@telorun/analyzer 0.62.1 → 0.64.0

package/src/analyzer.ts

@@ -25,6 +25,7 @@ import {
 import { DefinitionRegistry } from "./definition-registry.js";
 import { type ContractDirection, effectiveAuthorSchema } from "./extends-resolution.js";
 import {
+  analyzerContractScope,
   type ContractScope,
   PERMISSIVE_CONTRACT,
   resolveContract,
@@ -51,8 +52,48 @@ import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
 import { resolveRefSentinels } from "./resolve-ref-sentinels.js";
 import { resolveSchemaRefKinds, type RefConstraintIssue } from "./resolve-schema-ref-kinds.js";
 import { runZoneAnalysis, type ZoneExportCache } from "./resolve-zone-requirements.js";
-import { MANIFEST_SCHEMA_URI, ManifestRootSchema } from "./manifest-schemas.js";
+import { validateDurableRegions } from "./validate-durable-regions.js";
+import { validateZoneViolations } from "./validate-zone-violations.js";
+import { ManifestRootSchema } from "./manifest-schemas.js";
+import { gatherPropertySchemas, resolveLocalRef, walkStepArray } from "./schema-walk.js";
+import { buildStepContextSchema, CelScopeResolver, manifestRootForResolver } from "./cel-scope.js";
+
+// The structural walks and the CEL scope rule moved out of this file — the
+// first so both halves can reach them, the second so the IDE can ask what a
+// cursor sees without pulling the analysis pass in behind it. Re-exported here
+// because they were part of this module's surface before the split.
+export { gatherPropertySchemas, resolveLocalRef, walkStepArray } from "./schema-walk.js";
+export { analyzerContractScope } from "./invocation-contract.js";
 import { validateZoneSlotDeclarations, type ZoneSlotIssue } from "./validate-zone-slots.js";
+import {
+  validateSchemaProjection,
+  type SchemaProjectionIssue,
+} from "./validate-schema-projection.js";
+import {
+  evaluateResourceRules,
+  reportResourceRules,
+  reportUnexercisedRule,
+  ruleExercised,
+  validateResourceRuleDeclarations,
+  type ResourceRuleDiagnostic,
+  type ResourceRuleIssue,
+} from "./validate-resource-rules.js";
+import { readResourceRules, type ResourceRule } from "./resource-rule.js";
+import { readReferrerRules, type ReferrerRule } from "./referrer-rule.js";
+import {
+  evaluateReferrerRules,
+  referrerRuleExercised,
+  reportReferrerRules,
+  reportUnexercisedReferrerRule,
+  validateReferrerRuleDeclarations,
+  type Referrer,
+  type ReferrerRuleDiagnostic,
+  type ReferrerRuleIssue,
+} from "./validate-referrer-rules.js";
+import {
+  describeProjectionFailure,
+  type ProjectionFailure,
+} from "./schema-projection.js";
 import {
   validateDynamicSelectors,
   validateRefSlotDeclarations,
@@ -104,13 +145,14 @@ import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateRequires } from "./validate-requires.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
-import { collectStepInputIssues } from "./validate-step-inputs.js";
+import { collectRefInputIssues, collectStepInputIssues } from "./validate-step-inputs.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
+import { readStepSlot } from "./step-slot.js";
 
 const SELF_PREFIX = "Self.";
 
@@ -162,117 +204,8 @@ function resolveSelfOrAlias(
   return scopeResolver.resolveKind(value);
 }
 
-/** The {@link ContractScope} the analyzer resolves invocation contracts in: kinds
- *  resolve in the module that declared the definition they were read off (so an
- *  `extends` chain crossing module boundaries re-scopes at every hop), and named
- *  `telo#Type` references resolve against the flattened manifest list. `resolveIn`
- *  is the top-level entry point, where the kind was written by the READING
- *  module and there is no declaring definition yet. */
-export function analyzerContractScope(
-  defs: DefinitionRegistry,
-  aliases: AliasResolver,
-  scopes: ModuleScopes,
-  allManifests: Record<string, any>[],
-): ContractScope & { resolveIn(kind: string, module?: string): ResourceDefinition | undefined } {
-  const resolve = moduleScopedDefResolver<ResourceDefinition>(defs, aliases, scopes);
-  return {
-    resolveDefinition: resolve,
-    resolveIn: resolve.in,
-    typeManifestsFor: () => allManifests,
-  };
-}
-
 const SOURCE = "telo-analyzer";
 
-/** Build a closed JSON Schema for the `self` CEL variable available inside a
- *  `Telo.Definition` template body. Mirrors the runtime template controller's
- *  `const self = { ...resource, name: resource.metadata.name };` — every
- *  property the user declared in `schema:` plus synthetic `name` / `kind` and
- *  the metadata sub-object (kept open since metadata legitimately carries
- *  arbitrary user-added fields). */
-function buildSelfSchema(
-  definition: Record<string, any>,
-  defs?: DefinitionRegistry,
-  aliases?: AliasResolver,
-): Record<string, any> {
-  // The author-facing schema resolves inheritance: with `base:` the child's own
-  // schema (the parent's config is internal); without it, `merge(parent, own)`.
-  const userSchema = (
-    defs
-      ? effectiveAuthorSchema(definition as unknown as ResourceDefinition, (k) =>
-          defs.resolve(aliases?.resolveKind(k) ?? k) ?? defs.resolve(k),
-        )
-      : (definition.schema ?? {})
-  ) as Record<string, any>;
-  const userProps = (userSchema.properties ?? {}) as Record<string, any>;
-  const userRequired = Array.isArray(userSchema.required) ? userSchema.required : [];
-  return {
-    type: "object",
-    additionalProperties: false,
-    properties: {
-      ...userProps,
-      name: { type: "string" },
-      kind: { type: "string" },
-      metadata: {
-        type: "object",
-        additionalProperties: true,
-        properties: { name: { type: "string" } },
-      },
-    },
-    required: [...userRequired, "name", "kind"],
-  };
-}
-
-/** Build the JSON Schema for the `inputs` CEL variable available inside an
- *  invocable template body — the shared contract resolver applied to the
- *  definition itself, so a body is typed against the exact signature callers are
- *  checked against and dispatch enforces. Walks the whole `extends` chain rather
- *  than one hop, so a definition two levels below the declaration still gets
- *  typed inputs. Undefined when nothing in the chain declares a contract —
- *  the caller signals opaque `map<string, dyn>` upstream. */
-function lookupTemplateInputsSchema(
-  definition: Record<string, any>,
-  defs: DefinitionRegistry,
-  aliases: AliasResolver,
-  allManifests: Record<string, any>[],
-  scopes: ModuleScopes,
-): Record<string, any> | undefined {
-  return resolveContract(
-    "inputType",
-    undefined,
-    definition as unknown as ResourceDefinition,
-    analyzerContractScope(defs, aliases, scopes, allManifests),
-  )?.schema;
-}
-
-/** Returns a "resolver-facing" view of the manifest where the fields used as
- *  navigation roots by Telo.Definition's `x-telo-context-from-root` annotations
- *  have been pre-augmented:
- *    - `schema`     → augmented `self` schema (synthetic `name`/`kind`/metadata).
- *    - `inputType`  → resolved through the shared contract resolver, so
- *                     `x-telo-context-from-root: inputType` substitutes the
- *                     real signature. Without it the annotation would replace
- *                     the node verbatim with the inline `{kind, schema}` wrapper
- *                     the standard library writes everywhere, typing `inputs` as
- *                     `{kind, schema}` instead of the declared properties.
- *
- *  For non-definition manifests the original object is returned. */
-function manifestRootForResolver(
-  m: Record<string, any>,
-  defs: DefinitionRegistry,
-  aliases: AliasResolver,
-  allManifests: Record<string, any>[],
-  scopes: ModuleScopes,
-): Record<string, any> {
-  if (m.kind !== "Telo.Definition") return m;
-  const inputs = lookupTemplateInputsSchema(m, defs, aliases, allManifests, scopes);
-  return {
-    ...m,
-    schema: buildSelfSchema(m, defs, aliases),
-    ...(inputs ? { inputType: inputs } : {}),
-  };
-}
-
 /** True when an issue reports a property that is absent — its path points at a
  *  node the manifest does not contain. */
 export const missingRequired = (issue: { message: string }): boolean =>
@@ -306,273 +239,6 @@ function contractOwnerLabel(
   return canonical;
 }
 
