@objectstack/lint 17.2.0 → 17.4.0

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { Manifest } from '@objectstack/sdui-parser';
 import ts from 'typescript';
+import { Manifest } from '@objectstack/sdui-parser';
 import { SearchFieldMeta } from '@objectstack/spec/data';
 import { Options } from 'ajv';
 import { AccessMatrixParsed } from '@objectstack/spec/security';
-export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimePackageScope, m as RuntimeStackContext, n as authoringRulesFor, o as buildRuntimeWriteSnapshots, p as narrowObjectsToPackageClosure, r as runAuthoringRules, q as runRuntimeAuthoringRules, s as runtimeAuthoringRulesFor, t as runtimeGatedTypes, u as splitBySeverity, v as stackKeyForType } from './runtime-cV-l_vtC.js';
+export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimePackageScope, m as RuntimeStackContext, n as authoringRulesFor, o as buildRuntimeWriteSnapshots, p as narrowObjectsToPackageClosure, r as runAuthoringRules, q as runRuntimeAuthoringRules, s as runtimeAuthoringRulesFor, t as runtimeGatedTypes, u as splitBySeverity, v as stackKeyForType } from './runtime-S3OZQDZV.js';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -23,13 +23,6 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  *   name on the bound dataset.
  * - `widget-measure-unknown` — a `values[]` entry is not a measure name on
  *   the bound dataset.
- * - `chart-field-unknown` — a `chartConfig` binding names a field the query
- *   result will not contain: `xAxis.field` must be one of the widget's
- *   dimensions (or a dataset dimension), and each `yAxis[].field` /
- *   `series[].name` must be one of the widget's selected measures
- *   (`values`). Post-cutover (ADR-0021) the result rows are keyed by
- *   measure NAME (e.g. `sum_amount`), not the base column (`amount`) — a
- *   stale base-column reference renders the axis but an empty series.
  * - `widget-legacy-analytics-unrenderable` (#1878/#1894) — a widget uses the
  *   removed pre-ADR-0021 inline-analytics shape (`categoryField`/`rowField`/…)
  *   as its ONLY data wiring: no `dataset`, no `object`, no inline `data`. The
@@ -40,18 +33,68 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  * - `dashboard-filter-field-unknown` (#3365) — a dashboard-level filter
  *   (`dateRange` or a `globalFilters[]` entry) is wired into EVERY widget's
  *   analytics query (#2501), but its EFFECTIVE field (after any `filterBindings`
- *   re-target) does not exist on a bound widget's dataset object. The widget's
+ *   re-target) does not resolve on a bound widget's dataset object. The widget's
  *   query then references a non-existent column and crashes at render time
  *   (`no such column …`) — a build-decidable invariant that previously escaped
  *   the static gate and failed only when a user opened the dashboard. A widget
  *   opts out with `filterBindings: { <name>: false }` or re-targets to a real
  *   field. This is the same field-existence invariant ADR-0032 enforces for
  *   CEL formula / sharing-rule references, applied to dashboard filter fields.
+ *   Resolution is {@link resolveFieldPath}'s (#14275), so a DOTTED effective
+ *   field (`account.signed_at`) is walked hop by hop rather than skipped, and a
+ *   bare name is judged against the object's OWN injected columns rather than
+ *   the object-independent `SYSTEM_FIELDS` union — see "What #14275 closed"
+ *   below for why each half was a hole rather than a nicety.
+ * - `dashboard-filter-field-not-included` (#14275) — the effective field
+ *   RESOLVES, but its relationship prefix is not declared in the bound
+ *   dataset's `include`, so ADR-0021 compiles no join for it and the column is
+ *   out of the broadcast query's reach. The `include` half of the same two
+ *   clauses `widget-filter-field-not-included` applies to the widget's own
+ *   `filter`, at the position one level up — a separate id because the fix is a
+ *   different edit (declare the join, versus point the filter somewhere real)
+ *   and because the family keeps one id per class.
  *
  * Advisory rules — severity `warning`, build stays green:
  *
- * - `chart-config-missing` — a chart-type widget (bar/line/pie/…) has no
- *   `chartConfig`, so the renderer cannot tell which measure to plot.
+ * - `chart-field-unknown` (#1721; tier ruled on #15463) — a `chartConfig`
+ *   BINDING key names something the widget's selection does not carry:
+ *   `xAxis.field` is not one of the widget's dimensions (or a dataset
+ *   dimension), or a `yAxis[].field` / `series[].name` is not one of its
+ *   selected measures (`values`). Post-cutover (ADR-0021) the result rows are
+ *   keyed by measure NAME (e.g. `sum_amount`), not the base column (`amount`),
+ *   so a stale base-column reference is the usual way to write one. The pinned
+ *   renderer REFUSES all three keys as bindings — see "The three refused
+ *   binding keys" below — so the authored key changes nothing that renders: it
+ *   is a silent no-op, exactly `widget-legacy-analytics-shape`'s class. Kept as
+ *   a finding because the author wrote a binding and believes it is in force.
+ * - `chart-config-missing` — a `combo` widget has no `chartConfig`, so no
+ *   series carries a mark and the combination chart draws as one uniform
+ *   family. Narrowed to `combo` because `chartConfig` carries NO binding:
+ *   `DatasetWidget` derives the axis and one series per measure from the
+ *   widget's own `dimensions` / `values`, and actively REFUSES an authored
+ *   `ChartAxis.field` / `ChartSeries.name`. See "What the renderer actually
+ *   derives" below for the pinned contract this now mirrors.
+ * - `chart-measures-missing` — a chart-family widget selects NO measures
+ *   (`values` empty or absent). The pinned renderer short-circuits to an
+ *   authoring placeholder — *"Pick measures (values) for this dataset
+ *   widget."* — before any query runs, so no chart is drawn at all. Warning
+ *   rather than error because an empty selection is a legitimate
+ *   work-in-progress state a build must tolerate; erroring would gate the
+ *   `sys_metadata` publish path on a half-authored widget.
+ * - `widget-measures-missing` (#15508) — a NON-chart dataset widget — a
+ *   single-value family (`metric`/`kpi`/`gauge`/`solid-gauge`/`bullet`) or a
+ *   tabular one (`table`/`pivot`) — selects NO measures. The placeholder above
+ *   is returned for these families too: the pinned `values.length === 0` return
+ *   stands above every family branch, so the KPI number or the table is not
+ *   drawn either. Same warning tier and suppression as the chart-family
+ *   spelling; a separate id because "chart" does not name this condition and
+ *   because the family keeps one id per class.
+ * - `chart-dimensions-missing` — a chart-family widget selects at least one
+ *   measure but NO dimensions. The pinned renderer's
+ *   `isMetric = METRIC_TYPES.has(widgetType) || dimensions.length === 0`
+ *   routes it to the single-value branch, so it renders a KPI number and the
+ *   family the author declared is silently ignored. Warning because the
+ *   number is real and correct — it is the chart that is gone.
  * - `table-count-only` (#1719) — a `table`/`pivot` widget whose selected
  *   measures are ALL `aggregate: 'count'` and which declares no
  *   `dimensions` asks the analytics service for a single summary row. That
@@ -79,6 +122,261 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  *   of the same invariant, warned rather than errored because this pass cannot
  *   see the remote schema (#8116's severity reasoning).
  *
+ * ── The widget's OWN two references (#14148) ─────────────────────────────────
+ *
+ * - `widget-filter-field-unknown` — a KEY of the widget's own `filter` resolves
+ *   to no column on the bound dataset's object graph.
+ * - `widget-filter-field-not-included` — that key RESOLVES, but its relationship
+ *   prefix is not declared in the dataset's `include`, so ADR-0021 compiles no
+ *   join for it and the column is out of the query's reach.
+ * - `widget-sortby-unselected` — `options.sortBy` names neither a `dimensions[]`
+ *   nor a `values[]` entry of this widget, so the ordering the author wrote
+ *   cannot be applied to a result that will not contain that column.
+ *
+ * All three are `error`, and the reason is the reporting card's, quoted because
+ * it is the sharpest statement of it in the family: the dashboard it was
+ * measured on leads with a "not moving" tile — open work untouched >14 days —
+ * and *"an empty tile is indistinguishable from a healthy team: a missing
+ * number reads as zero, and zero is the answer the manager is hoping for."*
+ * The failure is not merely silent, it is silent in the direction the reader
+ * WANTS to believe, which is why it gates rather than advises.
+ *
+ * ### Why these two were the surviving holes
+ *
+ * On the very same node, the TOKEN was checked and the COLUMN was not:
+ * `filter-token-unknown` (#3574) fires path-precise at
+ * `…widgets[4].filter.due_date.$lte`, so the traversal already walked the
+ * filter tree and already knew the widget's dataset. And the identical
+ * resolution already existed one key over — `dashboard-filter-field-unknown`
+ * resolves a DASHBOARD-level filter's field against each widget's dataset base
+ * object. `widgets[].filter` is the same field-existence invariant on the
+ * filter an author is MORE likely to write by hand, and it was simply never fed
+ * through it. `options.sortBy` is the declared-≠-enforced half:
+ * `DashboardWidgetOptionsSchema.sortBy` states its own contract in prose —
+ * *"must be one this widget actually selects"* — and nothing enforced it.
+ *
+ * ### The `include` clause, and why a dotted path is RESOLVED here
+ *
+ * A widget's `filter` is ANDed into the dataset query as `runtimeFilter`
+ * (`DashboardWidgetSchema.filter`; `dataset-executor.ts` `combineFilters(
+ * compiled.filter, selection.runtimeFilter)`), and that compiled query carries
+ * ONLY the joins the dataset's `include` declared (`dataset-compiler.ts`: joins
+ * are derived from `include`, and `assertDeclared` refuses an undeclared
+ * relationship path). So a dotted key here is judged on the same two clauses
+ * `validate-dataset-references.ts` applies one level down — existence, then
+ * joinability — rather than skipped. The runtime is NOT a backstop for it
+ * either — `assertDeclared` runs over `dimensions` and `measures` only, never
+ * over `runtimeFilter` — so nothing between the author and the empty tile asks
+ * this question.
+ *
+ * ### What #14275 closed, one position up
+ *
+ * `dashboard-filter-field-unknown` (a1) shipped with the two limitations the
+ * paragraph above used to record as deliberate, and #14275 closed both by
+ * migrating that branch onto this same seam:
+ *
+ *   1. it SKIPPED every dotted effective field (`if (field.includes('.'))
+ *      continue;`), which was accurate when nothing in this package could walk
+ *      hops and false once {@link resolveFieldPath} landed. The consequence was
+ *      the sharper one: a dashboard filter is broadcast to EVERY widget on the
+ *      board, so a single unjudged `filterBindings: { dateRange:
+ *      'account.signed_at' }` degraded the whole dashboard rather than one tile
+ *      — unjudged whether or not `account` existed, whether or not `signed_at`
+ *      existed on it, and whether or not `account` was in the dataset's
+ *      `include`;
+ *   2. it resolved bare names against the object-independent `SYSTEM_FIELDS`
+ *      union, which answers "could this be a system column ANYWHERE". The two
+ *      differ exactly where it matters: on `ownership: 'none'` the platform
+ *      injects no `owner_id`, so the union answered a real defect as
+ *      resolvable. Both positions now take skip 3 per object, through
+ *      {@link resolveFieldPath}'s use of `injectedColumnsFor`.
+ *
+ * The #8340 provenance question rides on the migrated branch unchanged, and is
+ * now GATED by the verdict's `injected` marker rather than by union membership:
+ * a leaf that resolved because it is injected is the only leaf whose anchor can
+ * be unprovisioned (an author-DECLARED column of the same name is the author's,
+ * #7859), and the marker states that fact where the flat union could not. It
+ * also travels: the anchor is looked up on the object the LEAF landed on, so a
+ * dotted filter path ending on an ADR-0015 `external` object is answered too.
+ *
+ * Resolution is {@link resolveFieldPath}'s and its `unknowable` verdicts are
+ * never reported (ADR-0072 D1), so the three skips every field-existence rule
+ * in this package takes apply unchanged: an object this stack does not define,
+ * an object with no readable field map (ADR-0015 `external`), and a
+ * registry-injected system column — the last resolved PER OBJECT rather than
+ * through the flat `SYSTEM_FIELDS` union, which is what lets a reference to
+ * `owner_id` on an `ownership: 'none'` object stay a real finding.
+ *
+ * ### What the renderer actually derives (#14436)
+ *
+ * `chart-config-missing` used to fire on EVERY chart family that was not a
+ * single-value or tabular type, on the stated grounds that without
+ * `chartConfig` "the renderer cannot determine which measure to plot, so the
+ * series renders empty". That consequence was false, and it fired on this
+ * platform's OWN shipped metadata: the `system_overview` dashboard draws a pie
+ * and a bar, each with one dimension and one measure and no `chartConfig`, and
+ * both render correctly. A warning-tier rule that mis-fires on first-party
+ * metadata is the ADR-0072 D1 cost the whole family exists to avoid — it
+ * teaches every reader, human and agent, that this family is noise.
+ *
+ * The renderer's contract, read at the `@object-ui` revision this repo PINS
+ * (`.objectui-sha`), not at objectui's `origin/main` — the Console ships the
+ * pin, so the exemption is written against the behaviour the pin has:
+ *
+ *  - `DatasetWidget` calls `buildChartSeries(rows, dimensions, values, …)`,
+ *    which returns `{ data, xAxisKey, series }` — the x-axis key is
+ *    `dimensions[0]` and there is exactly one series per entry of `values`.
+ *    `chartConfig` is not an argument to it.
+ *  - The authored `chartConfig` reaches the chart only through
+ *    `mergeAuthoredPresentation` (per-series/axis PRESENTATION merged ONTO
+ *    those derived bindings) and `chartConfigPresentation` (chrome: titles,
+ *    height, colours, data labels, annotations, legend).
+ *  - The BINDING half of an authored `chartConfig` is refused outright. The
+ *    renderer pins this by name in
+ *    `packages/plugin-dashboard/src/__tests__/DatasetWidget.chartConfig.test.tsx`:
+ *    *"ignores an authored axis `field` and keeps the derived axis binding"*,
+ *    *"ignores an authored series and keeps one derived series per measure"*,
+ *    *"ignores `chartConfig.type` — the widget type owns the chart family"*,
+ *    and *"emits none of the presentation keys when no chartConfig is
+ *    declared"*.
+ *
+ * So for every chart family except one, a missing `chartConfig` costs the
+ * widget nothing at all, and ADDING one could not have repaired a widget whose
+ * selection is empty either — `chart-field-unknown` above reports a
+ * `yAxis[].field` that names anything the widget did not select, so
+ * `chartConfig` can never supply a measure the `values` array is missing.
+ *
+ * **The one surviving arm is `combo`**, and it is a real loss rather than an
+ * inferred one. A combination chart's whole identity is a per-series MARK, and
+ * that mark is authored as `chartConfig.series[].type` — presentation, so it
+ * does merge forward. `mergeAuthoredSeries` states the default it falls back
+ * to: *"a derived series with no authored entry keeps the family default"*,
+ * and `DatasetWidget.comboPresentation.test.tsx` records what that cost when
+ * the merge was missing — *"Without it the line measure drew as the second
+ * bar."* A `combo` with no `chartConfig` therefore draws every measure with
+ * one mark: the author asked for a combination and got a plain one. Warning
+ * rather than error, because the numbers are right and the chart renders — it
+ * is the shape that is wrong.
+ *
+ * ⚠️ Two genuinely un-renderable shapes are NOT this id's, because neither is
+ * caused by nor repairable with `chartConfig` and folding them in would leave
+ * this id misnaming its own condition: a chart-family widget selecting NO
+ * measures, and one selecting NO dimensions. They have their own ids —
+ * `chart-measures-missing` and `chart-dimensions-missing` — described next.
+ *
+ * ### The two empty-selection shapes (#15462)
+ *
+ * Read at the same PINNED `@object-ui` revision (`.objectui-sha`), in
+ * `packages/plugin-dashboard/src/DatasetWidget.tsx`:
+ *
+ *  - `:683` — `if (values.length === 0)` returns the authoring placeholder
+ *    `tt('dashboard.pickMeasures', 'Pick measures (values) for this dataset
+ *    widget.')`. It stands ABOVE every family branch, so a widget selecting no
+ *    measure never reaches a chart, a table or a KPI number: nothing is drawn.
+ *  - `:423` — `const isMetric = METRIC_TYPES.has(widgetType) ||
+ *    dimensions.length === 0;`, with `METRIC_TYPES` (`:343`) = `metric`, `kpi`,
+ *    `gauge`, `solid-gauge`, `bullet`; `:424` is the tabular test
+ *    (`table`/`pivot`); and the render branches (`:702`, `:798`, `:854`) route
+ *    `isMetric ? KPI : isTable ? table : chart`. A dimensionless `bar` is
+ *    therefore drawn as a single KPI number — the failure direction the family's
+ *    own docblock names, except worse: the number is REAL, so the missing chart
+ *    reads as a design choice rather than as a defect.
+ *
+ * So "chart family" here is not a hand list — it is what that routing leaves
+ * over: a declared `ChartTypeSchema` option that is neither a `METRIC_TYPES`
+ * member nor tabular ({@link CHART_FAMILY_WIDGET_TYPES}). The taxonomy supplies
+ * the universe and the renderer decides the exceptions, which is the same
+ * division #14436 settled for `MARK_MIXING_CHART_TYPES`: this file's copies of
+ * the renderer's two sets are held to `ChartTypeSchema` by the rule's tests, so
+ * a member that stops being a declared chart type reds instead of going quiet.
+ *
+ * The two ids never both fire on one widget, and the reason is the pin's own
+ * order: with no measures the placeholder returns at `:683` and the `isMetric`
+ * branch is never reached, so `chart-dimensions-missing`'s consequence (a KPI
+ * number in place of the chart) is not what that widget does. A widget missing
+ * both reports `chart-measures-missing` alone, whose hint names the missing
+ * dimension too.
+ *
+ * Both are warnings, per the tier decision on #15462: an empty selection is a
+ * state an author passes THROUGH, and the family's errors are reserved for
+ * bindings the analytics service cannot satisfy.
+ *
+ * **The measures shape is every family's, not the chart family's (#15508).**
+ * Re-read at the pinned `.objectui-sha` (`a472b0716`, where the four cited
+ * lines still read as quoted above), `:683` is ABOVE `:423`/`:424` and tests
+ * nothing but `values.length === 0`. So a `metric`, `kpi`, `gauge`,
+ * `solid-gauge`, `bullet`, `table` or `pivot` widget that selects no measures
+ * renders that same placeholder: the KPI number or the table the author
+ * declared is not drawn either, and a missing tile on a board reads as
+ * "nothing to report" rather than as a defect. Nothing else reported it —
+ * `table-count-only` requires `values.length > 0` before it looks, and rules
+ * (b)/(c) iterate the arrays, so an empty one is silent by construction.
+ *
+ * The population therefore widens to every DECLARED widget type
+ * ({@link NON_CHART_DATASET_WIDGET_TYPES} is the taxonomy minus the chart
+ * family), carried by TWO ids rather than one:
+ * {@link CHART_MEASURES_MISSING} keeps the chart family, and
+ * {@link WIDGET_MEASURES_MISSING} takes the rest. Two, because "chart" stops
+ * naming the condition once the population is every family — a `metric` tile
+ * is not a chart — while the old id is depended on from OUTSIDE this file (the
+ * `packages/lint` barrel re-exports it, which
+ * `rule-id-barrel-exports.test.ts` makes a public-surface contract, and a
+ * board may already carry `suppressWarnings: ['chart-measures-missing']`).
+ * Renaming would have retired a reachable id and falsified those references;
+ * splitting keeps every one of them true and lets each message state the
+ * consequence its family actually has (no chart drawn / no KPI number drawn /
+ * no table rendered), which one id could only do by branching anyway.
+ *
+ * The DIMENSIONS shape stays chart-family only, and deliberately: a
+ * dimensionless `metric` or `table` is what those families are FOR (the
+ * shipped `system_overview` KPI tiles are exactly that shape), and a
+ * dimensionless `table` already has its own id in `table-count-only`.
+ *
+ * ### The three refused binding keys (#15463)
+ *
+ * `chart-field-unknown` shipped at `error` with a message that named a QUERY
+ * failure — *"the query result will not contain it"*. Read at the same PINNED
+ * `@object-ui` revision (`.objectui-sha`), that consequence never happens,
+ * because the renderer never reads these keys as bindings at all. The rule id
+ * covers exactly three positions, and all three are refused:
+ *
+ *  - `chartConfig.xAxis.field` — `axisPresentation`
+ *    (`@object-ui/core` `src/utils/chart-presentation.ts`) builds the axis's
+ *    presentation MINUS its `field`, and that dropping is structural, not a
+ *    guard: the x-axis key is `buildChartSeries`' `xAxisKey`, i.e. the widget's
+ *    `dimensions[0]`. An authored `field` re-points nothing.
+ *  - `chartConfig.yAxis[].field` — the same `axisPresentation` call, per entry.
+ *    The entry keeps its SLOT (the count is what turns on a secondary axis) and
+ *    its scale/chrome; only the binding is dropped.
+ *  - `chartConfig.series[].name` — `mergeAuthoredSeries` pairs an authored
+ *    entry with the derived binding whose `dataKey` it EQUALS, one series per
+ *    entry of `values`. A name matching no derived series is *"**ignored** —
+ *    membership belongs to the dataset, so an author cannot add, remove or
+ *    re-point a series from the chart config"*. So the presentation the author
+ *    hung on that entry — the mark, the colour, the stack, the axis side —
