@objectstack/lint 17.1.0 → 17.3.0

package/dist/index.d.ts

@@ -1,8 +1,9 @@
+import ts from 'typescript';
 import { Manifest } from '@objectstack/sdui-parser';
 import { SearchFieldMeta } from '@objectstack/spec/data';
 import { Options } from 'ajv';
 import { AccessMatrixParsed } from '@objectstack/spec/security';
-export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimePackageScope, m as RuntimeStackContext, n as authoringRulesFor, o as buildRuntimeWriteSnapshots, p as narrowObjectsToPackageClosure, r as runAuthoringRules, q as runRuntimeAuthoringRules, s as runtimeAuthoringRulesFor, t as runtimeGatedTypes, u as splitBySeverity, v as stackKeyForType } from './runtime-s3X9D9hm.js';
+export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimePackageScope, m as RuntimeStackContext, n as authoringRulesFor, o as buildRuntimeWriteSnapshots, p as narrowObjectsToPackageClosure, r as runAuthoringRules, q as runRuntimeAuthoringRules, s as runtimeAuthoringRulesFor, t as runtimeGatedTypes, u as splitBySeverity, v as stackKeyForType } from './runtime-B8F5-Cbg.js';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -39,13 +40,26 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  * - `dashboard-filter-field-unknown` (#3365) — a dashboard-level filter
  *   (`dateRange` or a `globalFilters[]` entry) is wired into EVERY widget's
  *   analytics query (#2501), but its EFFECTIVE field (after any `filterBindings`
- *   re-target) does not exist on a bound widget's dataset object. The widget's
+ *   re-target) does not resolve on a bound widget's dataset object. The widget's
  *   query then references a non-existent column and crashes at render time
  *   (`no such column …`) — a build-decidable invariant that previously escaped
  *   the static gate and failed only when a user opened the dashboard. A widget
  *   opts out with `filterBindings: { <name>: false }` or re-targets to a real
  *   field. This is the same field-existence invariant ADR-0032 enforces for
  *   CEL formula / sharing-rule references, applied to dashboard filter fields.
+ *   Resolution is {@link resolveFieldPath}'s (#14275), so a DOTTED effective
+ *   field (`account.signed_at`) is walked hop by hop rather than skipped, and a
+ *   bare name is judged against the object's OWN injected columns rather than
+ *   the object-independent `SYSTEM_FIELDS` union — see "What #14275 closed"
+ *   below for why each half was a hole rather than a nicety.
+ * - `dashboard-filter-field-not-included` (#14275) — the effective field
+ *   RESOLVES, but its relationship prefix is not declared in the bound
+ *   dataset's `include`, so ADR-0021 compiles no join for it and the column is
+ *   out of the broadcast query's reach. The `include` half of the same two
+ *   clauses `widget-filter-field-not-included` applies to the widget's own
+ *   `filter`, at the position one level up — a separate id because the fix is a
+ *   different edit (declare the join, versus point the filter somewhere real)
+ *   and because the family keeps one id per class.
  *
  * Advisory rules — severity `warning`, build stays green:
  *
@@ -78,6 +92,91 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  *   of the same invariant, warned rather than errored because this pass cannot
  *   see the remote schema (#8116's severity reasoning).
  *
+ * ── The widget's OWN two references (#14148) ─────────────────────────────────
+ *
+ * - `widget-filter-field-unknown` — a KEY of the widget's own `filter` resolves
+ *   to no column on the bound dataset's object graph.
+ * - `widget-filter-field-not-included` — that key RESOLVES, but its relationship
+ *   prefix is not declared in the dataset's `include`, so ADR-0021 compiles no
+ *   join for it and the column is out of the query's reach.
+ * - `widget-sortby-unselected` — `options.sortBy` names neither a `dimensions[]`
+ *   nor a `values[]` entry of this widget, so the ordering the author wrote
+ *   cannot be applied to a result that will not contain that column.
+ *
+ * All three are `error`, and the reason is the reporting card's, quoted because
+ * it is the sharpest statement of it in the family: the dashboard it was
+ * measured on leads with a "not moving" tile — open work untouched >14 days —
+ * and *"an empty tile is indistinguishable from a healthy team: a missing
+ * number reads as zero, and zero is the answer the manager is hoping for."*
+ * The failure is not merely silent, it is silent in the direction the reader
+ * WANTS to believe, which is why it gates rather than advises.
+ *
+ * ### Why these two were the surviving holes
+ *
+ * On the very same node, the TOKEN was checked and the COLUMN was not:
+ * `filter-token-unknown` (#3574) fires path-precise at
+ * `…widgets[4].filter.due_date.$lte`, so the traversal already walked the
+ * filter tree and already knew the widget's dataset. And the identical
+ * resolution already existed one key over — `dashboard-filter-field-unknown`
+ * resolves a DASHBOARD-level filter's field against each widget's dataset base
+ * object. `widgets[].filter` is the same field-existence invariant on the
+ * filter an author is MORE likely to write by hand, and it was simply never fed
+ * through it. `options.sortBy` is the declared-≠-enforced half:
+ * `DashboardWidgetOptionsSchema.sortBy` states its own contract in prose —
+ * *"must be one this widget actually selects"* — and nothing enforced it.
+ *
+ * ### The `include` clause, and why a dotted path is RESOLVED here
+ *
+ * A widget's `filter` is ANDed into the dataset query as `runtimeFilter`
+ * (`DashboardWidgetSchema.filter`; `dataset-executor.ts` `combineFilters(
+ * compiled.filter, selection.runtimeFilter)`), and that compiled query carries
+ * ONLY the joins the dataset's `include` declared (`dataset-compiler.ts`: joins
+ * are derived from `include`, and `assertDeclared` refuses an undeclared
+ * relationship path). So a dotted key here is judged on the same two clauses
+ * `validate-dataset-references.ts` applies one level down — existence, then
+ * joinability — rather than skipped. The runtime is NOT a backstop for it
+ * either — `assertDeclared` runs over `dimensions` and `measures` only, never
+ * over `runtimeFilter` — so nothing between the author and the empty tile asks
+ * this question.
+ *
+ * ### What #14275 closed, one position up
+ *
+ * `dashboard-filter-field-unknown` (a1) shipped with the two limitations the
+ * paragraph above used to record as deliberate, and #14275 closed both by
+ * migrating that branch onto this same seam:
+ *
+ *   1. it SKIPPED every dotted effective field (`if (field.includes('.'))
+ *      continue;`), which was accurate when nothing in this package could walk
+ *      hops and false once {@link resolveFieldPath} landed. The consequence was
+ *      the sharper one: a dashboard filter is broadcast to EVERY widget on the
+ *      board, so a single unjudged `filterBindings: { dateRange:
+ *      'account.signed_at' }` degraded the whole dashboard rather than one tile
+ *      — unjudged whether or not `account` existed, whether or not `signed_at`
+ *      existed on it, and whether or not `account` was in the dataset's
+ *      `include`;
+ *   2. it resolved bare names against the object-independent `SYSTEM_FIELDS`
+ *      union, which answers "could this be a system column ANYWHERE". The two
+ *      differ exactly where it matters: on `ownership: 'none'` the platform
+ *      injects no `owner_id`, so the union answered a real defect as
+ *      resolvable. Both positions now take skip 3 per object, through
+ *      {@link resolveFieldPath}'s use of `injectedColumnsFor`.
+ *
+ * The #8340 provenance question rides on the migrated branch unchanged, and is
+ * now GATED by the verdict's `injected` marker rather than by union membership:
+ * a leaf that resolved because it is injected is the only leaf whose anchor can
+ * be unprovisioned (an author-DECLARED column of the same name is the author's,
+ * #7859), and the marker states that fact where the flat union could not. It
+ * also travels: the anchor is looked up on the object the LEAF landed on, so a
+ * dotted filter path ending on an ADR-0015 `external` object is answered too.
+ *
+ * Resolution is {@link resolveFieldPath}'s and its `unknowable` verdicts are
+ * never reported (ADR-0072 D1), so the three skips every field-existence rule
+ * in this package takes apply unchanged: an object this stack does not define,
+ * an object with no readable field map (ADR-0015 `external`), and a
+ * registry-injected system column — the last resolved PER OBJECT rather than
+ * through the flat `SYSTEM_FIELDS` union, which is what lets a reference to
+ * `owner_id` on an `ownership: 'none'` object stay a real finding.
+ *
  * Warnings can be deliberately suppressed per widget via
  * `suppressWarnings: ['<rule-id>']`; errors cannot — they describe a
  * binding the analytics service cannot satisfy.
@@ -93,6 +192,17 @@ declare const WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 declare const WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 declare const DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
 declare const DASHBOARD_FILTER_FIELD_UNPROVISIONED = "dashboard-filter-field-unprovisioned";
+/**
+ * [#14275] A dashboard filter's effective field resolves, but its relationship
+ * prefix is not declared in the bound dataset's `include`.
+ */
+declare const DASHBOARD_FILTER_FIELD_NOT_INCLUDED = "dashboard-filter-field-not-included";
+/** [#14148] A key of the widget's OWN `filter` that resolves to no column. */
+declare const WIDGET_FILTER_FIELD_UNKNOWN = "widget-filter-field-unknown";
+/** [#14148] A widget filter key whose relationship prefix is not in `include`. */
+declare const WIDGET_FILTER_FIELD_NOT_INCLUDED = "widget-filter-field-not-included";
+/** [#14148] `options.sortBy` names nothing this widget selects. */
+declare const WIDGET_SORTBY_UNSELECTED = "widget-sortby-unselected";
 type WidgetBindingSeverity = 'error' | 'warning';
 interface WidgetBindingFinding {
     /** `error` = unresolvable binding (broken page); `warning` = advisory. */
@@ -108,7 +218,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$G = Record<string, unknown>;
+type AnyRec$L = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -116,7 +226,7 @@ type AnyRec$G = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$G): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$L): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -129,12 +239,293 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$F = Record<string, unknown>;
+type AnyRec$K = Record<string, unknown>;
+/**
+ * A FIELD-level conditional rule (`visibleWhen` / `readonlyWhen` /
+ * `requiredWhen`) that reaches for a namespace root the field level does not
+ * bind. The field level binds THREE roots and nothing else — `record`,
+ * `previous`, and `parent` on a master-detail line item — measured at three
+ * independent ends: the server (`rule-validator.ts` binds
+ * `{ record, previous, extra: { parent } }` for `readonlyWhen` and
+ * `{ record, previous, ...parentScope }` for `requiredWhen`), the client
+ * (`evalFieldPredicate` binds `record` + `previous` + a caller `scope` that
+ * is only ever `{ parent }` across objectui's five field-level call sites),
+ * and the authoring surface (objectui's `FIELD_RULE_ROOTS`, whose comment
+ * says "nothing else").
+ *
+ * ## Why this is a rule of its own rather than a missing root
+ *
+ * Until #6290 the same rejection fell out of `@objectstack/formula`'s
+ * `SCOPE_ROOTS` not listing `current_user` — a global baseline, doing a
+ * per-surface job by accident. Two things were wrong with that:
+ *
+ *  1. The rest of the package said the opposite. `introspectScope` hands
+ *     `current_user` to authors as a legal root and `checkRoleCatalog`'s four
+ *     position-membership regexes all lead with it, because ADR-0068 D1 makes
+ *     it THE canonical spelling and `buildScope` really does mount it. One
+ *     package, two accounts of one root.
+ *  2. The diagnostic was the generic bare-field one, so it prescribed
+ *     "Write `record.current_user`" — a shape that binds on NO layer. An
+ *     author who followed it wrote something strictly worse than what they
+ *     started with, and the failure stayed silent.
+ *
+ * So the baseline now declares the root (a reference through it never faults
+ * platform-wide) and the surface that genuinely cannot bind it says so here,
+ * in its own words, with the prescriptions that actually exist.
+ *
+ * ## Why the membership test is an ALLOWLIST (#6713)
+ *
+ * Until #6713 this rule matched a hand-written DENYLIST — one root in #6584,
+ * three after #6585 (`current_user` / `user` / `ctx`). The denylist was never
+ * the truth: the three anchors above pin a three-item ALLOWLIST, and
+ * everything outside it is equally unbound, faults identically, and — this is
+ * the part that made the hole invisible — is equally SILENT. A root in
+ * `SCOPE_ROOTS` resolves in the strict env, so the bare-reference check one
+ * line up never fires on it either. #6713 measured 21 roots living in that
+ * gap (`input`, `output`, `os`, `vars`, `variables`, `automation`, `context`,
+ * `args`, `item`, `env`, `step`, `result`, `trigger`, `event`, `payload`,
+ * `data`, `params`, `config`, `settings`, `features`, `current`), two of them
+ * highly credible author typos rather than theoretical members:
+ *
+ *  - `os.user.id` — ADR-0068 D1's FOURTH user spelling. #6585 took three and
+ *    left this one, so the same semantic error stayed silent under one of the
+ *    four names the platform itself mounts the user object under.
+ *  - `data.status == 'x'` — `data` is the LEGAL root of this very
+ *    `visibleWhen` key on a METADATA form (`view.zod.ts`: "Root: `record` …
+ *    in runtime forms, or `data` in metadata forms"). Two form kinds, one key
+ *    name, different roots — and the repo's own `*.form.ts` files are full of
+ *    the `data` spelling for an author to copy.
+ *
+ * A denylist cannot track `SCOPE_ROOTS`: every root added there is unreported
+ * here until somebody remembers to copy it across (`current_user` itself
+ * arrived in #6290 and needed #6584 to be noticed). The allowlist inverts the
+ * maintenance burden onto the three roots that are pinned by three anchors and
+ * change only when the evaluators do.
+ *
+ * The membership test is {@link FIELD_RULE_JUDGED_ROOTS} minus the allowlist.
+ * Its bulk is `SCOPE_ROOTS`, taken from `@objectstack/formula` rather than
+ * restated here (#6713 published it for this consumer) — one list, one
+ * definition, no drift — plus the ambient roots #13935 measured outside that
+ * baseline; see "Why the judged vocabulary is WIDER than `SCOPE_ROOTS`" below.
+ * It deliberately is NOT `firstUndeclaredReference`, the declaredness oracle
+ * the sibling visibility rule uses, and the difference is a measured false
+ * positive rather than a preference: the strict env also declares CEL's TYPE
+ * names, so `type(record.x) == string` reports `string` as a root that
+ * "resolves". Judging by declaredness would reject that legitimate predicate;
+ * judging by membership does not. Everything the oracle owns and this list
+ * does not — bare field references, comprehension-macro variables — keeps
+ * falling to the bare-reference check, which has the right prescription for
+ * it. The two partitions are disjoint and there is no gap between them.
+ *
+ * ⚠️ That disjointness used to hold for FREE and no longer does. While every
+ * judged root was a `SCOPE_ROOTS` member it was declared in the strict env, so
+ * the bare-reference check could not fire on it whatever this rule decided.
+ * An AMBIENT root is undeclared there, so both checks see it — the walk
+ * suppresses the bare-reference verdict for a root this rule has claimed
+ * (`claimedRoot` on the `check` closure) to keep the invariant true by
+ * construction instead of by coincidence.
+ *
+ * ## Why it is an error and not a warning
+ *
+ * Every fault direction available here is silent, and two of the three are
+ * the opposite of what the author declared (see the per-slot table below):
+ * a `visibleWhen` written to HIDE leaves the field visible to everyone, a
+ * `readonlyWhen` written to unlock-under-a-condition locks the field on every
+ * write, and a `requiredWhen` simply never fires. None of the three produces
+ * a runtime error an author can find; the only signal that exists is this one
+ * (#6146).
+ *
+ * Verdict scope is the field level only. Per-option `visibleWhen` is checked
+ * by the loop in the field walk and deliberately NOT passed through here:
+ * options resolve against the host's predicate scope, which binds
+ * `current_user` (ADR-0068 / objectui#2284) — that surface is where such a
+ * predicate belongs, which is why it is also the first prescription below.
+ *
+ * ## The user roots, and why `ctx` is judged whole-root (#6585)
+ *
+ * ADR-0068 D1 makes `user` and `ctx.user` ALIASES of `current_user` — one
+ * `EvalUser` object under every spelling (`buildScope` in
+ * `formula/stdlib.ts` hangs the same reference on `current_user` / `user` /
+ * `ctx.user` / `os.user`). Matching only the canonical spelling meant the
+ * identical semantic error got a diagnostic under `current_user` and total
+ * silence under the aliases — which spelling the author picked decided
+ * whether they got the diagnostic, the exact fork AI authors cannot
+ * self-check. All four roots now share one verdict and one prescription;
+ * the message names the spelling found, nothing else varies. (`os` joined the
+ * set in #6713 — it is the fourth name `buildScope` mounts the same object
+ * under, and the allowlist would have rejected it anyway; what the user tier
+ * decides is only WHICH prescription it gets, and the user one is right for
+ * `os.user`. `os.org` / `os.env` land in the same tier because the option
+ * surface named by the first prescription binds the whole `os` namespace, not
+ * only its `user` member.)
+ *
+ * `ctx` is judged as a WHOLE root, not only in `ctx.user` form, because at
+ * this surface that is simply what is true: `buildScope` creates the `ctx`
+ * root ONLY when the evaluation carries a user (`scope.ctx = { user }`
+ * inside `if (ctx.user !== undefined)`), and no field-level site passes one
+ * — the server binds `record`+`previous`(+`parent`) (`rule-validator.ts`
+ * `readonlyWhenBindings` / the `requiredWhen` block) and the client's
+ * `evalFieldPredicate` binds `record`+`previous`+caller `scope` (only ever
+ * `{ parent }`). So `ctx.locale` faults exactly like `ctx.user.id` here.
+ * `ctx` IS ActionEngine's predicate root elsewhere — the platform's real
+ * `ctx.user` predicates all sit on action `visible` (`sys-user.object.ts`,
+ * `sys-invitation.object.ts`), a surface this helper never reads — and
+ * measured usage of field-level `*When` with ANY user root is zero across
+ * examples/, packages/ and objectui (#6585's sweep).
+ *
+ * The rejected alternative was matching `ctx` only in its `ctx.user` form.
+ * `collectCelRootIdentifiers` reports ROOTS and drops member names by
+ * design, so that reading needs a source-level spelling match — and a
+ * spelling match is precisely the defect this rule exists to remove: it
+ * would re-open the same fork one level down (`ctx["user"].id` silent,
+ * `ctx.user.id` rejected), while leaving a real fail-open fault (`ctx.locale`)
+ * unreported for the sake of a narrower rule NAME.
+ *
+ * ## The message tiers on TWO orthogonal axes
+ *
+ * The causal half tiers by SLOT (#6716); the prescription half tiers by ROOT
+ * (#6713). They are independent — `data` on a `readonlyWhen` needs the
+ * metadata-form prescription AND the locked-field consequence — so one
+ * skeleton carries both rather than a message per combination.
+ *
+ * ### Axis 1 — the consequence, by SLOT (#6716, all three cells measured)
+ *
+ * Until #6713/#6716 all three slots shared ONE sentence: "the predicate
+ * faults and falls back to VISIBLE, leaving the field the test was meant to
+ * hide showing for everyone". That is precise for exactly one of them. The
+ * measurement, at both ends of each slot:
+ *
+ *  - **`visibleWhen` — client-only, and since objectui#6010 it fails in TWO
+ *    ways rather than one.** The server half is unchanged and still exactly
+ *    right: it never evaluates a FIELD-level `visibleWhen` at all —
+ *    `rule-validator.ts`'s `ConditionalFieldDef` has no such member, and
+ *    `hasFieldRules` gates on `requiredWhen || readonlyWhen ||
+ *    fieldHasOptionVisibility` — the `visibleWhen` it does evaluate is the
+ *    per-OPTION one. The RENDERER half moved. `plugin-form`'s
+ *    `sectionFields.ts` (`fromObjectSchema`) copies an object field's ADR-0036
+ *    `visibleWhen` / `readonlyWhen` / `requiredWhen` straight onto the runtime
+ *    form field, and the SDUI form renderer resolves those through
+ *    `resolveFieldRuleState` **with `predicateScope` bound**. So under a host
+ *    that publishes a scope the predicate does not fault: it RESOLVES, the
+ *    control is hidden in that one form, and the server still returns the value
+ *    to every other reader — a silent enforcement gap. Only where no host
+ *    publishes a scope (the public `/f/:slug` route, every non-form reader)
+ *    does the old sentence still describe what happens: unbound root, fault,
+ *    `fallback: true`, field visible to everyone.
+ *
+ *    ⛔ This is not a reason to relax {@link FIELD_RULE_BOUND_ROOTS}. The
+ *    verdict is MORE justified than when it was written, not less: trading a
+ *    loud lint error for a gap nobody can see is the one outcome worse than
+ *    the error. Only the causal clause was re-measured.
+ *  - **`readonlyWhen` — the two ends fault in OPPOSITE directions, and the
+ *    server wins.** Server: `isReadonlyWhenLocked` matches the fault with
+ *    `unknownVariableOf` and returns `true` — "the declared lock is not
+ *    waived because it could not be evaluated" (#4889's carve-out, whose
+ *    trigger is precisely the unbound-ROOT case, not the undeclared-key one)
+ *    — and `stripReadonlyWhenFields` then DELETES the field from the incoming
+ *    payload and lets the rest of the write through. Client:
+ *    `resolveFieldRuleState` passes `fallback: false`, so the form renders the
+ *    field editable. The standing "server enforces, client is courtesy" rule
+ *    — ADR-0124 D1 — resolves the disagreement: the author edits
+ *    the field, the save reports
+ *    success, and the value silently never lands. The old sentence told this
+ *    author the field would be VISIBLE TO EVERYONE — the opposite failure, and
+ *    the opposite troubleshooting direction.
+ *  - **`requiredWhen` — fail-OPEN at both ends, and never about visibility.**
+ *    Server: the `requiredWhen` block logs `unknownVariableOf`'s name and
+ *    `continue`s — #4977 deliberately did not copy #4889's carve-out, so the
+ *    required-check is skipped for that write. Client: `fallback: false`, so
+ *    the form does not mark the field required either. Both ends agree and
+ *    both do nothing: the requirement is never enforced anywhere, and a record
+ *    saves with the field empty. "Falls back to VISIBLE" was not merely
+ *    imprecise here, it named the wrong property of the field.
+ *
+ * `conditionalRequired` also reaches this helper (the field walk still passes
+ * it). It is a `retiredKey` in `FieldSchema` — the strict schema rejects it by
+ * name — so the branch is inert on the parsed compile path, and it gets a
+ * slot-agnostic clause rather than a fabricated fourth measurement.
+ *
+ * ### Axis 2 — the prescription, by ROOT (#6713)
+ *
+ * The pre-#6713 prescriptions are user-oriented (move to the option level,
+ * declare permission-set FLS) because the pre-#6713 denylist held only user
+ * roots. Handed to an author who wrote `data.type == 'select'`, "move it to
+ * the option's `visibleWhen`" answers a question nobody asked. Three tiers:
+ *
+ *  - **user roots** (`current_user` / `user` / `ctx` / `os`) keep the existing
+ *    two user-specific prescriptions plus the `record` rewrite. What changed is
+ *    the GROUNDING of the first one, not the prescription: it used to read
+ *    "per-option is the one `*When` surface that binds `current_user`", and
+ *    since objectui#6010 a form VIEW's field predicate binds those roots too —
+ *    client-side only, because nothing on the write path evaluates a form-view
+ *    field `visibleWhen`. So per-option is recommended for the reason that
+ *    survives the change: the rule validator enforces it on write. The message
+ *    now says that, and names the view surface only to refuse it as a
+ *    destination for a server-enforced object rule (trading a loud lint error
+ *    for a silent enforcement gap is the one outcome worse than the error);
+ *  - **`data`** gets the metadata-form-vs-runtime-form explanation, because
+ *    that is what the mistake IS — the same key name, the other form kind's
+ *    root;
+ *  - **`app` and the other AMBIENT roots** get the renderer-mounted
+ *    explanation and an explicit refusal of `record.<root>` (#13935, below);
+ *  - **everything else** gets the general rewrite, phrased without claiming
+ *    which other surface the author copied it from.
+ *
+ * ## Why the judged vocabulary is WIDER than `SCOPE_ROOTS` (#13935)
+ *
+ * `SCOPE_ROOTS` was the membership test until #13935, and it is the wrong
+ * question by one word: it answers "is this root declared PLATFORM-WIDE",
+ * while the rule needs "is this root bound at SOME evaluation site". The two
+ * agreed for 27 roots and then disagreed for `app` — bound by objectui's
+ * `ExpressionProvider` on the very surface an author migrates a rule DOWN
+ * from, absent from the baseline. Falling outside the membership test sent it
+ * to the bare-reference check, whose prescription is "Write `record.app`" —
+ * and following that earns ``unknown field `app` `` from the field-existence
+ * pass one line up. A first diagnostic that is actively false about where the
+ * root binds, and a wasted correction cycle.
+ *
+ * `SCOPE_ROOTS`' own docblock made this measurable rather than a matter of
+ * taste: its `current_user` entry claims to be "the last one this list was
+ * missing (#6290)". `app` is that sentence's second counterexample — the same
+ * mechanism (#6713's point: a hand-maintained list doing a per-surface job
+ * drifts), a second sighting, not an analogy to the first.
+ *
+ * ⛔ The repair deliberately does NOT add `app` to `SCOPE_ROOTS`. That list is
+ * the published strict-lint accept baseline in `@objectstack/formula`, so
+ * adding a root there stops EVERY surface that judges bare identifiers from
+ * faulting it — a widened public accept set, to fix one surface's diagnostic.
+ * The judged vocabulary is assembled HERE, where the per-surface question is
+ * asked, and `SCOPE_ROOTS` is left as the proper subset it already is.
+ */
+/**
+ * The roots a field-level `*When` predicate binds. Everything else in
+ * {@link FIELD_RULE_JUDGED_ROOTS} is rejected — see the allowlist section above.
+ */
+declare const FIELD_RULE_BOUND_ROOTS: readonly ["record", "previous", "parent"];
+/**
+ * The decision half of the rule documented above, as ONE exported function so
+ * every surface that judges a field-level `*When` stands on the same verdict
+ * AND the same message (Prime Directive #12). Two consumers today: the
+ * metadata walk in {@link validateStackExpressions} below, and the docs-corpus
+ * gate `scripts/check-doc-formula-expressions.mjs`, which judges the same three
+ * slots where a fenced example's enclosing structure identifies the field layer
+ * (#11407). Before that gate existed this lived as a closure inside the walk —
+ * fine while there was one caller, and exactly how a second caller comes to own
+ * a DIALECT of the rule instead of the rule.
+ *
+ * `null` = nothing to report: the source does not parse (the syntax pass owns
+ * that, and reporting it twice under a worse name is the #4889 mistake), or
+ * every root it reads is one the field level binds.
+ */
+declare function fieldRuleRootIssue(slot: string, source: string): {
+    root: string;
+    message: string;
+} | null;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$F): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$K): ExprIssue[];
 
