fix: address CI findings on the reference-integrity rules (#3583)

- Raw NUL byte in the hook-dedup key (validate-expressions.ts) tripped
  `check:nul-bytes`. A raw NUL makes grep/ripgrep treat the whole file
  as binary and silently return zero matches, so the file drops out of
  code search and every grep-based lint. Written as the \u0000 escape
  per the repo convention — byte-identical at runtime.
- CodeQL (high): the `{…}` interpolation test used /\{[^}]+\}/, which
  backtracks quadratically on a long run of `{` with no closing brace.
  Replaced with a linear two-index scan; same semantics, including the
  "at least one character between the braces" rule.
- spec public API gained 6 exports (the platform-object registry), so
  the api-surface snapshot needed regenerating. 0 breaking, 6 added.

Also wire the two rules into `os compile` alongside `validate`/`lint`.
Every sibling reference rule (widget bindings, dashboard action refs,
filter tokens) already runs there, so leaving these out would recreate
the exact validate/lint/compile wiring drift the assessment flagged.

Document the new checks in docs/deployment/validating-metadata.mdx —
a "Dangling object and action names" section with the resolvability
severity table, plus the entry-points row.

Suites: lint 390, spec 6669, cli 636 passing; eslint, nul-bytes and
api-surface checks clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBks5G7AkwrvgF2kL5rfkT

Author: claude

content/docs/deployment/validating-metadata.mdx

@@ -83,6 +83,39 @@ header: {
 whose `objects/reports/dashboards/pages/views` route is unregistered is **warned**
 (external, interpolated, and opaque routes are skipped).
 
+### 4. Dangling object and action names
+
+The same gate covers the reference sites that are plain strings in the schema:
+an action param's record-picker target, a dashboard filter's options source, a
+navigation capability gate, and every surface that binds an action **by name**
+(`bulkActions` / `rowActions`, a page's `record:quick_actions`, a nav action item).
+
+```ts
+// ✗ the platform user object is `sys_user` — `user` resolves to nothing → error
+{ name: 'owner', type: 'lookup', reference: 'user' }
+
+// ✗ no action named `mass_update` is defined anywhere → error
+defineView({ /* … */ bulkActions: ['mass_update', 'mass_delete'] })
+
+// ⚠ platform-shaped, but no known package registers it → warning
+{ id: 'nav_approvals', type: 'object', objectName: 'sys_approval_process',
+  requiresObject: 'sys_approval_process' }
+```
+
+Severity follows **resolvability**, because "this might be provided by another
+installed package" is a real possibility that must not be guessed at:
+
+| The name… | Result |
+|---|---|
+| resolves to one of your own objects | ✓ |
+| is unresolved and carries no platform prefix | **error** — your objects are namespace-prefixed and present in the stack, so there is no legitimate elsewhere. This is the typo class (`user` for `sys_user`). |
+| resolves to a known platform / plugin / cloud object | ✓ |
+| carries a platform prefix but no known package registers it | **warning** — a third-party package may still provide it, so this stays advisory |
+
+Interpolated targets (`${…}`, `{…}`) are skipped — they resolve at render time.
+Action names get no third-party softening: the runtime ships no built-in action
+names, so a name resolving nowhere is always an **error**.
+
 ## The one gate, two entry points
 
 `os validate` and `os build` (alias of `os compile`) run the **same** validator:
@@ -93,6 +126,7 @@ whose `objects/reports/dashboards/pages/views` route is unregistered is **warned
 | CEL / predicate validation | ✓ | ✓ |
 | Widget-binding integrity | ✓ | ✓ |
 | Dashboard action/route references (ADR-0049) | ✓ | ✓ |
+| Object & action name references (#3583) | ✓ | ✓ |
 | Security posture (ADR-0090 — e.g. every custom object declares `sharingModel`) | ✓ | ✓ |
 | Emits `dist/objectstack.json` | — | ✓ |
 

packages/cli/src/commands/compile.ts

@@ -13,6 +13,7 @@ import { validateVisibilityPredicates } from '@objectstack/lint';
 import { validateWidgetBindings } from '@objectstack/lint';
 import { validateDashboardActionRefs } from '@objectstack/lint';
 import { validateFilterTokens } from '@objectstack/lint';
+import { validateObjectReferences, validateActionNameRefs } from '@objectstack/lint';
 import { validateResponsiveStyles } from '@objectstack/lint';
 import { validateSecurityPosture, validateOrgAxisRedLines, buildAccessMatrix, diffAccessMatrix } from '@objectstack/lint';
 import { validateReadonlyFlowWrites } from '@objectstack/lint';
@@ -319,6 +320,43 @@ export default class Compile extends Command {
         this.exit(1);
       }
 