+ *    lands on nothing.
+ *
+ * The renderer pins all three by name in
+ * `packages/plugin-dashboard/src/__tests__/DatasetWidget.chartConfig.test.tsx`
+ * (*"ignores an authored axis `field` and keeps the derived axis binding"*,
+ * *"ignores an authored series and keeps one derived series per measure"*).
+ *
+ * So the failure is not a broken page, it is an ignored key — which is the
+ * class `widget-legacy-analytics-shape` above reports at WARNING tier in this
+ * same file (*"the dashboard renderer ignores them … a silent no-op"*). All
+ * three positions therefore drop from `error` to `warning`, suppressible per
+ * widget, and each message states what actually happens instead of a query that
+ * never runs. The finding is KEPT rather than deleted: unlike #14436's
+ * over-reach the metadata really is wrong — the author wrote a binding and
+ * believes it is in force.
+ *
+ * The tier drop is a behaviour change on the `sys_metadata` publish door: the
+ * 2026-08-15 ruling put all SIX of this rule's error ids on that door as one
+ * "this board cannot render" class, and this id leaves that set, so a publish
+ * carrying only a refused `chartConfig` binding key now SUCCEEDS with the
+ * finding on the advisory channel. The remaining five are unchanged; the
+ * accept-set is re-pinned in `runtime-gate.test.ts`.
+ *
  * Warnings can be deliberately suppressed per widget via
  * `suppressWarnings: ['<rule-id>']`; errors cannot — they describe a
  * binding the analytics service cannot satisfy.
@@ -88,12 +386,44 @@ declare const WIDGET_DIMENSION_UNKNOWN = "widget-dimension-unknown";
 declare const WIDGET_MEASURE_UNKNOWN = "widget-measure-unknown";
 declare const CHART_FIELD_UNKNOWN = "chart-field-unknown";
 declare const CHART_CONFIG_MISSING = "chart-config-missing";
+/**
+ * [#15462] A chart-family widget selects no measures, so the pinned renderer
+ * draws the "Pick measures (values)" placeholder instead of a chart.
+ */
+declare const CHART_MEASURES_MISSING = "chart-measures-missing";
+/**
+ * [#15462] A chart-family widget selects no dimensions, so the pinned
+ * renderer's `isMetric` branch draws a KPI number instead of the declared
+ * chart family.
+ */
+declare const CHART_DIMENSIONS_MISSING = "chart-dimensions-missing";
+/**
+ * [#15508] A NON-chart dataset widget — a `METRIC_WIDGET_TYPES` or a
+ * `TABULAR_WIDGET_TYPES` one — selects no measures, so the pinned renderer
+ * draws the same "Pick measures (values)" placeholder in place of the KPI
+ * number or the table. The chart-family spelling of the same shape keeps its
+ * own id ({@link CHART_MEASURES_MISSING}); see "The two empty-selection
+ * shapes" in the module docblock for why the population is split across two
+ * ids rather than carried by one.
+ */
+declare const WIDGET_MEASURES_MISSING = "widget-measures-missing";
 declare const TABLE_COUNT_ONLY = "table-count-only";
 declare const MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 declare const WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 declare const WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 declare const DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
 declare const DASHBOARD_FILTER_FIELD_UNPROVISIONED = "dashboard-filter-field-unprovisioned";
+/**
+ * [#14275] A dashboard filter's effective field resolves, but its relationship
+ * prefix is not declared in the bound dataset's `include`.
+ */
+declare const DASHBOARD_FILTER_FIELD_NOT_INCLUDED = "dashboard-filter-field-not-included";
+/** [#14148] A key of the widget's OWN `filter` that resolves to no column. */
+declare const WIDGET_FILTER_FIELD_UNKNOWN = "widget-filter-field-unknown";
+/** [#14148] A widget filter key whose relationship prefix is not in `include`. */
+declare const WIDGET_FILTER_FIELD_NOT_INCLUDED = "widget-filter-field-not-included";
+/** [#14148] `options.sortBy` names nothing this widget selects. */
+declare const WIDGET_SORTBY_UNSELECTED = "widget-sortby-unselected";
 type WidgetBindingSeverity = 'error' | 'warning';
 interface WidgetBindingFinding {
     /** `error` = unresolvable binding (broken page); `warning` = advisory. */
@@ -109,7 +439,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$G = Record<string, unknown>;
+type AnyRec$N = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -117,7 +447,7 @@ type AnyRec$G = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$G): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$N): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -130,12 +460,293 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$F = Record<string, unknown>;
+type AnyRec$M = Record<string, unknown>;
+/**
+ * A FIELD-level conditional rule (`visibleWhen` / `readonlyWhen` /
+ * `requiredWhen`) that reaches for a namespace root the field level does not
+ * bind. The field level binds THREE roots and nothing else — `record`,
+ * `previous`, and `parent` on a master-detail line item — measured at three
+ * independent ends: the server (`rule-validator.ts` binds
+ * `{ record, previous, extra: { parent } }` for `readonlyWhen` and
+ * `{ record, previous, ...parentScope }` for `requiredWhen`), the client
+ * (`evalFieldPredicate` binds `record` + `previous` + a caller `scope` that
+ * is only ever `{ parent }` across objectui's five field-level call sites),
+ * and the authoring surface (objectui's `FIELD_RULE_ROOTS`, whose comment
+ * says "nothing else").
+ *
+ * ## Why this is a rule of its own rather than a missing root
+ *
+ * Until #6290 the same rejection fell out of `@objectstack/formula`'s
+ * `SCOPE_ROOTS` not listing `current_user` — a global baseline, doing a
+ * per-surface job by accident. Two things were wrong with that:
+ *
+ *  1. The rest of the package said the opposite. `introspectScope` hands
+ *     `current_user` to authors as a legal root and `checkRoleCatalog`'s four
+ *     position-membership regexes all lead with it, because ADR-0068 D1 makes
+ *     it THE canonical spelling and `buildScope` really does mount it. One
+ *     package, two accounts of one root.
+ *  2. The diagnostic was the generic bare-field one, so it prescribed
+ *     "Write `record.current_user`" — a shape that binds on NO layer. An
+ *     author who followed it wrote something strictly worse than what they
+ *     started with, and the failure stayed silent.
+ *
+ * So the baseline now declares the root (a reference through it never faults
+ * platform-wide) and the surface that genuinely cannot bind it says so here,
+ * in its own words, with the prescriptions that actually exist.
+ *
+ * ## Why the membership test is an ALLOWLIST (#6713)
+ *
+ * Until #6713 this rule matched a hand-written DENYLIST — one root in #6584,
+ * three after #6585 (`current_user` / `user` / `ctx`). The denylist was never
+ * the truth: the three anchors above pin a three-item ALLOWLIST, and
+ * everything outside it is equally unbound, faults identically, and — this is
+ * the part that made the hole invisible — is equally SILENT. A root in
+ * `SCOPE_ROOTS` resolves in the strict env, so the bare-reference check one
+ * line up never fires on it either. #6713 measured 21 roots living in that
+ * gap (`input`, `output`, `os`, `vars`, `variables`, `automation`, `context`,
+ * `args`, `item`, `env`, `step`, `result`, `trigger`, `event`, `payload`,
+ * `data`, `params`, `config`, `settings`, `features`, `current`), two of them
+ * highly credible author typos rather than theoretical members:
+ *
+ *  - `os.user.id` — ADR-0068 D1's FOURTH user spelling. #6585 took three and
+ *    left this one, so the same semantic error stayed silent under one of the
+ *    four names the platform itself mounts the user object under.
+ *  - `data.status == 'x'` — `data` is the LEGAL root of this very
+ *    `visibleWhen` key on a METADATA form (`view.zod.ts`: "Root: `record` …
+ *    in runtime forms, or `data` in metadata forms"). Two form kinds, one key
+ *    name, different roots — and the repo's own `*.form.ts` files are full of
+ *    the `data` spelling for an author to copy.
+ *
+ * A denylist cannot track `SCOPE_ROOTS`: every root added there is unreported
+ * here until somebody remembers to copy it across (`current_user` itself
+ * arrived in #6290 and needed #6584 to be noticed). The allowlist inverts the
+ * maintenance burden onto the three roots that are pinned by three anchors and
+ * change only when the evaluators do.
+ *
+ * The membership test is {@link FIELD_RULE_JUDGED_ROOTS} minus the allowlist.
+ * Its bulk is `SCOPE_ROOTS`, taken from `@objectstack/formula` rather than
+ * restated here (#6713 published it for this consumer) — one list, one
+ * definition, no drift — plus the ambient roots #13935 measured outside that
+ * baseline; see "Why the judged vocabulary is WIDER than `SCOPE_ROOTS`" below.
+ * It deliberately is NOT `firstUndeclaredReference`, the declaredness oracle
+ * the sibling visibility rule uses, and the difference is a measured false
+ * positive rather than a preference: the strict env also declares CEL's TYPE
+ * names, so `type(record.x) == string` reports `string` as a root that
+ * "resolves". Judging by declaredness would reject that legitimate predicate;
+ * judging by membership does not. Everything the oracle owns and this list
+ * does not — bare field references, comprehension-macro variables — keeps
+ * falling to the bare-reference check, which has the right prescription for
+ * it. The two partitions are disjoint and there is no gap between them.
+ *
+ * ⚠️ That disjointness used to hold for FREE and no longer does. While every
+ * judged root was a `SCOPE_ROOTS` member it was declared in the strict env, so
+ * the bare-reference check could not fire on it whatever this rule decided.
+ * An AMBIENT root is undeclared there, so both checks see it — the walk
+ * suppresses the bare-reference verdict for a root this rule has claimed
+ * (`claimedRoot` on the `check` closure) to keep the invariant true by
+ * construction instead of by coincidence.
+ *
+ * ## Why it is an error and not a warning
+ *
+ * Every fault direction available here is silent, and two of the three are
+ * the opposite of what the author declared (see the per-slot table below):
+ * a `visibleWhen` written to HIDE leaves the field visible to everyone, a
+ * `readonlyWhen` written to unlock-under-a-condition locks the field on every
+ * write, and a `requiredWhen` simply never fires. None of the three produces
+ * a runtime error an author can find; the only signal that exists is this one
+ * (#6146).
+ *
+ * Verdict scope is the field level only. Per-option `visibleWhen` is checked
+ * by the loop in the field walk and deliberately NOT passed through here:
+ * options resolve against the host's predicate scope, which binds
+ * `current_user` (ADR-0068 / objectui#2284) — that surface is where such a
+ * predicate belongs, which is why it is also the first prescription below.
+ *
+ * ## The user roots, and why `ctx` is judged whole-root (#6585)
+ *
+ * ADR-0068 D1 makes `user` and `ctx.user` ALIASES of `current_user` — one
+ * `EvalUser` object under every spelling (`buildScope` in
+ * `formula/stdlib.ts` hangs the same reference on `current_user` / `user` /
+ * `ctx.user` / `os.user`). Matching only the canonical spelling meant the
+ * identical semantic error got a diagnostic under `current_user` and total
+ * silence under the aliases — which spelling the author picked decided
+ * whether they got the diagnostic, the exact fork AI authors cannot
+ * self-check. All four roots now share one verdict and one prescription;
+ * the message names the spelling found, nothing else varies. (`os` joined the
+ * set in #6713 — it is the fourth name `buildScope` mounts the same object
+ * under, and the allowlist would have rejected it anyway; what the user tier
+ * decides is only WHICH prescription it gets, and the user one is right for
+ * `os.user`. `os.org` / `os.env` land in the same tier because the option
+ * surface named by the first prescription binds the whole `os` namespace, not
+ * only its `user` member.)
+ *
+ * `ctx` is judged as a WHOLE root, not only in `ctx.user` form, because at
+ * this surface that is simply what is true: `buildScope` creates the `ctx`
+ * root ONLY when the evaluation carries a user (`scope.ctx = { user }`
+ * inside `if (ctx.user !== undefined)`), and no field-level site passes one
+ * — the server binds `record`+`previous`(+`parent`) (`rule-validator.ts`
+ * `readonlyWhenBindings` / the `requiredWhen` block) and the client's
+ * `evalFieldPredicate` binds `record`+`previous`+caller `scope` (only ever
+ * `{ parent }`). So `ctx.locale` faults exactly like `ctx.user.id` here.
+ * `ctx` IS ActionEngine's predicate root elsewhere — the platform's real
+ * `ctx.user` predicates all sit on action `visible` (`sys-user.object.ts`,
+ * `sys-invitation.object.ts`), a surface this helper never reads — and
+ * measured usage of field-level `*When` with ANY user root is zero across
+ * examples/, packages/ and objectui (#6585's sweep).
+ *
+ * The rejected alternative was matching `ctx` only in its `ctx.user` form.
+ * `collectCelRootIdentifiers` reports ROOTS and drops member names by
+ * design, so that reading needs a source-level spelling match — and a
+ * spelling match is precisely the defect this rule exists to remove: it
+ * would re-open the same fork one level down (`ctx["user"].id` silent,
+ * `ctx.user.id` rejected), while leaving a real fail-open fault (`ctx.locale`)
+ * unreported for the sake of a narrower rule NAME.
+ *
+ * ## The message tiers on TWO orthogonal axes
+ *
+ * The causal half tiers by SLOT (#6716); the prescription half tiers by ROOT
+ * (#6713). They are independent — `data` on a `readonlyWhen` needs the
+ * metadata-form prescription AND the locked-field consequence — so one
+ * skeleton carries both rather than a message per combination.
+ *
+ * ### Axis 1 — the consequence, by SLOT (#6716, all three cells measured)
+ *
+ * Until #6713/#6716 all three slots shared ONE sentence: "the predicate
+ * faults and falls back to VISIBLE, leaving the field the test was meant to
+ * hide showing for everyone". That is precise for exactly one of them. The
+ * measurement, at both ends of each slot:
+ *
+ *  - **`visibleWhen` — client-only, and since objectui#6010 it fails in TWO
+ *    ways rather than one.** The server half is unchanged and still exactly
+ *    right: it never evaluates a FIELD-level `visibleWhen` at all —
+ *    `rule-validator.ts`'s `ConditionalFieldDef` has no such member, and
+ *    `hasFieldRules` gates on `requiredWhen || readonlyWhen ||
+ *    fieldHasOptionVisibility` — the `visibleWhen` it does evaluate is the
+ *    per-OPTION one. The RENDERER half moved. `plugin-form`'s
+ *    `sectionFields.ts` (`fromObjectSchema`) copies an object field's ADR-0036
+ *    `visibleWhen` / `readonlyWhen` / `requiredWhen` straight onto the runtime
+ *    form field, and the SDUI form renderer resolves those through
+ *    `resolveFieldRuleState` **with `predicateScope` bound**. So under a host
+ *    that publishes a scope the predicate does not fault: it RESOLVES, the
+ *    control is hidden in that one form, and the server still returns the value
+ *    to every other reader — a silent enforcement gap. Only where no host
+ *    publishes a scope (the public `/f/:slug` route, every non-form reader)
+ *    does the old sentence still describe what happens: unbound root, fault,
+ *    `fallback: true`, field visible to everyone.
+ *
+ *    ⛔ This is not a reason to relax {@link FIELD_RULE_BOUND_ROOTS}. The
+ *    verdict is MORE justified than when it was written, not less: trading a
+ *    loud lint error for a gap nobody can see is the one outcome worse than
+ *    the error. Only the causal clause was re-measured.
+ *  - **`readonlyWhen` — the two ends fault in OPPOSITE directions, and the
+ *    server wins.** Server: `isReadonlyWhenLocked` matches the fault with
+ *    `unknownVariableOf` and returns `true` — "the declared lock is not
+ *    waived because it could not be evaluated" (#4889's carve-out, whose
+ *    trigger is precisely the unbound-ROOT case, not the undeclared-key one)
+ *    — and `stripReadonlyWhenFields` then DELETES the field from the incoming
+ *    payload and lets the rest of the write through. Client:
+ *    `resolveFieldRuleState` passes `fallback: false`, so the form renders the
+ *    field editable. The standing "server enforces, client is courtesy" rule
+ *    — ADR-0124 D1 — resolves the disagreement: the author edits
+ *    the field, the save reports
+ *    success, and the value silently never lands. The old sentence told this
+ *    author the field would be VISIBLE TO EVERYONE — the opposite failure, and
+ *    the opposite troubleshooting direction.
+ *  - **`requiredWhen` — fail-OPEN at both ends, and never about visibility.**
+ *    Server: the `requiredWhen` block logs `unknownVariableOf`'s name and
+ *    `continue`s — #4977 deliberately did not copy #4889's carve-out, so the
+ *    required-check is skipped for that write. Client: `fallback: false`, so
+ *    the form does not mark the field required either. Both ends agree and
+ *    both do nothing: the requirement is never enforced anywhere, and a record
+ *    saves with the field empty. "Falls back to VISIBLE" was not merely
+ *    imprecise here, it named the wrong property of the field.
+ *
+ * `conditionalRequired` also reaches this helper (the field walk still passes
+ * it). It is a `retiredKey` in `FieldSchema` — the strict schema rejects it by
+ * name — so the branch is inert on the parsed compile path, and it gets a
+ * slot-agnostic clause rather than a fabricated fourth measurement.
+ *
+ * ### Axis 2 — the prescription, by ROOT (#6713)
+ *
+ * The pre-#6713 prescriptions are user-oriented (move to the option level,
+ * declare permission-set FLS) because the pre-#6713 denylist held only user
+ * roots. Handed to an author who wrote `data.type == 'select'`, "move it to
+ * the option's `visibleWhen`" answers a question nobody asked. Three tiers:
+ *
+ *  - **user roots** (`current_user` / `user` / `ctx` / `os`) keep the existing
+ *    two user-specific prescriptions plus the `record` rewrite. What changed is
+ *    the GROUNDING of the first one, not the prescription: it used to read
+ *    "per-option is the one `*When` surface that binds `current_user`", and
+ *    since objectui#6010 a form VIEW's field predicate binds those roots too —
+ *    client-side only, because nothing on the write path evaluates a form-view
+ *    field `visibleWhen`. So per-option is recommended for the reason that
+ *    survives the change: the rule validator enforces it on write. The message
+ *    now says that, and names the view surface only to refuse it as a
+ *    destination for a server-enforced object rule (trading a loud lint error
+ *    for a silent enforcement gap is the one outcome worse than the error);
+ *  - **`data`** gets the metadata-form-vs-runtime-form explanation, because
+ *    that is what the mistake IS — the same key name, the other form kind's
+ *    root;
+ *  - **`app` and the other AMBIENT roots** get the renderer-mounted
+ *    explanation and an explicit refusal of `record.<root>` (#13935, below);
+ *  - **everything else** gets the general rewrite, phrased without claiming
+ *    which other surface the author copied it from.
+ *
+ * ## Why the judged vocabulary is WIDER than `SCOPE_ROOTS` (#13935)
+ *
+ * `SCOPE_ROOTS` was the membership test until #13935, and it is the wrong
+ * question by one word: it answers "is this root declared PLATFORM-WIDE",
+ * while the rule needs "is this root bound at SOME evaluation site". The two
+ * agreed for 27 roots and then disagreed for `app` — bound by objectui's
+ * `ExpressionProvider` on the very surface an author migrates a rule DOWN
+ * from, absent from the baseline. Falling outside the membership test sent it
+ * to the bare-reference check, whose prescription is "Write `record.app`" —
+ * and following that earns ``unknown field `app` `` from the field-existence
+ * pass one line up. A first diagnostic that is actively false about where the
+ * root binds, and a wasted correction cycle.
+ *
+ * `SCOPE_ROOTS`' own docblock made this measurable rather than a matter of
+ * taste: its `current_user` entry claims to be "the last one this list was
+ * missing (#6290)". `app` is that sentence's second counterexample — the same
+ * mechanism (#6713's point: a hand-maintained list doing a per-surface job
+ * drifts), a second sighting, not an analogy to the first.
+ *
+ * ⛔ The repair deliberately does NOT add `app` to `SCOPE_ROOTS`. That list is
+ * the published strict-lint accept baseline in `@objectstack/formula`, so
+ * adding a root there stops EVERY surface that judges bare identifiers from
+ * faulting it — a widened public accept set, to fix one surface's diagnostic.
+ * The judged vocabulary is assembled HERE, where the per-surface question is
+ * asked, and `SCOPE_ROOTS` is left as the proper subset it already is.
+ */
+/**
+ * The roots a field-level `*When` predicate binds. Everything else in
+ * {@link FIELD_RULE_JUDGED_ROOTS} is rejected — see the allowlist section above.
+ */
+declare const FIELD_RULE_BOUND_ROOTS: readonly ["record", "previous", "parent"];
+/**
+ * The decision half of the rule documented above, as ONE exported function so
+ * every surface that judges a field-level `*When` stands on the same verdict
+ * AND the same message (Prime Directive #12). Two consumers today: the
+ * metadata walk in {@link validateStackExpressions} below, and the docs-corpus
+ * gate `scripts/check-doc-formula-expressions.mjs`, which judges the same three
+ * slots where a fenced example's enclosing structure identifies the field layer
+ * (#11407). Before that gate existed this lived as a closure inside the walk —
+ * fine while there was one caller, and exactly how a second caller comes to own
+ * a DIALECT of the rule instead of the rule.
+ *
+ * `null` = nothing to report: the source does not parse (the syntax pass owns
+ * that, and reporting it twice under a worse name is the #4889 mistake), or
+ * every root it reads is one the field level binds.
+ */
+declare function fieldRuleRootIssue(slot: string, source: string): {
+    root: string;
+    message: string;
+} | null;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$F): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$M): ExprIssue[];
 