-/** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
- *  Non-refs and unresolved refs pass through unchanged. */
-export function resolveLocalRef(
-  schema: Record<string, any> | undefined,
-  root: Record<string, any>,
-): Record<string, any> | undefined {
-  if (!schema) return undefined;
-  const ref = schema.$ref;
-  if (typeof ref === "string" && ref.startsWith("#/$defs/")) {
-    const defName = ref.slice("#/$defs/".length);
-    const resolved = root.$defs?.[defName];
-    if (resolved && typeof resolved === "object") return resolved as Record<string, any>;
-  }
-  // A kernel-owned structural fragment (`telo://manifest#/$defs/InvokeStep`).
-  // Resolved HERE rather than by each walker: this is the one chokepoint every
-  // structural walk already goes through — the step-array walks, the call graph,
-  // the zone projection, the eval-path collector — so a composer that points at a
-  // shared shape stays legible to all of them at once. Nothing is inlined into
-  // the stored schema, which keeps validator-cache identity stable and matches
-  // what `resolveSchemaTypeRefs` does for a named user type.
-  if (typeof ref === "string" && ref.startsWith(BUILTIN_FRAGMENT_PREFIX)) {
-    const defName = ref.slice(BUILTIN_FRAGMENT_PREFIX.length);
-    const resolved = (ManifestRootSchema.$defs as Record<string, unknown>)[defName];
-    if (resolved && typeof resolved === "object") return resolved as Record<string, any>;
-  }
-  return schema;
-}
-
-const BUILTIN_FRAGMENT_PREFIX = `${MANIFEST_SCHEMA_URI}#/$defs/`;
-
-/** Gather property schemas from a (possibly variant-bearing) object schema:
- *  top-level `properties` plus every `oneOf` / `anyOf` / `allOf` branch.
- *
- *  Each branch is resolved through {@link resolveLocalRef} first, so a branch
- *  that points at a shared shape — a `oneOf` arm that IS the kernel's dispatch
- *  site — contributes its properties like an inline one. Without that, pointing a
- *  composer at a shared shape would silently empty every role-driven lookup that
- *  reads this (the inputs slot, the retry policy, the eval paths), which is a
- *  failure with no diagnostic attached to it. */
-export function gatherPropertySchemas(
-  schema: Record<string, any>,
-  root?: Record<string, any>,
-): Array<[string, Record<string, any>]> {
-  const out: Array<[string, Record<string, any>]> = [];
-  const base = resolveLocalRef(schema, root ?? schema) ?? schema;
-  if (base.properties && typeof base.properties === "object") {
-    for (const [k, v] of Object.entries(base.properties as Record<string, any>)) {
-      out.push([k, v as Record<string, any>]);
-    }
-  }
-  for (const variantKey of ["oneOf", "anyOf", "allOf"] as const) {
-    const arr = base[variantKey];
-    if (!Array.isArray(arr)) continue;
-    for (const raw of arr) {
-      if (!raw || typeof raw !== "object") continue;
-      const variant = resolveLocalRef(raw as Record<string, any>, root ?? schema) ?? raw;
-      if (variant.properties) {
-        for (const [k, v] of Object.entries(variant.properties as Record<string, any>)) {
-          out.push([k, v as Record<string, any>]);
-        }
-      }
-    }
-  }
-  return out;
-}
-
-/**
- * Generic, role-driven walk over an `x-telo-step-context` step array. Calls
- * `visit(step, stepPath)` for every step — top-level and nested through the
- * `x-telo-topology-role` forms (`branch`, `branch-list`, `case-map`). This is
- * the single definition of how steps nest, shared by `buildStepContextSchema`
- * (which types `steps.<name>.result`) and `validateStepInvokeReferences` (which
- * checks invoke refs), so the topology contract lives in one place — adding a
- * role or nesting form updates both consumers at once. No resource kind is
- * hardcoded; recursion is driven entirely by the schema annotations.
- */
-export function walkStepArray(
-  steps: unknown[],
-  stepItemSchema: Record<string, any> | undefined,
-  rootSchema: Record<string, any>,
-  basePath: string,
-  visit: (step: Record<string, any>, stepPath: string) => void,
-): void {
-  const dispatchRole = (
-    data: unknown,
-    role: string,
-    itemsSchema: Record<string, any> | undefined,
-    path: string,
-  ): void => {
-    if (role === "branch" && Array.isArray(data)) {
-      walkStepArray(data, stepItemSchema, rootSchema, path, visit);
-    } else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
-      for (const [caseKey, arr] of Object.entries(data as Record<string, unknown>)) {
-        if (Array.isArray(arr)) walkStepArray(arr, stepItemSchema, rootSchema, `${path}.${caseKey}`, visit);
-      }
-    } else if (role === "branch-list" && Array.isArray(data)) {
-      const entrySchema = resolveLocalRef(itemsSchema, rootSchema);
-      if (!entrySchema) return;
-      data.forEach((entry, i) => {
-        if (!entry || typeof entry !== "object") return;
-        for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
-          const subRole = subSchema["x-telo-topology-role"];
-          if (typeof subRole !== "string") continue;
-          dispatchRole(
-            (entry as Record<string, any>)[subKey],
-            subRole,
-            subSchema.items as Record<string, any> | undefined,
-            `${path}[${i}].${subKey}`,
-          );
-        }
-      });
-    }
-  };
-
-  steps.forEach((step, i) => {
-    if (!step || typeof step !== "object") return;
-    const s = step as Record<string, any>;
-    const stepPath = `${basePath}[${i}]`;
-    visit(s, stepPath);
-    if (!stepItemSchema) return;
-    for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
-      const role = propSchema["x-telo-topology-role"];
-      if (typeof role !== "string") continue;
-      dispatchRole(
-        s[propKey],
-        role,
-        propSchema.items as Record<string, any> | undefined,
-        `${stepPath}.${propKey}`,
-      );
-    }
-  });
-}
-
-/**
- * Build a `steps` context schema from `x-telo-step-context` annotation.
- * Walks each step in the manifest array, resolves the invoked resource's output
- * contract, and builds `steps.<name>.result` context entries.
- *
- * Resolution is the shared {@link resolveContract} — the invoked resource
- * manifest's own declaration, then the kind's, resolved to the nearest
- * declaration along `extends`, then permissive. Sharing it with the kernel is
- * what stops `telo check` from typing `steps.X.result` against one contract
- * while dispatch validates against another.
- *
- * The kind layer is what makes `x-telo-stream` properties on definitions
- * actually govern step-result chain validation — without it, the validator falls
- * back to permissive and the stream-opacity rule never fires.
- *
- * Recursion into nested step arrays is annotation-driven via
- * `x-telo-topology-role`. The analyzer recognises three role values:
- *   - `branch`     — value is an array of steps (e.g. then / else / do / catch).
- *   - `branch-list`— value is an array of objects each carrying further roled
- *                    sub-properties (e.g. elseif: [{ if, then }]).
- *   - `case-map`   — value is an object whose values are step arrays (e.g. cases).
- * No specific Run.Sequence field name is hardcoded; any kind that uses
- * `x-telo-step-context` and tags its branch fields with these roles works.
- */
-function buildStepContextSchema(
-  manifest: Record<string, any>,
-  defSchema: Record<string, any>,
-  allManifests: Record<string, any>[],
-  defs: DefinitionRegistry,
-  aliases: AliasResolver,
-  scopes: ModuleScopes,
-): Record<string, any> | undefined {
-  const props = defSchema.properties as Record<string, any> | undefined;
-  if (!props) return undefined;
-
-  const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
-  const readingModule = (manifest.metadata as { module?: string } | undefined)?.module;
-
-  for (const [fieldName, fieldSchema] of Object.entries(props)) {
-    const stepCtx = fieldSchema["x-telo-step-context"] as Record<string, string> | undefined;
-    if (!stepCtx) continue;
-
-    const invokeField = stepCtx.invoke;
-    const outputTypeField = stepCtx.outputType;
-    // Optional: the field a step uses to produce a result without dispatching.
-    // Only a kind that declares one has pure steps at all.
-    const valueField = stepCtx.value;
-    if (!invokeField || !outputTypeField) continue;
-
-    const steps = manifest[fieldName];
-    if (!Array.isArray(steps)) continue;
-
-    const stepItemSchema = resolveLocalRef(
-      fieldSchema.items as Record<string, any> | undefined,
-      defSchema,
-    );
-
-    // The instance's own input contract, for typing a pure step that just
-    // forwards one of its values.
-    const ownInputs = resolveTypeFieldToSchema(
-      (manifest as Record<string, any>).inputType,
-      allManifests,
-    );
-
-    const stepProperties: Record<string, any> = {};
-
-    walkStepArray(steps, stepItemSchema, defSchema, fieldName, (s) => {
-      const name = s.name;
-      const invoke = s[invokeField] as Record<string, any> | undefined;
-      // Only invoke steps register a `steps.<name>.result` entry — control-flow
-      // wrappers (try/if/while/switch/throw) don't produce a result and must
-      // not shadow real entries with a permissive `additionalProperties: true`,
-      // or unknown step references slip through chain validation.
-      if (typeof name !== "string") return;
-      if (!invoke || typeof invoke !== "object") {
-        // A pure step dispatches nothing, so there is no contract to resolve.
-        // Where its expression is a plain chain into something already typed —
-        // an earlier step's result, or the kind's own inputs — that type carries
-        // through; anything else (arithmetic, a call, a comprehension) stays
-        // permissive rather than guessed. Same rule as a named binding's.
-        if (valueField && valueField in s) {
-          const scopeRoot = {
-            properties: {
-              steps: { type: "object", properties: { ...stepProperties } },
-              ...(ownInputs ? { inputs: ownInputs } : {}),
-            },
-          };
-          const chained = schemaAtChain(bindingPathChain(s[valueField]), scopeRoot);
-          stepProperties[name] = {
-            type: "object",
-            properties: { result: chained ?? PERMISSIVE_CONTRACT },
-          };
-        }
-        return;
-      }
-      const invokedKind = invoke.kind as string | undefined;
-      const invokedName = invoke.name as string | undefined;
-      // A named `!ref` carries the target's own manifest (which may narrow the
-      // contract for this one instance); an inline `{ kind, ... }` step IS the
-      // manifest. Either way the kind layer resolves through `extends`.
-      const invokedManifest = invokedName
-        ? (allManifests.find(
-            (m) =>
-              (m.metadata as any)?.name === invokedName && (!invokedKind || m.kind === invokedKind),
-          ) as Record<string, any> | undefined)
-        : (invoke as Record<string, any>);
-      const invokedDef = invokedKind
-        ? contractScope.resolveIn(invokedKind, readingModule)
-        : undefined;
-      const outputSchema = resolveContract(
-        outputTypeField as ContractDirection,
-        invokedManifest,
-        invokedDef,
-        contractScope,
-      )?.schema;
-      stepProperties[name] = {
-        type: "object",
-        properties: {
-          result: outputSchema ?? PERMISSIVE_CONTRACT,
-        },
-      };
-    });
-
-    if (Object.keys(stepProperties).length > 0) {
-      return {
-        type: "object",
-        properties: stepProperties,
-      };
-    }
-  }
-
-  return undefined;
-}
-
 /** The built-in namespace: globally resolvable, crossing no import boundary. */
 const TELO_BUILTIN_MODULE = "Telo";
 
