diff --git a/AGENTS.md b/AGENTS.md
index 02bb43170f..14f09edb14 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -98,7 +98,7 @@ interface BaseSchema {
   ```json
   { "type": "action:button", "properties": { "label": "Open details", "actionType": "url", "target": "/users/ada" } }
   ```
-  ⛔ Never author an `events` bag: `BaseSchema` declares no `events` member and no renderer reads `schema.events` — a typed literal refuses it (#0.1), but the tolerant zod face is `.passthrough()`, so one that arrives as data is kept, judged by nothing and run by nothing. `ButtonSchema.onClick` is a runtime slot for a host-supplied function and is refused by name for the same reason.
+  ⛔ Never author an `events` bag: `BaseSchema` declares no `events` member and no renderer reads `schema.events` — a typed literal refuses it (#0.1), and one that arrives as data is refused by name as an undeclared key by `objectui validate` and named the same way by `objectui check`, which both judge through the strict authoring face (objectui#5250). The tolerant zod face is `.passthrough()`: it still keeps the bag, and nothing runs it. `ButtonSchema.onClick` is a runtime slot for a host-supplied function and is refused by name for the same reason.
 - **#5 — Layout as components.** Treat `Grid`/`Stack`/`Container` as first-class. Layout schemas declare responsive columns on the node as `columns` — a number, or a breakpoint object (`columns: { xs: 1, md: 2, lg: 4 }`); never `cols`, which nothing reads (objectui#4001).
 - **#6 — Type safety over magic.** No `any` — use strict generics. Map `"type": "button"` → React component via a central `ComponentRegistry`. **No `eval()` / runtime dynamic imports** to load components (security).
 - **#7 — No-Touch zones (Shadcn purity).** `packages/components/src/ui/**/*.tsx` are upstream 3rd-party files overwritten by sync scripts — **never edit their logic/styles**. To change `Button`/`Dialog` behavior: create/edit a wrapper in `packages/components/src/custom/`, import the primitive from `@/ui/...`, and wrap it.
diff --git a/skills/objectui/guides/project-setup.md b/skills/objectui/guides/project-setup.md
index 26dc670ddf..a41a59bf35 100644
--- a/skills/objectui/guides/project-setup.md
+++ b/skills/objectui/guides/project-setup.md
@@ -166,7 +166,7 @@ overriding the token values: [`rules/styling.md`](../rules/styling.md).
 | `objectui build` | Production build (Vite) |
 | `objectui start` | Serve a previously-built production bundle |
 | `objectui validate` | Validate a schema file (CI-friendly, exits non-zero on failure) |
-| `objectui check` | Sweep the project's JSON files — not a validation verdict: a file whose root carries a structural key (`children`, `className`, `body`, …) is recognised by that key and never parsed against the schema; only a file with none of those keys is parsed, and it is listed as an advisory when its root `type` names a registered component but the document fails; exits non-zero on unreadable JSON only. Use `objectui validate` for the verdict |
+| `objectui check` | Sweep the project's JSON files — not a validation verdict: a file whose root carries a structural key (`children`, `className`, `body`, …) is recognised by that key and never parsed against the schema; only a file with none of those keys is parsed, and it is listed as an advisory when its root `type` names a registered component but the document fails; exits non-zero on unreadable JSON and on a `${…}` refused on a text key its node never evaluates (objectui#4795). Use `objectui validate` for the verdict |
 | `objectui generate` | Code/schema generation (`object`, `page`, `plugin`) |
 | `objectui doctor` | Diagnostics (Node version, deps, etc.) |
 | `objectui analyze` | Bundle-size report over the built `dist/` output |
diff --git a/skills/objectui/rules/protocol.md b/skills/objectui/rules/protocol.md
index ff716489de..d314286a83 100644
--- a/skills/objectui/rules/protocol.md
+++ b/skills/objectui/rules/protocol.md
@@ -277,9 +277,11 @@ component refuses a node-level `actionType` / `target` as mis-layered
 
 **❌ DO NOT** use function references or inline callbacks in JSON schemas, and
 **❌ DO NOT** author an `events` bag. `BaseSchema` declares no `events` member and no
-renderer reads `schema.events`: a typed literal refuses it (objectui#8347), and the
-tolerant zod face is `.passthrough()`, so one that arrives as data is kept, judged
-by nothing and run by nothing (objectui#6497). `ButtonSchema.onClick` is a
+renderer reads `schema.events`: a typed literal refuses it (objectui#8347), and one
+that arrives as data is refused by name as an undeclared key by `objectui validate`
+and named the same way by `objectui check`, which both judge through the strict
+authoring face (objectui#5250). The tolerant zod face is `.passthrough()`: it still
+keeps the bag, and nothing runs it (objectui#6497). `ButtonSchema.onClick` is a
 runtime slot for a host-supplied function and is refused by name for the same reason.
 
 ## Rule: Action Params Use Field Types (Shared Widget Renderer)