@objectstack/lint 17.0.0 → 17.1.0

package/dist/runtime.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var runtime_exports = {};
 __export(runtime_exports, {
   buildRuntimeWriteSnapshots: () => buildRuntimeWriteSnapshots,
+  narrowObjectsToPackageClosure: () => narrowObjectsToPackageClosure,
   runRuntimeAuthoringRules: () => runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor: () => runtimeAuthoringRulesFor,
   runtimeGatedTypes: () => runtimeGatedTypes,
@@ -276,10 +277,10 @@ var OUTCOME_CLAUSE = {
   "fail-closed": "so the rule enforces nothing and the write is rejected fail-closed (#4649/#4763)",
   "fail-open": "so the predicate is SKIPPED fail-open \u2014 the field is never actually required, the write proceeds unchecked, and the only trace is a `requiredWhen \u2026 failed to evaluate \u2014 skipped` log line (#4649/#4811)"
 };
-function nullGuardMessage(subject, objectName, finding, outcome = "fail-closed") {
+function nullGuardMessage(subject, objectName, finding2, outcome = "fail-closed") {
   const owner = objectName ? `'${objectName}'` : "this object";
-  const hasNote = finding.hasOnlyGuard ? ` \`has(${finding.operand})\` does not guard it.` : "";
-  return `${subject} applies \`${finding.operator}\` to \`${finding.operand}\`, which ${owner} declares as nullable (no \`required: true\`, no \`defaultValue\`).${hasNote} At runtime the operand is null, CEL has no \`${finding.operator}\` overload for null, and the whole predicate aborts \u2014 ${OUTCOME_CLAUSE[outcome]}. The predicate compares a value that is null. ${NULL_GUARD_HINT}`;
+  const hasNote = finding2.hasOnlyGuard ? ` \`has(${finding2.operand})\` does not guard it.` : "";
+  return `${subject} applies \`${finding2.operator}\` to \`${finding2.operand}\`, which ${owner} declares as nullable (no \`required: true\`, no \`defaultValue\`).${hasNote} At runtime the operand is null, CEL has no \`${finding2.operator}\` overload for null, and the whole predicate aborts \u2014 ${OUTCOME_CLAUSE[outcome]}. The predicate compares a value that is null. ${NULL_GUARD_HINT}`;
 }
 
 // src/validate-expressions.ts
@@ -462,10 +463,10 @@ function validateStackExpressions(stack) {
     if (!nullableFields || nullableFields.size === 0) return;
     const source = celSourceOf(raw);
     if (!source) return;
-    for (const finding of findUnguardedNullableOperands(source, { nullableFields })) {
+    for (const finding2 of findUnguardedNullableOperands(source, { nullableFields })) {
       issues.push({
         where,
-        message: nullGuardMessage(subject, objectName, finding, outcome),
+        message: nullGuardMessage(subject, objectName, finding2, outcome),
         source,
         severity: "error"
       });
@@ -489,7 +490,7 @@ function validateStackExpressions(stack) {
   const FIELD_RULE_SLOT_CONSEQUENCE_GENERIC = "the predicate faults, and a faulting rule never produces the verdict you declared \u2014 each slot resolves the fault to its own fallback, and none of those fallbacks is yours";
   const FIELD_RULE_SLOT_CONSEQUENCE = {
     visibleWhen: "the predicate faults and the renderer falls back to VISIBLE (`resolveFieldRuleState` evaluates visibility with `fallback: true`, and no server-side gate evaluates a field-level `visibleWhen` at all), leaving the field the test was meant to hide showing for everyone (#6146)",
-    readonlyWhen: "the predicate faults \u2014 and the two ends fault in OPPOSITE directions. The server treats the field as LOCKED (`isReadonlyWhenLocked` will not waive a declared lock it could not evaluate, #4889) and drops your value from the payload, while the form still renders the field editable (`fallback: false`). Per ADR-0057 D10 the server is the one that decides: the field looks writable, the save reports success, and the value silently never lands",
+    readonlyWhen: "the predicate faults \u2014 and the two ends fault in OPPOSITE directions. The server treats the field as LOCKED (`isReadonlyWhenLocked` will not waive a declared lock it could not evaluate, #4889) and drops your value from the payload, while the form still renders the field editable (`fallback: false`). The server is the one that decides: the field looks writable, the save reports success, and the value silently never lands",
     requiredWhen: "the predicate faults and the requirement is never enforced anywhere \u2014 the server logs it and SKIPS the check (fail-open, #4977 deliberately did not take #4889's carve-out) and the form does not mark the field required either, so a record saves with the field empty",
     // Listed rather than left to the `??` below, so the map covers every slot
     // the field walk passes and the default stays unreachable. `FieldSchema`
@@ -548,14 +549,15 @@ function validateStackExpressions(stack) {
           if (retired.length > 0) {
             issues.push({
               where: `${at} \xB7 node '${node.id}' (script) callable`,
-              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + // #6856 route D (maintainer-ruled): the house sentence names the TOOL's
-              // behaviour, never the retired key's fate — "rewrite it" reads two ways
-              // over a branch that DELETES the key (template/recipients/variables/script),
-              // "rewrite existing sources" only one. Plain-quoted (not a template literal)
+              message: `script node carries \`${retired.map((k) => `config.${k}`).join("`, `")}\` \u2014 retired in @objectstack/spec 17 (#4343). The built-in 'email'/'slack' actions were logger-backed stubs that delivered nothing, and inline \`config.script\` was never executed. ` + (action && action !== "invoke_function" && !["email", "slack"].includes(action) ? `\`actionType: '${action}'\` named a registered function \u2014 move it to \`function: '${action}'\`. ` : `Use a \`notify\` node for mail, a \`connector_action\` (Slack connector) or \`http\` node for Slack, and a registered function for logic. `) + // #6856 route D (maintainer-ruled), reworded under #9529: the house
+              // sentence names the TOOL's behaviour, never the retired key's fate —
+              // "rewrite it" read two ways over a branch that DELETES the key
+              // (template/recipients/variables/script), and the tool never rewrote a
+              // source file at all. Plain-quoted (not a template literal)
               // so this site is a member of `retired-key-migrate-sentence.test.ts`'s
               // widened scan (#7030) on the same textual shape as the spec corpus — no
               // interpolation lives in this clause, so nothing is lost switching quote style.
-              "Run `os migrate meta --from 16` to rewrite existing sources automatically.",
+              "Run `os migrate meta --from 16` to list the mechanical edits for existing sources; apply them by hand.",
               source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
             });
           } else if (!fn) {
@@ -626,10 +628,10 @@ function validateStackExpressions(stack) {
           f.expression,
           objectName ? { objectName, fields: fieldIndex.get(objectName), fieldTypes: fieldTypeIndex.get(objectName), scope: "record" } : { scope: "record" }
         );
-        const fieldWhere = `object '${objectName}' \xB7 field '${fname}' expression`;
-        for (const e of res.errors) issues.push({ where: fieldWhere, message: e.message, source: e.source, severity: "error" });
-        for (const w of res.warnings) issues.push({ where: fieldWhere, message: w.message, source: w.source, severity: "warning" });
-        warnUnprovisionedAnchors(fieldWhere, f.expression, objectName);
+        const fieldWhere2 = `object '${objectName}' \xB7 field '${fname}' expression`;
+        for (const e of res.errors) issues.push({ where: fieldWhere2, message: e.message, source: e.source, severity: "error" });
+        for (const w of res.warnings) issues.push({ where: fieldWhere2, message: w.message, source: w.source, severity: "warning" });
+        warnUnprovisionedAnchors(fieldWhere2, f.expression, objectName);
       }
     }
   }
@@ -1278,7 +1280,6 @@ function asArray4(v) {
 function strName(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-var MODAL_VERB_RE = /^(?:create|new|add|edit|update)_(.+)$/;
 var URL_COLLECTION_TO_STACK_KEY = {
   object: "objects",
   objects: "objects",
@@ -1323,13 +1324,10 @@ function collectKnownTargets(stack) {
   return { actions, objects, reports, dashboards, pages, views };
 }
 function resolveActionTarget(actionType, target, known) {
-  if (known.actions.has(target)) return true;
   if (actionType === "modal") {
-    if (known.objects.has(target)) return true;
-    const m = MODAL_VERB_RE.exec(target);
-    if (m && known.objects.has(m[1])) return true;
+    return known.pages.has(target);
   }
-  return false;
+  return known.actions.has(target);
 }
 function resolveUrlRoute(target, known) {
   if (/^[a-z][a-z0-9+.-]*:\/\//i.test(target) || target.startsWith("//")) return null;
@@ -1359,14 +1357,13 @@ function validateDashboardActionRefs(stack) {
     const actionType = strName(action.actionType) ?? "url";
     if (actionType === "script" || actionType === "modal") {
       if (resolveActionTarget(actionType, target, known)) return;
-      const kindWord = actionType === "script" ? "script" : "modal";
       findings.push({
         severity: "error",
         rule: DASHBOARD_ACTION_TARGET_UNDEFINED,
         where,
         path,
-        message: `${kindWord} action target "${target}" resolves to no defined action` + (actionType === "modal" ? " or object" : "") + `. The button renders but does nothing when clicked \u2014 a dangling reference the runtime cannot dispatch (ADR-0049: a declared reference must resolve).`,
-        hint: actionType === "modal" ? `Define an action named "${target}" (stack.actions or the object's actions), use the "<verb>_<object>" convention against a real object (e.g. "create_<object>"), point actionUrl at an existing object, or remove the button.` : `Define a script action named "${target}" (stack.actions or the object's actions) with an inline body or a registered handler, or remove the button.`
+        message: actionType === "modal" ? `modal action target "${target}" names no declared page \u2014 a modal target names a PAGE, only (objectstack#6739). The button renders but the runtime refuses the dispatch when clicked \u2014 a dangling reference (ADR-0049: a declared reference must resolve).` : `script action target "${target}" resolves to no defined action. The button renders but does nothing when clicked \u2014 a dangling reference the runtime cannot dispatch (ADR-0049: a declared reference must resolve).`,
+        hint: actionType === "modal" ? `Point actionUrl at a declared page (stack.pages), or use actionType: 'form' with an "<object>.<view>" form-view target to open an object's form, or remove the button.` : `Define a script action named "${target}" (stack.actions or the object's actions) with an inline body or a registered handler, or remove the button.`
       });
       return;
     }
@@ -1408,7 +1405,7 @@ function validateDashboardActionRefs(stack) {
 var import_data4 = require("@objectstack/spec/data");
 
 // src/filter-walk.ts
-var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
+var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter", "relatedListFilter"]);
 function asArray5(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -1512,8 +1509,146 @@ function validateFilterTokens(stack) {
   return out;
 }
 
-// src/validate-empty-combinators.ts
+// src/validate-preset-comparands.ts
 var import_data5 = require("@objectstack/spec/data");
+var import_ui2 = require("@objectstack/spec/ui");
+var FILTER_PRESET_COMPARAND = "filter-preset-comparand";
+var PRESET_COMPARAND_SURFACES = [
+  { key: "dashboards", kind: "dashboard" },
+  { key: "objects", kind: "object" },
+  { key: "views", kind: "view" },
+  { key: "reports", kind: "report" },
+  { key: "datasets", kind: "dataset" },
+  { key: "pages", kind: "page" },
+  { key: "apps", kind: "app" },
+  { key: "flows", kind: "flow" }
+];
+var ORDERING_DOLLAR_OPS = /* @__PURE__ */ new Set(["$gt", "$gte", "$lt", "$lte"]);
+var ORDERING_INFIX_OPS = /* @__PURE__ */ new Set([">", ">=", "<", "<="]);
+var ORDERING_RULE_OPS = /* @__PURE__ */ new Set([
+  "greater_than",
+  "greater_than_or_equal",
+  "less_than",
+  "less_than_or_equal",
+  "before",
+  "after"
+]);
+var MAX_DEPTH = 32;
+function isPlainObject(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date);
+}
+function finding(where, path, preset, operator) {
+  return {
+    severity: "error",
+    rule: FILTER_PRESET_COMPARAND,
+    where,
+    path,
+    message: (0, import_data5.bareDateRangePresetComparandMessage)(preset, operator),
+    hint: "Presets belong to the dashboard date-filter bar (dateRange.defaultRange, a date global filter's defaultValue). In a filter comparand, write the {date-macro} window the message names, or an ISO date."
+  };
+}
+function judgeConditionNode(node, path, where, out, depth) {
+  if (depth > MAX_DEPTH) return;
+  for (const [key, value] of Object.entries(node)) {
+    const here = `${path}.${key}`;
+    if (key === "$and" || key === "$or") {
+      if (Array.isArray(value)) {
+        value.forEach((arm, i) => {
+          if (isPlainObject(arm)) judgeConditionNode(arm, `${here}[${i}]`, where, out, depth + 1);
+        });
+      }
+      continue;
+    }
+    if (key === "$not") {
+      if (isPlainObject(value)) judgeConditionNode(value, here, where, out, depth + 1);
+      continue;
+    }
+    if (key.startsWith("$")) continue;
+    if (!isPlainObject(value)) continue;
+    const hasOps = Object.keys(value).some((k) => k.startsWith("$"));
+    if (!hasOps) {
+      judgeConditionNode(value, here, where, out, depth + 1);
+      continue;
+    }
+    for (const [op, comparand] of Object.entries(value)) {
+      if (ORDERING_DOLLAR_OPS.has(op) && (0, import_data5.isDateRangePresetName)(comparand)) {
+        out.push(finding(where, `${here}.${op}`, comparand, op));
+        continue;
+      }
+      if (op === "$between" && Array.isArray(comparand)) {
+        comparand.forEach((endpoint, i) => {
+          if ((0, import_data5.isDateRangePresetName)(endpoint)) {
+            out.push(finding(where, `${here}.${op}[${i}]`, endpoint, op));
+          }
+        });
+      }
+    }
+  }
+}
+function judgeFilterRule(rule, path, where, out) {
+  const operator = (0, import_ui2.normalizeFilterOperator)(rule.operator);
+  if (typeof operator !== "string") return;
+  const value = rule.value;
+  if (ORDERING_RULE_OPS.has(operator) && (0, import_data5.isDateRangePresetName)(value)) {
+    out.push(finding(where, `${path}.value`, value, operator));
+    return;
+  }
+  if (operator === "between" && Array.isArray(value)) {
+    value.forEach((endpoint, i) => {
+      if ((0, import_data5.isDateRangePresetName)(endpoint)) {
+        out.push(finding(where, `${path}.value[${i}]`, endpoint, operator));
+      }
+    });
+  }
+}
+function judgeTriple(triple, path, where, out) {
+  const op = triple[1];
+  if (typeof op !== "string") return;
+  const canonical = (0, import_data5.canonicalAstOperator)(op);
+  const value = triple[2];
+  if (ORDERING_INFIX_OPS.has(canonical) && (0, import_data5.isDateRangePresetName)(value)) {
+    out.push(finding(where, `${path}[2]`, value, op));
+    return;
+  }
+  if (canonical === "between" && Array.isArray(value)) {
+    value.forEach((endpoint, i) => {
+      if ((0, import_data5.isDateRangePresetName)(endpoint)) {
+        out.push(finding(where, `${path}[2][${i}]`, endpoint, op));
+      }
+    });
+  }
+}
+function judgeFilterValue(node, path, where, out, depth) {
+  if (depth > MAX_DEPTH) return;
+  if (Array.isArray(node)) {
+    if (typeof node[0] === "string" && typeof node[1] === "string" && !["and", "or"].includes(node[0].toLowerCase()) && import_data5.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
+      judgeTriple(node, path, where, out);
+      return;
+    }
+    node.forEach((member, i) => {
+      if (typeof member === "string") return;
+      judgeFilterValue(member, `${path}[${i}]`, where, out, depth + 1);
+    });
+    return;
+  }
+  if (!isPlainObject(node)) return;
+  if (typeof node.field === "string" && typeof node.operator === "string") {
+    judgeFilterRule(node, path, where, out);
+    return;
+  }
+  judgeConditionNode(node, path, where, out, depth);
+}
+function validatePresetComparands(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const out = [];
+  walkAuthoredFilters(stack, PRESET_COMPARAND_SURFACES, ({ value, path, where }) => {
+    judgeFilterValue(value, path, where, out, 0);
+  });
+  return out;
+}
+
+// src/validate-empty-combinators.ts
+var import_data6 = require("@objectstack/spec/data");
 var FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
 var FILTER_EMPTY_NODE = "filter-empty-node";
 var EMPTY_COMBINATOR_SURFACES = [
@@ -1532,12 +1667,12 @@ function isFilterNode(value) {
   return proto === Object.prototype || proto === null;
 }
 var VERDICT_OF = {
-  $and: (0, import_data5.reduceFilterVerdict)({ $and: [] }),
-  $or: (0, import_data5.reduceFilterVerdict)({ $or: [] }),
-  $not: (0, import_data5.reduceFilterVerdict)({ $not: {} }),
-  node: (0, import_data5.reduceFilterVerdict)({}),
+  $and: (0, import_data6.reduceFilterVerdict)({ $and: [] }),
+  $or: (0, import_data6.reduceFilterVerdict)({ $or: [] }),
+  $not: (0, import_data6.reduceFilterVerdict)({ $not: {} }),
+  node: (0, import_data6.reduceFilterVerdict)({}),
   /** One TRUE disjunct absorbs its `$or`: the sibling branches stop mattering. */
-  orWithEmptyBranch: (0, import_data5.reduceFilterVerdict)({ $or: [{ status: "open" }, {}] })
+  orWithEmptyBranch: (0, import_data6.reduceFilterVerdict)({ $or: [{ status: "open" }, {}] })
 };
 function rows(verdict) {
   if (verdict === "true") return "matches EVERY row";
@@ -1822,9 +1957,10 @@ function validateObjectReferences(stack) {
 }
 