@@ -647,7 +313,7 @@ const NO_ENTRY_POINT_CAPABILITIES = new Set([
 ]);
 
 /**
- * Validate `x-telo-step-context` step `invoke` references (e.g. `Run.Sequence`
+ * Validate step `invoke` references (e.g. `Run.Sequence`
  * steps).
  *
  * The reference field map deliberately does NOT descend into step `invoke`
@@ -666,7 +332,7 @@ const NO_ENTRY_POINT_CAPABILITIES = new Set([
  *     contract has no entry point → `REFERENCE_KIND_MISMATCH` (runtime
  *     `ERR_RESOURCE_NOT_INVOKABLE`).
  *
- * Generic and topology-driven — it walks steps via the same `x-telo-step-context`
+ * Generic and topology-driven — it walks steps via the same step-slot
  * / `x-telo-topology-role` annotations `buildStepContextSchema` uses (through the
  * shared `walkStepArray`), so nested branches (then/else/do/catch/cases) are
  * covered and no `Run.Sequence` field name is hardcoded. The cross-module
@@ -795,8 +461,7 @@ function validateStepInvokeReferences(
     for (const [fieldName, fieldSchema] of Object.entries(
       defSchema.properties as Record<string, any>,
     )) {
-      const stepCtx = fieldSchema["x-telo-step-context"] as Record<string, string> | undefined;
-      const invokeField = stepCtx?.invoke;
+      const invokeField = readStepSlot(fieldSchema)?.invoke;
       if (!invokeField) continue;
       const steps = m[fieldName];
       if (!Array.isArray(steps)) continue;
@@ -851,92 +516,6 @@ function pathCrossesNestedResource(root: unknown, path: string): boolean {
   return false;
 }
 