 /**
  * The corrective sentence, lifted **verbatim** from `unevaluableRuleError` in
@@ -328,7 +939,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$E = Record<string, unknown>;
+type AnyRec$L = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -338,7 +949,7 @@ type AnyRec$E = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$E): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$L): ListViewModeFinding[];
 
 type FunctionalCompletenessSeverity = 'error' | 'warning';
 interface FunctionalCompletenessFinding {
@@ -453,7 +1064,7 @@ declare const FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-des
  *     call sites that each skip it.
  */
 declare const FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
-type AnyRec$D = Record<string, unknown>;
+type AnyRec$K = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  *
@@ -462,7 +1073,7 @@ type AnyRec$D = Record<string, unknown>;
  * owns the `timeRelative` descriptor's contract, which is the point: the rule
  * ASKS that schema rather than restating it.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$D): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$K): FlowTriggerReadinessFinding[];
 
 type FlowTemplatePathSeverity = 'error' | 'warning';
 interface FlowTemplatePathFinding {
@@ -478,12 +1089,12 @@ interface FlowTemplatePathFinding {
 declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
 declare const FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
-type AnyRec$C = Record<string, unknown>;
+type AnyRec$J = Record<string, unknown>;
 /**
  * Validate `{record.<path>}` template references across every record-change
  * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTemplatePaths(stack: AnyRec$C): FlowTemplatePathFinding[];
+declare function validateFlowTemplatePaths(stack: AnyRec$J): FlowTemplatePathFinding[];
 
 type ReadonlyFlowWriteSeverity = 'error' | 'warning';
 interface ReadonlyFlowWriteFinding {
@@ -498,12 +1109,350 @@ interface ReadonlyFlowWriteFinding {
 }
 declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-type AnyRec$B = Record<string, unknown>;
+type AnyRec$I = Record<string, unknown>;
+/**
+ * Validate flow `update_record` / `create_record` writes against target-object
+ * readonly declarations. Pure and dependency-free; safe on pre- or post-parse
+ * stacks.
+ */
+declare function validateReadonlyFlowWrites(stack: AnyRec$I): ReadonlyFlowWriteFinding[];
+
+/** What a caller needs to tell an author WHICH source went unread, and where. */
+interface SourceParseFailure {
+    /** The first parse diagnostic, in the compiler's own wording, flattened to one line. */
+    message: string;
+    /** 1-based line, in the AUTHORED source's coordinates (see `synthesizedLinesBefore`). */
+    line: number;
+    /** 1-based column. */
+    column: number;
+    /** How many parse diagnostics in total — `message` is the first of `count`. */
+    count: number;
+}
+/** A parse plus the verdict on whether it succeeded. `failure` absent ⇒ it parsed. */
+interface CheckedParse {
+    /**
+     * The tree, ALWAYS returned — including when `failure` is set. Error recovery
+     * produces a partial tree, and a caller that already reports findings from it
+     * keeps doing so: the fix here is the missing SIGNAL, not the removal of
+     * whatever the recovered tree could still be read for.
+     */
+    sourceFile: ts.SourceFile;
+    /** Set when the parser reported at least one syntax diagnostic. */
+    failure?: SourceParseFailure;
+}
+interface CheckedParseOptions {
+    target: ts.ScriptTarget;
+    setParentNodes: boolean;
+    scriptKind: ts.ScriptKind;
+    /**
+     * Lines the CALLER synthesised ahead of the authored source, subtracted from
+     * the reported position so it lands in the author's coordinates.
+     *
+     * `validate-hook-body-writes.ts` parses an L2 hook body wrapped in
+     * `async function __body(ctx) {\n…\n}` — the shape the runtime compiles it
+     * into — so its diagnostics are one line low. The reported line is clamped to
+     * at least 1, so a diagnostic that lands on a synthesised line is attributed
+     * to the nearest AUTHORED line and never to a line the author did not write.
+     */
+    synthesizedLinesBefore?: number;
+}
+/**
+ * The one wording every caller's message embeds, so three findings about the
+ * same defect do not describe it three ways.
+ */
+declare function describeParseFailure(failure: SourceParseFailure): string;
+/**
+ * The hint every caller's finding carries. It says what the finding IS — a
+ * statement about what the checker could read, not a second syntax verdict —
+ * because a source that does not parse is not scored, and an author who reads
+ * "no problems found" about it would be reading a green line that lied.
+ */
+declare const PARSE_FAILURE_HINT: string;
+
+type HookBodyWriteSeverity = 'warning';
+interface HookBodyWriteFinding {
+    /** v1 is advisory-only by contract — the type says so. */
+    severity: HookBodyWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `hook "normalize_lead" › body`. */
+    where: string;
+    /** Config path, e.g. `hooks[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+/**
+ * [#10653] The body did not parse, so its write set is whatever error recovery
+ * left readable.
+ *
+ * Reported rather than skipped for the reason this rule exists at all: a
+ * mistake must be visible where it is MADE. An unparseable body reached the
+ * extractor, produced fewer matches, and came back as a hook with nothing to
+ * report — the same silence the undeclared write itself has at run time, this
+ * time wearing the checker's badge. `warning` because the whole rule is
+ * advisory and never gates (the severity type admits nothing else).
+ */
+declare const HOOK_BODY_SOURCE_UNPARSEABLE = "hook-body-source-unparseable";
+/**
+ * [#8663] The write-axis twin of `flow-template-field-unprovisioned` (#8340):
+ * the body writes a field {@link IMPLICIT_FIELDS} exempts, but on THIS target
+ * the platform registered that anchor without provisioning storage for it.
+ *
+ * A separate id at `warning` severity rather than a reclassification of
+ * {@link HOOK_BODY_WRITE_UNKNOWN_FIELD}, matching #8340's precedent exactly:
+ * the existence verdict is unchanged (the name IS addressable), and what is
+ * added is a second, independently suppressible finding on the path where the
+ * existence check stays silent.
+ */
+declare const HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
+/** One syntactic write shape the extractor recognizes. */
+interface HookBodyWritePattern {
+    /** Stable pattern id, carried on every extracted write. */
+    readonly id: string;
+    /** Author-facing syntax summary (for docs/diagnostics, not matching). */
+    readonly syntax: string;
+    /** Reconciliation fixture: extracting `source` must yield exactly `writes`. */
+    readonly example: {
+        readonly source: string;
+        readonly writes: ReadonlyArray<{
+            field: string;
+            object?: string;
+        }>;
+    };
+}
+declare const HOOK_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+/** A ledger pattern a given rule does NOT consume, and why. */
+interface BodyWritePatternExclusion {
+    /** The {@link HOOK_BODY_WRITE_PATTERNS} entry id being excluded. */
+    readonly id: string;
+    /** Why the shape does not mean the same thing on this rule's surface. */
+    readonly reason: string;
+}
+/**
+ * The ledger shapes THIS rule consumes.
+ *
+ * Declared rather than implied: before the ledger carried a shape the hook
+ * surface does not have, every write with no `object` was necessarily a
+ * `ctx.input` write, and the rule could branch on that alone. It no longer can
+ * — a `record-property-assign` write also carries no object, and would have
+ * been reported as "the hook writes 'stage' to its input", which is false.
+ * Each consumer declaring its own subset is what stops the next added shape
+ * from silently landing in a branch that was never written for it.
+ */
+declare const HOOK_BODY_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const HOOK_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$H = Record<string, unknown>;
+/** One statically-extracted field write found in an L2 body. */
+interface ExtractedHookBodyWrite {
+    /** Which {@link HOOK_BODY_WRITE_PATTERNS} entry matched. */
+    patternId: string;
+    /** Target object name; `undefined` = the hook's own target object(s). */
+    object?: string;
+    /** The `ctx.api` method for diagnostics (`insert`/`create`/`update`/`updateById`). */
+    method?: string;
+    field: string;
+}
+/** Everything one parse of an L2 body yields. */
+interface ExtractedHookBodyWriteSet {
+    /** Every literal write the {@link HOOK_BODY_WRITE_PATTERNS} ledger declares. */
+    writes: ExtractedHookBodyWrite[];
+    /**
+     * `ctx.record` is handed to something as a VALUE somewhere in the body — an
+     * argument, an assignment RHS, a spread, a return — rather than only having
+     * its properties read and written, or being truthiness/type tested.
+     *
+     * The action rule needs this to tell a dead snapshot write from a live one:
+     * `ctx.record.stage = 'won'; await ctx.api.object('d').update(ctx.record)`
+     * builds a payload and persists it, so the assignment is not a no-op. When
+     * this is true, no record write in the body can be judged, and none is
+     * reported. (One-level aliasing — `const r = ctx.record` — reads as an
+     * escape too, which is the safe direction: it suppresses findings.)
+     */
+    ctxRecordEscapes: boolean;
+    /**
+     * [#10653] Set when the body did not parse, so `writes` is whatever error
+     * recovery left readable rather than the body's actual write set.
+     *
+     * Absent means one of two things, and they are not the same: the body parsed,
+     * or the cheap pre-filter above rejected it before any parse. The filter is a
+     * raw-text scan for `ctx` / `Object`, and a body containing neither cannot
+     * match any pattern however it parses — so a skipped parse claims nothing and
+     * hides nothing.
+     *
+     * ## Whose fault an unparseable body is — asked, not assumed
+     *
+     * The body is parsed inside a synthesised wrapper (`async function __body(ctx)
+     * { … }`) because that is the shape the runtime compiles it into
+     * (`new AsyncFunction('ctx', source)`). So a parse failure here could in
+     * principle be the WRAPPER's fault rather than the author's, and blaming the
+     * author for the checker's own bug is the failure this whole change is about.
+     * It cannot be: the wrapper is a constant, and `validate-hook-body-writes.
+     * test.ts` pins that it parses clean around an empty body and around every
+     * example in the pattern ledger. Any diagnostic therefore comes from the
+     * body — and its position is reported in the BODY's own coordinates (the
+     * wrapper's line is subtracted, and the result is clamped so it can never
+     * point at a line the author did not write).
+     */
+    parseFailure?: SourceParseFailure;
+}
+/**
+ * Extract every literal field write the pattern ledger declares from an L2
+ * body's source. Parse-only (the source is never executed), error-tolerant
+ * (a body with syntax errors simply yields fewer matches), and lazy: the
+ * TypeScript compiler is not loaded when no pattern can possibly match.
+ *
+ * Thin projection of {@link extractHookBodyWriteSet} — use that one when the
+ * `ctx.record` liveness signal matters, so the body is parsed once, not twice.
+ */
+declare function extractHookBodyWrites(source: string): ExtractedHookBodyWrite[];
+/** {@link extractHookBodyWrites} plus the `ctx.record` liveness signal, one parse. */
+declare function extractHookBodyWriteSet(source: string): ExtractedHookBodyWriteSet;
+/**
+ * Validate L2 hook-body writes against target-object field declarations.
+ * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
+ *
+ * ## Which intakes reach a hook authored as an inline `handler` (#16095)
+ *
+ * This rule opens on `body.language === 'js'`. A hook written as
+ * `handler: async (ctx) => { … }` carries no `body`, so whether it is judged
+ * is a property of the DOOR — what each caller hands this function — not of
+ * the rule. Measured (`packages/cli/test/lint-hook-rules-reach-handler-hooks*`):
+ *
+ * Every leg below was measured with the body-authored control beside it, so a
+ * silent leg is a reading about that door and never about this rule. The doors
+ * are the call sites of `runAuthoringRules`, enumerated — not the three `os *`
+ * commands, which are fewer than the doors:
+ *
+ *   `os build` union        `compile.ts` lowers every inline handler to a
+ *                           metadata body BEFORE its parse (`lowerCallables`)
+ *                           and judges the parsed result — REACHED, always was.
+ *   `os build` per-package  same lowered `result.data`, re-entered one package
+ *                           manifest at a time — REACHED, always was.
+ *   `os lint`               hands the registry's `parsed` tier that same
+ *                           lowered view — REACHED since #16095.
+ *   scaffold validate       `runScaffoldAuthoringRules` (`os init` / `dev` over
+ *                           a rendered template) lowers before it parses too —
+ *                           REACHED, always was, and pinned since #16095.
+ *   `os validate`           lowers before it parses since #16544 — the same
+ *                           `lowerCallables` call, between its pre-parse
+ *                           unknown-key lints and its parse — REACHED since
+ *                           #16544. Measured NOT reached under #16095, when it
+ *                           parsed the normalized stack without lowering while
+ *                           the body-authored control fired; closing it was
+ *                           its own accept/reject decision, taken on #16544.
+ *   direct call             judges exactly the stack it is given — NOT reached
+ *                           unless the caller lowers first; measured both ways.
+ *
+ * A handler the extractor refuses (forbidden token, free identifier,
+ * unparseable) is left with no `body` on every door, so this rule stays silent
+ * on it; the refusal itself is reported by `os lint`'s `hook-body/*` rules and
+ * by `os build`'s warn-and-bundle line, never guessed at here.
+ */
+declare function validateHookBodyWrites(stack: AnyRec$H): HookBodyWriteFinding[];
+
+type ReadonlyHookWriteSeverity = 'error' | 'warning';
+interface ReadonlyHookWriteFinding {
+    severity: ReadonlyHookWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `hook "touch_account" > body`. */
+    where: string;
+    /** Config path, e.g. `hooks[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const HOOK_API_UPDATE_READONLY_FIELD = "hook-api-update-readonly-field";
+declare const HOOK_API_UPDATE_READONLY_WHEN_FIELD = "hook-api-update-readonly-when-field";
+/**
+ * The `HOOK_BODY_WRITE_PATTERNS` shapes THIS rule consumes.
+ *
+ * Declared as data rather than implied by a branch, for the reason the sibling
+ * rules declare theirs: a write with no `object` is not a single thing (both
+ * `ctx.input` and `ctx.record` shapes carry none), so a future ledger addition
+ * must not be able to land silently in a branch never written for it.
+ */
+declare const READONLY_HOOK_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const READONLY_HOOK_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$G = Record<string, unknown>;
+/**
+ * Validate L2 hook-body `ctx.api` writes against target-object readonly
+ * declarations. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or
+ * post-parse stacks.
+ *
+ * ## Which intakes reach a hook authored as an inline `handler` (#16095)
+ *
+ * This rule opens on `body.language === 'js'`. A hook written as
+ * `handler: async (ctx) => { … }` carries no `body`, so whether it is judged
+ * is a property of the DOOR — what each caller hands this function — not of
+ * the rule. Measured (`packages/cli/test/lint-hook-rules-reach-handler-hooks*`):
+ *
+ * Every leg below was measured with the body-authored control beside it, so a
+ * silent leg is a reading about that door and never about this rule. The doors
+ * are the call sites of `runAuthoringRules`, enumerated — not the three `os *`
+ * commands, which are fewer than the doors:
+ *
+ *   `os build` union        `compile.ts` lowers every inline handler to a
+ *                           metadata body BEFORE its parse (`lowerCallables`)
+ *                           and judges the parsed result — REACHED, always was.
+ *   `os build` per-package  same lowered `result.data`, re-entered one package
+ *                           manifest at a time — REACHED, always was.
+ *   `os lint`               hands the registry's `parsed` tier that same
+ *                           lowered view — REACHED since #16095.
+ *   scaffold validate       `runScaffoldAuthoringRules` (`os init` / `dev` over
+ *                           a rendered template) lowers before it parses too —
+ *                           REACHED, always was, and pinned since #16095.
+ *   `os validate`           lowers before it parses since #16544 — the same
+ *                           `lowerCallables` call, between its pre-parse
+ *                           unknown-key lints and its parse — REACHED since
+ *                           #16544. Measured NOT reached under #16095, when it
+ *                           parsed the normalized stack without lowering while
+ *                           the body-authored control fired; closing it was
+ *                           its own accept/reject decision, taken on #16544.
+ *   direct call             judges exactly the stack it is given — NOT reached
+ *                           unless the caller lowers first; measured both ways.
+ *
+ * A handler the extractor refuses (forbidden token, free identifier,
+ * unparseable) is left with no `body` on every door, so this rule stays silent
+ * on it; the refusal itself is reported by `os lint`'s `hook-body/*` rules and
+ * by `os build`'s warn-and-bundle line, never guessed at here.
+ */
+declare function validateReadonlyHookWrites(stack: AnyRec$G): ReadonlyHookWriteFinding[];
+
+type ReadonlyActionWriteSeverity = 'warning';
+interface ReadonlyActionWriteFinding {
+    /** Advisory by contract - the conditional strip is per record state. */
+    severity: ReadonlyActionWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `action "freeze_invoice" > body`. */
+    where: string;
+    /** Config path, e.g. `actions[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/** Rule id (registry entry). */
+declare const ACTION_API_UPDATE_READONLY_WHEN_FIELD = "action-api-update-readonly-when-field";
+/**
+ * The `HOOK_BODY_WRITE_PATTERNS` shapes THIS rule consumes.
+ *
+ * Declared as data rather than implied by a branch, for the reason the sibling
+ * rules declare theirs: a write with no `object` is not a single thing (both
+ * `ctx.input` and `ctx.record` shapes carry none), so a future ledger addition
+ * must not be able to land silently in a branch never written for it.
+ */
+declare const READONLY_ACTION_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const READONLY_ACTION_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$F = Record<string, unknown>;
 /**
- * Validate flow `update_record` writes against target-object readonly
- * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
+ * Validate L2 action-body `ctx.api` writes against target-object `readonlyWhen`
+ * declarations. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or
+ * post-parse stacks.
  */
-declare function validateReadonlyFlowWrites(stack: AnyRec$B): ReadonlyFlowWriteFinding[];
+declare function validateReadonlyActionWrites(stack: AnyRec$F): ReadonlyActionWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -540,14 +1489,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$A = Record<string, unknown>;
+type AnyRec$E = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$A): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$E): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -560,8 +1509,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$z = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$z, opts?: {
+type AnyRec$D = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$D, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -574,8 +1523,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$y = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$y): ReactPageFinding[];
+type AnyRec$C = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$C): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -586,7 +1535,7 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$x = Record<string, unknown>;
+type AnyRec$B = Record<string, unknown>;
 /**
  * The source could not be parsed, so the prop checks below read a partially
  * recovered tree (#10653).
@@ -604,65 +1553,29 @@ type AnyRec$x = Record<string, unknown>;
  * says the true thing: these checks did not get to run.
  */
 declare const REACT_PAGE_SOURCE_UNPARSEABLE = "react-page-source-unparseable";
+/**
+ * [#11284] A prop written in a deprecated react-tier spelling (maintainer
+ * ruling 2026-08-23: the react tier converges on the metadata-tier
+ * vocabulary, deprecate-first). Warning, never error: the old spelling keeps
+ * working for the whole deprecation window — this is the loud half of
+ * "alias + loud deprecation", same shape as `approval-approver-type-deprecated`.
+ */
+declare const REACT_PROP_DEPRECATED = "react-prop-deprecated";
+/**
+ * [#14791] A prop written in a react-tier spelling the contract has RETIRED
+ * (maintainer ruling 2026-09-07: `<ListView objectName>` / `viewType` go with
+ * no deprecation window). Error, never warning: the contract no longer
+ * publishes the spelling, and the finding carries the prescription — the
+ * react-tier twin of a metadata schema's `retiredKey()` tombstone.
+ */
+declare const REACT_PROP_RETIRED = "react-prop-retired";
 declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 declare const REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 declare const REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 declare const REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
-declare function validateReactPageProps(stack: AnyRec$x): ReactPropFinding[];
-
-/** What a caller needs to tell an author WHICH source went unread, and where. */
-interface SourceParseFailure {
-    /** The first parse diagnostic, in the compiler's own wording, flattened to one line. */
-    message: string;
-    /** 1-based line, in the AUTHORED source's coordinates (see `synthesizedLinesBefore`). */
-    line: number;
-    /** 1-based column. */
-    column: number;
-    /** How many parse diagnostics in total — `message` is the first of `count`. */
-    count: number;
-}
-/** A parse plus the verdict on whether it succeeded. `failure` absent ⇒ it parsed. */
-interface CheckedParse {
-    /**
-     * The tree, ALWAYS returned — including when `failure` is set. Error recovery
-     * produces a partial tree, and a caller that already reports findings from it
-     * keeps doing so: the fix here is the missing SIGNAL, not the removal of
-     * whatever the recovered tree could still be read for.
-     */
-    sourceFile: ts.SourceFile;
-    /** Set when the parser reported at least one syntax diagnostic. */
-    failure?: SourceParseFailure;
-}
-interface CheckedParseOptions {
-    target: ts.ScriptTarget;
-    setParentNodes: boolean;
-    scriptKind: ts.ScriptKind;
-    /**
-     * Lines the CALLER synthesised ahead of the authored source, subtracted from
-     * the reported position so it lands in the author's coordinates.
-     *
-     * `validate-hook-body-writes.ts` parses an L2 hook body wrapped in
-     * `async function __body(ctx) {\n…\n}` — the shape the runtime compiles it
-     * into — so its diagnostics are one line low. The reported line is clamped to
-     * at least 1, so a diagnostic that lands on a synthesised line is attributed
-     * to the nearest AUTHORED line and never to a line the author did not write.
-     */
-    synthesizedLinesBefore?: number;
-}
-/**
- * The one wording every caller's message embeds, so three findings about the
- * same defect do not describe it three ways.
- */
-declare function describeParseFailure(failure: SourceParseFailure): string;
-/**
- * The hint every caller's finding carries. It says what the finding IS — a
- * statement about what the checker could read, not a second syntax verdict —
- * because a source that does not parse is not scored, and an author who reads
- * "no problems found" about it would be reading a green line that lied.
- */
-declare const PARSE_FAILURE_HINT: string;
+declare function validateReactPageProps(stack: AnyRec$B): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -674,8 +1587,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$w = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$w): SourceStyleFinding[];
+type AnyRec$A = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$A): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -719,14 +1632,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$v = Record<string, unknown>;
+type AnyRec$z = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$v): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$z): RecordTitleFinding[];
 
