@@ -0,0 +1,13 @@
+---
+'@objectstack/cli': patch
+'@objectstack/spec': patch
+---
+
+fix(cli): `os validate --target` no longer refuses the engine's `parallel` and `try_catch` containers
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+A restriction profile's `allowedFlowNodeTypes` can only list `FlowNodeAction` ids, and the ADR-0031 containers `parallel` and `try_catch` are engine built-ins that are not among them. Under `allowCode: false`, `os validate --target` refused them as if a code plugin had registered them, and no profile could allow them. They are now structural, like `start` and `end`: always allowed, while every node inside their branches, `try` and `catch` regions is still judged. `loop` is a `FlowNodeAction` id and is still judged by the list.
+
+The `allowedFlowNodeTypes` docblock on `RestrictionProfileSchema` now states the reader rules: `start` / `end` and the two containers are always allowed, a `script` node is also subject to `allowCode`, and a node type outside the vocabulary is governed by `allowCode`. The `allowCode` docblock states which keys a reader takes as code, and that `devPlugins` is not one of them: `os build` leaves it out of the artifact a target installs. No schema shape or value set changes.
@@ -11,7 +11,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { FLOW_BUILTIN_NODE_TYPES } from '@objectstack/spec/automation';
+import { FLOW_BUILTIN_NODE_TYPES, LOOP_NODE_TYPE, PARALLEL_NODE_TYPE, TRY_CATCH_NODE_TYPE } from '@objectstack/spec/automation';
 
 import {
   judgeRestrictionProfile,
@@ -142,6 +142,46 @@ describe('judgeRestrictionProfile — the reader rules', () => {
     expect(rowsOf(profile({ allowedFlowNodeTypes: [] }), stack)).toEqual([]);
   });
 
+  /** One flow holding both ADR-0031 containers that FlowNodeAction does not name, each with a node inside. */
+  const CONTAINERS = {
+    manifest: STACK.manifest,
+    flows: [flow('rp_blocks', [
+      node('start', 'start'),
+      node('fan', PARALLEL_NODE_TYPE, { config: { branches: [{ nodes: [node('send', 'notify')], edges: [] }] } }),
+      node('guard', TRY_CATCH_NODE_TYPE, {
+        config: { try: { nodes: [node('fetch', 'get_record')], edges: [] }, catch: { nodes: [node('warn', 'notify')], edges: [] } },
+      }),
+      node('end', 'end'),
+    ])],
+  };
+
+  it('parallel / try_catch are always allowed — by a list that omits them AND under allowCode: false — while their nodes are judged', () => {
+    expect(FLOW_BUILTIN_NODE_TYPES).not.toContain(PARALLEL_NODE_TYPE);
+    expect(FLOW_BUILTIN_NODE_TYPES).not.toContain(TRY_CATCH_NODE_TYPE);
+    const rows = rowsOf(profile({ allowCode: false, allowedFlowNodeTypes: ['get_record'] }), CONTAINERS);
+    expect(rows.filter((r) => r.where.endsWith(`(${PARALLEL_NODE_TYPE})`) || r.where.endsWith(`(${TRY_CATCH_NODE_TYPE})`))).toEqual([]);
+    expect(rows.map(({ rule, path }) => ({ rule, path }))).toEqual([
+      { rule: 'allowedFlowNodeTypes', path: 'flows[0].nodes[1].config.branches[0].nodes[0]' },
+      { rule: 'allowedFlowNodeTypes', path: 'flows[0].nodes[2].config.catch.nodes[0]' },
+    ]);
+    expect(rowsOf(profile({ allowCode: false, allowedFlowNodeTypes: ['get_record', 'notify'] }), CONTAINERS)).toEqual([]);
+  });
+
+  it('loop is a FlowNodeAction id, so allowedFlowNodeTypes judges it — it is not a structural container', () => {
+    expect(FLOW_BUILTIN_NODE_TYPES).toContain(LOOP_NODE_TYPE);
+    const stack = {
+      manifest: STACK.manifest,
+      flows: [flow('rp_each', [
+        node('start', 'start'),
+        node('each', LOOP_NODE_TYPE, { config: { body: { nodes: [node('send', 'notify')], edges: [] } } }),
+        node('end', 'end'),
+      ])],
+    };
+    expect(rowsOf(profile({ allowedFlowNodeTypes: ['notify'] }), stack)).toEqual([
+      { rule: 'allowedFlowNodeTypes', where: "flow 'rp_each' › node 'each' (loop)", path: 'flows[0].nodes[1]' },
+    ]);
+  });
+
   it('a type outside FlowNodeAction is governed by allowCode: refused naming allowCode when it is false', () => {
     const rows = judgeRestrictionProfile(STACK, profile({ allowCode: false })).filter((r) => r.where.includes('(approval)'));
     expect(rows.map((r) => r.rule)).toEqual(['allowCode']);
 