-function collectErrorContextScopes(
-  defSchema: Record<string, any> | undefined,
-): Map<string, Record<string, any>> {
-  const out = new Map<string, Record<string, any>>();
-  if (!defSchema || typeof defSchema !== "object") return out;
-  const seen = new Set<Record<string, any>>();
-
-  const walk = (schema: Record<string, any> | undefined): void => {
-    if (!schema || typeof schema !== "object" || seen.has(schema)) return;
-    seen.add(schema);
-
-    const props = schema.properties as Record<string, any> | undefined;
-    if (props) {
-      for (const [fieldName, fieldSchema] of Object.entries(props)) {
-        if (fieldSchema && typeof fieldSchema === "object") {
-          const errCtx = (fieldSchema as Record<string, any>)["x-telo-error-context"];
-          if (errCtx && typeof errCtx === "object" && !out.has(fieldName)) {
-            out.set(fieldName, errCtx as Record<string, any>);
-          }
-        }
-        walk(resolveLocalRef(fieldSchema as Record<string, any>, defSchema));
-      }
-    }
-    if (schema.items) walk(resolveLocalRef(schema.items as Record<string, any>, defSchema));
-    for (const key of ["oneOf", "anyOf", "allOf"] as const) {
-      const arr = schema[key];
-      if (Array.isArray(arr)) for (const sub of arr) walk(resolveLocalRef(sub, defSchema));
-    }
-    if (schema.$defs && typeof schema.$defs === "object") {
-      for (const sub of Object.values(schema.$defs as Record<string, any>)) {
-        walk(sub as Record<string, any>);
-      }
-    }
-  };
-
-  walk(defSchema);
-  return out;
-}
-
-/**
- * Return the error-context schema for a CEL `path` when the path lies within
- * (any depth under) one of the error-bearing fields, else undefined. A path is
- * "within" field `f` when it contains a segment `f[<index>]`. When multiple
- * error-bearing fields match (e.g. a `finally` nested inside a `catch`), the
- * deepest — the one whose segment appears latest in the path — wins, so the
- * innermost branch's schema governs.
- */
-function errorContextForPath(
-  path: string,
-  scopes: Map<string, Record<string, any>>,
-): Record<string, any> | undefined {
-  let best: { index: number; schema: Record<string, any> } | undefined;
-  for (const [fieldName, schema] of scopes) {
-    const escaped = fieldName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    for (const match of path.matchAll(new RegExp(`(^|\\.)${escaped}\\[\\d+\\]`, "g"))) {
-      if (best === undefined || match.index > best.index) {
-        best = { index: match.index, schema };
-      }
-    }
-  }
-  return best?.schema;
-}
-
-/** Add a kind's named bindings to a resolved context, when the context declares
- *  a bindings region. They go UNDER the context's own properties: a scope
- *  variable wins over a same-named binding at runtime, so static typing has to
- *  agree (the collision itself is `BINDING_NAME_RESERVED`). */
-function withBindingNames(
-  contextSchema: Record<string, any>,
-  resource: Record<string, any>,
-): Record<string, any> {
-  const field = contextSchema[BINDINGS_ANNOTATION];
-  if (typeof field !== "string") return contextSchema;
-  const bindings = resource[field];
-  if (bindings === null || typeof bindings !== "object" || Array.isArray(bindings)) {
-    return contextSchema;
-  }
-  return {
-    ...contextSchema,
-    properties: {
-      ...bindingContextProperties(bindings as Record<string, unknown>, contextSchema),
-      ...(contextSchema.properties ?? {}),
-    },
-  };
-}
-
 /** Member-access chains in a CEL expression, or none when it doesn't parse.
  *  Best-effort: a syntax error is reported by the engine pass, not here. */
 function celAccessChains(env: Environment, expr: string): string[][] {
@@ -1253,14 +832,18 @@ export class StaticAnalyzer {
           }
           seen.add(alias);
         }
-        if (alias && source) {
-          const targetModule =
-            resolvedModuleName ?? source.split("/").filter(Boolean).pop() ?? source;
+        // An import whose target identity was never established registers NO
+        // alias. The name is never guessed from the source string: a guess that
+        // is usually right is what turned "this import did not resolve" into an
+        // assertion that a published dependency was malformed, naming a module
+        // no registry could ever hold. With no alias, every use degrades to
+        // "cannot resolve alias '<X>'" — which points at the import the author
+        // has to fix, and which the loader has already reported on its own line.
+        if (alias && source && resolvedModuleName) {
+          const targetModule = resolvedModuleName;
           // Module identity is registered globally so x-telo-ref resolution sees
           // transitively-imported modules regardless of which scope brought them in.
-          if (resolvedModuleName) {
-            defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
-          }
+          defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
           // `metadata.reExportedKinds` (stamped by flattenForAnalyzer / the editor projection)
           // maps an exported suffix to the true owning module's canonical kind for kinds this
           // import transitively re-exports (`exports.kinds: [Alias.Kind]`).
@@ -1318,6 +901,61 @@ export class StaticAnalyzer {
     const refConstraintIssues: RefConstraintIssue[] = [];
     const refSlotIssues: RefSlotIssue[] = [];
     const zoneSlotIssues: ZoneSlotIssue[] = [];
+    // One place a rule report becomes a diagnostic. The pass decided WHAT and
+    // WHERE; this only carries it across to the diagnostic shape.
+    const SEVERITY = {
+      error: DiagnosticSeverity.Error,
+      warning: DiagnosticSeverity.Warning,
+      information: DiagnosticSeverity.Information,
+    } as const;
+    const resourceRuleDiagnostic = (report: ResourceRuleDiagnostic): AnalysisDiagnostic => ({
+      severity: SEVERITY[report.severity],
+      code: report.code,
+      source: SOURCE,
+      message: report.message,
+      data: {
+        resource: {
+          kind: report.manifest.kind,
+          name: report.manifest.metadata?.name as string,
+        },
+        filePath: (report.manifest.metadata as { source?: string } | undefined)?.source,
+        path: report.path,
+        rule: report.rule,
+      },
+    });
+    const referrerRuleDiagnostic = (report: ReferrerRuleDiagnostic): AnalysisDiagnostic => ({
+      severity: SEVERITY[report.severity],
+      code: report.code,
+      source: SOURCE,
+      message: report.message,
+      data: {
+        resource: {
+          kind: report.manifest.kind,
+          name: report.manifest.metadata?.name as string,
+        },
