@@ -15,7 +15,8 @@ Metadata-protocol: narrowed
 - **Before.** A seed record such as `budget: { value: 10, currency: 'USD' }` on a currency field passed `os validate` with "Validation passed" (exit 0) and `os build` emitted the artifact. The row was refused only when the seed loaded, by the record validator: `Budget is a currency amount: write it as a bare number …`, one dropped row in the boot log.
 - **Now.** Both commands judge every seed record value with the judge the load runs, and refuse with that judge's code and sentence, located at the value: `data[0].records[4].budget: Budget is a currency amount: write it as a bare number … (invalid_number)`, exit 1. `--json` carries each issue as `{ location, object, field, code, message }`.
 - **One judge.** The verdict is `validateInsertValues` (`@objectstack/objectql`, new): the insert write's own normalizations (a blank on a typed field is `null`, a numeric string is its number, a scalar on a multi-value field is wrapped) and then the same record-validator call the insert path makes. The field map is the runtime registry's, built from the stack's objects and picklists. So a value the load accepts after a rewrite (`'10'` on a number field) still passes.
-- **Left to the load.** `required` (a default or a hook may fill the value), a field the object does not declare (`defineSeed` already refuses it), and every value the load rewrites or a deployment decides: an expression envelope (the `cel` template), a `seedFile(path)`, a reference, file or structured-JSON field, a field bound to a picklist another package declares, and a dataset whose object another package declares.
+- **Left to the load.** `required` on a missing value (a default or a hook may fill it; an explicit `[]` on a required multi-value field is refused `required` here, as at load), a field the object does not declare (`defineSeed` already refuses it), and every value the load rewrites or a deployment decides: an expression envelope (the `cel` template), a `seedFile(path)`, a reference, file or structured-JSON field, a field bound to a picklist another package declares, and a dataset whose object another package declares.
+- **Known limits.** A `beforeInsert` hook is not run at authoring time, so a value a hook would rewrite into an accepted shape is refused here though the load stores it. A dataset whose object is declared only under `manifest.objects`, outside `packages[]`, is not judged.
 - **Who sees it.** A stack shipping a seed row the load already drops. The four example apps in this repository (`app-todo`, `app-crm`, `app-showcase`, `app-multi-package`) carry none and pass unchanged.
 
 **The remedy.** Write the value in the shape the message names, for a currency a bare number such as `10`, with the currency in the field's `currencyConfig`.
@@ -41,6 +41,20 @@
  *
  * A field the object does not declare is left to the answer it already has
  * (`defineSeed` refuses it at load of the config).
+ *
+ * ## Known limits
+ *
+ *  - A `beforeInsert` hook is not run here. The seed write runs object hooks
+ *    (the seed context skips automation triggers, not hooks), and they run
+ *    BEFORE the record validator, so a hook that rewrites a seed value into an
+ *    accepted shape lets the load store it while this walk refuses it as
+ *    written. The authoring door has no hook runtime by design; a refusal of
+ *    a value a hook would have fixed comes from here.
+ *  - Coverage is the folded stack's: `authoringRuleUnionStack` folds the
+ *    stack's own collections and its `packages[]` bodies. A dataset under
+ *    `manifest.data` whose object is declared only under `manifest.objects`
+ *    (outside `packages[]`) finds no field map and goes unjudged, by the
+ *    dataset clause above: fail-open, never a false refusal.
  */
 
 import { createLogger } from '@objectstack/core';
 
@@ -1976,7 +1976,9 @@ export function validateRecord(
  *
  * What it leaves to the load, by construction:
  *  - a missing value (`undefined`, `null`, blank): whether the row needs one is
- *    `required`, which a `defaultValue` or a hook may still satisfy;
+ *    `required`, which a `defaultValue` or a hook may still satisfy. A
+ *    SUPPLIED empty array on a required multi-value field is not missing: it
+ *    is refused `required` here, as the insert path refuses it;
  *  - a name the schema does not declare: the undeclared-field refusal is
  *    another door's;
  *  - every non-value rule: validation rules, references resolving, permissions.