@telorun/analyzer 0.62.1 → 0.64.0

package/dist/analyzer.js

@@ -1,13 +1,13 @@
 import { canonicalTypeSchemaId, OBSERVED_STATE_KEY } from "@telorun/sdk";
 import { defaultRegistry, isRefSentinel, isTaggedSentinel, plainChainOf, } from "@telorun/templating";
-import { AliasResolver, moduleScopedDefResolver, scopeResolverForModule, } from "./alias-resolver.js";
-import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
+import { AliasResolver, scopeResolverForModule, } from "./alias-resolver.js";
+import { buildCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { effectiveAuthorSchema } from "./extends-resolution.js";
-import { PERMISSIVE_CONTRACT, resolveContract, } from "./invocation-contract.js";
+import { analyzerContractScope, resolveContract, } from "./invocation-contract.js";
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
-import { buildKernelGlobalsIndex, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
+import { buildKernelGlobalsIndex, KERNEL_GLOBAL_NAMES, } from "./kernel-globals.js";
 import { buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
@@ -17,8 +17,23 @@ import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
 import { resolveRefSentinels } from "./resolve-ref-sentinels.js";
 import { resolveSchemaRefKinds } from "./resolve-schema-ref-kinds.js";
 import { runZoneAnalysis } from "./resolve-zone-requirements.js";
-import { MANIFEST_SCHEMA_URI, ManifestRootSchema } from "./manifest-schemas.js";
+import { validateDurableRegions } from "./validate-durable-regions.js";
+import { validateZoneViolations } from "./validate-zone-violations.js";
+import { resolveLocalRef, walkStepArray } from "./schema-walk.js";
+import { CelScopeResolver } from "./cel-scope.js";
+// The structural walks and the CEL scope rule moved out of this file — the
+// first so both halves can reach them, the second so the IDE can ask what a
+// cursor sees without pulling the analysis pass in behind it. Re-exported here
+// because they were part of this module's surface before the split.
+export { gatherPropertySchemas, resolveLocalRef, walkStepArray } from "./schema-walk.js";
+export { analyzerContractScope } from "./invocation-contract.js";
 import { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
+import { validateSchemaProjection, } from "./validate-schema-projection.js";
+import { evaluateResourceRules, reportResourceRules, reportUnexercisedRule, ruleExercised, validateResourceRuleDeclarations, } from "./validate-resource-rules.js";
+import { readResourceRules } from "./resource-rule.js";
+import { readReferrerRules } from "./referrer-rule.js";
+import { evaluateReferrerRules, referrerRuleExercised, reportReferrerRules, reportUnexercisedReferrerRule, validateReferrerRuleDeclarations, } from "./validate-referrer-rules.js";
+import { describeProjectionFailure, } from "./schema-projection.js";
 import { validateDynamicSelectors, validateRefSlotDeclarations, } from "./validate-ref-slots.js";
 import { validateValueTypeSlots, } from "./validate-value-type-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
@@ -27,9 +42,9 @@ import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractAccessChains, extractCelRegionScopes, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { extractAccessChains, extractCelRegionScopes, pathMatchesScope, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
-import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
+import { BINDINGS_ANNOTATION, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
 import { CEL_RESERVED_WORDS, checkName } from "./identifier-name.js";
 import { validateIdentifierNames } from "./validate-identifier-names.js";
 import { validateExtends } from "./validate-extends.js";
@@ -40,13 +55,14 @@ import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateRequires } from "./validate-requires.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
-import { collectStepInputIssues } from "./validate-step-inputs.js";
+import { collectRefInputIssues, collectStepInputIssues } from "./validate-step-inputs.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
+import { readStepSlot } from "./step-slot.js";
 const SELF_PREFIX = "Self.";
 /**
  * `StaticAnalyzer.analyze()` requires `metadata.source` (non-empty) and
@@ -90,83 +106,7 @@ function resolveSelfOrAlias(value, ownModule, scopeResolver) {
     }
     return scopeResolver.resolveKind(value);
 }
-/** The {@link ContractScope} the analyzer resolves invocation contracts in: kinds
- *  resolve in the module that declared the definition they were read off (so an
- *  `extends` chain crossing module boundaries re-scopes at every hop), and named
- *  `telo#Type` references resolve against the flattened manifest list. `resolveIn`
- *  is the top-level entry point, where the kind was written by the READING
- *  module and there is no declaring definition yet. */
-export function analyzerContractScope(defs, aliases, scopes, allManifests) {
-    const resolve = moduleScopedDefResolver(defs, aliases, scopes);
-    return {
-        resolveDefinition: resolve,
-        resolveIn: resolve.in,
-        typeManifestsFor: () => allManifests,
-    };
-}
 const SOURCE = "telo-analyzer";
-/** Build a closed JSON Schema for the `self` CEL variable available inside a
- *  `Telo.Definition` template body. Mirrors the runtime template controller's
- *  `const self = { ...resource, name: resource.metadata.name };` — every
- *  property the user declared in `schema:` plus synthetic `name` / `kind` and
- *  the metadata sub-object (kept open since metadata legitimately carries
- *  arbitrary user-added fields). */
-function buildSelfSchema(definition, defs, aliases) {
-    // The author-facing schema resolves inheritance: with `base:` the child's own
-    // schema (the parent's config is internal); without it, `merge(parent, own)`.
