@objectstack/lint 17.3.0 → 17.4.0

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { Manifest } from '@objectstack/sdui-parser';
 import { SearchFieldMeta } from '@objectstack/spec/data';
 import { Options } from 'ajv';
 import { AccessMatrixParsed } from '@objectstack/spec/security';
-export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimePackageScope, m as RuntimeStackContext, n as authoringRulesFor, o as buildRuntimeWriteSnapshots, p as narrowObjectsToPackageClosure, r as runAuthoringRules, q as runRuntimeAuthoringRules, s as runtimeAuthoringRulesFor, t as runtimeGatedTypes, u as splitBySeverity, v as stackKeyForType } from './runtime-B8F5-Cbg.js';
+export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimePackageScope, m as RuntimeStackContext, n as authoringRulesFor, o as buildRuntimeWriteSnapshots, p as narrowObjectsToPackageClosure, r as runAuthoringRules, q as runRuntimeAuthoringRules, s as runtimeAuthoringRulesFor, t as runtimeGatedTypes, u as splitBySeverity, v as stackKeyForType } from './runtime-S3OZQDZV.js';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -23,13 +23,6 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  *   name on the bound dataset.
  * - `widget-measure-unknown` — a `values[]` entry is not a measure name on
  *   the bound dataset.
- * - `chart-field-unknown` — a `chartConfig` binding names a field the query
- *   result will not contain: `xAxis.field` must be one of the widget's
- *   dimensions (or a dataset dimension), and each `yAxis[].field` /
- *   `series[].name` must be one of the widget's selected measures
- *   (`values`). Post-cutover (ADR-0021) the result rows are keyed by
- *   measure NAME (e.g. `sum_amount`), not the base column (`amount`) — a
- *   stale base-column reference renders the axis but an empty series.
  * - `widget-legacy-analytics-unrenderable` (#1878/#1894) — a widget uses the
  *   removed pre-ADR-0021 inline-analytics shape (`categoryField`/`rowField`/…)
  *   as its ONLY data wiring: no `dataset`, no `object`, no inline `data`. The
@@ -63,8 +56,45 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  *
  * Advisory rules — severity `warning`, build stays green:
  *
- * - `chart-config-missing` — a chart-type widget (bar/line/pie/…) has no
- *   `chartConfig`, so the renderer cannot tell which measure to plot.
+ * - `chart-field-unknown` (#1721; tier ruled on #15463) — a `chartConfig`
+ *   BINDING key names something the widget's selection does not carry:
+ *   `xAxis.field` is not one of the widget's dimensions (or a dataset
+ *   dimension), or a `yAxis[].field` / `series[].name` is not one of its
+ *   selected measures (`values`). Post-cutover (ADR-0021) the result rows are
+ *   keyed by measure NAME (e.g. `sum_amount`), not the base column (`amount`),
+ *   so a stale base-column reference is the usual way to write one. The pinned
+ *   renderer REFUSES all three keys as bindings — see "The three refused
+ *   binding keys" below — so the authored key changes nothing that renders: it
+ *   is a silent no-op, exactly `widget-legacy-analytics-shape`'s class. Kept as
+ *   a finding because the author wrote a binding and believes it is in force.
+ * - `chart-config-missing` — a `combo` widget has no `chartConfig`, so no
+ *   series carries a mark and the combination chart draws as one uniform
+ *   family. Narrowed to `combo` because `chartConfig` carries NO binding:
+ *   `DatasetWidget` derives the axis and one series per measure from the
+ *   widget's own `dimensions` / `values`, and actively REFUSES an authored
+ *   `ChartAxis.field` / `ChartSeries.name`. See "What the renderer actually
+ *   derives" below for the pinned contract this now mirrors.
+ * - `chart-measures-missing` — a chart-family widget selects NO measures
+ *   (`values` empty or absent). The pinned renderer short-circuits to an
+ *   authoring placeholder — *"Pick measures (values) for this dataset
+ *   widget."* — before any query runs, so no chart is drawn at all. Warning
+ *   rather than error because an empty selection is a legitimate
+ *   work-in-progress state a build must tolerate; erroring would gate the
+ *   `sys_metadata` publish path on a half-authored widget.
+ * - `widget-measures-missing` (#15508) — a NON-chart dataset widget — a
+ *   single-value family (`metric`/`kpi`/`gauge`/`solid-gauge`/`bullet`) or a
+ *   tabular one (`table`/`pivot`) — selects NO measures. The placeholder above
+ *   is returned for these families too: the pinned `values.length === 0` return
+ *   stands above every family branch, so the KPI number or the table is not
+ *   drawn either. Same warning tier and suppression as the chart-family
+ *   spelling; a separate id because "chart" does not name this condition and
+ *   because the family keeps one id per class.
+ * - `chart-dimensions-missing` — a chart-family widget selects at least one
+ *   measure but NO dimensions. The pinned renderer's
+ *   `isMetric = METRIC_TYPES.has(widgetType) || dimensions.length === 0`
+ *   routes it to the single-value branch, so it renders a KPI number and the
+ *   family the author declared is silently ignored. Warning because the
+ *   number is real and correct — it is the chart that is gone.
  * - `table-count-only` (#1719) — a `table`/`pivot` widget whose selected
  *   measures are ALL `aggregate: 'count'` and which declares no
  *   `dimensions` asks the analytics service for a single summary row. That
@@ -177,6 +207,176 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  * through the flat `SYSTEM_FIELDS` union, which is what lets a reference to
  * `owner_id` on an `ownership: 'none'` object stay a real finding.
  *
+ * ### What the renderer actually derives (#14436)
+ *
+ * `chart-config-missing` used to fire on EVERY chart family that was not a
+ * single-value or tabular type, on the stated grounds that without
+ * `chartConfig` "the renderer cannot determine which measure to plot, so the
+ * series renders empty". That consequence was false, and it fired on this
+ * platform's OWN shipped metadata: the `system_overview` dashboard draws a pie
+ * and a bar, each with one dimension and one measure and no `chartConfig`, and
+ * both render correctly. A warning-tier rule that mis-fires on first-party
+ * metadata is the ADR-0072 D1 cost the whole family exists to avoid — it
+ * teaches every reader, human and agent, that this family is noise.
+ *
+ * The renderer's contract, read at the `@object-ui` revision this repo PINS
+ * (`.objectui-sha`), not at objectui's `origin/main` — the Console ships the
+ * pin, so the exemption is written against the behaviour the pin has:
+ *
+ *  - `DatasetWidget` calls `buildChartSeries(rows, dimensions, values, …)`,
+ *    which returns `{ data, xAxisKey, series }` — the x-axis key is
+ *    `dimensions[0]` and there is exactly one series per entry of `values`.
+ *    `chartConfig` is not an argument to it.
+ *  - The authored `chartConfig` reaches the chart only through
+ *    `mergeAuthoredPresentation` (per-series/axis PRESENTATION merged ONTO
+ *    those derived bindings) and `chartConfigPresentation` (chrome: titles,
+ *    height, colours, data labels, annotations, legend).
+ *  - The BINDING half of an authored `chartConfig` is refused outright. The
+ *    renderer pins this by name in
+ *    `packages/plugin-dashboard/src/__tests__/DatasetWidget.chartConfig.test.tsx`:
+ *    *"ignores an authored axis `field` and keeps the derived axis binding"*,
+ *    *"ignores an authored series and keeps one derived series per measure"*,
+ *    *"ignores `chartConfig.type` — the widget type owns the chart family"*,
+ *    and *"emits none of the presentation keys when no chartConfig is
+ *    declared"*.
+ *
+ * So for every chart family except one, a missing `chartConfig` costs the
+ * widget nothing at all, and ADDING one could not have repaired a widget whose
+ * selection is empty either — `chart-field-unknown` above reports a
+ * `yAxis[].field` that names anything the widget did not select, so
+ * `chartConfig` can never supply a measure the `values` array is missing.
+ *
+ * **The one surviving arm is `combo`**, and it is a real loss rather than an
+ * inferred one. A combination chart's whole identity is a per-series MARK, and
+ * that mark is authored as `chartConfig.series[].type` — presentation, so it
+ * does merge forward. `mergeAuthoredSeries` states the default it falls back
+ * to: *"a derived series with no authored entry keeps the family default"*,
+ * and `DatasetWidget.comboPresentation.test.tsx` records what that cost when
+ * the merge was missing — *"Without it the line measure drew as the second
+ * bar."* A `combo` with no `chartConfig` therefore draws every measure with
+ * one mark: the author asked for a combination and got a plain one. Warning
+ * rather than error, because the numbers are right and the chart renders — it
+ * is the shape that is wrong.
+ *
+ * ⚠️ Two genuinely un-renderable shapes are NOT this id's, because neither is
+ * caused by nor repairable with `chartConfig` and folding them in would leave
+ * this id misnaming its own condition: a chart-family widget selecting NO
+ * measures, and one selecting NO dimensions. They have their own ids —
+ * `chart-measures-missing` and `chart-dimensions-missing` — described next.
+ *
+ * ### The two empty-selection shapes (#15462)
+ *
+ * Read at the same PINNED `@object-ui` revision (`.objectui-sha`), in
+ * `packages/plugin-dashboard/src/DatasetWidget.tsx`:
+ *
+ *  - `:683` — `if (values.length === 0)` returns the authoring placeholder
+ *    `tt('dashboard.pickMeasures', 'Pick measures (values) for this dataset
+ *    widget.')`. It stands ABOVE every family branch, so a widget selecting no
+ *    measure never reaches a chart, a table or a KPI number: nothing is drawn.
+ *  - `:423` — `const isMetric = METRIC_TYPES.has(widgetType) ||
+ *    dimensions.length === 0;`, with `METRIC_TYPES` (`:343`) = `metric`, `kpi`,
+ *    `gauge`, `solid-gauge`, `bullet`; `:424` is the tabular test
+ *    (`table`/`pivot`); and the render branches (`:702`, `:798`, `:854`) route
+ *    `isMetric ? KPI : isTable ? table : chart`. A dimensionless `bar` is
+ *    therefore drawn as a single KPI number — the failure direction the family's
+ *    own docblock names, except worse: the number is REAL, so the missing chart
+ *    reads as a design choice rather than as a defect.
+ *
+ * So "chart family" here is not a hand list — it is what that routing leaves
+ * over: a declared `ChartTypeSchema` option that is neither a `METRIC_TYPES`
+ * member nor tabular ({@link CHART_FAMILY_WIDGET_TYPES}). The taxonomy supplies
+ * the universe and the renderer decides the exceptions, which is the same
+ * division #14436 settled for `MARK_MIXING_CHART_TYPES`: this file's copies of
+ * the renderer's two sets are held to `ChartTypeSchema` by the rule's tests, so
+ * a member that stops being a declared chart type reds instead of going quiet.
+ *
+ * The two ids never both fire on one widget, and the reason is the pin's own
+ * order: with no measures the placeholder returns at `:683` and the `isMetric`
+ * branch is never reached, so `chart-dimensions-missing`'s consequence (a KPI
+ * number in place of the chart) is not what that widget does. A widget missing
+ * both reports `chart-measures-missing` alone, whose hint names the missing
+ * dimension too.
+ *
+ * Both are warnings, per the tier decision on #15462: an empty selection is a
+ * state an author passes THROUGH, and the family's errors are reserved for
+ * bindings the analytics service cannot satisfy.
+ *
+ * **The measures shape is every family's, not the chart family's (#15508).**
+ * Re-read at the pinned `.objectui-sha` (`a472b0716`, where the four cited
+ * lines still read as quoted above), `:683` is ABOVE `:423`/`:424` and tests
+ * nothing but `values.length === 0`. So a `metric`, `kpi`, `gauge`,
+ * `solid-gauge`, `bullet`, `table` or `pivot` widget that selects no measures
+ * renders that same placeholder: the KPI number or the table the author
+ * declared is not drawn either, and a missing tile on a board reads as
+ * "nothing to report" rather than as a defect. Nothing else reported it —
+ * `table-count-only` requires `values.length > 0` before it looks, and rules
+ * (b)/(c) iterate the arrays, so an empty one is silent by construction.
+ *
+ * The population therefore widens to every DECLARED widget type
+ * ({@link NON_CHART_DATASET_WIDGET_TYPES} is the taxonomy minus the chart
+ * family), carried by TWO ids rather than one:
+ * {@link CHART_MEASURES_MISSING} keeps the chart family, and
+ * {@link WIDGET_MEASURES_MISSING} takes the rest. Two, because "chart" stops
+ * naming the condition once the population is every family — a `metric` tile
+ * is not a chart — while the old id is depended on from OUTSIDE this file (the
+ * `packages/lint` barrel re-exports it, which
+ * `rule-id-barrel-exports.test.ts` makes a public-surface contract, and a
+ * board may already carry `suppressWarnings: ['chart-measures-missing']`).
+ * Renaming would have retired a reachable id and falsified those references;
+ * splitting keeps every one of them true and lets each message state the
+ * consequence its family actually has (no chart drawn / no KPI number drawn /
+ * no table rendered), which one id could only do by branching anyway.
+ *
+ * The DIMENSIONS shape stays chart-family only, and deliberately: a
+ * dimensionless `metric` or `table` is what those families are FOR (the
+ * shipped `system_overview` KPI tiles are exactly that shape), and a
+ * dimensionless `table` already has its own id in `table-count-only`.
+ *
+ * ### The three refused binding keys (#15463)
+ *
+ * `chart-field-unknown` shipped at `error` with a message that named a QUERY
+ * failure — *"the query result will not contain it"*. Read at the same PINNED
+ * `@object-ui` revision (`.objectui-sha`), that consequence never happens,
+ * because the renderer never reads these keys as bindings at all. The rule id
+ * covers exactly three positions, and all three are refused:
+ *
+ *  - `chartConfig.xAxis.field` — `axisPresentation`
+ *    (`@object-ui/core` `src/utils/chart-presentation.ts`) builds the axis's
+ *    presentation MINUS its `field`, and that dropping is structural, not a
+ *    guard: the x-axis key is `buildChartSeries`' `xAxisKey`, i.e. the widget's
+ *    `dimensions[0]`. An authored `field` re-points nothing.
+ *  - `chartConfig.yAxis[].field` — the same `axisPresentation` call, per entry.
+ *    The entry keeps its SLOT (the count is what turns on a secondary axis) and
+ *    its scale/chrome; only the binding is dropped.
+ *  - `chartConfig.series[].name` — `mergeAuthoredSeries` pairs an authored
+ *    entry with the derived binding whose `dataKey` it EQUALS, one series per
+ *    entry of `values`. A name matching no derived series is *"**ignored** —
+ *    membership belongs to the dataset, so an author cannot add, remove or
+ *    re-point a series from the chart config"*. So the presentation the author
+ *    hung on that entry — the mark, the colour, the stack, the axis side —
+ *    lands on nothing.
+ *
+ * The renderer pins all three by name in
+ * `packages/plugin-dashboard/src/__tests__/DatasetWidget.chartConfig.test.tsx`
+ * (*"ignores an authored axis `field` and keeps the derived axis binding"*,
+ * *"ignores an authored series and keeps one derived series per measure"*).
+ *
+ * So the failure is not a broken page, it is an ignored key — which is the
+ * class `widget-legacy-analytics-shape` above reports at WARNING tier in this
+ * same file (*"the dashboard renderer ignores them … a silent no-op"*). All
+ * three positions therefore drop from `error` to `warning`, suppressible per
+ * widget, and each message states what actually happens instead of a query that
+ * never runs. The finding is KEPT rather than deleted: unlike #14436's
+ * over-reach the metadata really is wrong — the author wrote a binding and
+ * believes it is in force.
+ *
+ * The tier drop is a behaviour change on the `sys_metadata` publish door: the
+ * 2026-08-15 ruling put all SIX of this rule's error ids on that door as one
+ * "this board cannot render" class, and this id leaves that set, so a publish
+ * carrying only a refused `chartConfig` binding key now SUCCEEDS with the
+ * finding on the advisory channel. The remaining five are unchanged; the
+ * accept-set is re-pinned in `runtime-gate.test.ts`.
+ *
  * Warnings can be deliberately suppressed per widget via
  * `suppressWarnings: ['<rule-id>']`; errors cannot — they describe a
  * binding the analytics service cannot satisfy.
@@ -186,6 +386,27 @@ declare const WIDGET_DIMENSION_UNKNOWN = "widget-dimension-unknown";
 declare const WIDGET_MEASURE_UNKNOWN = "widget-measure-unknown";
 declare const CHART_FIELD_UNKNOWN = "chart-field-unknown";
 declare const CHART_CONFIG_MISSING = "chart-config-missing";
+/**
+ * [#15462] A chart-family widget selects no measures, so the pinned renderer
+ * draws the "Pick measures (values)" placeholder instead of a chart.
+ */
+declare const CHART_MEASURES_MISSING = "chart-measures-missing";
+/**
+ * [#15462] A chart-family widget selects no dimensions, so the pinned
+ * renderer's `isMetric` branch draws a KPI number instead of the declared
+ * chart family.
+ */
+declare const CHART_DIMENSIONS_MISSING = "chart-dimensions-missing";
+/**
+ * [#15508] A NON-chart dataset widget — a `METRIC_WIDGET_TYPES` or a
+ * `TABULAR_WIDGET_TYPES` one — selects no measures, so the pinned renderer
+ * draws the same "Pick measures (values)" placeholder in place of the KPI
+ * number or the table. The chart-family spelling of the same shape keeps its
+ * own id ({@link CHART_MEASURES_MISSING}); see "The two empty-selection
+ * shapes" in the module docblock for why the population is split across two
+ * ids rather than carried by one.
+ */
+declare const WIDGET_MEASURES_MISSING = "widget-measures-missing";
 declare const TABLE_COUNT_ONLY = "table-count-only";
 declare const MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 declare const WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
@@ -218,7 +439,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$L = Record<string, unknown>;
+type AnyRec$N = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -226,7 +447,7 @@ type AnyRec$L = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$L): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$N): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -239,7 +460,7 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$K = Record<string, unknown>;
+type AnyRec$M = Record<string, unknown>;
 /**
  * A FIELD-level conditional rule (`visibleWhen` / `readonlyWhen` /
  * `requiredWhen`) that reaches for a namespace root the field level does not
@@ -525,7 +746,7 @@ declare function fieldRuleRootIssue(slot: string, source: string): {
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$K): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$M): ExprIssue[];
 