 // src/validate-searchable-fields.ts
-var import_data6 = require("@objectstack/spec/data");
+var import_data7 = require("@objectstack/spec/data");
 var SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
 var SEARCHABLE_FIELD_UNSEARCHABLE = "searchable-field-unsearchable";
+var SEARCHABLE_FIELD_UNPROVISIONED = "searchable-field-unprovisioned";
 function asArray7(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -1870,7 +2006,7 @@ function resolveAllowedSet(target) {
     fields = { ...fields };
     for (const f of systemDeclared) fields[f] = {};
   }
-  const { allowed, source } = (0, import_data6.resolveSearchFieldResolution)({
+  const { allowed, source } = (0, import_data7.resolveSearchFieldResolution)({
     fields,
     searchableFields: target.searchableFields,
     displayField: target.displayField
@@ -1915,7 +2051,7 @@ function indexObjectSearchTargets(stack) {
   }
   return fieldsByObject;
 }
-function checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role = "narrowing") {
+function checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role = "narrowing", unprovisionedAnchors) {
   const findings = [];
   if (!Array.isArray(declared) || declared.length === 0) return findings;
   if (!objectName) return findings;
@@ -1923,6 +2059,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
   const target = fieldsByObject.get(objectName);
   if (!target) return findings;
   const known = target.names;
+  const anchors = unprovisionedAnchors?.get(objectName);
   const resolution = role === "narrowing" ? resolveAllowedSet(target) : void 0;
   for (let i = 0; i < declared.length; i++) {
     const entry = declared[i];
@@ -1940,7 +2077,17 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       });
       continue;
     }
-    if ((0, import_data6.isVirtualSearchField)(target.fields[name])) {
+    if (anchors?.has(name)) {
+      findings.push({
+        severity: "warning",
+        rule: SEARCHABLE_FIELD_UNPROVISIONED,
+        where,
+        path: `${path}[${i}]`,
+        message: `${subject} entry "${name}" resolves on object "${objectName}", but ${unprovisionedAnchorCause(objectName, name)}` + (role === "narrowing" ? ` \u2014 clients echo this declaration verbatim as the '$searchFields' override, so every toolbar search on this list scans a column that is empty on every record: it reads as search coverage and matches nothing.` : ` \u2014 'search' scans it on every record and it can never match, so the object's searchable set is narrower than it declares. Should it be the ONLY entry that resolves, the set scans nothing at all.`),
+        hint: unprovisionedAnchorHint(objectName, name)
+      });
+    }
+    if ((0, import_data7.isVirtualSearchField)(target.fields[name])) {
       const vtype = target.fields[name]?.type;
       findings.push({
         severity: "error",
@@ -1968,7 +2115,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
     }
     const isReference = meta?.type === "lookup" || meta?.type === "master_detail";
     let why;
-    if (import_data6.SEARCH_AUTO_EXCLUDED_FIELDS.has(name)) {
+    if (import_data7.SEARCH_AUTO_EXCLUDED_FIELDS.has(name)) {
       why = "a system/audit column, which the auto-default set never includes";
     } else if (meta?.hidden) {
       why = "hidden";
@@ -1982,7 +2129,7 @@ function checkSearchableFieldList(declared, objectName, fieldsByObject, where, p
       rule: SEARCHABLE_FIELD_UNSEARCHABLE,
       where,
       path: `${path}[${i}]`,
-      message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...import_data6.SEARCHABLE_TEXTUAL_TYPES, ...import_data6.SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
+      message: `${subject} entry "${name}" on object "${objectName}" is ${why}. With no 'searchableFields' declared on the object, 'search' scans its text-like columns (${[...import_data7.SEARCHABLE_TEXTUAL_TYPES, ...import_data7.SEARCHABLE_ENUM_TYPES].join(" / ")}). Clients echo this declaration verbatim as the '$searchFields' override, and the runtime refuses it: every toolbar search on this list returns 400 INVALID_FIELD (#4254).`,
       hint: (isReference ? `A ${meta?.type} column stores only the referenced record's id, so it cannot be a keyword target \u2014 drop "${name}" from this view and, to search by the related record's title, mirror it onto a stored text field here and declare that instead. ` : `Drop "${name}" from this view, or target a text-like field instead. `) + `Declaring 'searchableFields' on object "${objectName}" chooses the searchable set explicitly.`
     });
   }
@@ -1993,9 +2140,19 @@ function validateSearchableFields(stack) {
   if (!isRec3(stack)) return findings;
   const objects = asArray7(stack.objects);
   const fieldsByObject = indexObjectSearchTargets(stack);
+  const unprovisionedAnchors = indexUnprovisionedAnchors(stack);
   const check = (declared, objectName, where, path, subject, role) => {
     findings.push(
-      ...checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject, role)
+      ...checkSearchableFieldList(
+        declared,
+        objectName,
+        fieldsByObject,
+        where,
+        path,
+        subject,
+        role,
+        unprovisionedAnchors
+      )
     );
   };
   for (let oi = 0; oi < objects.length; oi++) {
@@ -2064,33 +2221,203 @@ function listViewObject(listView) {
   return isRec3(data) ? strName3(data.object) : void 0;
 }
 
-// src/page-walk.ts
+// src/validate-sortable-fields.ts
+var import_data8 = require("@objectstack/spec/data");
+var SORT_FIELD_UNKNOWN = "sort-field-unknown";
+var SORT_FIELD_UNSORTABLE = "sort-field-unsortable";
 function isRec4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function strName4(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
+function readSortKeys(declared) {
+  const fromShorthand = (raw, at) => {
+    const trimmed = raw.trim();
+    if (!trimmed) return void 0;
+    const bare = trimmed.startsWith("-") ? trimmed.slice(1).trim() : trimmed.split(/\s+/)[0];
+    return bare ? { field: bare, at } : void 0;
+  };
+  if (typeof declared === "string") {
+    return declared.split(",").map((part, i) => fromShorthand(part, declared.includes(",") ? `[${i}]` : "")).filter((k) => !!k);
+  }
+  if (Array.isArray(declared)) {
+    const keys = [];
+    for (let i = 0; i < declared.length; i++) {
+      const el = declared[i];
+      if (typeof el === "string") {
+        const k = fromShorthand(el, `[${i}]`);
+        if (k) keys.push(k);
+        continue;
+      }
+      if (!isRec4(el)) continue;
+      const field = strName4(el.field);
+      if (field) keys.push({ field: field.trim(), at: `[${i}]` });
+    }
+    return keys;
+  }
+  return [];
+}
+function suggest4(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance3(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function distance3(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function checkSortDeclaration(declared, objectName, fieldsByObject, where, path, subject) {
+  const findings = [];
+  if (declared === void 0 || declared === null) return findings;
+  if (!objectName) return findings;
+  if (!fieldsByObject.has(objectName)) return findings;
+  const target = fieldsByObject.get(objectName);
+  if (!target) return findings;
+  const known = target.names;
+  for (const key of readSortKeys(declared)) {
+    const name = key.field;
+    const head = name.split(".")[0];
+    if (SYSTEM_FIELDS.has(head)) continue;
+    if (!known.has(head)) {
+      const dotted = name.includes(".");
+      findings.push({
+        severity: "error",
+        rule: SORT_FIELD_UNKNOWN,
+        where,
+        path: `${path}${key.at}`,
+        message: `${subject} orders by "${name}", which is not a field on object "${objectName}". The runtime refuses the sort rather than dropping it: every load of this view answers 400 INVALID_SORT (#6994), because a sort is the view's FIRST fetch and not an optional interaction.` + (dotted ? "" : suggest4(head, known)),
+        hint: (dotted ? `'sort' reaches only whole columns of "${objectName}" itself, never a related record's column \u2014 denormalise the value onto "${objectName}" (a stored field, written when the source changes) and sort by that. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + (known.size > 0 ? `Object fields: ${[...known].sort().join(", ")}.` : "")
+      });
+      continue;
+    }
+    const meta = target.fields[name];
+    if ((0, import_data8.isVirtualSearchField)(meta)) {
+      const vtype = meta?.type;
+      findings.push({
+        severity: "error",
+        rule: SORT_FIELD_UNSORTABLE,
+        where,
+        path: `${path}${key.at}`,
+        message: `${subject} orders by "${name}" on object "${objectName}", a virtual '${vtype}' field: its value is computed on read and never stored, so no driver materialises a column to ORDER BY. Measured, an unrefused sort on one returns 'asc' and 'desc' in byte-identical order \u2014 the rows carry the values they were asked to be ordered by, unordered, under a success.`,
+        hint: `Denormalise the value onto "${objectName}" (a stored field, written when the source changes) and sort by that, or drop "${name}" from this sort. At runtime both doors now refuse it with 400 INVALID_SORT \u2014 the REST ingress (#6994) and the engine itself (#7095) \u2014 so the declaration breaks the view's first fetch, and every fetch after it.`
+      });
+    }
+  }
+  return findings;
+}
+function validateSortableFields(stack) {
+  const findings = [];
+  if (!isRec4(stack)) return findings;
+  const objects = Array.isArray(stack.objects) ? stack.objects : isRec4(stack.objects) ? Object.entries(stack.objects).map(([name, def]) => ({ name, ...def })) : [];
+  const fieldsByObject = indexObjectSearchTargets(stack);
+  const check = (declared, objectName, where, path, subject) => {
+    findings.push(
+      ...checkSortDeclaration(declared, objectName, fieldsByObject, where, path, subject)
+    );
+  };
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!isRec4(obj)) continue;
+    const objName = strName4(obj.name);
+    const label2 = objName ? `object "${objName}"` : `objects[${oi}]`;
+    if (isRec4(obj.listViews)) {
+      for (const [key, lv] of Object.entries(obj.listViews)) {
+        if (!isRec4(lv)) continue;
+        check(
+          lv.sort,
+          // A built-in list view belongs to its object; an inline `data.object`
+          // may still retarget it (ADR-0047 allows the explicit binding).
+          listViewObject2(lv) ?? objName,
+          `${label2} \u203A listViews.${key}`,
+          `objects[${oi}].listViews.${key}.sort`,
+          "list-view sort"
+        );
+      }
+    }
+  }
+  const views = Array.isArray(stack.views) ? stack.views : [];
+  for (let vi = 0; vi < views.length; vi++) {
+    const view = views[vi];
+    if (!isRec4(view)) continue;
+    const viewLabel2 = strName4(view.name) ?? strName4(view.objectName) ?? `#${vi}`;
+    const viewObject = strName4(view.objectName) ?? strName4(view.object);
+    if (isRec4(view.list)) {
+      check(
+        view.list.sort,
+        listViewObject2(view.list) ?? viewObject,
+        `view "${viewLabel2}" \u203A list`,
+        `views[${vi}].list.sort`,
+        "list-view sort"
+      );
+    }
+    if (isRec4(view.listViews)) {
+      for (const [key, lv] of Object.entries(view.listViews)) {
+        if (!isRec4(lv)) continue;
+        check(
+          lv.sort,
+          listViewObject2(lv) ?? viewObject,
+          `view "${viewLabel2}" \u203A listViews.${key}`,
+          `views[${vi}].listViews.${key}.sort`,
+          "list-view sort"
+        );
+      }
+    }
+  }
+  return findings;
+}
+function listViewObject2(listView) {
+  const data = listView.data;
+  return isRec4(data) ? strName4(data.object) : void 0;
+}
+
+// src/page-walk.ts
+function isRec5(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName5(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
 var SOURCE_AUTHORED_KINDS = /* @__PURE__ */ new Set(["html", "react", "jsx"]);
 function isSourceAuthoredPage(page) {
-  const kind = strName4(page.kind);
+  const kind = strName5(page.kind);
   return kind !== void 0 && SOURCE_AUTHORED_KINDS.has(kind);
 }
 function walkPageComponents(page, pagePath) {
   const out = [];
-  if (!isRec4(page) || isSourceAuthoredPage(page)) return out;
-  const pageObject = strName4(page.object);
+  if (!isRec5(page) || isSourceAuthoredPage(page)) return out;
+  const pageObject = strName5(page.object);
   const visit = (node, path, inheritedObject) => {
-    if (!isRec4(node)) return;
-    const props = isRec4(node.properties) ? node.properties : void 0;
-    const dataSource = isRec4(node.dataSource) ? node.dataSource : void 0;
-    const objectName = strName4(dataSource?.object) ?? strName4(props?.object) ?? inheritedObject;
+    if (!isRec5(node)) return;
+    const props = isRec5(node.properties) ? node.properties : void 0;
+    const dataSource = isRec5(node.dataSource) ? node.dataSource : void 0;
+    const objectName = strName5(dataSource?.object) ?? strName5(props?.object) ?? inheritedObject;
     out.push({ component: node, path, objectName });
     if (!props) return;
     if (Array.isArray(props.items)) {
       for (let i = 0; i < props.items.length; i++) {
         const item = props.items[i];
-        if (!isRec4(item) || !Array.isArray(item.children)) continue;
+        if (!isRec5(item) || !Array.isArray(item.children)) continue;
         for (let c = 0; c < item.children.length; c++) {
           visit(item.children[c], `${path}.properties.items[${i}].children[${c}]`, objectName);
         }
@@ -2112,12 +2439,12 @@ function walkPageComponents(page, pagePath) {
   const regions = Array.isArray(page.regions) ? page.regions : [];
   for (let r = 0; r < regions.length; r++) {
     const region = regions[r];
-    if (!isRec4(region) || !Array.isArray(region.components)) continue;
+    if (!isRec5(region) || !Array.isArray(region.components)) continue;
     for (let c = 0; c < region.components.length; c++) {
       visit(region.components[c], `${pagePath}.regions[${r}].components[${c}]`, pageObject);
     }
   }
-  const slots = isRec4(page.slots) ? page.slots : void 0;
+  const slots = isRec5(page.slots) ? page.slots : void 0;
   if (slots) {
     for (const [slot, value] of Object.entries(slots)) {
       const list3 = Array.isArray(value) ? value : [value];
@@ -2139,13 +2466,13 @@ function asArray8(v) {
   }
   return [];
 }
-function strName5(v) {
+function strName6(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function distance3(a, b) {
+function distance4(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -2161,11 +2488,11 @@ function distance3(a, b) {
   }
   return prev[n];
 }
-function suggest4(target, known) {
+function suggest5(target, known) {
   let best;
   let bestScore = Infinity;
   for (const candidate of known) {
-    const d = distance3(target, candidate);
+    const d = distance4(target, candidate);
     if (d < bestScore) {
       bestScore = d;
       best = candidate;
@@ -2177,13 +2504,13 @@ function suggest4(target, known) {
 function collectActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   for (const action of asArray8(stack.actions)) {
-    const n = strName5(action?.name);
+    const n = strName6(action?.name);
     if (n) names.add(n);
   }
   for (const obj of asArray8(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     for (const action of asArray8(obj.actions)) {
-      const n = strName5(action?.name);
+      const n = strName6(action?.name);
       if (n) names.add(n);
     }
   }
@@ -2200,7 +2527,7 @@ function validateActionNameRefs(stack) {
       rule: ACTION_NAME_UNDEFINED,
       where,
       path,
-      message: `${surface} names action "${name}", which is defined by no action in this stack (neither \`stack.actions\` nor any object's \`actions\`). The button renders and does nothing when clicked \u2014 a dead affordance the runtime cannot dispatch.` + suggest4(name, known),
+      message: `${surface} names action "${name}", which is defined by no action in this stack (neither \`stack.actions\` nor any object's \`actions\`). The button renders and does nothing when clicked \u2014 a dead affordance the runtime cannot dispatch.` + suggest5(name, known),
       hint: `Define an action named "${name}" (in \`stack.actions\` or the object's \`actions\`) ${placement}, remove the reference, or ignore this if the action is contributed by another installed package.` + (known.size > 0 ? ` Defined actions: ${[...known].sort().join(", ")}.` : "")
     });
   };
@@ -2226,7 +2553,7 @@ function validateActionNameRefs(stack) {
       if (!def || typeof def !== "object") continue;
       if (def.execution !== "aggregate") continue;
       if (def.actionDef !== void 0) continue;
-      const name = strName5(def.name);
+      const name = strName6(def.name);
       if (!name) continue;
       check(
         name,
@@ -2241,7 +2568,7 @@ function validateActionNameRefs(stack) {
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
     if (!view || typeof view !== "object") continue;
-    const viewName = strName5(view.name) ?? strName5(view.object) ?? `#${vi}`;
+    const viewName = strName6(view.name) ?? strName6(view.object) ?? `#${vi}`;
     const owner = `view "${viewName}"`;
     checkListContainer(view.list, owner, "list", `views[${vi}].list`);
     const listViews = view.listViews;
@@ -2257,7 +2584,7 @@ function validateActionNameRefs(stack) {
     if (!obj || typeof obj !== "object") continue;
     const objListViews = obj.listViews;
     if (!objListViews || typeof objListViews !== "object" || Array.isArray(objListViews)) continue;
-    const owner = `object "${strName5(obj.name) ?? `#${oi}`}"`;
+    const owner = `object "${strName6(obj.name) ?? `#${oi}`}"`;
     for (const [key, lv] of Object.entries(objListViews)) {
       checkListContainer(lv, owner, `listViews.${key}`, `objects[${oi}].listViews.${key}`);
     }
@@ -2266,7 +2593,7 @@ function validateActionNameRefs(stack) {
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
-    const pageName = strName5(page.name) ?? `#${pi}`;
+    const pageName = strName6(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
       const props = component.properties;
       if (!props || typeof props !== "object") continue;
@@ -2274,7 +2601,7 @@ function validateActionNameRefs(stack) {
       for (let ai = 0; ai < names.length; ai++) {
         check(
           names[ai],
-          `page "${pageName}" \xB7 component "${strName5(component.type) ?? "?"}"`,
+          `page "${pageName}" \xB7 component "${strName6(component.type) ?? "?"}"`,
           `${path}.properties.actionNames[${ai}]`,
           "Quick-actions bar"
         );
@@ -2285,7 +2612,7 @@ function validateActionNameRefs(stack) {
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName5(app.name) ?? `#${ai}`;
+    const appName = strName6(app.name) ?? `#${ai}`;
     const walkNav = (items, basePath) => {
       const navItems = asArray8(items);
       for (let ni = 0; ni < navItems.length; ni++) {
@@ -2293,20 +2620,20 @@ function validateActionNameRefs(stack) {
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
         const actionDef = nav.actionDef;
-        const actionName = strName5(actionDef?.actionName);
+        const actionName = strName6(actionDef?.actionName);
         if (nav.type === "action" && actionName) {
           check(
             actionName,
-            `app "${appName}" \xB7 nav "${strName5(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName6(nav.id) ?? `#${ni}`}"`,
             `${navPath}.actionDef.actionName`,
             "Navigation action item"
           );
         }
-        const runAction = strName5(nav.runAction);
+        const runAction = strName6(nav.runAction);
         if (nav.type === "object" && runAction) {
           check(
             runAction,
-            `app "${appName}" \xB7 nav "${strName5(nav.id) ?? `#${ni}`}"`,
+            `app "${appName}" \xB7 nav "${strName6(nav.id) ?? `#${ni}`}"`,
             `${navPath}.runAction`,
             "Navigation deep-link auto-run"
           );
@@ -2333,23 +2660,23 @@ function asArray9(v) {
   }
   return [];
 }
-function strName6(v) {
+function strName7(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function isRec5(v) {
+function isRec6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function fieldRefsFrom(value, basePath) {
   const out = [];
   const one = (v, path) => {
-    const bare = strName6(v);
+    const bare = strName7(v);
     if (bare) {
       out.push({ name: bare, path });
       return;
     }
-    if (!isRec5(v)) return;
-    const named = strName6(v.field) ?? strName6(v.name);
-    if (named) out.push({ name: named, path: `${path}.${strName6(v.field) ? "field" : "name"}` });
+    if (!isRec6(v)) return;
+    const named = strName7(v.field) ?? strName7(v.name);
+    if (named) out.push({ name: named, path: `${path}.${strName7(v.field) ? "field" : "name"}` });
   };
   if (Array.isArray(value)) {
     for (let i = 0; i < value.length; i++) one(value[i], `${basePath}[${i}]`);
@@ -2375,7 +2702,12 @@ var COMPONENT_FIELD_SPECS = {
   "record:details": { props: ["fields", "hideFields"], nestedSections: ["sections"] },
   "record:path": { props: ["statusField"] },
   "element:number": { props: ["field"] },
-  "element:filter": { props: ["fields"] },
+  // `element:filter` had a `{ props: ['fields'] }` entry until #9220 retired the
+  // whole element at element grain (ADR-0049 — no renderer ever shipped for it).
+  // Every `ElementFilterProps` key is a `retiredKey()` tombstone now, so no
+  // spec-conformant page carries `fields` on it, and the #5068 props gate
+  // reports an authored one by name with the element-retirement prescription —
+  // the same #5775/#6629 residue class as the record-picker entries below.
   "element:form": { props: ["fields"] },
   // `labelField` is the one field-bearing prop this element declares. Its former
   // companions `displayField` (renamed to `labelField`, ADR-0087 D2) and
@@ -2405,18 +2737,18 @@ function componentFieldRefs(type, props, basePath, sep = ".") {
     const sections = Array.isArray(props[key]) ? props[key] : [];
     for (let si = 0; si < sections.length; si++) {
       const section = sections[si];
-      if (!isRec5(section)) continue;
+      if (!isRec6(section)) continue;
       refs.push(...fieldRefsFrom(section.fields, `${basePath}${sep}${key}[${si}].fields`));
     }
   }
   return refs;
 }
 function relatedListFieldRefs(props, basePath, sep = ".") {
-  const add = isRec5(props.add) ? props.add : void 0;
-  const picker = add && isRec5(add.picker) ? add.picker : void 0;
+  const add = isRec6(props.add) ? props.add : void 0;
+  const picker = add && isRec6(add.picker) ? add.picker : void 0;
   const at = (key) => `${basePath}${sep}${key}`;
   return {
-    relatedObject: strName6(props.objectName),
+    relatedObject: strName7(props.objectName),
     related: [
       ...fieldRefsFrom(props.columns, at("columns")),
       ...sortFieldRefs(props.sort, at("sort")),
@@ -2425,7 +2757,7 @@ function relatedListFieldRefs(props, basePath, sep = ".") {
       ...add ? fieldRefsFrom(add.linkField, at("add.linkField")) : []
     ],
     parent: fieldRefsFrom(props.relationshipValueField, at("relationshipValueField")),
-    pickerObject: picker ? strName6(picker.object) : void 0,
+    pickerObject: picker ? strName7(picker.object) : void 0,
     picker: picker ? [
       ...fieldRefsFrom(picker.valueField, at("add.picker.valueField")),
       ...fieldRefsFrom(picker.labelField, at("add.picker.labelField"))
@@ -2434,13 +2766,13 @@ function relatedListFieldRefs(props, basePath, sep = ".") {
 }
 function indexObjectFields(stack) {
   const objectFields = /* @__PURE__ */ new Map();
-  if (!isRec5(stack)) return objectFields;
+  if (!isRec6(stack)) return objectFields;
   for (const obj of asArray9(stack.objects)) {
-    const name = strName6(obj.name);
+    const name = strName7(obj.name);
     if (!name) continue;
     const names = /* @__PURE__ */ new Set();
     for (const f of asArray9(obj.fields)) {
-      const fn = strName6(f.name);
+      const fn = strName7(f.name);
       if (fn) names.add(fn);
     }
     objectFields.set(name, names);
@@ -2488,15 +2820,15 @@ function validatePageFieldBindings(stack) {
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
     if (!page || typeof page !== "object") continue;
-    const pageName = strName6(page.name) ?? `#${pi}`;
+    const pageName = strName7(page.name) ?? `#${pi}`;
     const checkRefs = (refs, objectName, where) => {
       findings.push(
         ...checkFieldRefs(refs, objectName, objectFields, where, "skipped", unprovisionedAnchors)
       );
     };
     for (const { component, path, objectName } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName6(component.type);
-      const props = isRec5(component.properties) ? component.properties : void 0;
+      const type = strName7(component.type);
+      const props = isRec6(component.properties) ? component.properties : void 0;
       if (!type || !props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -2511,16 +2843,16 @@ function validatePageFieldBindings(stack) {
       if (!refs) continue;
       checkRefs(refs, objectName, where);
     }
-    const cfg = isRec5(page.interfaceConfig) ? page.interfaceConfig : void 0;
+    const cfg = isRec6(page.interfaceConfig) ? page.interfaceConfig : void 0;
     if (cfg) {
-      const cfgObject = strName6(cfg.source) ?? strName6(page.object);
+      const cfgObject = strName7(cfg.source) ?? strName7(page.object);
       const base = `pages[${pi}].interfaceConfig`;
       const refs = [
         ...fieldRefsFrom(cfg.columns, `${base}.columns`),
         ...sortFieldRefs(cfg.sort, `${base}.sort`),
         ...fieldRefsFrom(cfg.filterBy, `${base}.filterBy`)
       ];
-      const userFilters = isRec5(cfg.userFilters) ? cfg.userFilters : void 0;
+      const userFilters = isRec6(cfg.userFilters) ? cfg.userFilters : void 0;
       if (userFilters) {
         refs.push(...fieldRefsFrom(userFilters.fields, `${base}.userFilters.fields`));
       }
@@ -2542,16 +2874,16 @@ function asArray10(v) {
   }
   return [];
 }
-function strName7(v) {
+function strName8(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList2(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 }
-function isRec6(v) {
+function isRec7(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function distance4(a, b) {
+function distance5(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -2567,11 +2899,11 @@ function distance4(a, b) {
   }
   return prev[n];
 }
-function suggest5(target, known) {
+function suggest6(target, known) {
   let best;
   let bestScore = Infinity;
   for (const c of known) {
-    const d = distance4(target, c);
+    const d = distance5(target, c);
     if (d < bestScore) {
       bestScore = d;
       best = c;
@@ -2587,16 +2919,16 @@ function list2(names) {
 function indexDatasets(stack) {
   const out = /* @__PURE__ */ new Map();
   for (const ds of asArray10(stack.datasets)) {
-    const name = strName7(ds.name);
+    const name = strName8(ds.name);
     if (!name) continue;
     const dimensions = /* @__PURE__ */ new Set();
     for (const d of asArray10(ds.dimensions)) {
-      const n = strName7(d.name);
+      const n = strName8(d.name);
       if (n) dimensions.add(n);
     }
     const measures = /* @__PURE__ */ new Set();
     for (const m of asArray10(ds.measures)) {
-      const n = strName7(m.name);
+      const n = strName8(m.name);
       if (n) measures.add(n);
     }
     out.set(name, { dimensions, measures });
@@ -2619,7 +2951,7 @@ function validateChartBindings(stack) {
         where: binding.where,
         path: `${binding.path}.dataset`,
         message: `binds dataset "${dsName}", which resolves to no declared dataset \u2014 the chart has no data to render.`,
-        hint: `Declared datasets: ${list2(datasets.keys())}.${suggest5(dsName, datasets.keys())} Define it with defineDataset() or fix the reference (ADR-0021).`
+        hint: `Declared datasets: ${list2(datasets.keys())}.${suggest6(dsName, datasets.keys())} Define it with defineDataset() or fix the reference (ADR-0021).`
       });
       return;
     }
@@ -2631,7 +2963,7 @@ function validateChartBindings(stack) {
         where: binding.where,
         path,
         message: `"${name}" is not a dimension declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by DIMENSION NAME, not the base field, so this axis renders with no categories.`,
-        hint: `Dataset dimensions: ${list2(ds.dimensions)}.${suggest5(name, ds.dimensions)} Declare the dimension on the dataset, or bind an existing one.`
+        hint: `Dataset dimensions: ${list2(ds.dimensions)}.${suggest6(name, ds.dimensions)} Declare the dimension on the dataset, or bind an existing one.`
       });
     };
     const measureRef = (name, path, selected2) => {
@@ -2642,7 +2974,7 @@ function validateChartBindings(stack) {
           where: binding.where,
           path,
           message: `"${name}" is not a measure declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by MEASURE NAME (e.g. "sum_amount"), not the base field (e.g. "amount"), so this series comes back empty.`,
-          hint: `Dataset measures: ${list2(ds.measures)}.${suggest5(name, ds.measures)} Declare the measure on the dataset, or bind an existing one.`
+          hint: `Dataset measures: ${list2(ds.measures)}.${suggest6(name, ds.measures)} Declare the measure on the dataset, or bind an existing one.`
         });
         return;
       }
@@ -2677,26 +3009,26 @@ function validateChartBindings(stack) {
   const reports = asArray10(stack.reports);
   for (let ri = 0; ri < reports.length; ri++) {
     const report = reports[ri];
-    if (!isRec6(report)) continue;
-    const reportName = strName7(report.name) ?? `#${ri}`;
+    if (!isRec7(report)) continue;
+    const reportName = strName8(report.name) ?? `#${ri}`;
     const checkReportChart = (chart, dataset, values, where, path) => {
-      if (!isRec6(chart)) return;
+      if (!isRec7(chart)) return;
       check({
         dataset,
         // `values` is the report's measure SELECTION, not a chart ref; feeding
         // it in lets the yAxis "declared but not selected" check work without
         // reporting the selection itself twice.
         values: { names: values, path: `${path}.values` },
-        xAxis: strName7(chart.xAxis) ? { name: strName7(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
-        yAxis: strName7(chart.yAxis) ? { name: strName7(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
-        series: asArray10(chart.series).map((s, si) => ({ name: strName7(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
+        xAxis: strName8(chart.xAxis) ? { name: strName8(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
+        yAxis: strName8(chart.yAxis) ? { name: strName8(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
+        series: asArray10(chart.series).map((s, si) => ({ name: strName8(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
         where,
         path: `${path}.chart`
       });
     };
     checkReportChart(
       report.chart,
-      strName7(report.dataset),
+      strName8(report.dataset),
       strList2(report.values),
       `report "${reportName}" \xB7 chart`,
       `reports[${ri}]`
@@ -2704,22 +3036,22 @@ function validateChartBindings(stack) {
     const blocks = Array.isArray(report.blocks) ? report.blocks : [];
     for (let bi = 0; bi < blocks.length; bi++) {
       const block = blocks[bi];
-      if (!isRec6(block)) continue;
+      if (!isRec7(block)) continue;
       checkReportChart(
         block.chart,
-        strName7(block.dataset),
+        strName8(block.dataset),
         strList2(block.values),
-        `report "${reportName}" \xB7 block "${strName7(block.name) ?? `#${bi}`}" chart`,
+        `report "${reportName}" \xB7 block "${strName8(block.name) ?? `#${bi}`}" chart`,
         `reports[${ri}].blocks[${bi}]`
       );
     }
   }
   const checkListChart = (container, where, path) => {
-    if (!isRec6(container)) return;
+    if (!isRec7(container)) return;
     const chart = container.chart;
-    if (!isRec6(chart)) return;
+    if (!isRec7(chart)) return;
     check({
-      dataset: strName7(chart.dataset),
+      dataset: strName8(chart.dataset),
       dimensions: { names: strList2(chart.dimensions), path: `${path}.chart.dimensions` },
       values: { names: strList2(chart.values), path: `${path}.chart.values` },
       where,
@@ -2729,10 +3061,10 @@ function validateChartBindings(stack) {
   const views = asArray10(stack.views);
   for (let vi = 0; vi < views.length; vi++) {
     const view = views[vi];
-    if (!isRec6(view)) continue;
-    const viewName = strName7(view.name) ?? strName7(view.objectName) ?? `#${vi}`;
+    if (!isRec7(view)) continue;
+    const viewName = strName8(view.name) ?? strName8(view.objectName) ?? `#${vi}`;
     checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
-    if (isRec6(view.listViews)) {
+    if (isRec7(view.listViews)) {
       for (const [key, lv] of Object.entries(view.listViews)) {
         checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
       }
@@ -2741,8 +3073,8 @@ function validateChartBindings(stack) {
   const objects = asArray10(stack.objects);
   for (let oi = 0; oi < objects.length; oi++) {
     const obj = objects[oi];
-    if (!isRec6(obj) || !isRec6(obj.listViews)) continue;
-    const objName = strName7(obj.name) ?? `#${oi}`;
+    if (!isRec7(obj) || !isRec7(obj.listViews)) continue;
+    const objName = strName8(obj.name) ?? `#${oi}`;
     for (const [key, lv] of Object.entries(obj.listViews)) {
       checkListChart(
         lv,
@@ -2754,19 +3086,19 @@ function validateChartBindings(stack) {
   const pages = asArray10(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec6(page)) continue;
-    const pageName = strName7(page.name) ?? `#${pi}`;
+    if (!isRec7(page)) continue;
+    const pageName = strName8(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const props = isRec6(component.properties) ? component.properties : void 0;
-      if (!props || !strName7(props.dataset)) continue;
-      const axisRefs = asArray10(props.yAxis).map((a, ai) => ({ name: strName7(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
-      const seriesRefs = asArray10(props.series).map((s, si) => ({ name: strName7(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
+      const props = isRec7(component.properties) ? component.properties : void 0;
+      if (!props || !strName8(props.dataset)) continue;
+      const axisRefs = asArray10(props.yAxis).map((a, ai) => ({ name: strName8(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
+      const seriesRefs = asArray10(props.series).map((s, si) => ({ name: strName8(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
       check({
-        dataset: strName7(props.dataset),
+        dataset: strName8(props.dataset),
         dimensions: { names: strList2(props.dimensions), path: `${path}.properties.dimensions` },
         values: { names: strList2(props.values), path: `${path}.properties.values` },
         series: [...axisRefs, ...seriesRefs],
-        where: `page "${pageName}" \xB7 ${strName7(component.type) ?? "chart"}`,
+        where: `page "${pageName}" \xB7 ${strName8(component.type) ?? "chart"}`,
         path: `${path}.properties`
       });
     }
@@ -2833,7 +3165,7 @@ function asArray12(v) {
   }
   return [];
 }
-function strName8(v) {
+function strName9(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function collectNavExposures(stack) {
@@ -2842,18 +3174,18 @@ function collectNavExposures(stack) {
   for (let ai = 0; ai < apps.length; ai++) {
     const app = apps[ai];
     if (!app || typeof app !== "object") continue;
-    const appName = strName8(app.name) ?? `#${ai}`;
+    const appName = strName9(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
       const navItems = asArray12(items);
       for (let ni = 0; ni < navItems.length; ni++) {
         const nav = navItems[ni];
         if (!nav || typeof nav !== "object") continue;
         const navPath = `${basePath}[${ni}]`;
-        const objectName = strName8(nav.objectName);
+        const objectName = strName9(nav.objectName);
         if (nav.type === "object" && objectName) {
           out.push({
             objectName,
-            where: `app "${appName}" \xB7 nav "${strName8(nav.id) ?? `#${ni}`}"`,
+            where: `app "${appName}" \xB7 nav "${strName9(nav.id) ?? `#${ni}`}"`,
             path: `${navPath}.objectName`
           });
         }
@@ -2877,7 +3209,7 @@ function validateNavAccess(stack) {
   if (exposures.length === 0) return findings;
   const ownObjects = /* @__PURE__ */ new Set();
   for (const obj of asArray12(stack.objects)) {
-    const n = strName8(obj.name);
+    const n = strName9(obj.name);
     if (n) ownObjects.add(n);
   }
   const readable = /* @__PURE__ */ new Set();
@@ -2907,13 +3239,13 @@ function validateNavAccess(stack) {
 