+      // 3b-bis. Object & action name references (#3583) — the reference sites
+      //     `defineStack` does not cover: action-param `reference` /
+      //     `objectOverride`, dashboard filter `optionsFrom.object`, nav
+      //     `requiresObject` gates, and the name-bound action surfaces
+      //     (`bulkActions`/`rowActions`, page quick-actions, nav action items).
+      //     All plain strings in the schema, so a name resolving to nothing
+      //     ships and fails silently. Errors fail the build; the
+      //     platform-prefixed-but-unregistered case is advisory (a third-party
+      //     package may still provide it).
+      if (!flags.json) printStep('Checking object & action references (#3583)...');
+      const refFindings = [
+        ...validateObjectReferences(result.data as Record<string, unknown>),
+        ...validateActionNameRefs(result.data as Record<string, unknown>),
+      ];
+      const refErrors = refFindings.filter((f) => f.severity === 'error');
+      const refWarnings = refFindings.filter((f) => f.severity === 'warning');
+      if (refErrors.length > 0) {
+        if (flags.json) {
+          console.log(JSON.stringify({ success: false, error: 'reference integrity validation failed', issues: refErrors }));
+          this.exit(1);
+        }
+        console.log('');
+        printError(`Reference integrity check failed (${refErrors.length} issue${refErrors.length > 1 ? 's' : ''})`);
+        for (const f of refErrors.slice(0, 50)) {
+          console.log(`  • ${f.where}: ${f.message}`);
+          console.log(chalk.dim(`      ${f.hint}`));
+          console.log(chalk.dim(`      rule: ${f.rule}  at ${f.path}`));
+        }
+        this.exit(1);
+      }
+      if (!flags.json) {
+        for (const w of refWarnings.slice(0, 50)) {
+          console.log(chalk.yellow(`  ⚠ ${w.where}: ${w.message}`));
+          console.log(chalk.dim(`      ${w.hint}`));
+        }
+      }
+
       // 3c. SDUI scoped-styling correctness (ADR-0065) — a styled node without
       //     an `id` drops its CSS silently; Tailwind-in-className does nothing
       //     from metadata. Same bar for hand-authored and AI-generated pages

packages/lint/src/validate-expressions.ts

@@ -287,7 +287,7 @@ export function validateStackExpressions(stack: AnyRec): ExprIssue[] {
       check(`hook '${hookName}' (${target}) condition`, hook.condition, target, 'record');
       for (let i = mark; i < issues.length; i++) {
         const issue = issues[i];
-        const key = `${issue.message}
+        const key = `${issue.message}\u0000${issue.source ?? ''}`;
         // Keep the first occurrence of each distinct diagnostic. A field-unknown
         // finding differs per target (it names the object), so each survives;
         // a syntax error is identical across targets and collapses to one.

packages/lint/src/validate-object-references.ts

@@ -102,9 +102,21 @@ function strName(v: unknown): string | undefined {
   return typeof v === 'string' && v.length > 0 ? v : undefined;
 }
 
-/** A target the author cannot have meant literally — resolved at render time. */
+/**
+ * A target the author cannot have meant literally — `${…}` or `{…}` resolved at
+ * render time.
+ *
+ * Scanned rather than matched with `/\{[^}]+\}/`: that pattern backtracks
+ * quadratically on a long run of `{` with no closing brace (CodeQL
+ * polynomial-ReDoS), and the question here is simply "is there a `{` with a
+ * later `}` and something in between", which one pass answers.
+ */
 function isInterpolated(target: string): boolean {
-  return target.includes('${') || /\{[^}]+\}/.test(target);
+  if (target.includes('${')) return true;
+  const open = target.indexOf('{');
+  // `+ 2` keeps the original "at least one character between the braces"
+  // semantics, so a literal `{}` is not treated as a placeholder.
+  return open !== -1 && target.indexOf('}', open + 2) !== -1;
 }
 
 /** Levenshtein-bounded "did you mean?" over the known names. */

packages/spec/api-surface.json

@@ -649,6 +649,7 @@
     "BookSchema (const)",
     "BucketConfig (type)",
     "BucketConfigSchema (const)",
+    "CLOUD_PROVIDED_OBJECT_NAMES (const)",
     "CRDTMergeResult (type)",
     "CRDTMergeResultSchema (const)",
     "CRDTState (type)",
@@ -1006,6 +1007,9 @@
     "OpenTelemetryCompatibilitySchema (const)",
     "OtelExporterType (type)",
     "PKG_CONVENTIONS (const)",
+    "PLATFORM_OBJECTS_BY_PACKAGE (const)",
+    "PLATFORM_OBJECT_PREFIXES (const)",
+    "PLATFORM_PROVIDED_OBJECT_NAMES (const)",
     "PNCounter (type)",
     "PNCounterSchema (const)",
     "PackageDirectory (type)",
@@ -1260,6 +1264,8 @@
     "docAudienceAllows (function)",
     "emailTemplateForm (const)",
     "gcsStorageExample (const)",
+    "hasPlatformObjectPrefix (function)",
+    "isPlatformProvidedObjectName (function)",
     "isPublicAudience (function)",
     "minioStorageExample (const)",
     "resolveActionConfirm (function)",