 /**
  * The corrective sentence, lifted **verbatim** from `unevaluableRuleError` in
@@ -718,7 +939,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$J = Record<string, unknown>;
+type AnyRec$L = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -728,7 +949,7 @@ type AnyRec$J = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$J): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$L): ListViewModeFinding[];
 
 type FunctionalCompletenessSeverity = 'error' | 'warning';
 interface FunctionalCompletenessFinding {
@@ -843,7 +1064,7 @@ declare const FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-des
  *     call sites that each skip it.
  */
 declare const FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
-type AnyRec$I = Record<string, unknown>;
+type AnyRec$K = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  *
@@ -852,7 +1073,7 @@ type AnyRec$I = Record<string, unknown>;
  * owns the `timeRelative` descriptor's contract, which is the point: the rule
  * ASKS that schema rather than restating it.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$I): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$K): FlowTriggerReadinessFinding[];
 
 type FlowTemplatePathSeverity = 'error' | 'warning';
 interface FlowTemplatePathFinding {
@@ -868,12 +1089,12 @@ interface FlowTemplatePathFinding {
 declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
 declare const FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
-type AnyRec$H = Record<string, unknown>;
+type AnyRec$J = Record<string, unknown>;
 /**
  * Validate `{record.<path>}` template references across every record-change
  * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTemplatePaths(stack: AnyRec$H): FlowTemplatePathFinding[];
+declare function validateFlowTemplatePaths(stack: AnyRec$J): FlowTemplatePathFinding[];
 
 type ReadonlyFlowWriteSeverity = 'error' | 'warning';
 interface ReadonlyFlowWriteFinding {
@@ -888,12 +1109,13 @@ interface ReadonlyFlowWriteFinding {
 }
 declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-type AnyRec$G = Record<string, unknown>;
+type AnyRec$I = Record<string, unknown>;
 /**
- * Validate flow `update_record` writes against target-object readonly
- * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
+ * Validate flow `update_record` / `create_record` writes against target-object
+ * readonly declarations. Pure and dependency-free; safe on pre- or post-parse
+ * stacks.
  */
-declare function validateReadonlyFlowWrites(stack: AnyRec$G): ReadonlyFlowWriteFinding[];
+declare function validateReadonlyFlowWrites(stack: AnyRec$I): ReadonlyFlowWriteFinding[];
 
 /** What a caller needs to tell an author WHICH source went unread, and where. */
 interface SourceParseFailure {
@@ -1021,7 +1243,7 @@ interface BodyWritePatternExclusion {
 declare const HOOK_BODY_WRITE_PATTERN_IDS: readonly string[];
 /** Ledger shapes this rule leaves alone, each with its reason. */
 declare const HOOK_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
-type AnyRec$F = Record<string, unknown>;
+type AnyRec$H = Record<string, unknown>;
 /** One statically-extracted field write found in an L2 body. */
 interface ExtractedHookBodyWrite {
     /** Which {@link HOOK_BODY_WRITE_PATTERNS} entry matched. */
@@ -1090,8 +1312,45 @@ declare function extractHookBodyWriteSet(source: string): ExtractedHookBodyWrite
 /**
  * Validate L2 hook-body writes against target-object field declarations.
  * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
- */
-declare function validateHookBodyWrites(stack: AnyRec$F): HookBodyWriteFinding[];
+ *
+ * ## Which intakes reach a hook authored as an inline `handler` (#16095)
+ *
+ * This rule opens on `body.language === 'js'`. A hook written as
+ * `handler: async (ctx) => { … }` carries no `body`, so whether it is judged
+ * is a property of the DOOR — what each caller hands this function — not of
+ * the rule. Measured (`packages/cli/test/lint-hook-rules-reach-handler-hooks*`):
+ *
+ * Every leg below was measured with the body-authored control beside it, so a
+ * silent leg is a reading about that door and never about this rule. The doors
+ * are the call sites of `runAuthoringRules`, enumerated — not the three `os *`
+ * commands, which are fewer than the doors:
+ *
+ *   `os build` union        `compile.ts` lowers every inline handler to a
+ *                           metadata body BEFORE its parse (`lowerCallables`)
+ *                           and judges the parsed result — REACHED, always was.
+ *   `os build` per-package  same lowered `result.data`, re-entered one package
+ *                           manifest at a time — REACHED, always was.
+ *   `os lint`               hands the registry's `parsed` tier that same
+ *                           lowered view — REACHED since #16095.
+ *   scaffold validate       `runScaffoldAuthoringRules` (`os init` / `dev` over
+ *                           a rendered template) lowers before it parses too —
+ *                           REACHED, always was, and pinned since #16095.
+ *   `os validate`           lowers before it parses since #16544 — the same
+ *                           `lowerCallables` call, between its pre-parse
+ *                           unknown-key lints and its parse — REACHED since
+ *                           #16544. Measured NOT reached under #16095, when it
+ *                           parsed the normalized stack without lowering while
+ *                           the body-authored control fired; closing it was
+ *                           its own accept/reject decision, taken on #16544.
+ *   direct call             judges exactly the stack it is given — NOT reached
+ *                           unless the caller lowers first; measured both ways.
+ *
+ * A handler the extractor refuses (forbidden token, free identifier,
+ * unparseable) is left with no `body` on every door, so this rule stays silent
+ * on it; the refusal itself is reported by `os lint`'s `hook-body/*` rules and
+ * by `os build`'s warn-and-bundle line, never guessed at here.
+ */
+declare function validateHookBodyWrites(stack: AnyRec$H): HookBodyWriteFinding[];
 