 declare const FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 declare const FIELD_GROUP_EMPTY = "field-group-empty";
@@ -748,16 +1661,23 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$u = Record<string, unknown>;
+type AnyRec$y = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$u): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$y): SemanticRoleFinding[];
 
 declare const FORM_FIELD_UNKNOWN = "form-field-unknown";
 declare const FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
+/**
+ * [#13855] A section's `group` names a field group the bound object does not
+ * declare. The reference form inherits the section's whole membership from that
+ * group, so a dangling key leaves the section with no members and it does not
+ * render at all. Advisory like both rules above — see `object-field-groups.ts`.
+ */
+declare const FORM_SECTION_GROUP_UNKNOWN = "form-section-group-unknown";
 type FormLayoutSeverity = 'error' | 'warning';
 interface FormLayoutFinding {
     /** Always `warning` today — both rules are advisory (see module note). */
@@ -773,12 +1693,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$t = Record<string, unknown>;
+type AnyRec$x = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$t): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$x): FormLayoutFinding[];
 
 declare const VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 declare const VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
@@ -791,6 +1711,15 @@ declare const VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
  * consequence is identical, the FIX is not, and `--json` consumers key on the id.
  */
 declare const VISIBILITY_PREDICATE_OVER_BUDGET = "visibility-predicate-over-budget";
+/**
+ * A predicate calling a function the CEL environment does not register —
+ * #13594, the scoped supersession of this file's parse-only ruling (see the
+ * module note's §Function existence). A separate id from
+ * {@link VISIBILITY_PREDICATE_SYNTAX} for the same reason `over-budget` is one:
+ * the source parses perfectly, so the dialect prescription cannot succeed on it
+ * and `--json` consumers key on the id.
+ */
+declare const VISIBILITY_PREDICATE_UNKNOWN_FUNCTION = "visibility-predicate-unknown-function";
 type VisibilitySeverity = 'error' | 'warning';
 /**
  * Which binding environment the linted surface belongs to (ADR-0089 §Context):
@@ -818,9 +1747,9 @@ interface VisibilityOptions {
 interface VisibilityFinding {
     /**
      * `warning` for the ADR-0089 D3b advisory (`visibility-root-mislayered`);
-     * `error` for the three rules that gate — `visibility-predicate-syntax`,
-     * `visibility-predicate-over-budget` and `visibility-bare-identifier` (see
-     * module note).
+     * `error` for the four rules that gate — `visibility-predicate-syntax`,
+     * `visibility-predicate-over-budget`, `visibility-predicate-unknown-function`
+     * and `visibility-bare-identifier` (see module note).
      */
     severity: VisibilitySeverity;
     /** Diagnostic rule id, e.g. `visibility-root-mislayered`. */
@@ -834,7 +1763,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$s = Record<string, unknown>;
+type AnyRec$w = Record<string, unknown>;
 /**
  * Validate conditional-visibility predicates across authored views and pages.
  *
@@ -847,8 +1776,10 @@ type AnyRec$s = Record<string, unknown>;
  *
  * Returns findings (empty = clean). `visibility-root-mislayered` is advisory
  * (`warning`); `visibility-predicate-syntax` (#6253),
- * `visibility-predicate-over-budget` (#7217) and `visibility-bare-identifier`
- * (#6128) are `error` and the caller is expected to fail the build on them.
+ * `visibility-predicate-over-budget` (#7217),
+ * `visibility-predicate-unknown-function` (#13594) and
+ * `visibility-bare-identifier` (#6128) are `error` and the caller is expected to
+ * fail the build on them.
  *
  * The binding-root check is layer-directional (ADR-0089 D3). A form view that
  * declares `data: { provider: 'schema', schemaId }` is judged at `metadata` on
@@ -857,9 +1788,11 @@ type AnyRec$s = Record<string, unknown>;
  * predicate is flagged), or leave it at the `'runtime'` default for `*.view.ts` /
  * `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The syntax and
  * bare-identifier checks are layer-agnostic — but the ROOT their hints prescribe
- * is not, which is the second half of what #7815 fixes.
+ * is not, which is the second half of what #7815 fixes. The unknown-function
+ * check (#13594) is layer-agnostic in both halves: it prescribes a NAME, and the
+ * environment registers the same names on every layer.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$s, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$w, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
 declare const PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
@@ -902,7 +1835,7 @@ interface PredicatePathOptions {
      */
     resolveSchema?: (schemaId: string) => unknown;
 }
-type AnyRec$r = Record<string, unknown>;
+type AnyRec$v = Record<string, unknown>;
 /**
  * Refuse a metadata-form predicate that names a path the target schema does not
  * declare (#7010).
@@ -931,7 +1864,7 @@ type AnyRec$r = Record<string, unknown>;
  *
  * Returns findings (empty = clean).
  */
-declare function validatePredicatePathRefs(stack: AnyRec$r, opts?: PredicatePathOptions): PredicatePathFinding[];
+declare function validatePredicatePathRefs(stack: AnyRec$v, opts?: PredicatePathOptions): PredicatePathFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -949,12 +1882,12 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$q = Record<string, unknown>;
+type AnyRec$u = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$q): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$u): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
@@ -980,12 +1913,12 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$p = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$p): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$t): ApprovalApproverFinding[];
 
 type SeedReplaySafetySeverity = 'error' | 'warning';
 interface SeedReplaySafetyFinding {
@@ -999,7 +1932,7 @@ interface SeedReplaySafetyFinding {
     hint: string;
 }
 declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
-type AnyRec$o = Record<string, unknown>;
+type AnyRec$s = Record<string, unknown>;
 /**
  * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
  * mode, which duplicates its rows on every replay boot (framework#3434). Returns
@@ -1009,7 +1942,7 @@ type AnyRec$o = Record<string, unknown>;
  * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
  * with no `data` array yields no findings.
  */
-declare function validateSeedReplaySafety(stack: AnyRec$o): SeedReplaySafetyFinding[];
+declare function validateSeedReplaySafety(stack: AnyRec$s): SeedReplaySafetyFinding[];
 
 type SeedStateMachineSeverity = 'warning';
 interface SeedStateMachineFinding {
@@ -1023,7 +1956,7 @@ interface SeedStateMachineFinding {
     hint: string;
 }
 declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
-type AnyRec$n = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Flag every seed record whose `state_machine`-governed field carries a value
  * the machine does not declare (framework#3433 follow-up). Returns the findings
@@ -1036,7 +1969,7 @@ type AnyRec$n = Record<string, unknown>;
  * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
  * statically compared to the declared-state set.
  */
-declare function validateSeedStateMachine(stack: AnyRec$n): SeedStateMachineFinding[];
+declare function validateSeedStateMachine(stack: AnyRec$r): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -1048,9 +1981,11 @@ declare const SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unkno
 declare const SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
 declare const SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
 declare const SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
+declare const SECURITY_FLS_UNKNOWN_FIELD = "security-fls-unknown-field";
 declare const SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 declare const SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
 declare const SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
+declare const SECURITY_CBP_AMBIGUOUS_RELATION = "security-controlled-by-parent-ambiguous-relation";
 type SecuritySeverity = 'error' | 'warning' | 'info';
 interface SecurityFinding {
     severity: SecuritySeverity;
@@ -1065,7 +2000,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$m = Record<string, unknown>;
+type AnyRec$q = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -1073,7 +2008,7 @@ type AnyRec$m = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$m, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$q, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 /**
@@ -1104,94 +2039,8 @@ declare function validateSecurityPosture(stack: AnyRec$m, opts?: {
  * carries `positions`/`apps` and both types are gated — at which point it
  * crosses whole, in one edit, as its own entry.
  */
-declare function validateSecurityRoleWord(stack: AnyRec$m): SecurityFinding[];
-
-/**
- * [ADR-0105 D6] The two organization-axis red lines, enforced at authoring time.
- *
- * ADR-0105 gives organizations a reporting/grouping dimension
- * (`sys_organization.parent_organization_id`, sibling ordering). That dimension
- * is load-bearing for consolidated reporting — and dangerous, because it LOOKS
- * like a permission hierarchy. Two lines keep it from becoming one:
- *
- * | Rule                                    | Red line                          |
- * |-----------------------------------------|-----------------------------------|
- * | org-axis-permission-inheritance (error) | D6 ①: no inheritance along the org tree |
- * | org-axis-cross-org-bu-grant     (error) | D6 ②: business-unit trees stay org-internal |
- *
- * **① No permission inheritance along the org axis.** Cross-organization
- * visibility comes from membership union (`accessible_org_ids`, ADR-0105 D2) —
- * the engine's own Layer 0 wall — never from walking a parent reference. An RLS
- * policy or sharing rule that reads `parent_organization_id` builds a SECOND
- * permission hierarchy beside the business-unit tree: exactly the dual-hierarchy
- * mistake ADR-0057 D5 retired and ADR-0090 D3 finalized for positions. It also
- * silently outranks the wall it sits behind, since a Layer-1 policy cannot widen
- * Layer 0 (W1) — so the author gets a rule that appears to grant access and
- * does not. Fail at authoring, not in a support ticket.
- *
- * **② Business-unit trees remain org-internal.** `sys_business_unit` is
- * org-scoped and every BU mechanism (`unit_and_subordinates` sharing,
- * `adminScope` delegation, depth scopes) resolves within ONE organization. A
- * business-unit sharing rule on a PLATFORM-GLOBAL object (`tenancy.enabled:
- * false`) has no organization column to scope against, so the grant spans every
- * organization in the database — a cross-org BU grant by construction, and the
- * "cross-org BU mega-tree" the ADR rejected, arrived at by accident. It covers
- * BOTH business-unit recipients, `business_unit` and `unit_and_subordinates`
- * — see {@link BU_TREE_RECIPIENT_TYPES} for the word list and its deliberate
- * complement.
- *
- * Both are `error`, per ADR-0049 discipline: each mirrors a real enforcement
- * property (the Layer 0 wall's independence; the org-predicated BU resolver),
- * so the lint moves the failure from silent-wrong-answer to author-time fix-it.
- *
- * Pure `(stack) => Finding[]`; accepts the NORMALIZED stack input.
- *
- * ## Scope — the keys this rule reads, and the ones it deliberately does not
- *
- * Every key below is one `@objectstack/spec` DECLARES. That is a contract, not
- * a style preference: the rule is registered `input: 'parsed'`, so what it sees
- * is what `ObjectStackSchema` returned. An undeclared key never survives to be
- * read — the stack root strips it, and the `.strict()` sub-schemas reject the
- * whole stack outright — so a branch keyed on one is inert for every stack an
- * author can actually ship (#4984, #5009).
- *
- * | Read                                  | Declared by                        |
- * |---------------------------------------|------------------------------------|
- * | `permissions[]`                       | `ObjectStackSchema`                |
- * | `permissions[].rowLevelSecurity[]`    | `PermissionSetSchema`              |
- * | `…[].using` / `…[].check`             | `RowLevelSecurityPolicySchema`     |
- * | `sharingRules[]`                      | `ObjectStackSchema`                |
- * | `sharingRules[].condition` / `.sharedWith` / `.object` | `SharingRuleSchema` |
- * | `objects[].tenancy` / `.systemFields` | `ObjectSchema`                     |
- *
- * NOT read, and each for a reason that is a schema fact:
- *
- * - `permissionSets` / `sharing` — not declared on the stack root. The root
- *   STRIPS them, so after parse they are `undefined` no matter what the author
- *   wrote. The declared spellings are `permissions` and `sharingRules`.
- * - `sharingRules[].objectName` — `SharingRuleSchema` is `.strict()` and knows
- *   it only as a rejected name; `object` is required, so the canonical read can
- *   never be missing on a rule that parsed.
- * - `objects[].rowLevelSecurity` / `objects[].rls` — **object-level RLS is not
- *   an authoring surface at all.** `ObjectSchema` declares neither key (nor
- *   does `authorable-surface.json` list one: the sole entry is
- *   `security/PermissionSet:rowLevelSecurity`), and `ObjectSchema` is
- *   `.strict()`, so a stack carrying one does not parse — it is refused with
- *   "Unrecognized key(s) on this object". Until #5009 this file walked that
- *   non-existent surface for ~20 lines, complete with an `objects[N].
- *   rowLevelSecurity[M].using` diagnostic path. Nothing could reach it, and the
- *   cost was never the missed finding: the next author to read this rule (human
- *   or AI) came away believing object-level RLS was a real authorization
- *   surface and wrote more code against it (#5008 nearly did). RLS policies
- *   live on a permission set; that is the branch above.
- *
- * Alias tolerance belongs at the schema's refusal, not in a consumer (Prime
- * Directive #12) — where it also converts a loud, named rejection into a
- * silently-inert gate. `validate-org-axis-red-lines.test.ts` pins all of this
- * structurally: every key read here is checked against the declaring schema's
- * own `.shape`, and every `findings.push` site must be reachable by a fixture
- * that passed `safeParse`.
- */
+declare function validateSecurityRoleWord(stack: AnyRec$q): SecurityFinding[];
+
 declare const ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
 declare const ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
 type OrgAxisSeverity = 'error' | 'warning';
@@ -1273,86 +2122,6 @@ interface RlsPredicateFinding {
  */
 declare function validateRlsPredicateEnforceability(stack: unknown): RlsPredicateFinding[];
 
-/**
- * [ADR-0049 — references] Reference-integrity for dashboard header action
- * targets (issue #3367).
- *
- * ADR-0049 established the "enforce-or-remove" gate for spec *properties*: a
- * declared property the runtime does not honour is a false promise and must be
- * enforced, marked experimental, or removed. This rule applies the SAME honesty
- * principle to *references*. A dashboard header action names a target — a
- * `script`/`modal` action, or a `url` route — that must actually resolve. A
- * dangling target ships a button that renders and, on click, silently does
- * nothing: a false affordance, exactly the failure ADR-0049 exists to prevent,
- * just for a reference rather than a property.
- *
- * Nothing in the protocol schema can express this: `actionUrl` is a free string,
- * so `{ actionType: 'script', actionUrl: 'export_dashboard_pdf' }` parses and
- * ships even when no such action is defined anywhere in the stack.
- *
- * Surfaces checked:
- *   - dashboard `header.actions[]` — each `{ actionType, actionUrl }`
- *
- * ## The widget branch, and why it is gone (#5010)
- *
- * This rule used to check `widgets[].actionUrl` too, describing it as "the
- * per-widget button" and claiming in this docblock that it "mirrors the objectui
- * runtime dispatch". It did not: no renderer in either repo has ever drawn a
- * per-widget action button — all 14 `actionUrl` reads in `DashboardRenderer` are
- * scoped to `header.actions[]`. So the strictest arm of this rule (a dangling
- * `script`/`modal` target is an ERROR, i.e. a failed build) was enforcing
- * referential integrity for a button that could not render. An author could be
- * blocked from shipping because a control that does not exist pointed at an
- * action that also did not.
- *
- * That inversion — a rule written to delete false affordances, itself sustaining
- * one — is why the widget keys were retired rather than the check merely
- * relaxed: `widgets[].actionUrl` / `actionType` / `actionIcon` are now tombstoned
- * in `@objectstack/spec` 17.0.0, so authoring one is a `tsc` error and a parse
- * error carrying the prescription. There is no widget target left to resolve.
- *
- * Resolution mirrors the objectui runtime dispatch (`DashboardRenderer`
- * hands the target to the SHARED `useActionModal` since objectui#4782) so the
- * lint flags exactly what would fail to resolve at runtime:
- *
- *   actionType 'script' → `actionUrl` must name a DEFINED action (`stack.actions`
- *       or any `object.actions`, by `name`). A script target that names no
- *       defined action fails open at runtime ("action not found"). → ERROR.
- *
- *   actionType 'modal'  → `actionUrl` names a declared PAGE (`stack.pages`), and
- *       only a page — maintainer ruling objectstack#6739-A (2026-08-09). This
- *       rule used to accept a defined action name, a bare object name, and the
- *       `<verb>_<object>` convention (create_/new_/add_/edit_/update_ + object),
- *       on the claim that it mirrored `DashboardView`'s own modal handler. That
- *       handler — the convention's last live copy — was deleted by objectui#4782
- *       (after objectui#4764 retired the object fallback in `useActionModal`):
- *       the runtime resolves a string modal target against page metadata and
- *       REFUSES everything else, so each retired limb here blessed a button that
- *       dispatches to a named refusal at runtime. The ruling explicitly declined
- *       the middle shape (keep the prefix, reject bare object names): a target
- *       names the page `create_opportunity`, or it names nothing. Opening an
- *       object's form is `actionType: 'form'`. Otherwise → ERROR.
- *
- *   actionType 'url'    → a relative in-app path. WARN when a recognizable
- *       `<collection>/<name>` segment (objects/reports/dashboards/pages/views)
- *       names an entity that does not exist in this stack. External URLs
- *       (`http(s)://`, `//`), interpolated targets (`${…}`), and opaque routes
- *       (no recognized collection segment) are skipped — they cannot be resolved
- *       statically and may be host/app/plugin routes. → WARNING.
- *
- *   actionType 'flow' | 'api' — not checked: flow targets resolve against the
- *       automation engine / other packages, and api targets are opaque endpoints.
- *       Out of scope for #3367.
- *
- * Severity split follows the issue's acceptance criteria: an undefined
- * `script`/`modal` target FAILS validation (a genuine dead reference that fails
- * open at runtime as a dead button); an unresolved `url` route is advisory
- * (route resolution is app-context-dependent, and a path may be served by
- * another installed package or a host/console route). External, interpolated,
- * convention, and opaque targets are exempted to keep false positives near zero
- * — the same conservative posture as the sibling `lint-view-refs` and
- * `validate-capability-references` rules.
- */
 declare const DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
 declare const DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
 type DashboardActionRefSeverity = 'error' | 'warning';
@@ -1370,13 +2139,13 @@ interface DashboardActionRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$l = Record<string, unknown>;
+type AnyRec$p = Record<string, unknown>;
 /**
  * Validate every dashboard header action reference in a stack. Returns
  * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
  * unresolved routes are warnings.
  */
-declare function validateDashboardActionRefs(stack: AnyRec$l): DashboardActionRefFinding[];
+declare function validateDashboardActionRefs(stack: AnyRec$p): DashboardActionRefFinding[];
 
 /**
  * Build-time filter-placeholder diagnostics (issue #3574).
@@ -1460,9 +2229,82 @@ interface FilterTokenFinding {
  */
 declare function validateFilterTokens(stack: Record<string, unknown> | undefined | null): FilterTokenFinding[];
 
