@@ -0,0 +1,22 @@
+---
+'@objectstack/cli': minor
+---
+
+`os validate` runs the per-package author-time rule pass `os build` already ran — the false-clean residue #17069 left one layer down.
+
+`os build` runs the artifact's authoring rules **twice**: once over the union-folded stack, then a second `runAuthoringRules('build', …)` pass over each `artifactPackages(…)` entry with `packageBodyAsStack(…)` as resolution context, de-duplicated against the union run. `os validate` ran the union pass and stopped — it imported neither seam. By `compile.ts`' own description the survivors of that second pass are "exactly the set the union could not see", so that whole set was findings `os build` reported and `os validate` **structurally could not**. The direction is false-clean, and on the worse door: the fast pre-flight is what an author runs *before* shipping, so its clean bill of health is the strongest false assurance the three commands can give.
+
+Measured on `origin/main` 09e16a574 over `examples/app-multi-package`, both commands exiting 0:
+
+```
+os build    --json  warnings: 4      <- 3 union + 1 per-package survivor
+os validate --json  warnings: 3      <- the survivor is the defect
+```
+
+After: both report 4, the same set, in the same order.
+
+**The loop is now one seam, not two copies.** `runPerPackageAuthoringRules` lives beside `artifactPackages` / `packageBodyAsStack` in `utils/artifact-packages.ts`, whose header already forbids a second copy of that shape by name. What would have drifted between two hand-written loops is not the package reading but the **verdict** — the de-duplication key, the severity split, the `where` prefix. `os build`'s observable output is unchanged (text face byte-identical modulo timings; `--json` payload identical).
+
+**Severity mapping is `os build`'s, unchanged.** A per-package `error` refuses (exit 1); an advisory joins `warnings`. So `os validate` is narrowed only to the bar the command that *ships* already holds: every input it can now refuse is one `os build` already refuses, which means **nothing that builds today stops validating**. No newly-refused input could be exhibited on any fixture — across the repo's own two-package example and three constructed variants the observable change is advisory-only, because `packageBodyAsStack` hands each package the artifact's whole `packages[]` as resolution context and the reference-integrity suite resolves object names through it. Graded `minor` rather than `patch` for the new observable step line, the new advisories and the newly reachable non-zero exit; ⛔ **not** declared breaking, because the narrowing could not be exhibited and is bounded by an existing gate.
+
+Unchanged and out of scope: the ADR-0130 D4 union fold (#17069, fixed — `authoringRuleUnionStack` is in both commands), `--json` rendering (#11727), and disagreements *within* the per-package pass's verdicts (#18204). `os lint` still runs the union pass alone; its `artifactPackages` / `packageBodyAsStack` imports serve its own intra-package duplicate-name advisory, not the shared table.
@@ -0,0 +1,22 @@
+---
+'@objectstack/spec': patch
+---
+
+Say it out loud when a `.refine()` never reaches the published JSON Schema.
+
+`z.toJSONSchema()` has no arm for a `custom` check, so every rule written as a
+`.refine()` / `.superRefine()` is enforced by the runtime and absent from the
+`json-schema/` tree that ships inside this package — a published file that is
+WIDER than the Zod type it was generated from, in the direction where an
+author's (or an AI's) validator says yes and the platform then says no. Measured
+on zod 4.4.3: 688 refinement sites across 240 published schemas, none of which
+projected anything.
+
+Nothing about what the schemas accept changes. Each affected file now carries an
+`x-dropped-refinements` annotation naming the paths whose rules it does not
+state — `x-` keywords are ignored by every validator, so the accepted document
+set is byte-for-byte what it was — and the generator reports the population on
+every run and refuses to grow it silently
+(`packages/spec/dropped-refinements.baseline.json`).