 // src/validate-nav-target-refs.ts
 var NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
-var isRec7 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray13(v) {
-  if (Array.isArray(v)) return v.filter(isRec7);
-  if (isRec7(v)) return Object.entries(v).map(([name, def]) => isRec7(def) ? { name, ...def } : { name });
+  if (Array.isArray(v)) return v.filter(isRec8);
+  if (isRec8(v)) return Object.entries(v).map(([name, def]) => isRec8(def) ? { name, ...def } : { name });
   return [];
 }
-function strName9(v) {
+function strName10(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var isInterpolated2 = (s) => s.includes("${") || s.includes("{");
@@ -2925,14 +3257,14 @@ var NAV_TARGETS = [
 function namesOf(collection) {
   const out = /* @__PURE__ */ new Set();
   for (const entry of asArray13(collection)) {
-    const n = strName9(entry.name);
+    const n = strName10(entry.name);
     if (n) out.add(n);
   }
   return out;
 }
 function validateNavTargetRefs(stack) {
   const findings = [];
-  if (!isRec7(stack)) return findings;
+  if (!isRec8(stack)) return findings;
   const apps = asArray13(stack.apps);
   if (apps.length === 0) return findings;
   const declared = /* @__PURE__ */ new Map();
@@ -2940,16 +3272,16 @@ function validateNavTargetRefs(stack) {
     declared.set(collection, namesOf(stack[collection]));
   }
   for (const [ai, app] of apps.entries()) {
-    const appName = strName9(app.name) ?? `#${ai}`;
+    const appName = strName10(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
       if (!Array.isArray(items)) return;
       for (const [ni, raw] of items.entries()) {
-        if (!isRec7(raw)) continue;
+        if (!isRec8(raw)) continue;
         const nav = raw;
         const navPath = `${basePath}[${ni}]`;
         for (const [type, prop, collection, noun] of NAV_TARGETS) {
           if (nav.type !== type) continue;
-          const target = strName9(nav[prop]);
+          const target = strName10(nav[prop]);
           if (!target || isInterpolated2(target)) continue;
           const known = declared.get(collection);
           if (known.has(target)) continue;
@@ -2957,7 +3289,7 @@ function validateNavTargetRefs(stack) {
           findings.push({
             severity: "warning",
             rule: NAV_TARGET_UNRESOLVED,
-            where: `app "${appName}" \xB7 nav "${strName9(nav.id) ?? strName9(nav.label) ?? `#${ni}`}"`,
+            where: `app "${appName}" \xB7 nav "${strName10(nav.id) ?? strName10(nav.label) ?? `#${ni}`}"`,
             path: `${navPath}.${prop}`,
             message: `Navigation targets ${noun} '${target}', which this stack does not declare in \`${collection}\`. ` + (emptyCollection ? `The stack declares NO ${collection} at all, so \`defineStack\`'s own cross-reference check skipped this entry entirely (it is gated on \`${collection === "pages" ? "pageNames" : collection === "reports" ? "reportNames" : "dashboardNames"}.size > 0\`) \u2014 nothing else will report it. ` : "") + `The entry renders in the sidebar and resolves to nothing when clicked. If another package provides this ${noun}, this is expected and advisory only.`,
             hint: `Declare the ${noun} in \`${collection}\`, correct the name, or remove the nav entry if the ${noun} is gone.`
@@ -2976,44 +3308,44 @@ function validateNavTargetRefs(stack) {
 }
 
 // src/validate-nav-object-servability.ts
-var import_data7 = require("@objectstack/spec/data");
+var import_data9 = require("@objectstack/spec/data");
 var NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
-var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec9 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray14(v) {
-  if (Array.isArray(v)) return v.filter(isRec8);
-  if (isRec8(v)) return Object.entries(v).map(([name, def]) => isRec8(def) ? { name, ...def } : { name });
+  if (Array.isArray(v)) return v.filter(isRec9);
+  if (isRec9(v)) return Object.entries(v).map(([name, def]) => isRec9(def) ? { name, ...def } : { name });
   return [];
 }
-function strName10(v) {
+function strName11(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var isInterpolated3 = (s) => s.includes("${") || s.includes("{");
 function validateNavObjectServability(stack) {
   const findings = [];
-  if (!isRec8(stack)) return findings;
+  if (!isRec9(stack)) return findings;
   const apps = asArray14(stack.apps);
   if (apps.length === 0) return findings;
   const ownEnable = /* @__PURE__ */ new Map();
   const objects = asArray14(stack.objects);
   for (const [oi, obj] of objects.entries()) {
-    const n = strName10(obj.name);
+    const n = strName11(obj.name);
     if (!n) continue;
     ownEnable.set(n, { enable: obj.enable, path: `objects[${oi}].enable` });
   }
   if (ownEnable.size === 0) return findings;
   for (const [ai, app] of apps.entries()) {
-    const appName = strName10(app.name) ?? `#${ai}`;
+    const appName = strName11(app.name) ?? `#${ai}`;
     const walk = (items, basePath) => {
       if (!Array.isArray(items)) return;
       for (const [ni, raw] of items.entries()) {
-        if (!isRec8(raw)) continue;
+        if (!isRec9(raw)) continue;
         const nav = raw;
         const navPath = `${basePath}[${ni}]`;
         if (nav.type === "object") {
-          const target = strName10(nav.objectName);
+          const target = strName11(nav.objectName);
           const declared = target && !isInterpolated3(target) ? ownEnable.get(target) : void 0;
-          if (target && declared && !(0, import_data7.canServeApiOperation)(declared.enable, "list")) {
-            const enable = isRec8(declared.enable) ? declared.enable : {};
+          if (target && declared && !(0, import_data9.canServeApiOperation)(declared.enable, "list")) {
+            const enable = isRec9(declared.enable) ? declared.enable : {};
             const apiDisabled = enable.apiEnabled === false;
             const condition = apiDisabled ? "`enable.apiEnabled: false`" : "`enable.apiMethods` does not grant `list`" + (Array.isArray(enable.apiMethods) ? ` (declared: ${enable.apiMethods.length === 0 ? "[] \u2014 deny-all" : enable.apiMethods.map((m) => `\`${String(m)}\``).join(", ")})` : "");
             const answer = apiDisabled ? "404 `OBJECT_API_DISABLED`" : "405 `OBJECT_API_METHOD_NOT_ALLOWED`";
@@ -3021,7 +3353,7 @@ function validateNavObjectServability(stack) {
             findings.push({
               severity: "error",
               rule: NAV_OBJECT_UNSERVABLE,
-              where: `app "${appName}" \xB7 nav "${strName10(nav.id) ?? strName10(nav.label) ?? `#${ni}`}"`,
+              where: `app "${appName}" \xB7 nav "${strName11(nav.id) ?? strName11(nav.label) ?? `#${ni}`}"`,
               // The nav entry is where the dead row is authored; the `enable`
               // key that condemns it is named in the message, because the fix
               // may belong at either end.
@@ -3048,27 +3380,27 @@ var import_spec = require("@objectstack/spec");
 var import_system4 = require("@objectstack/spec/system");
 
