@@ -0,0 +1,23 @@
+---
+'@objectstack/lint': minor
+---
+
+**BREAKING** fix(lint)!: an app navigation `visible` that does not parse is refused like a page `visibleWhen`, and page variables must be unique, named and seeded with a default of their type
+
+Clause-②: no (narrowing)
+Metadata-protocol: narrowed
+Skills-docs: none — no file under `skills/**` teaches a navigation entry's `visible` grammar or the page `variables` list; the refusals carry their own fix and `os explain` entries.
+
+<!-- adr-0087: not-required (no-migration-prescription) The narrowing is a refusal at the authoring doors (the metadata save door, a draft's diagnostics and its publish, and os validate / os build / os lint) of two value shapes that never worked at runtime: a navigation `visible` the CEL front end cannot parse (the console hides the entry from every viewer), and a page `variables` list with a duplicate name, an empty name, or a `defaultValue` of another type than the declared one. No metadata key, accepted key, export or error code is removed or renamed, and no stored shape changes. The fix is the author's choice of the predicate or the declaration they meant, so there is no mechanical conversion for `objectstack migrate meta` to apply; the shipped corpus (examples, platform packages) carries 1 navigation `visible` and 5 page variables, none of them refused. -->
+
+Two authoring shapes saved, read `valid: true` as drafts, published and passed `os validate`, and then did something the author never asked for.
+
+**A navigation `visible` that does not parse.** `navigation[].visible`, `areas[].navigation[].visible` and every entry's `children` are now judged by `visibility-predicate-syntax`, the verdict a page component's `visibleWhen` already gets. A bare string and a `{ dialect: 'cel' }` envelope are CEL (the console evaluates both on the CEL engine); an envelope of another dialect is the console's legacy reading and is not judged. Only the syntax is judged on a navigation entry: it binds the shell's roots (`current_user`, `user`, `features`, …), not a page's `record`, so the reference checks a page predicate gets do not apply. The finding is located at the key (`apps[0].navigation[0].visible`), and its verdict says the entry is hidden from every viewer, since the console's navigation gate falls closed on a fault.
+
+**Page variable declarations.** A new rule, `validatePageVariables`, refuses at the same doors:
+
+- `page-variable-name-duplicate`: the same `name` twice (the console keeps the last declaration, so the first one's type and default were silently dropped);
+- `page-variable-name-empty`: an empty or blank `name` (no `page.NAME` read can reach it);
+- `page-variable-default-type`: a `defaultValue` of another kind than the declared `type` (a string for `string` and `record_id`, a finite number for `number`, a boolean for `boolean`, a plain object for `object`, an array for `array`; `null` is admitted for any type, and a variable with no `type` is a `string`).
+
+**Where.** The metadata save door (`PUT /api/v1/meta/app/:name` and `/meta/page/:name`, Studio, MCP), a draft's `_diagnostics`, the publish (`422 INVALID_METADATA`), and `os validate` / `os build` / `os lint`. Stored apps and pages keep loading and serving; only the next save of one with a finding is refused, with the fix.
@@ -771,7 +771,7 @@ os compile --json                    # JSON output for CI pipelines
   → Normalizing stack definition...
   → Lowering inline handlers...
   → Validating protocol compliance...
-  → Running author-time rules (57)...
+  → Running author-time rules (58)...
   → Checking that every required capability has a provider installable in this edition...
   → Collecting package docs (ADR-0046)... 0 collected
   → Writing artifact...
 
@@ -759,7 +759,7 @@ A clean run walks the registry and reports timing:
   Config: /path/to/support-desk/objectstack.config.ts
   Load time: 21ms
   → Validating against ObjectStack Protocol...
-  → Running author-time rules (57)...
+  → Running author-time rules (58)...
   → Checking that every required capability has a provider installable in this edition...
   → Checking package docs (ADR-0046)...
 
