegrityFinding;
 declare const NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
 declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
 
+type NavObjectServabilityFinding = ReferenceIntegrityFinding;
+/** Emitted when a nav entry targets an object whose `enable` block cannot serve a list. */
+declare const NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
+declare function validateNavObjectServability(stack: unknown): NavObjectServabilityFinding[];
+
 /**
  * [ADR-0061 — searchable set] `searchableFields` entries must name a field the
  * object actually has — and, on a list view, one the runtime will agree to scan.
@@ -1511,6 +1714,21 @@ declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
  *      the runtime would refuse — `created_by` in a view's narrowing — is a
  *      missed finding, not a wrong one.)
  *
+ * Skip 3 answers EXISTENCE, and since #8404 it no longer ends the matter. On an
+ * ADR-0015 `external` object the platform registers its injected anchors and
+ * provisions no storage behind them (#7865 / #8116), so `owner_id` there is
+ * addressable and empty on every record. Existence rightly stays silent —
+ * PROVENANCE is a second question, asked only of the names skip 3 already
+ * decided not to flag, and answered by the per-object index
+ * ({@link indexUnprovisionedAnchors}) rather than the object-independent union.
+ * A declared anchor survives into the resolved allow-list and the view's
+ * `$searchFields` narrowing, so it reads as search coverage and scans a column
+ * that can never match — #4830's own failure mode reached by a different route.
+ * WARNING, never gating, for #4330's cost asymmetry: the remote schema is not
+ * visible to this pass, so the finding describes a degradation, not a refusal
+ * (the same call `warnUnprovisionedAnchors` makes in `validate-expressions.ts`
+ * and the four filter/binding rules #8340 wired).
+ *
  * Dotted paths are NOT skipped here, unlike every sibling rule. Elsewhere
  * `owner_id.name` is left alone because the query engine resolves the traversal;
  * search does not — `resolveSearchFields` matches the field map by exact string,
@@ -1520,6 +1738,7 @@ declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
 
 declare const SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
 declare const SEARCHABLE_FIELD_UNSEARCHABLE = "searchable-field-unsearchable";
+declare const SEARCHABLE_FIELD_UNPROVISIONED = "searchable-field-unprovisioned";
 type SearchableFieldSeverity = 'error' | 'warning';
 interface SearchableFieldFinding {
     /** Always `error` — a stale entry narrows, widens or refuses the search (see module note). */
@@ -1548,7 +1767,24 @@ interface SearchableFieldFinding {
  *   runtime would refuse are flagged (#4830).
  */
 type SearchableFieldRole = 'canonical' | 'narrowing';
-type AnyRec$i = Record<string, unknown>;
+type AnyRec$j = Record<string, unknown>;
+/**
+ * The slice of an object the search checks resolve against: the authored
+ * field map (existence + the `type`/`hidden` meta search resolution reads),
+ * plus the object's own declarations the runtime's resolution consumes.
+ * `null` when the object declares no readable field map (external /
+ * introspected — nothing to judge against).
+ */
+interface ObjectSearchTarget {
+    /** Authored field names, for the existence check. */
+    names: Set<string>;
+    /** name → the metadata slice `resolveSearchFieldResolution` reads. */
+    fields: Record<string, SearchFieldMeta>;
+    /** The object's own `searchableFields`, when declared as an array. */
+    searchableFields?: string[];
+    /** `nameField` / `displayNameField` — ordering only, passed for parity. */
+    displayField?: string;
+}
 /**
  * Validate every `searchableFields` declaration in the stack — the object's own
  * (the canonical set, ADR-0061) and the list views that narrow it. Returns
@@ -1559,7 +1795,49 @@ type AnyRec$i = Record<string, unknown>;
  * `validate-react-page-props` — the gate that already parses that source —
  * runs the same `checkSearchableFieldList` core on it (#4329).
