@@ -196,6 +196,13 @@ const CALLERS: Record<string, Classification> = {
       'built metadata artifact offline, only to score whether the reference resolves to an object the build carries; ' +
       'it reads no record and serves nothing of the target to any caller',
   },
+  'packages/qa/scenarios/src/score/scenario-tags.ts': {
+    kind: 'not-a-served-read',
+    reason:
+      "the scenario scorer's capability-tag checks: they read a field's declared target out of a built metadata " +
+      "artifact offline (whether an approver's field holds a user, a controlled-by-parent detail's master), only to " +
+      'judge a capability check; they read no record and serve nothing of the target to any caller',
+  },
   'packages/lint/src/object-graph.ts': {
     kind: 'not-a-served-read',
     reason: 'authoring-time static analysis of metadata; reads no record',
 
@@ -76,11 +76,18 @@ discrimination test; ⛔ never match by area prefix.
 | `records-forms.master-detail-inline-edit` | has every master-detail field resolving, and one of them edited inline on its master (`inlineEdit`) |
 | `records-forms.roll-up-summary` | carries a roll-up summary, each reading a child object that relates back and, unless it counts, a child field that exists |
 | `records-forms.select-options` | carries a single-choice option field (`select`, `radio`), each offering at least two options |
+| `records-forms.formula-field` | carries a computed field (a `formula` field, or a stored field with an `expression`), each expression compiling at `record` scope against its object's columns |
+| `records-forms.validation-rule` | carries an active, refusing (`severity: 'error'`) validation rule on an object the card names, every rule's predicates (nested ones included) compiling against its object |
 | `access-security.field-permissions` | denies (`readable: false`, in a permission set) every field a card persona hides, and has that field |
 | `access-security.row-scope` | keeps every object a persona's `scope` names private (owner-scoped) or derived from its master, or narrows it for each such persona by a read policy (`rowLevelSecurity`, `select` or `all`, no `positions`, a `using` that is not `true`) on that persona's permission set |
+| `access-security.row-level-security` | keeps every object a persona's `scope` names to that persona by a route that enforces: private, a detail whose master is itself kept so, or a narrowing read policy on its permission set; and every read policy that applies there lowers to a query filter |
 | `approvals.approval-flow` | carries an approval (a flow with an Approval node), each bound to an object it serves, one bound to an object the card names |
+| `approvals.multi-step-approval` | carries an approval flow, bound to an object the card names, in which a second Approval node follows the first on its `approve` branch |
+| `approvals.dynamic-approver-routing` | routes an Approval node of a flow bound to an object the card names to an approver read off the record (`field`, `manager`, `expression`), each one able to name someone: a field holding a user, an expression over `current` / `trigger` / `vars` |
 | `automation.record-triggered-flow` | carries a record-triggered flow, each bound to an object it serves, one bound to an object the card names |
 | `dashboards.widget-measures` | carries a dashboard widget with a measure, and every widget measure resolves on the dataset it binds |
+| `dashboards.report` | carries a report whose dataset binds an object the card names, every report selecting only measures and dimensions its datasets declare |
+| `ai.agent-actions` | carries every action in `run.agentActions` on its object, AI-exposed and confirm-gated where the card says `confirm` (the agent-action checks) |
 
 ## Running the cards — `@objectstack/scenarios/runner`
 
 
@@ -68,6 +68,7 @@
   },
   "dependencies": {
     "@objectstack/core": "workspace:*",
+    "@objectstack/formula": "workspace:*",
     "@objectstack/objectql": "workspace:*",
     "@objectstack/plugin-sharing": "workspace:*",
     "@objectstack/spec": "workspace:*",
 