-    const userSchema = (defs
-        ? effectiveAuthorSchema(definition, (k) => defs.resolve(aliases?.resolveKind(k) ?? k) ?? defs.resolve(k))
-        : (definition.schema ?? {}));
-    const userProps = (userSchema.properties ?? {});
-    const userRequired = Array.isArray(userSchema.required) ? userSchema.required : [];
-    return {
-        type: "object",
-        additionalProperties: false,
-        properties: {
-            ...userProps,
-            name: { type: "string" },
-            kind: { type: "string" },
-            metadata: {
-                type: "object",
-                additionalProperties: true,
-                properties: { name: { type: "string" } },
-            },
-        },
-        required: [...userRequired, "name", "kind"],
-    };
-}
-/** Build the JSON Schema for the `inputs` CEL variable available inside an
- *  invocable template body — the shared contract resolver applied to the
- *  definition itself, so a body is typed against the exact signature callers are
- *  checked against and dispatch enforces. Walks the whole `extends` chain rather
- *  than one hop, so a definition two levels below the declaration still gets
- *  typed inputs. Undefined when nothing in the chain declares a contract —
- *  the caller signals opaque `map<string, dyn>` upstream. */
-function lookupTemplateInputsSchema(definition, defs, aliases, allManifests, scopes) {
-    return resolveContract("inputType", undefined, definition, analyzerContractScope(defs, aliases, scopes, allManifests))?.schema;
-}
-/** Returns a "resolver-facing" view of the manifest where the fields used as
- *  navigation roots by Telo.Definition's `x-telo-context-from-root` annotations
- *  have been pre-augmented:
- *    - `schema`     → augmented `self` schema (synthetic `name`/`kind`/metadata).
- *    - `inputType`  → resolved through the shared contract resolver, so
- *                     `x-telo-context-from-root: inputType` substitutes the
- *                     real signature. Without it the annotation would replace
- *                     the node verbatim with the inline `{kind, schema}` wrapper
- *                     the standard library writes everywhere, typing `inputs` as
- *                     `{kind, schema}` instead of the declared properties.
- *
- *  For non-definition manifests the original object is returned. */
-function manifestRootForResolver(m, defs, aliases, allManifests, scopes) {
-    if (m.kind !== "Telo.Definition")
-        return m;
-    const inputs = lookupTemplateInputsSchema(m, defs, aliases, allManifests, scopes);
-    return {
-        ...m,
-        schema: buildSelfSchema(m, defs, aliases),
-        ...(inputs ? { inputType: inputs } : {}),
-    };
-}
 /** True when an issue reports a property that is absent — its path points at a
  *  node the manifest does not contain. */
 export const missingRequired = (issue) => /is missing required property/.test(issue.message);
@@ -193,228 +133,6 @@ function contractOwnerLabel(definition, contract) {
     }
     return canonical;
 }
-/** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
- *  Non-refs and unresolved refs pass through unchanged. */
-export function resolveLocalRef(schema, root) {
-    if (!schema)
-        return undefined;
-    const ref = schema.$ref;
-    if (typeof ref === "string" && ref.startsWith("#/$defs/")) {
-        const defName = ref.slice("#/$defs/".length);
-        const resolved = root.$defs?.[defName];
-        if (resolved && typeof resolved === "object")
-            return resolved;
-    }
-    // A kernel-owned structural fragment (`telo://manifest#/$defs/InvokeStep`).
-    // Resolved HERE rather than by each walker: this is the one chokepoint every
-    // structural walk already goes through — the step-array walks, the call graph,
-    // the zone projection, the eval-path collector — so a composer that points at a
-    // shared shape stays legible to all of them at once. Nothing is inlined into
-    // the stored schema, which keeps validator-cache identity stable and matches
-    // what `resolveSchemaTypeRefs` does for a named user type.
-    if (typeof ref === "string" && ref.startsWith(BUILTIN_FRAGMENT_PREFIX)) {
-        const defName = ref.slice(BUILTIN_FRAGMENT_PREFIX.length);
-        const resolved = ManifestRootSchema.$defs[defName];
-        if (resolved && typeof resolved === "object")
-            return resolved;
-    }
-    return schema;
-}
-const BUILTIN_FRAGMENT_PREFIX = `${MANIFEST_SCHEMA_URI}#/$defs/`;
-/** Gather property schemas from a (possibly variant-bearing) object schema:
- *  top-level `properties` plus every `oneOf` / `anyOf` / `allOf` branch.
- *
- *  Each branch is resolved through {@link resolveLocalRef} first, so a branch
- *  that points at a shared shape — a `oneOf` arm that IS the kernel's dispatch
- *  site — contributes its properties like an inline one. Without that, pointing a
- *  composer at a shared shape would silently empty every role-driven lookup that
- *  reads this (the inputs slot, the retry policy, the eval paths), which is a
- *  failure with no diagnostic attached to it. */
-export function gatherPropertySchemas(schema, root) {
-    const out = [];
-    const base = resolveLocalRef(schema, root ?? schema) ?? schema;
-    if (base.properties && typeof base.properties === "object") {
-        for (const [k, v] of Object.entries(base.properties)) {
-            out.push([k, v]);
-        }
-    }
-    for (const variantKey of ["oneOf", "anyOf", "allOf"]) {
-        const arr = base[variantKey];
-        if (!Array.isArray(arr))
-            continue;
-        for (const raw of arr) {
-            if (!raw || typeof raw !== "object")
-                continue;
-            const variant = resolveLocalRef(raw, root ?? schema) ?? raw;
-            if (variant.properties) {
-                for (const [k, v] of Object.entries(variant.properties)) {
-                    out.push([k, v]);
-                }
-            }
-        }
-    }
-    return out;
-}
-/**
- * Generic, role-driven walk over an `x-telo-step-context` step array. Calls
- * `visit(step, stepPath)` for every step — top-level and nested through the
- * `x-telo-topology-role` forms (`branch`, `branch-list`, `case-map`). This is
- * the single definition of how steps nest, shared by `buildStepContextSchema`
- * (which types `steps.<name>.result`) and `validateStepInvokeReferences` (which
- * checks invoke refs), so the topology contract lives in one place — adding a
- * role or nesting form updates both consumers at once. No resource kind is
- * hardcoded; recursion is driven entirely by the schema annotations.
