fix(lint)!: object-field-ref-unknown judges a field's relatedListColumns, lookupColumns, lookupFilters and dependsOn, and indexes[].fields

[objectstack-fleet]

Part of #20432

Clause-②: no

What this does

This is step 1 of the triage direction on the card (5871296642). The object-level field-reference rule object-field-ref-unknown (packages/lint/src/validate-object-field-refs.ts, error, already on os validate / os build / os lint and the runtime publish door for object writes) now judges five more field-name lists. Before, it judged highlightFields and publicSharing.redactFields only:

• field level: relatedListColumns, lookupColumns (both arms), lookupFilters[].field, dependsOn (both arms);
• object level: indexes[].fields (the fold 5870812245).

A name that is not a field of the object the list addresses is refused at the exact path. Examples: objects[i].fields.FIELD.lookupColumns[j].field and objects[i].indexes[j].fields[k]. The message has the family's shape: the string that was written, the object it was judged against, a "Did you mean" when a name is close, then the consequence. The hint ends with that object's field list (Fields on "X": a, b, c.). The rule id, severity and suite wiring are unchanged. No new rule file and no new gate.

Step 2 is not in this PR: SqlDriver.syncDeclaredIndexes logging a skipped declared index at error through logDurabilityFailure, and showing it in drift. That is the domain:engine seat's second PR on this card, and #20432 remains open for it.

Which object a name is judged against (measured on each key's reader)

The PM's mechanism hypothesis 3 asked for this per key. The readers were read at the objectui pin .objectui-sha dd3f7e1b:

Position	Judged against	Reader
relatedListColumns[i]	the object that owns the field (the child)	app-shell/src/utils/deriveRelatedLists.ts:291, where the related list is childObject: child.name
lookupColumns[i] / .field	the referenced object	fields/src/widgets/LookupField.tsx:337,484, picker columns over refObjectSchema of referenceTo
lookupFilters[i].field	the referenced object	LookupField.tsx:339,661 lookupFiltersToRecord, which feeds the query on referenceTo. validate-preset-comparands.ts already binds the same key this way.
dependsOn[i] / .field	the object that owns the field	LookupField.tsx:451-458, where the gate reads the host record by this key
dependsOn[i].param, or the bare name on a picker	the referenced object	LookupField.tsx:371-380,647: param defaults to field, and dependentFilter[param]
indexes[i].fields[j]	the object itself, plus injected columns	SqlDriver.syncDeclaredIndexes reads names verbatim against physicalColumns

The referenced-object positions are judged only on types that render the picker. lookup and master_detail render LookupField (FieldEditWidget.tsx:105-106). user renders UserField, which delegates to LookupField with sys_user fixed (UserField.tsx:48). The target is the graph's referenceTargetOf answer. On any other type those keys have no reader and are not judged.

lookupColumns, dependsOn and index columns are read verbatim by their readers, so a dotted name there is judged as one name. relatedListColumns and lookupFilters[].field keep the family's path resolution. On dependsOn, a name that misses on the owner is reported once, not a second time against the referenced object. The field form rows that landed with #19332 G1b (field.form.ts:232-245) describe the same addresses, and none of them claims a refusal, so no published text changes.

Severity

error, the family's existing tier. os validate and os build turn author-time error findings into exit 1 (validate.ts and compile.ts, splitBySeverity then this.exit(1)). This was measured on the real built CLI over a two-object fixture (lookup invoice.account to account):

• os validate: clean variant exit 0; misspelt variant exit 1 with 5 findings, one per position (index, relatedListColumns, lookupColumns .field, lookupFilters .field, dependsOn).
• os build: clean variant exit 0; misspelt variant exit 1 with the same 5 findings.
• The runtime publish door on an object write refuses too. This is pinned in the test file, with objects.proj_task.indexes[0].fields[1] and a lookup resolved against a context object.