 /**
  * The corrective sentence, lifted **verbatim** from `unevaluableRuleError` in
@@ -225,6 +616,16 @@ declare const STARTUP_OPEN_VOCABULARY_VERDICT = "startup-open-vocabulary-verdict
  * {@link STARTUP_OPEN_VOCABULARY_VERDICT} already fired.
  */
 declare const STARTUP_VERDICT_ASSERTIVE_WORDING = "startup-verdict-assertive-wording";
+/**
+ * The source could not be parsed, so this rule's verdict about it covers only
+ * what error recovery left standing (#10653).
+ *
+ * This rule's own subject matter, turned on the rule: a terminal conclusion
+ * drawn about a world that had not finished forming. "No findings" about a
+ * source the parser could not read is exactly that, and it is what this module
+ * used to return — silently, with a `catch` above it that never ran.
+ */
+declare const STARTUP_SOURCE_UNPARSEABLE = "startup-source-unparseable";
 /**
  * Accessors that read a capability vocabulary a plugin can still extend.
  *
@@ -298,8 +699,10 @@ interface StartupRegistryVerdictOptions {
  * Find startup open-vocabulary verdicts in one TypeScript/JavaScript source.
  *
  * Pure: parses, never executes, never type-checks, touches no filesystem. An
- * unparseable source yields no findings rather than throwing — this advises on
- * source someone else owns, and refusing to parse is not a verdict about them.
+ * unparseable source is REPORTED ({@link STARTUP_SOURCE_UNPARSEABLE}) rather
+ * than thrown on — this advises on source someone else owns, so refusing to
+ * parse is not a verdict about them, but going silent about it was a verdict
+ * too, and the wrong one (#10653).
  */
 declare function findStartupRegistryVerdicts(source: string, options?: StartupRegistryVerdictOptions): StartupRegistryVerdictFinding[];
 
