bitboss-ui 3.0.0-beta.65 → 3.0.0-beta.67

package/scripts/lib/quiet-gate.mjs

@@ -0,0 +1,385 @@
+/**
+ * The quiet gate (owner 2026-10-29): browser runs start on a machine quiet
+ * enough to trust their timings. beta.66's release run went red only because
+ * six tabs ran browser suites at once (1-minute load 30–60 on 8 cores, Firefox
+ * delaying animation frames by 1–8.5 s, pt-matrix cases timing out); the same
+ * files were green 564/564 at load ~20.
+ *
+ * Two parts, both here so every runner shares one rule:
+ *
+ * LOAD GUARD (`waitForLowLoad`). Before a browser run, wait until the 1-minute
+ * load is at most LOAD_FACTOR × cores. A first reading already under the line
+ * starts at once; once over, the load must stay under for SETTLE_MS. Polls,
+ * never blocks forever: after LOAD_MAX_WAIT_MS it runs anyway and says so
+ * loudly (the caller also puts it in its results).
+ *
+ * QUIET WINDOW (`claimQuiet` / `waitForQuietWindow`). A heavy run (release:local,
+ * test:engines, a full test:ci:browser) claims `<git-common-dir>/bb-quiet/claim`
+ * (pid, lane, start, token; O_EXCL, dead holders reaped), machine-wide for every
+ * worktree of the repo. Any other browser run waits while a live claim that is
+ * not its own exists, printing who holds it. The holder exports its token in
+ * BB_QUIET_TOKEN, so its own children (release:check's chunked browser run,
+ * test:fixtures, the vitest processes) see the claim as theirs and never wait
+ * on it; they skip the load guard too, which the holder already passed.
+ *
+ * Off switch: BB_QUIET_GATE=off (a deliberate run) skips every wait; a heavy
+ * run still claims a FREE window, so the other tabs keep out of its way. CI
+ * (one job per machine) skips the whole gate. Node-only suites are never
+ * guarded. `node scripts/quiet-gate.mjs` is the shell side (status, wait,
+ * claim around any command).
+ *
+ * The claim is advisory, like `.git/night-wall.lock`: reaping a dead holder
+ * deletes the file only if it is byte-for-byte the dead claim (random token),
+ * without gate.mjs's takeover mutex. The worst a race there can do is let two
+ * heavy runs overlap once; it can never block a run (every wait has a max).
+ *
+ * Everything external (load, cores, clock, sleep, pids, log) is injectable, so
+ * the node tests drive it with fakes and never really wait.
+ */
+import { randomBytes } from 'node:crypto';
+import {
+	mkdirSync,
+	readFileSync,
+	rmSync,
+	statSync,
+	writeFileSync,
+} from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+/**
+ * Load per core above which a browser run waits. Measured 2026-10-29 on the
+ * 8-core dev machine: green 564/564 at a 1-minute load ~20 (2.5×), 13 timeouts
+ * at ~35 (4.4×), the release run red around 60 (7.5×). 3× keeps the green
+ * reading in and both red ones out.
+ */
+export const LOAD_FACTOR = 3;
+/** Once over the line, how long the load must stay under before a run starts. */
+export const SETTLE_MS = 30_000;
+export const LOAD_POLL_MS = 5_000;
+/** The load guard runs anyway after this, loudly. */
+export const LOAD_MAX_WAIT_MS = 20 * 60_000;
+export const CLAIM_POLL_MS = 15_000;
+/** A run waits this long for someone else's quiet window, then runs, loudly. */
+export const QUIET_MAX_WAIT_MS = 90 * 60_000;
+/** A claim file with no readable pid is "being written" this long. */
+const CLAIM_BIRTH_MS = 10_000;
+/** How often a waiting run repeats its status line. */
+const REPORT_EVERY_MS = 60_000;
+
+export const TOKEN_ENV = 'BB_QUIET_TOKEN';
+const TAG = '[quiet-gate]';
+
+const realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export function pidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (e) {
+		return e.code === 'EPERM';
+	}
+}
+
+/** "40 s", "3 min", "3 min 20 s": a wait under a minute is not "0 min". */
+const minutes = (ms) => {
+	const s = Math.round(ms / 1000);
+	if (s < 60) return `${s} s`;
+	return s % 60 ? `${Math.floor(s / 60)} min ${s % 60} s` : `${s / 60} min`;
+};
+
+/** Why the waiting is off, or null. */
+export function gateDisabled(env = process.env) {
+	if (env.BB_QUIET_GATE === 'off') return 'BB_QUIET_GATE=off';
+	if (env.CI) return 'CI';
+	return null;
+}
+
+export const loadThreshold = (cores) => Math.max(1, cores * LOAD_FACTOR);
+
+/**
+ * Wait until the 1-minute load is low enough for a browser run.