 // src/view-walk.ts
-function isRec9(v) {
+function isRec10(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName11(v) {
+function strName12(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function viewObjectName(view) {
-  return strName11(view.objectName) ?? strName11(view.object) ?? (isRec9(view.data) ? strName11(view.data.object) : void 0);
+  return strName12(view.objectName) ?? strName12(view.object) ?? (isRec10(view.data) ? strName12(view.data.object) : void 0);
 }
 function viewContainerSites(view, basePath) {
-  if (!isRec9(view)) return [];
+  if (!isRec10(view)) return [];
   const sites = [{ view, path: basePath, surface: "", kind: "self" }];
-  if (isRec9(view.form)) {
+  if (isRec10(view.form)) {
     sites.push({ view: view.form, path: `${basePath}.form`, surface: "form", kind: "form" });
   }
   for (const key of ["listViews", "formViews"]) {
     const container = view[key];
-    if (!isRec9(container)) continue;
+    if (!isRec10(container)) continue;
     const kind = key === "listViews" ? "listView" : "formView";
     for (const [subKey, sub] of Object.entries(container)) {
-      if (!isRec9(sub)) continue;
+      if (!isRec10(sub)) continue;
       sites.push({
         view: sub,
         path: `${basePath}.${key}.${subKey}`,
@@ -3086,18 +3418,18 @@ function formViewSites(view, basePath) {
 // src/validate-translation-references.ts
 var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
-function isRec10(v) {
+function isRec11(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function asArray15(v) {
   if (Array.isArray(v)) return v;
-  if (isRec10(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec10(def) ? def : {} }));
+  if (isRec11(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec11(def) ? def : {} }));
   return [];
 }
-function strName12(v) {
+function strName13(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function distance5(a, b) {
+function distance6(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -3113,7 +3445,7 @@ function distance5(a, b) {
   }
   return prev[n];
 }
-function suggest6(target, known) {
+function suggest7(target, known) {
   const names = [...known];
   const segmentMatch = names.find(
     (candidate) => candidate.endsWith(`_${target}`) || candidate.startsWith(`${target}_`)
@@ -3122,7 +3454,7 @@ function suggest6(target, known) {
   let best;
   let bestScore = Infinity;
   for (const candidate of names) {
-    const d = distance5(target, candidate);
+    const d = distance6(target, candidate);
     if (d < bestScore) {
       bestScore = d;
       best = candidate;
@@ -3155,33 +3487,33 @@ function collectViewRecord(view, factsFor) {
   const addSections = (container, binding) => {
     if (!binding) return;
     for (const section of asArray15(container.sections)) {
-      const sectionName = strName12(section.name);
+      const sectionName = strName13(section.name);
       if (sectionName) factsFor(binding).sections.add(sectionName);
     }
   };
-  const listBinding = isRec10(view.list) ? bindingOf(view.list) : void 0;
-  if (isRec10(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
-  addView(recordObject ?? listBinding, strName12(view.name));
+  const listBinding = isRec11(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec11(view.list)) addView(listBinding, defaultListViewKey(listBinding, view));
+  addView(recordObject ?? listBinding, strName13(view.name));
   const named = namedViewKeys(view);
   for (const family of ["listViews", "formViews"]) {
     const container = view[family];
-    if (!isRec10(container)) continue;
+    if (!isRec11(container)) continue;
     const registryKeys = family === "listViews" ? named.list : named.form;
     let at = 0;
     for (const sub of Object.values(container)) {
       if (!sub || typeof sub !== "object") continue;
       const registryKey = registryKeys[at++];
-      if (!isRec10(sub)) continue;
+      if (!isRec11(sub)) continue;
       const binding = bindingOf(sub) ?? listBinding;
       addView(binding, registryKey);
       addSections(sub, binding);
     }
   }
-  if (isRec10(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
+  if (isRec11(view.form)) addSections(view.form, bindingOf(view.form) ?? listBinding);
   addSections(view, recordObject ?? listBinding);
 }
 function defaultListViewKey(object, container) {
-  if (!object || !isRec10(container.list)) return void 0;
+  if (!object || !isRec11(container.list)) return void 0;
   const item = (0, import_spec.expandViewContainer)(object, container).find(
     (i) => i.viewKind === "list" && i.isDefault
   );
@@ -3193,7 +3525,7 @@ function namedViewKeys(container) {
   const object = "probe";
   const prefix = `${object}.`;
   const bare = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : name;
-  const countEntries = (v) => isRec10(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
+  const countEntries = (v) => isRec11(v) ? Object.values(v).filter((e) => !!e && typeof e === "object").length : 0;
   const listCount = countEntries(container.listViews);
   const formCount = countEntries(container.formViews);
   if (!listCount && !formCount) return { list: [], form: [] };
@@ -3211,14 +3543,14 @@ function readOptions(field) {
         values.add(opt);
         continue;
       }
-      if (!isRec10(opt)) continue;
-      const value = strName12(opt.value);
+      if (!isRec11(opt)) continue;
+      const value = strName13(opt.value);
       if (!value) continue;
       values.add(value);
-      const label2 = strName12(opt.label);
+      const label2 = strName13(opt.label);
       if (label2) byLabel.set(label2.toLowerCase(), value);
     }
-  } else if (isRec10(raw)) {
+  } else if (isRec11(raw)) {
     for (const [value, label2] of Object.entries(raw)) {
       values.add(value);
       if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
@@ -3239,23 +3571,23 @@ function buildUniverse(stack) {
     return facts;
   };
   for (const obj of asArray15(stack.objects)) {
-    const objectName = strName12(obj.name);
+    const objectName = strName13(obj.name);
     if (!objectName) continue;
     const facts = factsFor(objectName);
     for (const field of asArray15(obj.fields)) {
-      const fieldName = strName12(field.name);
+      const fieldName = strName13(field.name);
       if (fieldName) facts.fields.set(fieldName, field);
     }
     for (const action of asArray15(obj.actions)) {
-      const actionName = strName12(action.name);
+      const actionName = strName13(action.name);
       if (actionName) facts.actions.set(actionName, action);
     }
     for (const view of asArray15(obj.views)) {
-      collectViewRecord({ ...view, object: strName12(view.object) ?? objectName }, factsFor);
+      collectViewRecord({ ...view, object: strName13(view.object) ?? objectName }, factsFor);
     }
     collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
     for (const group of asArray15(obj.fieldGroups)) {
-      const key = strName12(group.key) ?? strName12(group.name);
+      const key = strName13(group.key) ?? strName13(group.name);
       if (key) facts.sections.add(key);
     }
   }
@@ -3266,10 +3598,10 @@ function buildUniverse(stack) {
   for (let pi = 0; pi < pages.length; pi++) {
     for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
       if (!walked.objectName) continue;
-      const props = isRec10(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec11(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
       for (const section of asArray15(props.sections)) {
-        const sectionName = strName12(section.name);
+        const sectionName = strName13(section.name);
         if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
       }
     }
@@ -3277,9 +3609,9 @@ function buildUniverse(stack) {
   const globalActions = /* @__PURE__ */ new Map();
   const actionOwners = /* @__PURE__ */ new Map();
   for (const action of asArray15(stack.actions)) {
-    const actionName = strName12(action.name);
+    const actionName = strName13(action.name);
     if (!actionName) continue;
-    const owner = strName12(action.objectName) ?? strName12(action.object);
+    const owner = strName13(action.objectName) ?? strName13(action.object);
     if (owner) {
       factsFor(owner).actions.set(actionName, action);
       actionOwners.set(actionName, owner);
@@ -3294,19 +3626,19 @@ function buildUniverse(stack) {
   }
   const apps = /* @__PURE__ */ new Map();
   for (const app of asArray15(stack.apps)) {
-    const appName = strName12(app.name);
+    const appName = strName13(app.name);
     if (!appName) continue;
     const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
     const walkNav = (items) => {
       for (const item of asArray15(items)) {
-        const id = strName12(item.id);
+        const id = strName13(item.id);
         if (id) navIds.add(id);
         if (item.children) walkNav(item.children);
       }
     };
     walkNav(app.navigation);
     for (const area of asArray15(app.areas)) {
-      const areaId = strName12(area.id);
+      const areaId = strName13(area.id);
       if (areaId) navIds.add(areaId);
       walkNav(area.navigation);
     }
@@ -3314,20 +3646,20 @@ function buildUniverse(stack) {
   }
   const dashboards = /* @__PURE__ */ new Map();
   for (const dash of asArray15(stack.dashboards)) {
-    const dashName = strName12(dash.name);
+    const dashName = strName13(dash.name);
     if (!dashName) continue;
     const widgets = /* @__PURE__ */ new Set();
     for (const widget of asArray15(dash.widgets)) {
-      const id = strName12(widget.id) ?? strName12(widget.name);
+      const id = strName13(widget.id) ?? strName13(widget.name);
       if (id) widgets.add(id);
     }
     const actions = /* @__PURE__ */ new Set();
     const headerActions = [
-      ...asArray15(isRec10(dash.header) ? dash.header.actions : void 0),
+      ...asArray15(isRec11(dash.header) ? dash.header.actions : void 0),
       ...asArray15(dash.actions)
     ];
     for (const action of headerActions) {
-      const key = strName12(action.actionUrl) ?? strName12(action.url) ?? strName12(action.name);
+      const key = strName13(action.actionUrl) ?? strName13(action.url) ?? strName13(action.name);
       if (key) actions.add(key);
     }
     dashboards.set(dashName, { widgets, actions });
@@ -3339,7 +3671,7 @@ function localePath(bundleIndex, locale) {
 }
 function validateTranslationReferences(stack) {
   const findings = [];
-  if (!isRec10(stack)) return findings;
+  if (!isRec11(stack)) return findings;
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   if (bundles.length === 0) return findings;
   const universe = buildUniverse(stack);
@@ -3348,13 +3680,13 @@ function validateTranslationReferences(stack) {
   };
   for (let bi = 0; bi < bundles.length; bi++) {
     const bundle = bundles[bi];
-    if (!isRec10(bundle)) continue;
+    if (!isRec11(bundle)) continue;
     for (const [locale, rawData] of Object.entries(bundle)) {
-      if (!isRec10(rawData)) continue;
+      if (!isRec11(rawData)) continue;
       const base = localePath(bi, locale);
       const inLocale = `locale "${locale}"`;
       for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
-        if (!isRec10(rawNode)) continue;
+        if (!isRec11(rawNode)) continue;
         const objPath = `${base}.objects.${objectName}`;
         const facts = universe.objects.get(objectName);
         if (!facts) {
@@ -3362,7 +3694,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 object "${objectName}"`,
             objPath,
-            (0, import_system4.hasPlatformObjectPrefix)(objectName) ? `Translations are keyed to "${objectName}", which carries a platform namespace prefix but is registered by no platform package, official plugin, or cloud runtime object \u2014 and this stack does not define it either. Nothing resolves these keys.` + suggest6(objectName, universe.objects.keys()) : `Translations are keyed to "${objectName}", which no object in this stack defines. The resolver looks up keys derived from the metadata, so this whole subtree is dead weight \u2014 every label it carries renders untranslated.` + suggest6(objectName, universe.objects.keys()),
+            (0, import_system4.hasPlatformObjectPrefix)(objectName) ? `Translations are keyed to "${objectName}", which carries a platform namespace prefix but is registered by no platform package, official plugin, or cloud runtime object \u2014 and this stack does not define it either. Nothing resolves these keys.` + suggest7(objectName, universe.objects.keys()) : `Translations are keyed to "${objectName}", which no object in this stack defines. The resolver looks up keys derived from the metadata, so this whole subtree is dead weight \u2014 every label it carries renders untranslated.` + suggest7(objectName, universe.objects.keys()),
             `Rename the key to the object it was written for, drop it, or ignore this if the object is contributed by another installed package.` + (universe.objects.size > 0 ? ` Defined objects: ${listNames(universe.objects.keys())}.` : "")
           );
           continue;
@@ -3375,12 +3707,12 @@ function validateTranslationReferences(stack) {
             orphan(
               `${inLocale} \xB7 object "${objectName}" \xB7 field "${fieldName}"`,
               fieldPath,
-              `Translations are keyed to field "${fieldName}", which object "${objectName}" does not declare. The label renders untranslated in this locale \u2014 and because every neighbouring field DOES resolve, the hole reads as a styling quirk rather than a missing translation.` + suggest6(fieldName, facts.fields.keys()),
+              `Translations are keyed to field "${fieldName}", which object "${objectName}" does not declare. The label renders untranslated in this locale \u2014 and because every neighbouring field DOES resolve, the hole reads as a styling quirk rather than a missing translation.` + suggest7(fieldName, facts.fields.keys()),
               `Point the key at a declared field, or drop it if the field was removed or renamed.` + (facts.fields.size > 0 ? ` Declared fields: ${listNames(facts.fields.keys())}.` : "")
             );
             continue;
           }
-          if (!isRec10(rawField)) continue;
+          if (!isRec11(rawField)) continue;
           checkOptionKeys(findings, {
             optionMap: rawField.options,
             field,
@@ -3395,7 +3727,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 object "${objectName}" \xB7 view "${viewName}"`,
             `${objPath}._views.${viewName}`,
-            `Translations are keyed to view "${viewName}", which no view of object "${objectName}" declares. The view tab keeps its source-locale label.` + suggest6(viewName, facts.views),
+            `Translations are keyed to view "${viewName}", which no view of object "${objectName}" declares. The view tab keeps its source-locale label.` + suggest7(viewName, facts.views),
             `Match the key to the view's \`name\` (not its label), or drop it.` + (facts.views.size > 0 ? ` Declared views: ${listNames(facts.views)}.` : "")
           );
         }
@@ -3404,7 +3736,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 object "${objectName}" \xB7 section "${sectionName}"`,
             `${objPath}._sections.${sectionName}`,
-            `Translations are keyed to section "${sectionName}", which nothing on object "${objectName}" declares \u2014 no \`fieldGroups[].key\`, no named form-view section, no named \`record:details\` section. The section heading stays in the source locale.` + suggest6(sectionName, facts.sections),
+            `Translations are keyed to section "${sectionName}", which nothing on object "${objectName}" declares \u2014 no \`fieldGroups[].key\`, no named form-view section, no named \`record:details\` section. The section heading stays in the source locale.` + suggest7(sectionName, facts.sections),
             `Sections are translatable only through a STABLE NAME: give the group/section a \`key\`/\`name\` and use it here, or drop the translation.` + (facts.sections.size > 0 ? ` Declared sections: ${listNames(facts.sections)}.` : ` Object "${objectName}" declares no named section at all.`)
           );
         }
@@ -3415,7 +3747,7 @@ function validateTranslationReferences(stack) {
             orphan(
               `${inLocale} \xB7 object "${objectName}" \xB7 action "${actionName}"`,
               actionPath,
-              `Translations are keyed to action "${actionName}", which is defined by neither object "${objectName}"'s \`actions\` nor a \`stack.actions\` entry bound to it. The button keeps its source-locale label.` + suggest6(actionName, facts.actions.keys()),
+              `Translations are keyed to action "${actionName}", which is defined by neither object "${objectName}"'s \`actions\` nor a \`stack.actions\` entry bound to it. The button keeps its source-locale label.` + suggest7(actionName, facts.actions.keys()),
               `Match the key to a defined action name, move it under the object that owns the action, or drop it.` + (facts.actions.size > 0 ? ` Actions on this object: ${listNames(facts.actions.keys())}.` : "")
             );
             continue;
@@ -3437,7 +3769,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 global action "${actionName}"`,
             actionPath,
-            owner ? `Action "${actionName}" is bound to object "${owner}", so the resolver looks it up under \`objects.${owner}._actions.${actionName}\` \u2014 never under \`globalActions\`, which is only consulted for object-less actions. This key is never read.` : `Translations are keyed to global action "${actionName}", which no object-less action in this stack defines. The button keeps its source-locale label.` + suggest6(actionName, universe.globalActions.keys()),
+            owner ? `Action "${actionName}" is bound to object "${owner}", so the resolver looks it up under \`objects.${owner}._actions.${actionName}\` \u2014 never under \`globalActions\`, which is only consulted for object-less actions. This key is never read.` : `Translations are keyed to global action "${actionName}", which no object-less action in this stack defines. The button keeps its source-locale label.` + suggest7(actionName, universe.globalActions.keys()),
             owner ? `Move these keys under \`objects.${owner}._actions.${actionName}\`.` : `Match the key to an object-less action's name, or drop it.` + (universe.globalActions.size > 0 ? ` Object-less actions: ${listNames(universe.globalActions.keys())}.` : "")
           );
           continue;
@@ -3457,18 +3789,18 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 app "${appName}"`,
             appPath,
-            `Translations are keyed to app "${appName}", which this stack does not define. The app launcher shows the source-locale label.` + suggest6(appName, universe.apps.keys()),
+            `Translations are keyed to app "${appName}", which this stack does not define. The app launcher shows the source-locale label.` + suggest7(appName, universe.apps.keys()),
             `Match the key to an app's \`name\`, or drop it.` + (universe.apps.size > 0 ? ` Defined apps: ${listNames(universe.apps.keys())}.` : "")
           );
           continue;
         }
-        if (!isRec10(rawApp)) continue;
+        if (!isRec11(rawApp)) continue;
         for (const navId of Object.keys(asRecord(rawApp.navigation))) {
           if (navIds.has(navId)) continue;
           orphan(
             `${inLocale} \xB7 app "${appName}" \xB7 navigation "${navId}"`,
             `${appPath}.navigation.${navId}`,
-            `Translations are keyed to navigation item "${navId}", which app "${appName}" does not declare. The menu entry keeps its source-locale label.` + suggest6(navId, navIds),
+            `Translations are keyed to navigation item "${navId}", which app "${appName}" does not declare. The menu entry keeps its source-locale label.` + suggest7(navId, navIds),
             `Match the key to the navigation item's \`id\`, or drop it.` + (navIds.size > 0 ? ` Declared navigation ids: ${listNames(navIds)}.` : "")
           );
         }
@@ -3480,18 +3812,18 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 dashboard "${dashName}"`,
             dashPath,
-            `Translations are keyed to dashboard "${dashName}", which this stack does not define. The dashboard title stays in the source locale.` + suggest6(dashName, universe.dashboards.keys()),
+            `Translations are keyed to dashboard "${dashName}", which this stack does not define. The dashboard title stays in the source locale.` + suggest7(dashName, universe.dashboards.keys()),
             `Match the key to a dashboard's \`name\`, or drop it.` + (universe.dashboards.size > 0 ? ` Defined dashboards: ${listNames(universe.dashboards.keys())}.` : "")
           );
           continue;
         }
-        if (!isRec10(rawDash)) continue;
+        if (!isRec11(rawDash)) continue;
         for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
           if (dash.widgets.has(widgetId)) continue;
           orphan(
             `${inLocale} \xB7 dashboard "${dashName}" \xB7 widget "${widgetId}"`,
             `${dashPath}.widgets.${widgetId}`,
-            `Translations are keyed to widget "${widgetId}", which dashboard "${dashName}" does not declare. The widget title stays in the source locale.` + suggest6(widgetId, dash.widgets),
+            `Translations are keyed to widget "${widgetId}", which dashboard "${dashName}" does not declare. The widget title stays in the source locale.` + suggest7(widgetId, dash.widgets),
             `Match the key to the widget's \`id\`, or drop it.` + (dash.widgets.size > 0 ? ` Declared widget ids: ${listNames(dash.widgets)}.` : "")
           );
         }
@@ -3500,7 +3832,7 @@ function validateTranslationReferences(stack) {
           orphan(
             `${inLocale} \xB7 dashboard "${dashName}" \xB7 action "${actionKey}"`,
             `${dashPath}.actions.${actionKey}`,
-            `Translations are keyed to header action "${actionKey}", which dashboard "${dashName}" does not declare. The button keeps its source-locale label.` + suggest6(actionKey, dash.actions),
+            `Translations are keyed to header action "${actionKey}", which dashboard "${dashName}" does not declare. The button keeps its source-locale label.` + suggest7(actionKey, dash.actions),
             `Header-action translations are keyed by the action's \`actionUrl\`, not its label.` + (dash.actions.size > 0 ? ` Declared header actions: ${listNames(dash.actions)}.` : "")
           );
         }
@@ -3510,7 +3842,7 @@ function validateTranslationReferences(stack) {
   return findings;
 }
 function asRecord(v) {
-  return isRec10(v) ? v : {};
+  return isRec11(v) ? v : {};
 }
 function checkOptionKeys(findings, ctx) {
   const optionKeys = Object.keys(asRecord(ctx.optionMap));
@@ -3522,7 +3854,7 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: ctx.path,
-      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName12(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName13(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
       hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
     });
     return;
@@ -3535,17 +3867,17 @@ function checkOptionKeys(findings, ctx) {
       rule: TRANSLATION_OPTION_KEY_UNKNOWN,
       where: ctx.where,
       path: `${ctx.path}.${key}`,
-      message: byLabel ? `Option translation is keyed by the DISPLAY LABEL "${key}" instead of the stored value "${byLabel}". The resolver looks the option up by value, so this entry is never found and the option renders with its source-locale label.` : `Option translation is keyed by "${key}", which is not one of the values declared by field "${ctx.objectName}.${ctx.fieldName}". The option renders untranslated.` + suggest6(key, declared.values),
+      message: byLabel ? `Option translation is keyed by the DISPLAY LABEL "${key}" instead of the stored value "${byLabel}". The resolver looks the option up by value, so this entry is never found and the option renders with its source-locale label.` : `Option translation is keyed by "${key}", which is not one of the values declared by field "${ctx.objectName}.${ctx.fieldName}". The option renders untranslated.` + suggest7(key, declared.values),
       hint: byLabel ? `Rename the key to "${byLabel}".` : `Option keys are the stored \`value\`, not the label and not a variant spelling (\`direct_mail\`, not \`direct-mail\`). Declared values: ${listNames(declared.values)}.`
     });
   }
 }
 function checkActionParams(findings, ctx) {
-  const rawParams = Object.keys(asRecord(isRec10(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  const rawParams = Object.keys(asRecord(isRec11(ctx.rawAction) ? ctx.rawAction.params : void 0));
   if (rawParams.length === 0) return;
   const declared = /* @__PURE__ */ new Set();
   for (const param of asArray15(ctx.action.params)) {
-    const name = strName12(param.name) ?? strName12(param.field);
+    const name = strName13(param.name) ?? strName13(param.field);
     if (name) declared.add(name);
   }
   for (const paramName of rawParams) {
@@ -3555,40 +3887,40 @@ function checkActionParams(findings, ctx) {
       rule: TRANSLATION_TARGET_UNKNOWN,
       where: `${ctx.where} \xB7 param "${paramName}"`,
       path: `${ctx.path}.params.${paramName}`,
-      message: `Translations are keyed to parameter "${paramName}", which ${ctx.subject} does not declare. The parameter's label and help text render untranslated in the action dialog.` + suggest6(paramName, declared),
+      message: `Translations are keyed to parameter "${paramName}", which ${ctx.subject} does not declare. The parameter's label and help text render untranslated in the action dialog.` + suggest7(paramName, declared),
       hint: `Match the key to a declared param \`name\`, or drop it.` + (declared.size > 0 ? ` Declared params: ${listNames(declared)}.` : "")
     });
   }
 }
 