+        filePath: (report.manifest.metadata as { source?: string } | undefined)?.source,
+        path: report.path,
+        rule: report.rule,
+      },
+    });
+    const projectionIssues: SchemaProjectionIssue[] = [];
+    const resourceRuleIssues: ResourceRuleIssue[] = [];
+    const referrerRuleIssues: ReferrerRuleIssue[] = [];
+    // A rule that never had anything to iterate is never proven — the second way
+    // coverage varies invisibly, beside the dynamic-leaf skip. Tracked across the
+    // whole run and reported once, since "empty on every resource" is not a fact
+    // any single resource can establish.
+    const ruleExercise = new Map<
+      string,
+      { manifest: ResourceManifest; rule: ResourceRule; exercised: boolean; seen: boolean }
+    >();
+    // Same for a referrer rule, where "never exercised" means nothing the
+    // `referrer:` filter matches ever referenced a resource of the kind — which
+    // is exactly what a typo in that filter looks like from the outside.
+    const referrerRuleExercise = new Map<
+      string,
+      { manifest: ResourceManifest; rule: ReferrerRule; exercised: boolean; seen: boolean }
+    >();
     // `x-telo-type` is checked on EVERY manifest, not only on definition docs: a
     // schema fragment is written wherever a kind declares a schema-valued field,
     // so an inline `inputType:` on an ordinary resource carries one just as a
@@ -1350,6 +988,35 @@ export class StaticAnalyzer {
         refConstraintIssues.push(...issues);
         refSlotIssues.push(...validateRefSlotDeclarations(m as unknown as ResourceManifest));
         zoneSlotIssues.push(...validateZoneSlotDeclarations(m as unknown as ResourceManifest));
+        projectionIssues.push(...validateSchemaProjection(m as unknown as ResourceManifest));
+        // Checked against the MERGED schema, so an `in:` pointer naming an
+        // inherited field resolves — which is what lets a rule shared by every
+        // backend be declared once on the abstract they extend.
+        resourceRuleIssues.push(
+          ...validateResourceRuleDeclarations(
+            m as unknown as ResourceManifest,
+            effectiveAuthorSchema(m as any, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k)),
+          ),
+        );
+        referrerRuleIssues.push(
+          ...validateReferrerRuleDeclarations(m as unknown as ResourceManifest),
+        );
+        for (const rule of readReferrerRules((m as Record<string, unknown>).schema)) {
+          referrerRuleExercise.set(`${m.metadata?.module}.${m.metadata?.name}#${rule.code}`, {
+            manifest: m as unknown as ResourceManifest,
+            rule,
+            exercised: false,
+            seen: false,
+          });
+        }
+        for (const rule of readResourceRules((m as Record<string, unknown>).schema)) {
+          ruleExercise.set(`${m.metadata?.module}.${m.metadata?.name}#${rule.code}`, {
+            manifest: m as unknown as ResourceManifest,
+            rule,
+            exercised: false,
+            seen: false,
+          });
+        }
       }
       const resolvedCapability = def.capability
         ? (scopeResolver.resolveKind(def.capability) ?? def.capability)
@@ -1407,6 +1074,25 @@ export class StaticAnalyzer {
         };
         const filePath = (issue.manifest.metadata as { source?: string } | undefined)?.source;
         const data = { resource, filePath, path: issue.path };
+        if (issue.annotation === "referrer") {
+          // Mirrors ZONE_PROVIDER_UNRESOLVED: a filter naming no kind matches no
+          // referrer, so the rule would pass on every manifest while checking
+          // nothing — reported at the kind that wrote it, since the consumer
+          // cannot see that the check is inert.
+          diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "REFERRER_RULE_INVALID",
+            source: SOURCE,
+            message:
+              `x-telo-referrer-rules 'referrer: ${issue.ref}' at '${issue.path}' names no kind. ` +
+              `The prefix must be an import alias declared in this file's 'imports:' map, ` +
+              `'Self' for a kind in this library, or 'Telo' for a built-in. A filter that ` +
+              `matches nothing leaves the rule inert. Known aliases: ` +
+              `${issue.knownAliases?.join(", ") || "(none)"}.`,
+            data,
+          });
+          continue;
+        }
         if (issue.annotation === "zone") {
           // Mirrors X_TELO_REF_UNRESOLVED: an unresolvable provider kind would
           // leave the requirement silently unenforced — no provider ever
@@ -1493,6 +1179,57 @@ export class StaticAnalyzer {
       // OPPOSITE directions — a dropped requirement is silently unenforced, a
       // dropped provision invents failures — so neither can be left to
       // leniency.
+      // A projection nothing can read does not fail — it stops typing the
+      // consumers counting on it, which puts a misspelled field back where the
+      // projection exists to catch it earlier.
+      for (const issue of resourceRuleIssues) {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: issue.code,
+          source: SOURCE,
+          message: issue.message,
+          data: {
+            resource: {
+              kind: issue.manifest.kind,
+              name: issue.manifest.metadata?.name as string,
+            },
+            filePath: (issue.manifest.metadata as { source?: string } | undefined)?.source,
+            path: issue.path,
+          },
+        });
+      }
+      for (const issue of referrerRuleIssues) {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: issue.code,
+          source: SOURCE,
+          message: issue.message,
+          data: {
+            resource: {
+              kind: issue.manifest.kind,
+              name: issue.manifest.metadata?.name as string,
+            },
+            filePath: (issue.manifest.metadata as { source?: string } | undefined)?.source,
+            path: issue.path,
+          },
+        });
+      }
+      for (const issue of projectionIssues) {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: issue.code,
+          source: SOURCE,
+          message: issue.message,
+          data: {
+            resource: {
+              kind: issue.manifest.kind,
+              name: issue.manifest.metadata?.name as string,
+            },
+            filePath: (issue.manifest.metadata as { source?: string } | undefined)?.source,
+            path: issue.path,
+          },
+        });
+      }
       for (const issue of zoneSlotIssues) {
         diagnostics.push({
           severity: DiagnosticSeverity.Error,
@@ -1532,6 +1269,57 @@ export class StaticAnalyzer {
         aliasesByModule,
       }));
 