+ * @returns {Promise<{ waitedMs: number, gaveUp: boolean, load: number, threshold: number }>}
+ */
+export async function waitForLowLoad({
+	label = 'browser run',
+	loadavg = () => os.loadavg()[0],
+	cores = os.cpus().length,
+	now = Date.now,
+	sleep = realSleep,
+	log = console.log,
+	settleMs = SETTLE_MS,
+	pollMs = LOAD_POLL_MS,
+	maxWaitMs = LOAD_MAX_WAIT_MS,
+} = {}) {
+	const threshold = loadThreshold(cores);
+	const start = now();
+	let calmSince = null;
+	let reported = -Infinity;
+	let wasOver = false;
+	for (;;) {
+		const load = loadavg();
+		const waitedMs = now() - start;
+		if (load <= threshold) {
+			if (!wasOver) return { waitedMs, gaveUp: false, load, threshold };
+			calmSince ??= now();
+			if (now() - calmSince >= settleMs) {
+				log(
+					`${TAG} ${label}: load ${load.toFixed(1)} ≤ ${threshold} for ${Math.round(settleMs / 1000)}s, starting after ${minutes(waitedMs)}`
+				);
+				return { waitedMs, gaveUp: false, load, threshold };
+			}
+		} else {
+			wasOver = true;
+			calmSince = null;
+		}
+		if (waitedMs >= maxWaitMs) {
+			log(
+				`${TAG} GAVE UP: ${label} starts on a LOADED machine (1-min load ${load.toFixed(1)} > ${threshold} = ${LOAD_FACTOR} × ${cores} cores after ${minutes(waitedMs)}). Expect timing failures; rerun when it is quiet.`
+			);
+			return { waitedMs, gaveUp: true, load, threshold };
+		}
+		if (load > threshold && now() - reported >= REPORT_EVERY_MS) {
+			reported = now();
+			log(
+				`${TAG} ${label}: 1-min load ${load.toFixed(1)} > ${threshold} (${LOAD_FACTOR} × ${cores} cores), waiting (${minutes(waitedMs)} so far, runs anyway at ${minutes(maxWaitMs)}; BB_QUIET_GATE=off skips)`
+			);
+		}
+		await sleep(pollMs);
+	}
+}
+
+const readText = (file) => {
+	try {
+		return readFileSync(file, 'utf8');
+	} catch {
+		return null;
+	}
+};
+
+export const claimFile = (dir) => path.join(dir, 'claim');
+
+/**
+ * The current claim: its fields, `text` (to clear it only if unchanged) and
+ * `alive`; null when there is none.
+ */
+export function readClaim(dir, { isAlive = pidAlive, now = Date.now } = {}) {
+	const file = claimFile(dir);
+	let stat;
+	try {
+		stat = statSync(file);
+	} catch {
+		return null;
+	}
+	const text = readText(file);
+	if (text === null) return null;
+	let claim = null;
+	try {
+		claim = JSON.parse(text);
+	} catch {
+		claim = null;
+	}
+	if (!claim || !Number.isInteger(claim.pid))
+		return { text, alive: now() - stat.mtimeMs < CLAIM_BIRTH_MS };
+	return { ...claim, text, alive: isAlive(claim.pid) };
+}
+
+/** Delete the claim only if it still holds exactly `text` (a dead holder's). */
+function clearIfUnchanged(dir, text) {
+	if (readText(claimFile(dir)) === text)
+		rmSync(claimFile(dir), { force: true });
+}
+
+/** "release:local (pid 123, /repo, for 4 min)" */
+export const holderText = (claim, now = Date.now()) =>
+	claim.pid === undefined
+		? 'a heavy run that is starting'
+		: `${claim.lane ?? 'a heavy run'} (pid ${claim.pid}${claim.cwd ? `, ${claim.cwd}` : ''}, for ${minutes(now - (claim.started ?? now))})`;
+
+/**
+ * Wait while a live claim that is not ours exists.