+/** Diagnostic rule id. */
+declare const FLOW_FILTER_TOKEN_UNKNOWN = "flow-filter-token-unknown";
+interface FlowFilterTokenFinding {
+    /** Always `error` — the node throws a guard refusal instead of running. */
+    severity: 'error';
+    rule: string;
+    /** Human-readable location, e.g. `flow "opportunity_stagnation"`. */
+    where: string;
+    /** Config path, e.g. `flows[2].nodes[1].config.filter.close_date.$lt`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/**
+ * Validate flow-node filter placeholders across a schema-parsed stack.
+ *
+ * Pure `(stack) => Finding[]`; no I/O.
+ */
+declare function validateFlowFilterTokens(stack: Record<string, unknown> | undefined | null): FlowFilterTokenFinding[];
+
+/** The two names legal only as a whole token (`{TODAY() + 7}`), never in a call. */
+declare const FLOW_TEMPLATE_DATE_FUNCTIONS: readonly string[];
+/**
+ * The value-expression function table — the CEL stdlib's numeric six, by the
+ * #11060 ruling. Mirrors `EXPRESSION_FUNCTION_ARITY`'s key set.
+ */
+declare const FLOW_TEMPLATE_VALUE_FUNCTIONS: readonly string[];
+/** What the flow template dialect does with one whole-string `{…}` token. */
+type FlowTemplateTokenVerdict = 
+/** `{NOW()}` / `{TODAY() - 45}` — the evaluator resolves it. Legitimate. */
+{
+    kind: 'date-function';
+    name: string;
+}
+/** `{$User.Id}` — the evaluator resolves it from the run context. */
+ | {
+    kind: 'user-context';
+}
+/**
+ * `{recordId}` / `{record.id}` — a `VariableMap` lookup, and the position
+ * from which an unresolved name is handed to the filter dialect. OPEN: not
+ * decidable from authored metadata, so never a finding.
+ */
+ | {
+    kind: 'variable-path';
+    head: string;
+}
+/**
+ * A call to a name in NEITHER table. `resolveToken` throws
+ * `FlowExpressionFunctionError` here (a guard refusal — a `fault` edge must
+ * not swallow it), so the node cannot run. THIS is the finding.
+ */
+ | {
+    kind: 'unknown-function';
+    name: string;
+}
+/**
+ * Anything else — junk shapes (`{30 days ago}`) and arithmetic over names
+ * this module cannot resolve. `resolveToken` answers `undefined` and the
+ * CRUD collapse guard (#3810) reports it at run time. Open, not judged.
+ */
+ | {
+    kind: 'unresolvable-shape';
+};
+/**
+ * Classify the INSIDE of one whole-string `{…}` filter token — `inner` is the
+ * text between the braces, exactly as authored.
+ *
+ * Mirrors `resolveToken`'s dispatch order (see the module header). Holds no
+ * severity and knows nothing about where the token was found.
+ */
+declare function classifyFlowTemplateToken(inner: string): FlowTemplateTokenVerdict;
+
 /**
- * Build-time refusal of a bare dashboard date-range PRESET name in an ordering
- * comparand (#8793 — the ruled C half of #8690).
+ * Build-time refusal of a bare dashboard date-range PRESET name authored as a
+ * filter comparand — two arms, one wording.
  *
  * `last_7_days` / `last_30_days` / `last_90_days` and their ten calendar
  * siblings are REAL declared names (`DATE_RANGE_PRESETS`,
@@ -1488,10 +2330,10 @@ declare function validateFilterTokens(stack: Record<string, unknown> | undefined
  * (`['created_at', '>=', …]`) — and reports with the located `where` / `path`
  * the CLI commands render.
  *
- * ## The boundary — ordering positions only, in all three shapes
+ * ## Arm 1 — ordering positions, FIELD-AGNOSTIC (#8793)
  *
- * This rule is field-agnostic, so the judgement rides on POSITION, exactly as
- * the schema door's #8793 note lays out at length:
+ * The judgement rides on POSITION alone, exactly as the schema door's #8793
+ * note lays out at length:
  *
  * - **Judged:** `$gt` / `$gte` / `$lt` / `$lte` comparands and `$between`
  *   endpoints (Mongo shape); `>` / `>=` / `<` / `<=` / `between` triples and
@@ -1499,17 +2341,105 @@ declare function validateFilterTokens(stack: Record<string, unknown> | undefined
  *   `greater_than` / `less_than` / `greater_than_or_equal` /
  *   `less_than_or_equal` / `before` / `after` / `between` view filter rules
  *   and every alias `normalizeFilterOperator` folds onto them. An ORDERED
- *   comparison against a declared preset name has no legitimate reading.
- * - **Not judged:** equality and membership (`=`, `equals`, `$eq`, `$ne`,
- *   `$in`, `$nin`, …). A select/picklist column legitimately stores values
- *   that collide with preset names (`GlobalFilterSchema`'s own pins protect
- *   `type: 'select', defaultValue: 'this_quarter'`), and on a declared
- *   temporal field the engine door still refuses these at query time with the
- *   field's type in hand.
+ *   comparison against a declared preset name has no legitimate reading on
+ *   ANY column, so no field type is needed to refuse it.
  * - **Only the 13 declared names.** A near-miss (`last_60_days`) is not this
  *   rule's business — on a temporal field the engine's field-typed door
  *   catches it; judging undeclared strings here would be a guessed superset.
  *
+ * ## Arm 2 — equality and membership positions, FIELD-TYPED (#16106)
+ *
+ * Equality (`{ period: 'this_quarter' }`, `$eq`, `$ne`) and membership (`$in`
+ * / `$nin`) CANNOT be judged blind: a select/picklist column legitimately
+ * stores values that collide with preset names (`GlobalFilterSchema`'s own
+ * pins protect `type: 'select', defaultValue: 'this_quarter'`), and equality
+ * against such a stored value is a working filter. That is why the schema
+ * door — field-agnostic by construction — keeps its ordering-only boundary,
+ * and why this arm exists HERE, where the stack's object metadata is in hand:
+ * maintainer-ruled 2026-09-06 (#16106, comment 5557019138, adopting
+ * recommendation 1′): *at a layer that holds the object metadata, a declared
+ * `date` / `datetime` field refuses one of the 13 declared preset names in
+ * EVERY comparand position — bare (implicit equality), `$eq` / `$ne`, `$in` /
+ * `$nin` and their view-rule and triple spellings, alongside the ordering
+ * positions already judged.* Same message, same prescription (the #5240
+ * convention): the window the preset already means is exactly what an author
+ * writing `close_date == 'last_30_days'` intended.
+ *
+ * Measured first (ruling item 3), as real queries on a declared `date` field
+ * (`close_date`) and a declared `datetime` sibling, on two real drivers —
+ * `@objectstack/driver-memory` and `@objectstack/driver-sqlite-wasm` — 30 rows
+ * seeded / 20 inside a 30-day window; both drivers answered identically:
+ *
+ * ```
+ * close_date: 'last_30_days'              REFUSED  INVALID_FILTER / 400   (bare)
+ * close_date: { $eq:  'last_30_days' }    REFUSED  INVALID_FILTER / 400
+ * close_date: { $in: ['last_30_days'] }   REFUSED  INVALID_FILTER / 400
+ * close_date: { $ne / $nin … }            REFUSED  INVALID_FILTER / 400
+ * close_date: { $gte: '{30_days_ago}' }   200      count=20   <- positive control
+ * close_date: '2026-09-03'                200      count=1    <- equality works on a date
+ * stage: 'this_quarter'  (select column)  200      count=10   <- the picklist case, alive
+ * ```
+ *
+ * So at QUERY time the engine door already refuses every residue position on a
+ * declared temporal field — the residue was purely an AUTHORING-time gap:
+ * `objectstack lint` passed and `defineStack` accepted a filter the runtime
+ * then refused with a 400 on first render. This arm closes that gap where the
+ * AI author's correction loop can see it.
+ *
+ * ### Which object a filter is judged against
+ *
+ * `walkAuthoredFilters` finds the subtrees; this arm re-walks each subtree's
+ * config path back through its ancestors and binds the filter to the NEAREST
+ * ancestor that declares an object, in the spellings the carriers actually
+ * use (each one the same read a sibling rule already makes at that position):
+ *
+ * - a literal `object` / `objectName` — a dataset, a summary field's child
+ *   object, a global filter's `optionsFrom`, a page data source, a
+ *   `record:related_list`'s `properties`, a time-relative trigger;
+ * - a `dataset` name, resolved to that dataset's `object` — dashboard widgets
+ *   (`validate-widget-bindings`, #14148), reports and report blocks;
+ * - `data: { provider: 'object', object }` — standalone views and list views
+ *   (`validate-list-view-field-refs`, #14107); any OTHER provider names no
+ *   object, so the position is unjudged;
+ * - `config.objectName` / `config.object` — flow CRUD nodes
+ *   (`validate-flow-node-writes`), a templated `{…}` value skipped;
+ * - `dataSource.object`, then `properties.object` / `properties.objectName`
+ *   — page components (`validate-page-field-bindings`);
+ * - `publicPicker.object`, else the enclosing form field's `reference`
+ *   resolved on the view's object, else NOTHING — a form field's public-lookup
+ *   picker (`FormFieldPublicPickerSchema`) queries the REFERENCED object, so
+ *   its `filter` must never fall through to the parent form object (#16106
+ *   review finding B1: that fall-through was a false refusal wherever the two
+ *   objects share a field name with differing types);
+ * - and, under `objects`, the object itself — its list views, tabs and
+ *   `relatedListFilter` (the filter runs over the CHILD rows, i.e. the object
+ *   that owns the field).
+ *
+ * The field key (a bare name, or a dotted relationship path) is then resolved
+ * through `resolveFieldPath` (`object-graph.ts`), and the comparand is judged
+ * only when the LEAF resolves to an author-declared field of type `date` or
+ * `datetime` — the two types the ruling names.
+ *
+ * ### What this arm deliberately does NOT judge
+ *
+ * Every one of these is a MISSED CATCH (the engine door still refuses it at
+ * query time, field type in hand), never a false build error:
+ *
+ * - a position no ancestor binds (an app-level filter, a dashboard-level
+ *   filter outside a widget), a dataset or object the stack does not declare,
+ *   an object with no readable field map, a view on a non-`object` provider;
+ * - a leaf that resolves only as a registry-INJECTED column (`created_at`,
+ *   `updated_at`, …): the object graph carries no type for those — their type
+ *   is registry-owned and invisible here (`FieldPathVerdict`'s own contract);
+ * - a `time` field: the ruling names `date` / `datetime`, and a wall-clock
+ *   column has no preset-shaped authoring slip worth a rule of its own;
+ * - a field the object does not declare at all (a typo) — that is the
+ *   `*-filter-field-unknown` rules' finding, not a second one here.
+ *
+ * The implicit-equality position is reported under the operator it LOWERS to,
+ * `$eq`, at the path of the field itself (`…filter.close_date`, no operator
+ * segment), so the located path still says exactly what was authored.
+ *
  * Both vocabularies' `{placeholder}` spellings never collide with a preset
  * name (a preset carries no braces), so this rule and `validate-filter-tokens`
  * cannot double-report one value.
@@ -1533,9 +2463,10 @@ interface PresetComparandFinding {
 /**
  * Validate every authored filter across a stack for bare preset comparands.
  *
- * Pure `(stack) => Finding[]`; no I/O. Needs no resolution context — the
- * judgement is on the filter literal alone — which is what qualifies it for
- * the runtime publish gate's per-write snapshot.
+ * Pure `(stack) => Finding[]`; no I/O. Arm 1 judges the filter literal alone;
+ * arm 2 additionally reads the stack's own `objects` (and `datasets`, to bind
+ * a widget or report) — both collections the runtime publish gate's per-write
+ * snapshot carries — and stays silent wherever they are absent.
  */
 declare function validatePresetComparands(stack: Record<string, unknown> | undefined | null): PresetComparandFinding[];
 
@@ -1585,12 +2516,12 @@ interface ObjectRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$k = Record<string, unknown>;
+type AnyRec$o = Record<string, unknown>;
 /**
  * Validate every object-name reference on the surfaces listed in the module
  * header. Returns findings (empty = clean).
  */
-declare function validateObjectReferences(stack: AnyRec$k): ObjectRefFinding[];
+declare function validateObjectReferences(stack: AnyRec$o): ObjectRefFinding[];
 
 type ReferenceIntegritySeverity = 'error' | 'warning';
 /**
@@ -1748,6 +2679,90 @@ type NavTargetRefFinding = ReferenceIntegrityFinding;
 declare const NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
 declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
 
+/**
+ * [#13216 — reference resolvability] A `type: 'page'` list view's `pageName`
+ * must name a page the stack actually declares.
+ *
+ * ## What the schema already settles, and what it cannot
+ *
+ * `ListViewSchema`'s `checkListViewPageMount` refuses a `page` view with no
+ * `pageName`, refuses `pageName` on any other view type, and refuses a
+ * `pageName` outside `SnakeCaseIdentifierSchema`'s grammar — so by the time a
+ * body reaches here the key is present, well-formed, and on the one view type
+ * that reads it. What a per-body parse cannot ask is whether the page EXISTS,
+ * because the answer lives in a sibling collection the body never sees. That is
+ * this rule's whole question, and it is the same question
+ * `validate-nav-target-refs` asks about the identical reference one surface
+ * over — `{ type: 'page', pageName }` on an app navigation item.
+ *
+ * ## Severity: warning, for its twin's reason
+ *
+ * `validate-nav-target-refs` explains why the honest ceiling for a page
+ * reference is advisory: unlike objects, pages have no curated
+ * cross-package registry, so "unresolved here" cannot be told apart from
+ * "provided by a package this stack cannot see". Nothing about mounting the
+ * same page on a view changes that, so the verdict matches its twin rather
+ * than inventing a second severity for one reference kind. `defineStack`'s
+ * `validateCrossReferences` still hard-fails first whenever the stack DOES
+ * declare pages — this rule is what speaks when that check has switched itself
+ * off (`pageNames.size > 0`), which is exactly the state a stack is in when
+ * the target was never written.
+ *
+ * ## Why it runs at the runtime publish gate too (`runtimeTypes: view`)
+ *
+ * The mount this rule guards is reachable in exactly the way #13100 measured:
+ * an agent publishes a page through the metadata API, then writes a view that
+ * mounts it. Both writes go through `PUT /api/v1/meta/view` — no CLI is
+ * involved anywhere on that path, so a build-time-only rule would never speak
+ * to the author who needs it. Crossing the member onto `view` snapshots is
+ * therefore the point, not a bonus.
+ *
+ * It is safe to cross ONLY because the per-write snapshot now carries `pages`
+ * (`RuntimeStackContext.pages`, added with this rule). Without that collection
+ * the member would not go quiet — it would report EVERY page mount as dead,
+ * which is the missing-collection false-positive channel
+ * `ReferenceIntegrityRule.runtimeTypes` exists to keep closed, and the reason
+ * `validateNavTargetRefs` is NOT crossed: nothing carries a snapshot's `apps`.
+ *
+ * ## The rungs, and why the list matches the sort rule's
+ *
+ * A `pageName` can be authored on every shape that carries a list view, and the
+ * #9313 lesson is that declaring `runtimeTypes` is necessary and NOT sufficient
+ * — the WALK has to reach the flattened top-level shape the write door actually
+ * carries, or the crossing is a silent no-op that reads as coverage. So the
+ * rungs are `validate-sortable-fields`' rungs, one key over:
+ *
+ *   - `objects[].listViews.<key>` — built-in named list views;
+ *   - `views[]` itself on a FLATTENED LIST OVERLAY (`viewKind: 'list'`, no
+ *     nested `config`) — the shape the runtime gate snapshots as `views: [item]`;
+ *   - `views[].config` on a standalone ViewItem RECORD (`viewKind: 'list'` with
+ *     a record-shaped `config`) — the shape a Studio-saved view round-trips as;
+ *   - `views[].list` — a `defineView` aggregate's default list;
+ *   - `views[].listViews.<key>` — its named list views.
+ *
+ * ## Not covered, deliberately
+ *
+ * An interpolated target (`${…}`) resolves at render time and is skipped — the
+ * conservative exemption `validate-nav-target-refs` and
+ * `validate-object-references` both use (ADR-0072 D1). It cannot currently
+ * arise (the schema's snake_case grammar refuses `$` and `{`), and is kept so
+ * this rule does not become the thing that has to change if the grammar ever
+ * widens.
+ *
+ * The view's `type` is NOT re-checked here. A body reaching a CLI command has
+ * been parsed; a body reaching `os lint` may not have been, and in that state
+ * reading `pageName` wherever it is written is the more useful answer — a
+ * `pageName` on a `grid` view is a schema refusal, not this rule's business,
+ * and reporting the dead reference underneath it as well helps rather than
+ * misleads.
+ */
+
+type ViewPageRefSeverity = 'error' | 'warning';
+type ViewPageRefFinding = ReferenceIntegrityFinding;
+/** Emitted when a `type: 'page'` view mounts a page the stack cannot resolve. */
+declare const VIEW_PAGE_UNRESOLVED = "view-page-unresolved";
+declare function validateViewPageRefs(stack: unknown): ViewPageRefFinding[];
+
 type NavObjectServabilityFinding = ReferenceIntegrityFinding;
 /** Emitted when a nav entry targets an object whose `enable` block cannot serve a list. */
 declare const NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
@@ -1903,7 +2918,7 @@ interface SearchableFieldFinding {
  *   runtime would refuse are flagged (#4830).
  */
 type SearchableFieldRole = 'canonical' | 'narrowing';
-type AnyRec$j = Record<string, unknown>;
+type AnyRec$n = Record<string, unknown>;
 /**
  * The slice of an object the search checks resolve against: the authored
  * field map (existence + the `type`/`hidden` meta search resolution reads),
@@ -1934,7 +2949,7 @@ interface ObjectSearchTarget {
  * `validate-react-page-props` — the gate that already parses that source —
  * runs the same `checkSearchableFieldList` core on it (#4329).
  */
-declare function validateSearchableFields(stack: AnyRec$j): SearchableFieldFinding[];
+declare function validateSearchableFields(stack: AnyRec$n): SearchableFieldFinding[];
 
 declare const SORT_FIELD_UNKNOWN = "sort-field-unknown";
 declare const SORT_FIELD_UNSORTABLE = "sort-field-unsortable";
@@ -1960,7 +2975,7 @@ interface SortableFieldFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$i = Record<string, unknown>;
+type AnyRec$m = Record<string, unknown>;
 /**
  * Check ONE authored `sort` declaration against the object it is bound to —
  * the shared core behind every list-view surface that declares an ordering.
@@ -1983,7 +2998,65 @@ declare function checkSortDeclaration(declared: unknown, objectName: string | un
  * over the bound object's own columns. See the module note for the four
  * sort-carrying surfaces that were checked and deliberately left out.
  */
-declare function validateSortableFields(stack: AnyRec$i): SortableFieldFinding[];
+declare function validateSortableFields(stack: AnyRec$m): SortableFieldFinding[];
+
+/** A list-view field reference that resolves to no field on the bound object. */
+declare const LIST_VIEW_FIELD_UNKNOWN = "list-view-field-unknown";
+/**
+ * [#14282] A list-view field reference written as a DOTTED path at a position
+ * whose name reaches a query door — where the door refuses it by name. See the
+ * second-class section on this module for the scope and the measurements.
+ */
+declare const LIST_VIEW_FIELD_DOTTED = "list-view-field-dotted";
+type ListViewFieldRefSeverity = 'error' | 'warning';
+interface ListViewFieldRefFinding {
+    /** See the two-tier note on this module. */
+    severity: ListViewFieldRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `view "task" › list › kanban`. */
+    where: string;
+    /** Config path, e.g. `views[0].list.kanban.groupByField`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$l = Record<string, unknown>;
+/**
+ * Validate every list view's field references against the object graph.
+ * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
+ * safe on both the schema-parsed stack and the raw config the `lint` path
+ * carries.
+ */
+declare function validateListViewFieldRefs(stack: AnyRec$l): ListViewFieldRefFinding[];
+
+/** An object-level field-name list entry that resolves to no field on the object. */
+declare const OBJECT_FIELD_REF_UNKNOWN = "object-field-ref-unknown";
+type ObjectFieldRefSeverity = 'error' | 'warning';
+interface ObjectFieldRefFinding {
+    /** Always `error` — see the severity note on this module. */
+    severity: ObjectFieldRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "proj_task" › highlightFields`. */
+    where: string;
+    /** Config path, e.g. `objects[0].highlightFields[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$k = Record<string, unknown>;
+/**
+ * Validate every object's own field-name lists against the object graph.
+ * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
+ * safe on both the schema-parsed stack and the raw config the `lint` path
+ * carries.
+ */
+declare function validateObjectFieldRefs(stack: AnyRec$k): ObjectFieldRefFinding[];
 
 declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
 type ActionNameRefSeverity = 'error' | 'warning';
@@ -2001,62 +3074,13 @@ interface ActionNameRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$h = Record<string, unknown>;
+type AnyRec$j = Record<string, unknown>;
 /**
  * Validate every name-bound action reference in a stack. Returns findings
  * (empty = clean).
  */
-declare function validateActionNameRefs(stack: AnyRec$h): ActionNameRefFinding[];
-
-/**
- * [ADR-0078 Phase 3 — Tier-A `action-locations`] An action nobody placed.
- *
- * `locations` is an action's placement declaration. An action that omits it —
- * and that no view names in `bulkActions` / `bulkActionDefs` / `rowActions` —
- * has no surface at all: it parses, it publishes, Setup lists it, and no user
- * can ever click it. ADR-0078 names this shape in its opening paragraph ("a
- * `summary` with no `summaryOperations`; **an `action` with no `locations`**;
- * … Each parses, 'renders', reports success — and does nothing") and Phase 3
- * asks for exactly this rule, one verified shape at a time.
- *
- * The renderer half is now unambiguous: objectui#3142 collapsed four
- * disagreeing renderers onto one predicate — an action renders at a location
- * only if it DECLARES that location. Before that, `action:bar` and the record
- * header showed an undeclared action *everywhere*, which is what made this
- * shape look alive; it is measurably inert as of objectui 17.1.
- *
- * ## What is NOT flagged, and why
- *
- * **`locations: []` — a deliberate headless action.** `content/docs/ui/
- * actions.mdx` ("Headless actions: declare it, then hide it") documents the
- * empty array as a first-class shape: the action stays callable over REST /
- * MCP / AI and keeps its capability gate, param contract and audit trail,
- * while claiming no UI surface. ADR-0110 D3 refuses an *undeclared* handler,
- * so a headless declaration is the only legal way to expose such an action —
- * flagging it would fight that ADR. The distinction this rule draws is
- * therefore between an author who said "nowhere, deliberately" (`[]`) and one
- * who never said anything at all (key absent).
- *
- * **Actions a view places by NAME.** Naming an action in a list view's
- * `bulkActions` or `bulkActionDefs` IS its placement — the selection bar is
- * driven by the view, never by `locations` (that is what the retired
- * `action.bulkEnabled` tombstone prescribes, and what objectui#3139's
- * aggregate bulk mode relies on: an action that only makes sense over a
- * selection has no single-record location by construction). `rowActions` is
- * exempted on the same zero-false-positive posture (ADR-0072 D1): it is the
- * same field pair on the same container, and an author who named an action
- * there has stated an intent — a name that resolves to nothing is already
- * `action-name-undefined`'s job, not this rule's.
- *
- * Scope note: this rule asks only "did anyone place this action?". It
- * deliberately does NOT check that a declared location is one a renderer
- * actually serves, nor that a view's named action belongs to that view's
- * object — distinct classes with their own rules. Cross-package placement (a
- * view in another installed package naming this action) is the one legitimate
- * miss, which is why this is a **warning**: like every other "declared but
- * does nothing" finding in this package (`validateSemanticRoles`,
- * `lintLivenessProperties`), it is high-signal and never fatal.
- */
+declare function validateActionNameRefs(stack: AnyRec$j): ActionNameRefFinding[];
+
 declare const ACTION_NO_PLACEMENT = "action-no-placement";
 type ActionLocationsSeverity = 'error' | 'warning';
 interface ActionLocationsFinding {
@@ -2073,12 +3097,12 @@ interface ActionLocationsFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$i = Record<string, unknown>;
 /**
  * Flag every action that declares no placement and that no view places by
  * name. Returns findings (empty = clean).
  */
-declare function validateActionLocations(stack: AnyRec$g): ActionLocationsFinding[];
+declare function validateActionLocations(stack: AnyRec$i): ActionLocationsFinding[];
 