+
+Clause-②: no
@@ -228,7 +228,33 @@ export const TaskViews = defineView({
         { field: 'estimate_hours' },
         { field: 'due_date' },
       ],
-      rowColor: { field: 'priority' },
+      // Row colouring by priority. The `colors` map is what does the work:
+      // `rowColor: { field }` alone parses and publishes clean and colours
+      // nothing (author-time diagnostic `view/row-color-without-colors`).
+      //
+      // The values are COLOUR NAMES, not hex. objectui `plugin-grid`'s
+      // `useRowColor` resolves each authored value through its own
+      // `COLOR_TO_CLASS` vocabulary to a literal Tailwind class
+      // (`red` -> `bg-red-100`), hands a `bg-*` value through untouched, and
+      // returns `undefined` for everything else — Tailwind v4 has no runtime,
+      // so a fabricated class string would name no rule in the compiled
+      // stylesheet. A hex here would clear the resolver's `!config.colors`
+      // guard, silence the diagnostic above, and still colour no row.
+      //
+      // Each name is the entry of that vocabulary nearest to the colour
+      // `priority` already declares on the option itself (`task.object.ts`):
+      // #94A3B8 slate, #3B82F6 blue, #F59E0B amber, #EF4444 red. The renderer
+      // paints the `-100` tint of the name, so the row background stays light
+      // enough to read the row's own text on.
+      rowColor: {
+        field: 'priority',
+        colors: {
+          low: 'slate',
+          medium: 'blue',
+          high: 'amber',
+          urgent: 'red',
+        },
+      },
       // List-level inline edit — cells become editable in place, with a
       // per-row edit affordance and a save-all/cancel-all toolbar (view-level
       // master switch; distinct from the master-detail `inlineEdit` on fields).
 
@@ -14,6 +14,11 @@ import { stripComments } from '../../../scripts/js-comment-mask.mjs';
 import stack from '../objectstack.config.js';
 import { PLATFORM_CAPABILITY_NAMES } from '@objectstack/spec/security';
 import { FILE_REFERENCE_TYPES, valueSchemaFor } from '@objectstack/spec/data';
+import { VIEW_ROW_COLOR_WITHOUT_COLORS } from '@objectstack/spec/kernel';
+// The SHIPPED ADR-0078 completeness gate, never a re-derivation of it —
+// `vitest.config.ts` aliases `@objectstack/lint` to its `src/`, so the verdict
+// is about the rule in this checkout rather than about `packages/lint/dist`.
+import { validateFunctionalCompleteness } from '@objectstack/lint';
 // The job handler's argument type, from the package that BUILDS it
 // (`AppPlugin`) — not a local re-description of it. A fake context typed to a
 // hand-written approximation is how a double drifts looser than the contract it
@@ -741,3 +746,90 @@ describe('sharing rules target an object under record-sharing enforcement (#9237
     ).toEqual([]);
   });
 });
+
+/**
+ * #15100 — the task Grid view's `rowColor` named a field and declared no
+ * `colors` map, so objectui `plugin-grid`'s `useRowColor` returned before it
+ * read a record and every row kept the default background, while the metadata
+ * parsed, validated and published clean. The same class as every guard above:
+ * a declaration the platform accepts at authoring time and then does not
+ * honour, announced only by an advisory line nobody reads.
+ *
+ * Two arms, because the wiring has two independent ways to be inert and only
+ * the first has a shipped rule:
+ *
+ *   ① NO MAP — the author-time diagnostic `view/row-color-without-colors`
+ *     names it. WARNING severity, so `os validate` prints it and still exits
+ *     0; a pin asserting "validate succeeds" would have passed on the broken
+ *     tree, so this asserts on the FINDINGS.
+ *
+ *   ② A MAP THE RENDERER CANNOT RESOLVE — invisible to ①. `colorToClass`
+ *     hands a value that already starts with `bg-` through untouched,
+ *     otherwise looks it up in its own `COLOR_TO_CLASS` vocabulary of colour
+ *     names, and returns `undefined` for anything else; it never fabricates a
+ *     class string, because Tailwind v4 has no runtime and only complete class
+ *     literals present in scanned source reach the compiled stylesheet. So a
+ *     hex — the spelling the `priority` field uses for its own option colours,
+ *     and the obvious thing to copy — clears the `!config.colors` guard,
+ *     silences ①, and still colours no row.
