@@ -0,0 +1,29 @@
+---
+"@objectstack/lint": patch
+---
+
+fix(lint): 17 more author-time rule ids print a `fix:` line of one remedy sentence, and `os explain RULE_ID` carries what those lines used to explain
+
+Clause-②: no
+
+- **Shorter fix lines.** Each finding of these 17 rule ids now carries a `hint` (the CLI's `fix:` line, the runtime issue's `hint`) of one remedy sentence of at most 200 characters on every variant the lint suite fires (the lengths here are the `hint` alone; the CLI prints it after `fix: `). The longest of each, before → after:
+  - list-view search: `searchable-field-unknown` (448 → 129), `searchable-field-unprovisioned` (362 → 175) and `searchable-field-unsearchable` (328 → 139);
+  - list-view sort: `sort-field-unprovisioned` (378 → 191), `sort-field-unsortable` (332 → 154) and `sort-field-unknown` (301 → 142);
+  - visibility predicates: `visibility-predicate-unknown-function` (375 → 165), `visibility-bare-identifier` (221 → 102) and `visibility-predicate-syntax` (214 → 113);
+  - flow filters: `flow-filter-token-unknown` (427 → 182);
+  - actions: `action-no-placement` (424 → 171);
+  - import mappings: `mapping-target-field-unknown` (405 → 189);
+  - dashboards: `unconsumed-widget-option` (396 → 135);
+  - app navigation: `nav-object-ungranted` (370 → 118);
+  - hook bodies: `hook-body-write-unprovisioned-anchor` (365 → 178), `hook-body-write-unknown-field` (275 → 110) and `hook-body-source-unparseable` (254 → 105).
+- **One line, one remedy.** Where a fix line explained its remedy, the explanation moved: why a stale or inadmissible `searchableFields` entry is a `400 INVALID_FIELD` on list search, that a view narrows the object's searchable set and never widens it, and that a lookup column stores only an id; that both runtime doors refuse a formula sort with `400 INVALID_SORT`; how to vouch for an unprovisioned anchor (`columnMap`) or opt the object out of the injection (`ownership: 'none'`, `systemFields: { audit: false }`); the two vocabularies a flow filter token resolves in; the other-language operator spellings CEL does not parse, why re-spelling cannot fix an unregistered function, and which namespaces each surface binds; why gating a nav entry does not clear a missing grant; which hook-body write shapes are checked; what a partially parsed body leaves unchecked.
+- **A list the verdict already covers is not echoed.** `searchable-field-unknown`, `sort-field-unknown` and `mapping-target-field-unknown` no longer list every field of the object: the verdict's "Did you mean" names the near miss. `mapping-target-field-unknown` still lists the object's compound fields and their parts, as every import-mapping refusal does.
+- **`os explain RULE_ID` carries the rest.** What the fix lines stopped saying is each id's `RULE_EXPLANATIONS` entry in `@objectstack/lint`, which `os explain RULE_ID` prints. Two ids had no entry and gain one, so their `rule:` line now ends with the `os explain` pointer: `action-no-placement` ("where an action can be placed") and `unconsumed-widget-option` ("which widget options a renderer reads"). Five entries gain text. The action locations the new entry spells out are held to the spec's `ACTION_LOCATIONS` by the rule's test.