- */
-export function walkStepArray(steps, stepItemSchema, rootSchema, basePath, visit) {
-    const dispatchRole = (data, role, itemsSchema, path) => {
-        if (role === "branch" && Array.isArray(data)) {
-            walkStepArray(data, stepItemSchema, rootSchema, path, visit);
-        }
-        else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
-            for (const [caseKey, arr] of Object.entries(data)) {
-                if (Array.isArray(arr))
-                    walkStepArray(arr, stepItemSchema, rootSchema, `${path}.${caseKey}`, visit);
-            }
-        }
-        else if (role === "branch-list" && Array.isArray(data)) {
-            const entrySchema = resolveLocalRef(itemsSchema, rootSchema);
-            if (!entrySchema)
-                return;
-            data.forEach((entry, i) => {
-                if (!entry || typeof entry !== "object")
-                    return;
-                for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
-                    const subRole = subSchema["x-telo-topology-role"];
-                    if (typeof subRole !== "string")
-                        continue;
-                    dispatchRole(entry[subKey], subRole, subSchema.items, `${path}[${i}].${subKey}`);
-                }
-            });
-        }
-    };
-    steps.forEach((step, i) => {
-        if (!step || typeof step !== "object")
-            return;
-        const s = step;
-        const stepPath = `${basePath}[${i}]`;
-        visit(s, stepPath);
-        if (!stepItemSchema)
-            return;
-        for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
-            const role = propSchema["x-telo-topology-role"];
-            if (typeof role !== "string")
-                continue;
-            dispatchRole(s[propKey], role, propSchema.items, `${stepPath}.${propKey}`);
-        }
-    });
-}
-/**
- * Build a `steps` context schema from `x-telo-step-context` annotation.
- * Walks each step in the manifest array, resolves the invoked resource's output
- * contract, and builds `steps.<name>.result` context entries.
- *
- * Resolution is the shared {@link resolveContract} — the invoked resource
- * manifest's own declaration, then the kind's, resolved to the nearest
- * declaration along `extends`, then permissive. Sharing it with the kernel is
- * what stops `telo check` from typing `steps.X.result` against one contract
- * while dispatch validates against another.
- *
- * The kind layer is what makes `x-telo-stream` properties on definitions
- * actually govern step-result chain validation — without it, the validator falls
- * back to permissive and the stream-opacity rule never fires.
- *
- * Recursion into nested step arrays is annotation-driven via
- * `x-telo-topology-role`. The analyzer recognises three role values:
- *   - `branch`     — value is an array of steps (e.g. then / else / do / catch).
- *   - `branch-list`— value is an array of objects each carrying further roled
- *                    sub-properties (e.g. elseif: [{ if, then }]).
- *   - `case-map`   — value is an object whose values are step arrays (e.g. cases).
- * No specific Run.Sequence field name is hardcoded; any kind that uses
- * `x-telo-step-context` and tags its branch fields with these roles works.
- */
-function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases, scopes) {
-    const props = defSchema.properties;
-    if (!props)
-        return undefined;
-    const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
-    const readingModule = manifest.metadata?.module;
-    for (const [fieldName, fieldSchema] of Object.entries(props)) {
-        const stepCtx = fieldSchema["x-telo-step-context"];
-        if (!stepCtx)
-            continue;
-        const invokeField = stepCtx.invoke;
-        const outputTypeField = stepCtx.outputType;
-        // Optional: the field a step uses to produce a result without dispatching.
-        // Only a kind that declares one has pure steps at all.
-        const valueField = stepCtx.value;
-        if (!invokeField || !outputTypeField)
-            continue;
-        const steps = manifest[fieldName];
-        if (!Array.isArray(steps))
-            continue;
-        const stepItemSchema = resolveLocalRef(fieldSchema.items, defSchema);
-        // The instance's own input contract, for typing a pure step that just
-        // forwards one of its values.
-        const ownInputs = resolveTypeFieldToSchema(manifest.inputType, allManifests);
-        const stepProperties = {};
-        walkStepArray(steps, stepItemSchema, defSchema, fieldName, (s) => {
-            const name = s.name;
-            const invoke = s[invokeField];
-            // Only invoke steps register a `steps.<name>.result` entry — control-flow
-            // wrappers (try/if/while/switch/throw) don't produce a result and must
-            // not shadow real entries with a permissive `additionalProperties: true`,
-            // or unknown step references slip through chain validation.
-            if (typeof name !== "string")
-                return;
-            if (!invoke || typeof invoke !== "object") {
-                // A pure step dispatches nothing, so there is no contract to resolve.
-                // Where its expression is a plain chain into something already typed —
-                // an earlier step's result, or the kind's own inputs — that type carries
-                // through; anything else (arithmetic, a call, a comprehension) stays
-                // permissive rather than guessed. Same rule as a named binding's.
-                if (valueField && valueField in s) {
-                    const scopeRoot = {
-                        properties: {
-                            steps: { type: "object", properties: { ...stepProperties } },
-                            ...(ownInputs ? { inputs: ownInputs } : {}),
-                        },
-                    };
-                    const chained = schemaAtChain(bindingPathChain(s[valueField]), scopeRoot);
-                    stepProperties[name] = {
-                        type: "object",
-                        properties: { result: chained ?? PERMISSIVE_CONTRACT },
-                    };
-                }
-                return;
-            }
-            const invokedKind = invoke.kind;
-            const invokedName = invoke.name;
-            // A named `!ref` carries the target's own manifest (which may narrow the
-            // contract for this one instance); an inline `{ kind, ... }` step IS the
-            // manifest. Either way the kind layer resolves through `extends`.
-            const invokedManifest = invokedName
-                ? allManifests.find((m) => m.metadata?.name === invokedName && (!invokedKind || m.kind === invokedKind))
-                : invoke;
-            const invokedDef = invokedKind
-                ? contractScope.resolveIn(invokedKind, readingModule)
-                : undefined;
-            const outputSchema = resolveContract(outputTypeField, invokedManifest, invokedDef, contractScope)?.schema;
-            stepProperties[name] = {
-                type: "object",
-                properties: {
-                    result: outputSchema ?? PERMISSIVE_CONTRACT,
-                },
-            };
-        });
-        if (Object.keys(stepProperties).length > 0) {
-            return {
-                type: "object",
-                properties: stepProperties,
-            };
-        }
-    }
-    return undefined;
-}
 /** The built-in namespace: globally resolvable, crossing no import boundary. */
 const TELO_BUILTIN_MODULE = "Telo";
 /** One mapping from a ref-slot issue to a diagnostic — the shape is identical
@@ -488,7 +206,7 @@ const NO_ENTRY_POINT_CAPABILITIES = new Set([
     "Telo.Sink",
 ]);
 /**
- * Validate `x-telo-step-context` step `invoke` references (e.g. `Run.Sequence`
+ * Validate step `invoke` references (e.g. `Run.Sequence`
  * steps).