+ * @returns {Promise<{ waitedMs: number, gaveUp: boolean, holder: object | null }>}
+ */
+export async function waitForQuietWindow({
+	label = 'browser run',
+	dir,
+	env = process.env,
+	isAlive = pidAlive,
+	now = Date.now,
+	sleep = realSleep,
+	log = console.log,
+	pollMs = CLAIM_POLL_MS,
+	maxWaitMs = QUIET_MAX_WAIT_MS,
+} = {}) {
+	const start = now();
+	let reported = -Infinity;
+	let holder = null;
+	for (;;) {
+		const claim = readClaim(dir, { isAlive, now });
+		const waitedMs = now() - start;
+		if (claim && !claim.alive) {
+			clearIfUnchanged(dir, claim.text);
+			continue;
+		}
+		if (!claim || (claim.token && claim.token === env[TOKEN_ENV])) {
+			if (holder)
+				log(
+					`${TAG} ${label}: the quiet window is free, starting after ${minutes(waitedMs)}`
+				);
+			return { waitedMs, gaveUp: false, holder };
+		}
+		holder = claim;
+		if (waitedMs >= maxWaitMs) {
+			log(
+				`${TAG} GAVE UP: ${label} starts INSIDE ${holderText(claim, now())}'s quiet window after ${minutes(waitedMs)}. Both runs may go red on timings.`
+			);
+			return { waitedMs, gaveUp: true, holder };
+		}
+		if (now() - reported >= REPORT_EVERY_MS) {
+			reported = now();
+			log(
+				`${TAG} ${label}: waiting, ${holderText(claim, now())} holds the quiet window (${minutes(waitedMs)} so far, runs anyway at ${minutes(maxWaitMs)})`
+			);
+		}
+		await sleep(pollMs);
+	}
+}
+
+/**
+ * Take the quiet window for a heavy run, waiting for another holder first.
+ * Inside a run that already holds it (our token), a no-op handle. Sets
+ * BB_QUIET_TOKEN in `env` so child processes inherit it; release() (also on
+ * exit) deletes the claim only while it is still ours.
+ * @returns {Promise<{ token: string | null, nested: boolean, gaveUp: boolean, release: () => void }>}
+ */
+export async function claimQuiet({
+	lane,
+	dir,
+	env = process.env,
+	pid = process.pid,
+	cwd = process.cwd(),
+	isAlive = pidAlive,
+	now = Date.now,
+	sleep = realSleep,
+	log = console.log,
+	wait = !gateDisabled(env),
+	pollMs = CLAIM_POLL_MS,
+	maxWaitMs = QUIET_MAX_WAIT_MS,
+	onExit = (release) => process.on('exit', release),
+} = {}) {
+	const mine = env[TOKEN_ENV];
+	const current = readClaim(dir, { isAlive, now });
+	if (mine && current?.alive && current.token === mine)
+		return { token: mine, nested: true, gaveUp: false, release: () => {} };
+	mkdirSync(dir, { recursive: true });
+	const token = randomBytes(8).toString('hex');
+	const text = `${JSON.stringify({ pid, lane, started: now(), cwd, token })}\n`;
+	const start = now();
+	let reported = -Infinity;
+	for (;;) {
+		try {
+			writeFileSync(claimFile(dir), text, { flag: 'wx' });
+			env[TOKEN_ENV] = token;
+			const release = () => {
+				if (readText(claimFile(dir)) === text)
+					rmSync(claimFile(dir), { force: true });
+			};
+			onExit(release);
+			log(`${TAG} ${lane} holds the quiet window: other browser runs wait`);
+			return { token, nested: false, gaveUp: false, release };
+		} catch (e) {
+			if (e.code !== 'EEXIST') throw e;
+		}
+		const holder = readClaim(dir, { isAlive, now });
+		if (holder && !holder.alive) {
+			clearIfUnchanged(dir, holder.text);
+			continue;
+		}
+		if (!holder) continue;
+		const waitedMs = now() - start;
+		if (!wait || waitedMs >= maxWaitMs) {
+			log(
+				`${TAG} ${wait ? 'GAVE UP: ' : ''}${lane} runs WITHOUT the quiet window: ${holderText(holder, now())} holds it${wait ? ` after ${minutes(waitedMs)}` : ` (${gateDisabled(env)})`}.`
+			);
+			return { token: null, nested: false, gaveUp: wait, release: () => {} };
+		}
+		if (now() - reported >= REPORT_EVERY_MS) {
+			reported = now();
+			log(
+				`${TAG} ${lane}: waiting for the quiet window, ${holderText(holder, now())} holds it`
+			);
+		}
+		await sleep(pollMs);
+	}
+}
+
+/**
+ * Where the claim lives: the repo's common git dir, shared by every worktree
+ * (the gate worktrees under ~/.bb-gate too). Null outside a git checkout.