+ */
+describe("the task Grid's rowColor is wired all the way to a colour (#15100)", () => {
+  it('reports no `view/row-color-without-colors` finding anywhere in this stack', () => {
+    const offenders = validateFunctionalCompleteness(stack)
+      .filter((f) => f.rule === VIEW_ROW_COLOR_WITHOUT_COLORS)
+      .map((f) => `${f.where} (${f.path})`);
+    expect(
+      offenders,
+      `\`rowColor\` block(s) with no \`colors\` map — the row-className resolver `
+        + `returns before it reads a record: ${offenders.join(', ')}`,
+    ).toEqual([]);
+  });
+
+  it('spells every authored colour as a value the renderer can resolve', () => {
+    // A colour NAME (`red`) or a complete Tailwind class (`bg-red-200`). The
+    // vocabulary itself is not transcribed here: a hand-copy of another repo's
+    // 23-entry map is a second opinion that drifts, and the shape rule is what
+    // separates a resolvable value from a hex.
+    const RESOLVABLE = /^(?:[a-z]+|bg-[a-z0-9/[\]().,%#-]+)$/;
+    const offenders: string[] = [];
+    for (const { path, block } of rowColorBlocks(stack)) {
+      for (const [value, colour] of Object.entries(block.colors ?? {})) {
+        if (typeof colour !== 'string' || !RESOLVABLE.test(colour)) {
+          offenders.push(`${path}.colors.${value} = ${JSON.stringify(colour)}`);
+        }
+      }
+    }
+    expect(
+      offenders,
+      `authored row colour(s) \`colorToClass\` resolves to \`undefined\` — the block passes `
+        + `the completeness rule above and still colours no row: ${offenders.join(', ')}`,
+    ).toEqual([]);
+  });
+});
+
+/** Every `rowColor` block anywhere in this app's stack, with where it sits. */
+function rowColorBlocks(
+  root: unknown,
+): Array<{ path: string; block: { colors?: Record<string, unknown> } }> {
+  const out: Array<{ path: string; block: { colors?: Record<string, unknown> } }> = [];
+  const seen = new WeakSet<object>();
+  const walk = (node: unknown, path: string): void => {
+    if (!node || typeof node !== 'object') return;
+    if (seen.has(node)) return;
+    seen.add(node);
+    if (Array.isArray(node)) {
+      node.forEach((child, i) => walk(child, `${path}[${i}]`));
+      return;
+    }
+    for (const [key, child] of Object.entries(node as Record<string, unknown>)) {
+      // The BOOLEAN toolbar toggle `userActions.rowColor` shares this key name
+      // and is a different thing entirely — only an object is the config.
+      if (key === 'rowColor' && child && typeof child === 'object' && !Array.isArray(child)) {
+        out.push({ path: `${path}.rowColor`, block: child as { colors?: Record<string, unknown> } });
+      }
+      walk(child, `${path}.${key}`);
+    }
+  };
+  walk(root, '$');
+  return out;
+}
@@ -16,7 +16,7 @@ import {
 import { loadConfig, namedExportRejectionHints } from '../utils/config.js';
 import { lowerCallables } from '../utils/lower-callables.js';
 import { authoringRuleUnionStack } from '../utils/stack-collections.js';
-import { artifactPackages, packageBodyAsStack } from '../utils/artifact-packages.js';
+import { artifactPackages, runPerPackageAuthoringRules } from '../utils/artifact-packages.js';
 import { buildAccessMatrix, diffAccessMatrix } from '@objectstack/lint';
 import { runAuthoringRules, splitBySeverity, authoringRulesFor } from '@objectstack/lint';
 import { resolveSduiManifest } from '../utils/sdui-manifest.js';
@@ -59,10 +59,6 @@ import {
 } from '../utils/permission-set-name-collisions.js';
 import type { PermissionSetNameCollisionDiagnostic } from '@objectstack/plugin-security';
 
-/** Identity of one finding, for the per-package de-duplication below. */
-const findingKey = (f: { rule: string; where: string; path: string; message: string }): string =>
-  `${f.rule}\u0000${f.where}\u0000${f.path}\u0000${f.message}`;
-
 export default class Compile extends Command {
   static override description = 'Compile ObjectStack configuration to JSON artifact';
 
@@ -425,32 +421,35 @@ export default class Compile extends Command {
       //     is the one `artifactPackages` above walked, off the same parsed
       //     stack, so the context a package resolves against is exactly the set
       //     of packages this artifact will register (ADR-0130 D4/D5).