  *
  * The reference field map deliberately does NOT descend into step `invoke`
@@ -507,7 +225,7 @@ const NO_ENTRY_POINT_CAPABILITIES = new Set([
  *     contract has no entry point → `REFERENCE_KIND_MISMATCH` (runtime
  *     `ERR_RESOURCE_NOT_INVOKABLE`).
  *
- * Generic and topology-driven — it walks steps via the same `x-telo-step-context`
+ * Generic and topology-driven — it walks steps via the same step-slot
  * / `x-telo-topology-role` annotations `buildStepContextSchema` uses (through the
  * shared `walkStepArray`), so nested branches (then/else/do/catch/cases) are
  * covered and no `Run.Sequence` field name is hardcoded. The cross-module
@@ -626,8 +344,7 @@ function validateStepInvokeReferences(allManifests, defs, aliases) {
         const resource = { kind: m.kind, name: meta.name };
         const filePath = typeof meta.source === "string" ? meta.source : undefined;
         for (const [fieldName, fieldSchema] of Object.entries(defSchema.properties)) {
-            const stepCtx = fieldSchema["x-telo-step-context"];
-            const invokeField = stepCtx?.invoke;
+            const invokeField = readStepSlot(fieldSchema)?.invoke;
             if (!invokeField)
                 continue;
             const steps = m[fieldName];
@@ -676,84 +393,6 @@ function pathCrossesNestedResource(root, path) {
     }
     return false;
 }
-function collectErrorContextScopes(defSchema) {
-    const out = new Map();
-    if (!defSchema || typeof defSchema !== "object")
-        return out;
-    const seen = new Set();
-    const walk = (schema) => {
-        if (!schema || typeof schema !== "object" || seen.has(schema))
-            return;
-        seen.add(schema);
-        const props = schema.properties;
-        if (props) {
-            for (const [fieldName, fieldSchema] of Object.entries(props)) {
-                if (fieldSchema && typeof fieldSchema === "object") {
-                    const errCtx = fieldSchema["x-telo-error-context"];
-                    if (errCtx && typeof errCtx === "object" && !out.has(fieldName)) {
-                        out.set(fieldName, errCtx);
-                    }
-                }
-                walk(resolveLocalRef(fieldSchema, defSchema));
-            }
-        }
-        if (schema.items)
-            walk(resolveLocalRef(schema.items, defSchema));
-        for (const key of ["oneOf", "anyOf", "allOf"]) {
-            const arr = schema[key];
-            if (Array.isArray(arr))
-                for (const sub of arr)
-                    walk(resolveLocalRef(sub, defSchema));
-        }
-        if (schema.$defs && typeof schema.$defs === "object") {
-            for (const sub of Object.values(schema.$defs)) {
-                walk(sub);
-            }
-        }
-    };
-    walk(defSchema);
-    return out;
-}
-/**
- * Return the error-context schema for a CEL `path` when the path lies within
- * (any depth under) one of the error-bearing fields, else undefined. A path is
- * "within" field `f` when it contains a segment `f[<index>]`. When multiple
- * error-bearing fields match (e.g. a `finally` nested inside a `catch`), the
- * deepest — the one whose segment appears latest in the path — wins, so the
- * innermost branch's schema governs.
- */
-function errorContextForPath(path, scopes) {
-    let best;
-    for (const [fieldName, schema] of scopes) {
-        const escaped = fieldName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        for (const match of path.matchAll(new RegExp(`(^|\\.)${escaped}\\[\\d+\\]`, "g"))) {
-            if (best === undefined || match.index > best.index) {
-                best = { index: match.index, schema };
-            }
-        }
-    }
-    return best?.schema;
-}
-/** Add a kind's named bindings to a resolved context, when the context declares
- *  a bindings region. They go UNDER the context's own properties: a scope
- *  variable wins over a same-named binding at runtime, so static typing has to
- *  agree (the collision itself is `BINDING_NAME_RESERVED`). */
-function withBindingNames(contextSchema, resource) {
-    const field = contextSchema[BINDINGS_ANNOTATION];
-    if (typeof field !== "string")
-        return contextSchema;
-    const bindings = resource[field];
-    if (bindings === null || typeof bindings !== "object" || Array.isArray(bindings)) {
-        return contextSchema;
-    }
-    return {
-        ...contextSchema,
-        properties: {
-            ...bindingContextProperties(bindings, contextSchema),
-            ...(contextSchema.properties ?? {}),
-        },
-    };
-}
 /** Member-access chains in a CEL expression, or none when it doesn't parse.
  *  Best-effort: a syntax error is reported by the engine pass, not here. */
 function celAccessChains(env, expr) {
@@ -1032,13 +671,18 @@ export class StaticAnalyzer {
                     }
                     seen.add(alias);
                 }
-                if (alias && source) {
-                    const targetModule = resolvedModuleName ?? source.split("/").filter(Boolean).pop() ?? source;
+                // An import whose target identity was never established registers NO
+                // alias. The name is never guessed from the source string: a guess that
+                // is usually right is what turned "this import did not resolve" into an
+                // assertion that a published dependency was malformed, naming a module
+                // no registry could ever hold. With no alias, every use degrades to
+                // "cannot resolve alias '<X>'" — which points at the import the author
+                // has to fix, and which the loader has already reported on its own line.
+                if (alias && source && resolvedModuleName) {
+                    const targetModule = resolvedModuleName;
                     // Module identity is registered globally so x-telo-ref resolution sees
                     // transitively-imported modules regardless of which scope brought them in.
