@objectstack/lint 17.0.0 → 17.1.0

package/dist/index.js

@@ -586,10 +586,10 @@ var OUTCOME_CLAUSE = {
   "fail-closed": "so the rule enforces nothing and the write is rejected fail-closed (#4649/#4763)",
   "fail-open": "so the predicate is SKIPPED fail-open \u2014 the field is never actually required, the write proceeds unchecked, and the only trace is a `requiredWhen \u2026 failed to evaluate \u2014 skipped` log line (#4649/#4811)"
 };
-function nullGuardMessage(subject, objectName, finding, outcome = "fail-closed") {
+function nullGuardMessage(subject, objectName, finding2, outcome = "fail-closed") {
   const owner = objectName ? `'${objectName}'` : "this object";
-  const hasNote = finding.hasOnlyGuard ? ` \`has(${finding.operand})\` does not guard it.` : "";
-  return `${subject} applies \`${finding.operator}\` to \`${finding.operand}\`, which ${owner} declares as nullable (no \`required: true\`, no \`defaultValue\`).${hasNote} At runtime the operand is null, CEL has no \`${finding.operator}\` overload for null, and the whole predicate aborts \u2014 ${OUTCOME_CLAUSE[outcome]}. The predicate compares a value that is null. ${NULL_GUARD_HINT}`;
+  const hasNote = finding2.hasOnlyGuard ? ` \`has(${finding2.operand})\` does not guard it.` : "";
+  return `${subject} applies \`${finding2.operator}\` to \`${finding2.operand}\`, which ${owner} declares as nullable (no \`required: true\`, no \`defaultValue\`).${hasNote} At runtime the operand is null, CEL has no \`${finding2.operator}\` overload for null, and the whole predicate aborts \u2014 ${OUTCOME_CLAUSE[outcome]}. The predicate compares a value that is null. ${NULL_GUARD_HINT}`;
 }
 
 // src/validate-expressions.ts
@@ -772,10 +772,10 @@ function validateStackExpressions(stack) {
     if (!nullableFields || nullableFields.size === 0) return;
     const source = celSourceOf(raw);
     if (!source) return;
-    for (const finding of findUnguardedNullableOperands(source, { nullableFields })) {
+    for (const finding2 of findUnguardedNullableOperands(source, { nullableFields })) {
       issues.push({
         where,
-        message: nullGuardMessage(subject, objectName, finding, outcome),
+        message: nullGuardMessage(subject, objectName, finding2, outcome),
         source,
         severity: "error"
       });
@@ -799,7 +799,7 @@ function validateStackExpressions(stack) {
   const FIELD_RULE_SLOT_CONSEQUENCE_GENERIC = "the predicate faults, and a faulting rule never produces the verdict you declared \u2014 each slot resolves the fault to its own fallback, and none of those fallbacks is yours";
   const FIELD_RULE_SLOT_CONSEQUENCE = {
     visibleWhen: "the predicate faults and the renderer falls back to VISIBLE (`resolveFieldRuleState` evaluates visibility with `fallback: true`, and no server-side gate evaluates a field-level `visibleWhen` at all), leaving the field the test was meant to hide showing for everyone (#6146)",
-    readonlyWhen: "the predicate faults \u2014 and the two ends fault in OPPOSITE directions. The server treats the field as LOCKED (`isReadonlyWhenLocked` will not waive a declared lock it could not evaluate, #4889) and drops your value from the payload, while the form still renders the field editable (`fallback: false`). Per ADR-0057 D10 the server is the one that decides: the field looks writable, the save reports success, and the value silently never lands",
+    readonlyWhen: "the predicate faults \u2014 and the two ends fault in OPPOSITE directions. The server treats the field as LOCKED (`isReadonlyWhenLocked` will not waive a declared lock it could not evaluate, #4889) and drops your value from the payload, while the form still renders the field editable (`fallback: false`). The server is the one that decides: the field looks writable, the save reports success, and the value silently never lands",
     requiredWhen: "the predicate faults and the requirement is never enforced anywhere \u2014 the server logs it and SKIPS the check (fail-open, #4977 deliberately did not take #4889's carve-out) and the form does not mark the field required either, so a record saves with the field empty",
     // Listed rather than left to the `??` below, so the map covers every slot
     // the field walk passes and the default stays unreachable. `FieldSchema`
@@ -858,14 +858,15 @@ function validateStackExpressions(stack) {
           if (retired.length > 0) {
             issues.push({
               where: `${at} \xB7 node '${node.id}' (script) callable`,
-              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + // #6856 route D (maintainer-ruled): the house sentence names the TOOL's
-              // behaviour, never the retired key's fate — "rewrite it" reads two ways
-              // over a branch that DELETES the key (template/recipients/variables/script),
-              // "rewrite existing sources" only one. Plain-quoted (not a template literal)
+              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + // #6856 route D (maintainer-ruled), reworded under #9529: the house
+              // sentence names the TOOL's behaviour, never the retired key's fate —
+              // "rewrite it" read two ways over a branch that DELETES the key
+              // (template/recipients/variables/script), and the tool never rewrote a
+              // source file at all. Plain-quoted (not a template literal)
               // so this site is a member of `retired-key-migrate-sentence.test.ts`'s
               // widened scan (#7030) on the same textual shape as the spec corpus — no
               // interpolation lives in this clause, so nothing is lost switching quote style.
-              "Run `os migrate meta --from 16` to rewrite existing sources automatically.",
+              "Run `os migrate meta --from 16` to list the mechanical edits for existing sources; apply them by hand.",
               source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
             });
           } else if (!fn) {
@@ -936,10 +937,10 @@ function validateStackExpressions(stack) {
           f.expression,
           objectName ? { objectName, fields: fieldIndex.get(objectName), fieldTypes: fieldTypeIndex.get(objectName), scope: "record" } : { scope: "record" }
         );
-        const fieldWhere = `object '${objectName}' \xB7 field '${fname}' expression`;
-        for (const e of res.errors) issues.push({ where: fieldWhere, message: e.message, source: e.source, severity: "error" });
-        for (const w of res.warnings) issues.push({ where: fieldWhere, message: w.message, source: w.source, severity: "warning" });
-        warnUnprovisionedAnchors(fieldWhere, f.expression, objectName);
+        const fieldWhere2 = `object '${objectName}' \xB7 field '${fname}' expression`;
+        for (const e of res.errors) issues.push({ where: fieldWhere2, message: e.message, source: e.source, severity: "error" });
+        for (const w of res.warnings) issues.push({ where: fieldWhere2, message: w.message, source: w.source, severity: "warning" });
+        warnUnprovisionedAnchors(fieldWhere2, f.expression, objectName);
       }
     }
   }
@@ -2580,6 +2581,7 @@ import {
 } from "@objectstack/spec/data";
 var SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
 var SEARCHABLE_FIELD_UNSEARCHABLE = "searchable-field-unsearchable";
+var SEARCHABLE_FIELD_UNPROVISIONED = "searchable-field-unprovisioned";
 function asArray10(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -2670,7 +2672,7 @@ function indexObjectSearchTargets(stack) {
   }
   return fieldsByObject;
 }
-function checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role = "narrowing") {
+function checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role = "narrowing", unprovisionedAnchors) {
   const findings = [];
   if (!Array.isArray(declared) || declared.length === 0) return findings;
   if (!objectName) return findings;
@@ -2678,6 +2680,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
   const target = fieldsByObject.get(objectName);
   if (!target) return findings;
   const known = target.names;
+  const anchors = unprovisionedAnchors?.get(objectName);
   const resolution = role === "narrowing" ? resolveAllowedSet(target) : void 0;
   for (let i = 0; i < declared.length; i++) {
     const entry = declared[i];
@@ -2695,6 +2698,16 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       });
       continue;
     }
+    if (anchors?.has(name)) {
+      findings.push({
+        severity: "warning",
+        rule: SEARCHABLE_FIELD_UNPROVISIONED,
+        where,
+        path: `${path}[${i}]`,
+        message: `${subject} entry "${name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, name)}` + (role === "narrowing" ? ` \u2014 clients echo this declaration verbatim as the '$searchFields' override, so every toolbar search on this list scans a column that is empty on every record: it reads as search coverage and matches nothing.` : ` \u2014 'search' scans it on every record and it can never match, so the object's searchable set is narrower than it declares. Should it be the ONLY entry that resolves, the set scans nothing at all.`),
+        hint: unprovisionedAnchorHint(objectName, name)
+      });
+    }
     if (isVirtualSearchField(target.fields[name])) {
       const vtype = target.fields[name]?.type;
       findings.push({
@@ -2748,9 +2761,19 @@ function validateSearchableFields(stack) {
   if (!isRec4(stack)) return findings;
   const objects = asArray10(stack.objects);
   const fieldsByObject = indexObjectSearchTargets(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const check = (declared, objectName, where, path, subject, role) => {
     findings.push(
-      ...checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role)
+      ...checkSearchableFieldList(
+        declared,
+        objectName,
+        fieldsByObject,
+        where,
+        path,
+        subject,
+        role,
+        unprovisionedAnchors
+      )
     );
   };
   for (let oi = 0; oi < objects.length; oi++) {
@@ -2937,7 +2960,12 @@ var COMPONENT_FIELD_SPECS = {
   "record:details": { props: ["fields", "hideFields"], nestedSections: ["sections"] },
   "record:path": { props: ["statusField"] },
   "element:number": { props: ["field"] },
-  "element:filter": { props: ["fields"] },
+  // `element:filter` had a `{ props: ['fields'] }` entry until #9220 retired the
+  // whole element at element grain (ADR-0049 — no renderer ever shipped for it).
+  // Every `ElementFilterProps` key is a `retiredKey()` tombstone now, so no
+  // spec-conformant page carries `fields` on it, and the #5068 props gate
+  // reports an authored one by name with the element-retirement prescription —
+  // the same #5775/#6629 residue class as the record-picker entries below.
   "element:form": { props: ["fields"] },
   // `labelField` is the one field-bearing prop this element declares. Its former
   // companions `displayField` (renamed to `labelField`, ADR-0087 D2) and
@@ -3640,7 +3668,12 @@ function validateReactPageProps(stack) {
                 searchTargets,
                 where,
                 `${path} \u203A searchableFields`,
-                "searchableFields"
+                "searchableFields",
+                // A `<ListView>` prop is a view-level narrowing — the checker's
+                // default, spelled out here because the #8404 provenance index
+                // follows it positionally.