 type ReadonlyHookWriteSeverity = 'error' | 'warning';
 interface ReadonlyHookWriteFinding {
@@ -1117,13 +1376,50 @@ declare const HOOK_API_UPDATE_READONLY_WHEN_FIELD = "hook-api-update-readonly-wh
 declare const READONLY_HOOK_WRITE_PATTERN_IDS: readonly string[];
 /** Ledger shapes this rule leaves alone, each with its reason. */
 declare const READONLY_HOOK_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
-type AnyRec$E = Record<string, unknown>;
+type AnyRec$G = Record<string, unknown>;
 /**
  * Validate L2 hook-body `ctx.api` writes against target-object readonly
  * declarations. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or
  * post-parse stacks.
- */
-declare function validateReadonlyHookWrites(stack: AnyRec$E): ReadonlyHookWriteFinding[];
+ *
+ * ## Which intakes reach a hook authored as an inline `handler` (#16095)
+ *
+ * This rule opens on `body.language === 'js'`. A hook written as
+ * `handler: async (ctx) => { … }` carries no `body`, so whether it is judged
+ * is a property of the DOOR — what each caller hands this function — not of
+ * the rule. Measured (`packages/cli/test/lint-hook-rules-reach-handler-hooks*`):
+ *
+ * Every leg below was measured with the body-authored control beside it, so a
+ * silent leg is a reading about that door and never about this rule. The doors
+ * are the call sites of `runAuthoringRules`, enumerated — not the three `os *`
+ * commands, which are fewer than the doors:
+ *
+ *   `os build` union        `compile.ts` lowers every inline handler to a
+ *                           metadata body BEFORE its parse (`lowerCallables`)
+ *                           and judges the parsed result — REACHED, always was.
+ *   `os build` per-package  same lowered `result.data`, re-entered one package
+ *                           manifest at a time — REACHED, always was.
+ *   `os lint`               hands the registry's `parsed` tier that same
+ *                           lowered view — REACHED since #16095.
+ *   scaffold validate       `runScaffoldAuthoringRules` (`os init` / `dev` over
+ *                           a rendered template) lowers before it parses too —
+ *                           REACHED, always was, and pinned since #16095.
+ *   `os validate`           lowers before it parses since #16544 — the same
+ *                           `lowerCallables` call, between its pre-parse
+ *                           unknown-key lints and its parse — REACHED since
+ *                           #16544. Measured NOT reached under #16095, when it
+ *                           parsed the normalized stack without lowering while
+ *                           the body-authored control fired; closing it was
+ *                           its own accept/reject decision, taken on #16544.
+ *   direct call             judges exactly the stack it is given — NOT reached
+ *                           unless the caller lowers first; measured both ways.
+ *
+ * A handler the extractor refuses (forbidden token, free identifier,
+ * unparseable) is left with no `body` on every door, so this rule stays silent
+ * on it; the refusal itself is reported by `os lint`'s `hook-body/*` rules and
+ * by `os build`'s warn-and-bundle line, never guessed at here.
+ */
+declare function validateReadonlyHookWrites(stack: AnyRec$G): ReadonlyHookWriteFinding[];
 
 type ReadonlyActionWriteSeverity = 'warning';
 interface ReadonlyActionWriteFinding {
@@ -1150,13 +1446,13 @@ declare const ACTION_API_UPDATE_READONLY_WHEN_FIELD = "action-api-update-readonl
 declare const READONLY_ACTION_WRITE_PATTERN_IDS: readonly string[];
 /** Ledger shapes this rule leaves alone, each with its reason. */
 declare const READONLY_ACTION_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
-type AnyRec$D = Record<string, unknown>;
+type AnyRec$F = Record<string, unknown>;
 /**
  * Validate L2 action-body `ctx.api` writes against target-object `readonlyWhen`
  * declarations. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or
  * post-parse stacks.
  */
-declare function validateReadonlyActionWrites(stack: AnyRec$D): ReadonlyActionWriteFinding[];
+declare function validateReadonlyActionWrites(stack: AnyRec$F): ReadonlyActionWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -1193,14 +1489,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$C = Record<string, unknown>;
+type AnyRec$E = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$C): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$E): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -1213,8 +1509,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$B = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$B, opts?: {
+type AnyRec$D = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$D, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -1227,8 +1523,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$A = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$A): ReactPageFinding[];
+type AnyRec$C = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$C): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -1239,7 +1535,7 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$z = Record<string, unknown>;
+type AnyRec$B = Record<string, unknown>;
 /**
  * The source could not be parsed, so the prop checks below read a partially
  * recovered tree (#10653).
@@ -1265,13 +1561,21 @@ declare const REACT_PAGE_SOURCE_UNPARSEABLE = "react-page-source-unparseable";
  * "alias + loud deprecation", same shape as `approval-approver-type-deprecated`.
  */
 declare const REACT_PROP_DEPRECATED = "react-prop-deprecated";
+/**
+ * [#14791] A prop written in a react-tier spelling the contract has RETIRED
+ * (maintainer ruling 2026-09-07: `<ListView objectName>` / `viewType` go with
+ * no deprecation window). Error, never warning: the contract no longer
+ * publishes the spelling, and the finding carries the prescription — the
+ * react-tier twin of a metadata schema's `retiredKey()` tombstone.
+ */
+declare const REACT_PROP_RETIRED = "react-prop-retired";
 declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
 declare const REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 declare const REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 declare const REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
-declare function validateReactPageProps(stack: AnyRec$z): ReactPropFinding[];
+declare function validateReactPageProps(stack: AnyRec$B): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -1283,8 +1587,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$y = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$y): SourceStyleFinding[];
+type AnyRec$A = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$A): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -1328,14 +1632,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$x = Record<string, unknown>;
+type AnyRec$z = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$x): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$z): RecordTitleFinding[];
 
 declare const FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 declare const FIELD_GROUP_EMPTY = "field-group-empty";
@@ -1357,13 +1661,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$w = Record<string, unknown>;
+type AnyRec$y = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$w): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$y): SemanticRoleFinding[];
 
 declare const FORM_FIELD_UNKNOWN = "form-field-unknown";
 declare const FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
@@ -1389,12 +1693,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$v = Record<string, unknown>;
+type AnyRec$x = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$v): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$x): FormLayoutFinding[];
 
 declare const VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 declare const VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
@@ -1459,7 +1763,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$u = Record<string, unknown>;
+type AnyRec$w = Record<string, unknown>;
 /**
  * Validate conditional-visibility predicates across authored views and pages.
  *
@@ -1488,7 +1792,7 @@ type AnyRec$u = Record<string, unknown>;
  * check (#13594) is layer-agnostic in both halves: it prescribes a NAME, and the
  * environment registers the same names on every layer.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$u, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$w, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
 declare const PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
@@ -1531,7 +1835,7 @@ interface PredicatePathOptions {
      */
     resolveSchema?: (schemaId: string) => unknown;
 }
-type AnyRec$t = Record<string, unknown>;
+type AnyRec$v = Record<string, unknown>;
 /**
  * Refuse a metadata-form predicate that names a path the target schema does not
  * declare (#7010).
@@ -1560,7 +1864,7 @@ type AnyRec$t = Record<string, unknown>;
  *
  * Returns findings (empty = clean).
  */
-declare function validatePredicatePathRefs(stack: AnyRec$t, opts?: PredicatePathOptions): PredicatePathFinding[];
+declare function validatePredicatePathRefs(stack: AnyRec$v, opts?: PredicatePathOptions): PredicatePathFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -1578,12 +1882,12 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$s = Record<string, unknown>;
+type AnyRec$u = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$s): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$u): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
@@ -1609,12 +1913,12 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$r = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$r): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$t): ApprovalApproverFinding[];
 
 type SeedReplaySafetySeverity = 'error' | 'warning';
 interface SeedReplaySafetyFinding {
@@ -1628,7 +1932,7 @@ interface SeedReplaySafetyFinding {
     hint: string;
 }
 declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
-type AnyRec$q = Record<string, unknown>;
+type AnyRec$s = Record<string, unknown>;
 /**
  * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
  * mode, which duplicates its rows on every replay boot (framework#3434). Returns
@@ -1638,7 +1942,7 @@ type AnyRec$q = Record<string, unknown>;
  * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
  * with no `data` array yields no findings.
  */
-declare function validateSeedReplaySafety(stack: AnyRec$q): SeedReplaySafetyFinding[];
+declare function validateSeedReplaySafety(stack: AnyRec$s): SeedReplaySafetyFinding[];
 
 type SeedStateMachineSeverity = 'warning';
 interface SeedStateMachineFinding {
@@ -1652,7 +1956,7 @@ interface SeedStateMachineFinding {
     hint: string;
 }
 declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
-type AnyRec$p = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Flag every seed record whose `state_machine`-governed field carries a value
  * the machine does not declare (framework#3433 follow-up). Returns the findings
@@ -1665,7 +1969,7 @@ type AnyRec$p = Record<string, unknown>;
  * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
  * statically compared to the declared-state set.
  */
-declare function validateSeedStateMachine(stack: AnyRec$p): SeedStateMachineFinding[];
+declare function validateSeedStateMachine(stack: AnyRec$r): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -1677,6 +1981,7 @@ declare const SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unkno
 declare const SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
 declare const SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
 declare const SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
+declare const SECURITY_FLS_UNKNOWN_FIELD = "security-fls-unknown-field";
 declare const SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 declare const SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
 declare const SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
@@ -1695,7 +2000,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$o = Record<string, unknown>;
+type AnyRec$q = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -1703,7 +2008,7 @@ type AnyRec$o = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$o, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$q, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 /**
@@ -1734,94 +2039,8 @@ declare function validateSecurityPosture(stack: AnyRec$o, opts?: {
  * carries `positions`/`apps` and both types are gated — at which point it
  * crosses whole, in one edit, as its own entry.
  */
-declare function validateSecurityRoleWord(stack: AnyRec$o): SecurityFinding[];
+declare function validateSecurityRoleWord(stack: AnyRec$q): SecurityFinding[];
 
-/**
- * [ADR-0105 D6] The two organization-axis red lines, enforced at authoring time.
- *
- * ADR-0105 gives organizations a reporting/grouping dimension
- * (`sys_organization.parent_organization_id`, sibling ordering). That dimension
- * is load-bearing for consolidated reporting — and dangerous, because it LOOKS
- * like a permission hierarchy. Two lines keep it from becoming one:
- *
- * | Rule                                    | Red line                          |
- * |-----------------------------------------|-----------------------------------|
- * | org-axis-permission-inheritance (error) | D6 ①: no inheritance along the org tree |
- * | org-axis-cross-org-bu-grant     (error) | D6 ②: business-unit trees stay org-internal |
- *
- * **① No permission inheritance along the org axis.** Cross-organization
- * visibility comes from membership union (`accessible_org_ids`, ADR-0105 D2) —
- * the engine's own Layer 0 wall — never from walking a parent reference. An RLS
- * policy or sharing rule that reads `parent_organization_id` builds a SECOND
- * permission hierarchy beside the business-unit tree: exactly the dual-hierarchy
- * mistake ADR-0057 D5 retired and ADR-0090 D3 finalized for positions. It also
- * silently outranks the wall it sits behind, since a Layer-1 policy cannot widen
- * Layer 0 (W1) — so the author gets a rule that appears to grant access and
- * does not. Fail at authoring, not in a support ticket.
- *
- * **② Business-unit trees remain org-internal.** `sys_business_unit` is
- * org-scoped and every BU mechanism (`unit_and_subordinates` sharing,
- * `adminScope` delegation, depth scopes) resolves within ONE organization. A
- * business-unit sharing rule on a PLATFORM-GLOBAL object (`tenancy.enabled:
- * false`) has no organization column to scope against, so the grant spans every
- * organization in the database — a cross-org BU grant by construction, and the
- * "cross-org BU mega-tree" the ADR rejected, arrived at by accident. It covers
- * BOTH business-unit recipients, `business_unit` and `unit_and_subordinates`
- * — see {@link BU_TREE_RECIPIENT_TYPES} for the word list and its deliberate
- * complement.
- *
- * Both are `error`, per ADR-0049 discipline: each mirrors a real enforcement
- * property (the Layer 0 wall's independence; the org-predicated BU resolver),
- * so the lint moves the failure from silent-wrong-answer to author-time fix-it.
- *
- * Pure `(stack) => Finding[]`; accepts the NORMALIZED stack input.
- *
- * ## Scope — the keys this rule reads, and the ones it deliberately does not
- *
- * Every key below is one `@objectstack/spec` DECLARES. That is a contract, not
- * a style preference: the rule is registered `input: 'parsed'`, so what it sees
- * is what `ObjectStackSchema` returned. An undeclared key never survives to be
- * read — the stack root strips it, and the `.strict()` sub-schemas reject the
- * whole stack outright — so a branch keyed on one is inert for every stack an
- * author can actually ship (#4984, #5009).
- *
- * | Read                                  | Declared by                        |
- * |---------------------------------------|------------------------------------|
- * | `permissions[]`                       | `ObjectStackSchema`                |
- * | `permissions[].rowLevelSecurity[]`    | `PermissionSetSchema`              |
- * | `…[].using` / `…[].check`             | `RowLevelSecurityPolicySchema`     |
- * | `sharingRules[]`                      | `ObjectStackSchema`                |
- * | `sharingRules[].condition` / `.sharedWith` / `.object` | `SharingRuleSchema` |
- * | `objects[].tenancy` / `.systemFields` | `ObjectSchema`                     |
- *
- * NOT read, and each for a reason that is a schema fact:
- *
- * - `permissionSets` / `sharing` — not declared on the stack root. The root
- *   STRIPS them, so after parse they are `undefined` no matter what the author
- *   wrote. The declared spellings are `permissions` and `sharingRules`.
- * - `sharingRules[].objectName` — `SharingRuleSchema` is `.strict()` and knows
- *   it only as a rejected name; `object` is required, so the canonical read can
- *   never be missing on a rule that parsed.
- * - `objects[].rowLevelSecurity` / `objects[].rls` — **object-level RLS is not
- *   an authoring surface at all.** `ObjectSchema` declares neither key (nor
- *   does `authorable-surface.json` list one: the sole entry is
- *   `security/PermissionSet:rowLevelSecurity`), and `ObjectSchema` is
- *   `.strict()`, so a stack carrying one does not parse — it is refused with
- *   "Unrecognized key(s) on this object". Until #5009 this file walked that
- *   non-existent surface for ~20 lines, complete with an `objects[N].
- *   rowLevelSecurity[M].using` diagnostic path. Nothing could reach it, and the
- *   cost was never the missed finding: the next author to read this rule (human
- *   or AI) came away believing object-level RLS was a real authorization
- *   surface and wrote more code against it (#5008 nearly did). RLS policies
- *   live on a permission set; that is the branch above.
- *
- * Alias tolerance belongs at the schema's refusal, not in a consumer (Prime
- * Directive #12) — where it also converts a loud, named rejection into a
- * silently-inert gate. `validate-org-axis-red-lines.test.ts` pins all of this
- * structurally: every key read here is checked against the declaring schema's
- * own `.shape`, and every `findings.push` site must be reachable by a fixture
- * that passed `safeParse`.
- */
 declare const ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
 declare const ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
 type OrgAxisSeverity = 'error' | 'warning';
@@ -1903,86 +2122,6 @@ interface RlsPredicateFinding {
  */
 declare function validateRlsPredicateEnforceability(stack: unknown): RlsPredicateFinding[];
 