 
@@ -305,7 +305,7 @@ visible: 'status != "resolved"'
 ◆ Validate
 ────────────────────────────────────────
   → Validating against ObjectStack Protocol...
-  → Running author-time rules (57)...
+  → Running author-time rules (58)...
 
   ✗ Author-time rules failed (1 issue)
   • stack · action 'resolve_ticket' visible: bare reference `status` — a
 
@@ -404,7 +404,7 @@ objectstack validate
 ────────────────────────────────────────
   → Loading configuration...
   → Validating against ObjectStack Protocol...
-  → Running author-time rules (57)...
+  → Running author-time rules (58)...
   → Checking that every required capability has a provider installable in this edition...
   → Checking package docs (ADR-0046)...
 
 
@@ -113,6 +113,7 @@ import { validateReferenceIntegrity } from './reference-integrity-suite.js';
 import { validateComponentProps } from './validate-component-props.js';
 import { validateComponentTypes } from './validate-component-types.js';
 import { validatePrintPageBlocks } from './validate-print-page-blocks.js';
+import { validatePageVariables } from './validate-page-variables.js';
 import { validatePagePredicateBounds } from './validate-page-predicate-bounds.js';
 import { validateResponsiveStyles } from './validate-responsive-styles.js';
 import { validateJsxPages } from './validate-jsx-pages.js';
@@ -1355,6 +1356,26 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
     runtimeTypes: ['page'],
     run: (stack) => validatePrintPageBlocks(stack),
   },
+  // #28663 — a page's `variables` declarations: each named once, by a
+  // non-empty name, with a `defaultValue` of its declared `type`. The schema
+  // types each entry alone and nothing judged the list, so a duplicate name
+  // (the console keeps the last), an empty name (unreachable as `page.NAME`)
+  // and a `number` seeded with `"abc"` all published `valid: true`. Gating on
+  // every door from birth: page-local, so a `page` write's per-write snapshot
+  // (`pages: [item]`) is the whole input. Measured at birth: the shipped
+  // corpus declares 5 variables on 2 showcase pages, 0 findings. Stored pages
+  // keep loading and serving; only the next save of one with a finding is
+  // refused, with the fix.
+  {
+    name: 'validatePageVariables',
+    tier: 'gating',
+    input: 'normalized',
+    commands: ALL,
+    source: 'packages/lint/src/validate-page-variables.ts',
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ['page'],
+    run: (stack) => validatePageVariables(stack),
+  },
   // ADR-0065 — a styled node's responsiveStyles must be scopable (needs an
   // `id`), name real CSS properties + design tokens, and carry a `large` base.
   {
@@ -1782,14 +1803,31 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
   // `visibleWhen` only, the one key the family reads — on a page component as
   // on a view form (the page-side `visibility` retired with the view-side
   // `visibleOn`).
+  //
+  // ─── …and on `app` writes (#28663) ───
+  //
+  // An app navigation entry's `visible` is a predicate the console evaluates
+  // as CEL (#27457), and its gate falls CLOSED: a `visible` that does not parse
+  // hides the entry from every viewer. Before this, `"'org_owner' in"` there
+  // saved, read `valid: true` as a draft, published and passed `os validate`,
+  // while the same fault in a page `visibleWhen` was refused. The rule now
+  // walks `apps[].navigation` / `areas[].navigation` (and `children`) for the
+  // SYNTAX verdict alone — the rule's module note says why the root-binding
+  // verdicts stay off a nav entry. `app` maps to `apps`, and an app snapshot
+  // holds the item as `apps: [item]` with no `views` or `pages`, so the view
+  // and page halves contribute nothing on an app write, as the app half
+  // contributes nothing on a view or page write. `validatePredicatePathRefs`
+  // declares `app` with it for the one-wall reason above and judges nothing
+  // there. Stored apps keep loading and serving; only the next save of an app
+  // with such a predicate is refused, with the fix.
   {
     name: 'validateVisibilityPredicates',
     tier: 'gating',
     input: 'normalized',
     commands: ALL,
     source: 'packages/lint/src/validate-visibility-predicates.ts',
     surfaces: CLI_AND_RUNTIME,
-    runtimeTypes: ['view', 'page'],
+    runtimeTypes: ['view', 'page', 'app'],
     run: (stack) => validateVisibilityPredicates(stack),
   },
   // #7010 — the same predicate surface, one question further in. The three
@@ -1828,9 +1866,10 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
     // was reverted; it is wired now because its siblings are. It declares
     // `page` with its sibling (#24491, ruling B on #23388) and judges nothing
     // there: it walks `stack.views` only, so a page write draws no finding from
-    // it at either door.
+    // it at either door. `app` likewise (#28663): declared with its sibling,
+    // judging nothing on an app write.
     surfaces: CLI_AND_RUNTIME,
-    runtimeTypes: ['view', 'page'],
+    runtimeTypes: ['view', 'page', 'app'],
     run: (stack) => validatePredicatePathRefs(stack),
   },
   // #24953 — the CEL slots INSIDE a page component's `properties` bag (a
 