Producers census

Measured before landing, with the rule run from source (tsx) over every exported object:

Corpus	Objects	Entries judged (idx / rLC / lC / lF / dO)	Findings
platform, packages/**/*.object.ts at af444b4cd1	84	352 / 0 / 0 / 0 / 3	0
examples/app-showcase (+ platform: 108)	24	0 / 14 / 4 / 1 / 2	0
examples/app-crm (+ platform: 90)	6	0 / 0 / 0 / 0 / 0	0
examples/app-todo (+ platform: 85)	1	5 / 0 / 0 / 0 / 0	0
hotcrm src/**/*.object.ts at 5bec6eb0	18	68 / 13 / 0 / 0 / 6	0
hotcrm + platform	102	420 / 13 / 0 / 0 / 9	0

The hotcrm carriers match the card's reading exactly: relatedListColumns in 3 files, dependsOn in 4. There is no real misspelling in any producer, so nothing is fixed at a producer and nothing is handed to the hotcrm lane.

The controls are lit:

• showcase: 5 planted misspellings (one per field-level position, both lookupColumns arms) gave 5 findings;
• platform: 1 planted index misspelling (sys_metadata_audit) gave 1 finding;
• hotcrm: 12 planted misspellings gave 12 new findings.

examples/app-multi-package declares 2 inline objects that carry none of these keys (population 0).

Tests (all at af444b4cd1)

• @objectstack/lint: vitest run, 115 files, 5355 passed / 5 skipped. typecheck, including check:test-typecheck over the test layer, exit 0. The rule file went from 31 to 60 tests: per list, a misspelling is refused with its code and path, a correct name passes, and a name from the OTHER object is still refused. Both object arms are covered, plus user resolving to sys_user, the three skips, verbatim dotted names, and junk inertness.
• @objectstack/cli --project unit: the first run gave 231 files passed, 3306 tests passed and 29 skipped. The other 2 files refused with the prerequisite "packages/cli is not built", which is not a red gate. After pnpm --filter @objectstack/cli build those 2 files passed, 29/29 tests. Integration tier is declared to CI.
• examples/app-showcase: 29 files / 385 tests passed.
• Runtime-door consumers: metadata-protocol protocol-publish-drafts-object-field-refs and build-probes-rule-failure (12 tests), plus platform-objects sys-email.highlight-fields-resolve (2 tests), all passed.
• Filter direction: only the package itself (@objectstack/lint) and named consumers were run. No ...@objectstack/lint sweep was run, because the public surface (exports, types) is byte-unchanged; the behaviour narrowing is what the consumer runs above cover.

Ablation (one-shot, restored, not kept)

The changes were committed first. Each leg was applied through scripts/ablation-replace.mjs, whose anchor must hit, with the landing proven by anchor count 1 to 0 and a blob change. A shell trap restored HEAD on exit. The test file imports the rule's source, so no build was involved.

• A, field-level slots emptied: 15 failed.
• B, index walk emptied: 3 failed.
• C, reference address collapsed onto the owner: 13 failed.

Restore was proven by blob equal to HEAD blob ac79635f and an empty git diff HEAD.

Gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at af444b4cd1 gave 60 commands, reconciled with --ran: 59 exited 0 and 1 is NOT MEASURED. The unmeasured one is pnpm check:dual-build-cjs-loads, which exited 3 with PREREQUISITE NOT MET because it reads every package's dist and 9 unrelated packages are unbuilt in this worktree. The four artifact-roster gates flagged under this diff's directories also exited 0: check-changeset-fixed, check:authz-resolver, check:error-code-casing and check:filter-alias-parity. ESLint, as a proven narrowing, ran on the 4 changed TS files (--format json: 4 files, 0 errors, 0 warnings). The config enables no type-aware linting (the printed config has parserOptions equal to ecmaVersion and sourceType only), so this diff cannot move a verdict on an untouched file. The repo-wide pnpm lint is CI's.