+                "narrowing",
+                unprovisionedAnchors
               )
             );
           }
@@ -5225,6 +5258,7 @@ function validateSecurityPosture(stack, opts) {
     }
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
+  const DELEGATION_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position"]);
   const nowMs = opts?.nowMs ?? Date.now();
   for (const [i, seed] of asArray19(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
@@ -5248,7 +5282,7 @@ function validateSecurityPosture(stack, opts) {
         }
       }
       const delegatedFrom = rec.delegated_from;
-      if (delegatedFrom != null && delegatedFrom !== "") {
+      if (DELEGATION_SEED_OBJECTS.has(seedObject) && delegatedFrom != null && delegatedFrom !== "") {
         const reason = rec.reason;
         if (typeof reason !== "string" || reason.trim().length === 0) {
           findings.push({
@@ -5414,6 +5448,8 @@ function validateOrgAxisRedLines(stack) {
 import { compileCelToFilter } from "@objectstack/formula";
 var SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
 var SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
+var SHARING_RULE_OBJECT_NOT_SHAREABLE = "sharing-rule-object-not-shareable";
+var SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT = "sharing-rule-object-controlled-by-parent";
 function asArray21(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -5438,10 +5474,67 @@ function sourceOf(condition) {
   return str2(input?.source);
 }
 var PUSHDOWN_SUBSET = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in`, `&&` `||` `!`, `== null` / `!= null`, and the string methods `startsWith` / `endsWith` / `contains` \u2014 over SINGLE-column `record.<field>` paths (ADR-0058 D2).";
+function effectiveSharingModelOf(obj) {
+  const m = obj.sharingModel;
+  if (m === "private") return "private";
+  if (m === "public_read") return "read";
+  if (m === "public_read_write" || m === "controlled_by_parent") return "public";
+  if (m == null) {
+    const isSystem = obj.isSystem === true || str2(obj.name).startsWith("sys_");
+    return isSystem ? "public" : "private";
+  }
+  return "private";
+}
+function masterOf(obj) {
+  for (const f of asArray21(obj.fields)) {
+    if (f.type === "master_detail") {
+      const ref = f.reference;
+      if (typeof ref === "string" && ref) return ref;
+    }
+  }
+  return void 0;
+}
+function anchorFindings(rule, index, objectsByName) {
+  const object = str2(rule.object);
+  if (!object) return [];
+  const target = objectsByName.get(object);
+  if (!target) return [];
+  const name = str2(rule.name) || String(index);
+  const where = `sharing rule "${name}" on object "${object}"`;
+  const path = `sharingRules[${index}].object`;
+  const owd = target.sharingModel;
+  if (owd === "controlled_by_parent") {
+    const master = masterOf(target);
+    return [{
+      severity: "error",
+      rule: SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT,
+      where,
+      path,
+      message: `Sharing rule "${name}" is anchored on object "${object}", which declares sharingModel 'controlled_by_parent'. A detail record has no record-level access of its own \u2014 its visibility is DERIVED from its master (ADR-0055), so it holds no shares to widen. \`SharingService.assertNotInertGrant\` refuses the grant with SHARING_NOT_ENABLED ("'${object}' is controlled by its parent (master-detail); share the master record instead"), so the rule's boot backfill fails, no \`sys_record_share\` row is ever written, and the recipients this rule names get whatever the MASTER grants them \u2014 which may be nothing. The grant is declared and does not exist.`,
+      hint: `Move the rule onto the MASTER object` + (master ? ` \u2014 "${object}" derives from "${master}" through its master_detail field, so share "${master}" and the detail rows follow` : `, and share that instead; the detail rows follow`) + `. If "${object}" is meant to carry a record-level baseline of its own, that is a different decision: change its sharingModel to 'private' (owner + shares) or 'public_read', and this rule becomes enforceable where it stands.`
+    }];
+  }
+  if (effectiveSharingModelOf(target) !== "public") return [];
+  const declared = owd === "public_read_write" ? `declares sharingModel 'public_read_write'` : `declares no sharingModel and is a system object (\`isSystem: true\` or a \`sys_\` name), which ADR-0090 D1 resolves to public`;
+  return [{
+    severity: "error",
+    rule: SHARING_RULE_OBJECT_NOT_SHAREABLE,
+    where,
+    path,
+    message: `Sharing rule "${name}" is anchored on object "${object}", which ${declared}. Its effective sharing model is therefore \`public\`, and sharing only ever WIDENS an OWD baseline \u2014 on the widest baseline there is nothing left to widen. \`SharingService.assertNotInertGrant\` refuses the grant with SHARING_NOT_ENABLED ("'${object}' is not under record-sharing enforcement"), so the rule's boot backfill fails and no \`sys_record_share\` row is ever written. Measured: \`buildReadFilter\` returns \`null\` for this object, i.e. NO record-level filter at all \u2014 every principal already reads every row, so this rule advertises a restriction that does not exist.`,
+    hint: `Decide which half is wrong. If the ACCESS is right \u2014 everyone should read and write these records \u2014 the rule is dead metadata: delete it (ADR-0049 enforce-or-remove). If the RULE is right \u2014 only the named audience should reach these records \u2014 then "${object}"'s OWD is the defect: set sharingModel: 'private' (owner + shares) or 'public_read', and this rule starts enforcing. Do NOT re-home the rule onto another public object; that moves the inertness instead of removing it.`
+  }];
+}
 function validateSharingRuleEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
+  const objectsByName = /* @__PURE__ */ new Map();
+  for (const obj of asArray21(cfg.objects)) {
+    const name = str2(obj.name);
+    if (name) objectsByName.set(name, obj);
+  }
   asArray21(cfg.sharingRules).forEach((rule, index) => {
+    anchorFindings(rule, index, objectsByName).forEach((f) => findings.push(f));
     const input = toCompilerInput(rule.condition);
     if (input === null) return;
     const result = compileCelToFilter(input, { variables: {} });
@@ -5579,7 +5672,6 @@ function asArray23(v) {
 function strName7(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-var MODAL_VERB_RE = /^(?:create|new|add|edit|update)_(.+)$/;
 var URL_COLLECTION_TO_STACK_KEY = {
   object: "objects",
   objects: "objects",
@@ -5624,13 +5716,10 @@ function collectKnownTargets(stack) {
   return { actions, objects, reports, dashboards, pages, views };
 }
 function resolveActionTarget(actionType, target, known) {
-  if (known.actions.has(target)) return true;
   if (actionType === "modal") {
-    if (known.objects.has(target)) return true;
-    const m = MODAL_VERB_RE.exec(target);
-    if (m && known.objects.has(m[1])) return true;
+    return known.pages.has(target);
   }
-  return false;
+  return known.actions.has(target);
 }
 function resolveUrlRoute(target, known) {
   if (/^[a-z][a-z0-9+.-]*:\/\//i.test(target) || target.startsWith("//")) return null;
@@ -5660,14 +5749,13 @@ function validateDashboardActionRefs(stack) {
     const actionType = strName7(action.actionType) ?? "url";
     if (actionType === "script" || actionType === "modal") {
       if (resolveActionTarget(actionType, target, known)) return;
-      const kindWord = actionType === "script" ? "script" : "modal";
       findings.push({
         severity: "error",
         rule: DASHBOARD_ACTION_TARGET_UNDEFINED,
         where,
         path,
-        message: `${kindWord} action target "${target}" resolves to no defined action` + (actionType === "modal" ? " or object" : "") + `. The button renders but does nothing when clicked \u2014 a dangling reference the runtime cannot dispatch (ADR-0049: a declared reference must resolve).`,
-        hint: actionType === "modal" ? `Define an action named "${target}" (stack.actions or the object's actions), use the "<verb>_<object>" convention against a real object (e.g. "create_<object>"), point actionUrl at an existing object, or remove the button.` : `Define a script action named "${target}" (stack.actions or the object's actions) with an inline body or a registered handler, or remove the button.`
+        message: actionType === "modal" ? `modal action target "${target}" names no declared page \u2014 a modal target names a PAGE, only (objectstack#6739). The button renders but the runtime refuses the dispatch when clicked \u2014 a dangling reference (ADR-0049: a declared reference must resolve).` : `script action target "${target}" resolves to no defined action. The button renders but does nothing when clicked \u2014 a dangling reference the runtime cannot dispatch (ADR-0049: a declared reference must resolve).`,
+        hint: actionType === "modal" ? `Point actionUrl at a declared page (stack.pages), or use actionType: 'form' with an "<object>.<view>" form-view target to open an object's form, or remove the button.` : `Define a script action named "${target}" (stack.actions or the object's actions) with an inline body or a registered handler, or remove the button.`
       });
       return;
     }
@@ -5709,7 +5797,7 @@ function validateDashboardActionRefs(stack) {
 import { classifyFilterToken, CONTEXT_TOKENS } from "@objectstack/spec/data";
 
 // src/filter-walk.ts
-var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
+var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter", "relatedListFilter"]);
 function asArray24(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -5813,6 +5901,149 @@ function validateFilterTokens(stack) {
   return out;
 }
 
+// src/validate-preset-comparands.ts
+import {
+  VALID_AST_OPERATORS as VALID_AST_OPERATORS2,
+  bareDateRangePresetComparandMessage,
+  canonicalAstOperator,
+  isDateRangePresetName
+} from "@objectstack/spec/data";
+import { normalizeFilterOperator } from "@objectstack/spec/ui";
+var FILTER_PRESET_COMPARAND = "filter-preset-comparand";
+var PRESET_COMPARAND_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" },
+  { key: "flows", kind: "flow" }
+];
+var ORDERING_DOLLAR_OPS = /* @__PURE__ */ new Set(["$gt", "$gte", "$lt", "$lte"]);
+var ORDERING_INFIX_OPS = /* @__PURE__ */ new Set([">", ">=", "<", "<="]);
+var ORDERING_RULE_OPS = /* @__PURE__ */ new Set([
+  "greater_than",
+  "greater_than_or_equal",
+  "less_than",
+  "less_than_or_equal",
+  "before",
+  "after"
+]);
+var MAX_DEPTH = 32;
+function isPlainObject(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date);
+}
+function finding(where, path, preset, operator) {
+  return {
+    severity: "error",
+    rule: FILTER_PRESET_COMPARAND,
+    where,
+    path,
+    message: bareDateRangePresetComparandMessage(preset, operator),
+    hint: "Presets belong to the dashboard date-filter bar (dateRange.defaultRange, a date global filter's defaultValue). In a filter comparand, write the {date-macro} window the message names, or an ISO date."
+  };
+}
+function judgeConditionNode(node, path, where, out, depth) {
+  if (depth > MAX_DEPTH) return;
+  for (const [key, value] of Object.entries(node)) {
+    const here = `${path}.${key}`;
+    if (key === "$and" || key === "$or") {
+      if (Array.isArray(value)) {
+        value.forEach((arm, i) => {
+          if (isPlainObject(arm)) judgeConditionNode(arm, `${here}[${i}]`, where, out, depth + 1);
+        });
+      }
+      continue;
+    }
+    if (key === "$not") {
+      if (isPlainObject(value)) judgeConditionNode(value, here, where, out, depth + 1);
+      continue;
+    }
+    if (key.startsWith("$")) continue;
+    if (!isPlainObject(value)) continue;
+    const hasOps = Object.keys(value).some((k) => k.startsWith("$"));
+    if (!hasOps) {
+      judgeConditionNode(value, here, where, out, depth + 1);
+      continue;
+    }
+    for (const [op, comparand] of Object.entries(value)) {
+      if (ORDERING_DOLLAR_OPS.has(op) && isDateRangePresetName(comparand)) {
+        out.push(finding(where, `${here}.${op}`, comparand, op));
+        continue;
+      }
+      if (op === "$between" && Array.isArray(comparand)) {
+        comparand.forEach((endpoint, i) => {
+          if (isDateRangePresetName(endpoint)) {
+            out.push(finding(where, `${here}.${op}[${i}]`, endpoint, op));
+          }
+        });
+      }
+    }
+  }
+}
+function judgeFilterRule(rule, path, where, out) {
+  const operator = normalizeFilterOperator(rule.operator);
+  if (typeof operator !== "string") return;
+  const value = rule.value;
+  if (ORDERING_RULE_OPS.has(operator) && isDateRangePresetName(value)) {
+    out.push(finding(where, `${path}.value`, value, operator));
+    return;
+  }
+  if (operator === "between" && Array.isArray(value)) {
+    value.forEach((endpoint, i) => {
+      if (isDateRangePresetName(endpoint)) {
+        out.push(finding(where, `${path}.value[${i}]`, endpoint, operator));
+      }
+    });
+  }
+}
+function judgeTriple(triple, path, where, out) {
+  const op = triple[1];
+  if (typeof op !== "string") return;
+  const canonical = canonicalAstOperator(op);
+  const value = triple[2];
+  if (ORDERING_INFIX_OPS.has(canonical) && isDateRangePresetName(value)) {
+    out.push(finding(where, `${path}[2]`, value, op));
+    return;
+  }
+  if (canonical === "between" && Array.isArray(value)) {
+    value.forEach((endpoint, i) => {
+      if (isDateRangePresetName(endpoint)) {
+        out.push(finding(where, `${path}[2][${i}]`, endpoint, op));
+      }
+    });
+  }
+}
+function judgeFilterValue(node, path, where, out, depth) {
+  if (depth > MAX_DEPTH) return;
+  if (Array.isArray(node)) {
+    if (typeof node[0] === "string" && typeof node[1] === "string" && !["and", "or"].includes(node[0].toLowerCase()) && VALID_AST_OPERATORS2.has(node[1].toLowerCase())) {
+      judgeTriple(node, path, where, out);
+      return;
+    }
+    node.forEach((member, i) => {
+      if (typeof member === "string") return;
+      judgeFilterValue(member, `${path}[${i}]`, where, out, depth + 1);
+    });
+    return;
+  }
+  if (!isPlainObject(node)) return;
+  if (typeof node.field === "string" && typeof node.operator === "string") {
+    judgeFilterRule(node, path, where, out);
+    return;
+  }
+  judgeConditionNode(node, path, where, out, depth);
+}
+function validatePresetComparands(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const out = [];
+  walkAuthoredFilters(stack, PRESET_COMPARAND_SURFACES, ({ value, path, where }) => {
+    judgeFilterValue(value, path, where, out, 0);
+  });
+  return out;
+}
+
 // src/validate-empty-combinators.ts
 import { reduceFilterVerdict } from "@objectstack/spec/data";
 var FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
@@ -6264,6 +6495,176 @@ function validateNavObjectServability(stack) {
   return findings;
 }
 
+// src/validate-sortable-fields.ts
+import { isVirtualSearchField as isVirtualSearchField2 } from "@objectstack/spec/data";
+var SORT_FIELD_UNKNOWN = "sort-field-unknown";
+var SORT_FIELD_UNSORTABLE = "sort-field-unsortable";
+function isRec16(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName11(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function readSortKeys(declared) {
+  const fromShorthand = (raw, at) => {
+    const trimmed = raw.trim();
+    if (!trimmed) return void 0;
+    const bare = trimmed.startsWith("-") ? trimmed.slice(1).trim() : trimmed.split(/\s+/)[0];
+    return bare ? { field: bare, at } : void 0;
+  };
+  if (typeof declared === "string") {
+    return declared.split(",").map((part, i) => fromShorthand(part, declared.includes(",") ? `[${i}]` : "")).filter((k) => !!k);
+  }
+  if (Array.isArray(declared)) {
+    const keys = [];
+    for (let i = 0; i < declared.length; i++) {
+      const el = declared[i];
+      if (typeof el === "string") {
+        const k = fromShorthand(el, `[${i}]`);
+        if (k) keys.push(k);
+        continue;
+      }
+      if (!isRec16(el)) continue;
+      const field = strName11(el.field);
+      if (field) keys.push({ field: field.trim(), at: `[${i}]` });
+    }
+    return keys;
+  }
+  return [];
+}
+function suggest4(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance3(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function distance3(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function checkSortDeclaration(declared, objectName, fieldsByObject, where, path, subject) {
+  const findings = [];
+  if (declared === void 0 || declared === null) return findings;
+  if (!objectName) return findings;
+  if (!fieldsByObject.has(objectName)) return findings;
+  const target = fieldsByObject.get(objectName);
+  if (!target) return findings;
+  const known = target.names;
+  for (const key of readSortKeys(declared)) {
+    const name = key.field;
+    const head = name.split(".")[0];
+    if (SYSTEM_FIELDS.has(head)) continue;
+    if (!known.has(head)) {
+      const dotted = name.includes(".");
+      findings.push({
+        severity: "error",
+        rule: SORT_FIELD_UNKNOWN,
+        where,
+        path: `${path}${key.at}`,
+        message: `${subject} orders by "${name}", which is not a field on object "${objectName}". The runtime refuses the sort rather than dropping it: every load of this view answers 400 INVALID_SORT (#6994), because a sort is the view's FIRST fetch and not an optional interaction.` + (dotted ? "" : suggest4(head, known)),
+        hint: (dotted ? `'sort' reaches only whole columns of "${objectName}" itself, never a related record's column \u2014 denormalise the value onto "${objectName}" (a stored field, written when the source changes) and sort by that. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + (known.size > 0 ? `Object fields: ${[...known].sort().join(", ")}.` : "")
+      });
+      continue;
+    }
+    const meta = target.fields[name];
+    if (isVirtualSearchField2(meta)) {
+      const vtype = meta?.type;
+      findings.push({
+        severity: "error",
+        rule: SORT_FIELD_UNSORTABLE,
+        where,
+        path: `${path}${key.at}`,
+        message: `${subject} orders by "${name}" on object "${objectName}", a virtual '${vtype}' field: its value is computed on read and never stored, so no driver materialises a column to ORDER BY. Measured, an unrefused sort on one returns 'asc' and 'desc' in byte-identical order \u2014 the rows carry the values they were asked to be ordered by, unordered, under a success.`,
+        hint: `Denormalise the value onto "${objectName}" (a stored field, written when the source changes) and sort by that, or drop "${name}" from this sort. At runtime both doors now refuse it with 400 INVALID_SORT \u2014 the REST ingress (#6994) and the engine itself (#7095) \u2014 so the declaration breaks the view's first fetch, and every fetch after it.`
+      });
+    }
+  }
+  return findings;
+}
+function validateSortableFields(stack) {
+  const findings = [];
+  if (!isRec16(stack)) return findings;
+  const objects = Array.isArray(stack.objects) ? stack.objects : isRec16(stack.objects) ? Object.entries(stack.objects).map(([name, def]) => ({ name, ...def })) : [];
+  const fieldsByObject = indexObjectSearchTargets(stack);
+  const check = (declared, objectName, where, path, subject) => {
+    findings.push(
+      ...checkSortDeclaration(declared, objectName, fieldsByObject, where, path, subject)
+    );
+  };
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!isRec16(obj)) continue;
+    const objName = strName11(obj.name);
+    const label2 = objName ? `object "${objName}"` : `objects[${oi}]`;
+    if (isRec16(obj.listViews)) {
+      for (const [key, lv] of Object.entries(obj.listViews)) {
+        if (!isRec16(lv)) continue;
+        check(
+          lv.sort,
+          // A built-in list view belongs to its object; an inline `data.object`
+          // may still retarget it (ADR-0047 allows the explicit binding).