  */
-declare function validateSearchableFields(stack: AnyRec$i): SearchableFieldFinding[];
+declare function validateSearchableFields(stack: AnyRec$j): SearchableFieldFinding[];
+
+declare const SORT_FIELD_UNKNOWN = "sort-field-unknown";
+declare const SORT_FIELD_UNSORTABLE = "sort-field-unsortable";
+type SortableFieldSeverity = 'error' | 'warning';
+interface SortableFieldFinding {
+    /** Always `error` — both verdicts are a `400 INVALID_SORT` at request time. */
+    severity: SortableFieldSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "crm_opportunity" › listViews.pipeline`. */
+    where: string;
+    /** Config path, e.g. `objects[0].listViews.pipeline.sort[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$i = Record<string, unknown>;
+/**
+ * Check ONE authored `sort` declaration against the object it is bound to —
+ * the shared core behind every list-view surface that declares an ordering.
+ *
+ * `fieldsByObject` is {@link indexObjectSearchTargets}' index, reused rather
+ * than rebuilt: the SEARCH and SORT doors must agree about which fields an
+ * object has and what type each one is, and two hand-written readers of the
+ * same field map is the drift `system-fields.ts` and `view-walk.ts` were both
+ * created to end. `subject` names the declaration for the message; the parsed
+ * key's position is appended to `path` so the author can go straight to it.
+ */
+declare function checkSortDeclaration(declared: unknown, objectName: string | undefined, fieldsByObject: ReadonlyMap<string, ObjectSearchTarget | null>, where: string, path: string, subject: string): SortableFieldFinding[];
+/**
+ * Validate every list-view `sort` declaration in the stack — the object's
+ * built-in named list views and the `defineView` aggregates that declare one.
+ * Returns findings (empty = clean).
+ *
+ * The surfaces walked here are exactly `validateSearchableFields`', for the
+ * same reason: these are the declarations that lower into an engine `orderBy`
+ * over the bound object's own columns. See the module note for the four
+ * sort-carrying surfaces that were checked and deliberately left out.
+ */
+declare function validateSortableFields(stack: AnyRec$i): SortableFieldFinding[];
 
 declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
 type ActionNameRefSeverity = 'error' | 'warning';
@@ -1758,6 +2036,17 @@ declare function walkPageComponents(page: AnyRec$f, pagePath: string): WalkedCom
  * drift #4330 had just finished removing from the system-field lists.
  */
 declare const PAGE_FIELD_UNKNOWN = "page-field-unknown";
+/**
+ * [#8340] The reference RESOLVES to a registry-injected system column — so
+ * {@link PAGE_FIELD_UNKNOWN} is right to stay silent — but the bound object is
+ * ADR-0015 `external`, where the platform registers the anchor and provisions
+ * no storage behind it. Always `warning`, on both consequences and including
+ * the `queried` one that gates for a genuinely missing column: the existence
+ * question has a closed oracle here and the provenance question does not (this
+ * pass cannot see the remote schema, only that the platform stores nothing) —
+ * #8116's severity reasoning, unchanged.
+ */
+declare const PAGE_FIELD_UNPROVISIONED = "page-field-unprovisioned";
 type PageFieldSeverity = 'error' | 'warning';
 interface PageFieldFinding {
     /**
@@ -2183,6 +2472,18 @@ interface HookBodyWriteFinding {
     hint: string;
 }
 declare const HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+/**
+ * [#8663] The write-axis twin of `flow-template-field-unprovisioned` (#8340):
+ * the body writes a field {@link IMPLICIT_FIELDS} exempts, but on THIS target
+ * the platform registered that anchor without provisioning storage for it.
+ *
+ * A separate id at `warning` severity rather than a reclassification of
+ * {@link HOOK_BODY_WRITE_UNKNOWN_FIELD}, matching #8340's precedent exactly:
+ * the existence verdict is unchanged (the name IS addressable), and what is
+ * added is a second, independently suppressible finding on the path where the
+ * existence check stays silent.
+ */
+declare const HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
 /** One syntactic write shape the extractor recognizes. */
 interface HookBodyWritePattern {
     /** Stable pattern id, carried on every extracted write. */
@@ -2281,6 +2582,12 @@ interface ActionBodyWriteFinding {
 }
 declare const ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
 declare const ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+/**
+ * [#8663] The action-surface twin of `hook-body-write-unprovisioned-anchor`.
+ * Same question, same wording, same `warning` severity — this rule and the hook
+ * rule share {@link IMPLICIT_FIELDS}, so they shared its blind spot too.