-                    if (resolvedModuleName) {
-                        defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
-                    }
+                    defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
                     // `metadata.reExportedKinds` (stamped by flattenForAnalyzer / the editor projection)
                     // maps an exported suffix to the true owning module's canonical kind for kinds this
                     // import transitively re-exports (`exports.kinds: [Alias.Kind]`).
@@ -1092,6 +736,55 @@ export class StaticAnalyzer {
         const refConstraintIssues = [];
         const refSlotIssues = [];
         const zoneSlotIssues = [];
+        // One place a rule report becomes a diagnostic. The pass decided WHAT and
+        // WHERE; this only carries it across to the diagnostic shape.
+        const SEVERITY = {
+            error: DiagnosticSeverity.Error,
+            warning: DiagnosticSeverity.Warning,
+            information: DiagnosticSeverity.Information,
+        };
+        const resourceRuleDiagnostic = (report) => ({
+            severity: SEVERITY[report.severity],
+            code: report.code,
+            source: SOURCE,
+            message: report.message,
+            data: {
+                resource: {
+                    kind: report.manifest.kind,
+                    name: report.manifest.metadata?.name,
+                },
+                filePath: report.manifest.metadata?.source,
+                path: report.path,
+                rule: report.rule,
+            },
+        });
+        const referrerRuleDiagnostic = (report) => ({
+            severity: SEVERITY[report.severity],
+            code: report.code,
+            source: SOURCE,
+            message: report.message,
+            data: {
+                resource: {
+                    kind: report.manifest.kind,
+                    name: report.manifest.metadata?.name,
+                },
+                filePath: report.manifest.metadata?.source,
+                path: report.path,
+                rule: report.rule,
+            },
+        });
+        const projectionIssues = [];
+        const resourceRuleIssues = [];
+        const referrerRuleIssues = [];
+        // A rule that never had anything to iterate is never proven — the second way
+        // coverage varies invisibly, beside the dynamic-leaf skip. Tracked across the
+        // whole run and reported once, since "empty on every resource" is not a fact
+        // any single resource can establish.
+        const ruleExercise = new Map();
+        // Same for a referrer rule, where "never exercised" means nothing the
+        // `referrer:` filter matches ever referenced a resource of the kind — which
+        // is exactly what a typo in that filter looks like from the outside.
+        const referrerRuleExercise = new Map();
         // `x-telo-type` is checked on EVERY manifest, not only on definition docs: a
         // schema fragment is written wherever a kind declares a schema-valued field,
         // so an inline `inputType:` on an ordinary resource carries one just as a
@@ -1124,6 +817,28 @@ export class StaticAnalyzer {
                 refConstraintIssues.push(...issues);
                 refSlotIssues.push(...validateRefSlotDeclarations(m));
                 zoneSlotIssues.push(...validateZoneSlotDeclarations(m));
+                projectionIssues.push(...validateSchemaProjection(m));
+                // Checked against the MERGED schema, so an `in:` pointer naming an
+                // inherited field resolves — which is what lets a rule shared by every
+                // backend be declared once on the abstract they extend.
+                resourceRuleIssues.push(...validateResourceRuleDeclarations(m, effectiveAuthorSchema(m, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k))));
+                referrerRuleIssues.push(...validateReferrerRuleDeclarations(m));
+                for (const rule of readReferrerRules(m.schema)) {
+                    referrerRuleExercise.set(`${m.metadata?.module}.${m.metadata?.name}#${rule.code}`, {
+                        manifest: m,
+                        rule,
+                        exercised: false,
+                        seen: false,
+                    });
+                }
+                for (const rule of readResourceRules(m.schema)) {
+                    ruleExercise.set(`${m.metadata?.module}.${m.metadata?.name}#${rule.code}`, {
+                        manifest: m,
+                        rule,
+                        exercised: false,
+                        seen: false,
+                    });
+                }
             }
             const resolvedCapability = def.capability
                 ? (scopeResolver.resolveKind(def.capability) ?? def.capability)
@@ -1177,6 +892,24 @@ export class StaticAnalyzer {
                 };
                 const filePath = issue.manifest.metadata?.source;
                 const data = { resource, filePath, path: issue.path };
+                if (issue.annotation === "referrer") {
+                    // Mirrors ZONE_PROVIDER_UNRESOLVED: a filter naming no kind matches no
+                    // referrer, so the rule would pass on every manifest while checking
+                    // nothing — reported at the kind that wrote it, since the consumer
+                    // cannot see that the check is inert.
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "REFERRER_RULE_INVALID",
+                        source: SOURCE,
+                        message: `x-telo-referrer-rules 'referrer: ${issue.ref}' at '${issue.path}' names no kind. ` +
+                            `The prefix must be an import alias declared in this file's 'imports:' map, ` +
+                            `'Self' for a kind in this library, or 'Telo' for a built-in. A filter that ` +
+                            `matches nothing leaves the rule inert. Known aliases: ` +
+                            `${issue.knownAliases?.join(", ") || "(none)"}.`,
+                        data,
+                    });
+                    continue;
+                }
                 if (issue.annotation === "zone") {
                     // Mirrors X_TELO_REF_UNRESOLVED: an unresolvable provider kind would
                     // leave the requirement silently unenforced — no provider ever
@@ -1262,6 +995,57 @@ export class StaticAnalyzer {
             // OPPOSITE directions — a dropped requirement is silently unenforced, a
             // dropped provision invents failures — so neither can be left to
             // leniency.
+            // A projection nothing can read does not fail — it stops typing the
+            // consumers counting on it, which puts a misspelled field back where the
+            // projection exists to catch it earlier.