+          listViewObject2(lv) ?? objName,
+          `${label2} \u203A listViews.${key}`,
+          `objects[${oi}].listViews.${key}.sort`,
+          "list-view sort"
+        );
+      }
+    }
+  }
+  const views = Array.isArray(stack.views) ? stack.views : [];
+  for (let vi = 0; vi < views.length; vi++) {
+    const view = views[vi];
+    if (!isRec16(view)) continue;
+    const viewLabel2 = strName11(view.name) ?? strName11(view.objectName) ?? `#${vi}`;
+    const viewObject = strName11(view.objectName) ?? strName11(view.object);
+    if (isRec16(view.list)) {
+      check(
+        view.list.sort,
+        listViewObject2(view.list) ?? viewObject,
+        `view "${viewLabel2}" \u203A list`,
+        `views[${vi}].list.sort`,
+        "list-view sort"
+      );
+    }
+    if (isRec16(view.listViews)) {
+      for (const [key, lv] of Object.entries(view.listViews)) {
+        if (!isRec16(lv)) continue;
+        check(
+          lv.sort,
+          listViewObject2(lv) ?? viewObject,
+          `view "${viewLabel2}" \u203A listViews.${key}`,
+          `views[${vi}].listViews.${key}.sort`,
+          "list-view sort"
+        );
+      }
+    }
+  }
+  return findings;
+}
+function listViewObject2(listView) {
+  const data = listView.data;
+  return isRec16(data) ? strName11(data.object) : void 0;
+}
+
 // src/validate-action-name-refs.ts
 var ACTION_NAME_UNDEFINED = "action-name-undefined";
 function asArray28(v) {
@@ -6273,13 +6674,13 @@ function asArray28(v) {
   }
   return [];
 }
-function strName11(v) {
+function strName12(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function distance3(a, b) {
+function distance4(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -6295,11 +6696,11 @@ function distance3(a, b) {
   }
   return prev[n];
 }
-function suggest4(target, known) {
+function suggest5(target, known) {
   let best;
   let bestScore = Infinity;
   for (const candidate of known) {
-    const d = distance3(target, candidate);
+    const d = distance4(target, candidate);
     if (d < bestScore) {
       bestScore = d;
       best = candidate;
@@ -6311,13 +6712,13 @@ function suggest4(target, known) {
 function collectActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   for (const action of asArray28(stack.actions)) {
-    const n = strName11(action?.name);
+    const n = strName12(action?.name);
     if (n) names.add(n);
   }
   for (const obj of asArray28(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     for (const action of asArray28(obj.actions)) {
-      const n = strName11(action?.name);
+      const n = strName12(action?.name);
       if (n) names.add(n);
     }
   }
@@ -6334,7 +6735,7 @@ function validateActionNameRefs(stack) {
       rule: ACTION_NAME_UNDEFINED,
       where,
       path,
-      message: `${surface} names action "${name}", which is defined by no action in this stack (neither \`stack.actions\` nor any object's \`actions\`). The button renders and does nothing when clicked \u2014 a dead affordance the runtime cannot dispatch.` + suggest4(name, known),
+      message: `${surface} names action "${name}", which is defined by no action in this stack (neither \`stack.actions\` nor any object's \`actions\`). The button renders and does nothing when clicked \u2014 a dead affordance the runtime cannot dispatch.` + suggest5(name, known),
       hint: `Define an action named "${name}" (in \`stack.actions\` or the object's \`actions\`) ${placement}, remove the reference, or ignore this if the action is contributed by another installed package.` + (known.size > 0 ? ` Defined actions: ${[...known].sort().join(", ")}.` : "")
     });
   };
@@ -6360,7 +6761,7 @@ function validateActionNameRefs(stack) {
       if (!def || typeof def !== "object") continue;
       if (def.execution !== "aggregate") continue;
       if (def.actionDef !== void 0) continue;
-      const name = strName11(def.name);
+      const name = strName12(def.name);
       if (!name) continue;
       check(
         name,
@@ -6375,7 +6776,7 @@ function validateActionNameRefs(stack) {
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
     if (!view || typeof view !== "object") continue;
-    const viewName = strName11(view.name) ?? strName11(view.object) ?? `#${vi}`;
+    const viewName = strName12(view.name) ?? strName12(view.object) ?? `#${vi}`;
     const owner = `view "${viewName}"`;
     checkListContainer(view.list, owner, "list", `views[${vi}].list`);
     const listViews = view.listViews;
@@ -6391,7 +6792,7 @@ function validateActionNameRefs(stack) {
     if (!obj || typeof obj !== "object") continue;
     const objListViews = obj.listViews;
     if (!objListViews || typeof objListViews !== "object" || Array.isArray(objListViews)) continue;
-    const owner = `object "${strName11(obj.name) ?? `#${oi}`}"`;
+    const owner = `object "${strName12(obj.name) ?? `#${oi}`}"`;
     for (const [key, lv] of Object.entries(objListViews)) {
       checkListContainer(lv, owner, `listViews.${key}`, `objects[${oi}].listViews.${key}`);
     }
@@ -6400,7 +6801,7 @@ function validateActionNameRefs(stack) {
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
-    const pageName = strName11(page.name) ?? `#${pi}`;
+    const pageName = strName12(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
       const props = component.properties;
       if (!props || typeof props !== "object") continue;
@@ -6408,7 +6809,7 @@ function validateActionNameRefs(stack) {
       for (let ai = 0; ai < names.length; ai++) {
         check(
           names[ai],
-          `page "${pageName}" \xB7 component "${strName11(component.type) ?? "?"}"`,
+          `page "${pageName}" \xB7 component "${strName12(component.type) ?? "?"}"`,
           `${path}.properties.actionNames[${ai}]`,
           "Quick-actions bar"
         );
@@ -6419,7 +6820,7 @@ function validateActionNameRefs(stack) {
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName11(app.name) ?? `#${ai}`;
+    const appName = strName12(app.name) ?? `#${ai}`;
     const walkNav = (items, basePath) => {
       const navItems = asArray28(items);
       for (let ni = 0; ni < navItems.length; ni++) {
@@ -6427,20 +6828,20 @@ function validateActionNameRefs(stack) {
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
         const actionDef = nav.actionDef;
-        const actionName = strName11(actionDef?.actionName);
+        const actionName = strName12(actionDef?.actionName);
         if (nav.type === "action" && actionName) {
           check(
             actionName,
-            `app "${appName}" \xB7 nav "${strName11(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName12(nav.id) ?? `#${ni}`}"`,
             `${navPath}.actionDef.actionName`,
             "Navigation action item"
           );
         }
-        const runAction = strName11(nav.runAction);
+        const runAction = strName12(nav.runAction);
         if (nav.type === "object" && runAction) {
           check(
             runAction,
-            `app "${appName}" \xB7 nav "${strName11(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName12(nav.id) ?? `#${ni}`}"`,
             `${navPath}.runAction`,
             "Navigation deep-link auto-run"
           );
@@ -6466,7 +6867,7 @@ function asArray29(v) {
   }
   return [];
 }
-function strName12(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList2(v) {
@@ -6481,7 +6882,7 @@ function collectNamePlacedActions(stack) {
       for (const n of strList2(list3[key])) placed.add(n);
     }
     for (const def of asArray29(list3.bulkActionDefs)) {
-      const n = strName12(def?.name);
+      const n = strName13(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -6507,7 +6908,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName12(action.name);
+    const name = strName13(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -6536,10 +6937,10 @@ import { ComponentPropsMap } from "@objectstack/spec/ui";
 import { lintUnknownKeysAgainstSchema } from "@objectstack/spec";
 var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
 var COMPONENT_PROPS_INVALID = "component-props-invalid";
-function isRec16(v) {
+function isRec17(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName13(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function asArray30(v) {
@@ -6553,8 +6954,8 @@ var PROPS_SCHEMAS = ComponentPropsMap;
 var DATASOURCE_SUPPLIED_PROP = "object";
 function suppliedByDataSource(issue, component) {
   if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
-  const dataSource = isRec16(component.dataSource) ? component.dataSource : void 0;
-  return strName13(dataSource?.object) !== void 0;
+  const dataSource = isRec17(component.dataSource) ? component.dataSource : void 0;
+  return strName14(dataSource?.object) !== void 0;
 }
 function unrecognizedKeysFromUnionArm(issue) {
   if (issue.code !== "invalid_union") return void 0;
@@ -6571,18 +6972,18 @@ function unrecognizedKeysFromUnionArm(issue) {
 }
 function validateComponentProps(stack) {
   const findings = [];
-  if (!isRec16(stack)) return findings;
+  if (!isRec17(stack)) return findings;
   const pages = asArray30(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec16(page)) continue;
-    const pageName = strName13(page.name) ?? `#${pi}`;
+    if (!isRec17(page)) continue;
+    const pageName = strName14(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName13(component.type);
+      const type = strName14(component.type);
       if (!type) continue;
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec16(component.properties) ? component.properties : void 0;
+      const props = isRec17(component.properties) ? component.properties : void 0;
       if (!props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -6654,16 +7055,16 @@ function asArray31(v) {
   }
   return [];
 }
-function strName14(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function isRec17(v) {
+function isRec18(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function distance4(a, b) {
+function distance5(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -6679,11 +7080,11 @@ function distance4(a, b) {
   }
   return prev[n];
 }
-function suggest5(target, known) {
+function suggest6(target, known) {
   let best;
   let bestScore = Infinity;
   for (const c of known) {
-    const d = distance4(target, c);
+    const d = distance5(target, c);
     if (d < bestScore) {
       bestScore = d;
       best = c;
@@ -6699,16 +7100,16 @@ function list2(names) {
 function indexDatasets(stack) {
   const out = /* @__PURE__ */ new Map();
   for (const ds of asArray31(stack.datasets)) {
-    const name = strName14(ds.name);
+    const name = strName15(ds.name);
     if (!name) continue;
     const dimensions = /* @__PURE__ */ new Set();
     for (const d of asArray31(ds.dimensions)) {
-      const n = strName14(d.name);
+      const n = strName15(d.name);
       if (n) dimensions.add(n);
     }
     const measures = /* @__PURE__ */ new Set();
     for (const m of asArray31(ds.measures)) {
-      const n = strName14(m.name);
+      const n = strName15(m.name);
       if (n) measures.add(n);
     }
     out.set(name, { dimensions, measures });
@@ -6731,7 +7132,7 @@ function validateChartBindings(stack) {
         where: binding.where,
         path: `${binding.path}.dataset`,
         message: `binds dataset "${dsName}", which resolves to no declared dataset \u2014 the chart has no data to render.`,
-        hint: `Declared datasets: ${list2(datasets.keys())}.${suggest5(dsName, datasets.keys())} Define it with defineDataset() or fix the reference (ADR-0021).`
+        hint: `Declared datasets: ${list2(datasets.keys())}.${suggest6(dsName, datasets.keys())} Define it with defineDataset() or fix the reference (ADR-0021).`
       });
       return;
     }
@@ -6743,7 +7144,7 @@ function validateChartBindings(stack) {
         where: binding.where,
         path,
         message: `"${name}" is not a dimension declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by DIMENSION NAME, not the base field, so this axis renders with no categories.`,
-        hint: `Dataset dimensions: ${list2(ds.dimensions)}.${suggest5(name, ds.dimensions)} Declare the dimension on the dataset, or bind an existing one.`
+        hint: `Dataset dimensions: ${list2(ds.dimensions)}.${suggest6(name, ds.dimensions)} Declare the dimension on the dataset, or bind an existing one.`
       });
     };
     const measureRef = (name, path, selected2) => {
@@ -6754,7 +7155,7 @@ function validateChartBindings(stack) {
           where: binding.where,
           path,
           message: `"${name}" is not a measure declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by MEASURE NAME (e.g. "sum_amount"), not the base field (e.g. "amount"), so this series comes back empty.`,
-          hint: `Dataset measures: ${list2(ds.measures)}.${suggest5(name, ds.measures)} Declare the measure on the dataset, or bind an existing one.`
+          hint: `Dataset measures: ${list2(ds.measures)}.${suggest6(name, ds.measures)} Declare the measure on the dataset, or bind an existing one.`
         });
         return;
       }
@@ -6789,26 +7190,26 @@ function validateChartBindings(stack) {
   const reports = asArray31(stack.reports);
   for (let ri = 0; ri < reports.length; ri++) {
     const report = reports[ri];
-    if (!isRec17(report)) continue;
-    const reportName = strName14(report.name) ?? `#${ri}`;
+    if (!isRec18(report)) continue;
+    const reportName = strName15(report.name) ?? `#${ri}`;
     const checkReportChart = (chart, dataset, values, where, path) => {
-      if (!isRec17(chart)) return;
+      if (!isRec18(chart)) return;
       check({
         dataset,
         // `values` is the report's measure SELECTION, not a chart ref; feeding
         // it in lets the yAxis "declared but not selected" check work without
         // reporting the selection itself twice.