+ */
+declare const ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR = "action-body-write-unprovisioned-anchor";
 /** @deprecated alias — the exclusion shape is shared with the hook rule. */
 type ActionBodyWriteExclusion = BodyWritePatternExclusion;
 /**
@@ -2314,9 +2621,17 @@ type AnyRec$6 = Record<string, unknown>;
  */
 declare function validateActionBodyWrites(stack: AnyRec$6): ActionBodyWriteFinding[];
 
-type FlowNodeWriteSeverity = 'error';
+/**
+ * `error` for the existence verdict — a literal key against a literal object is
+ * a certainty (see the module note). [#8663] `warning` for the provenance one:
+ * the same widening `validateFlowTemplatePaths` carries, for the same reason.
+ * The two questions have different certainties, so they cannot share a
+ * severity; the suite that runs this rule is severity-agnostic by contract and
+ * carries each finding's own value through.
+ */
+type FlowNodeWriteSeverity = 'error' | 'warning';
 interface FlowNodeWriteFinding {
-    /** Always `error` — a literal key against a literal object is a certainty (see module note). */
+    /** Per-finding — see {@link FlowNodeWriteSeverity}, which says why it is not a constant. */
     severity: FlowNodeWriteSeverity;
     rule: string;
     /** Human-readable location, e.g. `flow "close_deal" › node "Mark won"`. */
@@ -2327,6 +2642,20 @@ interface FlowNodeWriteFinding {
     hint: string;
 }
 declare const FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
+/**
+ * [#8663] The flow-node twin of `hook-body-write-unprovisioned-anchor`. This
+ * rule reached the same blind spot from the same direction: it imports
+ * {@link IMPLICIT_FIELDS} from the hook rule, so it inherited the set's
+ * object-independence along with its contents.
+ *
+ * ⚠️ `warning`, NOT this rule's usual `error`. The existence verdict gates
+ * because a literal key against a literal object is a certainty; the provenance
+ * verdict is a claim about a REMOTE schema this repo cannot see, so it advises.
+ * Reclassifying it upward would convert a silent case straight into a build
+ * break — the shape ADR-0072 D1 forbids, at the one severity where it cannot be
+ * ignored.
+ */
+declare const FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR = "flow-node-write-unprovisioned-anchor";
 /** Flow node types whose `config.fields` keys this rule resolves. */
 declare const FLOW_WRITE_NODE_TYPES: readonly string[];
 /** A `fields`-bearing node type this rule does NOT cover yet, and why. */
@@ -2525,6 +2854,42 @@ interface LintIssue {
     path: string;
     fix?: string;
 }
+/**
+ * A {@link LintIssue} that also states the HUMAN-READABLE location, for rules
+ * that are adapted into `AuthoringFinding` (`packages/lint/src/authoring-rules.ts`).
+ *
+ * `AuthoringFinding` declares two location slots with different jobs — `where`
+ * ("human-readable location", e.g. `object "leave_request"`) and `path` ("config
+ * path", e.g. `objects[3].sharingModel`) — and every CLI command renders the
+ * first as the line's prefix: `os validate` prints
+ * `• ${where}: ${message}` and then `rule: ${rule}  at ${path}`.
+ *
+ * `LintIssue` carries only the positional `path`, so the three ADR-0120
+ * uniqueness rules' registry adapters had nothing else to map and set
+ * `where: f.path`. Measured on `origin/main`: an author saw
+ * `• objects[44].indexes[1]: "sys_account" declares index …  at objects[44].indexes[1]`
+ * — the same positional string twice, and an index into the MERGED object array
+ * that appears in no file the author wrote (44 objects from
+ * `@objectstack/platform-objects` plus one from `@objectstack/metadata-core`).
+ * No information was lost — the object's name is in the message — but the
+ * location slot said nothing the `at` clause did not already say, and every
+ * other rule in the table spells it `object "sys_account"`.
+ *
+ * Stating `where` at the PRODUCER rather than reconstructing it in the adapter
+ * is deliberate: only the rule still holds the object it walked. Making it
+ * REQUIRED here (rather than adding `where?` to `LintIssue` and writing
+ * `f.where ?? f.path` at the adapter) is the same discipline — a consumer-side
+ * fallback would let the next rule ship the positional spelling again, silently.