@@ -315,7 +718,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$E = Record<string, unknown>;
+type AnyRec$J = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -325,7 +728,7 @@ type AnyRec$E = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$E): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$J): ListViewModeFinding[];
 
 type FunctionalCompletenessSeverity = 'error' | 'warning';
 interface FunctionalCompletenessFinding {
@@ -440,7 +843,7 @@ declare const FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-des
  *     call sites that each skip it.
  */
 declare const FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
-type AnyRec$D = Record<string, unknown>;
+type AnyRec$I = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  *
@@ -449,7 +852,7 @@ type AnyRec$D = Record<string, unknown>;
  * owns the `timeRelative` descriptor's contract, which is the point: the rule
  * ASKS that schema rather than restating it.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$D): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$I): FlowTriggerReadinessFinding[];
 
 type FlowTemplatePathSeverity = 'error' | 'warning';
 interface FlowTemplatePathFinding {
@@ -465,12 +868,12 @@ interface FlowTemplatePathFinding {
 declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
 declare const FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
-type AnyRec$C = Record<string, unknown>;
+type AnyRec$H = Record<string, unknown>;
 /**
  * Validate `{record.<path>}` template references across every record-change
  * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTemplatePaths(stack: AnyRec$C): FlowTemplatePathFinding[];
+declare function validateFlowTemplatePaths(stack: AnyRec$H): FlowTemplatePathFinding[];
 
 type ReadonlyFlowWriteSeverity = 'error' | 'warning';
 interface ReadonlyFlowWriteFinding {
@@ -485,12 +888,275 @@ interface ReadonlyFlowWriteFinding {
 }
 declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-type AnyRec$B = Record<string, unknown>;
+type AnyRec$G = Record<string, unknown>;
 /**
  * Validate flow `update_record` writes against target-object readonly
  * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateReadonlyFlowWrites(stack: AnyRec$B): ReadonlyFlowWriteFinding[];
+declare function validateReadonlyFlowWrites(stack: AnyRec$G): ReadonlyFlowWriteFinding[];
+
+/** What a caller needs to tell an author WHICH source went unread, and where. */
+interface SourceParseFailure {
+    /** The first parse diagnostic, in the compiler's own wording, flattened to one line. */
+    message: string;
+    /** 1-based line, in the AUTHORED source's coordinates (see `synthesizedLinesBefore`). */
+    line: number;
+    /** 1-based column. */
+    column: number;
+    /** How many parse diagnostics in total — `message` is the first of `count`. */
+    count: number;
+}
+/** A parse plus the verdict on whether it succeeded. `failure` absent ⇒ it parsed. */
+interface CheckedParse {
+    /**
+     * The tree, ALWAYS returned — including when `failure` is set. Error recovery
+     * produces a partial tree, and a caller that already reports findings from it
+     * keeps doing so: the fix here is the missing SIGNAL, not the removal of
+     * whatever the recovered tree could still be read for.
+     */
+    sourceFile: ts.SourceFile;
+    /** Set when the parser reported at least one syntax diagnostic. */
+    failure?: SourceParseFailure;
+}
+interface CheckedParseOptions {
+    target: ts.ScriptTarget;
+    setParentNodes: boolean;
+    scriptKind: ts.ScriptKind;
+    /**
+     * Lines the CALLER synthesised ahead of the authored source, subtracted from
+     * the reported position so it lands in the author's coordinates.
+     *
+     * `validate-hook-body-writes.ts` parses an L2 hook body wrapped in
+     * `async function __body(ctx) {\n…\n}` — the shape the runtime compiles it
+     * into — so its diagnostics are one line low. The reported line is clamped to
+     * at least 1, so a diagnostic that lands on a synthesised line is attributed
+     * to the nearest AUTHORED line and never to a line the author did not write.
+     */
+    synthesizedLinesBefore?: number;
+}
+/**
+ * The one wording every caller's message embeds, so three findings about the
+ * same defect do not describe it three ways.
+ */
+declare function describeParseFailure(failure: SourceParseFailure): string;
+/**
+ * The hint every caller's finding carries. It says what the finding IS — a
+ * statement about what the checker could read, not a second syntax verdict —
+ * because a source that does not parse is not scored, and an author who reads
+ * "no problems found" about it would be reading a green line that lied.
+ */
+declare const PARSE_FAILURE_HINT: string;
+
+type HookBodyWriteSeverity = 'warning';
+interface HookBodyWriteFinding {
+    /** v1 is advisory-only by contract — the type says so. */
+    severity: HookBodyWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `hook "normalize_lead" › body`. */
+    where: string;
+    /** Config path, e.g. `hooks[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+/**
+ * [#10653] The body did not parse, so its write set is whatever error recovery
+ * left readable.
+ *
+ * Reported rather than skipped for the reason this rule exists at all: a
+ * mistake must be visible where it is MADE. An unparseable body reached the
+ * extractor, produced fewer matches, and came back as a hook with nothing to
+ * report — the same silence the undeclared write itself has at run time, this
+ * time wearing the checker's badge. `warning` because the whole rule is
+ * advisory and never gates (the severity type admits nothing else).
+ */
+declare const HOOK_BODY_SOURCE_UNPARSEABLE = "hook-body-source-unparseable";
+/**
+ * [#8663] The write-axis twin of `flow-template-field-unprovisioned` (#8340):
+ * the body writes a field {@link IMPLICIT_FIELDS} exempts, but on THIS target
+ * the platform registered that anchor without provisioning storage for it.
+ *
+ * A separate id at `warning` severity rather than a reclassification of
+ * {@link HOOK_BODY_WRITE_UNKNOWN_FIELD}, matching #8340's precedent exactly:
+ * the existence verdict is unchanged (the name IS addressable), and what is
+ * added is a second, independently suppressible finding on the path where the
+ * existence check stays silent.
+ */
+declare const HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
+/** One syntactic write shape the extractor recognizes. */
+interface HookBodyWritePattern {
+    /** Stable pattern id, carried on every extracted write. */
+    readonly id: string;
+    /** Author-facing syntax summary (for docs/diagnostics, not matching). */
+    readonly syntax: string;
+    /** Reconciliation fixture: extracting `source` must yield exactly `writes`. */
+    readonly example: {
+        readonly source: string;
+        readonly writes: ReadonlyArray<{
+            field: string;
+            object?: string;
+        }>;
+    };
+}
+declare const HOOK_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+/** A ledger pattern a given rule does NOT consume, and why. */
+interface BodyWritePatternExclusion {
+    /** The {@link HOOK_BODY_WRITE_PATTERNS} entry id being excluded. */
+    readonly id: string;
+    /** Why the shape does not mean the same thing on this rule's surface. */
+    readonly reason: string;
+}
+/**
+ * The ledger shapes THIS rule consumes.
+ *
+ * Declared rather than implied: before the ledger carried a shape the hook
+ * surface does not have, every write with no `object` was necessarily a
+ * `ctx.input` write, and the rule could branch on that alone. It no longer can
+ * — a `record-property-assign` write also carries no object, and would have
+ * been reported as "the hook writes 'stage' to its input", which is false.
+ * Each consumer declaring its own subset is what stops the next added shape
+ * from silently landing in a branch that was never written for it.
+ */
+declare const HOOK_BODY_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const HOOK_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$F = Record<string, unknown>;
+/** One statically-extracted field write found in an L2 body. */
+interface ExtractedHookBodyWrite {
+    /** Which {@link HOOK_BODY_WRITE_PATTERNS} entry matched. */
+    patternId: string;
+    /** Target object name; `undefined` = the hook's own target object(s). */
+    object?: string;
+    /** The `ctx.api` method for diagnostics (`insert`/`create`/`update`/`updateById`). */
+    method?: string;
+    field: string;
+}
+/** Everything one parse of an L2 body yields. */
+interface ExtractedHookBodyWriteSet {
+    /** Every literal write the {@link HOOK_BODY_WRITE_PATTERNS} ledger declares. */
+    writes: ExtractedHookBodyWrite[];
+    /**
+     * `ctx.record` is handed to something as a VALUE somewhere in the body — an
+     * argument, an assignment RHS, a spread, a return — rather than only having
+     * its properties read and written, or being truthiness/type tested.
+     *
+     * The action rule needs this to tell a dead snapshot write from a live one:
+     * `ctx.record.stage = 'won'; await ctx.api.object('d').update(ctx.record)`
+     * builds a payload and persists it, so the assignment is not a no-op. When
+     * this is true, no record write in the body can be judged, and none is
+     * reported. (One-level aliasing — `const r = ctx.record` — reads as an
+     * escape too, which is the safe direction: it suppresses findings.)
+     */
+    ctxRecordEscapes: boolean;
+    /**
+     * [#10653] Set when the body did not parse, so `writes` is whatever error
+     * recovery left readable rather than the body's actual write set.
+     *
+     * Absent means one of two things, and they are not the same: the body parsed,
+     * or the cheap pre-filter above rejected it before any parse. The filter is a
+     * raw-text scan for `ctx` / `Object`, and a body containing neither cannot
+     * match any pattern however it parses — so a skipped parse claims nothing and
+     * hides nothing.
+     *
+     * ## Whose fault an unparseable body is — asked, not assumed
+     *
+     * The body is parsed inside a synthesised wrapper (`async function __body(ctx)
+     * { … }`) because that is the shape the runtime compiles it into
+     * (`new AsyncFunction('ctx', source)`). So a parse failure here could in
+     * principle be the WRAPPER's fault rather than the author's, and blaming the
+     * author for the checker's own bug is the failure this whole change is about.
+     * It cannot be: the wrapper is a constant, and `validate-hook-body-writes.
+     * test.ts` pins that it parses clean around an empty body and around every
+     * example in the pattern ledger. Any diagnostic therefore comes from the
+     * body — and its position is reported in the BODY's own coordinates (the
+     * wrapper's line is subtracted, and the result is clamped so it can never
+     * point at a line the author did not write).
+     */
+    parseFailure?: SourceParseFailure;
+}
+/**
+ * Extract every literal field write the pattern ledger declares from an L2
+ * body's source. Parse-only (the source is never executed), error-tolerant
+ * (a body with syntax errors simply yields fewer matches), and lazy: the
+ * TypeScript compiler is not loaded when no pattern can possibly match.
+ *
+ * Thin projection of {@link extractHookBodyWriteSet} — use that one when the
+ * `ctx.record` liveness signal matters, so the body is parsed once, not twice.
+ */
+declare function extractHookBodyWrites(source: string): ExtractedHookBodyWrite[];
+/** {@link extractHookBodyWrites} plus the `ctx.record` liveness signal, one parse. */
+declare function extractHookBodyWriteSet(source: string): ExtractedHookBodyWriteSet;
+/**
+ * Validate L2 hook-body writes against target-object field declarations.
+ * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
+ */
+declare function validateHookBodyWrites(stack: AnyRec$F): HookBodyWriteFinding[];
+
+type ReadonlyHookWriteSeverity = 'error' | 'warning';
+interface ReadonlyHookWriteFinding {
+    severity: ReadonlyHookWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `hook "touch_account" > body`. */
+    where: string;
+    /** Config path, e.g. `hooks[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const HOOK_API_UPDATE_READONLY_FIELD = "hook-api-update-readonly-field";
+declare const HOOK_API_UPDATE_READONLY_WHEN_FIELD = "hook-api-update-readonly-when-field";
+/**
+ * The `HOOK_BODY_WRITE_PATTERNS` shapes THIS rule consumes.
+ *
+ * Declared as data rather than implied by a branch, for the reason the sibling
+ * rules declare theirs: a write with no `object` is not a single thing (both
+ * `ctx.input` and `ctx.record` shapes carry none), so a future ledger addition
+ * must not be able to land silently in a branch never written for it.
+ */
+declare const READONLY_HOOK_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const READONLY_HOOK_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$E = Record<string, unknown>;
+/**
+ * Validate L2 hook-body `ctx.api` writes against target-object readonly
+ * declarations. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or
+ * post-parse stacks.
+ */
+declare function validateReadonlyHookWrites(stack: AnyRec$E): ReadonlyHookWriteFinding[];
+
+type ReadonlyActionWriteSeverity = 'warning';
+interface ReadonlyActionWriteFinding {
+    /** Advisory by contract - the conditional strip is per record state. */
+    severity: ReadonlyActionWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `action "freeze_invoice" > body`. */
+    where: string;
+    /** Config path, e.g. `actions[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/** Rule id (registry entry). */
+declare const ACTION_API_UPDATE_READONLY_WHEN_FIELD = "action-api-update-readonly-when-field";
+/**
+ * The `HOOK_BODY_WRITE_PATTERNS` shapes THIS rule consumes.
+ *
+ * Declared as data rather than implied by a branch, for the reason the sibling
+ * rules declare theirs: a write with no `object` is not a single thing (both
+ * `ctx.input` and `ctx.record` shapes carry none), so a future ledger addition
+ * must not be able to land silently in a branch never written for it.
+ */
+declare const READONLY_ACTION_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const READONLY_ACTION_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$D = Record<string, unknown>;
+/**
+ * Validate L2 action-body `ctx.api` writes against target-object `readonlyWhen`
+ * declarations. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or
+ * post-parse stacks.
+ */
+declare function validateReadonlyActionWrites(stack: AnyRec$D): ReadonlyActionWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -527,14 +1193,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$A = Record<string, unknown>;
+type AnyRec$C = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$A): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$C): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -547,8 +1213,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$z = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$z, opts?: {
+type AnyRec$B = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$B, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -561,8 +1227,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$y = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$y): ReactPageFinding[];
+type AnyRec$A = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$A): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -573,14 +1239,39 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$x = Record<string, unknown>;
+type AnyRec$z = Record<string, unknown>;
+/**
+ * The source could not be parsed, so the prop checks below read a partially
+ * recovered tree (#10653).
+ *
+ * Severity is `warning`, not `error`, and the reason is measured rather than
+ * cautious. The syntax VERDICT on a react page belongs to `validate-react-
+ * pages.ts`, which transpiles the same source through **Sucrase** — the parser
+ * family that actually compiles a react page — and errors when it refuses. This
+ * rule speaks for a different parser, and the two acceptance sets are not the
+ * same set: measured on 2026-08-21 (TypeScript 6.0.3 / sucrase 3.35.x), a react
+ * source containing `0755`, `'\012'`, `0b2` or `1__0` parses CLEAN through
+ * Sucrase while TypeScript reports a parse diagnostic, and `with (o) {}` goes
+ * the other way. Erroring here would newly fail builds the platform's own
+ * transpiler accepts; going silent is the defect this rule closes. A warning
+ * says the true thing: these checks did not get to run.
+ */
+declare const REACT_PAGE_SOURCE_UNPARSEABLE = "react-page-source-unparseable";
+/**
+ * [#11284] A prop written in a deprecated react-tier spelling (maintainer
+ * ruling 2026-08-23: the react tier converges on the metadata-tier
+ * vocabulary, deprecate-first). Warning, never error: the old spelling keeps
+ * working for the whole deprecation window — this is the loud half of
+ * "alias + loud deprecation", same shape as `approval-approver-type-deprecated`.
+ */
+declare const REACT_PROP_DEPRECATED = "react-prop-deprecated";
 declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 declare const REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 declare const REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 declare const REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
-declare function validateReactPageProps(stack: AnyRec$x): ReactPropFinding[];
+declare function validateReactPageProps(stack: AnyRec$z): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -592,8 +1283,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$w = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$w): SourceStyleFinding[];
+type AnyRec$y = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$y): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -637,14 +1328,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$v = Record<string, unknown>;
+type AnyRec$x = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$v): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$x): RecordTitleFinding[];
 