+ */
+export async function quietDir(env = process.env) {
+	// Tests point it elsewhere.
+	if (env.BB_QUIET_DIR) return env.BB_QUIET_DIR;
+	const { commonDir } = await import('./gate.mjs');
+	try {
+		return path.join(commonDir(), 'bb-quiet');
+	} catch {
+		return null;
+	}
+}
+
+/** Which lane a run belongs to, for the "who holds it" line. */
+export const laneName = (env = process.env, cwd = process.cwd()) =>
+	env.BB_LANE || path.basename(cwd);
+
+/**
+ * Before an ordinary browser run (a lane's vitest browser project, the
+ * fixtures runner): wait for someone else's quiet window, then for low load.
+ * Inside a heavy run's tree (BB_QUIET_TOKEN set and live): nothing to do.
+ */
+export async function browserGate({ label, env = process.env, ...deps } = {}) {
+	const off = gateDisabled(env);
+	if (off) return { skipped: off };
+	const dir = deps.dir ?? (await quietDir(env));
+	if (!dir) return { skipped: 'not in a git checkout' };
+	const claim = readClaim(dir, deps);
+	if (env[TOKEN_ENV] && claim?.alive && claim.token === env[TOKEN_ENV])
+		return { inside: true };
+	const quiet = await waitForQuietWindow({ label, dir, env, ...deps });
+	const load = await waitForLowLoad({ label, ...deps });
+	return { quiet, load };
+}
+
+/**
+ * Before a heavy run: take the quiet window, then wait for low load (which
+ * the other tabs' runs, now waiting, let drop). Nested inside a run that
+ * holds it: nothing to do.
+ */
+export async function heavyGate({
+	lane,
+	label = lane,
+	env = process.env,
+	...deps
+} = {}) {
+	// CI runs one job per machine: nothing to coordinate, nothing to claim.
+	if (env.CI) return { skipped: 'CI' };
+	const dir = deps.dir ?? (await quietDir(env));
+	if (!dir) return { skipped: 'not in a git checkout' };
+	const claim = await claimQuiet({ lane, dir, env, ...deps });
+	if (claim.nested) return { claim, nested: true };
+	const off = gateDisabled(env);
+	const load = off
+		? { skipped: off }
+		: await waitForLowLoad({ label, ...deps });
+	return { claim, load };
+}
+
+/** One results line for a load-guard outcome, or null when it had nothing to say. */
+export function guardSummary(name, load) {
+	if (!load || load.skipped || load.inside) return null;
+	if (load.gaveUp)
+		return `WARN    ${name}: started on a loaded machine (1-min load ${load.load.toFixed(1)} > ${load.threshold}) after ${minutes(load.waitedMs)}`;
+	if (load.waitedMs >= 60_000)
+		return `note    ${name}: waited ${minutes(load.waitedMs)} for the load to drop`;
+	return null;
+}

package/scripts/lib/reactive-v-model.mjs

@@ -12,9 +12,11 @@
  * expression (`ctx.draft`, `draft.name`) writes a property.
  *
  * Read from `compileScript(...).bindings`, never by compiling the template
- * with `inlineTemplate` and looking for the assignment: called on its own,
- * compileScript rewrites the `const` to `let` (with a warning) and hides the
- * very break the real build hits. When compileScript cannot run on a file
+ * with `inlineTemplate` and looking for the assignment. Vue 3.5.26+ demotes a
+ * v-model'd reactive `const` to `let` (with a warning, so its build passes)
+ * and reports it `setup-let`: that binding still counts when the AST shows the
+ * `const`, so the finding does not hang on the Vue `check` resolves, and
+ * matches the ESLint twin on a consumer still on ≤ 3.5.25. When compileScript cannot run on a file
  * (a type it would have to resolve from disk), the same classification is
  * made from the script AST: a `const` whose initializer is a call of the
  * `reactive` imported from `vue` — Vue's own rule.