+            for (const issue of resourceRuleIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                    },
+                });
+            }
+            for (const issue of referrerRuleIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                    },
+                });
+            }
+            for (const issue of projectionIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                    },
+                });
+            }
             for (const issue of zoneSlotIssues) {
                 diagnostics.push({
                     severity: DiagnosticSeverity.Error,
@@ -1296,6 +1080,57 @@ export class StaticAnalyzer {
             aliases,
             aliasesByModule,
         }));
+        /**
+         * Whether a referrer of `kind` satisfies a referrer rule's `referrer:`
+         * filter, which is canonical by the time it gets here (`resolveSchemaRefKinds`
+         * rewrote it in the DECLARING module's scope). The referring manifest's own
+         * `kind:` is not — it is whatever alias its author imported the kind under —
+         * so it is resolved the same way every other kind comparison in this pass
+         * resolves one. Liskov-substitutable, matching `checkKind`: a child of the
+         * named kind is one.
+         */
+        const kindMatches = (filter, kind) => {
+            const resolved = aliases.resolveKind(kind) ?? kind;
+            if (resolved === filter)
+                return true;
+            return defs
+                .getByExtends(filter)
+                .some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved);
+        };
+        /**
+         * The resources that reach `manifest`, with the slot each one reaches it
+         * through. A step's edge is attributed to the resource whose body declares
+         * it: a step is not a manifest, and the requirement is about the resource
+         * that has to declare something.
+         *
+         * Deduplication is the evaluation's, not this function's — a referrer
+         * reaching one resource through two slots is two sites, and which one anchors
+         * the diagnostic is a reporting decision.
+         */
+        const referrersOf = (manifest, graph) => {
+            const name = manifest.metadata?.name;
+            if (!name)
+                return [];
+            const node = graph.resource(manifest.kind, name) ?? graph.resourceByName(name);
+            if (!node)
+                return [];
+            const out = [];
+            for (const edge of graph.edgesTo(node.id)) {
+                const from = graph.nodes.get(edge.from);
+                if (!from)
+                    continue;
+                const owner = from.type === "step" ? graph.nodes.get(from.owner) : from;
+                if (!owner || owner.type !== "resource")
+                    continue;
+                out.push({
+                    manifest: owner.manifest,
+                    kind: owner.kind,
+                    name: owner.name,
+                    path: edge.path,
+                });
+            }
+            return out;
+        };
         // A `use` case map's selector written in CEL is a hard diagnostic — a call
         // graph known only at runtime is not statically analyzable, and no fallback
         // is conservative for every consumer. Scoped to the entry's own modules:
@@ -1323,6 +1158,29 @@ export class StaticAnalyzer {
                 moduleDocuments: options?.moduleDocuments,
                 cache: zoneExportCache,
             }));
+            // Durable regions — the SAME graph again, walked DOWNWARD this time.
+            // Every rule here keys off a zone attribute rather than off any kind, so
+            // a backend that ships its own workflow kind is covered without the
+            // analyzer knowing it exists: going native costs a module, not a change
+            // here.
+            const resolveRegionDef = (kind, module) => {
+                const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+                const canonical = scope.resolveKind(kind);
+                return defs.resolve(kind) ?? (canonical ? defs.resolve(canonical) : undefined);
+            };
+            diagnostics.push(...validateDurableRegions({
+                graph: getCallGraph(),
+                resolveDef: resolveRegionDef,
+                reportModules: rootModules,
+            }), 
+            // The same walk once more, over EVERY attribute rather than the two
+            // durability names — a region must not contain a resource that declares
+            // it cannot honour what the region promises.
+            ...validateZoneViolations({
+                graph: getCallGraph(),
+                resolveDef: resolveRegionDef,
+                reportModules: rootModules,
+            }));
         }
         // Phase 2.6: register each named `Telo.Type` resource's schema under its
         // canonical module-scoped id (`telo://<module>/<name>`), validate
@@ -1537,9 +1395,20 @@ export class StaticAnalyzer {
         // fit the slot at all", the schema answers "do their type arguments agree",
         // which cel-js cannot express because it types by constructor identity.
         const celSourceSchemaByPath = new Map();
-        // Context-free typed environments, one per manifest. Reused across every
-        // expression in it — see the build site for why a matched context opts out.
-        const typedEnvByManifest = new Map();
+        // What every CEL expression in this set is typed against. The rule lives in
+        // `cel-scope.ts` so the IDE asks the same question the pass does — a
+        // completion list is a claim that the name it offers will pass this check,
+        // and two implementations of it could not be held in agreement.
+        const celScope = new CelScopeResolver({
+            celEnv: this.celEnv,
+            defs,
+            aliases,
+            scopes: { aliasesByModule, rootModules },
+            allManifests,
+            kernelGlobals,
+            moduleManifest,
+            observedStateContext,
+        });
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
             const filePath = m.metadata?.source;
@@ -1672,6 +1541,56 @@ export class StaticAnalyzer {
                     });
                 }
             }
+            // Resource rules — relationships between this resource's own fields that
+            // JSON Schema cannot state, declared by the kind as CEL over `self` and
+            // `this`. Read off the AUTHOR-FACING schema, so an `extends` child without
+            // `base:` inherits its parent's rules and one that declares its own
+            // replaces them, exactly as the rest of the config contract merges.
+            // The finding→diagnostic mapping lives with the finding vocabulary in
+            // `validate-resource-rules.ts`, the shape every neighbouring pass uses:
+            // issues out, one emit here.
+            const ruleDeclarer = definition.metadata?.module;
+            for (const report of reportResourceRules(m, definition, evaluateResourceRules(m, authorSchema), !ruleDeclarer || rootModules.has(ruleDeclarer))) {
+                diagnostics.push(resourceRuleDiagnostic(report));
+            }
+            for (const rule of readResourceRules(authorSchema)) {
+                const key = `${definition.metadata?.module}.${definition.metadata?.name}#${rule.code}`;
+                const tracked = ruleExercise.get(key);
+                if (!tracked)
+                    continue;
+                tracked.seen = true;
+                if (ruleExercised(m, rule))
+                    tracked.exercised = true;
+            }
+            // Referrer rules — what must be true of whoever REFERENCES this resource,
+            // declared by the kind that has the requirement rather than by the kind
+            // that must satisfy it. The subject is chosen by the EDGE, so no kind
+            // literal appears on the referring side, where the spelling would be the
+            // consumer's import alias rather than anything the rule's author controls.