         values: { names: values, path: `${path}.values` },
-        xAxis: strName14(chart.xAxis) ? { name: strName14(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
-        yAxis: strName14(chart.yAxis) ? { name: strName14(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
-        series: asArray31(chart.series).map((s, si) => ({ name: strName14(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
+        xAxis: strName15(chart.xAxis) ? { name: strName15(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
+        yAxis: strName15(chart.yAxis) ? { name: strName15(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
+        series: asArray31(chart.series).map((s, si) => ({ name: strName15(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
         where,
         path: `${path}.chart`
       });
     };
     checkReportChart(
       report.chart,
-      strName14(report.dataset),
+      strName15(report.dataset),
       strList3(report.values),
       `report "${reportName}" \xB7 chart`,
       `reports[${ri}]`
@@ -6816,22 +7217,22 @@ function validateChartBindings(stack) {
     const blocks = Array.isArray(report.blocks) ? report.blocks : [];
     for (let bi = 0; bi < blocks.length; bi++) {
       const block = blocks[bi];
-      if (!isRec17(block)) continue;
+      if (!isRec18(block)) continue;
       checkReportChart(
         block.chart,
-        strName14(block.dataset),
+        strName15(block.dataset),
         strList3(block.values),
-        `report "${reportName}" \xB7 block "${strName14(block.name) ?? `#${bi}`}" chart`,
+        `report "${reportName}" \xB7 block "${strName15(block.name) ?? `#${bi}`}" chart`,
         `reports[${ri}].blocks[${bi}]`
       );
     }
   }
   const checkListChart = (container, where, path) => {
-    if (!isRec17(container)) return;
+    if (!isRec18(container)) return;
     const chart = container.chart;
-    if (!isRec17(chart)) return;
+    if (!isRec18(chart)) return;
     check({
-      dataset: strName14(chart.dataset),
+      dataset: strName15(chart.dataset),
       dimensions: { names: strList3(chart.dimensions), path: `${path}.chart.dimensions` },
       values: { names: strList3(chart.values), path: `${path}.chart.values` },
       where,
@@ -6841,10 +7242,10 @@ function validateChartBindings(stack) {
   const views = asArray31(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec17(view)) continue;
-    const viewName = strName14(view.name) ?? strName14(view.objectName) ?? `#${vi}`;
+    if (!isRec18(view)) continue;
+    const viewName = strName15(view.name) ?? strName15(view.objectName) ?? `#${vi}`;
     checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
-    if (isRec17(view.listViews)) {
+    if (isRec18(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
         checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
       }
@@ -6853,8 +7254,8 @@ function validateChartBindings(stack) {
   const objects = asArray31(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec17(obj) || !isRec17(obj.listViews)) continue;
-    const objName = strName14(obj.name) ?? `#${oi}`;
+    if (!isRec18(obj) || !isRec18(obj.listViews)) continue;
+    const objName = strName15(obj.name) ?? `#${oi}`;
     for (const [key, lv] of Object.entries(obj.listViews)) {
       checkListChart(
         lv,
@@ -6866,19 +7267,19 @@ function validateChartBindings(stack) {
   const pages = asArray31(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec17(page)) continue;
-    const pageName = strName14(page.name) ?? `#${pi}`;
+    if (!isRec18(page)) continue;
+    const pageName = strName15(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const props = isRec17(component.properties) ? component.properties : void 0;
-      if (!props || !strName14(props.dataset)) continue;
-      const axisRefs = asArray31(props.yAxis).map((a, ai) => ({ name: strName14(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
-      const seriesRefs = asArray31(props.series).map((s, si) => ({ name: strName14(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
+      const props = isRec18(component.properties) ? component.properties : void 0;
+      if (!props || !strName15(props.dataset)) continue;
+      const axisRefs = asArray31(props.yAxis).map((a, ai) => ({ name: strName15(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
+      const seriesRefs = asArray31(props.series).map((s, si) => ({ name: strName15(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
       check({
-        dataset: strName14(props.dataset),
+        dataset: strName15(props.dataset),
         dimensions: { names: strList3(props.dimensions), path: `${path}.properties.dimensions` },
         values: { names: strList3(props.values), path: `${path}.properties.values` },
         series: [...axisRefs, ...seriesRefs],
-        where: `page "${pageName}" \xB7 ${strName14(component.type) ?? "chart"}`,
+        where: `page "${pageName}" \xB7 ${strName15(component.type) ?? "chart"}`,
         path: `${path}.properties`
       });
     }
@@ -6891,11 +7292,11 @@ import { createRequire as createRequire4 } from "module";
 var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
 var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
 var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
-var isRec18 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec19 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray32(v) {
-  if (Array.isArray(v)) return v.filter(isRec18);
-  if (isRec18(v)) {
-    return Object.entries(v).filter(([, def]) => isRec18(def)).map(([name, def]) => ({ name, ...def }));
+  if (Array.isArray(v)) return v.filter(isRec19);
+  if (isRec19(v)) {
+    return Object.entries(v).filter(([, def]) => isRec19(def)).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
@@ -6912,7 +7313,7 @@ function loadAjv() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
     );
   }
-  const ctor = isRec18(mod) && "default" in mod ? mod.default : mod;
+  const ctor = isRec19(mod) && "default" in mod ? mod.default : mod;
   cachedAjv = ctor;
   return ctor;
 }
@@ -6927,7 +7328,7 @@ function loadAddFormats() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
     );
   }
-  const plugin = isRec18(mod) && "default" in mod ? mod.default : mod;
+  const plugin = isRec19(mod) && "default" in mod ? mod.default : mod;
   cachedAddFormats = plugin;
   return plugin;
 }
@@ -6957,13 +7358,13 @@ function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
   if (depth >= MAX_RULE_NESTING_DEPTH) return out;
   for (const branch of ["then", "otherwise"]) {
     const nested = rule[branch];
-    if (isRec18(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+    if (isRec19(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
   }
   return out;
 }
 function walkObjectValidationRules(stack) {
   const walked = [];
-  if (!isRec18(stack)) return walked;
+  if (!isRec19(stack)) return walked;
   for (const obj of asArray32(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     const validations = obj.validations;
@@ -6998,7 +7399,7 @@ function validateRuleCompilability(stack) {
         });
       }
     }
-    if (rule.type === "json_schema" && isRec18(rule.schema)) {
+    if (rule.type === "json_schema" && isRec19(rule.schema)) {
       try {
         createRuntimeAjv().compile(rule.schema);
       } catch (err) {
@@ -7018,7 +7419,7 @@ function validateRuleCompilability(stack) {
 
 // src/validate-rule-schema-formats.ts
 var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
-var isRec19 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec20 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var SUBSCHEMA_KEYS = [
   "additionalItems",
   "additionalProperties",
@@ -7042,7 +7443,7 @@ var SUBSCHEMA_MAP_KEYS = [
 var MAX_SCHEMA_WALK_DEPTH = 32;
 var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
 function collectFormatUses(schema, pointer, out, depth) {
-  if (!isRec19(schema)) return;
+  if (!isRec20(schema)) return;
   if (typeof schema.format === "string") {
     out.push({ pointer: `${pointer}/format`, name: schema.format });
   }
@@ -7061,7 +7462,7 @@ function collectFormatUses(schema, pointer, out, depth) {
   }
   for (const key of SUBSCHEMA_MAP_KEYS) {
     const value = schema[key];
-    if (!isRec19(value)) continue;
+    if (!isRec20(value)) continue;
     for (const [name, entry] of Object.entries(value)) {
       collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
     }
@@ -7069,13 +7470,13 @@ function collectFormatUses(schema, pointer, out, depth) {
   const items = schema.items;
   if (Array.isArray(items)) {
     items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
-  } else if (isRec19(items)) {
+  } else if (isRec20(items)) {
     collectFormatUses(items, `${pointer}/items`, out, depth + 1);
   }
   const dependencies = schema.dependencies;
-  if (isRec19(dependencies)) {
+  if (isRec20(dependencies)) {
     for (const [name, entry] of Object.entries(dependencies)) {
-      if (!isRec19(entry)) continue;
+      if (!isRec20(entry)) continue;
       collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
     }
   }
@@ -7102,9 +7503,9 @@ function nearestRegisteredFormat(name, registered) {
   let best = null;
   let bestDistance = Number.POSITIVE_INFINITY;
   for (const candidate of [...registered].sort()) {
-    const distance7 = editDistance2(authored, candidate);
-    if (distance7 < bestDistance) {
-      bestDistance = distance7;
+    const distance8 = editDistance2(authored, candidate);
+    if (distance8 < bestDistance) {
+      bestDistance = distance8;
       best = candidate;
     }
   }
@@ -7114,7 +7515,7 @@ function validateRuleSchemaFormats(stack) {
   const findings = [];
   const pending = [];
   for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
-    if (rule.type !== "json_schema" || !isRec19(rule.schema)) continue;
+    if (rule.type !== "json_schema" || !isRec20(rule.schema)) continue;
     const uses = [];
     collectFormatUses(rule.schema, "", uses, 0);
     for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
@@ -7239,7 +7640,7 @@ function asArray34(v) {
   }
   return [];
 }
-function strName15(v) {
+function strName16(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function collectNavExposures(stack) {
@@ -7248,18 +7649,18 @@ function collectNavExposures(stack) {
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName15(app.name) ?? `#${ai}`;
+    const appName = strName16(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
       const navItems = asArray34(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
-        const objectName = strName15(nav.objectName);
+        const objectName = strName16(nav.objectName);
         if (nav.type === "object" && objectName) {
           out.push({
             objectName,
-            where: `app "${appName}" \xB7 nav "${strName15(nav.id) ?? `#${ni}`}"`,
+            where: `app "${appName}" \xB7 nav "${strName16(nav.id) ?? `#${ni}`}"`,
             path: `${navPath}.objectName`
           });
         }
@@ -7283,7 +7684,7 @@ function validateNavAccess(stack) {
   if (exposures.length === 0) return findings;
   const ownObjects = /* @__PURE__ */ new Set();
   for (const obj of asArray34(stack.objects)) {
-    const n = strName15(obj.name);
+    const n = strName16(obj.name);
     if (n) ownObjects.add(n);
   }
   const readable = /* @__PURE__ */ new Set();
@@ -7316,18 +7717,18 @@ import { expandViewContainer } from "@objectstack/spec";
 import { hasPlatformObjectPrefix as hasPlatformObjectPrefix2, isPlatformProvidedObjectName as isPlatformProvidedObjectName3 } from "@objectstack/spec/system";
 var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec20(v) {
+function isRec21(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function asArray35(v) {
   if (Array.isArray(v)) return v;
-  if (isRec20(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec20(def) ? def : {} }));
+  if (isRec21(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec21(def) ? def : {} }));
   return [];
 }
-function strName16(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function distance5(a, b) {
+function distance6(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -7343,7 +7744,7 @@ function distance5(a, b) {
   }
   return prev[n];
 }
-function suggest6(target, known) {
+function suggest7(target, known) {
   const names = [...known];
   const segmentMatch = names.find(
     (candidate) => candidate.endsWith(`_${target}`) || candidate.startsWith(`${target}_`)
@@ -7352,7 +7753,7 @@ function suggest6(target, known) {
   let best;
   let bestScore = Infinity;
   for (const candidate of names) {
-    const d = distance5(target, candidate);
+    const d = distance6(target, candidate);
     if (d < bestScore) {
       bestScore = d;
       best = candidate;
@@ -7385,33 +7786,33 @@ function collectViewRecord(view, factsFor) {
   const addSections = (container, binding) => {
     if (!binding) return;
     for (const section of asArray35(container.sections)) {
-      const sectionName = strName16(section.name);
+      const sectionName = strName17(section.name);
       if (sectionName) factsFor(binding).sections.add(sectionName);
     }
   };
-  const listBinding = isRec20(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec20(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
-  addView(recordObject ?? listBinding, strName16(view.name));
+  const listBinding = isRec21(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec21(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
+  addView(recordObject ?? listBinding, strName17(view.name));
   const named = namedViewKeys(view);
   for (const family of ["listViews", "formViews"]) {
     const container = view[family];
-    if (!isRec20(container)) continue;
+    if (!isRec21(container)) continue;
     const registryKeys = family === "listViews" ? named.list : named.form;
     let at = 0;
     for (const sub of Object.values(container)) {
       if (!sub || typeof sub !== "object") continue;
       const registryKey = registryKeys[at++];
-      if (!isRec20(sub)) continue;
+      if (!isRec21(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
       addView(binding, registryKey);
       addSections(sub, binding);
     }
   }
-  if (isRec20(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  if (isRec21(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
   addSections(view, recordObject ?? listBinding);
 }
 function defaultListViewKey(object, container) {
-  if (!object || !isRec20(container.list)) return void 0;
+  if (!object || !isRec21(container.list)) return void 0;
   const item = expandViewContainer(object, container).find(
     (i) => i.viewKind === "list" && i.isDefault
   );
@@ -7423,7 +7824,7 @@ function namedViewKeys(container) {
   const object = "probe";
   const prefix = `${object}.`;
   const bare = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : name;
-  const countEntries = (v) => isRec20(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
+  const countEntries = (v) => isRec21(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
   const listCount = countEntries(container.listViews);
   const formCount = countEntries(container.formViews);
   if (!listCount && !formCount) return { list: [], form: [] };
@@ -7441,14 +7842,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec20(opt)) continue;
-      const value = strName16(opt.value);
+      if (!isRec21(opt)) continue;
+      const value = strName17(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName16(opt.label);
+      const label2 = strName17(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec20(raw)) {
+  } else if (isRec21(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -7469,23 +7870,23 @@ function buildUniverse(stack) {
     return facts;
   };
   for (const obj of asArray35(stack.objects)) {
-    const objectName = strName16(obj.name);
+    const objectName = strName17(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
     for (const field of asArray35(obj.fields)) {
-      const fieldName = strName16(field.name);
+      const fieldName = strName17(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
     for (const action of asArray35(obj.actions)) {
-      const actionName = strName16(action.name);