+    /**
+     * Whether a referrer of `kind` satisfies a referrer rule's `referrer:`
+     * filter, which is canonical by the time it gets here (`resolveSchemaRefKinds`
+     * rewrote it in the DECLARING module's scope). The referring manifest's own
+     * `kind:` is not — it is whatever alias its author imported the kind under —
+     * so it is resolved the same way every other kind comparison in this pass
+     * resolves one. Liskov-substitutable, matching `checkKind`: a child of the
+     * named kind is one.
+     */
+    const kindMatches = (filter: string, kind: string): boolean => {
+      const resolved = aliases.resolveKind(kind) ?? kind;
+      if (resolved === filter) return true;
+      return defs
+        .getByExtends(filter)
+        .some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved);
+    };
+
+    /**
+     * The resources that reach `manifest`, with the slot each one reaches it
+     * through. A step's edge is attributed to the resource whose body declares
+     * it: a step is not a manifest, and the requirement is about the resource
+     * that has to declare something.
+     *
+     * Deduplication is the evaluation's, not this function's — a referrer
+     * reaching one resource through two slots is two sites, and which one anchors
+     * the diagnostic is a reporting decision.
+     */
+    const referrersOf = (
+      manifest: ResourceManifest,
+      graph: ReturnType<typeof buildCallGraph>,
+    ): Referrer[] => {
+      const name = manifest.metadata?.name as string | undefined;
+      if (!name) return [];
+      const node = graph.resource(manifest.kind, name) ?? graph.resourceByName(name);
+      if (!node) return [];
+      const out: Referrer[] = [];
+      for (const edge of graph.edgesTo(node.id)) {
+        const from = graph.nodes.get(edge.from);
+        if (!from) continue;
+        const owner = from.type === "step" ? graph.nodes.get(from.owner) : from;
+        if (!owner || owner.type !== "resource") continue;
+        out.push({
+          manifest: owner.manifest,
+          kind: owner.kind,
+          name: owner.name,
+          path: edge.path,
+        });
+      }
+      return out;
+    };
+
     // A `use` case map's selector written in CEL is a hard diagnostic — a call
     // graph known only at runtime is not statically analyzable, and no fallback
     // is conservative for every consumer. Scoped to the entry's own modules:
@@ -1567,6 +1355,32 @@ export class StaticAnalyzer {
           cache: zoneExportCache,
         }),
       );
+
+      // Durable regions — the SAME graph again, walked DOWNWARD this time.
+      // Every rule here keys off a zone attribute rather than off any kind, so
+      // a backend that ships its own workflow kind is covered without the
+      // analyzer knowing it exists: going native costs a module, not a change
+      // here.
+      const resolveRegionDef = (kind: string, module?: string) => {
+        const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+        const canonical = scope.resolveKind(kind);
+        return defs.resolve(kind) ?? (canonical ? defs.resolve(canonical) : undefined);
+      };
+      diagnostics.push(
+        ...validateDurableRegions({
+          graph: getCallGraph(),
+          resolveDef: resolveRegionDef,
+          reportModules: rootModules,
+        }),
+        // The same walk once more, over EVERY attribute rather than the two
+        // durability names — a region must not contain a resource that declares
+        // it cannot honour what the region promises.
+        ...validateZoneViolations({
+          graph: getCallGraph(),
+          resolveDef: resolveRegionDef,
+          reportModules: rootModules,
+        }),
+      );
     }
 
     // Phase 2.6: register each named `Telo.Type` resource's schema under its
@@ -1811,9 +1625,20 @@ export class StaticAnalyzer {
     // fit the slot at all", the schema answers "do their type arguments agree",
     // which cel-js cannot express because it types by constructor identity.
     const celSourceSchemaByPath = new Map<ResourceManifest, Map<string, Record<string, any>>>();
-    // Context-free typed environments, one per manifest. Reused across every
-    // expression in it — see the build site for why a matched context opts out.
-    const typedEnvByManifest = new Map<ResourceManifest, Environment>();
+    // What every CEL expression in this set is typed against. The rule lives in
+    // `cel-scope.ts` so the IDE asks the same question the pass does — a
+    // completion list is a claim that the name it offers will pass this check,
+    // and two implementations of it could not be held in agreement.
+    const celScope = new CelScopeResolver({
+      celEnv: this.celEnv,
+      defs,
+      aliases,
+      scopes: { aliasesByModule, rootModules },
+      allManifests,
+      kernelGlobals,
+      moduleManifest,
+      observedStateContext,
+    });
 
     // Validate each non-definition, non-system resource
     for (const m of allManifests) {
@@ -1963,6 +1788,69 @@ export class StaticAnalyzer {
         }
       }
 