-      const artifactPackageEntries = (result.data as Record<string, unknown>).packages;
+      //
+      //     ⛔ [#18677] The LOOP itself is not written here either — it is
+      //     `runPerPackageAuthoringRules`, beside the two seams it reads, for
+      //     the reason that module's header already gives about them: the
+      //     `os validate` door owes the identical pass, and the thing that
+      //     would have drifted between two hand-written copies is the VERDICT
+      //     (the de-duplication key, the severity split, the `where` prefix),
+      //     not the package reading. Every observable of this step — the step
+      //     line, the advisory order, the error sentence, the `--json` envelope
+      //     — is unchanged; only the loop moved.
+      //
+      //     The count is read for the step LINE before the pass runs, so the
+      //     line still precedes the work it announces on every path — including
+      //     a rule that throws inside it.
       const packageEntries = artifactPackages(result.data as Record<string, unknown>);
       if (packageEntries.length > 0) {
         if (!flags.json) {
           printStep(`Running author-time rules per package (${packageEntries.length})...`);
         }
-        const alreadyReported = new Set(findings.map(findingKey));
-        const perPackageErrors: Array<{ package: string } & typeof ruleErrors[number]> = [];
-        for (const pkg of packageEntries) {
-          const asStack = packageBodyAsStack(pkg.body, artifactPackageEntries);
-          const pkgFindings = runAuthoringRules('build', {
-            normalized: asStack,
-            parsed: asStack,
-            sduiManifest: resolveSduiManifest(),
-            loweredHookRefs: lowering.loweredHookRefs,
-          }).filter((f) => !alreadyReported.has(findingKey(f)));
-          for (const f of pkgFindings) alreadyReported.add(findingKey(f));
-          const split = splitBySeverity(pkgFindings);
-          ruleAdvisories = [
-            ...ruleAdvisories,
-            ...split.advisories.map((a) => ({ ...a, where: `package '${pkg.id}' — ${a.where}` })),
-          ];
-          perPackageErrors.push(
-            ...split.errors.map((e) => ({ ...e, package: pkg.id, where: `package '${pkg.id}' — ${e.where}` })),
-          );
-        }
+        const perPackage = runPerPackageAuthoringRules({
+          command: 'build',
+          parsed: result.data as Record<string, unknown>,
+          unionFindings: findings,
+          sduiManifest: resolveSduiManifest(),
+          loweredHookRefs: lowering.loweredHookRefs,
+        });
+        const perPackageErrors: Array<{ package: string } & typeof ruleErrors[number]> =
+          perPackage.errors;
+        ruleAdvisories = [...ruleAdvisories, ...perPackage.advisories];
         if (perPackageErrors.length > 0) {
           if (flags.json) {
             await emitJson(
 
@@ -15,6 +15,9 @@ import {
 import { loadConfig, namedExportRejectionHints } from '../utils/config.js';
 import { lowerCallables } from '../utils/lower-callables.js';
 import { authoringRuleUnionStack } from '../utils/stack-collections.js';
+// [#18677] The per-package half of the author-time rule run, shared with
+// `os compile` — ⛔ the loop is not re-written here; see that module's header.