Acceptance notes

• carrier: #20432: step 2, the sync half, belongs to the domain:engine seat's second PR on this card. SqlDriver.syncDeclaredIndexes logs a skipped declared index (unique above all) at warn. Its duplicate-row sibling in the same function logs at error through logDurabilityFailure. expectedIndexes drops the index from drift. The Studio save door (ObjectSchema.safeParse) still admits a misspelt name, so that half still matters after this PR.
• Boundary: this rule judges existence only. An index column that names a real but virtual field (a formula) passes here and is still skipped at sync. Materialization stays the driver's question. It is written into the rule's docblock, which replaces the old "indexes[].fields[] is a storage question" paragraph (reason: that exclusion left a misspelling with no door at all).
• Boundary: the build-probes receipt plane (metadata-protocol/src/build-probes.ts) runs this rule over a one-object universe. The referenced-object positions are therefore unknowable, and silent, there. Its owner-addressed positions are judged. The door-time gate judges both.
• Boundary, pre-existing in the shared object graph: fields added by an objectExtensions entry are not merged into the graph. A list naming only such a field would be refused as a false finding. The census gave 0 findings in every producer measured, so no such case arose. Recorded here, not filed.
• File surface beyond the named file, same package, comments only: reference-integrity-suite.ts's member note said the rule resolves names against the object's OWN field map only, which is now false for the picker keys, so it was rewritten. The index.ts export comment lists the new positions.
• The changeset carries Clause-②: no (narrowing) with a BREAKING banner and minor, following the ADR-0087 gate (not-required (no-migration-prescription)) and the precedent of the security-role-word field-groups changeset. This body carries the claim's Clause-②: no verbatim.
• origin/main moved during the run (dc0ab6a2ed). This branch was not re-merged. CI validates the merge ref. The gate derivation flagged one stale family file (scripts/cross-package-test-inputs.mjs), whose gate ran green on this tree.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint, touching 20 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

25 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 75b2169243911f54dbc967679489b7cd01125093.

⛔ 9 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 6 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 75b2169243911f54dbc967679489b7cd01125093 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 758ffae000b6fecf95f81aacebf3b4caad8de3b9 — the merge of head af444b4cd12f2bb8252ce319d94a9b676382310b into base 75b2169243911f54dbc967679489b7cd01125093, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 758ffae000b6fecf95f81aacebf3b4caad8de3b9 && git checkout 758ffae000b6fecf95f81aacebf3b4caad8de3b9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 75b2169243911f54dbc967679489b7cd01125093 af444b4cd12f2bb8252ce319d94a9b676382310b && git checkout -B drift-repro 75b2169243911f54dbc967679489b7cd01125093 && git merge --no-ff af444b4cd12f2bb8252ce319d94a9b676382310b

node scripts/docs-audit/affected-docs.mjs --json 75b2169243911f54dbc967679489b7cd01125093

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 75b2169243911f54dbc967679489b7cd01125093 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: af444b4cd12f2bb8252ce319d94a9b676382310b
Local-runs: none

Inputs: card #20432 (body; comments 5870812245, 5871296642, 5872067468, 5874560373), PR #20479 (body, comment 5874529668, file list, the net diff of 5 files against merge-base 3cf6449), the objectui readers at the pin dd3f7e1b (.objectui-sha is identical at the head and at main), and the head's check-runs. Not read: the dispatch order or the dispatching seat's conclusions.

Check-runs on the head at judgment time: 34 total, 31 success, 3 skipped by path condition (Build Docs, Console Pin Gate, Packed-tarball smoke), 0 failed, 0 in progress. The nine that were in progress when the brief was written (Lint & Repo Gates, Test Core 1/2/3/5/6 and the rollup, Type Check · workspace, TypeScript Type Check) all concluded success.

① Derived judgments

Accept-set change: the rule object-field-ref-unknown (error; os validate / os build / os lint and the runtime publish door for object writes) refuses seven positions instead of two. Each new position, judged against its reader at the pin, not against the dev's prose:

1. fields.F.relatedListColumns[i] against the OWNER (the child object), path-resolved — RIGHT. app-shell/src/utils/deriveRelatedLists.ts:281-292 emits childObject: child.name and columns: fieldDef.relatedListColumns off the child's FK field; plugin-detail/src/RelatedList.tsx:739-753 resolves the authored columns against the child objectSchema. Keeping path resolution is the lenient direction: a correct dotted column is never refused, a misspelt leaf still is.
2. fields.F.lookupColumns[i] and [i].field against the REFERENCED object, verbatim — RIGHT. fields/src/widgets/LookupField.tsx:337,484,540: previewColumns are the authored lookupColumns, and buildLookupColumnDescriptors(previewColumns, refObjectSchema?.fields, referenceTo) reads fieldsMeta?.[col.field] as one key; core/src/utils/expand-fields.ts:263-274 matches columnIdentity(col) by set membership. No reader splits a picker column key on a dot, so a dotted name there addresses nothing and the verbatim refusal is a correct one.
3. fields.F.lookupFilters[i].field against the REFERENCED object, path-resolved — RIGHT. RecordPickerDialog.tsx:151- lookupFiltersToRecord keys the filter record by f.field; LookupField.tsx:658-669 feeds it to useRecordQuery({ objectName: referenceTo }). The same binding validate-preset-comparands.ts:123-127,402-409 already makes for this key. Path resolution matches what an engine filter key admits.
4. fields.F.dependsOn[i] and [i].field against the OWNER — RIGHT. LookupField.tsx:371-380 normalises a bare name to { field: d, param: d } and an object entry to param ?? field; :453-458 gates on resolvedDependentValues[field], the host record. useCascadingOptions.ts:28-57 reads the same key off the host's dependentValues for select / multiselect / radio, so judging the owner side on every type is right.
5. fields.F.dependsOn[i].param, or the bare name, against the REFERENCED object on picker types only — RIGHT. LookupField.tsx:645-653 writes f[param] = value into dependentFilter, merged into the query on referenceTo (:658-669). Picker types: FieldEditWidget.tsx:105-107 maps lookup and master_detail to LookupField, and user to UserField, which delegates with reference: meta?.reference || 'sys_user' (UserField.tsx:48-58); referenceTargetOf (spec/src/data/field-value.zod.ts:194-201) answers an explicit reference first, else the type's implicit sys_user. tree is a reference type with no picker mapping at the pin and is correctly left unjudged on this side (silence, the safe direction). Reporting a bare name once, on the owner, is right: one fix answers both sides.
6. indexes[i].fields[j] against the object itself plus injected columns, verbatim — RIGHT. driver-sql/src/sql-driver.ts:11858-11866 takes physicalColumns from columnInfo(), and :14192-14212 skips an index whose column is not in that set, at warn; schema-drift.ts:1818-1821 reads fields as verbatim strings (there is no direction-suffix spelling to preserve). The driver provisions id itself (table.string('id').primary()) and otherwise only what applySystemFields injects; the rule's injected set is resolveInjectedSystemColumns (spec/src/data/injected-system-columns.ts:139-185), the same plan. So id, created_at, organization_id under tenancy and owner_id under ownership: user resolve, and organization_id on a tenancy-off object is refused exactly where the driver would have no column to index.

False refusals, each a skip I verified in the code:

• A registry-injected column in an index or any list: resolveFieldPath resolves the leaf through obj.injected (object-graph.ts:474-478); id is in the name set as PRIMARY_KEY_COLUMN. Pinned at validate-object-field-refs.test.ts:610-618.
• A referenced object outside the checked stack (another package, a plugin not compiled in): graph.has(target) is false, the verdict is unknowable: object-not-in-stack, isUnjudgeable swallows it (object-graph.ts:441,470; the verbatim branch at validate-object-field-refs.ts:478). At the runtime door narrowObjectsToPackageClosure can only shrink that universe, which lands on the same silence. Pinned at test :470.
• An ADR-0015 external object with no field map: graphObjectOf returns null, the whole object is skipped as owner (:539-540) and yields no-field-map as a target. An external object that declares fields is judged on them, this family's existing finding: author-time expression validation resolves injected anchors on external objects but cannot warn they are unprovisioned — the #7865 provenance marker is unreachable from @objectstack/lint #8116 stance, unchanged here.
• A user field whose sys_user is not in the stack: the target is sys_user, graph.has is false, silent. Same branch as skip 1.
• A lookupFilters[].field path through a relationship: verbatim: false walks the hops on the referenced object; a hop through an injected column is injected-hop, a hop with no target is hop-untargeted, both unjudgeable.
• The REFERENCE slots on a non-picker type: target is undefined and the slot is skipped (:599,608-609). The platform's own dependsOn producers (sys-sharing-rule.object.ts: recipient_id is Field.text with widget: 'recipient-picker' and dependsOn: ['recipient_type', 'object_name']) are owner-only and pass.
• The runtime door snapshot: buildRuntimeWriteSnapshots drops the same-named stored copy from the baseline and appends the written item to the candidate (runtime-gate.ts:646-655), so a field the write adds is in the graph. No stale-copy channel.
• The raw lint path: a map-form fields goes through recordsOf; an unparsed object arm spelled with an alias ({ name }) reads as no name and is skipped, never refused.