-/**
- * [ADR-0049 — references] Reference-integrity for dashboard header action
- * targets (issue #3367).
- *
- * ADR-0049 established the "enforce-or-remove" gate for spec *properties*: a
- * declared property the runtime does not honour is a false promise and must be
- * enforced, marked experimental, or removed. This rule applies the SAME honesty
- * principle to *references*. A dashboard header action names a target — a
- * `script`/`modal` action, or a `url` route — that must actually resolve. A
- * dangling target ships a button that renders and, on click, silently does
- * nothing: a false affordance, exactly the failure ADR-0049 exists to prevent,
- * just for a reference rather than a property.
- *
- * Nothing in the protocol schema can express this: `actionUrl` is a free string,
- * so `{ actionType: 'script', actionUrl: 'export_dashboard_pdf' }` parses and
- * ships even when no such action is defined anywhere in the stack.
- *
- * Surfaces checked:
- *   - dashboard `header.actions[]` — each `{ actionType, actionUrl }`
- *
- * ## The widget branch, and why it is gone (#5010)
- *
- * This rule used to check `widgets[].actionUrl` too, describing it as "the
- * per-widget button" and claiming in this docblock that it "mirrors the objectui
- * runtime dispatch". It did not: no renderer in either repo has ever drawn a
- * per-widget action button — all 14 `actionUrl` reads in `DashboardRenderer` are
- * scoped to `header.actions[]`. So the strictest arm of this rule (a dangling
- * `script`/`modal` target is an ERROR, i.e. a failed build) was enforcing
- * referential integrity for a button that could not render. An author could be
- * blocked from shipping because a control that does not exist pointed at an
- * action that also did not.
- *
- * That inversion — a rule written to delete false affordances, itself sustaining
- * one — is why the widget keys were retired rather than the check merely
- * relaxed: `widgets[].actionUrl` / `actionType` / `actionIcon` are now tombstoned
- * in `@objectstack/spec` 17.0.0, so authoring one is a `tsc` error and a parse
- * error carrying the prescription. There is no widget target left to resolve.
- *
- * Resolution mirrors the objectui runtime dispatch (`DashboardRenderer`
- * hands the target to the SHARED `useActionModal` since objectui#4782) so the
- * lint flags exactly what would fail to resolve at runtime:
- *
- *   actionType 'script' → `actionUrl` must name a DEFINED action (`stack.actions`
- *       or any `object.actions`, by `name`). A script target that names no
- *       defined action fails open at runtime ("action not found"). → ERROR.
- *
- *   actionType 'modal'  → `actionUrl` names a declared PAGE (`stack.pages`), and
- *       only a page — maintainer ruling objectstack#6739-A (2026-08-09). This
- *       rule used to accept a defined action name, a bare object name, and the
- *       `<verb>_<object>` convention (create_/new_/add_/edit_/update_ + object),
- *       on the claim that it mirrored `DashboardView`'s own modal handler. That
- *       handler — the convention's last live copy — was deleted by objectui#4782
- *       (after objectui#4764 retired the object fallback in `useActionModal`):
- *       the runtime resolves a string modal target against page metadata and
- *       REFUSES everything else, so each retired limb here blessed a button that
- *       dispatches to a named refusal at runtime. The ruling explicitly declined
- *       the middle shape (keep the prefix, reject bare object names): a target
- *       names the page `create_opportunity`, or it names nothing. Opening an
- *       object's form is `actionType: 'form'`. Otherwise → ERROR.
- *
- *   actionType 'url'    → a relative in-app path. WARN when a recognizable
- *       `<collection>/<name>` segment (objects/reports/dashboards/pages/views)
- *       names an entity that does not exist in this stack. External URLs
- *       (`http(s)://`, `//`), interpolated targets (`${…}`), and opaque routes
- *       (no recognized collection segment) are skipped — they cannot be resolved
- *       statically and may be host/app/plugin routes. → WARNING.
- *
- *   actionType 'flow' | 'api' — not checked: flow targets resolve against the
- *       automation engine / other packages, and api targets are opaque endpoints.
- *       Out of scope for #3367.
- *
- * Severity split follows the issue's acceptance criteria: an undefined
- * `script`/`modal` target FAILS validation (a genuine dead reference that fails
- * open at runtime as a dead button); an unresolved `url` route is advisory
- * (route resolution is app-context-dependent, and a path may be served by
- * another installed package or a host/console route). External, interpolated,
- * convention, and opaque targets are exempted to keep false positives near zero
- * — the same conservative posture as the sibling `lint-view-refs` and
- * `validate-capability-references` rules.
- */
 declare const DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
 declare const DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
 type DashboardActionRefSeverity = 'error' | 'warning';
@@ -2000,13 +2139,13 @@ interface DashboardActionRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$n = Record<string, unknown>;
+type AnyRec$p = Record<string, unknown>;
 /**
  * Validate every dashboard header action reference in a stack. Returns
  * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
  * unresolved routes are warnings.
  */
-declare function validateDashboardActionRefs(stack: AnyRec$n): DashboardActionRefFinding[];
+declare function validateDashboardActionRefs(stack: AnyRec$p): DashboardActionRefFinding[];
 
 /**
  * Build-time filter-placeholder diagnostics (issue #3574).
@@ -2090,9 +2229,82 @@ interface FilterTokenFinding {
  */
 declare function validateFilterTokens(stack: Record<string, unknown> | undefined | null): FilterTokenFinding[];
 