 // src/collection-entries.ts
-function isRec11(v) {
+function isRec12(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function collectionEntries(v, base) {
   if (Array.isArray(v)) {
     const out = [];
     for (let i = 0; i < v.length; i++) {
-      if (isRec11(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
+      if (isRec12(v[i])) out.push({ rec: v[i], path: `${base}[${i}]` });
     }
     return out;
   }
-  if (isRec11(v)) {
-    return Object.entries(v).filter(([, def]) => isRec11(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
+  if (isRec12(v)) {
+    return Object.entries(v).filter(([, def]) => isRec12(def)).map(([name, def]) => ({ rec: { name, ...def }, path: `${base}.${name}` }));
   }
   return [];
 }
 
 // src/validate-translatable-sections.ts
 var TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
-function isRec12(v) {
+function isRec13(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName13(v) {
+function strName14(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function viewLabel(view) {
-  const name = strName13(view.name);
+  const name = strName14(view.name);
   return name ? `view "${name}"` : "";
 }
 function joinWhere(...parts) {
@@ -3596,7 +3928,7 @@ function joinWhere(...parts) {
 }
 function collectViewSites(view, basePath, label2, sites) {
   const recordObject = viewObjectName(view);
-  const listBinding = isRec12(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
+  const listBinding = isRec13(view.list) ? viewObjectName(view.list) ?? recordObject : void 0;
   for (const site of viewContainerSites(view, basePath)) {
     sites.push({
       path: `${site.path}.sections`,
@@ -3610,11 +3942,11 @@ function translatedObjectNames(stack) {
   const out = /* @__PURE__ */ new Set();
   const bundles = Array.isArray(stack.translations) ? stack.translations : [];
   for (const bundle of bundles) {
-    if (!isRec12(bundle)) continue;
+    if (!isRec13(bundle)) continue;
     for (const data of Object.values(bundle)) {
-      if (!isRec12(data) || !isRec12(data.objects)) continue;
+      if (!isRec13(data) || !isRec13(data.objects)) continue;
       for (const [objectName, node] of Object.entries(data.objects)) {
-        if (isRec12(node)) out.add(objectName);
+        if (isRec13(node)) out.add(objectName);
       }
     }
   }
@@ -3626,22 +3958,22 @@ function suggestedName(label2) {
 }
 function validateTranslatableSections(stack) {
   const findings = [];
-  if (!isRec12(stack)) return findings;
+  if (!isRec13(stack)) return findings;
   const translated = translatedObjectNames(stack);
   if (translated.size === 0) return findings;
   const sites = [];
   for (const { rec: obj, path: objPath } of collectionEntries(stack.objects, "objects")) {
-    const objectName = strName13(obj.name);
+    const objectName = strName14(obj.name);
     if (!objectName) continue;
     for (const { rec: view, path } of collectionEntries(obj.views, `${objPath}.views`)) {
       collectViewSites(
-        { ...view, object: strName13(view.object) ?? objectName },
+        { ...view, object: strName14(view.object) ?? objectName },
         path,
         viewLabel(view),
         sites
       );
     }
-    if (isRec12(obj.listViews)) {
+    if (isRec13(obj.listViews)) {
       collectViewSites({ object: objectName, listViews: obj.listViews }, objPath, "", sites);
     }
   }
@@ -3649,13 +3981,13 @@ function validateTranslatableSections(stack) {
     collectViewSites(view, path, viewLabel(view), sites);
   }
   for (const { rec: page, path: pagePath } of collectionEntries(stack.pages, "pages")) {
-    const pageName = strName13(page.name);
+    const pageName = strName14(page.name);
     const pageLabel = pageName ? `page "${pageName}"` : "";
     for (const walked of walkPageComponents(page, pagePath)) {
       if (!walked.objectName) continue;
-      const props = isRec12(walked.component.properties) ? walked.component.properties : void 0;
+      const props = isRec13(walked.component.properties) ? walked.component.properties : void 0;
       if (!props) continue;
-      const type = strName13(walked.component.type) ?? "component";
+      const type = strName14(walked.component.type) ?? "component";
       sites.push({
         path: `${walked.path}.properties.sections`,
         surface: joinWhere(pageLabel, type),
@@ -3670,9 +4002,9 @@ function validateTranslatableSections(stack) {
     if (!Array.isArray(site.sections)) continue;
     for (let i = 0; i < site.sections.length; i++) {
       const section = site.sections[i];
-      if (!isRec12(section)) continue;
-      if (strName13(section.name)) continue;
-      const heading = strName13(section.label);
+      if (!isRec13(section)) continue;
+      if (strName14(section.name)) continue;
+      const heading = strName14(section.label);
       if (!heading) continue;
       const slug = suggestedName(heading);
       findings.push({
@@ -3690,10 +4022,10 @@ function validateTranslatableSections(stack) {
 
 // src/flow-walk.ts
 var import_automation2 = require("@objectstack/spec/automation");
-function isRec13(v) {
+function isRec14(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName14(v) {
+function strName15(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var REGION_SLOTS = new Map(
@@ -3702,10 +4034,10 @@ var REGION_SLOTS = new Map(
 var REGION_CONFIG_KEYS = import_automation2.FLOW_REGION_CONFIG_KEYS;
 var MAX_REGION_DEPTH = 16;
 function flowNodeLabel(node, index) {
-  return strName14(node.label) ?? strName14(node.id) ?? `#${index}`;
+  return strName15(node.label) ?? strName15(node.id) ?? `#${index}`;
 }
 function stripRegions(config) {
-  if (!isRec13(config)) return void 0;
+  if (!isRec14(config)) return void 0;
   let out;
   for (const key of Object.keys(config)) {
     if (!REGION_CONFIG_KEYS.has(key)) continue;
@@ -3716,11 +4048,11 @@ function stripRegions(config) {
 }
 function walkFlowNodes(flow, flowPath) {
   const out = [];
-  if (!isRec13(flow)) return out;
+  if (!isRec14(flow)) return out;
   const visitList = (nodes, basePath, trail, depth) => {
     if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
     nodes.forEach((raw, index) => {
-      if (!isRec13(raw)) return;
+      if (!isRec14(raw)) return;
       const path = `${basePath}[${index}]`;
       out.push({
         node: raw,
@@ -3729,9 +4061,9 @@ function walkFlowNodes(flow, flowPath) {
         regionTrail: trail,
         depth
       });
-      const type = strName14(raw.type);
+      const type = strName15(raw.type);
       const slots = type ? REGION_SLOTS.get(type) : void 0;
-      if (!slots || !isRec13(raw.config)) return;
+      if (!slots || !isRec14(raw.config)) return;
       const config = raw.config;
       const here = `${type} "${flowNodeLabel(raw, index)}"`;
       for (const slot of slots) {
@@ -3739,8 +4071,8 @@ function walkFlowNodes(flow, flowPath) {
         if (slot === "branches") {
           if (!Array.isArray(value)) continue;
           value.forEach((branch, b) => {
-            if (!isRec13(branch)) return;
-            const branchName = strName14(branch.name) ?? `#${b}`;
+            if (!isRec14(branch)) return;
+            const branchName = strName15(branch.name) ?? `#${b}`;
             visitList(
               branch.nodes,
               `${path}.config.branches[${b}].nodes`,
@@ -3750,7 +4082,7 @@ function walkFlowNodes(flow, flowPath) {
           });
           continue;
         }
-        if (!isRec13(value)) continue;
+        if (!isRec14(value)) continue;
         visitList(
           value.nodes,
           `${path}.config.${slot}.nodes`,
@@ -3991,7 +4323,7 @@ function asArray17(v) {
   }
   return [];
 }
-function strName15(v) {
+function strName16(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function surfaceOf(v) {
@@ -4002,17 +4334,17 @@ function validateAiSurfaceAffinity(stack) {
   if (!stack || typeof stack !== "object") return findings;
   const skillsByName = /* @__PURE__ */ new Map();
   for (const skill of asArray17(stack.skills)) {
-    const n = strName15(skill.name);
+    const n = strName16(skill.name);
     if (n) skillsByName.set(n, skill);
   }
   const agents = asArray17(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const agentName = strName15(agent.name) ?? `#${ai}`;
+    const agentName = strName16(agent.name) ?? `#${ai}`;
     const agentSurface = surfaceOf(agent.surface);
     const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
     for (let si = 0; si < skillRefs.length; si++) {
-      const ref = strName15(skillRefs[si]);
+      const ref = strName16(skillRefs[si]);
       if (!ref) continue;
       const skill = skillsByName.get(ref);
       if (!skill) continue;
@@ -4041,10 +4373,10 @@ function asArray18(v) {
   }
   return [];
 }
-function strName16(v) {
+function strName17(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function distance6(a, b) {
+function distance7(a, b) {
   const m = a.length;
   const n = b.length;
   if (m === 0) return n;
@@ -4060,14 +4392,14 @@ function distance6(a, b) {
   }
   return prev[n];
 }
-function suggest7(target, known) {
+function suggest8(target, known) {
   for (const prefix of import_system5.PLATFORM_TOOL_FAMILY_PREFIXES) {
     if (known.has(`${prefix}${target}`)) return ` Did you mean "${prefix}${target}"?`;
   }
   let best;
   let bestScore = Infinity;
   for (const candidate of known) {
-    const d = distance6(target, candidate);
+    const d = distance7(target, candidate);
     if (d < bestScore) {
       bestScore = d;
       best = candidate;
@@ -4082,8 +4414,8 @@ function materialisesAsTool(action) {
   if (!ai || typeof ai !== "object") return false;
   const aiRec = ai;
   if (aiRec.exposed !== true) return false;
-  if (!strName16(aiRec.description)) return false;
-  const type = strName16(action.type);
+  if (!strName17(aiRec.description)) return false;
+  const type = strName17(action.type);
   if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
   if (type === "script") return Boolean(action.target || action.body);
   return Boolean(action.target);
@@ -4091,12 +4423,12 @@ function materialisesAsTool(action) {
 function collectToolUniverse(stack) {
   const universe = new Set(import_system5.PLATFORM_PROVIDED_TOOL_NAMES);
   for (const tool of asArray18(stack.tools)) {
-    const n = strName16(tool.name);
+    const n = strName17(tool.name);
     if (n) universe.add(n);
   }
   const addActionFamily = (actions) => {
     for (const action of asArray18(actions)) {
-      const n = strName16(action.name);
+      const n = strName17(action.name);
       if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
     }
   };
@@ -4110,7 +4442,7 @@ function collectUnexposedActionNames(stack) {
   const names = /* @__PURE__ */ new Set();
   const scan = (actions) => {
     for (const action of asArray18(actions)) {
-      const n = strName16(action.name);
+      const n = strName17(action.name);
       if (n && !materialisesAsTool(action)) names.add(n);
     }
   };
@@ -4136,10 +4468,10 @@ function validateAiToolReferences(stack) {
   const skills = asArray18(stack.skills);
   for (let si = 0; si < skills.length; si++) {
     const skill = skills[si];
-    const skillName = strName16(skill.name) ?? `#${si}`;
+    const skillName = strName17(skill.name) ?? `#${si}`;
     const refs = Array.isArray(skill.tools) ? skill.tools : [];
     for (let ti = 0; ti < refs.length; ti++) {
-      const ref = strName16(refs[ti]);
+      const ref = strName17(refs[ti]);
       if (!ref || resolves(ref)) continue;
       const isPattern = ref.endsWith("*");
       const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
@@ -4148,7 +4480,7 @@ function validateAiToolReferences(stack) {
         rule: AI_SKILL_TOOL_UNRESOLVED,
         where: `skill "${skillName}" \xB7 tools`,
         path: `skills[${si}].tools[${ti}]`,
-        message: isPattern ? `Skill "${skillName}" subscribes to tool family "${ref}", which matches nothing this stack can resolve (no declared tool, no platform tool, and no AI-exposed declarative action materialises into it). The subscription contributes zero tools at runtime.` : unexposed ? `Skill "${skillName}" references tool "${ref}", but the action "${unexposed}" does not become an AI tool: the runtime materialises \`action_<name>\` only for an action that opts in with \`ai.exposed: true\` + \`ai.description\` (ADR-0011) AND has a headless path (type \`script\`/\`api\`/\`flow\` with a target or body \u2014 \`url\`/\`modal\`/\`form\` are UI-only). The reference is dropped at runtime, so the skill promises a capability the agent cannot call.` : `Skill "${skillName}" references tool "${ref}", which resolves to nothing this stack can see: not a \`stack.tools\` record, not a platform-registered tool, and not a materialised action tool (\`action_<name>\`). The runtime silently drops the reference, so the skill's instructions claim a capability the agent does not have \u2014 the assistant will improvise or fail when asked to use it.` + suggest7(ref, universe),
+        message: isPattern ? `Skill "${skillName}" subscribes to tool family "${ref}", which matches nothing this stack can resolve (no declared tool, no platform tool, and no AI-exposed declarative action materialises into it). The subscription contributes zero tools at runtime.` : unexposed ? `Skill "${skillName}" references tool "${ref}", but the action "${unexposed}" does not become an AI tool: the runtime materialises \`action_<name>\` only for an action that opts in with \`ai.exposed: true\` + \`ai.description\` (ADR-0011) AND has a headless path (type \`script\`/\`api\`/\`flow\` with a target or body \u2014 \`url\`/\`modal\`/\`form\` are UI-only). The reference is dropped at runtime, so the skill promises a capability the agent cannot call.` : `Skill "${skillName}" references tool "${ref}", which resolves to nothing this stack can see: not a \`stack.tools\` record, not a platform-registered tool, and not a materialised action tool (\`action_<name>\`). The runtime silently drops the reference, so the skill's instructions claim a capability the agent does not have \u2014 the assistant will improvise or fail when asked to use it.` + suggest8(ref, universe),
         hint: unexposed ? `Either opt "${unexposed}" in \u2014 set \`ai: { exposed: true, description: '\u2026' }\` (\u226540 chars, LLM-facing) and give it a headless type \u2014 or drop the reference and have the skill's instructions recommend the UI action instead. A \`modal\`/\`form\`/\`url\` action stays human-driven by design; that is a legitimate answer, not a gap.` : `Back "${ref}" with a real executable: declare a declarative action (or flow), opt it in with \`ai.exposed: true\` + \`ai.description\`, and reference its materialised tool (\`action_<name>\` \u2014 the ADR-0109 default path, no tool record needed); or reference a platform tool by its registered name; or remove the reference and the instructions that mention it. Ignore this only if a runtime plugin outside the platform registry provides "${ref}". Family prefixes materialised by the runtime: ${import_system5.PLATFORM_TOOL_FAMILY_PREFIXES.join(", ")}.`
       });
     }
@@ -4166,7 +4498,7 @@ function asArray19(v) {
   }
   return [];
 }
-function strName17(v) {
+function strName18(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
@@ -4176,7 +4508,7 @@ function validateAiAgentAuthoring(stack) {
   const agents = asArray19(stack.agents);
   for (let ai = 0; ai < agents.length; ai++) {
     const agent = agents[ai];
-    const name = strName17(agent.name) ?? `#${ai}`;
+    const name = strName18(agent.name) ?? `#${ai}`;
     const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
     const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
     findings.push({
@@ -4192,9 +4524,9 @@ function validateAiAgentAuthoring(stack) {
   const apps = asArray19(stack.apps);
   for (let appIdx = 0; appIdx < apps.length; appIdx++) {
     const app = apps[appIdx];
-    const defaultAgent = strName17(app.defaultAgent);
+    const defaultAgent = strName18(app.defaultAgent);
     if (!defaultAgent || PLATFORM_AGENT_NAMES.has(defaultAgent)) continue;
-    const appName = strName17(app.name) ?? `#${appIdx}`;
+    const appName = strName18(app.name) ?? `#${appIdx}`;
     findings.push({
       severity: "warning",
       rule: DEFAULT_AGENT_OUTSIDE_ROSTER,
@@ -4225,6 +4557,7 @@ function loadTypeScript() {
   return cachedTs;
 }
 var HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+var HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
 var HOOK_BODY_WRITE_PATTERNS = [
   {
     id: "input-property-assign",
@@ -4291,13 +4624,16 @@ var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
   "owner",
   "record_type"
 ]);
-var isRec14 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function unprovisionedAnchorWriteConsequence() {
+  return `so the value can never land: the anchor exists only in the registered schema, which is what carries it PAST the write-path validator that refuses an undeclared name outright (INVALID_FIELD). The remote database is what rejects it \u2014 on a SQL remote with an untyped driver error ('no such column') that aborts the whole statement, so the correctly named fields in the same payload never land either; on a schemaless remote the key is persisted into a column no read surface returns (#4271).`;
+}
+var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray20(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec14(x));
-  if (isRec14(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec15(x));
+  if (isRec15(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec14(def) ? def : {}
+      ...isRec15(def) ? def : {}
     }));
   }
   return [];
@@ -4441,14 +4777,16 @@ function validateHookBodyWrites(stack) {
   const hooks = asArray20(stack.hooks);
   if (hooks.length === 0) return findings;
   let objectFields = null;
+  let anchors = null;
   hooks.forEach((hook, hookIndex) => {
     const body = hook.body;
-    if (!isRec14(body) || body.language !== "js") return;
+    if (!isRec15(body) || body.language !== "js") return;
     const source = body.source;
     if (typeof source !== "string" || source.trim() === "") return;
     const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
     if (writes.length === 0) return;
     objectFields ?? (objectFields = indexObjectFields2(stack));
+    anchors ?? (anchors = indexUnprovisionedAnchors(stack));
     const hookName = typeof hook.name === "string" && hook.name ? hook.name : `#${hookIndex}`;
     const targets = (Array.isArray(hook.object) ? hook.object : [hook.object]).filter(
       (o) => typeof o === "string" && o.trim() !== ""
@@ -4463,7 +4801,20 @@ function validateHookBodyWrites(stack) {
       if (reported.has(dedupeKey)) continue;
       if (w.object === void 0) {
         if (!inputJudgeable) continue;
-        if (IMPLICIT_FIELDS2.has(w.field)) continue;
+        if (IMPLICIT_FIELDS2.has(w.field)) {
+          if (!targets.every((t) => anchors.get(t)?.has(w.field))) continue;
+          reported.add(dedupeKey);
+          const anchorObj = targets.length === 1 ? targets[0] : targets.join(", ");
+          findings.push({
+            severity: "warning",
+            rule: HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR,
+            where,
+            path,
+            message: `body writes '${w.field}' to its input, and ${unprovisionedAnchorCause(anchorObj, w.field)} \u2014 ` + unprovisionedAnchorWriteConsequence(),
+            hint: unprovisionedAnchorHint(anchorObj, w.field)
+          });
+          continue;
+        }
         if (targetSets.some((s) => s.has(w.field))) continue;
         reported.add(dedupeKey);
         const objDesc = targets.length === 1 ? `object '${targets[0]}'` : `none of its target objects (${targets.join(", ")})`;
@@ -4479,7 +4830,20 @@ function validateHookBodyWrites(stack) {
       } else {
         const known = judgeableFieldsOf(objectFields, w.object);
         if (!known) continue;
-        if (IMPLICIT_FIELDS2.has(w.field) || known.has(w.field)) continue;
+        if (known.has(w.field)) continue;
+        if (IMPLICIT_FIELDS2.has(w.field)) {
+          if (!anchors.get(w.object)?.has(w.field)) continue;
+          reported.add(dedupeKey);
+          findings.push({
+            severity: "warning",
+            rule: HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR,
+            where,
+            path,
+            message: `body calls ctx.api.object('${w.object}').${w.method ?? "update"}(\u2026) writing '${w.field}', and ${unprovisionedAnchorCause(w.object, w.field)} \u2014 ${unprovisionedAnchorWriteConsequence()}`,
+            hint: unprovisionedAnchorHint(w.object, w.field)
+          });
+          continue;
+        }
         reported.add(dedupeKey);
         findings.push({
           severity: "warning",
@@ -4508,19 +4872,20 @@ function fixHint(field, declared) {
 var import_shared2 = require("@objectstack/spec/shared");
 var ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
 var ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+var ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR = "action-body-write-unprovisioned-anchor";
 var ACTION_BODY_WRITE_PATTERN_IDS = ["api-crud-literal"];
 var ACTION_RECORD_WRITE_PATTERN_IDS = ["record-property-assign"];
 var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_BODY_WRITE_PATTERN_IDS.includes(p.id));
 var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
 var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
 var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
-var isRec15 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray21(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec15(x));
-  if (isRec15(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec16(x));
+  if (isRec16(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec15(def) ? def : {}
+      ...isRec16(def) ? def : {}
     }));
   }
   return [];
@@ -4538,7 +4903,7 @@ function collectActionBodies(stack) {
       const type = typeof action.type === "string" ? action.type : "script";
       if (type !== "script") return;
       const body = action.body;
-      if (!isRec15(body) || body.language !== "js") return;
+      if (!isRec16(body) || body.language !== "js") return;
       const source = body.source;
       if (typeof source !== "string" || source.trim() === "") return;
       const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
@@ -4557,10 +4922,11 @@ function collectActionBodies(stack) {
 }
 function validateActionBodyWrites(stack) {
   const findings = [];
-  if (!isRec15(stack)) return findings;
+  if (!isRec16(stack)) return findings;
   const sites = collectActionBodies(stack);
   if (sites.length === 0) return findings;
   let objectFields = null;
+  let anchors = null;
   for (const site of sites) {
     if (!/\bapi\b/.test(site.source) && !/\brecord\b/.test(site.source)) continue;
     const { writes: allWrites, ctxRecordEscapes } = extractHookBodyWriteSet(site.source);
@@ -4585,6 +4951,7 @@ function validateActionBodyWrites(stack) {
     }
     if (writes.length === 0) continue;
     objectFields ?? (objectFields = indexObjectFields2(stack));
+    anchors ?? (anchors = indexUnprovisionedAnchors(stack));
     const reported = /* @__PURE__ */ new Set();
     for (const w of writes) {
       if (w.object === void 0) continue;
@@ -4592,7 +4959,20 @@ function validateActionBodyWrites(stack) {
       if (reported.has(dedupeKey)) continue;
       const known = judgeableFieldsOf(objectFields, w.object);
       if (!known) continue;
-      if (IMPLICIT_FIELDS2.has(w.field) || known.has(w.field)) continue;
+      if (known.has(w.field)) continue;
+      if (IMPLICIT_FIELDS2.has(w.field)) {
+        if (!anchors.get(w.object)?.has(w.field)) continue;
+        reported.add(dedupeKey);
+        findings.push({
+          severity: "warning",
+          rule: ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR,
+          where,
+          path: site.path,
+          message: `body calls ctx.api.object('${w.object}').${w.method ?? "update"}(\u2026) writing '${w.field}', and ${unprovisionedAnchorCause(w.object, w.field)} \u2014 ${unprovisionedAnchorWriteConsequence()}`,
+          hint: unprovisionedAnchorHint(w.object, w.field)
+        });
+        continue;
+      }
       reported.add(dedupeKey);
       findings.push({
         severity: "warning",
@@ -4614,14 +4994,15 @@ function fixHint2(field, declared) {
 // src/validate-flow-node-writes.ts
 var import_shared3 = require("@objectstack/spec/shared");
 var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
+var FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR = "flow-node-write-unprovisioned-anchor";
 var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
-var isRec16 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray22(v) {
-  if (Array.isArray(v)) return v.filter((x) => isRec16(x));
-  if (isRec16(v)) {
+  if (Array.isArray(v)) return v.filter((x) => isRec17(x));
+  if (isRec17(v)) {
     return Object.entries(v).map(([name, def]) => ({
       name,
-      ...isRec16(def) ? def : {}
+      ...isRec17(def) ? def : {}
     }));
   }
   return [];
@@ -4634,30 +5015,44 @@ function readLiteralObjectName(config) {
 var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
 function validateFlowNodeWrites(stack) {
   const findings = [];
-  if (!isRec16(stack)) return findings;
+  if (!isRec17(stack)) return findings;
   const flows = asArray22(stack.flows);
   if (flows.length === 0) return findings;
   let objectFields = null;
+  let anchors = null;
   flows.forEach((flow, flowIndex) => {
     const flowName = typeof flow.name === "string" && flow.name ? flow.name : `#${flowIndex}`;
     const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
     walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
       if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
-      const config = isRec16(node.config) ? node.config : void 0;
+      const config = isRec17(node.config) ? node.config : void 0;
       if (!config) return;
       const fields = config.fields;
-      if (!isRec16(fields)) return;
+      if (!isRec17(fields)) return;
       const written = Object.keys(fields);
       if (written.length === 0) return;
       const objectName = readLiteralObjectName(config);
       if (!objectName) return;
       objectFields ?? (objectFields = indexObjectFields2(stack));
+      anchors ?? (anchors = indexUnprovisionedAnchors(stack));
       const known = judgeableFieldsOf(objectFields, objectName);
       if (!known) return;
       const nodeName = flowNodeLabel(node, walkIndex);
       const nodeWhere = regionTrail ? `${regionTrail} \u203A node "${nodeName}"` : `node "${nodeName}"`;
       for (const fieldName of written) {
-        if (known.has(fieldName) || IMPLICIT_FIELDS2.has(fieldName)) continue;
+        if (known.has(fieldName)) continue;
+        if (IMPLICIT_FIELDS2.has(fieldName)) {
+          if (!anchors.get(objectName)?.has(fieldName)) continue;
+          findings.push({
+            severity: "warning",
+            rule: FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR,
+            where: `flow "${flowName}" \u203A ${nodeWhere}`,
+            path: `${nodePath}.config.fields.${fieldName}`,
+            message: `${node.type} writes '${fieldName}', and ${unprovisionedAnchorCause(objectName, fieldName)} \u2014 ` + unprovisionedAnchorWriteConsequence(),
+            hint: unprovisionedAnchorHint(objectName, fieldName)
+          });
+          continue;
+        }
         if (fieldName.includes(".")) continue;
         findings.push({
           severity: "error",
@@ -4770,15 +5165,15 @@ function validateReadonlyFlowWrites(stack) {
 