+      const actionName = strName17(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
     for (const view of asArray35(obj.views)) {
-      collectViewRecord({ ...view, object: strName16(view.object) ?? objectName }, factsFor);
+      collectViewRecord({ ...view, object: strName17(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
     for (const group of asArray35(obj.fieldGroups)) {
-      const key = strName16(group.key) ?? strName16(group.name);
+      const key = strName17(group.key) ?? strName17(group.name);
       if (key) facts.sections.add(key);
     }
   }
@@ -7496,10 +7897,10 @@ function buildUniverse(stack) {
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec20(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec21(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
       for (const section of asArray35(props.sections)) {
-        const sectionName = strName16(section.name);
+        const sectionName = strName17(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
@@ -7507,9 +7908,9 @@ function buildUniverse(stack) {
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
   for (const action of asArray35(stack.actions)) {
-    const actionName = strName16(action.name);
+    const actionName = strName17(action.name);
     if (!actionName) continue;
-    const owner = strName16(action.objectName) ?? strName16(action.object);
+    const owner = strName17(action.objectName) ?? strName17(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -7524,19 +7925,19 @@ function buildUniverse(stack) {
   }
   const apps = /* @__PURE__ */ new Map();
   for (const app of asArray35(stack.apps)) {
-    const appName = strName16(app.name);
+    const appName = strName17(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
       for (const item of asArray35(items)) {
-        const id = strName16(item.id);
+        const id = strName17(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
     for (const area of asArray35(app.areas)) {
-      const areaId = strName16(area.id);
+      const areaId = strName17(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
@@ -7544,20 +7945,20 @@ function buildUniverse(stack) {
   }
   const dashboards = /* @__PURE__ */ new Map();
   for (const dash of asArray35(stack.dashboards)) {
-    const dashName = strName16(dash.name);
+    const dashName = strName17(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
     for (const widget of asArray35(dash.widgets)) {
-      const id = strName16(widget.id) ?? strName16(widget.name);
+      const id = strName17(widget.id) ?? strName17(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray35(isRec20(dash.header) ? dash.header.actions : void 0),
+      ...asArray35(isRec21(dash.header) ? dash.header.actions : void 0),
       ...asArray35(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName16(action.actionUrl) ?? strName16(action.url) ?? strName16(action.name);
+      const key = strName17(action.actionUrl) ?? strName17(action.url) ?? strName17(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -7569,7 +7970,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec20(stack)) return findings;
+  if (!isRec21(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -7578,13 +7979,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec20(bundle)) continue;
+    if (!isRec21(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec20(rawData)) continue;
+      if (!isRec21(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec20(rawNode)) continue;
+        if (!isRec21(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -7592,7 +7993,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 object "${objectName}"`,
             objPath,
-            hasPlatformObjectPrefix2(objectName) ? `Translations are keyed to "${objectName}", which carries a platform namespace prefix but is registered by no platform package, official plugin, or cloud runtime object \u2014 and this stack does not define it either. Nothing resolves these keys.` + suggest6(objectName, universe.objects.keys()) : `Translations are keyed to "${objectName}", which no object in this stack defines. The resolver looks up keys derived from the metadata, so this whole subtree is dead weight \u2014 every label it carries renders untranslated.` + suggest6(objectName, universe.objects.keys()),
+            hasPlatformObjectPrefix2(objectName) ? `Translations are keyed to "${objectName}", which carries a platform namespace prefix but is registered by no platform package, official plugin, or cloud runtime object \u2014 and this stack does not define it either. Nothing resolves these keys.` + suggest7(objectName, universe.objects.keys()) : `Translations are keyed to "${objectName}", which no object in this stack defines. The resolver looks up keys derived from the metadata, so this whole subtree is dead weight \u2014 every label it carries renders untranslated.` + suggest7(objectName, universe.objects.keys()),
             `Rename the key to the object it was written for, drop it, or ignore this if the object is contributed by another installed package.` + (universe.objects.size > 0 ? ` Defined objects: ${listNames(universe.objects.keys())}.` : "")
           );
           continue;
@@ -7605,12 +8006,12 @@ function validateTranslationReferences(stack) {
             orphan(
               `${inLocale} \xB7 object "${objectName}" \xB7 field "${fieldName}"`,
               fieldPath,
-              `Translations are keyed to field "${fieldName}", which object "${objectName}" does not declare. The label renders untranslated in this locale \u2014 and because every neighbouring field DOES resolve, the hole reads as a styling quirk rather than a missing translation.` + suggest6(fieldName, facts.fields.keys()),
+              `Translations are keyed to field "${fieldName}", which object "${objectName}" does not declare. The label renders untranslated in this locale \u2014 and because every neighbouring field DOES resolve, the hole reads as a styling quirk rather than a missing translation.` + suggest7(fieldName, facts.fields.keys()),
               `Point the key at a declared field, or drop it if the field was removed or renamed.` + (facts.fields.size > 0 ? ` Declared fields: ${listNames(facts.fields.keys())}.` : "")
             );
             continue;
           }
-          if (!isRec20(rawField)) continue;
+          if (!isRec21(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -7625,7 +8026,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 object "${objectName}" \xB7 view "${viewName}"`,
             `${objPath}._views.${viewName}`,
-            `Translations are keyed to view "${viewName}", which no view of object "${objectName}" declares. The view tab keeps its source-locale label.` + suggest6(viewName, facts.views),
+            `Translations are keyed to view "${viewName}", which no view of object "${objectName}" declares. The view tab keeps its source-locale label.` + suggest7(viewName, facts.views),
             `Match the key to the view's \`name\` (not its label), or drop it.` + (facts.views.size > 0 ? ` Declared views: ${listNames(facts.views)}.` : "")
           );
         }
@@ -7634,7 +8035,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 object "${objectName}" \xB7 section "${sectionName}"`,
             `${objPath}._sections.${sectionName}`,
-            `Translations are keyed to section "${sectionName}", which nothing on object "${objectName}" declares \u2014 no \`fieldGroups[].key\`, no named form-view section, no named \`record:details\` section. The section heading stays in the source locale.` + suggest6(sectionName, facts.sections),
+            `Translations are keyed to section "${sectionName}", which nothing on object "${objectName}" declares \u2014 no \`fieldGroups[].key\`, no named form-view section, no named \`record:details\` section. The section heading stays in the source locale.` + suggest7(sectionName, facts.sections),
             `Sections are translatable only through a STABLE NAME: give the group/section a \`key\`/\`name\` and use it here, or drop the translation.` + (facts.sections.size > 0 ? ` Declared sections: ${listNames(facts.sections)}.` : ` Object "${objectName}" declares no named section at all.`)
           );
         }
@@ -7645,7 +8046,7 @@ function validateTranslationReferences(stack) {
             orphan(
               `${inLocale} \xB7 object "${objectName}" \xB7 action "${actionName}"`,
               actionPath,
-              `Translations are keyed to action "${actionName}", which is defined by neither object "${objectName}"'s \`actions\` nor a \`stack.actions\` entry bound to it. The button keeps its source-locale label.` + suggest6(actionName, facts.actions.keys()),
+              `Translations are keyed to action "${actionName}", which is defined by neither object "${objectName}"'s \`actions\` nor a \`stack.actions\` entry bound to it. The button keeps its source-locale label.` + suggest7(actionName, facts.actions.keys()),
               `Match the key to a defined action name, move it under the object that owns the action, or drop it.` + (facts.actions.size > 0 ? ` Actions on this object: ${listNames(facts.actions.keys())}.` : "")
             );
             continue;
@@ -7667,7 +8068,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 global action "${actionName}"`,
             actionPath,
-            owner ? `Action "${actionName}" is bound to object "${owner}", so the resolver looks it up under \`objects.${owner}._actions.${actionName}\` \u2014 never under \`globalActions\`, which is only consulted for object-less actions. This key is never read.` : `Translations are keyed to global action "${actionName}", which no object-less action in this stack defines. The button keeps its source-locale label.` + suggest6(actionName, universe.globalActions.keys()),
+            owner ? `Action "${actionName}" is bound to object "${owner}", so the resolver looks it up under \`objects.${owner}._actions.${actionName}\` \u2014 never under \`globalActions\`, which is only consulted for object-less actions. This key is never read.` : `Translations are keyed to global action "${actionName}", which no object-less action in this stack defines. The button keeps its source-locale label.` + suggest7(actionName, universe.globalActions.keys()),
             owner ? `Move these keys under \`objects.${owner}._actions.${actionName}\`.` : `Match the key to an object-less action's name, or drop it.` + (universe.globalActions.size > 0 ? ` Object-less actions: ${listNames(universe.globalActions.keys())}.` : "")
           );
           continue;
@@ -7687,18 +8088,18 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 app "${appName}"`,
             appPath,
-            `Translations are keyed to app "${appName}", which this stack does not define. The app launcher shows the source-locale label.` + suggest6(appName, universe.apps.keys()),
+            `Translations are keyed to app "${appName}", which this stack does not define. The app launcher shows the source-locale label.` + suggest7(appName, universe.apps.keys()),
             `Match the key to an app's \`name\`, or drop it.` + (universe.apps.size > 0 ? ` Defined apps: ${listNames(universe.apps.keys())}.` : "")
           );
           continue;
         }
-        if (!isRec20(rawApp)) continue;
+        if (!isRec21(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
             `${inLocale} \xB7 app "${appName}" \xB7 navigation "${navId}"`,
             `${appPath}.navigation.${navId}`,
-            `Translations are keyed to navigation item "${navId}", which app "${appName}" does not declare. The menu entry keeps its source-locale label.` + suggest6(navId, navIds),
+            `Translations are keyed to navigation item "${navId}", which app "${appName}" does not declare. The menu entry keeps its source-locale label.` + suggest7(navId, navIds),
             `Match the key to the navigation item's \`id\`, or drop it.` + (navIds.size > 0 ? ` Declared navigation ids: ${listNames(navIds)}.` : "")
           );
         }
@@ -7710,18 +8111,18 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 dashboard "${dashName}"`,
             dashPath,
-            `Translations are keyed to dashboard "${dashName}", which this stack does not define. The dashboard title stays in the source locale.` + suggest6(dashName, universe.dashboards.keys()),
+            `Translations are keyed to dashboard "${dashName}", which this stack does not define. The dashboard title stays in the source locale.` + suggest7(dashName, universe.dashboards.keys()),
             `Match the key to a dashboard's \`name\`, or drop it.` + (universe.dashboards.size > 0 ? ` Defined dashboards: ${listNames(universe.dashboards.keys())}.` : "")
           );
           continue;
         }
-        if (!isRec20(rawDash)) continue;
+        if (!isRec21(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
             `${inLocale} \xB7 dashboard "${dashName}" \xB7 widget "${widgetId}"`,
             `${dashPath}.widgets.${widgetId}`,
-            `Translations are keyed to widget "${widgetId}", which dashboard "${dashName}" does not declare. The widget title stays in the source locale.` + suggest6(widgetId, dash.widgets),
+            `Translations are keyed to widget "${widgetId}", which dashboard "${dashName}" does not declare. The widget title stays in the source locale.` + suggest7(widgetId, dash.widgets),
             `Match the key to the widget's \`id\`, or drop it.` + (dash.widgets.size > 0 ? ` Declared widget ids: ${listNames(dash.widgets)}.` : "")
           );
         }
@@ -7730,7 +8131,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 dashboard "${dashName}" \xB7 action "${actionKey}"`,
             `${dashPath}.actions.${actionKey}`,
-            `Translations are keyed to header action "${actionKey}", which dashboard "${dashName}" does not declare. The button keeps its source-locale label.` + suggest6(actionKey, dash.actions),
+            `Translations are keyed to header action "${actionKey}", which dashboard "${dashName}" does not declare. The button keeps its source-locale label.` + suggest7(actionKey, dash.actions),
             `Header-action translations are keyed by the action's \`actionUrl\`, not its label.` + (dash.actions.size > 0 ? ` Declared header actions: ${listNames(dash.actions)}.` : "")
           );
         }
@@ -7740,7 +8141,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec20(v) ? v : {};
+  return isRec21(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -7752,7 +8153,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName16(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName17(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -7765,17 +8166,17 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: `${ctx.path}.${key}`,
-      message: byLabel ? `Option translation is keyed by the DISPLAY LABEL "${key}" instead of the stored value "${byLabel}". The resolver looks the option up by value, so this entry is never found and the option renders with its source-locale label.` : `Option translation is keyed by "${key}", which is not one of the values declared by field "${ctx.objectName}.${ctx.fieldName}". The option renders untranslated.` + suggest6(key, declared.values),
+      message: byLabel ? `Option translation is keyed by the DISPLAY LABEL "${key}" instead of the stored value "${byLabel}". The resolver looks the option up by value, so this entry is never found and the option renders with its source-locale label.` : `Option translation is keyed by "${key}", which is not one of the values declared by field "${ctx.objectName}.${ctx.fieldName}". The option renders untranslated.` + suggest7(key, declared.values),
       hint: byLabel ? `Rename the key to "${byLabel}".` : `Option keys are the stored \`value\`, not the label and not a variant spelling (\`direct_mail\`, not \`direct-mail\`). Declared values: ${listNames(declared.values)}.`
     });
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec20(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec21(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
   for (const param of asArray35(ctx.action.params)) {
-    const name = strName16(param.name) ?? strName16(param.field);