+      // Resource rules — relationships between this resource's own fields that
+      // JSON Schema cannot state, declared by the kind as CEL over `self` and
+      // `this`. Read off the AUTHOR-FACING schema, so an `extends` child without
+      // `base:` inherits its parent's rules and one that declares its own
+      // replaces them, exactly as the rest of the config contract merges.
+      // The finding→diagnostic mapping lives with the finding vocabulary in
+      // `validate-resource-rules.ts`, the shape every neighbouring pass uses:
+      // issues out, one emit here.
+      const ruleDeclarer = (definition.metadata as { module?: string } | undefined)?.module;
+      for (const report of reportResourceRules(
+        m as unknown as ResourceManifest,
+        definition as unknown as ResourceManifest,
+        evaluateResourceRules(m as unknown as ResourceManifest, authorSchema),
+        !ruleDeclarer || rootModules.has(ruleDeclarer),
+      )) {
+        diagnostics.push(resourceRuleDiagnostic(report));
+      }
+      for (const rule of readResourceRules(authorSchema)) {
+        const key = `${definition.metadata?.module}.${definition.metadata?.name}#${rule.code}`;
+        const tracked = ruleExercise.get(key);
+        if (!tracked) continue;
+        tracked.seen = true;
+        if (ruleExercised(m as unknown as ResourceManifest, rule)) tracked.exercised = true;
+      }
+
+      // Referrer rules — what must be true of whoever REFERENCES this resource,
+      // declared by the kind that has the requirement rather than by the kind
+      // that must satisfy it. The subject is chosen by the EDGE, so no kind
+      // literal appears on the referring side, where the spelling would be the
+      // consumer's import alias rather than anything the rule's author controls.
+      // A consumer of the shared call graph, never a second traversal.
+      const referrerRules = readReferrerRules(authorSchema);
+      if (referrerRules.length > 0) {
+        const referrers = referrersOf(m as unknown as ResourceManifest, getCallGraph());
+        for (const report of reportReferrerRules(
+          m as unknown as ResourceManifest,
+          definition as unknown as ResourceManifest,
+          evaluateReferrerRules(
+            m as unknown as ResourceManifest,
+            authorSchema,
+            referrers,
+            kindMatches,
+          ),
+          !ruleDeclarer || rootModules.has(ruleDeclarer),
+        )) {
+          // A VIOLATION is the referrer's data, so it is reported only when that
+          // manifest is the entry's own — the same direction a resource-rule
+          // violation takes, one hop further out.
+          const owner = (report.manifest.metadata as { module?: string } | undefined)?.module;
+          if (report.code === "REFERRER_RULE_VIOLATED" && owner && !rootModules.has(owner)) {
+            continue;
+          }
+          diagnostics.push(referrerRuleDiagnostic(report));
+        }
+        for (const rule of referrerRules) {
+          const key = `${definition.metadata?.module}.${definition.metadata?.name}#${rule.code}`;
+          const tracked = referrerRuleExercise.get(key);
+          if (!tracked) continue;
+          tracked.seen = true;
+          if (referrerRuleExercised(rule, referrers, kindMatches)) tracked.exercised = true;
+        }
+      }
+
       // Validate inline resources nested inside this resource's body (e.g. a
       // Run.Sequence step's `invoke: { kind, ...config }`). These sit at
       // x-telo-ref slots reached only through local `$ref`s, which the
@@ -1998,6 +1886,24 @@ export class StaticAnalyzer {
       // (Invocation context compatibility check is handled via x-telo-context in the CEL pass below)
     }
 
+    // A rule whose collection was empty on every resource of its kind is a rule
+    // nothing proved. `check()` types `self` only shallowly (cel-js takes a flat
+    // field map, so `columns` is `map`), which means a typo below the first level
+    // survives declaration validation and is caught only by evaluation — so a
+    // rule that never evaluated has been verified by nothing at all. Reported
+    // only when the kind HAS resources here: a kind nobody instantiated in this
+    // workspace says nothing about the rule.
+    for (const tracked of ruleExercise.values()) {
+      if (!tracked.seen || tracked.exercised) continue;
+      diagnostics.push(resourceRuleDiagnostic(reportUnexercisedRule(tracked.manifest, tracked.rule)));
+    }
+    for (const tracked of referrerRuleExercise.values()) {
+      if (!tracked.seen || tracked.exercised) continue;
+      diagnostics.push(
+        referrerRuleDiagnostic(reportUnexercisedReferrerRule(tracked.manifest, tracked.rule)),
+      );
+    }
+
     // Template-body structural validations: check that template entry-points produce
     // values matching the contract of their dispatch target and (for `provide:`)
     // the abstract this definition `extends`. CEL fields inside the templated
@@ -2092,6 +1998,40 @@ export class StaticAnalyzer {
       }
     }
 
+    // A consumer's slot typed from a referenced declaration
+    // (`x-telo-schema-projection-from`) fails in the direction that is hardest
+    // to notice: the contract silently reopens, so a misspelled field passes
+    // `telo check` exactly as it did before the projection existed. That is the
+    // failure the projection exists to move earlier, so it is reported here
+    // rather than left to degrade. Entry-module-scoped, like
+    // `X_TELO_REF_UNRESOLVED` — a published dependency's slot is not the
+    // consumer's to fix.
+    for (const m of allManifests) {
+      const md = m as Record<string, any>;
+      if (typeof md.kind !== "string" || md.kind.startsWith("Telo.")) continue;
+      const ownModule = (md.metadata as { module?: string } | undefined)?.module;
+      if (ownModule && !rootModules.has(ownModule)) continue;
+      const definition = contractScope.resolveIn(md.kind, ownModule);
+      if (!definition) continue;
+      const failures: ProjectionFailure[] = [];
+      for (const direction of ["inputType", "outputType"] as const) {
+        resolveContract(direction, md, definition, contractScope, failures);
+      }
+      for (const failure of failures) {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "SCHEMA_PROJECTION_FROM_UNRESOLVED",
+          source: SOURCE,
+          message: `${md.kind}: ${describeProjectionFailure(failure)}`,
+          data: {
+            resource: { kind: md.kind, name: (md.metadata as any)?.name as string },
+            filePath: (md.metadata as { source?: string } | undefined)?.source,
+            path: failure.pointer.replace(/^\//, ""),
+          },
+        });
+      }
+    }
+
     // Validate CEL syntax and context variable access in all manifests. The
     // walker discovers every compiled CEL node by scanning the value tree and
     // hands back the `x-telo-context` schema matched at the enclosing path; the
@@ -2100,11 +2040,11 @@ export class StaticAnalyzer {
     // state (definitions, aliases, the typed CEL env).
     // Per-resource state computed at enter and read by that resource's CEL
     // sites. The manifest / resource / filePath come straight off each CelSite's
-    // `source` (no need to capture them); only the derived step / invocation
-    // context — which require analyzer state to build — are stashed here.
+    // `source` (no need to capture them); the derived step / invocation / error
+    // context is the scope resolver's, read back from it where a CHECK needs the
+    // same schema an expression is typed against.
     let celStepContextSchema: Record<string, any> | undefined;
-    let celInvocationContext: Record<string, any> | undefined;
-    let celErrorScopes: Map<string, Record<string, any>> = new Map();
+    let celErrorScopes: ReadonlyMap<string, Record<string, any>> = new Map();
     // Region coverage for the "CEL in a non-eval field" check: the union of
     // `x-telo-eval` paths (own + capability) and `x-telo-context` /
     // `x-telo-step-context` / `x-telo-error-context` scopes. A `!cel` outside
@@ -2125,23 +2065,29 @@ export class StaticAnalyzer {
       {
         onResourceEnter: (e) => {
           const m = e.source;
-          celInvocationContext = (m.metadata as any)?.xTeloInvocationContext as
-            | Record<string, any>
-            | undefined;
-          celStepContextSchema = e.definition?.schema
-            ? buildStepContextSchema(
+          celScope.enterResource(m, e.definition);
+          // Read back rather than recomputed: the step-inputs check has to see
+          // the same `steps` schema this resource's expressions are typed
+          // against, and a second computation is how the two come to disagree.
+          celStepContextSchema = celScope.stepContextSchema;
+          celErrorScopes = celScope.errorContextScopes;
+          if (e.definition?.schema) {
+            const stepName = (m.metadata as any)?.name as string | undefined;
+            const stepFile = (m.metadata as { source?: string } | undefined)?.source;
+            // Both drivers of the SAME check: a step's `inputs:` found through
+            // the step grammar, and a reference slot's found through the
+            // `x-telo-ref` `inputs:` pointer. A call site the editor can
+            // complete is a call site `telo check` validates.
+            const inputIssues = [
+              ...collectRefInputIssues(
                 m as Record<string, any>,
-                e.definition.schema as Record<string, any>,
+                defs.expandedFieldMapForResource(m, aliases, aliasesByModule),
                 allManifests as Record<string, any>[],
                 defs,
                 aliases,
                 { aliasesByModule, rootModules },
-              )
-            : undefined;
-          if (e.definition?.schema) {
-            const stepName = (m.metadata as any)?.name as string | undefined;
-            const stepFile = (m.metadata as { source?: string } | undefined)?.source;
-            for (const issue of collectStepInputIssues(
+              ),
+              ...collectStepInputIssues(
               m as Record<string, any>,
               e.definition.schema as Record<string, any>,
               allManifests as Record<string, any>[],
@@ -2149,7 +2095,9 @@ export class StaticAnalyzer {
               aliases,
               { aliasesByModule, rootModules },
               celStepContextSchema,
-            )) {
+              ),
+            ];
+            for (const issue of inputIssues) {
               diagnostics.push({
                 severity: DiagnosticSeverity.Error,
                 code: issue.code ?? "CONTRACT_INPUTS_MISMATCH",
@@ -2168,10 +2116,6 @@ export class StaticAnalyzer {
               });
             }
           }
-          celErrorScopes = collectErrorContextScopes(
-            e.definition?.schema as Record<string, any> | undefined,
-          );
-
           celBindingSites = findBindingSites(e.definition?.schema as Record<string, any>);
           if (celBindingSites) {
             const declared = (m as Record<string, any>)[celBindingSites.field];
@@ -2299,7 +2243,7 @@ export class StaticAnalyzer {
           if (
             celRuleApplies &&
             engineName === "cel" &&
-            celInvocationContext === undefined &&
+            celScope.invocationContextSchema === undefined &&
             !evalPathsCover(celEvalPaths, path) &&
             !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
             !pathCrossesNestedResource(m, path)
@@ -2352,70 +2296,6 @@ export class StaticAnalyzer {
             }
           }
 