+import { artifactPackages, runPerPackageAuthoringRules } from '../utils/artifact-packages.js';
 import { runAuthoringRules, splitBySeverity, authoringRulesFor } from '@objectstack/lint';
 import { resolveSduiManifest } from '../utils/sdui-manifest.js';
 import { preflightRequiredCapabilities, renderCapabilityMessage } from '../utils/capability-preflight.js';
@@ -382,6 +385,70 @@ export default class Validate extends Command {
         this.exit(1);
       }
 
+      // 3a-ii. [ADR-0130 D4, #18677] The SAME rule table, once per PACKAGE —
+      //     the second half of the run above, and the half this door ran
+      //     without.
+      //
+      //     `os build` has run it since #16611; `os validate` ran the union
+      //     fold and stopped, importing neither `artifactPackages` nor
+      //     `packageBodyAsStack`. `compile.ts` step 3b-ii says what survives
+      //     the de-duplication is "exactly the set the union could not see" ⇒
+      //     that whole set was findings `os build` reported and this command
+      //     structurally could not. Same FALSE-CLEAN direction #17069 fixed one
+      //     layer up, and the worse door for it: the fast inner-loop check is
+      //     what an author runs BEFORE shipping, so its clean bill of health is
+      //     the strongest false assurance the three commands can give.
+      //
+      //     ⛔ Not a second copy of the loop — `runPerPackageAuthoringRules` is
+      //     the one the build door calls, so the de-duplication key, the
+      //     severity split and the `where` prefix cannot drift between the two
+      //     doors. That drift is the defect this step closes, one layer down.
+      //
+      //     The SEVERITY MAPPING is `os build`'s, unchanged and deliberately:
+      //     an `error` refuses (exit 1), an advisory joins `ruleAdvisories` and
+      //     rides `warningsSoFar()`. The card asked for the asymmetry, ⛔ not
+      //     for a severity judgement, and a per-package `error` is one
+      //     `os build` ALREADY refuses — so this narrows `os validate` to the
+      //     bar the command that ships already holds, never past it.
+      //
+      //     Skipped entirely for a stack with no `packages[]`: one package by
+      //     definition, already judged whole by the union run above.
+      const packageEntries = artifactPackages(result.data as Record<string, unknown>);
+      if (packageEntries.length > 0) {
+        if (!flags.json) {
+          printStep(`Running author-time rules per package (${packageEntries.length})...`);
+        }
+        const perPackage = runPerPackageAuthoringRules({
+          command: 'validate',
+          parsed: result.data as Record<string, unknown>,
+          unionFindings: findings,
+          sduiManifest: resolveSduiManifest(),
+          // [#16546] The same ref set the union run above was handed, so a
+          // per-package hook write-set finding reports at the same `path` the
+          // other two doors report it at.
+          loweredHookRefs: lowering.loweredHookRefs,
+        });
+        ruleAdvisories = [...ruleAdvisories, ...perPackage.advisories];
+        if (perPackage.errors.length > 0) {
+          if (flags.json) {
+            await emitJson({
+              valid: false,
+              errors: perPackage.errors,
+              warnings: warningsSoFar(),
+              conversions: conversionNotices,
+              duration: timer.elapsed(),
+            });
+            this.exit(1);
+          }
+          console.log('');
+          printError(
+            `Author-time rules failed inside the artifact's packages (${perPackage.errors.length} issue${perPackage.errors.length > 1 ? 's' : ''})`,
+          );
+          printAuthoringRuleErrors(perPackage.errors, { remedy: JSON_FULL_LIST_REMEDY });
+          this.exit(1);
+        }
+      }
+
       // 3b. [#3366] Installable-provider preflight — the shift-left of the
       //     `serve`-time capability check. `os validate` previously only checked
       //     the `requires` tokens against the vocabulary (ADR-0066), never