 // src/validate-react-page-props.ts
 var import_node_module2 = require("module");
-var import_ui2 = require("@objectstack/spec/ui");
-var import_data8 = require("@objectstack/spec/data");
+var import_ui3 = require("@objectstack/spec/ui");
+var import_data10 = require("@objectstack/spec/data");
 
 // src/zod-issue-format.ts
-var isRec17 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec18 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var valueAtPath = (root, path) => {
   let cur = root;
   for (const key of path) {
-    if (!isRec17(cur) && !Array.isArray(cur)) return void 0;
+    if (!isRec18(cur) && !Array.isArray(cur)) return void 0;
     cur = cur[key];
   }
   return cur;
@@ -4826,7 +5221,7 @@ function loadTypeScript2() {
 }
 var asArray24 = (v) => Array.isArray(v) ? v : [];
 var BLOCKS = new Map(
-  import_ui2.REACT_BLOCKS.map((b) => [
+  import_ui3.REACT_BLOCKS.map((b) => [
     b.tag,
     {
       requiredBindings: b.interactions.filter((i) => i.required).map((i) => i.name),
@@ -4918,7 +5313,7 @@ var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 var REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 function checkChartDrillDown(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec18(raw)) {
+  if (!isRec19(raw)) {
     push2(
       "error",
       REACT_CHART_DRILLDOWN_INVALID,
@@ -4927,7 +5322,7 @@ function checkChartDrillDown(raw, push2) {
     );
     return;
   }
-  const parsed = import_ui2.ChartDrillDownSchema.safeParse(raw);
+  const parsed = import_ui3.ChartDrillDownSchema.safeParse(raw);
   if (parsed.success) return;
   for (const issue of parsed.error.issues) {
     const at = issue.path.length ? `drillDown.${issue.path.join(".")}` : "drillDown";
@@ -4941,7 +5336,7 @@ function checkChartDrillDown(raw, push2) {
 }
 function checkChartAggregate(raw, push2) {
   if (raw === void 0 || raw === NOT_STATIC) return;
-  if (!isRec18(raw)) {
+  if (!isRec19(raw)) {
     push2(
       "error",
       REACT_CHART_AGGREGATE_INVALID,
@@ -4959,7 +5354,7 @@ function checkChartAggregate(raw, push2) {
       "Add aggregate.groupBy (a field name, or { field, dateGranularity } to bucket dates) to give the chart a category axis. objectstack#5583 ruled that an ungrouped single-value chart is NOT a supported <ObjectChart> shape \u2014 groupBy stays required, and a single number belongs in an object-metric block instead. This stays a warning rather than an error only because promoting it is its own step."
     );
   }
-  const parsed = import_ui2.ChartAggregateSchema.safeParse(raw);
+  const parsed = import_ui3.ChartAggregateSchema.safeParse(raw);
   if (parsed.success) return;
   for (const issue of parsed.error.issues) {
     if (groupByAbsent && issue.path[0] === "groupBy") continue;
@@ -4972,7 +5367,7 @@ function checkChartAggregate(raw, push2) {
     );
   }
 }
-var isRec18 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec19 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
 function checkObjectChart(attrs, objectFields, findings, unprovisionedAnchors = /* @__PURE__ */ new Map()) {
   const { values, where, path } = attrs;
@@ -4982,11 +5377,11 @@ function checkObjectChart(attrs, objectFields, findings, unprovisionedAnchors =
   const aggregate = values.get("aggregate");
   checkChartAggregate(aggregate, push2);
   if (aggregate === void 0 || aggregate === NOT_STATIC) return;
-  if (!isRec18(aggregate)) return;
+  if (!isRec19(aggregate)) return;
   const fn = strOf(aggregate.function);
   const field = strOf(aggregate.field);
   const groupBy = aggregate.groupBy;
-  const groupByField = strOf(groupBy) ?? (isRec18(groupBy) ? strOf(groupBy.field) : void 0);
+  const groupByField = strOf(groupBy) ?? (isRec19(groupBy) ? strOf(groupBy.field) : void 0);
   const objectName = strOf(values.get("objectName"));
   const known = objectName ? objectFields.get(objectName) : void 0;
   if (objectName && known) {
@@ -5015,7 +5410,7 @@ function checkObjectChart(attrs, objectFields, findings, unprovisionedAnchors =
     fieldRef(field, "field");
     fieldRef(groupByField, "groupBy");
   }
-  const keys = (0, import_ui2.chartAggregateResultKeys)({ field, function: fn, groupBy });
+  const keys = (0, import_ui3.chartAggregateResultKeys)({ field, function: fn, groupBy });
   const columns = [keys.category, keys.value].filter((k) => !!k);
   if (columns.length === 0) return;
   const axisRef = (name, prop) => {
@@ -5030,18 +5425,18 @@ function checkObjectChart(attrs, objectFields, findings, unprovisionedAnchors =
     );
   };
   const xAxisRaw = values.get("xAxis");
-  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec18(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec19(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
   const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
   axisRef(categoryAxis, categoryProp);
   const yAxisRaw = values.get("yAxis");
   const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
   for (const a of yAxisList) {
-    axisRef(strOf(a) ?? (isRec18(a) ? strOf(a.field) : void 0), "yAxis[].field");
+    axisRef(strOf(a) ?? (isRec19(a) ? strOf(a.field) : void 0), "yAxis[].field");
   }
   const series = values.get("series");
   if (Array.isArray(series)) {
     for (const s of series) {
-      if (!isRec18(s)) continue;
+      if (!isRec19(s)) continue;
       const dataKey = strOf(s.dataKey);
       axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
     }
@@ -5081,7 +5476,7 @@ var REACT_FIELD_SPECS = {
 };
 var PATH_SEP = " \u203A ";
 var SCHEMA_TYPE_BY_TAG = new Map(
-  import_ui2.REACT_BLOCKS.map((b) => [b.tag, b.schemaType])
+  import_ui3.REACT_BLOCKS.map((b) => [b.tag, b.schemaType])
 );
 var FILTER_PROPS = new Set(
   Object.values(REACT_FIELD_SPECS).flatMap((s) => s.filterArrays ?? [])
@@ -5097,7 +5492,7 @@ function subformFieldRefs(value, basePath) {
   if (!Array.isArray(value)) return { child, parent };
   for (let i = 0; i < value.length; i++) {
     const sub = value[i];
-    if (!isRec18(sub)) continue;
+    if (!isRec19(sub)) continue;
     const at = (key) => `${basePath}[${i}].${key}`;
     child.push({
       objectName: strOf(sub.childObject),
@@ -5122,7 +5517,7 @@ function filterFieldRefs(node, basePath, out) {
     for (let i = 0; i < node.length; i++) filterFieldRefs(node[i], `${basePath}[${i}]`, out);
     return;
   }
-  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data8.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
+  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && import_data10.VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
     out.push({ name: head, path: `${basePath}[0]` });
   }
 }
@@ -5142,20 +5537,20 @@ function reactFieldRefs(spec, values, basePath) {
   }
   for (const key of spec.nestedFields ?? []) {
     const v = readable(key);
-    if (isRec18(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+    if (isRec19(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
   }
   for (const key of spec.sections ?? []) {
     const v = readable(key);
     if (!Array.isArray(v)) continue;
     for (let i = 0; i < v.length; i++) {
       const section = v[i];
-      if (!isRec18(section)) continue;
+      if (!isRec19(section)) continue;
       own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
     }
   }
   for (const key of spec.keyedByField ?? []) {
     const v = readable(key);
-    if (!isRec18(v)) continue;
+    if (!isRec19(v)) continue;
     for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
   }
   for (const key of spec.filterArrays ?? []) {
@@ -5212,7 +5607,7 @@ function recordContextFinding(tag, schemaType, where, path) {
     where,
     path,
     message: `<${tag}> renders "${schemaType}", which reads its record from the record context a record page mounts \u2014 a kind:'react' page never mounts one, so the block renders empty no matter how it is bound (its objectName/recordId are not read by the renderer).`,
-    hint: `On a react page bind the record yourself: ${import_ui2.REACT_RECORD_BLOCK_ALTERNATIVES[schemaType] ?? RECORD_BLOCK_GENERIC_FIX}`
+    hint: `On a react page bind the record yourself: ${import_ui3.REACT_RECORD_BLOCK_ALTERNATIVES[schemaType] ?? RECORD_BLOCK_GENERIC_FIX}`
   };
 }
 function localComponentNames(tsc, sf) {
@@ -5251,7 +5646,7 @@ function validateReactPageProps(stack) {
         const tag = node.tagName.getText(sf);
         const where = `page "${name}" \u203A <${tag}>`;
         const path = `pages[${p}].source`;
-        const recordType = import_ui2.RECORD_CONTEXT_BLOCK_TAGS.get(tag);
+        const recordType = import_ui3.RECORD_CONTEXT_BLOCK_TAGS.get(tag);
         if (recordType && !locals.has(tag)) {
           findings.push(recordContextFinding(tag, recordType, where, path));
           tsc.forEachChild(node, visit);
@@ -5278,7 +5673,7 @@ function validateReactPageProps(stack) {
           }
           if (tag === "Block") {
             const blockType = strOf(values.get("type"));
-            if (blockType && (0, import_ui2.isRecordContextBlockType)(blockType)) {
+            if (blockType && (0, import_ui3.isRecordContextBlockType)(blockType)) {
               findings.push(recordContextFinding(tag, blockType, where, path));
               tsc.forEachChild(node, visit);
               return;
@@ -5322,7 +5717,12 @@ function validateReactPageProps(stack) {
                 searchTargets,
                 where,
                 `${path} \u203A searchableFields`,
-                "searchableFields"
+                "searchableFields",
+                // A `<ListView>` prop is a view-level narrowing — the checker's
+                // default, spelled out here because the #8404 provenance index
+                // follows it positionally.
+                "narrowing",
+                unprovisionedAnchors
               )
             );
           }
@@ -5344,6 +5744,13 @@ function validateReactPageProps(stack) {
 var REFERENCE_INTEGRITY_RULES = [
   { name: "validateObjectReferences", run: validateObjectReferences },
   { name: "validateSearchableFields", run: validateSearchableFields },
+  // [#9257] The same reading, one axis over: a list view's `sort` is a field
+  // name written in metadata, resolved against the object's declared fields. It
+  // gates (`error`) because the runtime does not tolerate a bad one at all —
+  // `assertSortFieldsExist` (#6994) and `assertOrderByIsMaterializable` (#7095)
+  // both answer `400 INVALID_SORT` — and a view's sort is its FIRST fetch, so
+  // the refusal is the whole view, on every load, traced to nothing.
+  { name: "validateSortableFields", run: validateSortableFields },
   { name: "validateActionNameRefs", run: validateActionNameRefs },
   { name: "validatePageFieldBindings", run: validatePageFieldBindings },
   { name: "validateChartBindings", run: validateChartBindings },
@@ -5458,14 +5865,14 @@ function validateReferenceIntegrity(stack) {
 }
 