+            // A consumer of the shared call graph, never a second traversal.
+            const referrerRules = readReferrerRules(authorSchema);
+            if (referrerRules.length > 0) {
+                const referrers = referrersOf(m, getCallGraph());
+                for (const report of reportReferrerRules(m, definition, evaluateReferrerRules(m, authorSchema, referrers, kindMatches), !ruleDeclarer || rootModules.has(ruleDeclarer))) {
+                    // A VIOLATION is the referrer's data, so it is reported only when that
+                    // manifest is the entry's own — the same direction a resource-rule
+                    // violation takes, one hop further out.
+                    const owner = report.manifest.metadata?.module;
+                    if (report.code === "REFERRER_RULE_VIOLATED" && owner && !rootModules.has(owner)) {
+                        continue;
+                    }
+                    diagnostics.push(referrerRuleDiagnostic(report));
+                }
+                for (const rule of referrerRules) {
+                    const key = `${definition.metadata?.module}.${definition.metadata?.name}#${rule.code}`;
+                    const tracked = referrerRuleExercise.get(key);
+                    if (!tracked)
+                        continue;
+                    tracked.seen = true;
+                    if (referrerRuleExercised(rule, referrers, kindMatches))
+                        tracked.exercised = true;
+                }
+            }
             // Validate inline resources nested inside this resource's body (e.g. a
             // Run.Sequence step's `invoke: { kind, ...config }`). These sit at
             // x-telo-ref slots reached only through local `$ref`s, which the
@@ -1700,6 +1619,23 @@ export class StaticAnalyzer {
             }
             // (Invocation context compatibility check is handled via x-telo-context in the CEL pass below)
         }
+        // A rule whose collection was empty on every resource of its kind is a rule
+        // nothing proved. `check()` types `self` only shallowly (cel-js takes a flat
+        // field map, so `columns` is `map`), which means a typo below the first level
+        // survives declaration validation and is caught only by evaluation — so a
+        // rule that never evaluated has been verified by nothing at all. Reported
+        // only when the kind HAS resources here: a kind nobody instantiated in this
+        // workspace says nothing about the rule.
+        for (const tracked of ruleExercise.values()) {
+            if (!tracked.seen || tracked.exercised)
+                continue;
+            diagnostics.push(resourceRuleDiagnostic(reportUnexercisedRule(tracked.manifest, tracked.rule)));
+        }
+        for (const tracked of referrerRuleExercise.values()) {
+            if (!tracked.seen || tracked.exercised)
+                continue;
+            diagnostics.push(referrerRuleDiagnostic(reportUnexercisedReferrerRule(tracked.manifest, tracked.rule)));
+        }
         // Template-body structural validations: check that template entry-points produce
         // values matching the contract of their dispatch target and (for `provide:`)
         // the abstract this definition `extends`. CEL fields inside the templated
@@ -1768,6 +1704,42 @@ export class StaticAnalyzer {
                 }
             }
         }
+        // A consumer's slot typed from a referenced declaration
+        // (`x-telo-schema-projection-from`) fails in the direction that is hardest
+        // to notice: the contract silently reopens, so a misspelled field passes
+        // `telo check` exactly as it did before the projection existed. That is the
+        // failure the projection exists to move earlier, so it is reported here
+        // rather than left to degrade. Entry-module-scoped, like
+        // `X_TELO_REF_UNRESOLVED` — a published dependency's slot is not the
+        // consumer's to fix.
+        for (const m of allManifests) {
+            const md = m;
+            if (typeof md.kind !== "string" || md.kind.startsWith("Telo."))
+                continue;
+            const ownModule = md.metadata?.module;
+            if (ownModule && !rootModules.has(ownModule))
+                continue;
+            const definition = contractScope.resolveIn(md.kind, ownModule);
+            if (!definition)
+                continue;
+            const failures = [];
+            for (const direction of ["inputType", "outputType"]) {
+                resolveContract(direction, md, definition, contractScope, failures);
+            }
+            for (const failure of failures) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "SCHEMA_PROJECTION_FROM_UNRESOLVED",
+                    source: SOURCE,
+                    message: `${md.kind}: ${describeProjectionFailure(failure)}`,
+                    data: {
+                        resource: { kind: md.kind, name: md.metadata?.name },
+                        filePath: md.metadata?.source,
+                        path: failure.pointer.replace(/^\//, ""),
+                    },
+                });
+            }
+        }
         // Validate CEL syntax and context variable access in all manifests. The
         // walker discovers every compiled CEL node by scanning the value tree and
         // hands back the `x-telo-context` schema matched at the enclosing path; the
@@ -1776,10 +1748,10 @@ export class StaticAnalyzer {
         // state (definitions, aliases, the typed CEL env).
         // Per-resource state computed at enter and read by that resource's CEL
         // sites. The manifest / resource / filePath come straight off each CelSite's
-        // `source` (no need to capture them); only the derived step / invocation
-        // context — which require analyzer state to build — are stashed here.
+        // `source` (no need to capture them); the derived step / invocation / error
+        // context is the scope resolver's, read back from it where a CHECK needs the
+        // same schema an expression is typed against.
         let celStepContextSchema;
-        let celInvocationContext;
         let celErrorScopes = new Map();
         // Region coverage for the "CEL in a non-eval field" check: the union of
         // `x-telo-eval` paths (own + capability) and `x-telo-context` /
@@ -1797,14 +1769,24 @@ export class StaticAnalyzer {
         visitManifest(allManifests, defs, {
             onResourceEnter: (e) => {
                 const m = e.source;
-                celInvocationContext = m.metadata?.xTeloInvocationContext;
-                celStepContextSchema = e.definition?.schema
-                    ? buildStepContextSchema(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules })
-                    : undefined;
+                celScope.enterResource(m, e.definition);
+                // Read back rather than recomputed: the step-inputs check has to see
+                // the same `steps` schema this resource's expressions are typed
+                // against, and a second computation is how the two come to disagree.