+    const name = strName17(param.name) ?? strName17(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -7785,7 +8186,7 @@ function checkActionParams(findings, ctx) {
       rule: TRANSLATION_TARGET_UNKNOWN,
       where: `${ctx.where} \xB7 param "${paramName}"`,
       path: `${ctx.path}.params.${paramName}`,
-      message: `Translations are keyed to parameter "${paramName}", which ${ctx.subject} does not declare. The parameter's label and help text render untranslated in the action dialog.` + suggest6(paramName, declared),
+      message: `Translations are keyed to parameter "${paramName}", which ${ctx.subject} does not declare. The parameter's label and help text render untranslated in the action dialog.` + suggest7(paramName, declared),
       hint: `Match the key to a declared param \`name\`, or drop it.` + (declared.size > 0 ? ` Declared params: ${listNames(declared)}.` : "")
     });
   }
@@ -7793,14 +8194,14 @@ function checkActionParams(findings, ctx) {
 
 // src/validate-translatable-sections.ts
 var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
-function isRec21(v) {
+function isRec22(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName17(v) {
+function strName18(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function viewLabel(view) {
-  const name = strName17(view.name);
+  const name = strName18(view.name);
   return name ? `view "${name}"` : "";
 }
 function joinWhere(...parts) {
@@ -7808,7 +8209,7 @@ function joinWhere(...parts) {
 }
 function collectViewSites(view, basePath, label2, sites) {
   const recordObject = viewObjectName(view);
-  const listBinding = isRec21(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
+  const listBinding = isRec22(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
   for (const site of viewContainerSites(view, basePath)) {
     sites.push({
       path: `${site.path}.sections`,
@@ -7822,11 +8223,11 @@ function translatedObjectNames(stack) {
   const out = /* @__PURE__ */ new Set();
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   for (const bundle of bundles) {
-    if (!isRec21(bundle)) continue;
+    if (!isRec22(bundle)) continue;
     for (const data of Object.values(bundle)) {
-      if (!isRec21(data) || !isRec21(data.objects)) continue;
+      if (!isRec22(data) || !isRec22(data.objects)) continue;
       for (const [objectName, node] of Object.entries(data.objects)) {
-        if (isRec21(node)) out.add(objectName);
+        if (isRec22(node)) out.add(objectName);
       }
     }
   }
@@ -7838,22 +8239,22 @@ function suggestedName(label2) {
 }
 function validateTranslatableSections(stack) {
   const findings = [];
-  if (!isRec21(stack)) return findings;
+  if (!isRec22(stack)) return findings;
   const translated = translatedObjectNames(stack);
   if (translated.size === 0) return findings;
   const sites = [];
   for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
-    const objectName = strName17(obj.name);
+    const objectName = strName18(obj.name);
     if (!objectName) continue;
     for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
       collectViewSites(
-        { ...view, object: strName17(view.object) ?? objectName },
+        { ...view, object: strName18(view.object) ?? objectName },
         path,
         viewLabel(view),
         sites
       );
     }
-    if (isRec21(obj.listViews)) {
+    if (isRec22(obj.listViews)) {
       collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
     }
   }
@@ -7861,13 +8262,13 @@ function validateTranslatableSections(stack) {
     collectViewSites(view, path, viewLabel(view), sites);
   }
   for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
-    const pageName = strName17(page.name);
+    const pageName = strName18(page.name);
     const pageLabel = pageName ? `page "${pageName}"` : "";
     for (const walked of walkPageComponents(page, pagePath)) {
       if (!walked.objectName) continue;
-      const props = isRec21(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec22(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      const type = strName17(walked.component.type) ?? "component";
+      const type = strName18(walked.component.type) ?? "component";
       sites.push({
         path: `${walked.path}.properties.sections`,
         surface: joinWhere(pageLabel, type),
@@ -7882,9 +8283,9 @@ function validateTranslatableSections(stack) {
     if (!Array.isArray(site.sections)) continue;
     for (let i = 0; i < site.sections.length; i++) {
       const section = site.sections[i];
-      if (!isRec21(section)) continue;
-      if (strName17(section.name)) continue;
-      const heading = strName17(section.label);
+      if (!isRec22(section)) continue;
+      if (strName18(section.name)) continue;
+      const heading = strName18(section.label);
       if (!heading) continue;
       const slug = suggestedName(heading);
       findings.push({
@@ -7909,7 +8310,7 @@ function asArray36(v) {
   }
   return [];
 }
-function strName18(v) {
+function strName19(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -7920,17 +8321,17 @@ function validateAiSurfaceAffinity(stack) {
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
   for (const skill of asArray36(stack.skills)) {
-    const n = strName18(skill.name);
+    const n = strName19(skill.name);
     if (n) skillsByName.set(n, skill);
   }
   const agents = asArray36(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName18(agent.name) ?? `#${ai}`;
+    const agentName = strName19(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName18(skillRefs[si]);
+      const ref = strName19(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -7959,10 +8360,10 @@ function asArray37(v) {
   }
   return [];
 }
-function strName19(v) {
+function strName20(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function distance6(a, b) {
+function distance7(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -7978,14 +8379,14 @@ function distance6(a, b) {
   }
   return prev[n];
 }
-function suggest7(target, known) {
+function suggest8(target, known) {
   for (const prefix of PLATFORM_TOOL_FAMILY_PREFIXES) {
     if (known.has(`${prefix}${target}`)) return ` Did you mean "${prefix}${target}"?`;
   }
   let best;
   let bestScore = Infinity;
   for (const candidate of known) {
-    const d = distance6(target, candidate);
+    const d = distance7(target, candidate);
     if (d < bestScore) {
       bestScore = d;
       best = candidate;
@@ -8000,8 +8401,8 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName19(aiRec.description)) return false;
-  const type = strName19(action.type);
+  if (!strName20(aiRec.description)) return false;
+  const type = strName20(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
@@ -8009,12 +8410,12 @@ function materialisesAsTool(action) {
 function collectToolUniverse(stack) {
   const universe = new Set(PLATFORM_PROVIDED_TOOL_NAMES);
   for (const tool of asArray37(stack.tools)) {
-    const n = strName19(tool.name);
+    const n = strName20(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
     for (const action of asArray37(actions)) {
-      const n = strName19(action.name);
+      const n = strName20(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
@@ -8028,7 +8429,7 @@ function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
     for (const action of asArray37(actions)) {
-      const n = strName19(action.name);
+      const n = strName20(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
@@ -8054,10 +8455,10 @@ function validateAiToolReferences(stack) {
   const skills = asArray37(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName19(skill.name) ?? `#${si}`;
+    const skillName = strName20(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName19(refs[ti]);
+      const ref = strName20(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -8066,7 +8467,7 @@ function validateAiToolReferences(stack) {
         rule: AI_SKILL_TOOL_UNRESOLVED,
         where: `skill "${skillName}" \xB7 tools`,
         path: `skills[${si}].tools[${ti}]`,
-        message: isPattern ? `Skill "${skillName}" subscribes to tool family "${ref}", which matches nothing this stack can resolve (no declared tool, no platform tool, and no AI-exposed declarative action materialises into it). The subscription contributes zero tools at runtime.` : unexposed ? `Skill "${skillName}" references tool "${ref}", but the action "${unexposed}" does not become an AI tool: the runtime materialises \`action_<name>\` only for an action that opts in with \`ai.exposed: true\` + \`ai.description\` (ADR-0011) AND has a headless path (type \`script\`/\`api\`/\`flow\` with a target or body \u2014 \`url\`/\`modal\`/\`form\` are UI-only). The reference is dropped at runtime, so the skill promises a capability the agent cannot call.` : `Skill "${skillName}" references tool "${ref}", which resolves to nothing this stack can see: not a \`stack.tools\` record, not a platform-registered tool, and not a materialised action tool (\`action_<name>\`). The runtime silently drops the reference, so the skill's instructions claim a capability the agent does not have \u2014 the assistant will improvise or fail when asked to use it.` + suggest7(ref, universe),
+        message: isPattern ? `Skill "${skillName}" subscribes to tool family "${ref}", which matches nothing this stack can resolve (no declared tool, no platform tool, and no AI-exposed declarative action materialises into it). The subscription contributes zero tools at runtime.` : unexposed ? `Skill "${skillName}" references tool "${ref}", but the action "${unexposed}" does not become an AI tool: the runtime materialises \`action_<name>\` only for an action that opts in with \`ai.exposed: true\` + \`ai.description\` (ADR-0011) AND has a headless path (type \`script\`/\`api\`/\`flow\` with a target or body \u2014 \`url\`/\`modal\`/\`form\` are UI-only). The reference is dropped at runtime, so the skill promises a capability the agent cannot call.` : `Skill "${skillName}" references tool "${ref}", which resolves to nothing this stack can see: not a \`stack.tools\` record, not a platform-registered tool, and not a materialised action tool (\`action_<name>\`). The runtime silently drops the reference, so the skill's instructions claim a capability the agent does not have \u2014 the assistant will improvise or fail when asked to use it.` + suggest8(ref, universe),
         hint: unexposed ? `Either opt "${unexposed}" in \u2014 set \`ai: { exposed: true, description: '\u2026' }\` (\u226540 chars, LLM-facing) and give it a headless type \u2014 or drop the reference and have the skill's instructions recommend the UI action instead. A \`modal\`/\`form\`/\`url\` action stays human-driven by design; that is a legitimate answer, not a gap.` : `Back "${ref}" with a real executable: declare a declarative action (or flow), opt it in with \`ai.exposed: true\` + \`ai.description\`, and reference its materialised tool (\`action_<name>\` \u2014 the ADR-0109 default path, no tool record needed); or reference a platform tool by its registered name; or remove the reference and the instructions that mention it. Ignore this only if a runtime plugin outside the platform registry provides "${ref}". Family prefixes materialised by the runtime: ${PLATFORM_TOOL_FAMILY_PREFIXES.join(", ")}.`
       });
     }
@@ -8084,7 +8485,7 @@ function asArray38(v) {
   }
   return [];
 }
-function strName20(v) {
+function strName21(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
@@ -8094,7 +8495,7 @@ function validateAiAgentAuthoring(stack) {
   const agents = asArray38(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName20(agent.name) ?? `#${ai}`;
+    const name = strName21(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -8110,9 +8511,9 @@ function validateAiAgentAuthoring(stack) {
   const apps = asArray38(stack.apps);
   for (let appIdx = 0; appIdx < apps.length; appIdx++) {
     const app = apps[appIdx];
-    const defaultAgent = strName20(app.defaultAgent);
+    const defaultAgent = strName21(app.defaultAgent);
     if (!defaultAgent || PLATFORM_AGENT_NAMES.has(defaultAgent)) continue;
-    const appName = strName20(app.name) ?? `#${appIdx}`;
+    const appName = strName21(app.name) ?? `#${appIdx}`;
     findings.push({
       severity: "warning",
       rule: DEFAULT_AGENT_OUTSIDE_ROSTER,
@@ -8142,6 +8543,7 @@ function loadTypeScript3() {
   return cachedTs3;
 }
 var HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+var HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
 var HOOK_BODY_WRITE_PATTERNS = [
   {
     id: "input-property-assign",
@@ -8214,13 +8616,16 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec22 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function unprovisionedAnchorWriteConsequence() {
+  return `so the value can never land: the anchor exists only in the registered schema, which is what carries it PAST the write-path validator that refuses an undeclared name outright (INVALID_FIELD). The remote database is what rejects it \u2014 on a SQL remote with an untyped driver error ('no such column') that aborts the whole statement, so the correctly named fields in the same payload never land either; on a schemaless remote the key is persisted into a column no read surface returns (#4271).`;
+}
+var isRec23 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray39(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec22(x));
-  if (isRec22(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec23(x));
+  if (isRec23(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec22(def) ? def : {}
+      ...isRec23(def) ? def : {}
     }));
   }
   return [];
@@ -8364,14 +8769,16 @@ function validateHookBodyWrites(stack) {
   const hooks = asArray39(stack.hooks);
   if (hooks.length === 0) return findings;
   let objectFields = null;
+  let anchors = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec22(body) || body.language !== "js") return;
+    if (!isRec23(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
     if (writes.length === 0) return;
     objectFields ?? (objectFields = indexObjectFields2(stack));
+    anchors ?? (anchors = indexUnprovisionedAnchors(stack));
     const hookName = typeof hook.name === "string" && hook.name ? hook.name : `#${hookIndex}`;
     const targets = (Array.isArray(hook.object) ? hook.object : [hook.object]).filter(
       (o) => typeof o === "string" && o.trim() !== ""
@@ -8386,7 +8793,20 @@ function validateHookBodyWrites(stack) {
       if (reported.has(dedupeKey)) continue;
       if (w.object === void 0) {
         if (!inputJudgeable) continue;
-        if (IMPLICIT_FIELDS2.has(w.field)) continue;
+        if (IMPLICIT_FIELDS2.has(w.field)) {
+          if (!targets.every((t) => anchors.get(t)?.has(w.field))) continue;
+          reported.add(dedupeKey);
+          const anchorObj = targets.length === 1 ? targets[0] : targets.join(", ");
+          findings.push({
+            severity: "warning",
+            rule: HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR,
+            where,
+            path,
+            message: `body writes '${w.field}' to its input, and ${unprovisionedAnchorCause(anchorObj, w.field)} \u2014 ` + unprovisionedAnchorWriteConsequence(),
+            hint: unprovisionedAnchorHint(anchorObj, w.field)
+          });
+          continue;
+        }
         if (targetSets.some((s) => s.has(w.field))) continue;
         reported.add(dedupeKey);
         const objDesc = targets.length === 1 ? `object '${targets[0]}'` : `none of its target objects (${targets.join(", ")})`;
@@ -8402,7 +8822,20 @@ function validateHookBodyWrites(stack) {
       } else {
         const known = judgeableFieldsOf(objectFields, w.object);
         if (!known) continue;
-        if (IMPLICIT_FIELDS2.has(w.field) || known.has(w.field)) continue;
+        if (known.has(w.field)) continue;
+        if (IMPLICIT_FIELDS2.has(w.field)) {
+          if (!anchors.get(w.object)?.has(w.field)) continue;
+          reported.add(dedupeKey);
+          findings.push({
+            severity: "warning",
+            rule: HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR,
+            where,
+            path,