+/** Diagnostic rule id. */
+declare const FLOW_FILTER_TOKEN_UNKNOWN = "flow-filter-token-unknown";
+interface FlowFilterTokenFinding {
+    /** Always `error` — the node throws a guard refusal instead of running. */
+    severity: 'error';
+    rule: string;
+    /** Human-readable location, e.g. `flow "opportunity_stagnation"`. */
+    where: string;
+    /** Config path, e.g. `flows[2].nodes[1].config.filter.close_date.$lt`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/**
+ * Validate flow-node filter placeholders across a schema-parsed stack.
+ *
+ * Pure `(stack) => Finding[]`; no I/O.
+ */
+declare function validateFlowFilterTokens(stack: Record<string, unknown> | undefined | null): FlowFilterTokenFinding[];
+
+/** The two names legal only as a whole token (`{TODAY() + 7}`), never in a call. */
+declare const FLOW_TEMPLATE_DATE_FUNCTIONS: readonly string[];
+/**
+ * The value-expression function table — the CEL stdlib's numeric six, by the
+ * #11060 ruling. Mirrors `EXPRESSION_FUNCTION_ARITY`'s key set.
+ */
+declare const FLOW_TEMPLATE_VALUE_FUNCTIONS: readonly string[];
+/** What the flow template dialect does with one whole-string `{…}` token. */
+type FlowTemplateTokenVerdict = 
+/** `{NOW()}` / `{TODAY() - 45}` — the evaluator resolves it. Legitimate. */
+{
+    kind: 'date-function';
+    name: string;
+}
+/** `{$User.Id}` — the evaluator resolves it from the run context. */
+ | {
+    kind: 'user-context';
+}
+/**
+ * `{recordId}` / `{record.id}` — a `VariableMap` lookup, and the position
+ * from which an unresolved name is handed to the filter dialect. OPEN: not
+ * decidable from authored metadata, so never a finding.
+ */
+ | {
+    kind: 'variable-path';
+    head: string;
+}
+/**
+ * A call to a name in NEITHER table. `resolveToken` throws
+ * `FlowExpressionFunctionError` here (a guard refusal — a `fault` edge must
+ * not swallow it), so the node cannot run. THIS is the finding.
+ */
+ | {
+    kind: 'unknown-function';
+    name: string;
+}
+/**
+ * Anything else — junk shapes (`{30 days ago}`) and arithmetic over names
+ * this module cannot resolve. `resolveToken` answers `undefined` and the
+ * CRUD collapse guard (#3810) reports it at run time. Open, not judged.
+ */
+ | {
+    kind: 'unresolvable-shape';
+};
+/**
+ * Classify the INSIDE of one whole-string `{…}` filter token — `inner` is the
+ * text between the braces, exactly as authored.
+ *
+ * Mirrors `resolveToken`'s dispatch order (see the module header). Holds no
+ * severity and knows nothing about where the token was found.
+ */
+declare function classifyFlowTemplateToken(inner: string): FlowTemplateTokenVerdict;
+
 /**
- * Build-time refusal of a bare dashboard date-range PRESET name in an ordering
- * comparand (#8793 — the ruled C half of #8690).
+ * Build-time refusal of a bare dashboard date-range PRESET name authored as a
+ * filter comparand — two arms, one wording.
  *
  * `last_7_days` / `last_30_days` / `last_90_days` and their ten calendar
  * siblings are REAL declared names (`DATE_RANGE_PRESETS`,
@@ -2118,10 +2330,10 @@ declare function validateFilterTokens(stack: Record<string, unknown> | undefined
  * (`['created_at', '>=', …]`) — and reports with the located `where` / `path`
  * the CLI commands render.
  *
- * ## The boundary — ordering positions only, in all three shapes
+ * ## Arm 1 — ordering positions, FIELD-AGNOSTIC (#8793)
  *
- * This rule is field-agnostic, so the judgement rides on POSITION, exactly as
- * the schema door's #8793 note lays out at length:
+ * The judgement rides on POSITION alone, exactly as the schema door's #8793
+ * note lays out at length:
  *
  * - **Judged:** `$gt` / `$gte` / `$lt` / `$lte` comparands and `$between`
  *   endpoints (Mongo shape); `>` / `>=` / `<` / `<=` / `between` triples and
@@ -2129,17 +2341,105 @@ declare function validateFilterTokens(stack: Record<string, unknown> | undefined
  *   `greater_than` / `less_than` / `greater_than_or_equal` /
  *   `less_than_or_equal` / `before` / `after` / `between` view filter rules
  *   and every alias `normalizeFilterOperator` folds onto them. An ORDERED
- *   comparison against a declared preset name has no legitimate reading.
- * - **Not judged:** equality and membership (`=`, `equals`, `$eq`, `$ne`,
- *   `$in`, `$nin`, …). A select/picklist column legitimately stores values
- *   that collide with preset names (`GlobalFilterSchema`'s own pins protect
- *   `type: 'select', defaultValue: 'this_quarter'`), and on a declared
- *   temporal field the engine door still refuses these at query time with the
- *   field's type in hand.
+ *   comparison against a declared preset name has no legitimate reading on
+ *   ANY column, so no field type is needed to refuse it.
  * - **Only the 13 declared names.** A near-miss (`last_60_days`) is not this
  *   rule's business — on a temporal field the engine's field-typed door
  *   catches it; judging undeclared strings here would be a guessed superset.
  *
+ * ## Arm 2 — equality and membership positions, FIELD-TYPED (#16106)
+ *
+ * Equality (`{ period: 'this_quarter' }`, `$eq`, `$ne`) and membership (`$in`
+ * / `$nin`) CANNOT be judged blind: a select/picklist column legitimately
+ * stores values that collide with preset names (`GlobalFilterSchema`'s own
+ * pins protect `type: 'select', defaultValue: 'this_quarter'`), and equality
+ * against such a stored value is a working filter. That is why the schema
+ * door — field-agnostic by construction — keeps its ordering-only boundary,
+ * and why this arm exists HERE, where the stack's object metadata is in hand:
+ * maintainer-ruled 2026-09-06 (#16106, comment 5557019138, adopting
+ * recommendation 1′): *at a layer that holds the object metadata, a declared
+ * `date` / `datetime` field refuses one of the 13 declared preset names in
+ * EVERY comparand position — bare (implicit equality), `$eq` / `$ne`, `$in` /
+ * `$nin` and their view-rule and triple spellings, alongside the ordering
+ * positions already judged.* Same message, same prescription (the #5240
+ * convention): the window the preset already means is exactly what an author
+ * writing `close_date == 'last_30_days'` intended.
+ *
+ * Measured first (ruling item 3), as real queries on a declared `date` field
+ * (`close_date`) and a declared `datetime` sibling, on two real drivers —
+ * `@objectstack/driver-memory` and `@objectstack/driver-sqlite-wasm` — 30 rows
+ * seeded / 20 inside a 30-day window; both drivers answered identically:
+ *
+ * ```
+ * close_date: 'last_30_days'              REFUSED  INVALID_FILTER / 400   (bare)
+ * close_date: { $eq:  'last_30_days' }    REFUSED  INVALID_FILTER / 400
+ * close_date: { $in: ['last_30_days'] }   REFUSED  INVALID_FILTER / 400
+ * close_date: { $ne / $nin … }            REFUSED  INVALID_FILTER / 400
+ * close_date: { $gte: '{30_days_ago}' }   200      count=20   <- positive control
+ * close_date: '2026-09-03'                200      count=1    <- equality works on a date
+ * stage: 'this_quarter'  (select column)  200      count=10   <- the picklist case, alive
+ * ```
+ *
+ * So at QUERY time the engine door already refuses every residue position on a
+ * declared temporal field — the residue was purely an AUTHORING-time gap:
+ * `objectstack lint` passed and `defineStack` accepted a filter the runtime
+ * then refused with a 400 on first render. This arm closes that gap where the
+ * AI author's correction loop can see it.
+ *
+ * ### Which object a filter is judged against
+ *
+ * `walkAuthoredFilters` finds the subtrees; this arm re-walks each subtree's
+ * config path back through its ancestors and binds the filter to the NEAREST
+ * ancestor that declares an object, in the spellings the carriers actually
+ * use (each one the same read a sibling rule already makes at that position):
+ *
+ * - a literal `object` / `objectName` — a dataset, a summary field's child
+ *   object, a global filter's `optionsFrom`, a page data source, a
+ *   `record:related_list`'s `properties`, a time-relative trigger;
+ * - a `dataset` name, resolved to that dataset's `object` — dashboard widgets
+ *   (`validate-widget-bindings`, #14148), reports and report blocks;
+ * - `data: { provider: 'object', object }` — standalone views and list views
+ *   (`validate-list-view-field-refs`, #14107); any OTHER provider names no
+ *   object, so the position is unjudged;
+ * - `config.objectName` / `config.object` — flow CRUD nodes
+ *   (`validate-flow-node-writes`), a templated `{…}` value skipped;
+ * - `dataSource.object`, then `properties.object` / `properties.objectName`
+ *   — page components (`validate-page-field-bindings`);
+ * - `publicPicker.object`, else the enclosing form field's `reference`
+ *   resolved on the view's object, else NOTHING — a form field's public-lookup
+ *   picker (`FormFieldPublicPickerSchema`) queries the REFERENCED object, so
+ *   its `filter` must never fall through to the parent form object (#16106
+ *   review finding B1: that fall-through was a false refusal wherever the two
+ *   objects share a field name with differing types);
+ * - and, under `objects`, the object itself — its list views, tabs and
+ *   `relatedListFilter` (the filter runs over the CHILD rows, i.e. the object
+ *   that owns the field).
+ *
+ * The field key (a bare name, or a dotted relationship path) is then resolved
+ * through `resolveFieldPath` (`object-graph.ts`), and the comparand is judged
+ * only when the LEAF resolves to an author-declared field of type `date` or
+ * `datetime` — the two types the ruling names.
+ *
+ * ### What this arm deliberately does NOT judge
+ *
+ * Every one of these is a MISSED CATCH (the engine door still refuses it at
+ * query time, field type in hand), never a false build error:
+ *
+ * - a position no ancestor binds (an app-level filter, a dashboard-level
+ *   filter outside a widget), a dataset or object the stack does not declare,
+ *   an object with no readable field map, a view on a non-`object` provider;
+ * - a leaf that resolves only as a registry-INJECTED column (`created_at`,
+ *   `updated_at`, …): the object graph carries no type for those — their type
+ *   is registry-owned and invisible here (`FieldPathVerdict`'s own contract);
+ * - a `time` field: the ruling names `date` / `datetime`, and a wall-clock
+ *   column has no preset-shaped authoring slip worth a rule of its own;
+ * - a field the object does not declare at all (a typo) — that is the
+ *   `*-filter-field-unknown` rules' finding, not a second one here.
+ *
+ * The implicit-equality position is reported under the operator it LOWERS to,
+ * `$eq`, at the path of the field itself (`…filter.close_date`, no operator
+ * segment), so the located path still says exactly what was authored.
+ *
  * Both vocabularies' `{placeholder}` spellings never collide with a preset
  * name (a preset carries no braces), so this rule and `validate-filter-tokens`
  * cannot double-report one value.
@@ -2163,9 +2463,10 @@ interface PresetComparandFinding {
 /**
  * Validate every authored filter across a stack for bare preset comparands.
  *
- * Pure `(stack) => Finding[]`; no I/O. Needs no resolution context — the
- * judgement is on the filter literal alone — which is what qualifies it for
- * the runtime publish gate's per-write snapshot.
+ * Pure `(stack) => Finding[]`; no I/O. Arm 1 judges the filter literal alone;
+ * arm 2 additionally reads the stack's own `objects` (and `datasets`, to bind
+ * a widget or report) — both collections the runtime publish gate's per-write
+ * snapshot carries — and stays silent wherever they are absent.
  */
 declare function validatePresetComparands(stack: Record<string, unknown> | undefined | null): PresetComparandFinding[];
 
@@ -2215,12 +2516,12 @@ interface ObjectRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$m = Record<string, unknown>;
+type AnyRec$o = Record<string, unknown>;
 /**
  * Validate every object-name reference on the surfaces listed in the module
  * header. Returns findings (empty = clean).
  */
-declare function validateObjectReferences(stack: AnyRec$m): ObjectRefFinding[];
+declare function validateObjectReferences(stack: AnyRec$o): ObjectRefFinding[];
 
 type ReferenceIntegritySeverity = 'error' | 'warning';
 /**
@@ -2617,7 +2918,7 @@ interface SearchableFieldFinding {
  *   runtime would refuse are flagged (#4830).
  */
 type SearchableFieldRole = 'canonical' | 'narrowing';
-type AnyRec$l = Record<string, unknown>;
+type AnyRec$n = Record<string, unknown>;
 /**
  * The slice of an object the search checks resolve against: the authored
  * field map (existence + the `type`/`hidden` meta search resolution reads),
@@ -2648,7 +2949,7 @@ interface ObjectSearchTarget {
  * `validate-react-page-props` — the gate that already parses that source —
  * runs the same `checkSearchableFieldList` core on it (#4329).
  */
-declare function validateSearchableFields(stack: AnyRec$l): SearchableFieldFinding[];
+declare function validateSearchableFields(stack: AnyRec$n): SearchableFieldFinding[];
 
 declare const SORT_FIELD_UNKNOWN = "sort-field-unknown";
 declare const SORT_FIELD_UNSORTABLE = "sort-field-unsortable";
@@ -2674,7 +2975,7 @@ interface SortableFieldFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$k = Record<string, unknown>;
+type AnyRec$m = Record<string, unknown>;
 /**
  * Check ONE authored `sort` declaration against the object it is bound to —
  * the shared core behind every list-view surface that declares an ordering.
@@ -2697,7 +2998,7 @@ declare function checkSortDeclaration(declared: unknown, objectName: string | un
  * over the bound object's own columns. See the module note for the four
  * sort-carrying surfaces that were checked and deliberately left out.
  */
-declare function validateSortableFields(stack: AnyRec$k): SortableFieldFinding[];
+declare function validateSortableFields(stack: AnyRec$m): SortableFieldFinding[];
 
 /** A list-view field reference that resolves to no field on the bound object. */
 declare const LIST_VIEW_FIELD_UNKNOWN = "list-view-field-unknown";
@@ -2722,14 +3023,40 @@ interface ListViewFieldRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$j = Record<string, unknown>;
+type AnyRec$l = Record<string, unknown>;
 /**
  * Validate every list view's field references against the object graph.
  * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
  * safe on both the schema-parsed stack and the raw config the `lint` path
  * carries.
  */
-declare function validateListViewFieldRefs(stack: AnyRec$j): ListViewFieldRefFinding[];
+declare function validateListViewFieldRefs(stack: AnyRec$l): ListViewFieldRefFinding[];
+
+/** An object-level field-name list entry that resolves to no field on the object. */
+declare const OBJECT_FIELD_REF_UNKNOWN = "object-field-ref-unknown";
+type ObjectFieldRefSeverity = 'error' | 'warning';
+interface ObjectFieldRefFinding {
+    /** Always `error` — see the severity note on this module. */
+    severity: ObjectFieldRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "proj_task" › highlightFields`. */
+    where: string;
+    /** Config path, e.g. `objects[0].highlightFields[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$k = Record<string, unknown>;
+/**
+ * Validate every object's own field-name lists against the object graph.
+ * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
+ * safe on both the schema-parsed stack and the raw config the `lint` path
+ * carries.
+ */
+declare function validateObjectFieldRefs(stack: AnyRec$k): ObjectFieldRefFinding[];
 
 declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
 type ActionNameRefSeverity = 'error' | 'warning';
@@ -2747,62 +3074,13 @@ interface ActionNameRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$i = Record<string, unknown>;
+type AnyRec$j = Record<string, unknown>;
 /**
  * Validate every name-bound action reference in a stack. Returns findings
  * (empty = clean).
  */
-declare function validateActionNameRefs(stack: AnyRec$i): ActionNameRefFinding[];
+declare function validateActionNameRefs(stack: AnyRec$j): ActionNameRefFinding[];
 