@@ -0,0 +1,95 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * What the platform's own expression front end (`@objectstack/formula`) says of
+ * the expressions a built artifact carries: the reads behind the capability-tag
+ * checks that ask whether an expression COMPILES or ENFORCES
+ * (`scenario-tags.ts`). Each answer is the verdict of the function the platform
+ * runs at that site, never a parser of this package's:
+ *
+ *  - a computed field's `expression` and a validation rule's predicates:
+ *    `validateExpression`, the shared validator `os validate` / `os build` run
+ *    over every formula and predicate (`@objectstack/lint`'s
+ *    `validate-expressions.ts`), at `record` scope against the object's
+ *    columns (its declared fields and the system columns the registry injects,
+ *    `resolveInjectedSystemColumns`) and its declared field types, with a
+ *    relationship traversal judged the way the engine serves one at both sites
+ *    (`traversalHydration`: one hop through a reference, never two);
+ *  - an `expression` approver: `collectCelRootIdentifiers` over the closed root
+ *    set `APPROVER_EXPRESSION_ROOTS`, the pre-check plugin-approvals runs at
+ *    node entry and the `approval-expression-invalid` lint mirrors;
+ *  - an RLS `using`: `isSupportedRlsExpression`, the one shape gate
+ *    plugin-security compiles with. `false` there is a predicate that never
+ *    lowers to a filter, so its policy matches no row.
+ *
+ * What it does NOT re-run is the build's further site rules over the same
+ * sources: the null guard, type soundness under the site's fault outcome, a
+ * hop into a field the target object lacks, `label()` over an optionless
+ * field. An artifact `os build` wrote has passed those; a source that parses
+ * and reads only real columns passes here even where the build would also
+ * have flagged one of them.
+ *
+ * Deterministic: no model call, no network.
+ */
+
+import { collectCelRootIdentifiers, isSupportedRlsExpression, validateExpression } from '@objectstack/formula';
+import { APPROVER_EXPRESSION_ROOTS } from '@objectstack/spec/automation';
+import { resolveInjectedSystemColumns } from '@objectstack/spec/data';
+
+type Bag = Record<string, unknown>;
+
+const isBag = (value: unknown): value is Bag => !!value && typeof value === 'object' && !Array.isArray(value);
+
+/** The source text of an expression slot: a bare string or the `{ dialect, source }` envelope the parse writes. */
+export function expressionSource(raw: unknown): string | undefined {
+  const source = isBag(raw) ? raw.source : raw;
+  return typeof source === 'string' && source.trim() !== '' ? source : undefined;
+}
+
+/** The columns a `record`-scoped expression on this object can read: its declared fields and the injected ones. */
+function objectColumns(def: Bag): string[] {
+  const declared = isBag(def.fields) ? Object.keys(def.fields) : [];
+  return [...new Set([...declared, ...resolveInjectedSystemColumns(def).names])];
+}
+
+/** Declared field name → its type, the index the build's pass hands the validator (a reference type is a hop). */
+function declaredFieldTypes(def: Bag): Record<string, string> {
+  const types: Record<string, string> = {};
+  for (const [name, field] of isBag(def.fields) ? Object.entries(def.fields) : []) {
+    if (isBag(field) && typeof field.type === 'string') types[name] = field.type;
+  }
+  return types;
+}
+
+/**
+ * Why a `record`-scoped expression of `object` does not compile, or
+ * `undefined` when it does: `value` for a computed field, `predicate` for a
+ * validation rule. An absent or blank source is a refusal here, never the
+ * validator's vacuous pass.
+ */
+export function recordExpressionRefusal(role: 'value' | 'predicate', raw: unknown, object: string, def: Bag): string | undefined {
+  const source = expressionSource(raw);
+  if (source === undefined) return 'declares no expression';
+  const verdict = validateExpression(role, isBag(raw) ? (raw as { dialect?: string; source?: string }) : source, {
+    objectName: object,
+    fields: objectColumns(def),
+    fieldTypes: declaredFieldTypes(def),
+    scope: 'record',
+    traversalHydration: true,
+  });
+  return verdict.ok ? undefined : (verdict.errors[0]?.message ?? 'does not compile');
+}
+
+/** Why an `expression` approver cannot route, or `undefined`: it parses and reads only `current` / `trigger` / `vars`. */
+export function approverExpressionRefusal(raw: unknown): string | undefined {
+  const source = expressionSource(raw);
+  if (source === undefined) return 'declares no expression';
+  const parsed = collectCelRootIdentifiers(source);
+  if (!parsed.ok) return `does not parse as CEL: ${parsed.error}`;
+  const roots = new Set<string>(APPROVER_EXPRESSION_ROOTS);
+  const foreign = parsed.roots.filter((r) => !roots.has(r));
+  return foreign.length === 0 ? undefined : `reads ${foreign.join(', ')}, and an approver expression reads only ${[...roots].join(', ')}`;
+}
+
+/** Whether an RLS `using` lowers to a query filter, so its policy enforces (`isSupportedRlsExpression`). */
+export const rlsPredicateEnforces = (using: string): boolean => isSupportedRlsExpression(using);