+- **At the runtime publish gate** (Studio, REST `PUT /api/v1/meta`, and the MCP and AI authors that write through that door), 10 of the 17 fire; the `hint` FROM → TO, measured at the door:
+  - a `view` write: `sort-field-unknown` (422 `issues[].hint`, a name / a dotted path 114 / 261 → 47 / 135), `sort-field-unsortable` (422, 318 → 140), `sort-field-unprovisioned` (2xx `advisories[].hint`, 363 → 176), `searchable-field-unknown` (422, a name / a dotted path 281 / 430 → 48 / 129), `searchable-field-unsearchable` (422, a formula / outside the declared set / a lookup / a json column 222 / 142 / 323 / 157 → 110 / 68 / 135 / 64), `searchable-field-unprovisioned` (2xx advisory, 361 → 174), `visibility-predicate-syntax` (422, a recognised spelling / none 106 / 214 → 106 / 107), `visibility-predicate-unknown-function` (422, 371 → 165) and `visibility-bare-identifier` (422, a bare name / an unbound namespace 160 / 215 → 41 / 96);
+  - an `object` write: `searchable-field-unknown` (422, the object's own set / a built-in list view 266 / 261 → 55 / 50), `searchable-field-unsearchable` (422, 222 → 110) and `searchable-field-unprovisioned` (2xx advisory, 361 → 174);
+  - a `flow` write: `flow-filter-token-unknown` (422, `{TOMORROW()}` / `{ROUND(x)}` / `{Math.round(x)}` / `{TODAY() - 45 - 10}` 336 / 358 / 427 / 100 → 91 / 113 / 182 / 100).
+
+  Studio's save-advisory toast prints an advisory's `hint` after its message, so the two `*-unprovisioned` toasts shorten; Studio renders no 422 issue's `hint`. No Studio, REST or MCP reader in this repository or in objectui matches on `hint` text; a tool that did should match on `rule` and `path` instead.
+- **Never at the runtime gate:** `action-no-placement`, `mapping-target-field-unknown`, `unconsumed-widget-option`, `nav-object-ungranted` and the three `hook-body-*` ids run on the CLI only.
+- **Unchanged:** every `message` (the verdict), rule id, severity and `path`, and what each rule accepts or refuses.
@@ -0,0 +1,19 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/objectql': patch
+---
+
+A language the environment added to an email template, which the package does not ship, is no longer treated as packaged code
+
+Clause-②: no
+
+An `email_template` is identified by its name and its `locale`, so the languages of one template form a bundle. When an administrator customizes a template in a language its package does not ship (for example a `zh-CN` version of a template the package ships in `en-US` only), that version is the environment's own item. Until now it was registered and served wearing the package's protection envelope, taken from the shipped `en-US` version:
+
+- the registry's artifact lookup answered the environment's `zh-CN` version as the package's own `zh-CN` artifact;
+- `GET /meta/email_template/:name?member=zh-CN` and the `/meta/email_template` list served it with `provenance: 'package'`, the package's id and its version;
+- the registry heal that runs after `DELETE ?member=zh-CN` refused to retire it as packaged code.
+
+- `@objectstack/metadata-protocol`: the artifact envelope (`_packageId`, `_packageVersion`, `_provenance`, and an artifact lock) is copied only onto a version of the same language as the shipped artifact. Each place that copies it looks up the artifact of the body's own language first. A language the package does not ship is registered and served as the environment's item. A language the package does ship keeps its envelope, its lock and its reset exactly as before. Types without languages are unchanged.
+- `@objectstack/objectql`: `SchemaRegistry.removeRuntimeShadow(type, name, member)` lifts a named language's shadow only when the package ships that language. For any other language it declines, and the heal's last step (`removeOverlayEntry`) retires the entry. Naming no language still sweeps the whole bundle, as before.
+
+A lock still binds the template name, at the read and at the write gate alike: a template the package locks stays locked in every language.
@@ -1081,22 +1081,32 @@ jobs:
       #   OK            at or under 1.3x (WARN_MEASURED_OVER_PREDICTED)
       #   WARN          past 1.3x, at or under 1.5x: a `::warning::` annotation
       #                 naming the shard and its heaviest overshoot; green
-      #   DRIFT         past 1.5x (MAX_MEASURED_OVER_PREDICTED): red
+      #   DRIFT         past 1.5x (MAX_MEASURED_OVER_PREDICTED): a second
+      #                 `::warning::` annotation, the upper tier; green
       #   NOT MEASURED  no executed test task carried a dataset entry; green
       #
-      # ONE red rule and a warning under it, on the same ratio: triage ruled
-      # the in-tree 1.5x the red and the card's 1.3x a warning only, and took no
-      # second red on wall time against `timeout-minutes`. Both constants, their
-      # measured basis and a self-test battery each live in the script.