-/**
- * [ADR-0078 Phase 3 — Tier-A `action-locations`] An action nobody placed.
- *
- * `locations` is an action's placement declaration. An action that omits it —
- * and that no view names in `bulkActions` / `bulkActionDefs` / `rowActions` —
- * has no surface at all: it parses, it publishes, Setup lists it, and no user
- * can ever click it. ADR-0078 names this shape in its opening paragraph ("a
- * `summary` with no `summaryOperations`; **an `action` with no `locations`**;
- * … Each parses, 'renders', reports success — and does nothing") and Phase 3
- * asks for exactly this rule, one verified shape at a time.
- *
- * The renderer half is now unambiguous: objectui#3142 collapsed four
- * disagreeing renderers onto one predicate — an action renders at a location
- * only if it DECLARES that location. Before that, `action:bar` and the record
- * header showed an undeclared action *everywhere*, which is what made this
- * shape look alive; it is measurably inert as of objectui 17.1.
- *
- * ## What is NOT flagged, and why
- *
- * **`locations: []` — a deliberate headless action.** `content/docs/ui/
- * actions.mdx` ("Headless actions: declare it, then hide it") documents the
- * empty array as a first-class shape: the action stays callable over REST /
- * MCP / AI and keeps its capability gate, param contract and audit trail,
- * while claiming no UI surface. ADR-0110 D3 refuses an *undeclared* handler,
- * so a headless declaration is the only legal way to expose such an action —
- * flagging it would fight that ADR. The distinction this rule draws is
- * therefore between an author who said "nowhere, deliberately" (`[]`) and one
- * who never said anything at all (key absent).
- *
- * **Actions a view places by NAME.** Naming an action in a list view's
- * `bulkActions` or `bulkActionDefs` IS its placement — the selection bar is
- * driven by the view, never by `locations` (that is what the retired
- * `action.bulkEnabled` tombstone prescribes, and what objectui#3139's
- * aggregate bulk mode relies on: an action that only makes sense over a
- * selection has no single-record location by construction). `rowActions` is
- * exempted on the same zero-false-positive posture (ADR-0072 D1): it is the
- * same field pair on the same container, and an author who named an action
- * there has stated an intent — a name that resolves to nothing is already
- * `action-name-undefined`'s job, not this rule's.
- *
- * Scope note: this rule asks only "did anyone place this action?". It
- * deliberately does NOT check that a declared location is one a renderer
- * actually serves, nor that a view's named action belongs to that view's
- * object — distinct classes with their own rules. Cross-package placement (a
- * view in another installed package naming this action) is the one legitimate
- * miss, which is why this is a **warning**: like every other "declared but
- * does nothing" finding in this package (`validateSemanticRoles`,
- * `lintLivenessProperties`), it is high-signal and never fatal.
- */
 declare const ACTION_NO_PLACEMENT = "action-no-placement";
 type ActionLocationsSeverity = 'error' | 'warning';
 interface ActionLocationsFinding {
@@ -2819,12 +3097,12 @@ interface ActionLocationsFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$h = Record<string, unknown>;
+type AnyRec$i = Record<string, unknown>;
 /**
  * Flag every action that declares no placement and that no view places by
  * name. Returns findings (empty = clean).
  */
-declare function validateActionLocations(stack: AnyRec$h): ActionLocationsFinding[];
+declare function validateActionLocations(stack: AnyRec$i): ActionLocationsFinding[];
 
 /**
  * Shared page-component traversal for the lint rules that inspect
@@ -2850,11 +3128,11 @@ declare function validateActionLocations(stack: AnyRec$h): ActionLocationsFindin
  *     author never wrote, so those pages are skipped here and covered by
  *     `validate-jsx-pages` / `validate-react-page-props` instead.
  */
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /** A visited component plus everything needed to locate and bind it. */
 interface WalkedComponent {
     /** The component record itself. */
-    component: AnyRec$g;
+    component: AnyRec$h;
     /** Config path, e.g. `pages[0].regions[1].components[2]`. */
     path: string;
     /**
@@ -2865,7 +3143,7 @@ interface WalkedComponent {
     objectName?: string;
 }
 /** Is this page authored as `source` (so its `regions` must not be linted)? */
-declare function isSourceAuthoredPage(page: AnyRec$g): boolean;
+declare function isSourceAuthoredPage(page: AnyRec$h): boolean;
 /**
  * Walk every component on a page, depth-first, yielding each with its config
  * path and resolved object binding. Source-authored pages yield nothing.
@@ -2902,7 +3180,7 @@ declare function isSourceAuthoredPage(page: AnyRec$g): boolean;
  * descent is bounded by the document's own finite nesting, so the cap would only
  * ever fire on acyclic input, which is precisely the input it must not truncate.
  */
-declare function walkPageComponents(page: AnyRec$g, pagePath: string): WalkedComponent[];
+declare function walkPageComponents(page: AnyRec$h, pagePath: string): WalkedComponent[];
 
 /**
  * object name → its DECLARED field-group keys.
@@ -2912,7 +3190,7 @@ declare function walkPageComponents(page: AnyRec$g, pagePath: string): WalkedCom
  * data-dependent) finding from a reference to a group that was never declared.
  * This index answers only the second question — the one with a closed oracle.
  *
- * `fieldGroups` is an ARRAY on `ObjectSchema`, and `asArray` additionally
+ * `fieldGroups` is an ARRAY on `ObjectSchema`, and `recordsOf` additionally
  * resolves the name-keyed map shape that raw (non-`defineStack`) metadata can
  * carry, the same tolerance every other index in this package extends.
  */
@@ -3046,7 +3324,7 @@ interface PageFieldFinding {
     hint: string;
 }
 
-declare function validatePageFieldBindings(stack: AnyRec$g): PageFieldFinding[];
+declare function validatePageFieldBindings(stack: AnyRec$h): PageFieldFinding[];
 
 declare const PAGE_VISUALIZATION_WITHOUT_BINDING = "page/visualization-without-binding";
 type PageVisualizationSeverity = 'error' | 'warning';
@@ -3097,8 +3375,8 @@ interface VisualizationPredicate {
  * that pin is the drift this table's whole purpose is to make loud.
  */
 declare const OBJECTUI_DERIVATION_PREDICATES: readonly VisualizationPredicate[];
-type AnyRec$f = Record<string, unknown>;
-declare function validatePageVisualizationBindings(stack: AnyRec$f): PageVisualizationFinding[];
+type AnyRec$g = Record<string, unknown>;
+declare function validatePageVisualizationBindings(stack: AnyRec$g): PageVisualizationFinding[];
 
 /** A key authored in `properties` that the type's props schema does not declare. */
 declare const COMPONENT_PROPS_UNKNOWN_KEY = "component-props-unknown-key";
@@ -3124,7 +3402,7 @@ interface ComponentPropsFinding {
     /** How to fix it. */
     hint: string;
 }
-declare function validateComponentProps(stack: AnyRec$g): ComponentPropsFinding[];
+declare function validateComponentProps(stack: AnyRec$h): ComponentPropsFinding[];
 
 /** A component `type` inside a spec-reserved namespace that the vocabulary does not declare. */
 declare const COMPONENT_TYPE_UNKNOWN = "component-type-unknown";
@@ -3141,7 +3419,7 @@ interface ComponentTypeFinding {
     /** How to fix it. */
     hint: string;
 }
-declare function validateComponentTypes(stack: AnyRec$g): ComponentTypeFinding[];
+declare function validateComponentTypes(stack: AnyRec$h): ComponentTypeFinding[];
 
 /**
  * [ADR-0021 — semantic layer] Chart-binding integrity for the surfaces the
@@ -3178,6 +3456,132 @@ declare function validateComponentTypes(stack: AnyRec$g): ComponentTypeFinding[]
  * rule has no business loading. It is checked by `validate-react-page-props`
  * instead, against the naming convention `chartAggregateResultKeys`
  * (`@objectstack/spec/ui`) now pins down (#3701).
+ *
+ * ## Which positions are BINDINGS, and which are presentation (#15575)
+ *
+ * `chart-measure-unknown`'s message names a QUERY consequence — *"this series
+ * comes back empty"* — and that is only true where the position feeds the
+ * dataset query. Read at the pinned `@object-ui` revision (`.objectui-sha`),
+ * the three surfaces do not agree, so the tier and the consequence are per
+ * POSITION rather than per rule:
+ *
+ *  - **Report charts.** The chart runs its OWN query out of the two axis
+ *    strings — `useDatasetRows(dataset, [xAxis], [yAxis], …)` in
+ *    `plugin-report/src/DatasetReportRenderer.tsx`, and in that file's own
+ *    words *"the embedded chart queries only `chart.xAxis` × `chart.yAxis`"*.
+ *    So `chart.yAxis` IS the binding and keeps `error`. `chart.series[]` is
+ *    not: it is *"The author's per-chart override for ONE measure's display
+ *    name — the entry of `chart.series[]` whose `name` IS that measure"*,
+ *    lowered through `mergeAuthoredSeries`, for which *"an authored entry
+ *    naming a measure that is NOT in the dataset selection is **ignored** —
+ *    membership belongs to the dataset"* (`@object-ui/core`
+ *    `src/utils/chart-presentation.ts`).
+ *  - **List-view charts.** `ListChartConfigSchema` is a STRICT object of
+ *    `chartType` / `dataset` / `dimensions` / `values`: it declares no
+ *    `series` and no `yAxis`, so this rule has no presentation position on
+ *    that surface at all. Its one measure position is `values[]`, which
+ *    `app-shell/src/views/ObjectView.tsx` hands to the chart component as the
+ *    dataset measures (and synthesises the series list FROM). Query binding,
+ *    `error`, unchanged.
+ *  - **Dataset-bound page chart components.** `plugin-charts/src/ObjectChart.tsx`
+ *    queries `{ dimensions: schema.dimensions, measures: schema.values }` and
+ *    then REPLACES the authored series wholesale —
+ *    `{ ...schema, data, xAxisKey, series: datasetChart.series }`, one derived
+ *    entry per selected measure. An authored `properties.series[].name` reaches
+ *    the renderer not at all, and an authored `properties.yAxis[].field` is
+ *    inert for the same reason (`normalizeChartSchema` synthesises series from
+ *    `yAxis[].field` only when there are none, which on this surface means an
+ *    empty `values` — a chart with no measures to plot either way). Both are
+ *    presentation; `dimensions` / `values` are the binding.
+ *
+ * So the presentation positions drop to `warning` and state what actually
+ * happens, which is the resolution the maintainer ruling on
+ * `chart-field-unknown` reached for the same question one rule over (see "The
+ * three refused binding keys" in `validate-widget-bindings.ts`). Two things
+ * follow that differ from that sibling, and are worth stating rather than
+ * leaving to be re-derived:
+ *
+ *  - **There is no per-position suppression here.** `suppressWarnings` is
+ *    declared on the dashboard WIDGET only (`spec/src/ui/dashboard.zod.ts`),
+ *    and none of these three surfaces carries the key. A `warning` is advisory
+ *    (the consumers split on `severity === 'error'`) but cannot be silenced
+ *    individually; declaring the key on these surfaces would be a schema
+ *    change, which this rule has no standing to make.
+ *  - **The page surface's axis refs and series refs are separate limbs.** They
+ *    used to be concatenated into one `series` array before the measure walk,
+ *    so every `yAxis[].field` took the SERIES message. Reading both shapes on
+ *    that surface is deliberate (the props bag mixes them); giving them one
+ *    message was not — the pin refuses the two for different reasons, so they
+ *    now carry different sentences.
+ *
+ * `chart-axis-not-selected` (declared measure, outside the selection) rides the
+ * same walk and took the same one-size sentence — *"the query does not return
+ * it, so the series plots nothing"*. That is the truth at a query position and
+ * not at a presentation one, where no series is derived for the name in the
+ * first place, so its consequence is per position too.
+ *
+ * ## Which SET `chart-axis-not-selected` resolves against (#15734)
+ *
+ * The consequence is per POSITION; the selection it is measured against is per
+ * SURFACE — and on the report surface that selection is not `report.values`.
+ * At the same pinned revision `DatasetReportRenderer.tsx` runs
+ * `useDatasetRows(dataset, plan.kind === 'series' && xAxis ? [xAxis] : [],
+ * wantsQuery && yAxis ? [yAxis] : [], …)` and derives the plotted series with
+ * `buildChartSeries(…, [xAxis], [yAxis], …)` — *"the selection is exactly one
+ * dimension × one measure, so this takes the helper's single-dimension branch
+ * and returns ONE series"*. `report.values` is the selection of the TABLE
+ * beneath the chart; the chart's own is the axis pair. Two things follow:
+ *
+ *  - **Nothing to report at the report `chart.yAxis`.** That position IS the
+ *    chart's query, so it cannot fail to select itself. The warning that fired
+ *    for a declared measure outside `report.values` stated a query consequence
+ *    its own pin refutes: the chart asks for exactly that measure and plots
+ *    it. `chart-measure-unknown` at that position is untouched — an UNDECLARED
+ *    measure still returns no column, and still gates.
+ *  - **`chart.series[].name` resolves against the singleton `{ chart.yAxis }`.**
+ *    The override is paired with a DERIVED series and the chart derives one,
+ *    so that singleton — not `report.values` — is the set an entry can land
+ *    on. An entry naming `chart.yAxis` lands however the table is selected;
+ *    one naming any other declared measure lands on nothing.
+ *
+ * The list-view and page-component surfaces keep `values`: there it IS the
+ * measure set the query asks for, so the existing resolution is correct.
+ *
+ * ## What a REPORT binds, chart or no chart (#16105)
+ *
+ * A report is dataset-bound in its own right — `ReportSchema` requires
+ * `dataset` + `values` on every non-`joined` report and declares `rows` (the
+ * down axis) and `columns` (the across axis a `matrix` pivots on, ADR-0021 D2)
+ * as dimension names "from the dataset". The chart is optional decoration on
+ * top of that binding, not the binding itself.
+ *
+ * The walk did not read it that way. Every report position reached the resolver
+ * through one closure that opened `if (!isRec(chart)) return`, and that closure
+ * was the only site `report.dataset` was ever passed to, so:
+ *
+ *  - a report authored WITHOUT a chart was not checked at all — an unresolvable
+ *    `dataset`, an unknown `rows`/`columns` dimension and an unknown `values`
+ *    measure all published clean; and
+ *  - `rows`/`columns` were passed to the resolver on NO report, charted or not.
+ *    On one and the same charted report, `values` was resolved and the
+ *    dimension selection beside it was not.
+ *
+ * So the dataset is resolved once per report and once per block — before the
+ * chart question is asked — and fed to two groups of positions: the report's
+ * own selection (`rows`/`columns` → `chart-dimension-unknown`, `values` →
+ * `chart-measure-unknown`) and, when a chart is present, its axis refs
+ * exactly as before. Not a second "chartless reports too" pass after the early
+ * return: one path, entered unconditionally, with the chart as the branch it
+ * always was. Which is also why an unresolvable dataset on a charted report is
+ * still ONE finding — `resolveDataset` runs once per surface, not once per
+ * group.
+ *
+ * `rows`/`columns` take `chart-dimension-unknown` rather than an id of their
+ * own: the position is a dataset DIMENSION reference resolved against the
+ * dataset's declared dimensions, which is what that rule already means on the
+ * list-view and page surfaces, and the spec's own words for the two report
+ * keys are "down axis" and "across" — so the rule's existing sentence about an
+ * axis rendering with no categories is true where it now fires.
  */
 declare const CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
 declare const CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
@@ -3198,7 +3602,7 @@ interface ChartBindingFinding {
     hint: string;
 }
 
