diff --git a/‎.changeset/22212-lint-sibling-spellings.md‎
Lines changed: 18 additions & 0 deletions b/‎.changeset/22212-lint-sibling-spellings.md‎
Lines changed: 18 additions & 0 deletions
diff --git a/‎packages/lint/src/validate-component-props.test.ts‎
Lines changed: 53 additions & 4 deletions b/‎packages/lint/src/validate-component-props.test.ts‎
Lines changed: 53 additions & 4 deletions
diff --git a/‎packages/lint/src/validate-component-props.ts‎
Lines changed: 14 additions & 1 deletion b/‎packages/lint/src/validate-component-props.ts‎
Lines changed: 14 additions & 1 deletion
diff --git a/‎packages/lint/src/validate-hook-body-writes.test.ts‎
Lines changed: 19 additions & 0 deletions b/‎packages/lint/src/validate-hook-body-writes.test.ts‎
Lines changed: 19 additions & 0 deletions
@@ -0,0 +1,18 @@
+---
+'@objectstack/lint': minor
+---
+
+fix(lint)!: four authoring rules now fire on the sibling spelling of a defect they already caught
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, export or stored shape is removed, renamed or re-shaped, and no stored row is read or rewritten, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is the set of stacks four existing @objectstack/lint rules pass: each now reports, under its existing id and severity, a spelling of the defect it already reported in another spelling. The fix for every new finding is the one the rule's own hint already gives. The other categories are closed on facts: @objectstack/lint publishes (not unpublished); no ADR-0087 id covers these paths and this diff adds none (not registered / already-registered); and no exported TypeScript declaration changes (not runtime-interface-only / type-surface-only). -->
+
+**BREAKING**: an accept-set narrowing of the `os lint`, `os validate` and `os build` verdicts, shipped as `minor` under the launch-window convention for accept-set narrowings. No rule id is added. Each rule below now reports a spelling of a defect it already reported, at the severity it already had.
+
+- **`hook-api-update-readonly-field`** (error) and **`hook-body-write-unknown-field`** (warning) read a hook body's writes from one extractor. That extractor accepted only the literal `ctx.api.object(...)` receiver. A body that binds the handle first, such as `const api = ctx.api as HookApi | undefined; await api.object('crm_case').update({...})`, was invisible to both rules. The byte-identical `ctx.api.object(...)` statement fired both. The receiver can now also be a local bound to `ctx.api`, with or without type-only and non-null wrappers. That covers `const api = ctx.api`, `const { api } = ctx`, `const { api: db } = ctx` and an optional call `api?.object(...)`. The local must be declared once and never reassigned, and the write must sit in the block that declares it. A reassigned, shadowed, defaulted or out-of-scope local is still not judged, and neither is a local bound to `ctx.api.sudo()`. The action-body write rules share the extractor, so they read the same receivers.
+- **`visibility-bare-identifier`** (error) used to accept any name written as a namespace. `has(record.x) && foo.x == 'crm_lead'` published clean, and the console's engine then answered `Unknown variable: foo` and rendered the element unconditionally. A namespace root that no layer binds is now reported, with its own message and fix. Every root a renderer binds still passes: `record`, `previous`, `parent`, `current_user`, `user`, `ctx`, `os`, `features`, `page` and `data`, plus everything in `@objectstack/formula`'s `SCOPE_ROOTS`. On a metadata-editing form, a dotted chain on the right of `==` / `!=` is still left to `predicate-rhs-path-shaped`.
+- **`security-master-detail-ungranted`** (warning) used to treat an object as a detail only when it had a `master_detail` field. The runtime also resolves a `controlled_by_parent` object's master through a required lookup. That child, granted in no permission set, gets the same never-derived 403 on object-level CRUD. It is now reported too. A child with two `master_detail` fields is reported against the master the runtime picks.
+- **`component-props-invalid`** / **`component-props-unknown-key`** (warning) skipped a component whose `properties` bag was absent. A top-level component never arrives without one, because `PageComponentSchema` defaults it to `{}`. A nested component (in `children`, `items[].children` or `footer`) is never parsed by that schema, so every required prop it omitted went unreported. An absent bag is now judged as `{}`.
+
+**What an author sees.** A stack that passed before can now draw one of these findings. Each one names a real defect: a write the runtime drops or refuses, a predicate that can never evaluate, a role that is denied the object, or a component missing a prop its contract requires. The fix is in the finding's hint. The readonly-write and visibility findings are errors, so they fail `os build`. The others are warnings, which fail only `os lint --strict`.
@@ -223,6 +223,51 @@ describe('validateComponentProps — value verdicts', () => {
     );
   });
 