-          let matchedContext: Record<string, any> | undefined =
-            e.contextSchema ?? celInvocationContext;
-
-          if (celStepContextSchema) {
-            const base =
-              matchedContext ?? { type: "object", properties: {}, additionalProperties: true };
-            matchedContext = {
-              ...base,
-              properties: {
-                ...(base.properties ?? {}),
-                steps: celStepContextSchema,
-              },
-            };
-          }
-
-          // `error` is only in scope inside an error-bearing branch (e.g. a
-          // `catch:` / `finally:`), so it's merged per-path, not resource-wide.
-          const errorSchema =
-            celErrorScopes.size > 0 ? errorContextForPath(path, celErrorScopes) : undefined;
-          if (errorSchema) {
-            const base =
-              matchedContext ?? { type: "object", properties: {}, additionalProperties: true };
-            matchedContext = {
-              ...base,
-              properties: {
-                ...(base.properties ?? {}),
-                error: errorSchema,
-              },
-            };
-          }
-
-          let effectiveContext: Record<string, any> | null = null;
-          if (matchedContext) {
-            const manifestItem = matchedScope
-              ? getManifestItem(path, matchedScope, m as Record<string, any>)
-              : (m as Record<string, any>);
-            const rootForResolver = manifestRootForResolver(
-              m as Record<string, any>,
-              defs,
-              aliases,
-              allManifests as Record<string, any>[],
-              { aliasesByModule, rootModules },
-            );
-            const resolvedContext = resolveContextAnnotations(matchedContext, manifestItem, {
-              manifestRoot: rootForResolver,
-              defs,
-              aliases,
-              allManifests: allManifests as Record<string, any>[],
-            });
-            effectiveContext = mergeKernelGlobalsIntoContext(
-              withBindingNames(resolvedContext, m as Record<string, any>),
-              // Typed in the module that DECLARED this resource — for a manifest
-              // forwarded from an imported library, that is its `moduleGlobals`
-              // stamp, not the consuming application's block.
-              kernelGlobals.forResource(m),
-            );
-          } else if (observedStateContext) {
-            // No `x-telo-context` matched, so nothing was chain-validated here
-            // before. Validate the observed-state segment alone rather than
-            // merging the kernel globals, whose closed `variables` / `ports`
-            // nodes would newly reject reads that pass today.
-            effectiveContext = observedStateContext;
-          }
-
           const engine = defaultRegistry().get(engineName);
           if (!engine) {
             // No registered engine owns this tag — the expression would go
@@ -2430,38 +2310,15 @@ export class StaticAnalyzer {
             return;
           }
           // The engine type-checks, so it gets the environment typed for THIS
-          // path — not the bare base one. A `Telo.Import`'s variables/secrets
-          // are a config-only contract evaluated in the IMPORTING module's
-          // scope, so they type from the owning module doc and drop
-          // `resources`/`env`, making a reference to either an error.
-          //
-          // Cached per manifest when no `x-telo-context` applied, which is most
-          // expressions: the environment then depends only on the manifest, so
-          // rebuilding it per expression is pure waste — a clone plus a
-          // re-registration of every variable, on every keystroke in the IDE.
-          // A matched context makes the environment path-specific (its schema is
-          // resolved against the enclosing array item), so those still build
-          // fresh rather than risk one item's types leaking into another's.
-          const cached = effectiveContext === null ? typedEnvByManifest.get(m) : undefined;
-          const typedEnv =
-            cached ??
-            (m.kind === "Telo.Import"
-              ? buildImportInputCelEnvironment(
-                  this.celEnv,
-                  allManifests.find(
-                    (mm) =>
-                      (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
-                      (mm.metadata as { name?: string } | undefined)?.name ===
-                        (m.metadata as { module?: string } | undefined)?.module,
-                  ),
-                )
-              : buildTypedCelEnvironment(
-                  this.celEnv,
-                  m,
-                  effectiveContext ?? undefined,
-                  moduleManifest,
-                ));
-          if (effectiveContext === null && !cached) typedEnvByManifest.set(m, typedEnv);
+          // path — not the bare base one. Both halves come from the one scope
+          // rule, which is what makes the IDE's answer and this check the same
+          // answer rather than two that agree today.
+          const { env: typedEnv, contextSchema: effectiveContext } = celScope.scopeFor({
+            source: m,
+            path,
+            contextSchema: e.contextSchema,
+            matchedScope,
+          });
 
           const result = engine.analyze(expr, { celEnv: typedEnv, contextSchema: effectiveContext });