-declare function validateChartBindings(stack: AnyRec$g): ChartBindingFinding[];
+declare function validateChartBindings(stack: AnyRec$h): ChartBindingFinding[];
 
 /** An `include[]` entry that does not name a joinable relationship path. */
 declare const DATASET_INCLUDE_UNKNOWN = "dataset-include-unknown";
@@ -3223,14 +3627,14 @@ interface DatasetRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$e = Record<string, unknown>;
+type AnyRec$f = Record<string, unknown>;
 /**
  * Validate every ADR-0021 dataset's references against the object graph.
  * Returns findings (empty = clean). Pure `(stack) => Finding[]`; no I/O, and
  * safe on both the schema-parsed stack and the raw config the `lint` path
  * carries.
  */
-declare function validateDatasetReferences(stack: AnyRec$e): DatasetRefFinding[];
+declare function validateDatasetReferences(stack: AnyRec$f): DatasetRefFinding[];
 
 /**
  * Field types that address ANOTHER object, so a `.<hop>` through one is a join
@@ -3481,11 +3885,11 @@ declare const VALIDATION_RULE_SCHEMA_UNCOMPILABLE = "validation-rule-json-schema
  * still says the same thing.
  */
 declare const RUNTIME_AJV_OPTIONS: Options;
-type AnyRec$d = Record<string, unknown>;
+type AnyRec$e = Record<string, unknown>;
 /** One authored validation rule, located for a finding. */
 interface WalkedValidationRule {
     /** The rule record itself — a top-level entry, or a `conditional` branch. */
-    rule: AnyRec$d;
+    rule: AnyRec$e;
     /** The declaring object's `name`, or `(unnamed object)`. */
     objectName: string;
     /** The nesting-aware rule name as prose: `'outer' → 'inner'`. */
@@ -3569,12 +3973,61 @@ interface NavAccessFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$c = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /**
  * Validate that every object a stack's navigation exposes is readable by at
  * least one permission set the stack declares. Returns findings (empty = clean).
  */
-declare function validateNavAccess(stack: AnyRec$c): NavAccessFinding[];
+declare function validateNavAccess(stack: AnyRec$d): NavAccessFinding[];
+
+declare const FIELD_NO_CONSUMERS = "field-no-consumers";
+type FieldConsumerSeverity = 'warning';
+/** Why the field is reported: carriers only, or nothing at all. */
+type FieldConsumerVerdict = 'inert' | 'carrier-only';
+interface FieldConsumerFinding {
+    /** Always `warning` — a consumer may live outside the stack (see module note). */
+    severity: FieldConsumerSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "crm_product" · field "tax_rate"`. */
+    where: string;
+    /** Config path of the DECLARATION, e.g. `objects[3].fields.tax_rate` (map shape) or `objects[3].fields[2]` (array shape). */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+    /** The declaring object. */
+    object: string;
+    /** The field name. */
+    field: string;
+    /** `carrier-only` when carrier sites exist, `inert` when no site of any kind names the field. */
+    verdict: FieldConsumerVerdict;
+    /** Config paths of the carrier sites a removal must clean (empty for `inert`). */
+    carriers: string[];
+    /** The stack roots this verdict was measured over — consumer roots then carrier roots. */
+    rootsScanned: readonly string[];
+}
+type AnyRec$c = Record<string, unknown>;
+/**
+ * Roots whose contents can CONSUME a field, walked with an object context.
+ * `objects` is here for what an object carries besides its field map —
+ * formulas, roll-ups, validations, built-in list views, hooks, actions,
+ * indexes, `highlightFields`, `searchableFields`. Order is report order.
+ */
+declare const CONSUMER_ROOTS: readonly string[];
+/**
+ * Roots whose contents carry a field without reading it. A locale row is a
+ * label for a field, not a consumer of one; a seed VALUE nothing reads is the
+ * shape being hunted; an import column and a field-level permission grant are
+ * customer-facing surfaces a removal must clean, not evidence of a reader.
+ */
+declare const CARRIER_ROOTS: readonly string[];
+/**
+ * Report every declared field that nothing in the stack reads or displays.
+ * Returns findings (empty = clean). Pure; safe on pre- or post-parse stacks.
+ */
+declare function validateFieldConsumers(stack: AnyRec$c): FieldConsumerFinding[];
 
 declare const TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
 declare const TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
@@ -3623,33 +4076,6 @@ type AnyRec$a = Record<string, unknown>;
  */
 declare function validateTranslatableSections(stack: AnyRec$a): TranslatableSectionFinding[];
 
-/**
- * [ADR-0064 §3] Skill ↔ agent surface affinity (issue #3820).
- *
- * An agent binds a product surface (`'ask'` | `'build'`, ADR-0063 §1) and a
- * skill declares which surface it belongs to (`'ask'` | `'build'` | `'both'`,
- * ADR-0063 §3). A skill may only attach to an agent whose surface it matches —
- * `'both'` attaches to either. The runtime treats a violation as a FAST LOAD
- * ERROR: `resolveActiveSkills()` throws on the first incompatible binding, so
- * an agent shipping one mismatched skill reference fails at **chat time** with
- * a 500 — after parse, after validate, after deploy.
- *
- * Both sides of the check are declared in the same stack, so the contradiction
- * is statically provable and this rule carries severity **error** with zero
- * false positives by construction. Both sides default to `'ask'` when the
- * `surface` field is absent (mirroring the runtime's defaults), so the rule is
- * safe on the raw/normalized config the `lint` path carries as well as the
- * schema-parsed stack.
- *
- * Scope note: this rule deliberately does NOT check that `agent.skills[]`
- * names resolve at all. Kernel skills (`schema_reader`, the `ask`/`build`
- * bundles) are runtime-registered and statically invisible, and whether
- * app-stack tool/skill namespaces get a platform-name registry is an open
- * decision (#3820 D0/D2) — resolving names against `stack.skills` alone would
- * flag every kernel-skill reference. An unresolved name is therefore skipped
- * here; only a reference that resolves in-stack AND contradicts the affinity
- * contract is reported.
- */
 declare const AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
 type AiSurfaceAffinitySeverity = 'error' | 'warning';
 interface AiSurfaceAffinityFinding {
@@ -3696,78 +4122,6 @@ type AnyRec$8 = Record<string, unknown>;
  */
 declare function validateAiToolReferences(stack: AnyRec$8): AiToolRefFinding[];
 
-/**
- * [ADR-0063 §2] `stack.agents` is a platform-internal slot (issue #3820).
- *
- * ADR-0063 §2 withdrew tenant/app-package custom agents: the kernel ships
- * exactly two agents (`ask`, `build`), the surface the user is in binds one,
- * and third parties extend the platform by authoring **skills**, never
- * `*.agent.ts`. The `agent` metadata type carries the decision
- * (`allowRuntimeCreate: false, allowOrgOverride: false`), and the runtime
- * enforces it on both paths — `listAgents()` filters non-platform records out
- * of the catalog, and `loadAgent()` refuses them outright (cloud#904), so a
- * stack-authored agent 404s on chat and cannot be pinned via
- * `app.defaultAgent`.
- *
- * What was missing is the AUTHORING-time signal. `defineStack` still accepts
- * an `agents` array, so an app package could declare agents that parse,
- * validate, and build into the artifact — and then do nothing at runtime.
- * HotCRM shipped two of them for months. That is the ADR-0078 shape this rule
- * closes: loud at the producer, tolerant at the consumer (Prime Directive
- * #12).
- *
- * Severity is **warning**, not error, for one reason: the platform's own
- * packages legitimately author agent records, and this rule cannot tell a
- * platform package from an app package by reading the stack alone. A warning
- * that names the runtime consequence is honest for both readers; the runtime
- * is what actually gates. Deliberately NOT a Zod refine — an existing stack
- * must keep parsing (ADR-0078 non-goal #1).
- *
- * ## The value half (issue #6041)
- *
- * The rule above catches a stack that *declares* a withdrawn agent record.
- * It never looked at `app.defaultAgent` — a plain
- * `SnakeCaseIdentifierSchema` string, so any snake_case value parses, builds,
- * and passes `os:check` even when it names nothing the runtime will ever
- * resolve. #5985 measured the blind spot directly: replaying the bad example
- * `defaultAgent: 'sales_copilot'` left `check:skill-examples` at 208 green,
- * EXIT=0. `app.defaultAgent` silently falls back to the platform default at
- * runtime (ADR-0063 §1) instead of crashing, which is why this limb is
- * **warning**, not error, same as the rule above — the maintainer ruling on
- * #6041 (2026-08-07, reaffirmed 2026-08-09) is option A: add the value check
- * at warning tier, reusing `PLATFORM_AGENT_NAMES` rather than narrowing the
- * schema to an enum (a breaking authoring change ADR-0063 already walked
- * back once).
- *
- * ## Why the value limb no longer reads the same roster (issue #14461)
- *
- * `PLATFORM_AGENT_NAMES` holds FOUR names, and reusing it for the value limb
- * meant this gate accepted `defaultAgent: 'metadata_assistant'` — the exact
- * spelling `skills/objectstack-ai` tells authors is "not vocabulary". The
- * platform then taught it from its own only live example: `studio.app.ts`
- * pinned the alias. So an AI author copying the one working example in the
- * repo wrote the forbidden spelling and this rule waved it through — the
- * silent-tolerance shape ADR-0078 exists to close, committed by the gate
- * itself.
- *
- * The maintainer ruling on #14461 (2026-09-03) re-pins Studio to `build` and
- * SPLITS the two limbs' rosters, keeping both of #6041's operative decisions
- * intact (warning tier, no Zod enum):
- *
- *  - the DECLARATION limb still reads all four names. Its question is "does
- *    this record shadow a platform record?", and declaring `metadata_assistant`
- *    shadows `build` through the alias exactly as declaring `build` does. That
- *    judgement is unchanged.
- *  - the VALUE limb reads `CANONICAL_AGENT_NAMES` only, and a legacy alias
- *    gets its own rule id and wording ({@link DEFAULT_AGENT_LEGACY_ALIAS}).
- *    Its question is "is this the right thing to WRITE?", and the answer for
- *    an alias is no even though it resolves.
- *
- * The alias limb stays `warning`, not `error`, and for a sharper reason than
- * the roster limb: an aliased pin is not broken. It resolves, the app gets the
- * agent it meant, and nothing a user can see is wrong — which is precisely why
- * the signal has to be an authoring-time nudge rather than a build break.
- */
 declare const AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
 /** `app.defaultAgent` names something outside the platform agent roster. */
 declare const DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
@@ -4135,21 +4489,6 @@ declare const VIEW_REF_FORM_TARGET_KIND = "view-ref-form-target-kind";
 declare const VIEW_REF_NAV_VIEW_MISSING = "view-ref-nav-view-missing";
 declare function lintViewRefs(stack: AnyRec): ViewRefFinding[];
 