 /**
  * Shared page-component traversal for the lint rules that inspect
@@ -2104,11 +3128,11 @@ declare function validateActionLocations(stack: AnyRec$g): ActionLocationsFindin
  *     author never wrote, so those pages are skipped here and covered by
  *     `validate-jsx-pages` / `validate-react-page-props` instead.
  */
-type AnyRec$f = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /** A visited component plus everything needed to locate and bind it. */
 interface WalkedComponent {
     /** The component record itself. */
-    component: AnyRec$f;
+    component: AnyRec$h;
     /** Config path, e.g. `pages[0].regions[1].components[2]`. */
     path: string;
     /**
@@ -2119,14 +3143,92 @@ interface WalkedComponent {
     objectName?: string;
 }
 /** Is this page authored as `source` (so its `regions` must not be linted)? */
-declare function isSourceAuthoredPage(page: AnyRec$f): boolean;
+declare function isSourceAuthoredPage(page: AnyRec$h): boolean;
 /**
  * Walk every component on a page, depth-first, yielding each with its config
  * path and resolved object binding. Source-authored pages yield nothing.
  *
  * `pagePath` is the caller's path prefix for the page (e.g. `pages[3]`).
+ *
+ * The descent is cycle-safe. Every composition slot below is `z.array(z.unknown())`
+ * authored data, so a component that contains itself — directly, or through a
+ * chain of containers — is LEGAL input, and an unguarded walk recurses until the
+ * stack dies. That crash is not scoped to one rule: this is the one shared
+ * traversal under every page-shaped lint rule and the CLI's i18n object-sections
+ * pass, so it takes all of them down in the same process.
+ *
+ * The guard is an ANCESTOR set, not a visited set, and the difference is
+ * load-bearing rather than stylistic — it is the same predicate
+ * `translatePage` (`packages/spec/src/system/i18n-resolver.ts`) settled on. A
+ * component object reused twice as a SIBLING is two legitimate placements at two
+ * distinct config paths, and every rule built on this walk must see both; a
+ * visited set would yield the first and silently drop the second, converting a
+ * crash into missing lint coverage. Only a node that is its own ancestor is a
+ * cycle.
+ *
+ * A cycle stops the descent SILENTLY — the repeated node is not yielded a second
+ * time and no finding is produced. The guard is a safety property of the walk,
+ * not a verdict about the document: deciding that a self-referential page is
+ * itself an authoring error would be new reject behaviour on authored input, and
+ * that is a contract call, not this walk's to make.
+ *
+ * Deliberately NO depth cap, which is a different instrument (`translatePage`
+ * carries both). A cap bounds a legal-but-absurd document; on a resolver it
+ * leaves copy untranslated, but on a LINT walk it would drop real components
+ * from the walk output and every rule would go quiet about them — a silent loss
+ * of coverage that looks exactly like a clean page. With the cycle guard the
+ * descent is bounded by the document's own finite nesting, so the cap would only
+ * ever fire on acyclic input, which is precisely the input it must not truncate.
  */
-declare function walkPageComponents(page: AnyRec$f, pagePath: string): WalkedComponent[];
+declare function walkPageComponents(page: AnyRec$h, pagePath: string): WalkedComponent[];
+
+/**
+ * object name → its DECLARED field-group keys.
+ *
+ * Declared, not derived: `deriveFieldGroupLayout` drops a group no visible field
+ * joins, and a reference to a declared-but-empty group is a different (and
+ * data-dependent) finding from a reference to a group that was never declared.
+ * This index answers only the second question — the one with a closed oracle.
+ *
+ * `fieldGroups` is an ARRAY on `ObjectSchema`, and `recordsOf` additionally
+ * resolves the name-keyed map shape that raw (non-`defineStack`) metadata can
+ * carry, the same tolerance every other index in this package extends.
+ */
+declare function indexObjectFieldGroups(stack: unknown): Map<string, Set<string>>;
+/** One `section.group` reference, with the path that located it. */
+interface SectionGroupRef {
+    /** The referenced field-group key, as authored. */
+    key: string;
+    /** Config path of the `group` key itself. */
+    path: string;
+}
+/**
+ * Pull `group` references out of a `sections`-shaped value.
+ *
+ * `sep` joins the index onto `basePath` the way the calling surface addresses
+ * itself — `.` for metadata config paths, and the react surface's ` › ` if it
+ * ever grows a section-bearing block.
+ */
+declare function sectionGroupRefs(sections: unknown, basePath: string, sep?: string): SectionGroupRef[];
+/** The finding shape both host rules already declare, structurally. */
+interface SectionGroupFinding {
+    severity: 'warning';
+    rule: string;
+    where: string;
+    path: string;
+    message: string;
+    hint: string;
+}
+/**
+ * Check one batch of group references against `objectName`'s declared groups.
+ *
+ * Bails out when the object is not defined in this stack — it may come from
+ * another installed package, and a group cannot be judged on a schema we cannot
+ * see. That is the same skip {@link checkFieldRefs} takes, and for the same
+ * reason: silence about an unknowable object beats a finding the author cannot
+ * act on.
+ */
+declare function checkSectionGroupRefs(refs: readonly SectionGroupRef[], objectName: string | undefined, objectFieldGroups: ReadonlyMap<string, Set<string>>, where: string, rule: string): SectionGroupFinding[];
 
 /**
  * [ADR-0078 — completeness] Field-reference integrity for page components
@@ -2193,6 +3295,14 @@ declare const PAGE_FIELD_UNKNOWN = "page-field-unknown";
  * #8116's severity reasoning, unchanged.
  */
 declare const PAGE_FIELD_UNPROVISIONED = "page-field-unprovisioned";
+/**
+ * [#13855] A section's `group` names a field group the bound object does not
+ * declare. The reference form inherits the section's whole membership from that
+ * group, so a dangling key leaves the section with no members and it does not
+ * render at all. Always `warning` — see `object-field-groups.ts` for why this
+ * sits with the family's advisory findings rather than gating.
+ */
+declare const PAGE_SECTION_GROUP_UNKNOWN = "page-section-group-unknown";
 type PageFieldSeverity = 'error' | 'warning';
 interface PageFieldFinding {
     /**
@@ -2214,7 +3324,59 @@ interface PageFieldFinding {
     hint: string;
 }
 
-declare function validatePageFieldBindings(stack: AnyRec$f): PageFieldFinding[];
+declare function validatePageFieldBindings(stack: AnyRec$h): PageFieldFinding[];
+
+declare const PAGE_VISUALIZATION_WITHOUT_BINDING = "page/visualization-without-binding";
+type PageVisualizationSeverity = 'error' | 'warning';
+interface PageVisualizationFinding {
+    /**
+     * `error` when the entry leads `allowedVisualizations` — it becomes the
+     * forced `viewType` and the runtime reaches its renderer's refusal screen.
+     * `warning` otherwise — the type is filtered out of the switcher silently.
+     */
+    severity: PageVisualizationSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `page "showcase_task_calendar" · interfaceConfig.appearance`. */
+    where: string;
+    /** Config path, e.g. `pages[0].interfaceConfig.appearance.allowedVisualizations[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * One row of the renderer's derivation, transcribed.
+ *
+ * `types` is the TYPE predicate (checked first, in the object's declaration
+ * order); `namePattern` is the NAME fallback's regex SOURCE, or `null` where
+ * the renderer has no name fallback for that visualization. `viewBlocks` are
+ * the keys on the referenced view that supply the binding directly — read
+ * ahead of any derivation, exactly as `view.<viz> ?? derived` does.
+ */
+interface VisualizationPredicate {
+    visualization: string;
+    /** The binding key the renderer would produce (what the message names). */
+    binding: string;
+    types: readonly string[];
+    namePattern: string | null;
+    viewBlocks: readonly string[];
+}
+/**
+ * The mirrored table — objectui `f0f774b0`,
+ * `packages/app-shell/src/views/InterfaceListPage.tsx`:
+ * `SELECT_TYPES`/`DATE_TYPES`/`IMAGE_TYPES`/`LOCATION_TYPES` at `:149-151`
+ * and `:203`, `defaultKanbanFromObject` `:153`, `defaultDateField` `:163`,
+ * `defaultCalendarFromObject` `:170`, `defaultGalleryFromObject` `:175`,
+ * `defaultGanttFromObject` `:185`, `defaultMapFromObject` `:253`.
+ *
+ * ⛔ Pinned verbatim by the fixture test. Editing a row here without editing
+ * that pin is the drift this table's whole purpose is to make loud.
+ */
+declare const OBJECTUI_DERIVATION_PREDICATES: readonly VisualizationPredicate[];
+type AnyRec$g = Record<string, unknown>;
+declare function validatePageVisualizationBindings(stack: AnyRec$g): PageVisualizationFinding[];
 
 /** A key authored in `properties` that the type's props schema does not declare. */
 declare const COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
@@ -2240,7 +3402,24 @@ interface ComponentPropsFinding {
     /** How to fix it. */
     hint: string;
 }
-declare function validateComponentProps(stack: AnyRec$f): ComponentPropsFinding[];
+declare function validateComponentProps(stack: AnyRec$h): ComponentPropsFinding[];
+
+/** A component `type` inside a spec-reserved namespace that the vocabulary does not declare. */
+declare const COMPONENT_TYPE_UNKNOWN = "component-type-unknown";
+interface ComponentTypeFinding {
+    severity: 'error';
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `page "app_launcher" · global:serch`. */
+    where: string;
+    /** Config path, e.g. `pages[0].regions[1].components[0].type`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+declare function validateComponentTypes(stack: AnyRec$h): ComponentTypeFinding[];
 
 /**
  * [ADR-0021 — semantic layer] Chart-binding integrity for the surfaces the
@@ -2277,6 +3456,132 @@ declare function validateComponentProps(stack: AnyRec$f): ComponentPropsFinding[
  * rule has no business loading. It is checked by `validate-react-page-props`
  * instead, against the naming convention `chartAggregateResultKeys`
  * (`@objectstack/spec/ui`) now pins down (#3701).
+ *
+ * ## Which positions are BINDINGS, and which are presentation (#15575)
+ *
+ * `chart-measure-unknown`'s message names a QUERY consequence — *"this series
+ * comes back empty"* — and that is only true where the position feeds the
+ * dataset query. Read at the pinned `@object-ui` revision (`.objectui-sha`),
+ * the three surfaces do not agree, so the tier and the consequence are per
+ * POSITION rather than per rule:
+ *
+ *  - **Report charts.** The chart runs its OWN query out of the two axis
+ *    strings — `useDatasetRows(dataset, [xAxis], [yAxis], …)` in
+ *    `plugin-report/src/DatasetReportRenderer.tsx`, and in that file's own
+ *    words *"the embedded chart queries only `chart.xAxis` × `chart.yAxis`"*.
+ *    So `chart.yAxis` IS the binding and keeps `error`. `chart.series[]` is
+ *    not: it is *"The author's per-chart override for ONE measure's display
+ *    name — the entry of `chart.series[]` whose `name` IS that measure"*,
+ *    lowered through `mergeAuthoredSeries`, for which *"an authored entry
+ *    naming a measure that is NOT in the dataset selection is **ignored** —
+ *    membership belongs to the dataset"* (`@object-ui/core`
+ *    `src/utils/chart-presentation.ts`).
+ *  - **List-view charts.** `ListChartConfigSchema` is a STRICT object of
+ *    `chartType` / `dataset` / `dimensions` / `values`: it declares no
+ *    `series` and no `yAxis`, so this rule has no presentation position on
+ *    that surface at all. Its one measure position is `values[]`, which
+ *    `app-shell/src/views/ObjectView.tsx` hands to the chart component as the
+ *    dataset measures (and synthesises the series list FROM). Query binding,
+ *    `error`, unchanged.
+ *  - **Dataset-bound page chart components.** `plugin-charts/src/ObjectChart.tsx`
+ *    queries `{ dimensions: schema.dimensions, measures: schema.values }` and
+ *    then REPLACES the authored series wholesale —
+ *    `{ ...schema, data, xAxisKey, series: datasetChart.series }`, one derived
+ *    entry per selected measure. An authored `properties.series[].name` reaches
+ *    the renderer not at all, and an authored `properties.yAxis[].field` is
+ *    inert for the same reason (`normalizeChartSchema` synthesises series from
+ *    `yAxis[].field` only when there are none, which on this surface means an
+ *    empty `values` — a chart with no measures to plot either way). Both are
+ *    presentation; `dimensions` / `values` are the binding.
+ *
+ * So the presentation positions drop to `warning` and state what actually
+ * happens, which is the resolution the maintainer ruling on
+ * `chart-field-unknown` reached for the same question one rule over (see "The
+ * three refused binding keys" in `validate-widget-bindings.ts`). Two things
+ * follow that differ from that sibling, and are worth stating rather than
+ * leaving to be re-derived:
+ *
+ *  - **There is no per-position suppression here.** `suppressWarnings` is
+ *    declared on the dashboard WIDGET only (`spec/src/ui/dashboard.zod.ts`),
+ *    and none of these three surfaces carries the key. A `warning` is advisory
+ *    (the consumers split on `severity === 'error'`) but cannot be silenced
+ *    individually; declaring the key on these surfaces would be a schema
+ *    change, which this rule has no standing to make.
+ *  - **The page surface's axis refs and series refs are separate limbs.** They
+ *    used to be concatenated into one `series` array before the measure walk,
+ *    so every `yAxis[].field` took the SERIES message. Reading both shapes on
+ *    that surface is deliberate (the props bag mixes them); giving them one
+ *    message was not — the pin refuses the two for different reasons, so they
+ *    now carry different sentences.
+ *
+ * `chart-axis-not-selected` (declared measure, outside the selection) rides the
+ * same walk and took the same one-size sentence — *"the query does not return
+ * it, so the series plots nothing"*. That is the truth at a query position and
+ * not at a presentation one, where no series is derived for the name in the
+ * first place, so its consequence is per position too.
+ *
+ * ## Which SET `chart-axis-not-selected` resolves against (#15734)
+ *
+ * The consequence is per POSITION; the selection it is measured against is per
+ * SURFACE — and on the report surface that selection is not `report.values`.
+ * At the same pinned revision `DatasetReportRenderer.tsx` runs
+ * `useDatasetRows(dataset, plan.kind === 'series' && xAxis ? [xAxis] : [],
+ * wantsQuery && yAxis ? [yAxis] : [], …)` and derives the plotted series with
+ * `buildChartSeries(…, [xAxis], [yAxis], …)` — *"the selection is exactly one
+ * dimension × one measure, so this takes the helper's single-dimension branch
+ * and returns ONE series"*. `report.values` is the selection of the TABLE
+ * beneath the chart; the chart's own is the axis pair. Two things follow:
+ *
+ *  - **Nothing to report at the report `chart.yAxis`.** That position IS the
+ *    chart's query, so it cannot fail to select itself. The warning that fired
+ *    for a declared measure outside `report.values` stated a query consequence
+ *    its own pin refutes: the chart asks for exactly that measure and plots
+ *    it. `chart-measure-unknown` at that position is untouched — an UNDECLARED
+ *    measure still returns no column, and still gates.
+ *  - **`chart.series[].name` resolves against the singleton `{ chart.yAxis }`.**
+ *    The override is paired with a DERIVED series and the chart derives one,
+ *    so that singleton — not `report.values` — is the set an entry can land
+ *    on. An entry naming `chart.yAxis` lands however the table is selected;
+ *    one naming any other declared measure lands on nothing.
+ *
+ * The list-view and page-component surfaces keep `values`: there it IS the
+ * measure set the query asks for, so the existing resolution is correct.
+ *
+ * ## What a REPORT binds, chart or no chart (#16105)
+ *
+ * A report is dataset-bound in its own right — `ReportSchema` requires
+ * `dataset` + `values` on every non-`joined` report and declares `rows` (the
+ * down axis) and `columns` (the across axis a `matrix` pivots on, ADR-0021 D2)
+ * as dimension names "from the dataset". The chart is optional decoration on
+ * top of that binding, not the binding itself.
+ *
+ * The walk did not read it that way. Every report position reached the resolver
+ * through one closure that opened `if (!isRec(chart)) return`, and that closure
+ * was the only site `report.dataset` was ever passed to, so:
+ *
+ *  - a report authored WITHOUT a chart was not checked at all — an unresolvable
+ *    `dataset`, an unknown `rows`/`columns` dimension and an unknown `values`
+ *    measure all published clean; and
+ *  - `rows`/`columns` were passed to the resolver on NO report, charted or not.
+ *    On one and the same charted report, `values` was resolved and the
+ *    dimension selection beside it was not.
+ *
+ * So the dataset is resolved once per report and once per block — before the
+ * chart question is asked — and fed to two groups of positions: the report's
+ * own selection (`rows`/`columns` → `chart-dimension-unknown`, `values` →
+ * `chart-measure-unknown`) and, when a chart is present, its axis refs
+ * exactly as before. Not a second "chartless reports too" pass after the early
+ * return: one path, entered unconditionally, with the chart as the branch it
+ * always was. Which is also why an unresolvable dataset on a charted report is
+ * still ONE finding — `resolveDataset` runs once per surface, not once per
+ * group.
+ *
+ * `rows`/`columns` take `chart-dimension-unknown` rather than an id of their
+ * own: the position is a dataset DIMENSION reference resolved against the
+ * dataset's declared dimensions, which is what that rule already means on the
+ * list-view and page surfaces, and the spec's own words for the two report
+ * keys are "down axis" and "across" — so the rule's existing sentence about an
+ * axis rendering with no categories is true where it now fires.
  */
 declare const CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
 declare const CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
@@ -2297,7 +3602,265 @@ interface ChartBindingFinding {
     hint: string;
 }
 