+            message: `body calls ctx.api.object('${w.object}').${w.method ?? "update"}(\u2026) writing '${w.field}', and ${unprovisionedAnchorCause(w.object, w.field)} \u2014 ${unprovisionedAnchorWriteConsequence()}`,
+            hint: unprovisionedAnchorHint(w.object, w.field)
+          });
+          continue;
+        }
         reported.add(dedupeKey);
         findings.push({
           severity: "warning",
@@ -8431,6 +8864,7 @@ function fixHint(field, declared) {
 import { findClosestMatches as findClosestMatches3, formatSuggestion as formatSuggestion3 } from "@objectstack/spec/shared";
 var ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
 var ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+var ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR = "action-body-write-unprovisioned-anchor";
 var ACTION_BODY_WRITE_PATTERN_IDS = ["api-crud-literal"];
 var ACTION_RECORD_WRITE_PATTERN_IDS = ["record-property-assign"];
 var ACTION_BODY_WRITE_EXCLUSIONS = [
@@ -8447,13 +8881,13 @@ var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_B
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec23 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec24 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray40(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec23(x));
-  if (isRec23(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec24(x));
+  if (isRec24(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec23(def) ? def : {}
+      ...isRec24(def) ? def : {}
     }));
   }
   return [];
@@ -8471,7 +8905,7 @@ function collectActionBodies(stack) {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec23(body) || body.language !== "js") return;
+      if (!isRec24(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -8490,10 +8924,11 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec23(stack)) return findings;
+  if (!isRec24(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
+  let anchors = null;
   for (const site of sites) {
     if (!/\bapi\b/.test(site.source) && !/\brecord\b/.test(site.source)) continue;
     const { writes: allWrites, ctxRecordEscapes } = extractHookBodyWriteSet(site.source);
@@ -8518,6 +8953,7 @@ function validateActionBodyWrites(stack) {
     }
     if (writes.length === 0) continue;
     objectFields ?? (objectFields = indexObjectFields2(stack));
+    anchors ?? (anchors = indexUnprovisionedAnchors(stack));
     const reported = /* @__PURE__ */ new Set();
     for (const w of writes) {
       if (w.object === void 0) continue;
@@ -8525,7 +8961,20 @@ function validateActionBodyWrites(stack) {
       if (reported.has(dedupeKey)) continue;
       const known = judgeableFieldsOf(objectFields, w.object);
       if (!known) continue;
-      if (IMPLICIT_FIELDS2.has(w.field) || known.has(w.field)) continue;
+      if (known.has(w.field)) continue;
+      if (IMPLICIT_FIELDS2.has(w.field)) {
+        if (!anchors.get(w.object)?.has(w.field)) continue;
+        reported.add(dedupeKey);
+        findings.push({
+          severity: "warning",
+          rule: ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR,
+          where,
+          path: site.path,
+          message: `body calls ctx.api.object('${w.object}').${w.method ?? "update"}(\u2026) writing '${w.field}', and ${unprovisionedAnchorCause(w.object, w.field)} \u2014 ${unprovisionedAnchorWriteConsequence()}`,
+          hint: unprovisionedAnchorHint(w.object, w.field)
+        });
+        continue;
+      }
       reported.add(dedupeKey);
       findings.push({
         severity: "warning",
@@ -8547,15 +8996,16 @@ function fixHint2(field, declared) {
 // src/validate-flow-node-writes.ts
 import { findClosestMatches as findClosestMatches4, formatSuggestion as formatSuggestion4 } from "@objectstack/spec/shared";
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
+var FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR = "flow-node-write-unprovisioned-anchor";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
 var FLOW_WRITE_NODE_TYPES_DEFERRED = [];
-var isRec24 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec25 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray41(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec24(x));
-  if (isRec24(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec25(x));
+  if (isRec25(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec24(def) ? def : {}
+      ...isRec25(def) ? def : {}
     }));
   }
   return [];
@@ -8568,30 +9018,44 @@ function readLiteralObjectName2(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec24(stack)) return findings;
+  if (!isRec25(stack)) return findings;
   const flows = asArray41(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
+  let anchors = null;
   flows.forEach((flow, flowIndex) => {
     const flowName = typeof flow.name === "string" && flow.name ? flow.name : `#${flowIndex}`;
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec24(node.config) ? node.config : void 0;
+      const config = isRec25(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec24(fields)) return;
+      if (!isRec25(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName2(config);
       if (!objectName) return;
       objectFields ?? (objectFields = indexObjectFields2(stack));
+      anchors ?? (anchors = indexUnprovisionedAnchors(stack));
       const known = judgeableFieldsOf(objectFields, objectName);
       if (!known) return;
       const nodeName = flowNodeLabel(node, walkIndex);
       const nodeWhere = regionTrail ? `${regionTrail} \u203A node "${nodeName}"` : `node "${nodeName}"`;
       for (const fieldName of written) {
-        if (known.has(fieldName) || IMPLICIT_FIELDS2.has(fieldName)) continue;
+        if (known.has(fieldName)) continue;
+        if (IMPLICIT_FIELDS2.has(fieldName)) {
+          if (!anchors.get(objectName)?.has(fieldName)) continue;
+          findings.push({
+            severity: "warning",
+            rule: FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR,
+            where: `flow "${flowName}" \u203A ${nodeWhere}`,
+            path: `${nodePath}.config.fields.${fieldName}`,
+            message: `${node.type} writes '${fieldName}', and ${unprovisionedAnchorCause(objectName, fieldName)} \u2014 ` + unprovisionedAnchorWriteConsequence(),
+            hint: unprovisionedAnchorHint(objectName, fieldName)
+          });
+          continue;
+        }
         if (fieldName.includes(".")) continue;
         findings.push({
           severity: "error",
@@ -8615,6 +9079,13 @@ function fixHint3(field, declared) {
 var REFERENCE_INTEGRITY_RULES = [
   { name: "validateObjectReferences", run: validateObjectReferences },
   { name: "validateSearchableFields", run: validateSearchableFields },
+  // [#9257] The same reading, one axis over: a list view's `sort` is a field
+  // name written in metadata, resolved against the object's declared fields. It
+  // gates (`error`) because the runtime does not tolerate a bad one at all —
+  // `assertSortFieldsExist` (#6994) and `assertOrderByIsMaterializable` (#7095)
+  // both answer `400 INVALID_SORT` — and a view's sort is its FIRST fetch, so
+  // the refusal is the whole view, on every load, traced to nothing.
+  { name: "validateSortableFields", run: validateSortableFields },
   { name: "validateActionNameRefs", run: validateActionNameRefs },
   { name: "validatePageFieldBindings", run: validatePageFieldBindings },
   { name: "validateChartBindings", run: validateChartBindings },
@@ -9557,6 +10028,17 @@ function lintViewRefs(stack) {
 }
 
 // src/data-model-rules.ts
+function objectWhere(obj) {
+  return `object "${obj?.name}"`;
+}
+function indexWhere(obj, idx, j, cols) {
+  const named = typeof idx?.name === "string" && idx.name.trim() ? `'${idx.name.trim()}'` : "";
+  const label2 = named || (cols.length > 0 ? `[${cols.join(", ")}]` : `#${j}`);
+  return `${objectWhere(obj)} \xB7 index ${label2}`;
+}
+function fieldWhere(obj, fieldName) {
+  return `${objectWhere(obj)} \xB7 field '${fieldName}'`;
+}
 var RELATIONSHIP_TYPES = /* @__PURE__ */ new Set(["lookup", "master_detail"]);
 var NUMERIC_TYPES = /* @__PURE__ */ new Set([
   "number",
@@ -9629,11 +10111,13 @@ function lintUnscopedDeclaredIndexes(objects) {
     for (let j = 0; j < declaredIndexes.length; j++) {
       const idx = declaredIndexes[j];
       if (idx?.unique !== true) continue;
-      const cols = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string").join(", ") : "";
+      const colList = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string") : [];
+      const cols = colList.join(", ");
       const indexLabel = typeof idx?.name === "string" && idx.name.trim() ? ` '${idx.name.trim()}'` : "";
       issues.push({
         severity: "warning",
         rule: UNIQUE_UNSCOPED_DECLARED_INDEX,
+        where: indexWhere(obj, idx, j, colList),
         message: `"${obj.name}" declares index${indexLabel} [${cols}] with bare \`unique: true\` \u2014 a unique index whose scope is unstated (ADR-0120). Today the bare spelling materializes over exactly its \`fields\`, i.e. installation-wide; an author who meant "unique per organization" gets no per-organization constraint and no error. Protocol 18 rejects this spelling (#5082).`,
         path: `objects[${i}].indexes[${j}]`,
         fix: `State the scope: \`unique: 'global'\` (installation-wide \u2014 exactly today's behavior) or \`unique: 'organization'\` (one holder per organization \u2014 the driver prepends the NULL-safe organization key part at registration).`
@@ -9682,6 +10166,11 @@ function lintUniqueDeclarations(objects) {
       issues.push({
         severity: "warning",
         rule: UNIQUE_DOUBLE_DECLARATION,
+        // More specific than `path` on purpose: this rule's finding is about ONE
+        // column, but its `path` has always been the whole object (`objects[i]`)
+        // because the defect straddles `fields.<name>.unique` and an entry of
+        // `indexes`. `where` can name the column without picking one of the two.
+        where: fieldWhere(obj, name),
         message,
         path: `objects[${i}]`,
         fix
@@ -9710,6 +10199,7 @@ function lintLegacyOrganizationComposites(objects) {
       issues.push({
         severity: "warning",
         rule: UNIQUE_LEGACY_ORGANIZATION_COMPOSITE,
+        where: indexWhere(obj, idx, j, cols),
         message: `"${obj.name}" declares index${indexLabel} [${cols.join(", ")}] with ${spelling} and lists the organization column '${tenantColumn}' itself \u2014 the hand-written per-organization composite that predates the scope vocabulary (ADR-0120 S6). It reads as "unique per organization" but materializes as a plain composite, and SQL UNIQUE is NULL-distinct: on every row whose '${tenantColumn}' is NULL it enforces nothing (#5030) \u2014 which on a single-organization deployment is every row.`,
         path: `objects[${i}].indexes[${j}]`,
         fix: `State the scope instead: \`unique: 'organization'\` on this index (keep \`fields\` exactly as they are \u2014 the driver makes the listed '${tenantColumn}' NULL-safe in place rather than prepending a second organization key part). ${rest.length > 0 ? `The constraint then really is "one ${rest.join(" + ")} per organization". ` : ""}Opting in is a physical tightening: it surfaces as a \`recreate_index\` drift op gated by the duplicate pre-flight probe (ADR-0120 D4), so pre-existing duplicate NULL-organization rows block it with a report rather than failing a boot. Leaving it as-is stays valid indefinitely and forces no drift.`
@@ -9856,7 +10346,7 @@ var CLI_ONLY = ["cli"];
 var CLI_AND_RUNTIME = ["cli", "runtime-publish"];
 var RUNTIME_NEEDS_FULL_SNAPSHOT = "P2 (#4463): reads a stack-wide collection the per-write snapshot does not carry, so running it now would report the rest of the tenant's metadata as missing rather than judging this write.";
 var RUNTIME_HEAVY_SOURCE_PARSE = "Not runtime-safe: parses authored source through typescript/sucrase, the two dependencies the kernel boot path must never load (lazy-deps.test.ts). Studio compiles page source on its own path.";
-var RUNTIME_OBJECT_WRITES_P2 = "P2 (#4463): judges an object/field declaration. Object writes are the hottest metadata path in the product, so P1 gates `flow` first and widens once the gate has real traffic behind it.";
+var RUNTIME_OBJECT_ADVISORY_VOLUME = "Advisory-tier object rule: it cannot refuse a write, and it is held off the runtime door for advisory VOLUME (~8 findings per object write measured on unswept metadata, rendered in Studio since #4717), not refusal risk. Crossing it is a UX decision with its own card (#4716).";
 var EXPRESSION_INVALID = "expression-invalid";
 var AUTHORING_RULES = [
   // ADR-0032 §1a/1b — CEL predicates in actions/validations/flows/sharing/hooks
@@ -9917,8 +10407,14 @@ var AUTHORING_RULES = [
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-functional-completeness.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): the OBJECT write door — the five gating
+    // object rules cross together under the 2026-08-18 adjudication. The
+    // false-positive budget the crossing owed was exempted on a measured
+    // 0 refusals / 75 real object declarations (authored config-file metadata,
+    // so a lower bound — see RUNTIME_OBJECT_ADVISORY_VOLUME's note); the six
+    // advisory-tier object rules deliberately do NOT ride.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateFunctionalCompleteness(stack)
   },
   // [#7521, via cloud#1225] A managed object advertising a generic write verb
@@ -9942,8 +10438,11 @@ var AUTHORING_RULES = [
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-managed-api-methods.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): a managed object advertising a verb its
+    // own affordances refuse is exactly the contradiction a Studio/MCP author
+    // can save today — the CLI sweep (#7934) never sees an overlay row.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateManagedApiMethods(stack)
   },
   // A view container in `views: []` that registers zero views: nothing appears
@@ -9965,19 +10464,38 @@ var AUTHORING_RULES = [
   },
   // ADR-0021 (#1719/#1721) — a widget's `dataset`/`dimensions`/`values` and its
   // chartConfig axis/series must resolve against the declared datasets.
+  //
+  // Runtime publish gate (#7529, maintainer-ruled 2026-08-12): a dashboard
+  // widget bound to a dataset that resolves to nothing sailed through save AND
+  // publish — this rule provably caught the body and was simply never invoked,
+  // because `dashboard` was not a runtime-gated type. Option B: a DRAFT may
+  // hold a forward reference; publishing refuses it with the key path named.
+  // The snapshot carries `datasets` for exactly this rule (`RuntimeStackContext`
+  // — without it every legitimate board reads as dangling, the 3-phantom
+  // measurement). `surfaces` is per-RULE, so this flip puts all SIX of the
+  // rule's error ids on the publish gate, not just `widget-dataset-unknown` —
+  // ruled 2026-08-15: they are one coherent "this board cannot render"
+  // reference-integrity class, and the ~6× wider accept-set narrowing was
+  // accepted knowingly rather than splitting the dataset limb into its own
+  // rule (traversal-duplication drift) or adding a per-finding-id surface
+  // filter (registry machinery that weakens "delete a rule from the table and
+  // enforcement stops in the same commit"). Warning-tier ids ride along on the
+  // advisory channel and never block (#4463 P1).
   {
     name: "validateWidgetBindings",
     tier: "gating",
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-widget-bindings.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["dashboard"],
     run: (stack) => validateWidgetBindings(stack)
   },
-  // ADR-0049 / #3367 — a header or widget action naming a `script`/`modal`
-  // target that resolves to no defined action ships a button that renders and
-  // silently does nothing on click. Unresolved `url` routes stay advisory.
+  // ADR-0049 / #3367 — a dashboard header action naming a dead target ships a
+  // button that renders and refuses (or does nothing) on click: a `script`
+  // target must name a defined action, a `modal` target must name a declared
+  // page (objectstack#6739-A — a modal string target names a PAGE, only).
+  // Unresolved `url` routes stay advisory.