@@ -34,7 +36,7 @@ const PROP_DIRECTIVE = 7;
 const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
 
 export const REACTIVE_V_MODEL_MESSAGE = (name) =>
-	`\`${name}\` is a const reactive(); a production build rejects v-model on it — use ref() and \`.value\` in script`;
+	`\`${name}\` is a const reactive(); v-model reassigns it (a production build on Vue ≤ 3.5.25 fails, later Vue turns it into a \`let\`) — use ref() and \`.value\` in script`;
 
 /** Strip TS wrappers and parentheses Vue's own classification looks through. */
 export function unwrapExpression(node) {
@@ -172,7 +174,11 @@ function reactiveBindings(descriptor) {
 	const confirmed = fromAst();
 	const names = new Set();
 	for (const [name, type] of Object.entries(bindings ?? {}))
-		if (type === 'setup-reactive-const' && confirmed.has(name)) names.add(name);
+		if (
+			(type === 'setup-reactive-const' || type === 'setup-let') &&
+			confirmed.has(name)
+		)
+			names.add(name);
 	return names;
 }
 

package/scripts/lib/tab-links.mjs

@@ -0,0 +1,209 @@
+/**
+ * `tab-link-navigation` / `tab-link-missing` (Q6.1 link mode, owner
+ * 2026-10-29): a BbTabs / BbTabsRoot whose items carry `href` or `to` is a
+ * `<nav>` of links, each going to its own page. Two spellings read as
+ * something else and are caught here, statically, never by a console warning:
+ *
+ * - `navigation` on a link strip: it syncs a query parameter, and links have
+ *   none to sync, so it does nothing. Drop it (an `href` used only as the
+ *   query base of a `navigation` strip is gone: drop the `href` instead, query
+ *   mode keeps the current URL).
+ * - an item with neither `href` nor `to` beside items that have one: it
+ *   renders as a disabled link. Give it its page.
+ *
+ * Reach: the literal `items` array the file spells, inline or a `<script
+ * setup>` const bound by name (`scriptSetupArrayConsts`). An item that
+ * spreads another object is not judged (its fields are out of sight).
+ */
+import { babelParse, parse } from 'vue/compiler-sfc';
+import { libraryAliases, localBbImports } from './local-components.mjs';
+
+const NODE_ELEMENT = 1;
+const NODE_ATTRIBUTE = 6;
+const PROP_DIRECTIVE = 7;
+
+const TABS = new Set(['BbTabs', 'BbTabsRoot']);
+
+export const TAB_LINK_MESSAGES = {
+	navigation: (component) =>
+		`\`navigation\` does nothing on a ${component} whose items have \`href\` / \`to\`: those items are links to their own pages, with no query parameter to sync. Drop \`navigation\` (or, if the \`href\` was only the query base, drop the \`href\`: query mode keeps the current URL).`,
+	missing: (component, value) =>
+		`${value ? `The \`${value}\` item` : 'This item'} of a ${component} whose other items have \`href\` / \`to\` has neither: in link mode it renders as a disabled link. Give it its \`href\` (Inertia) or \`to\` (Vue Router / Nuxt).`,
+};
+
+export const TAB_LINK_HINT =
+	'link mode: every item an `href` / `to`, the current one by `:model-value`, no `navigation`';
+
+const pascal = (tag) =>
+	tag.includes('-')
+		? tag.replace(/(?:^|-)([a-z0-9])/g, (_, c) => c.toUpperCase())
+		: tag;
+
+const unwrap = (node) => {
+	let current = node;
+	while (
+		current &&
+		[
+			'TSAsExpression',
+			'TSSatisfiesExpression',
+			'TSNonNullExpression',
+			'TSTypeAssertion',
+			'ParenthesizedExpression',
+		].includes(current.type)
+	)
+		current = current.expression;
+	return current;
+};
+
+const keyName = (property) =>
+	property.type === 'ObjectProperty' && !property.computed
+		? property.key.type === 'Identifier'
+			? property.key.name
+			: property.key.type === 'StringLiteral'
+				? property.key.value
+				: undefined
+		: undefined;
+
+const has = (object, key) => object.properties.some((p) => keyName(p) === key);
+
+const stringValue = (object, key) => {
+	const property = object.properties.find((p) => keyName(p) === key);
+	const value = unwrap(property?.value);
+	return value?.type === 'StringLiteral' ? value.value : undefined;
+};
+
+const arrayOf = (node, arrays) => {
+	const value = unwrap(node);
+	if (value?.type === 'ArrayExpression') return value;
+	if (value?.type === 'Identifier') return arrays?.get(value.name) ?? null;
+	return null;