 declare const FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 declare const FIELD_GROUP_EMPTY = "field-group-empty";
@@ -666,16 +1357,23 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$u = Record<string, unknown>;
+type AnyRec$w = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$u): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$w): SemanticRoleFinding[];
 
 declare const FORM_FIELD_UNKNOWN = "form-field-unknown";
 declare const FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
+/**
+ * [#13855] A section's `group` names a field group the bound object does not
+ * declare. The reference form inherits the section's whole membership from that
+ * group, so a dangling key leaves the section with no members and it does not
+ * render at all. Advisory like both rules above — see `object-field-groups.ts`.
+ */
+declare const FORM_SECTION_GROUP_UNKNOWN = "form-section-group-unknown";
 type FormLayoutSeverity = 'error' | 'warning';
 interface FormLayoutFinding {
     /** Always `warning` today — both rules are advisory (see module note). */
@@ -691,12 +1389,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$t = Record<string, unknown>;
+type AnyRec$v = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$t): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$v): FormLayoutFinding[];
 
 declare const VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 declare const VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
@@ -709,6 +1407,15 @@ declare const VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
  * consequence is identical, the FIX is not, and `--json` consumers key on the id.
  */
 declare const VISIBILITY_PREDICATE_OVER_BUDGET = "visibility-predicate-over-budget";
+/**
+ * A predicate calling a function the CEL environment does not register —
+ * #13594, the scoped supersession of this file's parse-only ruling (see the
+ * module note's §Function existence). A separate id from
+ * {@link VISIBILITY_PREDICATE_SYNTAX} for the same reason `over-budget` is one:
+ * the source parses perfectly, so the dialect prescription cannot succeed on it
+ * and `--json` consumers key on the id.
+ */
+declare const VISIBILITY_PREDICATE_UNKNOWN_FUNCTION = "visibility-predicate-unknown-function";
 type VisibilitySeverity = 'error' | 'warning';
 /**
  * Which binding environment the linted surface belongs to (ADR-0089 §Context):
@@ -736,9 +1443,9 @@ interface VisibilityOptions {
 interface VisibilityFinding {
     /**
      * `warning` for the ADR-0089 D3b advisory (`visibility-root-mislayered`);
-     * `error` for the three rules that gate — `visibility-predicate-syntax`,
-     * `visibility-predicate-over-budget` and `visibility-bare-identifier` (see
-     * module note).
+     * `error` for the four rules that gate — `visibility-predicate-syntax`,
+     * `visibility-predicate-over-budget`, `visibility-predicate-unknown-function`
+     * and `visibility-bare-identifier` (see module note).
      */
     severity: VisibilitySeverity;
     /** Diagnostic rule id, e.g. `visibility-root-mislayered`. */
@@ -752,7 +1459,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$s = Record<string, unknown>;
+type AnyRec$u = Record<string, unknown>;
 /**
  * Validate conditional-visibility predicates across authored views and pages.
  *
@@ -765,8 +1472,10 @@ type AnyRec$s = Record<string, unknown>;
  *
  * Returns findings (empty = clean). `visibility-root-mislayered` is advisory
  * (`warning`); `visibility-predicate-syntax` (#6253),
- * `visibility-predicate-over-budget` (#7217) and `visibility-bare-identifier`
- * (#6128) are `error` and the caller is expected to fail the build on them.
+ * `visibility-predicate-over-budget` (#7217),
+ * `visibility-predicate-unknown-function` (#13594) and
+ * `visibility-bare-identifier` (#6128) are `error` and the caller is expected to
+ * fail the build on them.
  *
  * The binding-root check is layer-directional (ADR-0089 D3). A form view that
  * declares `data: { provider: 'schema', schemaId }` is judged at `metadata` on
@@ -775,9 +1484,11 @@ type AnyRec$s = Record<string, unknown>;
  * predicate is flagged), or leave it at the `'runtime'` default for `*.view.ts` /
  * `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The syntax and
  * bare-identifier checks are layer-agnostic — but the ROOT their hints prescribe
- * is not, which is the second half of what #7815 fixes.
+ * is not, which is the second half of what #7815 fixes. The unknown-function
+ * check (#13594) is layer-agnostic in both halves: it prescribes a NAME, and the
+ * environment registers the same names on every layer.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$s, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$u, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
 declare const PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
@@ -820,7 +1531,7 @@ interface PredicatePathOptions {
      */
     resolveSchema?: (schemaId: string) => unknown;
 }
-type AnyRec$r = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 /**
  * Refuse a metadata-form predicate that names a path the target schema does not
  * declare (#7010).
@@ -849,7 +1560,7 @@ type AnyRec$r = Record<string, unknown>;
  *
  * Returns findings (empty = clean).
  */
-declare function validatePredicatePathRefs(stack: AnyRec$r, opts?: PredicatePathOptions): PredicatePathFinding[];
+declare function validatePredicatePathRefs(stack: AnyRec$t, opts?: PredicatePathOptions): PredicatePathFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -867,12 +1578,12 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$q = Record<string, unknown>;
+type AnyRec$s = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$q): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$s): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
@@ -898,12 +1609,12 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$p = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$p): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$r): ApprovalApproverFinding[];
 
 type SeedReplaySafetySeverity = 'error' | 'warning';
 interface SeedReplaySafetyFinding {
@@ -917,7 +1628,7 @@ interface SeedReplaySafetyFinding {
     hint: string;
 }
 declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
-type AnyRec$o = Record<string, unknown>;
+type AnyRec$q = Record<string, unknown>;
 /**
  * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
  * mode, which duplicates its rows on every replay boot (framework#3434). Returns
@@ -927,7 +1638,7 @@ type AnyRec$o = Record<string, unknown>;
  * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
  * with no `data` array yields no findings.
  */
-declare function validateSeedReplaySafety(stack: AnyRec$o): SeedReplaySafetyFinding[];
+declare function validateSeedReplaySafety(stack: AnyRec$q): SeedReplaySafetyFinding[];
 
 type SeedStateMachineSeverity = 'warning';
 interface SeedStateMachineFinding {
@@ -941,7 +1652,7 @@ interface SeedStateMachineFinding {
     hint: string;
 }
 declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
-type AnyRec$n = Record<string, unknown>;
+type AnyRec$p = Record<string, unknown>;
 /**
  * Flag every seed record whose `state_machine`-governed field carries a value
  * the machine does not declare (framework#3433 follow-up). Returns the findings
@@ -954,7 +1665,7 @@ type AnyRec$n = Record<string, unknown>;
  * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
  * statically compared to the declared-state set.
  */
-declare function validateSeedStateMachine(stack: AnyRec$n): SeedStateMachineFinding[];
+declare function validateSeedStateMachine(stack: AnyRec$p): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -969,6 +1680,7 @@ declare const SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
 declare const SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 declare const SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
 declare const SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
+declare const SECURITY_CBP_AMBIGUOUS_RELATION = "security-controlled-by-parent-ambiguous-relation";
 type SecuritySeverity = 'error' | 'warning' | 'info';
 interface SecurityFinding {
     severity: SecuritySeverity;
@@ -983,7 +1695,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$m = Record<string, unknown>;
+type AnyRec$o = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -991,7 +1703,7 @@ type AnyRec$m = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$m, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$o, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 /**
@@ -1022,7 +1734,7 @@ declare function validateSecurityPosture(stack: AnyRec$m, opts?: {
  * carries `positions`/`apps` and both types are gated — at which point it
  * crosses whole, in one edit, as its own entry.
  */
-declare function validateSecurityRoleWord(stack: AnyRec$m): SecurityFinding[];
+declare function validateSecurityRoleWord(stack: AnyRec$o): SecurityFinding[];
 
 /**
  * [ADR-0105 D6] The two organization-axis red lines, enforced at authoring time.
@@ -1288,13 +2000,13 @@ interface DashboardActionRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$l = Record<string, unknown>;
+type AnyRec$n = Record<string, unknown>;
 /**
  * Validate every dashboard header action reference in a stack. Returns
  * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
  * unresolved routes are warnings.
  */
-declare function validateDashboardActionRefs(stack: AnyRec$l): DashboardActionRefFinding[];
+declare function validateDashboardActionRefs(stack: AnyRec$n): DashboardActionRefFinding[];
 
 /**
  * Build-time filter-placeholder diagnostics (issue #3574).
@@ -1503,12 +2215,12 @@ interface ObjectRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$k = Record<string, unknown>;
+type AnyRec$m = Record<string, unknown>;
 /**
  * Validate every object-name reference on the surfaces listed in the module
  * header. Returns findings (empty = clean).
  */
-declare function validateObjectReferences(stack: AnyRec$k): ObjectRefFinding[];
+declare function validateObjectReferences(stack: AnyRec$m): ObjectRefFinding[];
 
 type ReferenceIntegritySeverity = 'error' | 'warning';
 /**
@@ -1532,21 +2244,75 @@ interface ReferenceIntegrityFinding {
 /** One member of the suite. `name` is the exported function's name — the id a wiring test can assert on. */
 interface ReferenceIntegrityRule {
     name: string;
+    /**
+     * [#9313] The runtime-publish per-write snapshot types this member judges.
+     *
+     * The suite is ONE entry in `AUTHORING_RULES`, and that entry's
+     * `runtimeTypes` says which WRITES dispatch the suite at the runtime publish
+     * gate. This field is the finer axis the entry cannot express: which MEMBERS
+     * are safe to judge that per-write snapshot. The two axes differ because the
+     * snapshot is partial by design (`RuntimeStackContext` carries objects /
+     * permissions / books / datasets and nothing else): a member that resolves
+     * against a collection the snapshot does not carry would not go quiet — it
+     * would report every reference into that collection as dead. Measured on the
+     * `view` widening: `validateActionNameRefs` resolves the action names in
+     * `views[].list` / `views[].listViews.*` against `stack.actions`, which no
+     * per-write snapshot carries, so crossing it with the suite would refuse a
+     * legitimate CONTAINER view write for every stack-level action it names —
+     * a false 422 on the only door a Studio tenant has (on a FLATTENED overlay
+     * it has no rung, so the same crossing would be a silent no-op instead;
+     * measured both ways, `runtime-gate.view-writes.test.ts`).
+     *
+     * ABSENT = `['flow']`, the surface the whole suite has run on since #4463 P1.
+     * The default is deliberately the frozen historical surface, never "all":
+     * widening a member onto another type is an explicit declaration here plus
+     * its own false-positive measurement (#4716's budget), exactly the
+     * discipline `runtimeTypes` gives registry entries. CLI commands ignore this
+     * field entirely — all members always run there (see
+     * {@link validateReferenceIntegrity}).
+     */
+    runtimeTypes?: readonly string[];
     run: (stack: Record<string, unknown>) => ReferenceIntegrityFinding[];
 }
 /**
  * Every reference-integrity rule, in the order their findings are reported.
  *
  * ADDING A RULE: append it here and it runs on `validate`, `lint` and
- * `compile` at once. Do not re-wire the commands.
+ * `compile` at once. Do not re-wire the commands. It joins the runtime
+ * publish gate on the DEFAULT member surface (`flow` snapshots only, #9313) —
+ * widening it to another write type is a `runtimeTypes` declaration on the
+ * member plus that type's own false-positive measurement, never automatic.
  */
 declare const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[];
+/**
+ * Options for {@link validateReferenceIntegrity}.
+ *
+ * Declared as the suite's own type rather than importing
+ * `AuthoringRuleContext` from `authoring-rules.ts` — the suite predates the
+ * registry and the registry imports the suite, so the dependency must keep
+ * pointing that way. The registry's context is assignable to this shape by
+ * construction (`runtimeWriteType` spells the same key on both).
+ */
+interface ReferenceIntegrityRunOptions {
+    /**
+     * [#9313] The singular metadata type of the per-write snapshot being judged,
+     * when the caller is the runtime publish gate. Set by `runtime-gate.ts` for
+     * every gated write; ABSENT on the three CLI commands and every whole-stack
+     * caller, which run all members unconditionally.
+     */
+    runtimeWriteType?: string;
+}
 /**
  * Run every reference-integrity rule over a stack. Returns the concatenated
  * findings (empty = clean). Pure: no I/O, safe on both the schema-parsed stack
  * and the raw/normalized config the `lint` path carries.
+ *
+ * [#9313] When `options.runtimeWriteType` is set — the runtime publish gate
+ * judging one write's snapshot — only the members declaring that type run
+ * (see {@link ReferenceIntegrityRule.runtimeTypes}). Whole-stack callers pass
+ * no options and keep the full suite, byte-identically.
  */
-declare function validateReferenceIntegrity(stack: Record<string, unknown>): ReferenceIntegrityFinding[];
+declare function validateReferenceIntegrity(stack: Record<string, unknown>, options?: ReferenceIntegrityRunOptions): ReferenceIntegrityFinding[];
 
 /**
  * [ADR-0072 — reference resolvability] App-navigation targets that are not
@@ -1612,6 +2378,90 @@ type NavTargetRefFinding = ReferenceIntegrityFinding;
 declare const NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
 declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
 