   {
     name: "validateDashboardActionRefs",
     tier: "gating",
@@ -10002,6 +10520,28 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateFilterTokens(stack)
   },
+  // #8793 (the ruled C half of #8690) — a declared dashboard date-range preset
+  // name (`last_30_days`, …) authored as a bare ORDERING comparand resolves in
+  // no layer: the engine refuses it on a declared temporal field at query time
+  // (INVALID_FILTER / 400, PR #8808), and anywhere else it compares as a
+  // literal string. This is the authoring-time refusal the ruling shipped
+  // alongside the engine door, judging the filter literal in isolation —
+  // ordering positions only, all three authored filter shapes. Like
+  // `validateEmptyCombinators` it needs NO resolution context, so
+  // RUNTIME_NEEDS_FULL_SNAPSHOT does not apply and the runtime gate runs it
+  // for every filter-carrying type the gate already maps: the write path is
+  // the one door an AI author uses, and dashboards/views are where the preset
+  // vocabulary is near enough to reach for.
+  {
+    name: "validatePresetComparands",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-preset-comparands.ts",
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["dashboard", "view", "object", "page", "flow"],
+    run: (stack) => validatePresetComparands(stack)
+  },
   // #5330 — the LITERAL empty combinators (`$and: []`, `$or: []`, `$not: {}`,
   // `{}`). #5322 ruled their RUNTIME meaning to be the boolean identity, and
   // this rule does not touch it: it refuses the literal SPELLINGS at authoring
@@ -10220,7 +10760,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-record-title.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     run: (stack) => validateRecordTitle(stack)
   },
   // ADR-0085 — `stageField` / `highlightFields` / `Field.group` are pointers
@@ -10233,7 +10773,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-semantic-roles.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     run: (stack) => validateSemanticRoles(stack)
   },
   // #2578 / #4449 — a form section's field reference that resolves to nothing
@@ -10444,7 +10984,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/lint-liveness-properties.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     run: (stack) => lintLivenessProperties(stack).map((f) => ({
       severity: "warning",
       rule: f.rule,
@@ -10463,8 +11003,12 @@ var AUTHORING_RULES = [
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/lint-autonumber-formats.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): an autonumber referencing a field the
+    // object does not carry is broken from the first record; only the error
+    // arm blocks — the optional-field arm is `warning` and rides the
+    // advisory channel like every other non-error finding (#4463 P1).
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => lintAutonumberFormats(stack).map((f) => ({
       severity: f.severity,
       rule: f.rule,
@@ -10505,12 +11049,12 @@ var AUTHORING_RULES = [
     commands: ["validate", "build"],
     source: "packages/lint/src/data-model-rules.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly ahead of R10 in its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
     run: (stack) => lintUnscopedDeclaredIndexes(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
       severity: f.severity === "suggestion" ? "info" : f.severity,
       rule: f.rule,
-      where: f.path,
+      where: f.where,
       path: f.path,
       message: f.message,
       hint: f.fix ?? ""
@@ -10526,12 +11070,12 @@ var AUTHORING_RULES = [
     commands: ["validate", "build"],
     source: "packages/lint/src/data-model-rules.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly as R10 of its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
     run: (stack) => lintUniqueDeclarations(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
       severity: f.severity === "suggestion" ? "info" : f.severity,
       rule: f.rule,
-      where: f.path,
+      where: f.where,
       path: f.path,
       message: f.message,
       hint: f.fix ?? ""
@@ -10548,12 +11092,12 @@ var AUTHORING_RULES = [
     commands: ["validate", "build"],
     source: "packages/lint/src/data-model-rules.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly alongside R10/R11 in its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
     run: (stack) => lintLegacyOrganizationComposites(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
       severity: f.severity === "suggestion" ? "info" : f.severity,
       rule: f.rule,
-      where: f.path,
+      where: f.where,
       path: f.path,
       message: f.message,
       hint: f.fix ?? ""
@@ -10681,16 +11225,26 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateOrgAxisRedLines(stack)
   },
-  // #4698 — the "declared but never read" gate, for the one surface where the
-  // predicate is EXACT rather than inferred. A sharing rule's `condition` has a
-  // single runtime consumer (`bootstrapDeclaredSharingRules`) whose only use of
-  // the key is `compileCelToFilter(condition, { variables: {} })`; a condition
-  // that does not lower means the rule is SKIPPED at boot, so the grant is
-  // declared and does not exist. The lint calls that same compiler, from the
-  // same package, with the same options — the verdict cannot drift from the
-  // consumer's. Gating for the ADR-0078 reason `SharingRuleSchema`'s own
-  // docblock states: the whole authorable surface is enforced, and this was the
-  // one field where that sentence was not yet true.
+  // #4698 / #9698 — the "declared but never read" gate, for the two fields of a
+  // sharing rule where the predicate is EXACT rather than inferred.
+  //
+  //  - `condition` has a single runtime consumer
+  //    (`bootstrapDeclaredSharingRules`) whose only use of the key is
+  //    `compileCelToFilter(condition, { variables: {} })`; a condition that
+  //    does not lower means the rule is SKIPPED at boot.
+  //  - `object` decides whether the grant is refused outright: reconcile hands
+  //    each row to `SharingService.grant`, whose ADR-0111 D7 pre-flight THROWS
+  //    `SHARING_NOT_ENABLED` when the anchor's effective sharing model is
+  //    `public` or it is a `controlled_by_parent` detail. Both are decidable
+  //    from authored metadata; the other arms of that verdict (`owner_id`, the
+  //    bypass set, federated anchors) are not, and are excluded by name.
+  //
+  // Either way the grant is declared and does not exist. The lint calls the
+  // same compiler and mirrors the same verdict function, from the same inputs
+  // — the verdict cannot drift from the consumers'. Gating for the ADR-0078
+  // reason `SharingRuleSchema`'s own docblock states: the whole authorable
+  // surface is enforced, and these were the fields where that sentence was not
+  // yet true.
   {
     name: "validateSharingRuleEnforceability",
     tier: "gating",
@@ -10698,7 +11252,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-sharing-rule-enforceability.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: "P2 (#4463): a sharing rule is not a `flow`, and P1 gates `flow` alone. The rule itself is snapshot-safe \u2014 it reads ONLY `stack.sharingRules[].condition` and needs no other collection \u2014 so widening it here is a `runtimeTypes: ['sharing_rule']` edit once the gate accepts that type, not new wiring. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
+    surfaceReason: "P2 (#4463): a sharing rule is not a `flow`, and P1 gates `flow` alone. This entry used to add that the rule reads ONLY `stack.sharingRules[].condition` and needs no other collection, so crossing was a lone `runtimeTypes` edit. #9698 FALSIFIED that: the anchor arm resolves `sharingRules[].object` against `stack.objects` to read the anchor's OWD, so the rule is now cross-collection. `objects` IS carried by the per-write snapshot (`CONTEXT_STACK_KEYS`, #8309), so the remaining gap is unchanged in SHAPE \u2014 the gate must accept a `sharing_rule` type and the snapshot must carry `sharingRules`, which it does not \u2014 but it is now TWO collections, not one. Crossing with `sharingRules` uncarried would enforce this id for zero of its inputs while the entry claimed the door (#7220). Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
     run: (stack) => validateSharingRuleEnforceability(stack)
   },
   // #4983 — the sibling surface of the rule above, and ADR-0056 D4's gate,
@@ -10737,8 +11291,15 @@ var AUTHORING_RULES = [
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-rule-compilability.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): the rule loads ajv LAZILY, only when the
+    // judged snapshot actually carries a `json_schema` validation — so an
+    // ordinary object write (no `json_schema` anywhere) still loads no
+    // compiler, which `runtime-lazy-deps.test.ts` pins in both directions.
+    // The load it does take (~64 ms cold once, ~15 ms warm per publish
+    // carrying such a rule) is the measured, adjudicated price of refusing a
+    // validation rule that would otherwise ship compiled-by-nothing.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateRuleCompilability(stack)
   },
   // #5178 — the residual half of #5029, which registering `ajv-formats` does
@@ -10759,8 +11320,12 @@ var AUTHORING_RULES = [
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-rule-schema-formats.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): crosses with its compile sibling above —
+    // the two judgements over one artifact stay on one side of the wall
+    // (#7220's family discipline). Same lazy-ajv contract: the registered
+    // format set is only enumerated once a schema actually names a format.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateRuleSchemaFormats(stack)
   }
 ];
@@ -10820,7 +11385,20 @@ var TYPE_TO_STACK_KEY = {
   permission: "permissions",
   book: "books"
 };
-var CONTEXT_STACK_KEYS = ["objects", "permissions", "books"];
+function narrowObjectsToPackageClosure(objects, scope) {
+  if (!scope || typeof scope.packageId !== "string" || scope.packageId === "") return objects;
+  const reachable = /* @__PURE__ */ new Set([scope.packageId, ...scope.dependencies]);
+  return objects.filter((entry) => {
+    if (!entry || typeof entry !== "object") return true;
+    const owner = entry[PACKAGE_PROVENANCE_KEY];
+    if (typeof owner !== "string" || owner === "" || owner === OVERLAY_PROVENANCE_SENTINEL) return true;
+    if (reachable.has(owner)) return true;
+    return isSystemObject(entry);
+  });
+}
+var PACKAGE_PROVENANCE_KEY = "_packageId";
+var OVERLAY_PROVENANCE_SENTINEL = "sys_metadata";
+var CONTEXT_STACK_KEYS = ["objects", "permissions", "books", "datasets"];
 function runtimeAuthoringRulesFor(type) {
   return AUTHORING_RULES.filter(
     (r) => r.surfaces.includes("runtime-publish") && (r.runtimeTypes ?? []).includes(type)
@@ -10846,7 +11424,8 @@ function buildRuntimeWriteSnapshots(args) {
   const itemName = typeof item.name === "string" ? item.name : void 0;
   const baseline = {};
   for (const key of CONTEXT_STACK_KEYS) {
-    const collection = args.context?.[key] ?? [];
+    const raw = args.context?.[key] ?? [];
+    const collection = key === "objects" ? narrowObjectsToPackageClosure(raw, args.packageScope) : raw;
     baseline[key] = key === stackKey ? collection.filter((o) => !itemName || o?.name !== itemName) : collection;
   }
   const candidate = {
@@ -10880,7 +11459,8 @@ function runRuntimeAuthoringRules(args) {
   const snapshots = buildRuntimeWriteSnapshots({
     type: args.type,
     item: args.item,
-    ...args.context !== void 0 ? { context: args.context } : {}
+    ...args.context !== void 0 ? { context: args.context } : {},
+    ...args.packageScope !== void 0 ? { packageScope: args.packageScope } : {}
   });
   if (!snapshots) return empty;
   const ctx = { sduiManifest: args.sduiManifest };
@@ -10897,6 +11477,7 @@ export {
   ACTION_BODY_WRITE_PATTERNS,
   ACTION_BODY_WRITE_PATTERN_IDS,
   ACTION_BODY_WRITE_UNKNOWN_FIELD,
+  ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR,
   ACTION_NAME_UNDEFINED,
   ACTION_NO_PLACEMENT,
   ACTION_RECORD_WRITE_DISCARDED,
@@ -10942,6 +11523,7 @@ export {
   FIELD_GROUP_UNDECLARED,
   FILTER_EMPTY_COMBINATOR,
   FILTER_EMPTY_NODE,
+  FILTER_PRESET_COMPARAND,
   FILTER_TOKEN_UNKNOWN,
   FLOW_APPROVAL_REVISE_DEAD_END,
   FLOW_APPROVAL_REVISE_DISABLED,
@@ -10959,6 +11541,7 @@ export {
   FLOW_MULTIPLE_DEFAULT_EDGES,
   FLOW_MULTI_WRITE_UNFILTERED,
   FLOW_NODE_WRITE_UNKNOWN_FIELD,
+  FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR,
   FLOW_PHANTOM_AGGREGATION,
   FLOW_RUNAS_UNSCOPED,
   FLOW_TEMPLATE_FIELD_UNPROVISIONED,
@@ -10980,6 +11563,7 @@ export {
   HOOK_BODY_WRITE_PATTERNS,
   HOOK_BODY_WRITE_PATTERN_IDS,
   HOOK_BODY_WRITE_UNKNOWN_FIELD,
+  HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR,
   LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   LIVENESS_DEAD_PROPERTY,
   LIVENESS_EXPERIMENTAL_PROPERTY,
@@ -11015,6 +11599,7 @@ export {
   RUNTIME_AJV_OPTIONS,
   SEAL_MARKERS,
   SEARCHABLE_FIELD_UNKNOWN,
+  SEARCHABLE_FIELD_UNPROVISIONED,
   SEARCHABLE_FIELD_UNSEARCHABLE,
   SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
@@ -11033,8 +11618,12 @@ export {
   SEED_VALUE_OUTSIDE_STATE_MACHINE,
   SEMANTIC_ROLE_FIELD_UNKNOWN,
   SEMANTIC_ROLE_FIELD_UNPROVISIONED,
+  SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT,
+  SHARING_RULE_OBJECT_NOT_SHAREABLE,
   SHARING_RULE_RUNTIME_VARIABLE_CONDITION,
   SHARING_RULE_UNLOWERABLE_CONDITION,
+  SORT_FIELD_UNKNOWN,
+  SORT_FIELD_UNSORTABLE,
   STARTUP_OPEN_VOCABULARY_VERDICT,
   STARTUP_VERDICT_ASSERTIVE_WORDING,
   STARTUP_VERDICT_HINT,
@@ -11071,6 +11660,7 @@ export {
   authoringRulesFor,
   buildAccessMatrix,
   buildRuntimeWriteSnapshots,
+  checkSortDeclaration,
   diffAccessMatrix,
   extractHookBodyWriteSet,
   extractHookBodyWrites,
@@ -11085,6 +11675,7 @@ export {
   lintUniqueDeclarations,
   lintUnscopedDeclaredIndexes,
   lintViewRefs,
+  narrowObjectsToPackageClosure,
   nearestRegisteredFormat,
   nullGuardMessage,
   runAuthoringRules,
@@ -11123,6 +11714,7 @@ export {
   validatePageFieldBindings,
   validatePageSourceStyling,
   validatePredicatePathRefs,
+  validatePresetComparands,
   validateReactPageProps,
   validateReactPages,
   validateReadonlyFlowWrites,
@@ -11139,6 +11731,7 @@ export {
   validateSeedStateMachine,
   validateSemanticRoles,
   validateSharingRuleEnforceability,
+  validateSortableFields,
   validateStackExpressions,
   validateTranslatableSections,
   validateTranslationReferences,