@@ -43,7 +43,13 @@
  *
  *  1. `start` / `end` (`FLOW_STRUCTURAL_NODE_TYPES`) are always allowed: the
  *     engine handles them without an executor, and a profile that had to list
- *     them to allow any flow at all would be a trap.
+ *     them to allow any flow at all would be a trap. So are the ADR-0031
+ *     containers `parallel` and `try_catch` ({@link FLOW_CONTAINER_NODE_TYPES}):
+ *     engine built-ins that are not `FlowNodeAction` ids, so no profile could
+ *     name them, and reader rule 2 would otherwise refuse them as code. A
+ *     container only holds regions; every node inside it is still judged.
+ *     (`loop`, the third container, IS a `FlowNodeAction` id, so
+ *     `allowedFlowNodeTypes` judges it like any built-in.)
  *  2. A node type outside the spec's built-in registry (`FlowNodeAction` /
  *     `FLOW_BUILTIN_NODE_TYPES`) cannot be named by `allowedFlowNodeTypes`, so
  *     it is governed by `allowCode`, and its refusal names that rule.
@@ -59,6 +65,8 @@ import { isAbsolute, join, resolve } from 'node:path';
 import {
   FLOW_BUILTIN_NODE_TYPES,
   FLOW_STRUCTURAL_NODE_TYPES,
+  PARALLEL_NODE_TYPE,
+  TRY_CATCH_NODE_TYPE,
   collectFlowGraphs,
   type FlowNodeParsed,
 } from '@objectstack/spec/automation';
@@ -150,6 +158,14 @@ export function loadRestrictionProfile(
   return { profile: parsed.data, file };
 }
 
+/**
+ * Reader rule 1, second half: the ADR-0031 containers the engine ships that
+ * `FlowNodeAction` does not name, read off the spec's own type-id constants.
+ * Structural like `start` / `end`: always allowed, while the nodes in their
+ * regions are judged (`collectFlowGraphs` walks into every region).
+ */
+const FLOW_CONTAINER_NODE_TYPES: readonly string[] = [PARALLEL_NODE_TYPE, TRY_CATCH_NODE_TYPE];
+
 /**
  * The keys the spec classifies as code that never reach a target, so
  * `allowCode` does not read them. `devPlugins` is loaded only by a local
@@ -300,8 +316,8 @@ function judgeNodeType(
   allowCode: boolean,
   allowed: ReadonlySet<string>,
 ): { rule: RestrictionRule; message: string } | undefined {
-  // Reader rule 1: structural types are always allowed.
-  if (FLOW_STRUCTURAL_NODE_TYPES.includes(type)) return undefined;
+  // Reader rule 1: structural types and the ADR-0031 containers are always allowed.
+  if (FLOW_STRUCTURAL_NODE_TYPES.includes(type) || FLOW_CONTAINER_NODE_TYPES.includes(type)) return undefined;
   // Reader rule 3: a `script` node calls code; under `allowCode: false` that rule alone refuses it.
   if (type === 'script' && !allowCode) {
     return {
 
@@ -66,6 +66,18 @@ export const RestrictionProfileSchema = lazySchema(() => strictObject(
      * named handler `functions`, and code plugins.
      *
      * `false` refuses every one of them; `true` allows them.
+     *
+     * ## Reader rule
+     *
+     * Besides `hooks`, a reader takes what is code from the spec's one
+     * classification of a package body's keys, `UNMANAGED_INSTALL_KEY_DISPOSITIONS`
+     * (`@objectstack/spec/kernel`, disposition `code`), and a key that carries
+     * nothing refuses nothing. `devPlugins` is not judged by `allowCode`: it
+     * is loaded only by a local development boot, and `os build` leaves it out
+     * of the artifact a target installs, so it never reaches a target;
+     * `UNMANAGED_INSTALL_KEY_DISPOSITIONS` still classifies it as `code` for an
+     * unmanaged install. A `script` flow node is also subject to this rule (see
+     * `allowedFlowNodeTypes`).
      */
     allowCode: z
       .boolean()
@@ -91,6 +103,26 @@ export const RestrictionProfileSchema = lazySchema(() => strictObject(
      * forbidden; a type the registry does not name is refused here.
      *
      * An empty array allows no built-in node type.
+     *
+     * ## Reader rules
+     *
+     * A reader judges every node of every flow, at every region depth, by
+     * these rules, and names exactly one dimension per refused node:
+     *
+     * - `start` / `end` are structural and always allowed, listed or not: the
+     *   engine runs them without an executor, so a profile never has to list
+     *   them for a flow to run at all.
+     * - The ADR-0031 containers `parallel` and `try_catch` are structural too
+     *   and always allowed: engine built-ins that are not `FlowNodeAction` ids,
+     *   so no profile could list them. A container only holds regions, and
+     *   every node inside them is still judged. (`loop`, the third container,
+     *   is a `FlowNodeAction` id and is judged by this list.)
+     * - A `script` node calls a registered function, so it is also subject to
+     *   `allowCode`: under `allowCode: false` it is refused by `allowCode`
+     *   alone, and under `allowCode: true` by this list.
+     * - A node type outside the profile's vocabulary cannot be named by this
+     *   list, so `allowCode` governs it: refused under `allowCode: false`,
+     *   allowed under `allowCode: true`.
      */
     allowedFlowNodeTypes: z
       .array(FlowNodeAction)