+/**
+ * [#13216 — reference resolvability] A `type: 'page'` list view's `pageName`
+ * must name a page the stack actually declares.
+ *
+ * ## What the schema already settles, and what it cannot
+ *
+ * `ListViewSchema`'s `checkListViewPageMount` refuses a `page` view with no
+ * `pageName`, refuses `pageName` on any other view type, and refuses a
+ * `pageName` outside `SnakeCaseIdentifierSchema`'s grammar — so by the time a
+ * body reaches here the key is present, well-formed, and on the one view type
+ * that reads it. What a per-body parse cannot ask is whether the page EXISTS,
+ * because the answer lives in a sibling collection the body never sees. That is
+ * this rule's whole question, and it is the same question
+ * `validate-nav-target-refs` asks about the identical reference one surface
+ * over — `{ type: 'page', pageName }` on an app navigation item.
+ *
+ * ## Severity: warning, for its twin's reason
+ *
+ * `validate-nav-target-refs` explains why the honest ceiling for a page
+ * reference is advisory: unlike objects, pages have no curated
+ * cross-package registry, so "unresolved here" cannot be told apart from
+ * "provided by a package this stack cannot see". Nothing about mounting the
+ * same page on a view changes that, so the verdict matches its twin rather
+ * than inventing a second severity for one reference kind. `defineStack`'s
+ * `validateCrossReferences` still hard-fails first whenever the stack DOES
+ * declare pages — this rule is what speaks when that check has switched itself
+ * off (`pageNames.size > 0`), which is exactly the state a stack is in when
+ * the target was never written.
+ *
+ * ## Why it runs at the runtime publish gate too (`runtimeTypes: view`)
+ *
+ * The mount this rule guards is reachable in exactly the way #13100 measured:
+ * an agent publishes a page through the metadata API, then writes a view that
+ * mounts it. Both writes go through `PUT /api/v1/meta/view` — no CLI is
+ * involved anywhere on that path, so a build-time-only rule would never speak
+ * to the author who needs it. Crossing the member onto `view` snapshots is
+ * therefore the point, not a bonus.
+ *
+ * It is safe to cross ONLY because the per-write snapshot now carries `pages`
+ * (`RuntimeStackContext.pages`, added with this rule). Without that collection
+ * the member would not go quiet — it would report EVERY page mount as dead,
+ * which is the missing-collection false-positive channel
+ * `ReferenceIntegrityRule.runtimeTypes` exists to keep closed, and the reason
+ * `validateNavTargetRefs` is NOT crossed: nothing carries a snapshot's `apps`.
+ *
+ * ## The rungs, and why the list matches the sort rule's
+ *
+ * A `pageName` can be authored on every shape that carries a list view, and the
+ * #9313 lesson is that declaring `runtimeTypes` is necessary and NOT sufficient
+ * — the WALK has to reach the flattened top-level shape the write door actually
+ * carries, or the crossing is a silent no-op that reads as coverage. So the
+ * rungs are `validate-sortable-fields`' rungs, one key over:
+ *
+ *   - `objects[].listViews.<key>` — built-in named list views;
+ *   - `views[]` itself on a FLATTENED LIST OVERLAY (`viewKind: 'list'`, no
+ *     nested `config`) — the shape the runtime gate snapshots as `views: [item]`;
+ *   - `views[].config` on a standalone ViewItem RECORD (`viewKind: 'list'` with
+ *     a record-shaped `config`) — the shape a Studio-saved view round-trips as;
+ *   - `views[].list` — a `defineView` aggregate's default list;
+ *   - `views[].listViews.<key>` — its named list views.
+ *
+ * ## Not covered, deliberately
+ *
+ * An interpolated target (`${…}`) resolves at render time and is skipped — the
+ * conservative exemption `validate-nav-target-refs` and
+ * `validate-object-references` both use (ADR-0072 D1). It cannot currently
+ * arise (the schema's snake_case grammar refuses `$` and `{`), and is kept so
+ * this rule does not become the thing that has to change if the grammar ever
+ * widens.
+ *
+ * The view's `type` is NOT re-checked here. A body reaching a CLI command has
+ * been parsed; a body reaching `os lint` may not have been, and in that state
+ * reading `pageName` wherever it is written is the more useful answer — a
+ * `pageName` on a `grid` view is a schema refusal, not this rule's business,
+ * and reporting the dead reference underneath it as well helps rather than
+ * misleads.
+ */
+
+type ViewPageRefSeverity = 'error' | 'warning';
+type ViewPageRefFinding = ReferenceIntegrityFinding;
+/** Emitted when a `type: 'page'` view mounts a page the stack cannot resolve. */
+declare const VIEW_PAGE_UNRESOLVED = "view-page-unresolved";
+declare function validateViewPageRefs(stack: unknown): ViewPageRefFinding[];
+
 type NavObjectServabilityFinding = ReferenceIntegrityFinding;
 /** Emitted when a nav entry targets an object whose `enable` block cannot serve a list. */
 declare const NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
@@ -1767,7 +2617,7 @@ interface SearchableFieldFinding {
  *   runtime would refuse are flagged (#4830).
  */
 type SearchableFieldRole = 'canonical' | 'narrowing';
-type AnyRec$j = Record<string, unknown>;
+type AnyRec$l = Record<string, unknown>;
 /**
  * The slice of an object the search checks resolve against: the authored
  * field map (existence + the `type`/`hidden` meta search resolution reads),
@@ -1787,21 +2637,31 @@ interface ObjectSearchTarget {
 }
 /**
  * Validate every `searchableFields` declaration in the stack — the object's own
- * (the canonical set, ADR-0061) and the list views that narrow it. Returns
- * findings (empty = clean).
+ * (the canonical set, ADR-0061) and the list views that narrow it, including
+ * the two standalone `views[]` shapes the `PUT /api/v1/meta/view` door
+ * carries and the runtime publish gate snapshots: the flattened list overlay
+ * (#9313, top-level set) and the ViewItem record (#10001,
+ * `config.searchableFields` one level down). Returns findings (empty = clean).
  *
  * The react page surface (`<ListView searchableFields={…}>`) is deliberately
  * NOT walked here: its declaration lives inside JSX source, and
  * `validate-react-page-props` — the gate that already parses that source —
  * runs the same `checkSearchableFieldList` core on it (#4329).
  */
-declare function validateSearchableFields(stack: AnyRec$j): SearchableFieldFinding[];
+declare function validateSearchableFields(stack: AnyRec$l): SearchableFieldFinding[];
 
 declare const SORT_FIELD_UNKNOWN = "sort-field-unknown";
 declare const SORT_FIELD_UNSORTABLE = "sort-field-unsortable";
+/** [#10474] The provenance verdict — a WARNING, unlike the two above. */
+declare const SORT_FIELD_UNPROVISIONED = "sort-field-unprovisioned";
 type SortableFieldSeverity = 'error' | 'warning';
 interface SortableFieldFinding {
-    /** Always `error` — both verdicts are a `400 INVALID_SORT` at request time. */
+    /**
+     * `error` for the two verdicts the runtime REFUSES (`400 INVALID_SORT` at
+     * request time); `warning` for the #10474 provenance verdict, which no
+     * runtime door refuses and which this pass cannot prove against a remote
+     * schema it cannot see.
+     */
     severity: SortableFieldSeverity;
     /** Diagnostic rule id. */
     rule: string;
@@ -1814,7 +2674,7 @@ interface SortableFieldFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$i = Record<string, unknown>;
+type AnyRec$k = Record<string, unknown>;
 /**
  * Check ONE authored `sort` declaration against the object it is bound to —
  * the shared core behind every list-view surface that declares an ordering.
@@ -1826,7 +2686,7 @@ type AnyRec$i = Record<string, unknown>;
  * created to end. `subject` names the declaration for the message; the parsed
  * key's position is appended to `path` so the author can go straight to it.
  */
-declare function checkSortDeclaration(declared: unknown, objectName: string | undefined, fieldsByObject: ReadonlyMap<string, ObjectSearchTarget | null>, where: string, path: string, subject: string): SortableFieldFinding[];
+declare function checkSortDeclaration(declared: unknown, objectName: string | undefined, fieldsByObject: ReadonlyMap<string, ObjectSearchTarget | null>, where: string, path: string, subject: string, unprovisionedAnchors?: ReadonlyMap<string, ReadonlySet<string>>): SortableFieldFinding[];
 /**
  * Validate every list-view `sort` declaration in the stack — the object's
  * built-in named list views and the `defineView` aggregates that declare one.
@@ -1837,32 +2697,64 @@ declare function checkSortDeclaration(declared: unknown, objectName: string | un
  * over the bound object's own columns. See the module note for the four
  * sort-carrying surfaces that were checked and deliberately left out.
  */
-declare function validateSortableFields(stack: AnyRec$i): SortableFieldFinding[];
+declare function validateSortableFields(stack: AnyRec$k): SortableFieldFinding[];
 
-declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
-type ActionNameRefSeverity = 'error' | 'warning';
-interface ActionNameRefFinding {
-    /** Always `error` — a name-bound action that resolves nowhere is a dead button. */
-    severity: ActionNameRefSeverity;
+/** A list-view field reference that resolves to no field on the bound object. */
+declare const LIST_VIEW_FIELD_UNKNOWN = "list-view-field-unknown";
+/**
+ * [#14282] A list-view field reference written as a DOTTED path at a position
+ * whose name reaches a query door — where the door refuses it by name. See the
+ * second-class section on this module for the scope and the measurements.
+ */
+declare const LIST_VIEW_FIELD_DOTTED = "list-view-field-dotted";
+type ListViewFieldRefSeverity = 'error' | 'warning';
+interface ListViewFieldRefFinding {
+    /** See the two-tier note on this module. */
+    severity: ListViewFieldRefSeverity;
     /** Diagnostic rule id. */
     rule: string;
-    /** Human-readable location, e.g. `view "crm_lead" · list "all" · bulkActions`. */
+    /** Human-readable location, e.g. `view "task" › list › kanban`. */
     where: string;
-    /** Config path, e.g. `views[0].list.bulkActions[1]`. */
+    /** Config path, e.g. `views[0].list.kanban.groupByField`. */
     path: string;
     /** What is wrong. */
     message: string;
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$h = Record<string, unknown>;
+type AnyRec$j = Record<string, unknown>;
 /**
- * Validate every name-bound action reference in a stack. Returns findings
- * (empty = clean).
+ * Validate every list view's field references against the object graph.
+ * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
+ * safe on both the schema-parsed stack and the raw config the `lint` path
+ * carries.
  */
-declare function validateActionNameRefs(stack: AnyRec$h): ActionNameRefFinding[];
+declare function validateListViewFieldRefs(stack: AnyRec$j): ListViewFieldRefFinding[];
 
-/**
+declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
+type ActionNameRefSeverity = 'error' | 'warning';
+interface ActionNameRefFinding {
+    /** Always `error` — a name-bound action that resolves nowhere is a dead button. */
+    severity: ActionNameRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `view "crm_lead" · list "all" · bulkActions`. */
+    where: string;
+    /** Config path, e.g. `views[0].list.bulkActions[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$i = Record<string, unknown>;
+/**
+ * Validate every name-bound action reference in a stack. Returns findings
+ * (empty = clean).
+ */
+declare function validateActionNameRefs(stack: AnyRec$i): ActionNameRefFinding[];
+
+/**
  * [ADR-0078 Phase 3 — Tier-A `action-locations`] An action nobody placed.
  *
  * `locations` is an action's placement declaration. An action that omits it —
@@ -1927,12 +2819,12 @@ interface ActionLocationsFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /**
  * Flag every action that declares no placement and that no view places by
  * name. Returns findings (empty = clean).
  */
-declare function validateActionLocations(stack: AnyRec$g): ActionLocationsFinding[];
+declare function validateActionLocations(stack: AnyRec$h): ActionLocationsFinding[];
 
 /**
  * Shared page-component traversal for the lint rules that inspect
@@ -1958,11 +2850,11 @@ declare function validateActionLocations(stack: AnyRec$g): ActionLocationsFindin
  *     author never wrote, so those pages are skipped here and covered by
  *     `validate-jsx-pages` / `validate-react-page-props` instead.
  */
-type AnyRec$f = Record<string, unknown>;
+type AnyRec$g = Record<string, unknown>;
 /** A visited component plus everything needed to locate and bind it. */
 interface WalkedComponent {
     /** The component record itself. */
-    component: AnyRec$f;
+    component: AnyRec$g;
     /** Config path, e.g. `pages[0].regions[1].components[2]`. */
     path: string;
     /**
@@ -1973,14 +2865,92 @@ interface WalkedComponent {
     objectName?: string;
 }
 /** Is this page authored as `source` (so its `regions` must not be linted)? */
-declare function isSourceAuthoredPage(page: AnyRec$f): boolean;
+declare function isSourceAuthoredPage(page: AnyRec$g): boolean;
 /**
  * Walk every component on a page, depth-first, yielding each with its config
  * path and resolved object binding. Source-authored pages yield nothing.
  *
  * `pagePath` is the caller's path prefix for the page (e.g. `pages[3]`).
+ *
+ * The descent is cycle-safe. Every composition slot below is `z.array(z.unknown())`
+ * authored data, so a component that contains itself — directly, or through a
+ * chain of containers — is LEGAL input, and an unguarded walk recurses until the
+ * stack dies. That crash is not scoped to one rule: this is the one shared
+ * traversal under every page-shaped lint rule and the CLI's i18n object-sections
+ * pass, so it takes all of them down in the same process.
+ *
+ * The guard is an ANCESTOR set, not a visited set, and the difference is
+ * load-bearing rather than stylistic — it is the same predicate
+ * `translatePage` (`packages/spec/src/system/i18n-resolver.ts`) settled on. A
+ * component object reused twice as a SIBLING is two legitimate placements at two
+ * distinct config paths, and every rule built on this walk must see both; a
+ * visited set would yield the first and silently drop the second, converting a
+ * crash into missing lint coverage. Only a node that is its own ancestor is a
+ * cycle.
+ *
+ * A cycle stops the descent SILENTLY — the repeated node is not yielded a second
+ * time and no finding is produced. The guard is a safety property of the walk,
+ * not a verdict about the document: deciding that a self-referential page is
+ * itself an authoring error would be new reject behaviour on authored input, and
+ * that is a contract call, not this walk's to make.
+ *
+ * Deliberately NO depth cap, which is a different instrument (`translatePage`
+ * carries both). A cap bounds a legal-but-absurd document; on a resolver it
+ * leaves copy untranslated, but on a LINT walk it would drop real components
+ * from the walk output and every rule would go quiet about them — a silent loss
+ * of coverage that looks exactly like a clean page. With the cycle guard the
+ * descent is bounded by the document's own finite nesting, so the cap would only
+ * ever fire on acyclic input, which is precisely the input it must not truncate.
+ */
+declare function walkPageComponents(page: AnyRec$g, pagePath: string): WalkedComponent[];
+
+/**
+ * object name → its DECLARED field-group keys.
+ *
+ * Declared, not derived: `deriveFieldGroupLayout` drops a group no visible field
+ * joins, and a reference to a declared-but-empty group is a different (and
+ * data-dependent) finding from a reference to a group that was never declared.
+ * This index answers only the second question — the one with a closed oracle.
+ *
+ * `fieldGroups` is an ARRAY on `ObjectSchema`, and `asArray` additionally
+ * resolves the name-keyed map shape that raw (non-`defineStack`) metadata can
+ * carry, the same tolerance every other index in this package extends.
+ */
+declare function indexObjectFieldGroups(stack: unknown): Map<string, Set<string>>;
+/** One `section.group` reference, with the path that located it. */
+interface SectionGroupRef {
+    /** The referenced field-group key, as authored. */
+    key: string;
+    /** Config path of the `group` key itself. */
+    path: string;
+}
+/**
+ * Pull `group` references out of a `sections`-shaped value.
+ *
+ * `sep` joins the index onto `basePath` the way the calling surface addresses
+ * itself — `.` for metadata config paths, and the react surface's ` › ` if it
+ * ever grows a section-bearing block.
+ */
+declare function sectionGroupRefs(sections: unknown, basePath: string, sep?: string): SectionGroupRef[];
+/** The finding shape both host rules already declare, structurally. */
+interface SectionGroupFinding {
+    severity: 'warning';
+    rule: string;
+    where: string;
+    path: string;
+    message: string;
+    hint: string;
+}
+/**
+ * Check one batch of group references against `objectName`'s declared groups.
+ *
+ * Bails out when the object is not defined in this stack — it may come from
+ * another installed package, and a group cannot be judged on a schema we cannot
+ * see. That is the same skip {@link checkFieldRefs} takes, and for the same
+ * reason: silence about an unknowable object beats a finding the author cannot
+ * act on.
  */
-declare function walkPageComponents(page: AnyRec$f, pagePath: string): WalkedComponent[];
+declare function checkSectionGroupRefs(refs: readonly SectionGroupRef[], objectName: string | undefined, objectFieldGroups: ReadonlyMap<string, Set<string>>, where: string, rule: string): SectionGroupFinding[];
 