-      #
-      # THE RED IS A `schedule` RED ALONE (C2, both timing steps, ruling
-      # https://github.com/objectstack-ai/objectstack/issues/22949#issuecomment-6119186511):
-      # the dataset's weights are measured on the hourly `schedule` runs, so
-      # only those exit 1 on DRIFT. On `merge_group`, `pull_request`, `push`
-      # and `workflow_dispatch` the step prints the same verdict, raises the
-      # DRIFT as a `::warning::` annotation and exits 0. The event reaches the
-      # script as `--event "$GITHUB_EVENT_NAME"`, which it requires; the rule
-      # and its self-test live there (TIMING_GRADED_EVENT, timingGateMode).
+      # Two thresholds on ONE ratio, and no second rule on wall time against
+      # `timeout-minutes`: triage ruled the in-tree 1.5x the upper tier and the
+      # card's 1.3x the lower. Both constants, their measured basis and a
+      # self-test battery each live in the script.
+      #
+      # NO EVENT GRADES (#22949 ruling E, item 1, both timing steps:
+      # https://github.com/objectstack-ai/objectstack/issues/22949#issuecomment-6125775640).
+      # A wall-clock reading on a shared runner measures the run's load as much
+      # as the code: the same package reads 82 s on a quiet hour and 209 s on a
+      # busy one, 2.56x, past this step's 1.5x bound and the ceilings' 2.0x of
+      # weight. The dataset's weights come from a window that was mostly
+      # quiet-density and every event, `schedule` included, meets both
+      # densities, so busy hours put the same shards past the bound whatever
+      # their code does: density, not code.
+      # So on `schedule`, `merge_group`, `pull_request`, `push` and
+      # `workflow_dispatch` alike the step prints the same verdict, raises DRIFT
+      # as a `::warning::` annotation and exits 0. The event reaches the script
+      # as `--event "$GITHUB_EVENT_NAME"`, which it requires: a missing one is a
+      # refusal, and so is a dataset or run summary that does not parse, and a
+      # refusal is still a red step on every event. The rule and its self-test
+      # live in the script (timingGateMode); regression detection moves to the
+      # dataset refresh's diff (E2, #23059).
       #
       # EXECUTED WINDOWS ONLY. Measurements come from samplesFromSummary() in
       # measure-test-shard-timings.mjs, which drops cache HITs and failed
@@ -1105,11 +1115,11 @@ jobs:
       # predicted and vouch for a rotted dataset, so a shard whose packages all
       # replayed is NOT MEASURED, never "fast".
       #
-      # NO `if:` and NO `continue-on-error` (the red is the point, and the
-      # `schedule`-only red is the script's `--event`, so neither is needed),
-      # and ABOVE the attestation pair for the #6082 reason documented on the
-      # upload above: a failed unguarded step skips that pair, so a drift red
-      # also withholds this shard's attestation, the fail-closed direction. A shard
+      # NO `if:` and NO `continue-on-error` (the only red left here is a
+      # refusal, and a refusal must stay red, so neither is wanted), and ABOVE
+      # the attestation pair for the #6082 reason documented on the upload
+      # above: a failed unguarded step skips that pair, so a refusal also
+      # withholds this shard's attestation, the fail-closed direction. A shard
       # with no packages runs no turbo and writes no summary; that is NOT
       # MEASURED here rather than a usage error from the script.
       #
@@ -1459,8 +1469,10 @@ jobs:
       # diagnostics fault here (an artifact-service 403 is the measured one,
       # #14469) must not evict a green run. The suite-duration ceiling check
       # at the end of this job reads the same captures and is the one step
-      # here that DOES red the job, on purpose: it is a gate, not a report, and
-      # a capture that never arrived reads NOT MEASURED there, never red.
+      # here that can still red the job, on purpose and only on a refusal (a
+      # malformed table or raise record, no `--event`): a package over its
+      # ceiling is a `::warning::` on every event, and a capture that never
+      # arrived reads NOT MEASURED there, never red.