+                celStepContextSchema = celScope.stepContextSchema;
+                celErrorScopes = celScope.errorContextScopes;
                 if (e.definition?.schema) {
                     const stepName = m.metadata?.name;
                     const stepFile = m.metadata?.source;
-                    for (const issue of collectStepInputIssues(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules }, celStepContextSchema)) {
+                    // Both drivers of the SAME check: a step's `inputs:` found through
+                    // the step grammar, and a reference slot's found through the
+                    // `x-telo-ref` `inputs:` pointer. A call site the editor can
+                    // complete is a call site `telo check` validates.
+                    const inputIssues = [
+                        ...collectRefInputIssues(m, defs.expandedFieldMapForResource(m, aliases, aliasesByModule), allManifests, defs, aliases, { aliasesByModule, rootModules }),
+                        ...collectStepInputIssues(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules }, celStepContextSchema),
+                    ];
+                    for (const issue of inputIssues) {
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
                             code: issue.code ?? "CONTRACT_INPUTS_MISMATCH",
@@ -1822,7 +1804,6 @@ export class StaticAnalyzer {
                         });
                     }
                 }
-                celErrorScopes = collectErrorContextScopes(e.definition?.schema);
                 celBindingSites = findBindingSites(e.definition?.schema);
                 if (celBindingSites) {
                     const declared = m[celBindingSites.field];
@@ -1946,7 +1927,7 @@ export class StaticAnalyzer {
                 // (resource-wide invocation context) carry CEL the kernel evaluates.
                 if (celRuleApplies &&
                     engineName === "cel" &&
-                    celInvocationContext === undefined &&
+                    celScope.invocationContextSchema === undefined &&
                     !evalPathsCover(celEvalPaths, path) &&
                     !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
                     !pathCrossesNestedResource(m, path)) {
@@ -1993,55 +1974,6 @@ export class StaticAnalyzer {
                         }
                     }
                 }
-                let matchedContext = e.contextSchema ?? celInvocationContext;
-                if (celStepContextSchema) {
-                    const base = matchedContext ?? { type: "object", properties: {}, additionalProperties: true };
-                    matchedContext = {
-                        ...base,
-                        properties: {
-                            ...(base.properties ?? {}),
-                            steps: celStepContextSchema,
-                        },
-                    };
-                }
-                // `error` is only in scope inside an error-bearing branch (e.g. a
-                // `catch:` / `finally:`), so it's merged per-path, not resource-wide.
-                const errorSchema = celErrorScopes.size > 0 ? errorContextForPath(path, celErrorScopes) : undefined;
-                if (errorSchema) {
-                    const base = matchedContext ?? { type: "object", properties: {}, additionalProperties: true };
-                    matchedContext = {
-                        ...base,
-                        properties: {
-                            ...(base.properties ?? {}),
-                            error: errorSchema,
-                        },
-                    };
-                }
-                let effectiveContext = null;
-                if (matchedContext) {
-                    const manifestItem = matchedScope
-                        ? getManifestItem(path, matchedScope, m)
-                        : m;
-                    const rootForResolver = manifestRootForResolver(m, defs, aliases, allManifests, { aliasesByModule, rootModules });
-                    const resolvedContext = resolveContextAnnotations(matchedContext, manifestItem, {
-                        manifestRoot: rootForResolver,
-                        defs,
-                        aliases,
-                        allManifests: allManifests,
-                    });
-                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), 
-                    // Typed in the module that DECLARED this resource — for a manifest
-                    // forwarded from an imported library, that is its `moduleGlobals`
-                    // stamp, not the consuming application's block.
-                    kernelGlobals.forResource(m));
-                }
-                else if (observedStateContext) {
-                    // No `x-telo-context` matched, so nothing was chain-validated here
-                    // before. Validate the observed-state segment alone rather than
-                    // merging the kernel globals, whose closed `variables` / `ports`
-                    // nodes would newly reject reads that pass today.
-                    effectiveContext = observedStateContext;
-                }
                 const engine = defaultRegistry().get(engineName);
                 if (!engine) {
                     // No registered engine owns this tag — the expression would go
@@ -2056,27 +1988,15 @@ export class StaticAnalyzer {
                     return;
                 }
                 // The engine type-checks, so it gets the environment typed for THIS
-                // path — not the bare base one. A `Telo.Import`'s variables/secrets
-                // are a config-only contract evaluated in the IMPORTING module's
-                // scope, so they type from the owning module doc and drop
-                // `resources`/`env`, making a reference to either an error.
-                //
-                // Cached per manifest when no `x-telo-context` applied, which is most
-                // expressions: the environment then depends only on the manifest, so
-                // rebuilding it per expression is pure waste — a clone plus a
-                // re-registration of every variable, on every keystroke in the IDE.
-                // A matched context makes the environment path-specific (its schema is
-                // resolved against the enclosing array item), so those still build
-                // fresh rather than risk one item's types leaking into another's.
-                const cached = effectiveContext === null ? typedEnvByManifest.get(m) : undefined;
-                const typedEnv = cached ??
-                    (m.kind === "Telo.Import"
-                        ? buildImportInputCelEnvironment(this.celEnv, allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
-                            mm.metadata?.name ===
-                                m.metadata?.module))
-                        : buildTypedCelEnvironment(this.celEnv, m, effectiveContext ?? undefined, moduleManifest));
-                if (effectiveContext === null && !cached)
-                    typedEnvByManifest.set(m, typedEnv);
+                // path — not the bare base one. Both halves come from the one scope
+                // rule, which is what makes the IDE's answer and this check the same
+                // answer rather than two that agree today.
+                const { env: typedEnv, contextSchema: effectiveContext } = celScope.scopeFor({
+                    source: m,
+                    path,
+                    contextSchema: e.contextSchema,
+                    matchedScope,
+                });
                 const result = engine.analyze(expr, { celEnv: typedEnv, contextSchema: effectiveContext });
                 if (result.type !== undefined) {
                     let byPath = celTypeByPath.get(m);