 /**
  * [ADR-0078 — completeness] Field-reference integrity for page components
@@ -2047,6 +3017,14 @@ declare const PAGE_FIELD_UNKNOWN = "page-field-unknown";
  * #8116's severity reasoning, unchanged.
  */
 declare const PAGE_FIELD_UNPROVISIONED = "page-field-unprovisioned";
+/**
+ * [#13855] A section's `group` names a field group the bound object does not
+ * declare. The reference form inherits the section's whole membership from that
+ * group, so a dangling key leaves the section with no members and it does not
+ * render at all. Always `warning` — see `object-field-groups.ts` for why this
+ * sits with the family's advisory findings rather than gating.
+ */
+declare const PAGE_SECTION_GROUP_UNKNOWN = "page-section-group-unknown";
 type PageFieldSeverity = 'error' | 'warning';
 interface PageFieldFinding {
     /**
@@ -2068,7 +3046,59 @@ interface PageFieldFinding {
     hint: string;
 }
 
-declare function validatePageFieldBindings(stack: AnyRec$f): PageFieldFinding[];
+declare function validatePageFieldBindings(stack: AnyRec$g): PageFieldFinding[];
+
+declare const PAGE_VISUALIZATION_WITHOUT_BINDING = "page/visualization-without-binding";
+type PageVisualizationSeverity = 'error' | 'warning';
+interface PageVisualizationFinding {
+    /**
+     * `error` when the entry leads `allowedVisualizations` — it becomes the
+     * forced `viewType` and the runtime reaches its renderer's refusal screen.
+     * `warning` otherwise — the type is filtered out of the switcher silently.
+     */
+    severity: PageVisualizationSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `page "showcase_task_calendar" · interfaceConfig.appearance`. */
+    where: string;
+    /** Config path, e.g. `pages[0].interfaceConfig.appearance.allowedVisualizations[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * One row of the renderer's derivation, transcribed.
+ *
+ * `types` is the TYPE predicate (checked first, in the object's declaration
+ * order); `namePattern` is the NAME fallback's regex SOURCE, or `null` where
+ * the renderer has no name fallback for that visualization. `viewBlocks` are
+ * the keys on the referenced view that supply the binding directly — read
+ * ahead of any derivation, exactly as `view.<viz> ?? derived` does.
+ */
+interface VisualizationPredicate {
+    visualization: string;
+    /** The binding key the renderer would produce (what the message names). */
+    binding: string;
+    types: readonly string[];
+    namePattern: string | null;
+    viewBlocks: readonly string[];
+}
+/**
+ * The mirrored table — objectui `f0f774b0`,
+ * `packages/app-shell/src/views/InterfaceListPage.tsx`:
+ * `SELECT_TYPES`/`DATE_TYPES`/`IMAGE_TYPES`/`LOCATION_TYPES` at `:149-151`
+ * and `:203`, `defaultKanbanFromObject` `:153`, `defaultDateField` `:163`,
+ * `defaultCalendarFromObject` `:170`, `defaultGalleryFromObject` `:175`,
+ * `defaultGanttFromObject` `:185`, `defaultMapFromObject` `:253`.
+ *
+ * ⛔ Pinned verbatim by the fixture test. Editing a row here without editing
+ * that pin is the drift this table's whole purpose is to make loud.
+ */
+declare const OBJECTUI_DERIVATION_PREDICATES: readonly VisualizationPredicate[];
+type AnyRec$f = Record<string, unknown>;
+declare function validatePageVisualizationBindings(stack: AnyRec$f): PageVisualizationFinding[];
 
 /** A key authored in `properties` that the type's props schema does not declare. */
 declare const COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
@@ -2094,7 +3124,24 @@ interface ComponentPropsFinding {
     /** How to fix it. */
     hint: string;
 }
-declare function validateComponentProps(stack: AnyRec$f): ComponentPropsFinding[];
+declare function validateComponentProps(stack: AnyRec$g): ComponentPropsFinding[];
+
+/** A component `type` inside a spec-reserved namespace that the vocabulary does not declare. */
+declare const COMPONENT_TYPE_UNKNOWN = "component-type-unknown";
+interface ComponentTypeFinding {
+    severity: 'error';
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `page "app_launcher" · global:serch`. */
+    where: string;
+    /** Config path, e.g. `pages[0].regions[1].components[0].type`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+declare function validateComponentTypes(stack: AnyRec$g): ComponentTypeFinding[];
 
 /**
  * [ADR-0021 — semantic layer] Chart-binding integrity for the surfaces the
@@ -2151,7 +3198,265 @@ interface ChartBindingFinding {
     hint: string;
 }
 
-declare function validateChartBindings(stack: AnyRec$f): ChartBindingFinding[];
+declare function validateChartBindings(stack: AnyRec$g): ChartBindingFinding[];
+
+/** An `include[]` entry that does not name a joinable relationship path. */
+declare const DATASET_INCLUDE_UNKNOWN = "dataset-include-unknown";
+/** A `dimensions[].field` / `measures[].field` path that resolves to no column. */
+declare const DATASET_FIELD_UNKNOWN = "dataset-field-unknown";
+/** A field path whose relationship prefix was never declared in `include`. */
+declare const DATASET_FIELD_NOT_INCLUDED = "dataset-field-not-included";
+/** A filter KEY — on the dataset or a measure — that resolves to no column. */
+declare const DATASET_FILTER_FIELD_UNKNOWN = "dataset-filter-field-unknown";
+type DatasetRefSeverity = 'error' | 'warning';
+interface DatasetRefFinding {
+    /** Always `error` today — see the severity note on this module. */
+    severity: DatasetRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `dataset "sales" › dimension "region"`. */
+    where: string;
+    /** Config path, e.g. `datasets[0].dimensions[2].field`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$e = Record<string, unknown>;
+/**
+ * Validate every ADR-0021 dataset's references against the object graph.
+ * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
+ * safe on both the schema-parsed stack and the raw config the `lint` path
+ * carries.
+ */
+declare function validateDatasetReferences(stack: AnyRec$e): DatasetRefFinding[];
+
+/**
+ * Field types that address ANOTHER object, so a `.<hop>` through one is a join
+ * the query compiler derives rather than a column read.
+ *
+ * `user` and `tree` are members alongside the two obvious ones for the reason
+ * `validate-flow-template-paths.ts` lists them: both store a foreign key and
+ * both are traversed the same way. A dataset `include` naming one is joinable
+ * exactly as a `lookup` is.
+ */
+declare const RELATIONSHIP_FIELD_TYPES: ReadonlySet<string>;
+/** The slice of one field this module reads. */
+interface GraphField {
+    /** Declared `type`, when the author wrote one. */
+    type?: string;
+    /**
+     * The object a relationship field addresses.
+     *
+     * `reference` is the ONLY spelling `FieldSchema` declares — `referenceTo` /
+     * `relatedTo` / `target` / `targetObject` / `lookupObject` are REJECTED
+     * aliases the strict error map maps back to it (#5017), so a field spelling
+     * one of them does not parse at all. Re-admitting an alias here would be the
+     * tolerant consumer Prime Directive #12 refuses, so only `reference` is read.
+     */
+    reference?: string;
+    /**
+     * The declared `multiple: true` flag, when the author wrote one.
+     *
+     * Read here because the dotted-path verdict a caller may reach for
+     * ({@link classifyDottedFilterHead} in `@objectstack/spec/data`) is a
+     * function of BOTH `type` and `multiple`: an array-valued head is
+     * deliberately unjudged there, since a numeric-index dotted path genuinely
+     * reaches into it on two of three backends. A caller handed only `type`
+     * would have to re-derive the flag from the raw stack, which is the second
+     * copy this module exists to prevent. Additive (#14282): every existing
+     * consumer that ignores the key keeps its verdicts byte-for-byte.
+     */
+    multiple?: boolean;
+}
+/**
+ * One object's resolvable surface. `null` in the index marks an object that
+ * declares no readable field map, keeping "declared nothing" distinguishable
+ * from "not in this stack" — the same distinction
+ * {@link indexObjectSearchTargets} draws for the search axis.
+ */
+interface GraphObject {
+    /** Authored field names. */
+    names: ReadonlySet<string>;
+    /** name → the slice above. */
+    fields: ReadonlyMap<string, GraphField>;
+    /** Registry-injected columns addressable on THIS object (skip 3). */
+    injected: ReadonlySet<string>;
+}
+/** object name → its resolvable surface, or `null` (skip 2). */
+type ObjectGraph = ReadonlyMap<string, GraphObject | null>;
+/**
+ * Index a stack's objects once. Callers that resolve many paths build this a
+ * single time and hand it to every {@link resolveFieldPath} call.
+ */
+declare function indexObjectGraph(stack: unknown): ObjectGraph;
+/** What a path resolved to, or precisely how it failed. */
+type FieldPathVerdict = 
+/**
+ * Every hop and the leaf resolved. `object` is the object the LEAF lives on.
+ * `injected` marks a leaf resolved through skip 3 — a registry-injected
+ * column, real at runtime, whose TYPE and relationship target are
+ * registry-owned and invisible here. A caller asking a second question about
+ * the leaf (is it a relationship? is it materialised?) must treat an
+ * `injected` leaf as unanswerable rather than assume the absence of a
+ * declared type means the absence of the property.
+ */
+{
+    kind: 'ok';
+    object: string;
+    field: string;
+    meta?: GraphField;
+    injected?: true;
+}
+/**
+ * The graph cannot answer — one of the three skips. Never report this: it is
+ * the absence of a judgement, not a passing one.
+ */
+ | {
+    kind: 'unknowable';
+    reason: 'object-not-in-stack' | 'no-field-map' | 'injected-hop';
+    object: string;
+}
+/**
+ * A hop names nothing on the object it was written against. `at` is the
+ * 0-based segment index, `object` the object the hop was resolved against.
+ */
+ | {
+    kind: 'hop-unknown';
+    at: number;
+    segment: string;
+    object: string;
+    candidates: ReadonlySet<string>;
+}
+/**
+ * A hop resolves to a real field that is NOT a relationship, so there is
+ * nothing to traverse through — the author wrote `amount.total` where
+ * `amount` is a number.
+ */
+ | {
+    kind: 'hop-not-relationship';
+    at: number;
+    segment: string;
+    object: string;
+    type?: string;
+}
+/**
+ * A relationship hop resolves but declares no `reference`, so the target
+ * object is unknown and the rest of the path cannot be judged. Treated as a
+ * SKIP by callers for the same reason as `unknowable`.
+ */
+ | {
+    kind: 'hop-untargeted';
+    at: number;
+    segment: string;
+    object: string;
+}
+/** Every hop resolved; the LEAF names nothing on the object it landed on. */
+ | {
+    kind: 'field-unknown';
+    object: string;
+    field: string;
+    candidates: ReadonlySet<string>;
+};
+/**
+ * Resolve `path` against `objectName` in `graph`.
+ *
+ * A bare `field` is the one-segment case and resolves against the root object
+ * directly. A dotted `a.b.field` walks `a`, then `b`, as to-one relationship
+ * hops, and resolves the leaf on whatever object the last hop landed on.
+ *
+ * ⛔ This function answers EXISTENCE only. Whether a hop was DECLARED joinable
+ * — an ADR-0021 dataset joins only what `Dataset.include` names — is a second
+ * question the caller owns, because only the caller knows which declaration
+ * governs the position. Conflating them here would make the seam unusable at
+ * the positions that have no `include` (a list view's field path, #14107).
+ */
+declare function resolveFieldPath(graph: ObjectGraph, objectName: string | undefined, path: string): FieldPathVerdict | undefined;
+/**
+ * The relationship prefixes a document declared as joinable.
+ *
+ * ADR-0021: *"Declaring `a.b` implicitly includes the intermediate `a`."* So
+ * every PREFIX of every declared path is joinable, not only the paths as
+ * written — which is why this expands rather than reading `include` verbatim.
+ *
+ * Here rather than in a rule because the SAME `include` governs positions two
+ * different rules judge: a dataset's own `dimensions[].field` / `measures[].field`
+ * / filter keys (#14105), and a dashboard widget's `filter` keys (#14148), whose
+ * condition is ANDed into that same dataset's compiled query as `runtimeFilter`.
+ * Two copies of the prefix expansion would let the two positions drift apart on
+ * a clause that is one sentence of one ADR.
+ */
+declare function joinablePrefixes(include: unknown): ReadonlySet<string>;
+/** The two halves of a rendered verdict: the finding's message, and its detail. */
+interface FieldPathAccount {
+    /** What is wrong, in prose, carrying the "did you mean" when there is one. */
+    message: string;
+    /** The supporting field list, for the finding's hint. */
+    detail: string;
+}
+/**
+ * Turn a resolution verdict into the message half of an existence finding, or
+ * `undefined` when the verdict is one no rule may report.
+ *
+ * Shared by every position that resolves a field PATH — a dataset dimension, a
+ * measure, a dataset filter key (#14105), a widget filter key (#14148) — so
+ * they cannot drift into N different accounts of the same miss. The caller
+ * supplies `subject` (how the position is named in prose) and owns the rule id,
+ * the severity, the path and the hint's prescription; this function holds none
+ * of them, matching the rest of this module.
+ */
+declare function describeFieldPathVerdict(verdict: FieldPathVerdict, path: string, subject: string): FieldPathAccount | undefined;
+/**
+ * True when the verdict is one no rule may report — the graph could not answer.
+ * Callers spell the skip through this predicate rather than re-listing the
+ * kinds, so a future verdict added to the union defaults to being reported
+ * loudly (a missed skip is a visible false positive; a missed report is
+ * silence, which is the failure mode this whole family exists to end).
+ */
+declare function isUnjudgeable(verdict: FieldPathVerdict | undefined): boolean;
+/**
+ * Nearest declared name for a typo'd reference, or `undefined` when nothing is
+ * close enough. The sole shared helper behind every "Did you mean?" hint in
+ * this package (issue #14268 consolidated the four hand-copied instances that
+ * had drifted apart into this one).
+ *
+ * Containment is checked first, ahead of edit distance: the ADR-0021 cutover's
+ * canonical drift is base column → prefixed measure name (`amount` →
+ * `sum_amount`), which is far in edit distance but obvious to a human. A
+ * candidate that contains the target (or vice versa, when both are at least 3
+ * characters) scores on the length delta instead and always wins over an
+ * edit-distance match; otherwise the target must be within budget —
+ * `max(2, floor(len/3))` — of a candidate to be offered at all.
+ */
+declare function nearestName(target: string, known: Iterable<string>): string | undefined;
+/** ` Did you mean "x"?`, or the empty string — the platform's message shape. */
+declare function suggestName(target: string, known: Iterable<string>): string;
+/** A readable field list for a hint, or `(none)`. */
+declare function listNames(names: Iterable<string>): string;
+
+/** One field position inside an authored filter. */
+interface FilterFieldKey {
+    /**
+     * The field the condition filters BY, exactly as authored — a bare name
+     * (`status`), or a dotted relationship path (`account.region`, whether
+     * spelled that way or reached by descending a nested condition object).
+     */
+    field: string;
+    /** Config path of the position, e.g. `datasets[1].measures[1].filter.last_update_at`. */
+    path: string;
+}
+/**
+ * Emit every FIELD KEY inside one authored filter subtree, whatever shape it
+ * was authored in — the key half of what `validate-preset-comparands.ts` does
+ * for values, and the traversal `filter-token-unknown` already performs while
+ * reasoning only about the strings it finds.
+ *
+ * Holds no judgement: it does not know which object the filter is bound to and
+ * emits no findings. Resolution is {@link resolveFieldPath}'s job
+ * (`object-graph.ts`) and the verdict is the caller's.
+ */
+declare function walkFilterFieldKeys(node: unknown, path: string, visit: (key: FilterFieldKey) => void, depth?: number): void;
 