       #
       # ⛔ Steps, deliberately, NOT a new `needs:` entry: this job's
       # `OS_AGGREGATOR_MEMBERS` / `OS_AGGREGATOR_NON_MEMBERS` block is asserted
@@ -1516,11 +1528,14 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
-      # ── The per-package suite-duration ratchet (#16468) ──────────────────
+      # ── The per-package suite-duration ceilings (#16468) ─────────────────
       #
-      # A GATE, unlike the two reporting steps above: NO `continue-on-error`,
-      # so on a `schedule` run a package whose suite ran past its ceiling reds
-      # `Test Core`, naming the package and its slowest test files. The
+      # A READING, never a red (ruling E, below): a package whose suite ran
+      # past its ceiling is one `::warning::` annotation naming it and its
+      # slowest test files, and the step exits 0 on every event. Unlike the two
+      # reporting steps above it carries NO `continue-on-error`, because a
+      # REFUSAL (a malformed table or raise record, no `--event`) is not a
+      # timing reading and reds `Test Core` on every event. The
       # ceiling is the package's slowest executed run in the refresh window
       # x 1.25, generated into scripts/test-shard-timings.json (`ceilings`) by
       # the refresh lane and held by every later refresh; it rises only by a
@@ -1538,19 +1553,26 @@ jobs:
       # samplesFromSummary, and every vitest file line); a capture that did not
       # arrive leaves its packages ungraded and says so, never red.
       #
-      # EXIT-GRADED ON `schedule` ALONE (C2, both timing steps, ruling
-      # https://github.com/objectstack-ai/objectstack/issues/22949#issuecomment-6119186511):
-      # the ceilings come from the hourly `schedule` runs, so only those red
-      # this job on a package over its ceiling. On `merge_group`,
-      # `pull_request`, `push` and `workflow_dispatch` the step prints the same
-      # table, raises each package over its ceiling as a `::warning::`
-      # annotation and exits 0; a real slowdown merged to `main` reds the next
-      # hourly run. A package whose ceiling is under the absolute floor (20s,
-      # CEILING_FLOOR_SECONDS) prints "below floor" and is never red. The
-      # event reaches the script as `--event "$GITHUB_EVENT_NAME"`, which it
-      # requires; a refusal (a malformed table or raise record) is red on every
-      # event. The rule, the floor's reading and their self-tests live in the
-      # script.
+      # NO EVENT GRADES (#22949 ruling E, item 1, both timing steps:
+      # https://github.com/objectstack-ai/objectstack/issues/22949#issuecomment-6125775640).
+      # A per-package suite wall on a shared runner measures the run's load as
+      # much as the package: the same package reads 82 s on a quiet hour (most
+      # packages replayed) and 209 s on a busy one (the whole workspace
+      # executing), 2.56x, while the ceiling formula (window max x 1.25) allows
+      # 2.0x of weight. The window the ceilings come from was mostly
+      # quiet-density and every event, `schedule` included, meets both
+      # densities, so busy hours put the same near-ceiling packages over
+      # whatever their code does: density, not code. So on `schedule`,
+      # `merge_group`, `pull_request`, `push` and `workflow_dispatch` alike the
+      # step prints the same table, raises each package over its ceiling as a
+      # `::warning::` annotation and exits 0. A package whose ceiling is under
+      # the absolute floor (20s, CEILING_FLOOR_SECONDS) prints "below floor" and
+      # is never over. The event reaches the script as
+      # `--event "$GITHUB_EVENT_NAME"`, which it requires; a refusal (a
+      # malformed table or raise record, no event) is red on every event. The
+      # rule, the floor's reading and their self-tests live in the script;
+      # regression detection moves to the dataset refresh's diff (E2, #23059)
+      # and the per-file budget.
       #
       # NOT MEASURED, exit 0, while the dataset carries no `ceilings`: they are
       # generated only where the run-summary artifacts are downloadable (the