 // src/validate-component-props.ts
-var import_ui3 = require("@objectstack/spec/ui");
+var import_ui4 = require("@objectstack/spec/ui");
 var import_spec2 = require("@objectstack/spec");
 var COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
 var COMPONENT_PROPS_INVALID = "component-props-invalid";
-function isRec19(v) {
+function isRec20(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName18(v) {
+function strName19(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function asArray25(v) {
@@ -5475,12 +5882,12 @@ function asArray25(v) {
   }
   return [];
 }
-var PROPS_SCHEMAS = import_ui3.ComponentPropsMap;
+var PROPS_SCHEMAS = import_ui4.ComponentPropsMap;
 var DATASOURCE_SUPPLIED_PROP = "object";
 function suppliedByDataSource(issue, component) {
   if (issue.path.length !== 1 || issue.path[0] !== DATASOURCE_SUPPLIED_PROP) return false;
-  const dataSource = isRec19(component.dataSource) ? component.dataSource : void 0;
-  return strName18(dataSource?.object) !== void 0;
+  const dataSource = isRec20(component.dataSource) ? component.dataSource : void 0;
+  return strName19(dataSource?.object) !== void 0;
 }
 function unrecognizedKeysFromUnionArm(issue) {
   if (issue.code !== "invalid_union") return void 0;
@@ -5497,18 +5904,18 @@ function unrecognizedKeysFromUnionArm(issue) {
 }
 function validateComponentProps(stack) {
   const findings = [];
-  if (!isRec19(stack)) return findings;
+  if (!isRec20(stack)) return findings;
   const pages = asArray25(stack.pages);
   for (let pi = 0; pi < pages.length; pi++) {
     const page = pages[pi];
-    if (!isRec19(page)) continue;
-    const pageName = strName18(page.name) ?? `#${pi}`;
+    if (!isRec20(page)) continue;
+    const pageName = strName19(page.name) ?? `#${pi}`;
     for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
-      const type = strName18(component.type);
+      const type = strName19(component.type);
       if (!type) continue;
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec19(component.properties) ? component.properties : void 0;
+      const props = isRec20(component.properties) ? component.properties : void 0;
       if (!props) continue;
       const where = `page "${pageName}" \xB7 ${type}`;
       const base = `${path}.properties`;
@@ -6504,7 +6911,7 @@ function validateApprovalApprovers(stack) {
 }
 
 // src/validate-record-title.ts
-var import_data9 = require("@objectstack/spec/data");
+var import_data11 = require("@objectstack/spec/data");
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
 function asArray33(v) {
@@ -6532,7 +6939,7 @@ function validateRecordTitle(stack) {
         hint: `titleFormat is a render-only template the server cannot return or query, and an explicit nameField now takes precedence. For a single-field title set nameField: '<field>'. For a composite title, add a formula field (returnType: 'text') and designate it via nameField.`
       });
     }
-    const completeness = (0, import_data9.objectTitleCompleteness)(obj);
+    const completeness = (0, import_data11.objectTitleCompleteness)(obj);
     if (completeness.status === "none") {
       findings.push({
         severity: "warning",
@@ -6679,10 +7086,10 @@ function asArray35(v) {
   }
   return [];
 }
-function isRec20(v) {
+function isRec21(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function strName19(v) {
+function strName20(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function fieldNameOf(entry) {
@@ -6703,7 +7110,7 @@ function validateFormLayout(stack) {
     objectFields.set(name, new Set(fields));
   }
   for (const { rec: view, path: viewPath } of collectionEntries(stack.views, "views")) {
-    const viewName = strName19(view.name) ?? strName19(view.object) ?? viewPath;
+    const viewName = strName20(view.name) ?? strName20(view.object) ?? viewPath;
     const containerObject = viewObjectName(view);
     for (const site of formViewSites(view, viewPath)) {
       const objName = viewObjectName(site.view) ?? containerObject;
@@ -6713,7 +7120,7 @@ function validateFormLayout(stack) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const sec = sections[s];
-          const secFields = isRec20(sec) && Array.isArray(sec.fields) ? sec.fields : [];
+          const secFields = isRec21(sec) && Array.isArray(sec.fields) ? sec.fields : [];
           for (let f = 0; f < secFields.length; f++) {
             const entry = secFields[f];
             const fname = fieldNameOf(entry);
@@ -6728,7 +7135,7 @@ function validateFormLayout(stack) {
                 hint: `Fix the field name, or add "${fname}" to ${objName}. Section field references must match the object's field names exactly.`
               });
             }
-            const colSpan = isRec20(entry) ? entry.colSpan : void 0;
+            const colSpan = isRec21(entry) ? entry.colSpan : void 0;
             if (colSpan != null) {
               findings.push({
                 severity: "warning",
@@ -6886,12 +7293,12 @@ function bareRhsOnlyIdentifiers(ast) {
   for (const name of elsewhere) rhs.delete(name);
   return rhs;
 }
-function isRec21(v) {
+function isRec22(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function schemaIdOf(view) {
   const data = view.data;
-  if (!isRec21(data)) return void 0;
+  if (!isRec22(data)) return void 0;
   if (data.provider !== "schema") return void 0;
   return typeof data.schemaId === "string" ? data.schemaId : void 0;
 }
@@ -7263,7 +7670,7 @@ function predicateSource2(v) {
   }
   return void 0;
 }
-function isRec22(v) {
+function isRec23(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function checkPredicate(source, scope, where, path, findings) {
@@ -7334,7 +7741,7 @@ function walkFields(entries, scope, where, base, findings, depth) {
   if (!Array.isArray(entries) || depth > 12) return;
   for (let i = 0; i < entries.length; i++) {
     const entry = entries[i];
-    if (!isRec22(entry)) continue;
+    if (!isRec23(entry)) continue;
     const path = `${base}[${i}]`;
     for (const key of PREDICATE_KEYS) {
       const source = predicateSource2(entry[key]);
@@ -7368,7 +7775,7 @@ function validatePredicatePathRefs(stack, opts = {}) {
         const sections = Array.isArray(site.view[bucket]) ? site.view[bucket] : [];
         for (let s = 0; s < sections.length; s++) {
           const section = sections[s];
-          if (!isRec22(section)) continue;
+          if (!isRec23(section)) continue;
           const sectionPath = `${site.path}.${bucket}[${s}]`;
           for (const key of PREDICATE_KEYS) {
             const source = predicateSource2(section[key]);
@@ -7652,6 +8059,7 @@ function validateSecurityPosture(stack, opts) {
     }
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
+  const DELEGATION_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position"]);
   const nowMs = opts?.nowMs ?? Date.now();
   for (const [i, seed] of asArray36(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
@@ -7675,7 +8083,7 @@ function validateSecurityPosture(stack, opts) {
         }
       }
       const delegatedFrom = rec.delegated_from;
-      if (delegatedFrom != null && delegatedFrom !== "") {
+      if (DELEGATION_SEED_OBJECTS.has(seedObject) && delegatedFrom != null && delegatedFrom !== "") {
         const reason = rec.reason;
         if (typeof reason !== "string" || reason.trim().length === 0) {
           findings.push({
@@ -7841,6 +8249,8 @@ function validateOrgAxisRedLines(stack) {
 var import_formula6 = require("@objectstack/formula");
 var SHARING_RULE_UNLOWERABLE_CONDITION = "sharing-rule-unlowerable-condition";
 var SHARING_RULE_RUNTIME_VARIABLE_CONDITION = "sharing-rule-runtime-variable-condition";
+var SHARING_RULE_OBJECT_NOT_SHAREABLE = "sharing-rule-object-not-shareable";
+var SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT = "sharing-rule-object-controlled-by-parent";
 function asArray38(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -7865,10 +8275,67 @@ function sourceOf(condition) {
   return str2(input?.source);
 }
 var PUSHDOWN_SUBSET = "The lowerable subset is: `==` `!=` `>` `<` `>=` `<=`, `in`, `&&` `||` `!`, `== null` / `!= null`, and the string methods `startsWith` / `endsWith` / `contains` \u2014 over SINGLE-column `record.<field>` paths (ADR-0058 D2).";
+function effectiveSharingModelOf(obj) {
+  const m = obj.sharingModel;
+  if (m === "private") return "private";
+  if (m === "public_read") return "read";
+  if (m === "public_read_write" || m === "controlled_by_parent") return "public";
+  if (m == null) {
+    const isSystem = obj.isSystem === true || str2(obj.name).startsWith("sys_");
+    return isSystem ? "public" : "private";
+  }
+  return "private";
+}
+function masterOf(obj) {
+  for (const f of asArray38(obj.fields)) {
+    if (f.type === "master_detail") {
+      const ref = f.reference;
+      if (typeof ref === "string" && ref) return ref;
+    }
+  }
+  return void 0;
+}
+function anchorFindings(rule, index, objectsByName) {
+  const object = str2(rule.object);
+  if (!object) return [];
+  const target = objectsByName.get(object);
+  if (!target) return [];
+  const name = str2(rule.name) || String(index);
+  const where = `sharing rule "${name}" on object "${object}"`;
+  const path = `sharingRules[${index}].object`;
+  const owd = target.sharingModel;
+  if (owd === "controlled_by_parent") {
+    const master = masterOf(target);
+    return [{
+      severity: "error",
+      rule: SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT,
+      where,
+      path,
+      message: `Sharing rule "${name}" is anchored on object "${object}", which declares sharingModel 'controlled_by_parent'. A detail record has no record-level access of its own \u2014 its visibility is DERIVED from its master (ADR-0055), so it holds no shares to widen. \`SharingService.assertNotInertGrant\` refuses the grant with SHARING_NOT_ENABLED ("'${object}' is controlled by its parent (master-detail); share the master record instead"), so the rule's boot backfill fails, no \`sys_record_share\` row is ever written, and the recipients this rule names get whatever the MASTER grants them \u2014 which may be nothing. The grant is declared and does not exist.`,
+      hint: `Move the rule onto the MASTER object` + (master ? ` \u2014 "${object}" derives from "${master}" through its master_detail field, so share "${master}" and the detail rows follow` : `, and share that instead; the detail rows follow`) + `. If "${object}" is meant to carry a record-level baseline of its own, that is a different decision: change its sharingModel to 'private' (owner + shares) or 'public_read', and this rule becomes enforceable where it stands.`
+    }];
+  }
+  if (effectiveSharingModelOf(target) !== "public") return [];
+  const declared = owd === "public_read_write" ? `declares sharingModel 'public_read_write'` : `declares no sharingModel and is a system object (\`isSystem: true\` or a \`sys_\` name), which ADR-0090 D1 resolves to public`;
+  return [{
+    severity: "error",
+    rule: SHARING_RULE_OBJECT_NOT_SHAREABLE,
+    where,
+    path,
+    message: `Sharing rule "${name}" is anchored on object "${object}", which ${declared}. Its effective sharing model is therefore \`public\`, and sharing only ever WIDENS an OWD baseline \u2014 on the widest baseline there is nothing left to widen. \`SharingService.assertNotInertGrant\` refuses the grant with SHARING_NOT_ENABLED ("'${object}' is not under record-sharing enforcement"), so the rule's boot backfill fails and no \`sys_record_share\` row is ever written. Measured: \`buildReadFilter\` returns \`null\` for this object, i.e. NO record-level filter at all \u2014 every principal already reads every row, so this rule advertises a restriction that does not exist.`,
+    hint: `Decide which half is wrong. If the ACCESS is right \u2014 everyone should read and write these records \u2014 the rule is dead metadata: delete it (ADR-0049 enforce-or-remove). If the RULE is right \u2014 only the named audience should reach these records \u2014 then "${object}"'s OWD is the defect: set sharingModel: 'private' (owner + shares) or 'public_read', and this rule starts enforcing. Do NOT re-home the rule onto another public object; that moves the inertness instead of removing it.`
+  }];
+}
 function validateSharingRuleEnforceability(stack) {
   const findings = [];
   const cfg = stack ?? {};
+  const objectsByName = /* @__PURE__ */ new Map();
+  for (const obj of asArray38(cfg.objects)) {
+    const name = str2(obj.name);
+    if (name) objectsByName.set(name, obj);
+  }
   asArray38(cfg.sharingRules).forEach((rule, index) => {
+    anchorFindings(rule, index, objectsByName).forEach((f) => findings.push(f));
     const input = toCompilerInput(rule.condition);
     if (input === null) return;
     const result = (0, import_formula6.compileCelToFilter)(input, { variables: {} });
@@ -7994,11 +8461,11 @@ var import_meta4 = {};
 var VALIDATION_RULE_REGEX_UNCOMPILABLE = "validation-rule-regex-uncompilable";
 var VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema-uncompilable";
 var RUNTIME_AJV_OPTIONS = { allErrors: true, strict: false };
-var isRec23 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec24 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function asArray40(v) {
-  if (Array.isArray(v)) return v.filter(isRec23);
-  if (isRec23(v)) {
-    return Object.entries(v).filter(([, def]) => isRec23(def)).map(([name, def]) => ({ name, ...def }));
+  if (Array.isArray(v)) return v.filter(isRec24);
+  if (isRec24(v)) {
+    return Object.entries(v).filter(([, def]) => isRec24(def)).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
@@ -8015,7 +8482,7 @@ function loadAjv() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule.`
     );
   }
-  const ctor = isRec23(mod) && "default" in mod ? mod.default : mod;
+  const ctor = isRec24(mod) && "default" in mod ? mod.default : mod;
   cachedAjv = ctor;
   return ctor;
 }
@@ -8030,7 +8497,7 @@ function loadAddFormats() {
       `@objectstack/lint: checking a \`json_schema\` validation rule requires the "ajv-formats" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "ajv-formats" in the image; it is only loaded when a stack declares a \`json_schema\` validation rule. The runtime registers it too, and this gate must compile in the SAME environment or it starts disagreeing with the write path.`
     );
   }
-  const plugin = isRec23(mod) && "default" in mod ? mod.default : mod;
+  const plugin = isRec24(mod) && "default" in mod ? mod.default : mod;
   cachedAddFormats = plugin;
   return plugin;
 }
@@ -8060,13 +8527,13 @@ function flattenRules(rule, labelTrail, pathTrail, depth = 0) {
   if (depth >= MAX_RULE_NESTING_DEPTH) return out;
   for (const branch of ["then", "otherwise"]) {
     const nested = rule[branch];
-    if (isRec23(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
+    if (isRec24(nested)) out.push(...flattenRules(nested, label2, `${path}.${branch}`, depth + 1));
   }
   return out;
 }
 function walkObjectValidationRules(stack) {
   const walked = [];
-  if (!isRec23(stack)) return walked;
+  if (!isRec24(stack)) return walked;
   for (const obj of asArray40(stack.objects)) {
     const objectName = typeof obj.name === "string" ? obj.name : "(unnamed object)";
     const validations = obj.validations;
@@ -8101,7 +8568,7 @@ function validateRuleCompilability(stack) {
         });
       }
     }
-    if (rule.type === "json_schema" && isRec23(rule.schema)) {
+    if (rule.type === "json_schema" && isRec24(rule.schema)) {
       try {
         createRuntimeAjv().compile(rule.schema);
       } catch (err) {
@@ -8121,7 +8588,7 @@ function validateRuleCompilability(stack) {
 
 // src/validate-rule-schema-formats.ts
 var VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT = "validation-rule-json-schema-unknown-format";
-var isRec24 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isRec25 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var SUBSCHEMA_KEYS = [
   "additionalItems",
   "additionalProperties",
@@ -8145,7 +8612,7 @@ var SUBSCHEMA_MAP_KEYS = [
 var MAX_SCHEMA_WALK_DEPTH = 32;
 var escapePointerSegment = (segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1");
 function collectFormatUses(schema, pointer, out, depth) {
-  if (!isRec24(schema)) return;
+  if (!isRec25(schema)) return;
   if (typeof schema.format === "string") {
     out.push({ pointer: `${pointer}/format`, name: schema.format });
   }
@@ -8164,7 +8631,7 @@ function collectFormatUses(schema, pointer, out, depth) {
   }
   for (const key of SUBSCHEMA_MAP_KEYS) {
     const value = schema[key];
-    if (!isRec24(value)) continue;
+    if (!isRec25(value)) continue;
     for (const [name, entry] of Object.entries(value)) {
       collectFormatUses(entry, `${pointer}/${escapePointerSegment(key)}/${escapePointerSegment(name)}`, out, depth + 1);
     }
@@ -8172,13 +8639,13 @@ function collectFormatUses(schema, pointer, out, depth) {
   const items = schema.items;
   if (Array.isArray(items)) {
     items.forEach((entry, index) => collectFormatUses(entry, `${pointer}/items/${index}`, out, depth + 1));
-  } else if (isRec24(items)) {
+  } else if (isRec25(items)) {
     collectFormatUses(items, `${pointer}/items`, out, depth + 1);
   }
   const dependencies = schema.dependencies;
-  if (isRec24(dependencies)) {
+  if (isRec25(dependencies)) {
     for (const [name, entry] of Object.entries(dependencies)) {
-      if (!isRec24(entry)) continue;
+      if (!isRec25(entry)) continue;
       collectFormatUses(entry, `${pointer}/dependencies/${escapePointerSegment(name)}`, out, depth + 1);
     }
   }
@@ -8205,9 +8672,9 @@ function nearestRegisteredFormat(name, registered) {
   let best = null;
   let bestDistance = Number.POSITIVE_INFINITY;
   for (const candidate of [...registered].sort()) {
-    const distance7 = editDistance2(authored, candidate);
-    if (distance7 < bestDistance) {
-      bestDistance = distance7;
+    const distance8 = editDistance2(authored, candidate);
+    if (distance8 < bestDistance) {
+      bestDistance = distance8;
       best = candidate;
     }
   }
@@ -8217,7 +8684,7 @@ function validateRuleSchemaFormats(stack) {
   const findings = [];
   const pending = [];
   for (const { rule, objectName, label: label2, where, basePath } of walkObjectValidationRules(stack)) {
-    if (rule.type !== "json_schema" || !isRec24(rule.schema)) continue;
+    if (rule.type !== "json_schema" || !isRec25(rule.schema)) continue;
     const uses = [];
     collectFormatUses(rule.schema, "", uses, 0);
     for (const use of uses) pending.push({ use, where, label: label2, objectName, basePath });
@@ -8250,7 +8717,7 @@ function asArray41(v) {
   }
   return [];
 }
-function strName20(v) {
+function strName21(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function strList3(v) {
@@ -8265,7 +8732,7 @@ function collectNamePlacedActions(stack) {
       for (const n of strList3(list3[key])) placed.add(n);
     }
     for (const def of asArray41(list3.bulkActionDefs)) {
-      const n = strName20(def?.name);
+      const n = strName21(def?.name);
       if (n) placed.add(n);
     }
   };
@@ -8291,7 +8758,7 @@ function validateActionLocations(stack) {
   const check = (action, path) => {
     if (!action || typeof action !== "object") return;
     if ("locations" in action) return;
-    const name = strName20(action.name);
+    const name = strName21(action.name);
     if (!name) return;
     if (namePlaced.has(name)) return;
     findings.push({
@@ -8317,7 +8784,7 @@ function validateActionLocations(stack) {
 
 // src/lint-flow-patterns.ts
 var import_automation5 = require("@objectstack/spec/automation");
-var import_data10 = require("@objectstack/spec/data");
+var import_data12 = require("@objectstack/spec/data");
 function asArray42(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -8592,7 +9059,7 @@ function scanBranchRouting(at, nodes, edges, findings) {
 function filterCarriesNoCondition(filter) {
   if (filter === void 0 || filter === null) return true;
   if (typeof filter !== "object" || Array.isArray(filter)) return false;
-  return (0, import_data10.reduceFilterVerdict)(filter) === "true";
+  return (0, import_data12.reduceFilterVerdict)(filter) === "true";
 }
 function describeUnboundedFilter(filter) {
   if (filter === void 0 || filter === null) return "no `filter` key";
@@ -8959,7 +9426,7 @@ function lintLivenessProperties(stack) {
 }
 
 // src/lint-autonumber-formats.ts
-var import_data11 = require("@objectstack/spec/data");
+var import_data13 = require("@objectstack/spec/data");
 var AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
 var AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
 var AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
@@ -8985,8 +9452,8 @@ function lintAutonumberFormats(stack) {
       const name = typeof f.name === "string" ? f.name : "(unnamed field)";
       const fmt = typeof f.autonumberFormat === "string" ? f.autonumberFormat : typeof f.format === "string" ? f.format : "";
       if (!fmt) continue;
-      const tokens = (0, import_data11.parseAutonumberFormat)(fmt);
-      const refs = (0, import_data11.referencedFields)(tokens);
+      const tokens = (0, import_data13.parseAutonumberFormat)(fmt);
+      const refs = (0, import_data13.referencedFields)(tokens);
       const where = `object '${objectName}' \xB7 field '${name}' (autonumber "${fmt}")`;
       for (const t of tokens) {
         if (t.kind !== "literal") continue;
@@ -9141,6 +9608,17 @@ function lintViewRefs(stack) {
 }
 