 type RuleCompilabilitySeverity = 'error';
 interface RuleCompilabilityFinding {
@@ -2176,11 +3481,11 @@ declare const VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema
  * still says the same thing.
  */
 declare const RUNTIME_AJV_OPTIONS: Options;
-type AnyRec$e = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /** One authored validation rule, located for a finding. */
 interface WalkedValidationRule {
     /** The rule record itself — a top-level entry, or a `conditional` branch. */
-    rule: AnyRec$e;
+    rule: AnyRec$d;
     /** The declaring object's `name`, or `(unnamed object)`. */
     objectName: string;
     /** The nesting-aware rule name as prose: `'outer' → 'inner'`. */
@@ -2264,12 +3569,12 @@ interface NavAccessFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$d = Record<string, unknown>;
+type AnyRec$c = Record<string, unknown>;
 /**
  * Validate that every object a stack's navigation exposes is readable by at
  * least one permission set the stack declares. Returns findings (empty = clean).
  */
-declare function validateNavAccess(stack: AnyRec$d): NavAccessFinding[];
+declare function validateNavAccess(stack: AnyRec$c): NavAccessFinding[];
 
 declare const TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 declare const TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
@@ -2288,12 +3593,12 @@ interface TranslationRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$c = Record<string, unknown>;
+type AnyRec$b = Record<string, unknown>;
 /**
  * Validate every reference a translation bundle makes against the metadata it
  * claims to translate. Returns findings (empty = clean).
  */
-declare function validateTranslationReferences(stack: AnyRec$c): TranslationRefFinding[];
+declare function validateTranslationReferences(stack: AnyRec$b): TranslationRefFinding[];
 
 declare const TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
 type TranslatableSectionSeverity = 'warning';
@@ -2311,12 +3616,12 @@ interface TranslatableSectionFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$b = Record<string, unknown>;
+type AnyRec$a = Record<string, unknown>;
 /**
  * Report every form/detail section that declares a heading but no `name`, on an
  * object the stack actually translates. Returns findings (empty = clean).
  */
-declare function validateTranslatableSections(stack: AnyRec$b): TranslatableSectionFinding[];
+declare function validateTranslatableSections(stack: AnyRec$a): TranslatableSectionFinding[];
 
 /**
  * [ADR-0064 §3] Skill ↔ agent surface affinity (issue #3820).
@@ -2361,12 +3666,12 @@ interface AiSurfaceAffinityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
+type AnyRec$9 = Record<string, unknown>;
 /**
  * Validate every in-stack agent→skill binding against the ADR-0064 §3 surface
  * affinity contract. Returns findings (empty = clean).
  */
-declare function validateAiSurfaceAffinity(stack: AnyRec$a): AiSurfaceAffinityFinding[];
+declare function validateAiSurfaceAffinity(stack: AnyRec$9): AiSurfaceAffinityFinding[];
 
 declare const AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
 type AiToolRefSeverity = 'error' | 'warning';
@@ -2384,12 +3689,12 @@ interface AiToolRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$9 = Record<string, unknown>;
+type AnyRec$8 = Record<string, unknown>;
 /**
  * Validate every `skill.tools[]` reference in a stack. Returns findings
  * (empty = clean).
  */
-declare function validateAiToolReferences(stack: AnyRec$9): AiToolRefFinding[];
+declare function validateAiToolReferences(stack: AnyRec$8): AiToolRefFinding[];
 
 /**
  * [ADR-0063 §2] `stack.agents` is a platform-internal slot (issue #3820).
@@ -2433,10 +3738,41 @@ declare function validateAiToolReferences(stack: AnyRec$9): AiToolRefFinding[];
  * at warning tier, reusing `PLATFORM_AGENT_NAMES` rather than narrowing the
  * schema to an enum (a breaking authoring change ADR-0063 already walked
  * back once).
+ *
+ * ## Why the value limb no longer reads the same roster (issue #14461)
+ *
+ * `PLATFORM_AGENT_NAMES` holds FOUR names, and reusing it for the value limb
+ * meant this gate accepted `defaultAgent: 'metadata_assistant'` — the exact
+ * spelling `skills/objectstack-ai` tells authors is "not vocabulary". The
+ * platform then taught it from its own only live example: `studio.app.ts`
+ * pinned the alias. So an AI author copying the one working example in the
+ * repo wrote the forbidden spelling and this rule waved it through — the
+ * silent-tolerance shape ADR-0078 exists to close, committed by the gate
+ * itself.
+ *
+ * The maintainer ruling on #14461 (2026-09-03) re-pins Studio to `build` and
+ * SPLITS the two limbs' rosters, keeping both of #6041's operative decisions
+ * intact (warning tier, no Zod enum):
+ *
+ *  - the DECLARATION limb still reads all four names. Its question is "does
+ *    this record shadow a platform record?", and declaring `metadata_assistant`
+ *    shadows `build` through the alias exactly as declaring `build` does. That
+ *    judgement is unchanged.
+ *  - the VALUE limb reads `CANONICAL_AGENT_NAMES` only, and a legacy alias
+ *    gets its own rule id and wording ({@link DEFAULT_AGENT_LEGACY_ALIAS}).
+ *    Its question is "is this the right thing to WRITE?", and the answer for
+ *    an alias is no even though it resolves.
+ *
+ * The alias limb stays `warning`, not `error`, and for a sharper reason than
+ * the roster limb: an aliased pin is not broken. It resolves, the app gets the
+ * agent it meant, and nothing a user can see is wrong — which is precisely why
+ * the signal has to be an authoring-time nudge rather than a build break.
  */
 declare const AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
 /** `app.defaultAgent` names something outside the platform agent roster. */
 declare const DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
+/** `app.defaultAgent` spells a platform agent by its RETIRED alias (#14461). */
+declare const DEFAULT_AGENT_LEGACY_ALIAS = "default-agent-legacy-alias";
 type AiAgentAuthoringSeverity = 'error' | 'warning';
 interface AiAgentAuthoringFinding {
     /** Always `warning` — the runtime is the gate; this is the authoring-time signal. */
@@ -2452,121 +3788,12 @@ interface AiAgentAuthoringFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$8 = Record<string, unknown>;
+type AnyRec$7 = Record<string, unknown>;
 /**
  * Flag every agent declared in a stack. Returns findings (empty = clean,
  * which is what every app package should be).
  */
-declare function validateAiAgentAuthoring(stack: AnyRec$8): AiAgentAuthoringFinding[];
-
-type HookBodyWriteSeverity = 'warning';
-interface HookBodyWriteFinding {
-    /** v1 is advisory-only by contract — the type says so. */
-    severity: HookBodyWriteSeverity;
-    rule: string;
-    /** Human-readable location, e.g. `hook "normalize_lead" › body`. */
-    where: string;
-    /** Config path, e.g. `hooks[0].body.source`. */
-    path: string;
-    message: string;
-    hint: string;
-}
-declare const HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
-/**
- * [#8663] The write-axis twin of `flow-template-field-unprovisioned` (#8340):
- * the body writes a field {@link IMPLICIT_FIELDS} exempts, but on THIS target
- * the platform registered that anchor without provisioning storage for it.
- *
- * A separate id at `warning` severity rather than a reclassification of
- * {@link HOOK_BODY_WRITE_UNKNOWN_FIELD}, matching #8340's precedent exactly:
- * the existence verdict is unchanged (the name IS addressable), and what is
- * added is a second, independently suppressible finding on the path where the
- * existence check stays silent.
- */
-declare const HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
-/** One syntactic write shape the extractor recognizes. */
-interface HookBodyWritePattern {
-    /** Stable pattern id, carried on every extracted write. */
-    readonly id: string;
-    /** Author-facing syntax summary (for docs/diagnostics, not matching). */
-    readonly syntax: string;
-    /** Reconciliation fixture: extracting `source` must yield exactly `writes`. */
-    readonly example: {
-        readonly source: string;
-        readonly writes: ReadonlyArray<{
-            field: string;
-            object?: string;
-        }>;
-    };
-}
-declare const HOOK_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
-/** A ledger pattern a given rule does NOT consume, and why. */
-interface BodyWritePatternExclusion {
-    /** The {@link HOOK_BODY_WRITE_PATTERNS} entry id being excluded. */
-    readonly id: string;
-    /** Why the shape does not mean the same thing on this rule's surface. */
-    readonly reason: string;
-}
-/**
- * The ledger shapes THIS rule consumes.
- *
- * Declared rather than implied: before the ledger carried a shape the hook
- * surface does not have, every write with no `object` was necessarily a
- * `ctx.input` write, and the rule could branch on that alone. It no longer can
- * — a `record-property-assign` write also carries no object, and would have
- * been reported as "the hook writes 'stage' to its input", which is false.
- * Each consumer declaring its own subset is what stops the next added shape
- * from silently landing in a branch that was never written for it.
- */
-declare const HOOK_BODY_WRITE_PATTERN_IDS: readonly string[];
-/** Ledger shapes this rule leaves alone, each with its reason. */
-declare const HOOK_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
-type AnyRec$7 = Record<string, unknown>;
-/** One statically-extracted field write found in an L2 body. */
-interface ExtractedHookBodyWrite {
-    /** Which {@link HOOK_BODY_WRITE_PATTERNS} entry matched. */
-    patternId: string;
-    /** Target object name; `undefined` = the hook's own target object(s). */
-    object?: string;
-    /** The `ctx.api` method for diagnostics (`insert`/`create`/`update`/`updateById`). */
-    method?: string;
-    field: string;
-}
-/** Everything one parse of an L2 body yields. */
-interface ExtractedHookBodyWriteSet {
-    /** Every literal write the {@link HOOK_BODY_WRITE_PATTERNS} ledger declares. */
-    writes: ExtractedHookBodyWrite[];
-    /**
-     * `ctx.record` is handed to something as a VALUE somewhere in the body — an
-     * argument, an assignment RHS, a spread, a return — rather than only having
-     * its properties read and written, or being truthiness/type tested.
-     *
-     * The action rule needs this to tell a dead snapshot write from a live one:
-     * `ctx.record.stage = 'won'; await ctx.api.object('d').update(ctx.record)`
-     * builds a payload and persists it, so the assignment is not a no-op. When
-     * this is true, no record write in the body can be judged, and none is
-     * reported. (One-level aliasing — `const r = ctx.record` — reads as an
-     * escape too, which is the safe direction: it suppresses findings.)
-     */
-    ctxRecordEscapes: boolean;
-}
-/**
- * Extract every literal field write the pattern ledger declares from an L2
- * body's source. Parse-only (the source is never executed), error-tolerant
- * (a body with syntax errors simply yields fewer matches), and lazy: the
- * TypeScript compiler is not loaded when no pattern can possibly match.
- *
- * Thin projection of {@link extractHookBodyWriteSet} — use that one when the
- * `ctx.record` liveness signal matters, so the body is parsed once, not twice.
- */
-declare function extractHookBodyWrites(source: string): ExtractedHookBodyWrite[];
-/** {@link extractHookBodyWrites} plus the `ctx.record` liveness signal, one parse. */
-declare function extractHookBodyWriteSet(source: string): ExtractedHookBodyWriteSet;
-/**
- * Validate L2 hook-body writes against target-object field declarations.
- * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
- */
-declare function validateHookBodyWrites(stack: AnyRec$7): HookBodyWriteFinding[];
+declare function validateAiAgentAuthoring(stack: AnyRec$7): AiAgentAuthoringFinding[];
 