+  /**
+   * [#22212] A NESTED component with NO `properties` bag at all. The top-level
+   * firing control parses through `PageComponentSchema`, whose default makes the
+   * absent bag `{}`; a nested node sits in an untyped slot and never gets that
+   * default, so it reached this rule as `undefined` and was skipped — measured
+   * on nested `record:related_list`, `page:accordion` and `element:text` in the
+   * reporting app. The control and the probe are the same node, one level apart.
+   */
+  describe('a nested component whose `properties` are absent (#22212)', () => {
+    const required = (f: ReturnType<typeof validateComponentProps>) => invalid(f).map((x) => x.path);
+
+    it('the firing control: a top-level node with an empty bag reports its required props', () => {
+      expect(required(validateComponentProps(stackWith([{ type: 'record:related_list', properties: {} }]))))
+        .toContain('pages[0].regions[0].components[0].properties.relationshipField');
+    });
+
+    it('the parsed door: the top-level node with NO bag reports the same (the schema default)', () => {
+      const parsed = normalizeStackInput(stackWith([{ type: 'record:related_list' }])) as AnyRec;
+      expect(required(validateComponentProps(parsed)))
+        .toContain('pages[0].regions[0].components[0].properties.relationshipField');
+    });
+
+    it.each([
+      ['a container\'s `children`', { type: 'page:section', properties: { children: [{ type: 'record:related_list' }] } },
+        'pages[0].regions[0].components[0].properties.children[0].properties.relationshipField'],
+      ['a tab panel\'s `items[].children`',
+        { type: 'page:tabs', properties: { items: [{ label: 'T', value: 't', children: [{ type: 'record:related_list' }] }] } },
+        'pages[0].regions[0].components[0].properties.items[0].children[0].properties.relationshipField'],
+    ])('the probe: a nested node with NO bag in %s reports the same required prop', (_label, node, path) => {
+      expect(required(validateComponentProps(stackWith([node])))).toContain(path);
+    });
+
+    it('a present bag that is not an object is still left to the parse that owns its shape', () => {
+      expect(validateComponentProps(
+        stackWith([{ type: 'page:section', properties: { children: [{ type: 'record:related_list', properties: 'x' }] } }]),
+      )).toEqual([]);
+    });
+
+    it('a nested node whose required props are all optional stays silent with no bag', () => {
+      expect(validateComponentProps(
+        stackWith([{ type: 'page:section', properties: { children: [{ type: 'page:header' }] } }]),
+      )).toEqual([]);
+    });
+  });
+
   /**
    * #7702 — `PageHeaderProps.title` used to be required while the platform's
    * own synthesizer (objectui `buildDefaultHeader`) emits every seeded
@@ -415,12 +460,16 @@ describe('validateComponentProps — value verdicts', () => {
    * tab items' `value`/`count` are the same shape one level down.
    */
   it('reports nothing on the container/child keys the renderers honour (#5775)', () => {
+    // The child is filler: the subject is the CONTAINER keys. Since #22212 a
+    // nested node is judged even with no `properties` bag, so the filler carries
+    // the one prop `element:text` requires instead of omitting it.
+    const TEXT_CHILD = { type: 'element:text', properties: { content: 'Hi' } };
     const findings = validateComponentProps(
       stackWith([
-        { type: 'page:card', properties: { title: 'Shortcuts', children: [{ type: 'element:text' }] } },
-        { type: 'page:section', properties: { children: [{ type: 'element:text' }] } },
-        { type: 'page:footer', properties: { children: [{ type: 'element:text' }] } },
-        { type: 'page:sidebar', properties: { children: [{ type: 'element:text' }] } },
+        { type: 'page:card', properties: { title: 'Shortcuts', children: [TEXT_CHILD] } },
+        { type: 'page:section', properties: { children: [TEXT_CHILD] } },
+        { type: 'page:footer', properties: { children: [TEXT_CHILD] } },
+        { type: 'page:sidebar', properties: { children: [TEXT_CHILD] } },
         {
           type: 'page:tabs',
           properties: { items: [{ label: 'Tasks', value: 'related:task', count: 3, children: [] }] },
 
@@ -243,7 +243,20 @@ export function validateComponentProps(stack: AnyRec): ComponentPropsFinding[] {
       // map does not carry.
       const schema = PROPS_SCHEMAS[type];
       if (!schema) continue;
-      const props = isRec(component.properties) ? component.properties : undefined;
+      // [#22212] An ABSENT bag is judged as `{}` — what `PageComponentSchema`'s
+      // `properties` default makes it. That default only ever reaches the
+      // components the schema parses, which are the top-level ones: a NESTED
+      // component (in another's `children` / `items[].children` / `footer`) sits
+      // in a `z.array(z.unknown())` slot and keeps its `undefined`. Skipping
+      // that hid every required prop such a component omits, while the same
+      // node one level up drew `component-props-invalid`. A PRESENT bag that is
+      // not an object is still left to the parse that owns its shape.
+      const props =
+        component.properties === undefined
+          ? {}
+          : isRec(component.properties)
+            ? component.properties
+            : undefined;
       if (!props) continue;
 
       const where = `page "${pageName}" · ${type}`;
 
@@ -312,6 +312,25 @@ describe('validateHookBodyWrites — ctx.api writes', () => {
     expect(finding.message).not.toMatch(/write-path validator skips/);
   });
 
+  // [#22212] The firing control and the aliased spelling, side by side: the
+  // reporting app's conventions mandate the alias, so before this every one of
+  // its writes reached neither hook write-set rule.
+  it('reads a local bound to ctx.api as the same receiver (#22212)', () => {
+    const WRITE = "object('crm_deal').update({ id, stag: 'won' });";
+    const control = validateHookBodyWrites(stackWith(`await ctx.api.${WRITE}`));
+    expect(control).toHaveLength(1);
+    expect(control[0].rule).toBe(HOOK_BODY_WRITE_UNKNOWN_FIELD);
+    for (const source of [
+      `const api = ctx.api as HookApi | undefined;\nif (!api) return;\nawait api.${WRITE}`,
+      `const api = ctx.api!;\nawait api?.${WRITE}`,
+      `const { api } = ctx;\nawait api.${WRITE}`,
+    ]) {
+      expect(validateHookBodyWrites(stackWith(source)), source).toEqual(control);
+    }
+    // ...and an alias the extractor cannot prove is ctx.api stays unjudged.
+    expect(validateHookBodyWrites(stackWith(`let api = ctx.api;\napi = other;\nawait api.${WRITE}`))).toEqual([]);
+  });
+
   it('checks updateById payloads at argument 1, not 0', () => {
     const findings = validateHookBodyWrites(
       stackWith("await ctx.api.object('crm_deal').updateById(ctx.input.id, { stag: 'won' });"),