Public surface: packages/lint/src/index.ts and reference-integrity-suite.ts change comments only; no export, type, rule id, severity or suite entry moves, and object-graph.ts is untouched. The member's runtimeTypes: ['flow', 'object'] is byte-identical to the merge-base (reference-integrity-suite.ts:348), so the runtime publish door is this rule's existing wiring since #15254, not a door this diff opens; the 422 is runtime-authoring-gate.ts:800. The rewritten suite note is accurate: a referenced object the snapshot does not carry is unknowable, so the missing-collection false-positive channel stays closed. The new consequence / prescription strings and the changeset prose carry no tracker number.

② Semver level

.changeset/20432-field-name-list-refs.md: @objectstack/lint: minor, a BREAKING banner, Clause-②: no (narrowing), adr-0087: not-required (no-migration-prescription). RIGHT for what the diff publishes: nothing widens (no key, export or payload grows), the accept set narrows at three existing doors, AGENTS.md makes (narrowing) BREAKING, and check-changeset-no-major refuses major in the launch window, so the banner carries the breaking-ness. Same form as .changeset/18306-role-word-field-groups.md and 19370-role-word-crosses-whole.md. No FROM → TO mapping is owed: nothing is renamed or retired, and the one-line fix is in the body (fix the name the finding points at or drop the entry; write param when the two sides differ). Check Changeset and Lint & Repo Gates are green on this head.

The claim about already-stored objects is honest: because the baseline excludes the same-named stored copy, an object republished with an unchanged misspelling is judged as new and refused; a draft save is not judged (D1); the changeset states both. #4463 D4 still keeps a sibling's stored violation off a clean write (test :138-146).

Clause-②: line: the PR body carries Clause-②: no (the claim's line verbatim), the changeset no (narrowing). The value is truthful (this diff widens nothing) and the fleet's one reader, scripts/pm/clause2-line.mjs, makes the arm optional (an absent arm declares no direction), so the body line is a legal declaration and the two gates read the arm where it lives, in the changeset. Not a FAIL. Recommendation to the seat, no code change: amend the body line to Clause-②: no (narrowing) so a reader of the PR alone sees the breaking direction the changeset declares.

③ Boundary flags

Dev flags (deviations in 5874560373 and the PR's Acceptance notes):

1. Comment-only edits in reference-integrity-suite.ts and index.ts — answered: both notes are now true, and the old own-field-map sentence was false for the picker keys.
2. Body Clause-②: no against changeset no (narrowing) — answered in ②.
3. The runtime publish door refuses the five positions beyond the card's wording — answered in ① and ②: existing wiring, honestly stated in the changeset.
4. origin/main not re-merged (main moved to dc0ab6a during the run) — answered: the PR reads mergeable, the only differences against current main outside this diff are validate-component-props.* from PR fix(lint): waive only a MISSING object beside a dataSource binding #20454 (not this branch), and CI ran green on the merge ref.
5. Turbo cache hits during closure builds; the CLI integration tier left to CI — answered: this review is read-only; Dogfood Verify CLI, Test Core and Build Core are green on the head.

out_of_scope_findings:

• carrier: #20432 step 2 (SqlDriver.syncDeclaredIndexes at warn, drift drops the index) — answered: matches triage 5871296642 direction 2, the domain:engine PR on this card; the card stays open for it.
• A formula (virtual) index column passes existence and is still skipped at sync — answered: existence-only is the rule's stated scope (docblock and changeset); materialization folds into step 2.
• build-probes.ts runs the rule over a one-object universe, leaving the REFERENCE positions silent on that plane — answered: silence, not refusal; the door-time gate judges both.
• Fields contributed by objectExtensions are absent from the shared object graph — ESCALATED to the seat. Verified: indexObjectGraph reads objects[].fields only, and no CLI-side fold exists (the runtime registry folds extenders for listItems, but the written item itself replaces that folded copy unfolded). The channel is pre-existing for highlightFields / redactFields and every field-existence rule on this seam, and the census gave 0 findings, so it is not a defect this diff introduces; but the diff moves the exposure from 2 positions to 7 at error, and the dev left it noted, not filed. Whether a seam card against packages/lint/src/object-graph.ts is owed under Prime Directive chore: version packages #10 (a false refusal on valid metadata is an authoring trap) is the seat's call.
• hotcrm 0 findings at 5bec6eb0 — dev-measured, not re-run here; the carrier counts match the card's own reading.

open_questions: none declared, none found.

Implemented-by: claude/issue-20432-field-name-list-refs
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code