+ *
+ * `path` is unchanged and stays positional: it is the slot that is SUPPOSED to
+ * be a config path, `os validate` prints it after `at`, and the runtime gate's
+ * `fingerprint` reads `where` and `path` together (making `where` more specific
+ * cannot merge two findings that were distinct).
+ */
+interface LocatedLintIssue extends LintIssue {
+    /** Human-readable location, e.g. `object "sys_account" · index 'uniq_org_email'`. */
+    where: string;
+}
 declare const UNIQUE_DOUBLE_DECLARATION = "unique/double-declaration";
 declare const UNIQUE_UNSCOPED_DECLARED_INDEX = "unique/unscoped-declared-index";
 declare const UNIQUE_LEGACY_ORGANIZATION_COMPOSITE = "unique/legacy-organization-composite";
@@ -2545,10 +2910,12 @@ declare const UNIQUE_LEGACY_ORGANIZATION_COMPOSITE = "unique/legacy-organization
  * 17.x: warning. Protocol 18 rejects the spelling at validate/publish (#5082).
  * Advisory — never fails a build in 17.x.
  *
+ * Concrete harm: #8323 measured the cross-tenant 409-vs-201 oracle end to end.
+ *
  * Wiring: own AUTHORING_RULES entry (validate/build), and `lintDataModel`
  * calls it for `os lint` — each command reports each finding exactly once.
  */
-declare function lintUnscopedDeclaredIndexes(objects: any[]): LintIssue[];
+declare function lintUnscopedDeclaredIndexes(objects: any[]): LocatedLintIssue[];
 /**
  * R10 (ADR-0120 D5b) — the same single column carries BOTH a field-level
  * `unique` and a declared single-column unique index (#3991), judged in the
@@ -2578,7 +2945,7 @@ declare function lintUnscopedDeclaredIndexes(objects: any[]): LintIssue[];
  * Advisory. The resulting stack is well-defined — the cost is an intent that
  * never takes effect, not a broken artifact — so this never fails a build.
  */
-declare function lintUniqueDeclarations(objects: any[]): LintIssue[];
+declare function lintUniqueDeclarations(objects: any[]): LocatedLintIssue[];
 /**
  * R12 (ADR-0120 D5c) — a declared unique index whose column list CONTAINS the
  * organization column: the hand-written per-organization composite (S6),
@@ -2605,7 +2972,7 @@ declare function lintUniqueDeclarations(objects: any[]): LintIssue[];
  * unique declared on the organization column ALONE, which is not a composite and
  * has no per-organization reading to recover.
  */
-declare function lintLegacyOrganizationComposites(objects: any[]): LintIssue[];
+declare function lintLegacyOrganizationComposites(objects: any[]): LocatedLintIssue[];
 /**
  * Lint the relationship / data-modeling conventions across the full object set.
  * Pure and deterministic — safe to call from both the `lint` command and the
@@ -2613,4 +2980,4 @@ declare function lintLegacyOrganizationComposites(objects: any[]): LintIssue[];
  */
 declare function lintDataModel(objects: any[]): LintIssue[];
 
-export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type ComponentPropsFinding, type ComponentPropsSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PRE_SEAL_PHASES, type PageFieldFinding, type PageFieldSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findStartupRegistryVerdicts, findUnguardedNullableOperands, isSourceAuthoredPage, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, nearestRegisteredFormat, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateDashboardActionRefs, validateEmptyCombinators, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateNavAccess, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePredicatePathRefs, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings, walkPageComponents };
+export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type ComponentPropsFinding, type ComponentPropsSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_PRESET_COMPARAND, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, type LocatedLintIssue, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SOURCE_CLASSNAME, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageFieldFinding, type PageFieldSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, type PresetComparandFinding, type PresetComparandSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REFERENCE_INTEGRITY_RULES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNPROVISIONED, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT, SHARING_RULE_OBJECT_NOT_SHAREABLE, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, SORT_FIELD_UNKNOWN, SORT_FIELD_UNSORTABLE, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SortableFieldFinding, type SortableFieldSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, checkSortDeclaration, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findStartupRegistryVerdicts, findUnguardedNullableOperands, isSourceAuthoredPage, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, nearestRegisteredFormat, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateDashboardActionRefs, validateEmptyCombinators, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePredicatePathRefs, validatePresetComparands, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateSortableFields, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings, walkPageComponents };