@@ -674,6 +674,16 @@ export {
 } from './validate-print-page-blocks.js';
 export type { PrintPageBlockFinding } from './validate-print-page-blocks.js';
 
+// #28663 — a page's `variables` declarations: unique, named, and seeded with
+// a `defaultValue` of the declared `type`.
+export {
+  validatePageVariables,
+  PAGE_VARIABLE_NAME_DUPLICATE,
+  PAGE_VARIABLE_NAME_EMPTY,
+  PAGE_VARIABLE_DEFAULT_TYPE,
+} from './validate-page-variables.js';
+export type { PageVariableFinding } from './validate-page-variables.js';
+
 // #24953 — a CEL slot inside a page component's `properties` (a `page:tabs`
 // item `visibleWhen`, an `object-form` section predicate, an `action:*`
 // `visible`, …) over the platform's parse bounds. A warning in 18.x.
 
@@ -962,6 +962,11 @@ const VISIBILITY_PREDICATE_SYNTAX_EXPLANATION: RuleExplanation = {
       'evaluate, and the console falls OPEN: the element renders unconditionally and looks exactly like ' +
       'one with no predicate at all (failing open is the console\'s settled behaviour). Every other ' +
       'predicate surface already gates a syntax fault (ADR-0032), so this one does too.',
+    'An app navigation entry\'s `visible` is judged the same way, and there the cost is the opposite ' +
+      'one: the console\'s navigation gate falls CLOSED, so an entry whose predicate does not parse is ' +
+      'hidden from every viewer, its author included. Only the syntax is judged on a navigation entry: ' +
+      'it binds `current_user`, `user`, `features` and the rest of the shell\'s roots rather than ' +
+      '`record`, so the reference checks a page predicate gets do not apply to it.',
     'Spellings from other languages do not parse: write `==` (not `===`), `!=` (not `!==` or `<>`), ' +
       '`&&` (not `and`), `||` (not `or`), `!` (not `not`). A predicate that is flawless CEL but too ' +
       'large is `visibility-predicate-over-budget` instead.',
@@ -2713,6 +2718,53 @@ const PRINT_PAGE_BLOCK_UNPRINTABLE_EXPLANATION: RuleExplanation = {
   ],
 };
 