-declare function validateChartBindings(stack: AnyRec$f): ChartBindingFinding[];
+declare function validateChartBindings(stack: AnyRec$h): ChartBindingFinding[];
+
+/** An `include[]` entry that does not name a joinable relationship path. */
+declare const DATASET_INCLUDE_UNKNOWN = "dataset-include-unknown";
+/** A `dimensions[].field` / `measures[].field` path that resolves to no column. */
+declare const DATASET_FIELD_UNKNOWN = "dataset-field-unknown";
+/** A field path whose relationship prefix was never declared in `include`. */
+declare const DATASET_FIELD_NOT_INCLUDED = "dataset-field-not-included";
+/** A filter KEY — on the dataset or a measure — that resolves to no column. */
+declare const DATASET_FILTER_FIELD_UNKNOWN = "dataset-filter-field-unknown";
+type DatasetRefSeverity = 'error' | 'warning';
+interface DatasetRefFinding {
+    /** Always `error` today — see the severity note on this module. */
+    severity: DatasetRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `dataset "sales" › dimension "region"`. */
+    where: string;
+    /** Config path, e.g. `datasets[0].dimensions[2].field`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$f = Record<string, unknown>;
+/**
+ * Validate every ADR-0021 dataset's references against the object graph.
+ * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
+ * safe on both the schema-parsed stack and the raw config the `lint` path
+ * carries.
+ */
+declare function validateDatasetReferences(stack: AnyRec$f): DatasetRefFinding[];
+
+/**
+ * Field types that address ANOTHER object, so a `.<hop>` through one is a join
+ * the query compiler derives rather than a column read.
+ *
+ * `user` and `tree` are members alongside the two obvious ones for the reason
+ * `validate-flow-template-paths.ts` lists them: both store a foreign key and
+ * both are traversed the same way. A dataset `include` naming one is joinable
+ * exactly as a `lookup` is.
+ */
+declare const RELATIONSHIP_FIELD_TYPES: ReadonlySet<string>;
+/** The slice of one field this module reads. */
+interface GraphField {
+    /** Declared `type`, when the author wrote one. */
+    type?: string;
+    /**
+     * The object a relationship field addresses.
+     *
+     * `reference` is the ONLY spelling `FieldSchema` declares — `referenceTo` /
+     * `relatedTo` / `target` / `targetObject` / `lookupObject` are REJECTED
+     * aliases the strict error map maps back to it (#5017), so a field spelling
+     * one of them does not parse at all. Re-admitting an alias here would be the
+     * tolerant consumer Prime Directive #12 refuses, so only `reference` is read.
+     */
+    reference?: string;
+    /**
+     * The declared `multiple: true` flag, when the author wrote one.
+     *
+     * Read here because the dotted-path verdict a caller may reach for
+     * ({@link classifyDottedFilterHead} in `@objectstack/spec/data`) is a
+     * function of BOTH `type` and `multiple`: an array-valued head is
+     * deliberately unjudged there, since a numeric-index dotted path genuinely
+     * reaches into it on two of three backends. A caller handed only `type`
+     * would have to re-derive the flag from the raw stack, which is the second
+     * copy this module exists to prevent. Additive (#14282): every existing
+     * consumer that ignores the key keeps its verdicts byte-for-byte.
+     */
+    multiple?: boolean;
+}
+/**
+ * One object's resolvable surface. `null` in the index marks an object that
+ * declares no readable field map, keeping "declared nothing" distinguishable
+ * from "not in this stack" — the same distinction
+ * {@link indexObjectSearchTargets} draws for the search axis.
+ */
+interface GraphObject {
+    /** Authored field names. */
+    names: ReadonlySet<string>;
+    /** name → the slice above. */
+    fields: ReadonlyMap<string, GraphField>;
+    /** Registry-injected columns addressable on THIS object (skip 3). */
+    injected: ReadonlySet<string>;
+}
+/** object name → its resolvable surface, or `null` (skip 2). */
+type ObjectGraph = ReadonlyMap<string, GraphObject | null>;
+/**
+ * Index a stack's objects once. Callers that resolve many paths build this a
+ * single time and hand it to every {@link resolveFieldPath} call.
+ */
+declare function indexObjectGraph(stack: unknown): ObjectGraph;
+/** What a path resolved to, or precisely how it failed. */
+type FieldPathVerdict = 
+/**
+ * Every hop and the leaf resolved. `object` is the object the LEAF lives on.
+ * `injected` marks a leaf resolved through skip 3 — a registry-injected
+ * column, real at runtime, whose TYPE and relationship target are
+ * registry-owned and invisible here. A caller asking a second question about
+ * the leaf (is it a relationship? is it materialised?) must treat an
+ * `injected` leaf as unanswerable rather than assume the absence of a
+ * declared type means the absence of the property.
+ */
+{
+    kind: 'ok';
+    object: string;
+    field: string;
+    meta?: GraphField;
+    injected?: true;
+}
+/**
+ * The graph cannot answer — one of the three skips. Never report this: it is
+ * the absence of a judgement, not a passing one.
+ */
+ | {
+    kind: 'unknowable';
+    reason: 'object-not-in-stack' | 'no-field-map' | 'injected-hop';
+    object: string;
+}
+/**
+ * A hop names nothing on the object it was written against. `at` is the
+ * 0-based segment index, `object` the object the hop was resolved against.
+ */
+ | {
+    kind: 'hop-unknown';
+    at: number;
+    segment: string;
+    object: string;
+    candidates: ReadonlySet<string>;
+}
+/**
+ * A hop resolves to a real field that is NOT a relationship, so there is
+ * nothing to traverse through — the author wrote `amount.total` where
+ * `amount` is a number.
+ */
+ | {
+    kind: 'hop-not-relationship';
+    at: number;
+    segment: string;
+    object: string;
+    type?: string;
+}
+/**
+ * A relationship hop resolves but declares no `reference`, so the target
+ * object is unknown and the rest of the path cannot be judged. Treated as a
+ * SKIP by callers for the same reason as `unknowable`.
+ */
+ | {
+    kind: 'hop-untargeted';
+    at: number;
+    segment: string;
+    object: string;
+}
+/** Every hop resolved; the LEAF names nothing on the object it landed on. */
+ | {
+    kind: 'field-unknown';
+    object: string;
+    field: string;
+    candidates: ReadonlySet<string>;
+};
+/**
+ * Resolve `path` against `objectName` in `graph`.
+ *
+ * A bare `field` is the one-segment case and resolves against the root object
+ * directly. A dotted `a.b.field` walks `a`, then `b`, as to-one relationship
+ * hops, and resolves the leaf on whatever object the last hop landed on.
+ *
+ * ⛔ This function answers EXISTENCE only. Whether a hop was DECLARED joinable
+ * — an ADR-0021 dataset joins only what `Dataset.include` names — is a second
+ * question the caller owns, because only the caller knows which declaration
+ * governs the position. Conflating them here would make the seam unusable at
+ * the positions that have no `include` (a list view's field path, #14107).
+ */
+declare function resolveFieldPath(graph: ObjectGraph, objectName: string | undefined, path: string): FieldPathVerdict | undefined;
+/**
+ * The relationship prefixes a document declared as joinable.
+ *
+ * ADR-0021: *"Declaring `a.b` implicitly includes the intermediate `a`."* So
+ * every PREFIX of every declared path is joinable, not only the paths as
+ * written — which is why this expands rather than reading `include` verbatim.
+ *
+ * Here rather than in a rule because the SAME `include` governs positions two
+ * different rules judge: a dataset's own `dimensions[].field` / `measures[].field`
+ * / filter keys (#14105), and a dashboard widget's `filter` keys (#14148), whose
+ * condition is ANDed into that same dataset's compiled query as `runtimeFilter`.
+ * Two copies of the prefix expansion would let the two positions drift apart on
+ * a clause that is one sentence of one ADR.
+ */
+declare function joinablePrefixes(include: unknown): ReadonlySet<string>;
+/** The two halves of a rendered verdict: the finding's message, and its detail. */
+interface FieldPathAccount {
+    /** What is wrong, in prose, carrying the "did you mean" when there is one. */
+    message: string;
+    /** The supporting field list, for the finding's hint. */
+    detail: string;
+}
+/**
+ * Turn a resolution verdict into the message half of an existence finding, or
+ * `undefined` when the verdict is one no rule may report.
+ *
+ * Shared by every position that resolves a field PATH — a dataset dimension, a
+ * measure, a dataset filter key (#14105), a widget filter key (#14148) — so
+ * they cannot drift into N different accounts of the same miss. The caller
+ * supplies `subject` (how the position is named in prose) and owns the rule id,
+ * the severity, the path and the hint's prescription; this function holds none
+ * of them, matching the rest of this module.
+ */
+declare function describeFieldPathVerdict(verdict: FieldPathVerdict, path: string, subject: string): FieldPathAccount | undefined;
+/**
+ * True when the verdict is one no rule may report — the graph could not answer.
+ * Callers spell the skip through this predicate rather than re-listing the
+ * kinds, so a future verdict added to the union defaults to being reported
+ * loudly (a missed skip is a visible false positive; a missed report is
+ * silence, which is the failure mode this whole family exists to end).
+ */
+declare function isUnjudgeable(verdict: FieldPathVerdict | undefined): boolean;
+/**
+ * Nearest declared name for a typo'd reference, or `undefined` when nothing is
+ * close enough. The sole shared helper behind every "Did you mean?" hint in
+ * this package (issue #14268 consolidated the four hand-copied instances that
+ * had drifted apart into this one).
+ *
+ * Containment is checked first, ahead of edit distance: the ADR-0021 cutover's
+ * canonical drift is base column → prefixed measure name (`amount` →
+ * `sum_amount`), which is far in edit distance but obvious to a human. A
+ * candidate that contains the target (or vice versa, when both are at least 3
+ * characters) scores on the length delta instead and always wins over an
+ * edit-distance match; otherwise the target must be within budget —
+ * `max(2, floor(len/3))` — of a candidate to be offered at all.
+ */
+declare function nearestName(target: string, known: Iterable<string>): string | undefined;
+/** ` Did you mean "x"?`, or the empty string — the platform's message shape. */
+declare function suggestName(target: string, known: Iterable<string>): string;
+/** A readable field list for a hint, or `(none)`. */
+declare function listNames(names: Iterable<string>): string;
+
+/** One field position inside an authored filter. */
+interface FilterFieldKey {
+    /**
+     * The field the condition filters BY, exactly as authored — a bare name
+     * (`status`), or a dotted relationship path (`account.region`, whether
+     * spelled that way or reached by descending a nested condition object).
+     */
+    field: string;
+    /** Config path of the position, e.g. `datasets[1].measures[1].filter.last_update_at`. */
+    path: string;
+}
+/**
+ * Emit every FIELD KEY inside one authored filter subtree, whatever shape it
+ * was authored in — the key half of what `validate-preset-comparands.ts` does
+ * for values, and the traversal `filter-token-unknown` already performs while
+ * reasoning only about the strings it finds.
+ *
+ * Holds no judgement: it does not know which object the filter is bound to and
+ * emits no findings. Resolution is {@link resolveFieldPath}'s job
+ * (`object-graph.ts`) and the verdict is the caller's.
+ */
+declare function walkFilterFieldKeys(node: unknown, path: string, visit: (key: FilterFieldKey) => void, depth?: number): void;
 
 type RuleCompilabilitySeverity = 'error';
 interface RuleCompilabilityFinding {
@@ -2417,6 +3980,55 @@ type AnyRec$d = Record<string, unknown>;
  */
 declare function validateNavAccess(stack: AnyRec$d): NavAccessFinding[];
 
+declare const FIELD_NO_CONSUMERS = "field-no-consumers";
+type FieldConsumerSeverity = 'warning';
+/** Why the field is reported: carriers only, or nothing at all. */
+type FieldConsumerVerdict = 'inert' | 'carrier-only';
+interface FieldConsumerFinding {
+    /** Always `warning` — a consumer may live outside the stack (see module note). */
+    severity: FieldConsumerSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "crm_product" · field "tax_rate"`. */
+    where: string;
+    /** Config path of the DECLARATION, e.g. `objects[3].fields.tax_rate` (map shape) or `objects[3].fields[2]` (array shape). */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+    /** The declaring object. */
+    object: string;
+    /** The field name. */
+    field: string;
+    /** `carrier-only` when carrier sites exist, `inert` when no site of any kind names the field. */
+    verdict: FieldConsumerVerdict;
+    /** Config paths of the carrier sites a removal must clean (empty for `inert`). */
+    carriers: string[];
+    /** The stack roots this verdict was measured over — consumer roots then carrier roots. */
+    rootsScanned: readonly string[];
+}
+type AnyRec$c = Record<string, unknown>;
+/**
+ * Roots whose contents can CONSUME a field, walked with an object context.
+ * `objects` is here for what an object carries besides its field map —
+ * formulas, roll-ups, validations, built-in list views, hooks, actions,
+ * indexes, `highlightFields`, `searchableFields`. Order is report order.
+ */
+declare const CONSUMER_ROOTS: readonly string[];
+/**
+ * Roots whose contents carry a field without reading it. A locale row is a
+ * label for a field, not a consumer of one; a seed VALUE nothing reads is the
+ * shape being hunted; an import column and a field-level permission grant are
+ * customer-facing surfaces a removal must clean, not evidence of a reader.
+ */
+declare const CARRIER_ROOTS: readonly string[];
+/**
+ * Report every declared field that nothing in the stack reads or displays.
+ * Returns findings (empty = clean). Pure; safe on pre- or post-parse stacks.
+ */
+declare function validateFieldConsumers(stack: AnyRec$c): FieldConsumerFinding[];
+
 declare const TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 declare const TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
 type TranslationRefSeverity = 'warning';
@@ -2434,12 +4046,12 @@ interface TranslationRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$c = Record<string, unknown>;
+type AnyRec$b = Record<string, unknown>;
 /**
  * Validate every reference a translation bundle makes against the metadata it
  * claims to translate. Returns findings (empty = clean).
  */
-declare function validateTranslationReferences(stack: AnyRec$c): TranslationRefFinding[];
+declare function validateTranslationReferences(stack: AnyRec$b): TranslationRefFinding[];
 
 declare const TRANSLATION_SECTION_NAME_MISSING = "translation-section-name-missing";
 type TranslatableSectionSeverity = 'warning';
@@ -2457,40 +4069,13 @@ interface TranslatableSectionFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$b = Record<string, unknown>;
+type AnyRec$a = Record<string, unknown>;
 /**
  * Report every form/detail section that declares a heading but no `name`, on an
  * object the stack actually translates. Returns findings (empty = clean).
  */
-declare function validateTranslatableSections(stack: AnyRec$b): TranslatableSectionFinding[];
+declare function validateTranslatableSections(stack: AnyRec$a): TranslatableSectionFinding[];
 
-/**
- * [ADR-0064 §3] Skill ↔ agent surface affinity (issue #3820).
- *
- * An agent binds a product surface (`'ask'` | `'build'`, ADR-0063 §1) and a
- * skill declares which surface it belongs to (`'ask'` | `'build'` | `'both'`,
- * ADR-0063 §3). A skill may only attach to an agent whose surface it matches —
- * `'both'` attaches to either. The runtime treats a violation as a FAST LOAD
- * ERROR: `resolveActiveSkills()` throws on the first incompatible binding, so
- * an agent shipping one mismatched skill reference fails at **chat time** with
- * a 500 — after parse, after validate, after deploy.
- *
- * Both sides of the check are declared in the same stack, so the contradiction
- * is statically provable and this rule carries severity **error** with zero
- * false positives by construction. Both sides default to `'ask'` when the
- * `surface` field is absent (mirroring the runtime's defaults), so the rule is
- * safe on the raw/normalized config the `lint` path carries as well as the
- * schema-parsed stack.
- *
- * Scope note: this rule deliberately does NOT check that `agent.skills[]`
- * names resolve at all. Kernel skills (`schema_reader`, the `ask`/`build`
- * bundles) are runtime-registered and statically invisible, and whether
- * app-stack tool/skill namespaces get a platform-name registry is an open
- * decision (#3820 D0/D2) — resolving names against `stack.skills` alone would
- * flag every kernel-skill reference. An unresolved name is therefore skipped
- * here; only a reference that resolves in-stack AND contradicts the affinity
- * contract is reported.
- */
 declare const AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
 type AiSurfaceAffinitySeverity = 'error' | 'warning';
 interface AiSurfaceAffinityFinding {
@@ -2507,12 +4092,12 @@ interface AiSurfaceAffinityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
+type AnyRec$9 = Record<string, unknown>;
 /**
  * Validate every in-stack agent→skill binding against the ADR-0064 §3 surface
  * affinity contract. Returns findings (empty = clean).
  */
-declare function validateAiSurfaceAffinity(stack: AnyRec$a): AiSurfaceAffinityFinding[];
+declare function validateAiSurfaceAffinity(stack: AnyRec$9): AiSurfaceAffinityFinding[];
 
 declare const AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
 type AiToolRefSeverity = 'error' | 'warning';
@@ -2530,59 +4115,18 @@ interface AiToolRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$9 = Record<string, unknown>;
+type AnyRec$8 = Record<string, unknown>;
 /**
  * Validate every `skill.tools[]` reference in a stack. Returns findings
  * (empty = clean).
  */
-declare function validateAiToolReferences(stack: AnyRec$9): AiToolRefFinding[];
-
-/**
- * [ADR-0063 §2] `stack.agents` is a platform-internal slot (issue #3820).
- *
- * ADR-0063 §2 withdrew tenant/app-package custom agents: the kernel ships
- * exactly two agents (`ask`, `build`), the surface the user is in binds one,
- * and third parties extend the platform by authoring **skills**, never
- * `*.agent.ts`. The `agent` metadata type carries the decision
- * (`allowRuntimeCreate: false, allowOrgOverride: false`), and the runtime
- * enforces it on both paths — `listAgents()` filters non-platform records out
- * of the catalog, and `loadAgent()` refuses them outright (cloud#904), so a
- * stack-authored agent 404s on chat and cannot be pinned via
- * `app.defaultAgent`.
- *
- * What was missing is the AUTHORING-time signal. `defineStack` still accepts
- * an `agents` array, so an app package could declare agents that parse,
- * validate, and build into the artifact — and then do nothing at runtime.
- * HotCRM shipped two of them for months. That is the ADR-0078 shape this rule
- * closes: loud at the producer, tolerant at the consumer (Prime Directive
- * #12).
- *
- * Severity is **warning**, not error, for one reason: the platform's own
- * packages legitimately author agent records, and this rule cannot tell a
- * platform package from an app package by reading the stack alone. A warning
- * that names the runtime consequence is honest for both readers; the runtime
- * is what actually gates. Deliberately NOT a Zod refine — an existing stack
- * must keep parsing (ADR-0078 non-goal #1).
- *
- * ## The value half (issue #6041)
- *
- * The rule above catches a stack that *declares* a withdrawn agent record.
- * It never looked at `app.defaultAgent` — a plain
- * `SnakeCaseIdentifierSchema` string, so any snake_case value parses, builds,
- * and passes `os:check` even when it names nothing the runtime will ever
- * resolve. #5985 measured the blind spot directly: replaying the bad example
- * `defaultAgent: 'sales_copilot'` left `check:skill-examples` at 208 green,
- * EXIT=0. `app.defaultAgent` silently falls back to the platform default at
- * runtime (ADR-0063 §1) instead of crashing, which is why this limb is
- * **warning**, not error, same as the rule above — the maintainer ruling on
- * #6041 (2026-08-07, reaffirmed 2026-08-09) is option A: add the value check
- * at warning tier, reusing `PLATFORM_AGENT_NAMES` rather than narrowing the
- * schema to an enum (a breaking authoring change ADR-0063 already walked
- * back once).
- */
+declare function validateAiToolReferences(stack: AnyRec$8): AiToolRefFinding[];
+
 declare const AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
 /** `app.defaultAgent` names something outside the platform agent roster. */
 declare const DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
+/** `app.defaultAgent` spells a platform agent by its RETIRED alias (#14461). */
+declare const DEFAULT_AGENT_LEGACY_ALIAS = "default-agent-legacy-alias";
 type AiAgentAuthoringSeverity = 'error' | 'warning';
 interface AiAgentAuthoringFinding {
     /** Always `warning` — the runtime is the gate; this is the authoring-time signal. */
@@ -2598,158 +4142,12 @@ interface AiAgentAuthoringFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$8 = Record<string, unknown>;
+type AnyRec$7 = Record<string, unknown>;
 /**
  * Flag every agent declared in a stack. Returns findings (empty = clean,
  * which is what every app package should be).
  */
-declare function validateAiAgentAuthoring(stack: AnyRec$8): AiAgentAuthoringFinding[];
-
-type HookBodyWriteSeverity = 'warning';
-interface HookBodyWriteFinding {
-    /** v1 is advisory-only by contract — the type says so. */
-    severity: HookBodyWriteSeverity;
-    rule: string;
-    /** Human-readable location, e.g. `hook "normalize_lead" › body`. */
-    where: string;
-    /** Config path, e.g. `hooks[0].body.source`. */
-    path: string;
-    message: string;
-    hint: string;
-}
-declare const HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
-/**
- * [#10653] The body did not parse, so its write set is whatever error recovery
- * left readable.
- *
- * Reported rather than skipped for the reason this rule exists at all: a
- * mistake must be visible where it is MADE. An unparseable body reached the
- * extractor, produced fewer matches, and came back as a hook with nothing to
- * report — the same silence the undeclared write itself has at run time, this
- * time wearing the checker's badge. `warning` because the whole rule is
- * advisory and never gates (the severity type admits nothing else).
- */
-declare const HOOK_BODY_SOURCE_UNPARSEABLE = "hook-body-source-unparseable";
-/**
- * [#8663] The write-axis twin of `flow-template-field-unprovisioned` (#8340):
- * the body writes a field {@link IMPLICIT_FIELDS} exempts, but on THIS target
- * the platform registered that anchor without provisioning storage for it.
- *
- * A separate id at `warning` severity rather than a reclassification of
- * {@link HOOK_BODY_WRITE_UNKNOWN_FIELD}, matching #8340's precedent exactly:
- * the existence verdict is unchanged (the name IS addressable), and what is
- * added is a second, independently suppressible finding on the path where the
- * existence check stays silent.
- */
-declare const HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR = "hook-body-write-unprovisioned-anchor";
-/** One syntactic write shape the extractor recognizes. */
-interface HookBodyWritePattern {
-    /** Stable pattern id, carried on every extracted write. */
-    readonly id: string;
-    /** Author-facing syntax summary (for docs/diagnostics, not matching). */
-    readonly syntax: string;
-    /** Reconciliation fixture: extracting `source` must yield exactly `writes`. */
-    readonly example: {
-        readonly source: string;
-        readonly writes: ReadonlyArray<{
-            field: string;
-            object?: string;
-        }>;
-    };
-}
-declare const HOOK_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
-/** A ledger pattern a given rule does NOT consume, and why. */
-interface BodyWritePatternExclusion {
-    /** The {@link HOOK_BODY_WRITE_PATTERNS} entry id being excluded. */
-    readonly id: string;
-    /** Why the shape does not mean the same thing on this rule's surface. */
-    readonly reason: string;
-}
-/**
- * The ledger shapes THIS rule consumes.
- *
- * Declared rather than implied: before the ledger carried a shape the hook
- * surface does not have, every write with no `object` was necessarily a
- * `ctx.input` write, and the rule could branch on that alone. It no longer can
- * — a `record-property-assign` write also carries no object, and would have
- * been reported as "the hook writes 'stage' to its input", which is false.
- * Each consumer declaring its own subset is what stops the next added shape
- * from silently landing in a branch that was never written for it.
- */
-declare const HOOK_BODY_WRITE_PATTERN_IDS: readonly string[];
-/** Ledger shapes this rule leaves alone, each with its reason. */
-declare const HOOK_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
-type AnyRec$7 = Record<string, unknown>;
-/** One statically-extracted field write found in an L2 body. */
-interface ExtractedHookBodyWrite {
-    /** Which {@link HOOK_BODY_WRITE_PATTERNS} entry matched. */
-    patternId: string;
-    /** Target object name; `undefined` = the hook's own target object(s). */
-    object?: string;
-    /** The `ctx.api` method for diagnostics (`insert`/`create`/`update`/`updateById`). */
-    method?: string;
-    field: string;
-}
-/** Everything one parse of an L2 body yields. */
-interface ExtractedHookBodyWriteSet {
-    /** Every literal write the {@link HOOK_BODY_WRITE_PATTERNS} ledger declares. */
-    writes: ExtractedHookBodyWrite[];
-    /**
-     * `ctx.record` is handed to something as a VALUE somewhere in the body — an
-     * argument, an assignment RHS, a spread, a return — rather than only having
-     * its properties read and written, or being truthiness/type tested.
-     *
-     * The action rule needs this to tell a dead snapshot write from a live one:
-     * `ctx.record.stage = 'won'; await ctx.api.object('d').update(ctx.record)`
-     * builds a payload and persists it, so the assignment is not a no-op. When
-     * this is true, no record write in the body can be judged, and none is
-     * reported. (One-level aliasing — `const r = ctx.record` — reads as an
-     * escape too, which is the safe direction: it suppresses findings.)
-     */
-    ctxRecordEscapes: boolean;
-    /**
-     * [#10653] Set when the body did not parse, so `writes` is whatever error
-     * recovery left readable rather than the body's actual write set.
-     *
-     * Absent means one of two things, and they are not the same: the body parsed,
-     * or the cheap pre-filter above rejected it before any parse. The filter is a
-     * raw-text scan for `ctx` / `Object`, and a body containing neither cannot
-     * match any pattern however it parses — so a skipped parse claims nothing and
-     * hides nothing.
-     *
-     * ## Whose fault an unparseable body is — asked, not assumed
-     *
-     * The body is parsed inside a synthesised wrapper (`async function __body(ctx)
-     * { … }`) because that is the shape the runtime compiles it into
-     * (`new AsyncFunction('ctx', source)`). So a parse failure here could in
-     * principle be the WRAPPER's fault rather than the author's, and blaming the
-     * author for the checker's own bug is the failure this whole change is about.
-     * It cannot be: the wrapper is a constant, and `validate-hook-body-writes.
-     * test.ts` pins that it parses clean around an empty body and around every
-     * example in the pattern ledger. Any diagnostic therefore comes from the
-     * body — and its position is reported in the BODY's own coordinates (the
-     * wrapper's line is subtracted, and the result is clamped so it can never
-     * point at a line the author did not write).
-     */
-    parseFailure?: SourceParseFailure;
-}
-/**
- * Extract every literal field write the pattern ledger declares from an L2
- * body's source. Parse-only (the source is never executed), error-tolerant
- * (a body with syntax errors simply yields fewer matches), and lazy: the
- * TypeScript compiler is not loaded when no pattern can possibly match.
- *
- * Thin projection of {@link extractHookBodyWriteSet} — use that one when the
- * `ctx.record` liveness signal matters, so the body is parsed once, not twice.
- */
-declare function extractHookBodyWrites(source: string): ExtractedHookBodyWrite[];
-/** {@link extractHookBodyWrites} plus the `ctx.record` liveness signal, one parse. */
-declare function extractHookBodyWriteSet(source: string): ExtractedHookBodyWriteSet;
-/**
- * Validate L2 hook-body writes against target-object field declarations.
- * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
- */
-declare function validateHookBodyWrites(stack: AnyRec$7): HookBodyWriteFinding[];
+declare function validateAiAgentAuthoring(stack: AnyRec$7): AiAgentAuthoringFinding[];
 