+};
+
+const parseExpression = (content) => {
+	try {
+		return (
+			babelParse(`(${content})`, {
+				sourceType: 'module',
+				plugins: ['typescript'],
+			}).program.body[0]?.expression ?? null
+		);
+	} catch {
+		return null;
+	}
+};
+
+/** `navigation`, `:navigation="true"`; never `:navigation="false"`. */
+const navigationProp = (node) =>
+	(node.props ?? []).find((prop) => {
+		if (prop.type === NODE_ATTRIBUTE) return prop.name === 'navigation';
+		if (prop.type !== PROP_DIRECTIVE || prop.name !== 'bind') return false;
+		if (!prop.arg?.isStatic || prop.arg.content !== 'navigation') return false;
+		return prop.exp?.content.trim() !== 'false';
+	});
+
+/**
+ * @param {string} code a whole SFC (ranges are offsets into it) or a snippet
+ * @param {{ templateAst?: any, arrays?: Map<string, any>, library?: Parameters<typeof localBbImports>[1] }} [options]
+ * @returns {Array<{ component: string, attr: string, kind: 'tab-link-navigation' | 'tab-link-missing', line: number, message: string, hint: string, range?: [number, number] }>}
+ */
+export function tabLinkFindings(code, options = {}) {
+	if (!/\b(href|to)\b/.test(code)) return [];
+	let descriptor = null;
+	try {
+		({ descriptor } = parse(code, { sourceMap: false }));
+	} catch {
+		descriptor = null;
+	}
+	const ast = options.templateAst ?? descriptor?.template?.ast;
+	if (!ast) return [];
+	const ranged =
+		!options.templateAst || options.templateAst === descriptor?.template?.ast;
+	const arrays = options.arrays;
+	const scriptArrays = new Set(arrays ? [...arrays.values()] : []);
+	const scriptOffset = descriptor?.scriptSetup?.loc.start.offset ?? 0;
+	const scriptLine = descriptor?.scriptSetup?.loc.start.line ?? 1;
+	const aliases = libraryAliases(code);
+	const own = localBbImports(code, options.library);
+	const findings = [];
+
+	const check = (node, component, itemsProp) => {
+		const array = arrayOf(
+			parseExpression(itemsProp.exp?.content ?? ''),
+			arrays
+		);
+		if (!array) return;
+		const entries = array.elements
+			.map(unwrap)
+			.filter((entry) => entry?.type === 'ObjectExpression');
+		const isLink = (entry) => has(entry, 'href') || has(entry, 'to');
+		if (!entries.some(isLink)) return;
+		const inScript = scriptArrays.has(array);
+		// `(` was prepended to the template expression before parsing.
+		const base = inScript
+			? {
+					offset: ranged && descriptor?.scriptSetup ? scriptOffset : null,
+					line: scriptLine,
+				}
+			: {
+					offset: ranged ? itemsProp.exp.loc.start.offset - 1 : null,
+					line: itemsProp.exp.loc.start.line,
+				};
+
+		const navigation = navigationProp(node);
+		if (navigation)
+			findings.push({
+				component,
+				attr: 'navigation',
+				kind: 'tab-link-navigation',
+				line: navigation.loc.start.line,
+				message: TAB_LINK_MESSAGES.navigation(component),
+				hint: TAB_LINK_HINT,
+				...(ranged
+					? {
+							range: [navigation.loc.start.offset, navigation.loc.end.offset],
+						}
+					: {}),
+			});
+
+		for (const entry of entries) {
+			if (isLink(entry)) continue;
+			if (entry.properties.some((p) => p.type === 'SpreadElement')) continue;
+			findings.push({
+				component,
+				attr: ':items',
+				kind: 'tab-link-missing',
+				line: base.line + entry.loc.start.line - 1,
+				message: TAB_LINK_MESSAGES.missing(
+					component,
+					stringValue(entry, 'value')
+				),
+				hint: TAB_LINK_HINT,
+				...(base.offset !== null
+					? { range: [base.offset + entry.start, base.offset + entry.end] }
+					: {}),
+			});
+		}
+	};
+
+	const walk = (node) => {
+		if (!node || typeof node !== 'object') return;
+		if (node.type === NODE_ELEMENT && !own.has(node.tag)) {
+			const written = pascal(node.tag);
+			const component =
+				aliases.get(node.tag) ?? aliases.get(written) ?? written;
+			if (TABS.has(component)) {
+				const items = (node.props ?? []).find(
+					(prop) =>
+						prop.type === PROP_DIRECTIVE &&
+						prop.name === 'bind' &&
+						prop.arg?.isStatic &&
+						prop.arg.content === 'items'
+				);
+				if (items) check(node, component, items);
+			}
+		}
+		for (const child of node.children ?? []) walk(child);
+	};
+	walk(ast);
+	return findings;
+}