-/**
- * Data-model best-practice lint rules.
- *
- * These rules encode the relationship / master-detail / roll-up conventions the
- * platform ships (see the objectstack-data and objectstack-ui skills, ADR-0035).
- * They run over the normalized object set and flag anti-patterns that an
- * author — human OR an AI generator — commonly produces. They are intentionally
- * heuristic: structural problems are `error`, likely-wrong choices are
- * `warning`, and "you probably want this" nudges are `suggestion`. None of them
- * block on a judgement call.
- *
- * The same rules double as the automated rubric for the metadata-generation
- * eval (see `score.ts`): a generated stack scores well exactly when it is
- * schema-valid AND lint-clean here.
- */
 type Severity = 'error' | 'warning' | 'suggestion';
 interface LintIssue {
     severity: Severity;
@@ -4354,4 +4693,4 @@ declare function auditPageExpressionEnvelopes(page: unknown, pageLabel: string):
 /** Render findings as the actionable red an author reads in CI. */
 declare function renderBareExpressionFindings(findings: readonly BareExpressionFinding[]): string;
 
-export { ACTION_API_UPDATE_READONLY_WHEN_FIELD, ACTION_BODY_SOURCE_UNPARSEABLE, ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BareExpressionFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, COMPONENT_TYPE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type CheckedParse, type CheckedParseOptions, type ComponentPropsFinding, type ComponentPropsSeverity, type ComponentTypeFinding, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_NOT_INCLUDED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DATASET_FIELD_NOT_INCLUDED, DATASET_FIELD_UNKNOWN, DATASET_FILTER_FIELD_UNKNOWN, DATASET_INCLUDE_UNKNOWN, DEFAULT_AGENT_LEGACY_ALIAS, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type DatasetRefFinding, type DatasetRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type EnvelopeAuditDoor, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FIELD_RULE_BOUND_ROOTS, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_PRESET_COMPARAND, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_LOOP_BODY_UNCONTAINED, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_TRY_CATCH_WITHOUT_CATCH, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, FORM_SECTION_GROUP_UNKNOWN, type FieldPathAccount, type FieldPathVerdict, type FilterFieldKey, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, type GraphField, type GraphObject, HOOK_API_UPDATE_READONLY_FIELD, HOOK_API_UPDATE_READONLY_WHEN_FIELD, HOOK_BODY_SOURCE_UNPARSEABLE, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FIELD_DOTTED, LIST_VIEW_FIELD_UNKNOWN, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, LIVENESS_LIVE_ELSEWHERE_PROPERTY, LIVENESS_PLANNED_PROPERTY, type LintIssue, type ListViewFieldRefFinding, type ListViewFieldRefSeverity, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, type LocatedLintIssue, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECTUI_DERIVATION_PREDICATES, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectGraph, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SECTION_GROUP_UNKNOWN, PAGE_SOURCE_CLASSNAME, PAGE_VISUALIZATION_WITHOUT_BINDING, PARSE_FAILURE_HINT, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageEnvelopeAudit, type PageFieldFinding, type PageFieldSeverity, type PageVisualizationFinding, type PageVisualizationSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, type PresetComparandFinding, type PresetComparandSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REACT_PAGE_SOURCE_UNPARSEABLE, REACT_PROP_DEPRECATED, READONLY_ACTION_WRITE_EXCLUSIONS, READONLY_ACTION_WRITE_PATTERN_IDS, READONLY_HOOK_WRITE_EXCLUSIONS, READONLY_HOOK_WRITE_PATTERN_IDS, REFERENCE_INTEGRITY_RULES, RELATIONSHIP_FIELD_TYPES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyActionWriteFinding, type ReadonlyActionWriteSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type ReadonlyHookWriteFinding, type ReadonlyHookWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNPROVISIONED, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_AMBIGUOUS_RELATION, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT, SHARING_RULE_OBJECT_NOT_SHAREABLE, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, SORT_FIELD_UNKNOWN, SORT_FIELD_UNPROVISIONED, SORT_FIELD_UNSORTABLE, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_SOURCE_UNPARSEABLE, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SectionGroupFinding, type SectionGroupRef, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SortableFieldFinding, type SortableFieldSeverity, type SourceParseFailure, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_PAGE_UNRESOLVED, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VIEW_REF_NAV_VIEW_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_PREDICATE_UNKNOWN_FUNCTION, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewPageRefFinding, type ViewPageRefSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, type VisualizationPredicate, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_FILTER_FIELD_NOT_INCLUDED, WIDGET_FILTER_FIELD_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, WIDGET_SORTBY_UNSELECTED, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, auditPageExpressionEnvelopes, authorWarnedProperties, buildAccessMatrix, checkSectionGroupRefs, checkSortDeclaration, describeFieldPathVerdict, describeParseFailure, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, fieldRuleRootIssue, findStartupRegistryVerdicts, findUnguardedNullableOperands, indexObjectFieldGroups, indexObjectGraph, isSourceAuthoredPage, isUnjudgeable, joinablePrefixes, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, listNames, nearestName, nearestRegisteredFormat, nullGuardMessage, renderBareExpressionFindings, resolveFieldPath, sectionGroupRefs, suggestName, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateComponentTypes, validateDashboardActionRefs, validateDatasetReferences, validateEmptyCombinators, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewFieldRefs, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePageVisualizationBindings, validatePredicatePathRefs, validatePresetComparands, validateReactPageProps, validateReactPages, validateReadonlyActionWrites, validateReadonlyFlowWrites, validateReadonlyHookWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateSortableFields, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateViewPageRefs, validateVisibilityPredicates, validateWidgetBindings, walkFilterFieldKeys, walkPageComponents };
+export { ACTION_API_UPDATE_READONLY_WHEN_FIELD, ACTION_BODY_SOURCE_UNPARSEABLE, ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BareExpressionFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSIONS_MISSING, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURES_MISSING, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, COMPONENT_TYPE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type CheckedParse, type CheckedParseOptions, type ComponentPropsFinding, type ComponentPropsSeverity, type ComponentTypeFinding, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_NOT_INCLUDED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DATASET_FIELD_NOT_INCLUDED, DATASET_FIELD_UNKNOWN, DATASET_FILTER_FIELD_UNKNOWN, DATASET_INCLUDE_UNKNOWN, DEFAULT_AGENT_LEGACY_ALIAS, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type DatasetRefFinding, type DatasetRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type EnvelopeAuditDoor, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, CARRIER_ROOTS as FIELD_CARRIER_ROOTS, CONSUMER_ROOTS as FIELD_CONSUMER_ROOTS, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FIELD_NO_CONSUMERS, FIELD_RULE_BOUND_ROOTS, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_PRESET_COMPARAND, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_FILTER_TOKEN_UNKNOWN, FLOW_INERT_NODE_CONDITION, FLOW_LOOP_BODY_UNCONTAINED, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_DATE_FUNCTIONS, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TEMPLATE_VALUE_FUNCTIONS, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_TRY_CATCH_WITHOUT_CATCH, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, FORM_SECTION_GROUP_UNKNOWN, type FieldConsumerFinding, type FieldConsumerSeverity, type FieldConsumerVerdict, type FieldPathAccount, type FieldPathVerdict, type FilterFieldKey, type FilterTokenFinding, type FilterTokenSeverity, type FlowFilterTokenFinding, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTemplateTokenVerdict, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, type GraphField, type GraphObject, HOOK_API_UPDATE_READONLY_FIELD, HOOK_API_UPDATE_READONLY_WHEN_FIELD, HOOK_BODY_SOURCE_UNPARSEABLE, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FIELD_DOTTED, LIST_VIEW_FIELD_UNKNOWN, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, LIVENESS_LIVE_ELSEWHERE_PROPERTY, LIVENESS_PLANNED_PROPERTY, type LintIssue, type ListViewFieldRefFinding, type ListViewFieldRefSeverity, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, type LocatedLintIssue, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECTUI_DERIVATION_PREDICATES, OBJECT_FIELD_REF_UNKNOWN, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectFieldRefFinding, type ObjectFieldRefSeverity, type ObjectGraph, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SECTION_GROUP_UNKNOWN, PAGE_SOURCE_CLASSNAME, PAGE_VISUALIZATION_WITHOUT_BINDING, PARSE_FAILURE_HINT, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageEnvelopeAudit, type PageFieldFinding, type PageFieldSeverity, type PageVisualizationFinding, type PageVisualizationSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, type PresetComparandFinding, type PresetComparandSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REACT_PAGE_SOURCE_UNPARSEABLE, REACT_PROP_DEPRECATED, REACT_PROP_RETIRED, READONLY_ACTION_WRITE_EXCLUSIONS, READONLY_ACTION_WRITE_PATTERN_IDS, READONLY_HOOK_WRITE_EXCLUSIONS, READONLY_HOOK_WRITE_PATTERN_IDS, REFERENCE_INTEGRITY_RULES, RELATIONSHIP_FIELD_TYPES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyActionWriteFinding, type ReadonlyActionWriteSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type ReadonlyHookWriteFinding, type ReadonlyHookWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNPROVISIONED, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_AMBIGUOUS_RELATION, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNKNOWN_FIELD, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_OBJECT_CONTROLLED_BY_PARENT, SHARING_RULE_OBJECT_NOT_SHAREABLE, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, SORT_FIELD_UNKNOWN, SORT_FIELD_UNPROVISIONED, SORT_FIELD_UNSORTABLE, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_SOURCE_UNPARSEABLE, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SectionGroupFinding, type SectionGroupRef, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SortableFieldFinding, type SortableFieldSeverity, type SourceParseFailure, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_PAGE_UNRESOLVED, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VIEW_REF_NAV_VIEW_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_PREDICATE_UNKNOWN_FUNCTION, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewPageRefFinding, type ViewPageRefSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, type VisualizationPredicate, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_FILTER_FIELD_NOT_INCLUDED, WIDGET_FILTER_FIELD_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURES_MISSING, WIDGET_MEASURE_UNKNOWN, WIDGET_SORTBY_UNSELECTED, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, auditPageExpressionEnvelopes, authorWarnedProperties, buildAccessMatrix, checkSectionGroupRefs, checkSortDeclaration, classifyFlowTemplateToken, describeFieldPathVerdict, describeParseFailure, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, fieldRuleRootIssue, findStartupRegistryVerdicts, findUnguardedNullableOperands, indexObjectFieldGroups, indexObjectGraph, isSourceAuthoredPage, isUnjudgeable, joinablePrefixes, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, listNames, nearestName, nearestRegisteredFormat, nullGuardMessage, renderBareExpressionFindings, resolveFieldPath, sectionGroupRefs, suggestName, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateComponentTypes, validateDashboardActionRefs, validateDatasetReferences, validateEmptyCombinators, validateFieldConsumers, validateFilterTokens, validateFlowFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewFieldRefs, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectFieldRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePageVisualizationBindings, validatePredicatePathRefs, validatePresetComparands, validateReactPageProps, validateReactPages, validateReadonlyActionWrites, validateReadonlyFlowWrites, validateReadonlyHookWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateSortableFields, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateViewPageRefs, validateVisibilityPredicates, validateWidgetBindings, walkFilterFieldKeys, walkPageComponents };