 type ActionBodyWriteSeverity = 'warning';
 interface ActionBodyWriteFinding {
@@ -2582,6 +3809,17 @@ interface ActionBodyWriteFinding {
 }
 declare const ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
 declare const ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+/**
+ * [#10653] The action-surface twin of `hook-body-source-unparseable`. Same
+ * extractor, same synthesised wrapper, same parse — so the body that came back
+ * silently unread on the hook surface came back silently unread here too.
+ *
+ * Wiring only the hook rule would have left the blind half standing at the call
+ * site next door, which this rule's own division of labour forbids: an action
+ * body runs through the same `HookBodySchema` and the same sandbox, so it gets
+ * the same treatment.
+ */
+declare const ACTION_BODY_SOURCE_UNPARSEABLE = "action-body-source-unparseable";
 /**
  * [#8663] The action-surface twin of `hook-body-write-unprovisioned-anchor`.
  * Same question, same wording, same `warning` severity — this rule and the hook
@@ -2772,6 +4010,40 @@ declare const FLOW_INERT_NODE_CONDITION = "flow-inert-node-condition";
  * how it divides labour with the #3810 run-time guard.
  */
 declare const FLOW_MULTI_WRITE_UNFILTERED = "flow-multi-write-unfiltered";
+/**
+ * #13681 / #14394 — a `loop` body that runs a node which can fail, with no
+ * `try_catch` between the loop and that node. The first failing item kills the
+ * whole sweep: `loop-node.ts:123-135` iterates with a bare `await` and no
+ * `try`/`catch` anywhere in the file, so the body's failure propagates out of
+ * the container and the remaining items are never processed.
+ *
+ * A **warning**, per the severity policy at the top of this file: a loop whose
+ * body is deliberately allowed to die (fail fast on the first bad row) is a
+ * legitimate reading, and the rule cannot prove the author did not mean it. What
+ * it can do is make the choice visible at authoring time — today it is silent,
+ * and the measured consequence is a 5-row sweep that processes 3 rows and
+ * reports a run that "completed" nothing unusual.
+ *
+ * See {@link scanUncontainedLoopBodies} for the containment judgement, and
+ * {@link FALLIBLE_NODE_TYPES} for what counts as fallible and why.
+ */
+declare const FLOW_LOOP_BODY_UNCONTAINED = "flow-loop-body-uncontained";
+/**
+ * #13681 / #14394 — the near-miss shape: a `try_catch` that declares no `catch`
+ * region. `catch` is optional in the schema (`control-flow.zod.ts:315`) and
+ * omitting it makes the container **fail** (`try-catch-node.ts:190`), so the
+ * wrapped region dies exactly like an unwrapped one — measured side by side, the
+ * no-`catch` run and the no-wrapper control produce identical output.
+ *
+ * This is the family's first target for the containment pair, not an extra: an
+ * author who reaches for `try_catch` has recognised the hazard and stopped one
+ * key short, and before this rule got **zero containment and zero diagnostics**.
+ * A warning rather than an error under the same policy — a `retry`-only
+ * `try_catch` (retry the region, then fail loudly) is a legitimate reading.
+ *
+ * See {@link scanTryCatchWithoutCatch}.
+ */
+declare const FLOW_TRY_CATCH_WITHOUT_CATCH = "flow-try-catch-without-catch";
 /**
  * Lint every flow for known authoring anti-patterns — its own graph AND every
  * nested ADR-0031 region (#5383). Returns a (possibly empty) list of findings;
@@ -2788,13 +4060,44 @@ interface LivenessLintFinding {
 }
 declare const LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
 declare const LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
+declare const LIVENESS_PLANNED_PROPERTY = "liveness-planned-property";
+declare const LIVENESS_LIVE_ELSEWHERE_PROPERTY = "liveness-live-elsewhere-property";
 type AnyRec$2 = Record<string, unknown>;
+/**
+ * The property paths of `type`'s ledger that warn an author for authoring them
+ * — i.e. exactly the set {@link lintLivenessProperties} raises a finding on for
+ * that type, exposed as a decision procedure.
+ *
+ * WHY THIS IS EXPORTED RATHER THAN RE-DERIVED. A second tool wanted the same
+ * fact and the first attempt at it re-read the ledger itself, which is how the
+ * two halves of one `os lint` run came to point in opposite directions: the
+ * CLI's i18n coverage walker demanded `flows.*` translation keys for a group
+ * whose ledger row is `planned` + `authorWarn`, so omitting the keys drew
+ * `i18n/missing-flow` and authoring them drew `liveness-planned-property` — in
+ * the SAME run, with no third option for the author. A demand side and a warn
+ * side that disagree can only be kept honest by reading ONE verdict, so this
+ * returns the very map `checkItem` iterates rather than a parallel reading of
+ * the same JSON.
+ *
+ * Keys are the ledger's own property paths, `children` flattened one level as
+ * `parent.child` — the shape `checkItem` resolves. Unreadable or absent ledger
+ * ⇒ the empty set, which is also the state in which `lintLivenessProperties`
+ * warns on nothing: the two sides go quiet together rather than one of them
+ * going quiet alone.
+ *
+ * Deliberately NOT memoized, for the same reason `lintLivenessProperties`
+ * re-reads on every call: a cached verdict outlives the ledger edit that
+ * changes it, and a stale "nothing warns here" is the silent state this whole
+ * family exists to prevent.
+ */
+declare function authorWarnedProperties(type: string): ReadonlySet<string>;
 /**
  * Lint the compiled stack for authored properties the liveness ledger flags as
  * misleading. Advisory only — returns findings, never throws. Covers every
  * governed metadata type: objects (incl. `enable.*`) and their fields walk
- * bespoke nesting; the remaining types are flat stack collections. Container
- * properties fan out over arrays (each flow node, each dataset measure). The
+ * bespoke nesting, and translation bundles walk their locale entries (#11288);
+ * the remaining types are flat stack collections. Container properties fan out
+ * over arrays (each flow node, each dataset measure). The
  * mechanism stays ledger-driven — coverage grows by marking more entries
  * `authorWarn` rather than touching this code.
  */
@@ -2829,6 +4132,7 @@ type AnyRec = Record<string, any>;
 declare const VIEW_KEY_COLLISION = "view-key-collision";
 declare const VIEW_REF_FORM_TARGET_MISSING = "view-ref-form-target-missing";
 declare const VIEW_REF_FORM_TARGET_KIND = "view-ref-form-target-kind";
+declare const VIEW_REF_NAV_VIEW_MISSING = "view-ref-nav-view-missing";
 declare function lintViewRefs(stack: AnyRec): ViewRefFinding[];
 
 /**
@@ -2881,10 +4185,20 @@ interface LintIssue {
  * `f.where ?? f.path` at the adapter) is the same discipline — a consumer-side
  * fallback would let the next rule ship the positional spelling again, silently.
  *
- * `path` is unchanged and stays positional: it is the slot that is SUPPOSED to
- * be a config path, `os validate` prints it after `at`, and the runtime gate's
- * `fingerprint` reads `where` and `path` together (making `where` more specific
- * cannot merge two findings that were distinct).
+ * `path` is unchanged and stays positional AT THE RULE LEVEL: it is the slot
+ * that is SUPPOSED to be a config path, `os validate` prints it after `at`
+ * (where the index resolves against the author's own config file), and the
+ * runtime gate's `fingerprint` reads `where` and `path` together (making
+ * `where` more specific cannot merge two findings that were distinct).
+ *
+ * [#10064] On the runtime gate's WIRE surface (`RuntimeAuthoringIssue.path`,
+ * the 422 `issues[]` / 2xx `advisories`), the top-level collection index of a
+ * collection-resident finding is rewritten to the entry's NAME
+ * (`objects[417].sharingModel` → `objects.acme_invoice.sharingModel`) after
+ * the differential — a runtime caller has no array to resolve `417` against;
+ * that index numbers the gate's private per-write snapshot. The rewrite lives
+ * in `runtime-gate.ts` (`nameKeyFindingPath`); rules keep emitting positional
+ * paths and need no awareness of it.
  */
 interface LocatedLintIssue extends LintIssue {
     /** Human-readable location, e.g. `object "sys_account" · index 'uniq_org_email'`. */
@@ -2980,4 +4294,64 @@ declare function lintLegacyOrganizationComposites(objects: any[]): LocatedLintIs
  */
 declare function lintDataModel(objects: any[]): LintIssue[];
 
-export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type ComponentPropsFinding, type ComponentPropsSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_PRESET_COMPARAND, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, type LocatedLintIssue, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SOURCE_CLASSNAME, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageFieldFinding, type PageFieldSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, type PresetComparandFinding, type PresetComparandSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REFERENCE_INTEGRITY_RULES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNPROVISIONED, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT, SHARING_RULE_OBJECT_NOT_SHAREABLE, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, SORT_FIELD_UNKNOWN, SORT_FIELD_UNSORTABLE, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SortableFieldFinding, type SortableFieldSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, checkSortDeclaration, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findStartupRegistryVerdicts, findUnguardedNullableOperands, isSourceAuthoredPage, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, nearestRegisteredFormat, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateDashboardActionRefs, validateEmptyCombinators, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePredicatePathRefs, validatePresetComparands, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateSortableFields, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings, walkPageComponents };
+/** Which parse produced a finding — see the door table in the module header. */
+type EnvelopeAuditDoor = 'PageSchema' | 'PageComponentSchema' | 'ComponentPropsMap';
+/** One bare-expression position: authored as a string, normalized by a parse. */
+interface BareExpressionFinding {
+    /** The consumer's page label, e.g. `<ExportName> (<page.name>)`. */
+    page: string;
+    /** Authored path from the page root, e.g. `slots.alerts[0].visibleWhen`. */
+    path: string;
+    /** The bare string the author wrote — what reaches the wire verbatim. */
+    authored: string;
+    /** Set when the parse also RENAMED the key (deprecated alias). */
+    normalizedTo?: string;
+    door: EnvelopeAuditDoor;
+}
+/** The three-door union over one page, findings and door preconditions both. */
+interface PageEnvelopeAudit {
+    /** Every bare-expression position any door found, deduped by path, sorted. */
+    findings: BareExpressionFinding[];
+    /** Door 1 could not run — the page itself does not parse. */
+    pageParseError?: string;
+    /** Door 2 could not run for these components. */
+    componentParseErrors: {
+        path: string;
+        type: string;
+        issues: string;
+    }[];
+    /** Door 3 has no schema to parse these components' `properties` with. */
+    unmappedTypes: {
+        path: string;
+        type: string;
+    }[];
+    /** Door 3 could not run — the authored bag is refused by its props schema. */
+    unreadableProps: {
+        path: string;
+        type: string;
+        issues: string;
+    }[];
+    /** How many components the walk reached (coverage floor for doors 2 and 3). */
+    componentCount: number;
+}
+/**
+ * Run all three parse doors over one authored page and union their findings.
+ *
+ * Read `findings` for the verdict, and assert the four precondition channels
+ * separately (see the module header — a door that could not open reports
+ * there, never as a silently smaller `findings`).
+ *
+ * Exported findings are deduped by path: a top-level component's
+ * `visibleWhen` is legitimately seen by doors 1 AND 2, and reporting it twice
+ * would read as two defects.
+ *
+ * @param page - The authored page object, exactly as exported (never parsed
+ *   first — the audit's whole subject is what the raw export serves).
+ * @param pageLabel - How findings should name the page; consumers use
+ *   `<ExportName> (<page.name>)`.
+ */
+declare function auditPageExpressionEnvelopes(page: unknown, pageLabel: string): PageEnvelopeAudit;
+/** Render findings as the actionable red an author reads in CI. */
+declare function renderBareExpressionFindings(findings: readonly BareExpressionFinding[]): string;
+
+export { ACTION_API_UPDATE_READONLY_WHEN_FIELD, ACTION_BODY_SOURCE_UNPARSEABLE, ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BareExpressionFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, COMPONENT_TYPE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type CheckedParse, type CheckedParseOptions, type ComponentPropsFinding, type ComponentPropsSeverity, type ComponentTypeFinding, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_NOT_INCLUDED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DATASET_FIELD_NOT_INCLUDED, DATASET_FIELD_UNKNOWN, DATASET_FILTER_FIELD_UNKNOWN, DATASET_INCLUDE_UNKNOWN, DEFAULT_AGENT_LEGACY_ALIAS, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type DatasetRefFinding, type DatasetRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type EnvelopeAuditDoor, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FIELD_RULE_BOUND_ROOTS, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_PRESET_COMPARAND, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_LOOP_BODY_UNCONTAINED, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_TRY_CATCH_WITHOUT_CATCH, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, FORM_SECTION_GROUP_UNKNOWN, type FieldPathAccount, type FieldPathVerdict, type FilterFieldKey, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, type GraphField, type GraphObject, HOOK_API_UPDATE_READONLY_FIELD, HOOK_API_UPDATE_READONLY_WHEN_FIELD, HOOK_BODY_SOURCE_UNPARSEABLE, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FIELD_DOTTED, LIST_VIEW_FIELD_UNKNOWN, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, LIVENESS_LIVE_ELSEWHERE_PROPERTY, LIVENESS_PLANNED_PROPERTY, type LintIssue, type ListViewFieldRefFinding, type ListViewFieldRefSeverity, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, type LocatedLintIssue, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECTUI_DERIVATION_PREDICATES, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectGraph, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SECTION_GROUP_UNKNOWN, PAGE_SOURCE_CLASSNAME, PAGE_VISUALIZATION_WITHOUT_BINDING, PARSE_FAILURE_HINT, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageEnvelopeAudit, type PageFieldFinding, type PageFieldSeverity, type PageVisualizationFinding, type PageVisualizationSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, type PresetComparandFinding, type PresetComparandSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REACT_PAGE_SOURCE_UNPARSEABLE, REACT_PROP_DEPRECATED, READONLY_ACTION_WRITE_EXCLUSIONS, READONLY_ACTION_WRITE_PATTERN_IDS, READONLY_HOOK_WRITE_EXCLUSIONS, READONLY_HOOK_WRITE_PATTERN_IDS, REFERENCE_INTEGRITY_RULES, RELATIONSHIP_FIELD_TYPES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyActionWriteFinding, type ReadonlyActionWriteSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type ReadonlyHookWriteFinding, type ReadonlyHookWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNPROVISIONED, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_AMBIGUOUS_RELATION, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT, SHARING_RULE_OBJECT_NOT_SHAREABLE, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, SORT_FIELD_UNKNOWN, SORT_FIELD_UNPROVISIONED, SORT_FIELD_UNSORTABLE, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_SOURCE_UNPARSEABLE, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SectionGroupFinding, type SectionGroupRef, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SortableFieldFinding, type SortableFieldSeverity, type SourceParseFailure, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_PAGE_UNRESOLVED, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VIEW_REF_NAV_VIEW_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_PREDICATE_UNKNOWN_FUNCTION, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewPageRefFinding, type ViewPageRefSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, type VisualizationPredicate, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_FILTER_FIELD_NOT_INCLUDED, WIDGET_FILTER_FIELD_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, WIDGET_SORTBY_UNSELECTED, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, auditPageExpressionEnvelopes, authorWarnedProperties, buildAccessMatrix, checkSectionGroupRefs, checkSortDeclaration, describeFieldPathVerdict, describeParseFailure, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, fieldRuleRootIssue, findStartupRegistryVerdicts, findUnguardedNullableOperands, indexObjectFieldGroups, indexObjectGraph, isSourceAuthoredPage, isUnjudgeable, joinablePrefixes, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, listNames, nearestName, nearestRegisteredFormat, nullGuardMessage, renderBareExpressionFindings, resolveFieldPath, sectionGroupRefs, suggestName, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateComponentTypes, validateDashboardActionRefs, validateDatasetReferences, validateEmptyCombinators, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewFieldRefs, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePageVisualizationBindings, validatePredicatePathRefs, validatePresetComparands, validateReactPageProps, validateReactPages, validateReadonlyActionWrites, validateReadonlyFlowWrites, validateReadonlyHookWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateSortableFields, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateViewPageRefs, validateVisibilityPredicates, validateWidgetBindings, walkFilterFieldKeys, walkPageComponents };