 type ActionBodyWriteSeverity = 'warning';
 interface ActionBodyWriteFinding {
@@ -2966,6 +4364,40 @@ declare const FLOW_INERT_NODE_CONDITION = "flow-inert-node-condition";
  * how it divides labour with the #3810 run-time guard.
  */
 declare const FLOW_MULTI_WRITE_UNFILTERED = "flow-multi-write-unfiltered";
+/**
+ * #13681 / #14394 — a `loop` body that runs a node which can fail, with no
+ * `try_catch` between the loop and that node. The first failing item kills the
+ * whole sweep: `loop-node.ts:123-135` iterates with a bare `await` and no
+ * `try`/`catch` anywhere in the file, so the body's failure propagates out of
+ * the container and the remaining items are never processed.
+ *
+ * A **warning**, per the severity policy at the top of this file: a loop whose
+ * body is deliberately allowed to die (fail fast on the first bad row) is a
+ * legitimate reading, and the rule cannot prove the author did not mean it. What
+ * it can do is make the choice visible at authoring time — today it is silent,
+ * and the measured consequence is a 5-row sweep that processes 3 rows and
+ * reports a run that "completed" nothing unusual.
+ *
+ * See {@link scanUncontainedLoopBodies} for the containment judgement, and
+ * {@link FALLIBLE_NODE_TYPES} for what counts as fallible and why.
+ */
+declare const FLOW_LOOP_BODY_UNCONTAINED = "flow-loop-body-uncontained";
+/**
+ * #13681 / #14394 — the near-miss shape: a `try_catch` that declares no `catch`
+ * region. `catch` is optional in the schema (`control-flow.zod.ts:315`) and
+ * omitting it makes the container **fail** (`try-catch-node.ts:190`), so the
+ * wrapped region dies exactly like an unwrapped one — measured side by side, the
+ * no-`catch` run and the no-wrapper control produce identical output.
+ *
+ * This is the family's first target for the containment pair, not an extra: an
+ * author who reaches for `try_catch` has recognised the hazard and stopped one
+ * key short, and before this rule got **zero containment and zero diagnostics**.
+ * A warning rather than an error under the same policy — a `retry`-only
+ * `try_catch` (retry the region, then fail loudly) is a legitimate reading.
+ *
+ * See {@link scanTryCatchWithoutCatch}.
+ */
+declare const FLOW_TRY_CATCH_WITHOUT_CATCH = "flow-try-catch-without-catch";
 /**
  * Lint every flow for known authoring anti-patterns — its own graph AND every
  * nested ADR-0031 region (#5383). Returns a (possibly empty) list of findings;
@@ -2982,13 +4414,44 @@ interface LivenessLintFinding {
 }
 declare const LIVENESS_DEAD_PROPERTY = "liveness-dead-property";
 declare const LIVENESS_EXPERIMENTAL_PROPERTY = "liveness-experimental-property";
+declare const LIVENESS_PLANNED_PROPERTY = "liveness-planned-property";
+declare const LIVENESS_LIVE_ELSEWHERE_PROPERTY = "liveness-live-elsewhere-property";
 type AnyRec$2 = Record<string, unknown>;
+/**
+ * The property paths of `type`'s ledger that warn an author for authoring them
+ * — i.e. exactly the set {@link lintLivenessProperties} raises a finding on for
+ * that type, exposed as a decision procedure.
+ *
+ * WHY THIS IS EXPORTED RATHER THAN RE-DERIVED. A second tool wanted the same
+ * fact and the first attempt at it re-read the ledger itself, which is how the
+ * two halves of one `os lint` run came to point in opposite directions: the
+ * CLI's i18n coverage walker demanded `flows.*` translation keys for a group
+ * whose ledger row is `planned` + `authorWarn`, so omitting the keys drew
+ * `i18n/missing-flow` and authoring them drew `liveness-planned-property` — in
+ * the SAME run, with no third option for the author. A demand side and a warn
+ * side that disagree can only be kept honest by reading ONE verdict, so this
+ * returns the very map `checkItem` iterates rather than a parallel reading of
+ * the same JSON.
+ *
+ * Keys are the ledger's own property paths, `children` flattened one level as
+ * `parent.child` — the shape `checkItem` resolves. Unreadable or absent ledger
+ * ⇒ the empty set, which is also the state in which `lintLivenessProperties`
+ * warns on nothing: the two sides go quiet together rather than one of them
+ * going quiet alone.
+ *
+ * Deliberately NOT memoized, for the same reason `lintLivenessProperties`
+ * re-reads on every call: a cached verdict outlives the ledger edit that
+ * changes it, and a stale "nothing warns here" is the silent state this whole
+ * family exists to prevent.
+ */
+declare function authorWarnedProperties(type: string): ReadonlySet<string>;
 /**
  * Lint the compiled stack for authored properties the liveness ledger flags as
  * misleading. Advisory only — returns findings, never throws. Covers every
  * governed metadata type: objects (incl. `enable.*`) and their fields walk
- * bespoke nesting; the remaining types are flat stack collections. Container
- * properties fan out over arrays (each flow node, each dataset measure). The
+ * bespoke nesting, and translation bundles walk their locale entries (#11288);
+ * the remaining types are flat stack collections. Container properties fan out
+ * over arrays (each flow node, each dataset measure). The
  * mechanism stays ledger-driven — coverage grows by marking more entries
  * `authorWarn` rather than touching this code.
  */
@@ -3023,23 +4486,9 @@ type AnyRec = Record<string, any>;
 declare const VIEW_KEY_COLLISION = "view-key-collision";
 declare const VIEW_REF_FORM_TARGET_MISSING = "view-ref-form-target-missing";
 declare const VIEW_REF_FORM_TARGET_KIND = "view-ref-form-target-kind";
+declare const VIEW_REF_NAV_VIEW_MISSING = "view-ref-nav-view-missing";
 declare function lintViewRefs(stack: AnyRec): ViewRefFinding[];
 
-/**
- * Data-model best-practice lint rules.
- *
- * These rules encode the relationship / master-detail / roll-up conventions the
- * platform ships (see the objectstack-data and objectstack-ui skills, ADR-0035).
- * They run over the normalized object set and flag anti-patterns that an
- * author — human OR an AI generator — commonly produces. They are intentionally
- * heuristic: structural problems are `error`, likely-wrong choices are
- * `warning`, and "you probably want this" nudges are `suggestion`. None of them
- * block on a judgement call.
- *
- * The same rules double as the automated rubric for the metadata-generation
- * eval (see `score.ts`): a generated stack scores well exactly when it is
- * schema-valid AND lint-clean here.
- */
 type Severity = 'error' | 'warning' | 'suggestion';
 interface LintIssue {
     severity: Severity;
@@ -3184,4 +4633,64 @@ declare function lintLegacyOrganizationComposites(objects: any[]): LocatedLintIs
  */
 declare function lintDataModel(objects: any[]): LintIssue[];
 
-export { ACTION_BODY_SOURCE_UNPARSEABLE, ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type CheckedParse, type CheckedParseOptions, type ComponentPropsFinding, type ComponentPropsSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_PRESET_COMPARAND, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_SOURCE_UNPARSEABLE, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, type LocatedLintIssue, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SOURCE_CLASSNAME, PARSE_FAILURE_HINT, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageFieldFinding, type PageFieldSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, type PresetComparandFinding, type PresetComparandSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REACT_PAGE_SOURCE_UNPARSEABLE, REFERENCE_INTEGRITY_RULES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNPROVISIONED, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT, SHARING_RULE_OBJECT_NOT_SHAREABLE, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, SORT_FIELD_UNKNOWN, SORT_FIELD_UNPROVISIONED, SORT_FIELD_UNSORTABLE, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_SOURCE_UNPARSEABLE, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SortableFieldFinding, type SortableFieldSeverity, type SourceParseFailure, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, checkSortDeclaration, describeParseFailure, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findStartupRegistryVerdicts, findUnguardedNullableOperands, isSourceAuthoredPage, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, nearestRegisteredFormat, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateDashboardActionRefs, validateEmptyCombinators, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePredicatePathRefs, validatePresetComparands, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateSortableFields, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings, walkPageComponents };
+/** Which parse produced a finding — see the door table in the module header. */
+type EnvelopeAuditDoor = 'PageSchema' | 'PageComponentSchema' | 'ComponentPropsMap';
+/** One bare-expression position: authored as a string, normalized by a parse. */
+interface BareExpressionFinding {
+    /** The consumer's page label, e.g. `<ExportName> (<page.name>)`. */
+    page: string;
+    /** Authored path from the page root, e.g. `slots.alerts[0].visibleWhen`. */
+    path: string;
+    /** The bare string the author wrote — what reaches the wire verbatim. */
+    authored: string;
+    /** Set when the parse also RENAMED the key (deprecated alias). */
+    normalizedTo?: string;
+    door: EnvelopeAuditDoor;
+}
+/** The three-door union over one page, findings and door preconditions both. */
+interface PageEnvelopeAudit {
+    /** Every bare-expression position any door found, deduped by path, sorted. */
+    findings: BareExpressionFinding[];
+    /** Door 1 could not run — the page itself does not parse. */
+    pageParseError?: string;
+    /** Door 2 could not run for these components. */
+    componentParseErrors: {
+        path: string;
+        type: string;
+        issues: string;
+    }[];
+    /** Door 3 has no schema to parse these components' `properties` with. */
+    unmappedTypes: {
+        path: string;
+        type: string;
+    }[];
+    /** Door 3 could not run — the authored bag is refused by its props schema. */
+    unreadableProps: {
+        path: string;
+        type: string;
+        issues: string;
+    }[];
+    /** How many components the walk reached (coverage floor for doors 2 and 3). */
+    componentCount: number;
+}
+/**
+ * Run all three parse doors over one authored page and union their findings.
+ *
+ * Read `findings` for the verdict, and assert the four precondition channels
+ * separately (see the module header — a door that could not open reports
+ * there, never as a silently smaller `findings`).
+ *
+ * Exported findings are deduped by path: a top-level component's
+ * `visibleWhen` is legitimately seen by doors 1 AND 2, and reporting it twice
+ * would read as two defects.
+ *
+ * @param page - The authored page object, exactly as exported (never parsed
+ *   first — the audit's whole subject is what the raw export serves).
+ * @param pageLabel - How findings should name the page; consumers use
+ *   `<ExportName> (<page.name>)`.
+ */
+declare function auditPageExpressionEnvelopes(page: unknown, pageLabel: string): PageEnvelopeAudit;
+/** Render findings as the actionable red an author reads in CI. */
+declare function renderBareExpressionFindings(findings: readonly BareExpressionFinding[]): string;
+
+export { ACTION_API_UPDATE_READONLY_WHEN_FIELD, ACTION_BODY_SOURCE_UNPARSEABLE, ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BareExpressionFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSIONS_MISSING, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURES_MISSING, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, COMPONENT_TYPE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type CheckedParse, type CheckedParseOptions, type ComponentPropsFinding, type ComponentPropsSeverity, type ComponentTypeFinding, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_NOT_INCLUDED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DATASET_FIELD_NOT_INCLUDED, DATASET_FIELD_UNKNOWN, DATASET_FILTER_FIELD_UNKNOWN, DATASET_INCLUDE_UNKNOWN, DEFAULT_AGENT_LEGACY_ALIAS, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type DatasetRefFinding, type DatasetRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type EnvelopeAuditDoor, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, CARRIER_ROOTS as FIELD_CARRIER_ROOTS, CONSUMER_ROOTS as FIELD_CONSUMER_ROOTS, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FIELD_NO_CONSUMERS, FIELD_RULE_BOUND_ROOTS, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_PRESET_COMPARAND, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_FILTER_TOKEN_UNKNOWN, FLOW_INERT_NODE_CONDITION, FLOW_LOOP_BODY_UNCONTAINED, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_DATE_FUNCTIONS, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TEMPLATE_VALUE_FUNCTIONS, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_TRY_CATCH_WITHOUT_CATCH, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, FORM_SECTION_GROUP_UNKNOWN, type FieldConsumerFinding, type FieldConsumerSeverity, type FieldConsumerVerdict, type FieldPathAccount, type FieldPathVerdict, type FilterFieldKey, type FilterTokenFinding, type FilterTokenSeverity, type FlowFilterTokenFinding, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTemplateTokenVerdict, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, type GraphField, type GraphObject, HOOK_API_UPDATE_READONLY_FIELD, HOOK_API_UPDATE_READONLY_WHEN_FIELD, HOOK_BODY_SOURCE_UNPARSEABLE, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FIELD_DOTTED, LIST_VIEW_FIELD_UNKNOWN, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, LIVENESS_LIVE_ELSEWHERE_PROPERTY, LIVENESS_PLANNED_PROPERTY, type LintIssue, type ListViewFieldRefFinding, type ListViewFieldRefSeverity, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, type LocatedLintIssue, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECTUI_DERIVATION_PREDICATES, OBJECT_FIELD_REF_UNKNOWN, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectFieldRefFinding, type ObjectFieldRefSeverity, type ObjectGraph, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SECTION_GROUP_UNKNOWN, PAGE_SOURCE_CLASSNAME, PAGE_VISUALIZATION_WITHOUT_BINDING, PARSE_FAILURE_HINT, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageEnvelopeAudit, type PageFieldFinding, type PageFieldSeverity, type PageVisualizationFinding, type PageVisualizationSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, type PresetComparandFinding, type PresetComparandSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REACT_PAGE_SOURCE_UNPARSEABLE, REACT_PROP_DEPRECATED, REACT_PROP_RETIRED, READONLY_ACTION_WRITE_EXCLUSIONS, READONLY_ACTION_WRITE_PATTERN_IDS, READONLY_HOOK_WRITE_EXCLUSIONS, READONLY_HOOK_WRITE_PATTERN_IDS, REFERENCE_INTEGRITY_RULES, RELATIONSHIP_FIELD_TYPES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyActionWriteFinding, type ReadonlyActionWriteSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type ReadonlyHookWriteFinding, type ReadonlyHookWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNPROVISIONED, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_AMBIGUOUS_RELATION, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNKNOWN_FIELD, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT, SHARING_RULE_OBJECT_NOT_SHAREABLE, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, SORT_FIELD_UNKNOWN, SORT_FIELD_UNPROVISIONED, SORT_FIELD_UNSORTABLE, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_SOURCE_UNPARSEABLE, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SectionGroupFinding, type SectionGroupRef, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SortableFieldFinding, type SortableFieldSeverity, type SourceParseFailure, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_PAGE_UNRESOLVED, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VIEW_REF_NAV_VIEW_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_PREDICATE_UNKNOWN_FUNCTION, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewPageRefFinding, type ViewPageRefSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, type VisualizationPredicate, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_FILTER_FIELD_NOT_INCLUDED, WIDGET_FILTER_FIELD_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURES_MISSING, WIDGET_MEASURE_UNKNOWN, WIDGET_SORTBY_UNSELECTED, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, auditPageExpressionEnvelopes, authorWarnedProperties, buildAccessMatrix, checkSectionGroupRefs, checkSortDeclaration, classifyFlowTemplateToken, describeFieldPathVerdict, describeParseFailure, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, fieldRuleRootIssue, findStartupRegistryVerdicts, findUnguardedNullableOperands, indexObjectFieldGroups, indexObjectGraph, isSourceAuthoredPage, isUnjudgeable, joinablePrefixes, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, listNames, nearestName, nearestRegisteredFormat, nullGuardMessage, renderBareExpressionFindings, resolveFieldPath, sectionGroupRefs, suggestName, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateComponentTypes, validateDashboardActionRefs, validateDatasetReferences, validateEmptyCombinators, validateFieldConsumers, validateFilterTokens, validateFlowFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewFieldRefs, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectFieldRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePageVisualizationBindings, validatePredicatePathRefs, validatePresetComparands, validateReactPageProps, validateReactPages, validateReadonlyActionWrites, validateReadonlyFlowWrites, validateReadonlyHookWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateSortableFields, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateViewPageRefs, validateVisibilityPredicates, validateWidgetBindings, walkFilterFieldKeys, walkPageComponents };