+// ── Page variables (`validate-page-variables.ts`) ───────────────────────────
+
+const PAGE_VARIABLE_NAME_DUPLICATE_EXPLANATION: RuleExplanation = {
+  rule: 'page-variable-name-duplicate',
+  covers: 'why a page variable name may be declared only once',
+  paragraphs: [
+    'A page variable is page-local state that predicates read as `page.NAME` and an element writes ' +
+      'through its `source` binding. The console seeds the page\'s variable store from the declarations ' +
+      'in order, so a second declaration of the same name silently replaces the first: the first one\'s ' +
+      '`type` and `defaultValue` are gone, and nothing says so.',
+    'It is an error on every authoring door — `os validate`, `os build`, `os lint` and the page save ' +
+      'door (Studio, REST, MCP), including a draft\'s diagnostics and its publish. Rename one of the two ' +
+      'or remove the duplicate. A stored page keeps loading and serving; only its next save is judged.',
+  ],
+};
+
+const PAGE_VARIABLE_NAME_EMPTY_EXPLANATION: RuleExplanation = {
+  rule: 'page-variable-name-empty',
+  covers: 'why a page variable needs a name',
+  paragraphs: [
+    'A page variable is reached only by its name: predicates read it as `page.NAME`, and an element ' +
+      'writes it through its `source` binding. A declaration whose name is empty or blank can be neither ' +
+      'read nor written, so it is a declaration that does nothing while looking like one that works.',
+    'It is an error on every authoring door — `os validate`, `os build`, `os lint` and the page save ' +
+      'door (Studio, REST, MCP), including a draft\'s diagnostics and its publish. Name the variable or ' +
+      'remove the entry.',
+  ],
+};
+
+const PAGE_VARIABLE_DEFAULT_TYPE_EXPLANATION: RuleExplanation = {
+  rule: 'page-variable-default-type',
+  covers: 'which `defaultValue` each page variable type admits',
+  paragraphs: [
+    'A page variable starts with its `defaultValue`, or with its type\'s empty value when the default ' +
+      'is omitted: `\'\'` for `string` and `record_id`, `0` for `number`, `false` for `boolean`, `{}` ' +
+      'for `object`, `[]` for `array`. A default of another kind — `defaultValue: "abc"` on a `number` ' +
+      'variable — is seeded as written, so every predicate that reads it compares the wrong kind of ' +
+      'value while the declaration claims otherwise.',
+    'Admitted: a string for `string` and `record_id`, a finite number for `number`, `true` or `false` ' +
+      'for `boolean`, a plain object for `object`, an array for `array`, and `null` for any type ' +
+      '("no value yet"). A variable with no `type` is a `string` variable, as the schema defaults it.',
+    'It is an error on every authoring door — `os validate`, `os build`, `os lint` and the page save ' +
+      'door (Studio, REST, MCP), including a draft\'s diagnostics and its publish. Fix the default, omit ' +
+      'it, or declare the type the default really has.',
+  ],
+};
+
 // ── Filter comparands (`validate-preset-comparands.ts`) ────────────────────
 
 const FILTER_PRESET_COMPARAND_EXPLANATION: RuleExplanation = {
@@ -5384,6 +5436,9 @@ export const RULE_EXPLANATIONS: Readonly<Record<string, RuleExplanation>> = Obje
   [COMPONENT_TYPE_UNKNOWN_EXPLANATION.rule]: COMPONENT_TYPE_UNKNOWN_EXPLANATION,
   [COMPONENT_PROPS_INVALID_EXPLANATION.rule]: COMPONENT_PROPS_INVALID_EXPLANATION,
   [PRINT_PAGE_BLOCK_UNPRINTABLE_EXPLANATION.rule]: PRINT_PAGE_BLOCK_UNPRINTABLE_EXPLANATION,
+  [PAGE_VARIABLE_NAME_DUPLICATE_EXPLANATION.rule]: PAGE_VARIABLE_NAME_DUPLICATE_EXPLANATION,
+  [PAGE_VARIABLE_NAME_EMPTY_EXPLANATION.rule]: PAGE_VARIABLE_NAME_EMPTY_EXPLANATION,
+  [PAGE_VARIABLE_DEFAULT_TYPE_EXPLANATION.rule]: PAGE_VARIABLE_DEFAULT_TYPE_EXPLANATION,
   [FILTER_PRESET_COMPARAND_EXPLANATION.rule]: FILTER_PRESET_COMPARAND_EXPLANATION,
   [FILTER_TOKEN_UNKNOWN_EXPLANATION.rule]: FILTER_TOKEN_UNKNOWN_EXPLANATION,
   [APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY_EXPLANATION.rule]: APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY_EXPLANATION,