 // src/data-model-rules.ts
+function objectWhere(obj) {
+  return `object "${obj?.name}"`;
+}
+function indexWhere(obj, idx, j, cols) {
+  const named = typeof idx?.name === "string" && idx.name.trim() ? `'${idx.name.trim()}'` : "";
+  const label2 = named || (cols.length > 0 ? `[${cols.join(", ")}]` : `#${j}`);
+  return `${objectWhere(obj)} \xB7 index ${label2}`;
+}
+function fieldWhere(obj, fieldName) {
+  return `${objectWhere(obj)} \xB7 field '${fieldName}'`;
+}
 function fieldEntries2(fields) {
   if (!fields) return [];
   if (Array.isArray(fields)) {
@@ -9174,11 +9652,13 @@ function lintUnscopedDeclaredIndexes(objects) {
     for (let j = 0; j < declaredIndexes.length; j++) {
       const idx = declaredIndexes[j];
       if (idx?.unique !== true) continue;
-      const cols = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string").join(", ") : "";
+      const colList = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string") : [];
+      const cols = colList.join(", ");
       const indexLabel = typeof idx?.name === "string" && idx.name.trim() ? ` '${idx.name.trim()}'` : "";
       issues.push({
         severity: "warning",
         rule: UNIQUE_UNSCOPED_DECLARED_INDEX,
+        where: indexWhere(obj, idx, j, colList),
         message: `"${obj.name}" declares index${indexLabel} [${cols}] with bare \`unique: true\` \u2014 a unique index whose scope is unstated (ADR-0120). Today the bare spelling materializes over exactly its \`fields\`, i.e. installation-wide; an author who meant "unique per organization" gets no per-organization constraint and no error. Protocol 18 rejects this spelling (#5082).`,
         path: `objects[${i}].indexes[${j}]`,
         fix: `State the scope: \`unique: 'global'\` (installation-wide \u2014 exactly today's behavior) or \`unique: 'organization'\` (one holder per organization \u2014 the driver prepends the NULL-safe organization key part at registration).`
@@ -9227,6 +9707,11 @@ function lintUniqueDeclarations(objects) {
       issues.push({
         severity: "warning",
         rule: UNIQUE_DOUBLE_DECLARATION,
+        // More specific than `path` on purpose: this rule's finding is about ONE
+        // column, but its `path` has always been the whole object (`objects[i]`)
+        // because the defect straddles `fields.<name>.unique` and an entry of
+        // `indexes`. `where` can name the column without picking one of the two.
+        where: fieldWhere(obj, name),
         message,
         path: `objects[${i}]`,
         fix
@@ -9255,6 +9740,7 @@ function lintLegacyOrganizationComposites(objects) {
       issues.push({
         severity: "warning",
         rule: UNIQUE_LEGACY_ORGANIZATION_COMPOSITE,
+        where: indexWhere(obj, idx, j, cols),
         message: `"${obj.name}" declares index${indexLabel} [${cols.join(", ")}] with ${spelling} and lists the organization column '${tenantColumn}' itself \u2014 the hand-written per-organization composite that predates the scope vocabulary (ADR-0120 S6). It reads as "unique per organization" but materializes as a plain composite, and SQL UNIQUE is NULL-distinct: on every row whose '${tenantColumn}' is NULL it enforces nothing (#5030) \u2014 which on a single-organization deployment is every row.`,
         path: `objects[${i}].indexes[${j}]`,
         fix: `State the scope instead: \`unique: 'organization'\` on this index (keep \`fields\` exactly as they are \u2014 the driver makes the listed '${tenantColumn}' NULL-safe in place rather than prepending a second organization key part). ${rest.length > 0 ? `The constraint then really is "one ${rest.join(" + ")} per organization". ` : ""}Opting in is a physical tightening: it surfaces as a \`recreate_index\` drift op gated by the duplicate pre-flight probe (ADR-0120 D4), so pre-existing duplicate NULL-organization rows block it with a report rather than failing a boot. Leaving it as-is stays valid indefinitely and forces no drift.`
@@ -9271,7 +9757,7 @@ var CLI_ONLY = ["cli"];
 var CLI_AND_RUNTIME = ["cli", "runtime-publish"];
 var RUNTIME_NEEDS_FULL_SNAPSHOT = "P2 (#4463): reads a stack-wide collection the per-write snapshot does not carry, so running it now would report the rest of the tenant's metadata as missing rather than judging this write.";
 var RUNTIME_HEAVY_SOURCE_PARSE = "Not runtime-safe: parses authored source through typescript/sucrase, the two dependencies the kernel boot path must never load (lazy-deps.test.ts). Studio compiles page source on its own path.";
-var RUNTIME_OBJECT_WRITES_P2 = "P2 (#4463): judges an object/field declaration. Object writes are the hottest metadata path in the product, so P1 gates `flow` first and widens once the gate has real traffic behind it.";
+var RUNTIME_OBJECT_ADVISORY_VOLUME = "Advisory-tier object rule: it cannot refuse a write, and it is held off the runtime door for advisory VOLUME (~8 findings per object write measured on unswept metadata, rendered in Studio since #4717), not refusal risk. Crossing it is a UX decision with its own card (#4716).";
 var EXPRESSION_INVALID = "expression-invalid";
 var AUTHORING_RULES = [
   // ADR-0032 §1a/1b — CEL predicates in actions/validations/flows/sharing/hooks
@@ -9332,8 +9818,14 @@ var AUTHORING_RULES = [
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-functional-completeness.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): the OBJECT write door — the five gating
+    // object rules cross together under the 2026-08-18 adjudication. The
+    // false-positive budget the crossing owed was exempted on a measured
+    // 0 refusals / 75 real object declarations (authored config-file metadata,
+    // so a lower bound — see RUNTIME_OBJECT_ADVISORY_VOLUME's note); the six
+    // advisory-tier object rules deliberately do NOT ride.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateFunctionalCompleteness(stack)
   },
   // [#7521, via cloud#1225] A managed object advertising a generic write verb
@@ -9357,8 +9849,11 @@ var AUTHORING_RULES = [
     input: "normalized",
     commands: ALL,
     source: "packages/lint/src/validate-managed-api-methods.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): a managed object advertising a verb its
+    // own affordances refuse is exactly the contradiction a Studio/MCP author
+    // can save today — the CLI sweep (#7934) never sees an overlay row.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateManagedApiMethods(stack)
   },
   // A view container in `views: []` that registers zero views: nothing appears
@@ -9380,19 +9875,38 @@ var AUTHORING_RULES = [
   },
   // ADR-0021 (#1719/#1721) — a widget's `dataset`/`dimensions`/`values` and its
   // chartConfig axis/series must resolve against the declared datasets.
+  //
+  // Runtime publish gate (#7529, maintainer-ruled 2026-08-12): a dashboard
+  // widget bound to a dataset that resolves to nothing sailed through save AND
+  // publish — this rule provably caught the body and was simply never invoked,
+  // because `dashboard` was not a runtime-gated type. Option B: a DRAFT may
+  // hold a forward reference; publishing refuses it with the key path named.
+  // The snapshot carries `datasets` for exactly this rule (`RuntimeStackContext`
+  // — without it every legitimate board reads as dangling, the 3-phantom
+  // measurement). `surfaces` is per-RULE, so this flip puts all SIX of the
+  // rule's error ids on the publish gate, not just `widget-dataset-unknown` —
+  // ruled 2026-08-15: they are one coherent "this board cannot render"
+  // reference-integrity class, and the ~6× wider accept-set narrowing was
+  // accepted knowingly rather than splitting the dataset limb into its own
+  // rule (traversal-duplication drift) or adding a per-finding-id surface
+  // filter (registry machinery that weakens "delete a rule from the table and
+  // enforcement stops in the same commit"). Warning-tier ids ride along on the
+  // advisory channel and never block (#4463 P1).
   {
     name: "validateWidgetBindings",
     tier: "gating",
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-widget-bindings.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["dashboard"],
     run: (stack) => validateWidgetBindings(stack)
   },
-  // ADR-0049 / #3367 — a header or widget action naming a `script`/`modal`
-  // target that resolves to no defined action ships a button that renders and
-  // silently does nothing on click. Unresolved `url` routes stay advisory.
+  // ADR-0049 / #3367 — a dashboard header action naming a dead target ships a
+  // button that renders and refuses (or does nothing) on click: a `script`
+  // target must name a defined action, a `modal` target must name a declared
+  // page (objectstack#6739-A — a modal string target names a PAGE, only).
+  // Unresolved `url` routes stay advisory.
   {
     name: "validateDashboardActionRefs",
     tier: "gating",
@@ -9417,6 +9931,28 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateFilterTokens(stack)
   },
+  // #8793 (the ruled C half of #8690) — a declared dashboard date-range preset
+  // name (`last_30_days`, …) authored as a bare ORDERING comparand resolves in
+  // no layer: the engine refuses it on a declared temporal field at query time
+  // (INVALID_FILTER / 400, PR #8808), and anywhere else it compares as a
+  // literal string. This is the authoring-time refusal the ruling shipped
+  // alongside the engine door, judging the filter literal in isolation —
+  // ordering positions only, all three authored filter shapes. Like
+  // `validateEmptyCombinators` it needs NO resolution context, so
+  // RUNTIME_NEEDS_FULL_SNAPSHOT does not apply and the runtime gate runs it
+  // for every filter-carrying type the gate already maps: the write path is
+  // the one door an AI author uses, and dashboards/views are where the preset
+  // vocabulary is near enough to reach for.
+  {
+    name: "validatePresetComparands",
+    tier: "gating",
+    input: "parsed",
+    commands: ALL,
+    source: "packages/lint/src/validate-preset-comparands.ts",
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["dashboard", "view", "object", "page", "flow"],
+    run: (stack) => validatePresetComparands(stack)
+  },
   // #5330 — the LITERAL empty combinators (`$and: []`, `$or: []`, `$not: {}`,
   // `{}`). #5322 ruled their RUNTIME meaning to be the boolean identity, and
   // this rule does not touch it: it refuses the literal SPELLINGS at authoring
@@ -9635,7 +10171,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-record-title.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     run: (stack) => validateRecordTitle(stack)
   },
   // ADR-0085 — `stageField` / `highlightFields` / `Field.group` are pointers
@@ -9648,7 +10184,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-semantic-roles.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     run: (stack) => validateSemanticRoles(stack)
   },
   // #2578 / #4449 — a form section's field reference that resolves to nothing
@@ -9859,7 +10395,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/lint-liveness-properties.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     run: (stack) => lintLivenessProperties(stack).map((f) => ({
       severity: "warning",
       rule: f.rule,
@@ -9878,8 +10414,12 @@ var AUTHORING_RULES = [
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/lint-autonumber-formats.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): an autonumber referencing a field the
+    // object does not carry is broken from the first record; only the error
+    // arm blocks — the optional-field arm is `warning` and rides the
+    // advisory channel like every other non-error finding (#4463 P1).
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => lintAutonumberFormats(stack).map((f) => ({
       severity: f.severity,
       rule: f.rule,
@@ -9920,12 +10460,12 @@ var AUTHORING_RULES = [
     commands: ["validate", "build"],
     source: "packages/lint/src/data-model-rules.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly ahead of R10 in its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
     run: (stack) => lintUnscopedDeclaredIndexes(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
       severity: f.severity === "suggestion" ? "info" : f.severity,
       rule: f.rule,
-      where: f.path,
+      where: f.where,
       path: f.path,
       message: f.message,
       hint: f.fix ?? ""
@@ -9941,12 +10481,12 @@ var AUTHORING_RULES = [
     commands: ["validate", "build"],
     source: "packages/lint/src/data-model-rules.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly as R10 of its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
     run: (stack) => lintUniqueDeclarations(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
       severity: f.severity === "suggestion" ? "info" : f.severity,
       rule: f.rule,
-      where: f.path,
+      where: f.where,
       path: f.path,
       message: f.message,
       hint: f.fix ?? ""
@@ -9963,12 +10503,12 @@ var AUTHORING_RULES = [
     commands: ["validate", "build"],
     source: "packages/lint/src/data-model-rules.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    surfaceReason: RUNTIME_OBJECT_ADVISORY_VOLUME,
     scopeReason: "`os lint` already reports this rule through `lintDataModel`, which calls it directly alongside R10/R11 in its best-practice sweep \u2014 registering it for `lint` as well would report every finding twice. This is coverage recorded, not coverage missing: all three commands report the rule.",
     run: (stack) => lintLegacyOrganizationComposites(Array.isArray(stack.objects) ? stack.objects : []).map((f) => ({
       severity: f.severity === "suggestion" ? "info" : f.severity,
       rule: f.rule,
-      where: f.path,
+      where: f.where,
       path: f.path,
       message: f.message,
       hint: f.fix ?? ""
@@ -10096,16 +10636,26 @@ var AUTHORING_RULES = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateOrgAxisRedLines(stack)
   },
-  // #4698 — the "declared but never read" gate, for the one surface where the
-  // predicate is EXACT rather than inferred. A sharing rule's `condition` has a
-  // single runtime consumer (`bootstrapDeclaredSharingRules`) whose only use of
-  // the key is `compileCelToFilter(condition, { variables: {} })`; a condition
-  // that does not lower means the rule is SKIPPED at boot, so the grant is
-  // declared and does not exist. The lint calls that same compiler, from the
-  // same package, with the same options — the verdict cannot drift from the
-  // consumer's. Gating for the ADR-0078 reason `SharingRuleSchema`'s own
-  // docblock states: the whole authorable surface is enforced, and this was the
-  // one field where that sentence was not yet true.
+  // #4698 / #9698 — the "declared but never read" gate, for the two fields of a
+  // sharing rule where the predicate is EXACT rather than inferred.
+  //
+  //  - `condition` has a single runtime consumer
+  //    (`bootstrapDeclaredSharingRules`) whose only use of the key is
+  //    `compileCelToFilter(condition, { variables: {} })`; a condition that
+  //    does not lower means the rule is SKIPPED at boot.
+  //  - `object` decides whether the grant is refused outright: reconcile hands
+  //    each row to `SharingService.grant`, whose ADR-0111 D7 pre-flight THROWS
+  //    `SHARING_NOT_ENABLED` when the anchor's effective sharing model is
+  //    `public` or it is a `controlled_by_parent` detail. Both are decidable
+  //    from authored metadata; the other arms of that verdict (`owner_id`, the
+  //    bypass set, federated anchors) are not, and are excluded by name.
+  //
+  // Either way the grant is declared and does not exist. The lint calls the
+  // same compiler and mirrors the same verdict function, from the same inputs
+  // — the verdict cannot drift from the consumers'. Gating for the ADR-0078
+  // reason `SharingRuleSchema`'s own docblock states: the whole authorable
+  // surface is enforced, and these were the fields where that sentence was not
+  // yet true.
   {
     name: "validateSharingRuleEnforceability",
     tier: "gating",
@@ -10113,7 +10663,7 @@ var AUTHORING_RULES = [
     commands: ALL,
     source: "packages/lint/src/validate-sharing-rule-enforceability.ts",
     surfaces: CLI_ONLY,
-    surfaceReason: "P2 (#4463): a sharing rule is not a `flow`, and P1 gates `flow` alone. The rule itself is snapshot-safe \u2014 it reads ONLY `stack.sharingRules[].condition` and needs no other collection \u2014 so widening it here is a `runtimeTypes: ['sharing_rule']` edit once the gate accepts that type, not new wiring. Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
+    surfaceReason: "P2 (#4463): a sharing rule is not a `flow`, and P1 gates `flow` alone. This entry used to add that the rule reads ONLY `stack.sharingRules[].condition` and needs no other collection, so crossing was a lone `runtimeTypes` edit. #9698 FALSIFIED that: the anchor arm resolves `sharingRules[].object` against `stack.objects` to read the anchor's OWD, so the rule is now cross-collection. `objects` IS carried by the per-write snapshot (`CONTEXT_STACK_KEYS`, #8309), so the remaining gap is unchanged in SHAPE \u2014 the gate must accept a `sharing_rule` type and the snapshot must carry `sharingRules`, which it does not \u2014 but it is now TWO collections, not one. Crossing with `sharingRules` uncarried would enforce this id for zero of its inputs while the entry claimed the door (#7220). Recorded as pending rather than done, because a rule that has never run at a door should not claim it.",
     run: (stack) => validateSharingRuleEnforceability(stack)
   },
   // #4983 — the sibling surface of the rule above, and ADR-0056 D4's gate,
@@ -10152,8 +10702,15 @@ var AUTHORING_RULES = [
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-rule-compilability.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): the rule loads ajv LAZILY, only when the
+    // judged snapshot actually carries a `json_schema` validation — so an
+    // ordinary object write (no `json_schema` anywhere) still loads no
+    // compiler, which `runtime-lazy-deps.test.ts` pins in both directions.
+    // The load it does take (~64 ms cold once, ~15 ms warm per publish
+    // carrying such a rule) is the measured, adjudicated price of refusing a
+    // validation rule that would otherwise ship compiled-by-nothing.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateRuleCompilability(stack)
   },
   // #5178 — the residual half of #5029, which registering `ajv-formats` does
@@ -10174,8 +10731,12 @@ var AUTHORING_RULES = [
     input: "parsed",
     commands: ALL,
     source: "packages/lint/src/validate-rule-schema-formats.ts",
-    surfaces: CLI_ONLY,
-    surfaceReason: RUNTIME_OBJECT_WRITES_P2,
+    // Runtime publish gate (#4716): crosses with its compile sibling above —
+    // the two judgements over one artifact stay on one side of the wall
+    // (#7220's family discipline). Same lazy-ajv contract: the registered
+    // format set is only enumerated once a schema actually names a format.
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ["object"],
     run: (stack) => validateRuleSchemaFormats(stack)
   }
 ];
@@ -10217,7 +10778,20 @@ var TYPE_TO_STACK_KEY = {
   permission: "permissions",
   book: "books"
 };
-var CONTEXT_STACK_KEYS = ["objects", "permissions", "books"];
+function narrowObjectsToPackageClosure(objects, scope) {
+  if (!scope || typeof scope.packageId !== "string" || scope.packageId === "") return objects;
+  const reachable = /* @__PURE__ */ new Set([scope.packageId, ...scope.dependencies]);
+  return objects.filter((entry) => {
+    if (!entry || typeof entry !== "object") return true;
+    const owner = entry[PACKAGE_PROVENANCE_KEY];
+    if (typeof owner !== "string" || owner === "" || owner === OVERLAY_PROVENANCE_SENTINEL) return true;
+    if (reachable.has(owner)) return true;
+    return isSystemObject(entry);
+  });
+}
+var PACKAGE_PROVENANCE_KEY = "_packageId";
+var OVERLAY_PROVENANCE_SENTINEL = "sys_metadata";
+var CONTEXT_STACK_KEYS = ["objects", "permissions", "books", "datasets"];
 function runtimeAuthoringRulesFor(type) {
   return AUTHORING_RULES.filter(
     (r) => r.surfaces.includes("runtime-publish") && (r.runtimeTypes ?? []).includes(type)
@@ -10243,7 +10817,8 @@ function buildRuntimeWriteSnapshots(args) {
   const itemName = typeof item.name === "string" ? item.name : void 0;
   const baseline = {};
   for (const key of CONTEXT_STACK_KEYS) {
-    const collection = args.context?.[key] ?? [];
+    const raw = args.context?.[key] ?? [];
+    const collection = key === "objects" ? narrowObjectsToPackageClosure(raw, args.packageScope) : raw;
     baseline[key] = key === stackKey ? collection.filter((o) => !itemName || o?.name !== itemName) : collection;
   }
   const candidate = {
@@ -10277,7 +10852,8 @@ function runRuntimeAuthoringRules(args) {
   const snapshots = buildRuntimeWriteSnapshots({
     type: args.type,
     item: args.item,
-    ...args.context !== void 0 ? { context: args.context } : {}
+    ...args.context !== void 0 ? { context: args.context } : {},
+    ...args.packageScope !== void 0 ? { packageScope: args.packageScope } : {}
   });
   if (!snapshots) return empty;
   const ctx = { sduiManifest: args.sduiManifest };
@@ -10292,6 +10868,7 @@ function runRuntimeAuthoringRules(args) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   buildRuntimeWriteSnapshots,
+  narrowObjectsToPackageClosure,
   runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor,
   runtimeGatedTypes,