@@ -0,0 +1,18 @@
+---
+'@objectstack/lint': minor
+---
+
+**BREAKING** fix(lint)!: a page variable `source` naming no component on the page, and a page predicate reading a `page.NAME` the page does not declare, are refused
+
+Clause-②: no (narrowing)
+Metadata-protocol: narrowed
+Skills-docs: none — no file under `skills/**` teaches a page variable's `source` binding or `page.NAME` reads; both refusals carry their own fix and `os explain` entries.
+
+<!-- adr-0087: not-required (no-migration-prescription) The narrowing is a refusal at the authoring doors (the metadata save door, a draft's diagnostics and its publish, and os validate / os build / os lint) of two references that never resolved at runtime: a page variable `source` that names no component id on the page (the console binds the writer by exact id, so nothing ever writes the variable), and a page component `visibleWhen` reading `page.NAME` for a `NAME` the page's `variables` does not declare (the read faults and the element renders unconditionally). No metadata key, accepted key, export or error code is removed or renamed, and no stored shape changes. The fix is the author's choice of the component id or variable name they meant, so there is no mechanical conversion for `objectstack migrate meta` to apply; the shipped corpus (examples, platform packages) carries 3 variable `source` bindings and 5 `page.NAME` predicate reads (all on two showcase pages), none of them refused. -->
+
+#28663 judged a page's `variables` list itself. Two references into that list still saved, read `valid: true` as drafts, published and passed `os validate`, though neither can ever resolve:
+
+- `page-variable-source-unknown` (in `validatePageVariables`): a variable whose `source` names a component `id` the page does not hold. The console binds a writer element by comparing its `id` with `source` exactly, so no element writes the variable and it keeps its default for the page's whole life. Components nested inside containers count; a page authored as code (`kind: 'react'` or `'html'`) is not judged, since its components live in the code. Located at `variables[i].source`.
+- `visibility-page-variable-undeclared` (in `validateVisibilityPredicates`): a page component `visibleWhen` reading `page.NAME` (or `page.?NAME`) where the page declares no variable `NAME`. `page` holds the page's declared variables and nothing else, so the read faults and the element always renders. Judged from the predicate's existing parse; an index read (`page['x']`) and a predicate whose comprehension binds `page` as its loop variable are not judged. Located at the component.
+
+**Where.** The metadata save door (`PUT /api/v1/meta/page/:name`, Studio, MCP), a draft's `_diagnostics`, the publish (`422 INVALID_METADATA`), and `os validate` / `os build` / `os lint`. Stored pages keep loading and serving; only the next save of one with a finding is refused, with the fix.
@@ -279,6 +279,7 @@ export {
   VISIBILITY_PREDICATE_OVER_BUDGET,
   VISIBILITY_PREDICATE_UNKNOWN_FUNCTION,
   VISIBILITY_PREDICATE_HAS_ARGUMENT,
+  VISIBILITY_PAGE_VARIABLE_UNDECLARED,
 } from './validate-visibility-predicates.js';
 export type {
   VisibilityFinding,
@@ -675,12 +676,14 @@ export {
 export type { PrintPageBlockFinding } from './validate-print-page-blocks.js';
 
 // #28663 — a page's `variables` declarations: unique, named, and seeded with
-// a `defaultValue` of the declared `type`.
+// a `defaultValue` of the declared `type`; #28725 — a `source` naming a
+// component the page holds.
 export {
   validatePageVariables,
   PAGE_VARIABLE_NAME_DUPLICATE,
   PAGE_VARIABLE_NAME_EMPTY,
   PAGE_VARIABLE_DEFAULT_TYPE,
+  PAGE_VARIABLE_SOURCE_UNKNOWN,
 } from './validate-page-variables.js';
 export type { PageVariableFinding } from './validate-page-variables.js';
 
 
@@ -1014,6 +1014,22 @@ const VISIBILITY_PREDICATE_HAS_ARGUMENT_EXPLANATION: RuleExplanation = {
   ],
 };
 
+const VISIBILITY_PAGE_VARIABLE_UNDECLARED_EXPLANATION: RuleExplanation = {
+  rule: 'visibility-page-variable-undeclared',
+  covers: 'which page variables a page predicate can read',
+  paragraphs: [
+    'On a page component `page` holds the page\'s own variables and nothing else: the console seeds it ' +
+      'from the page\'s `variables` declarations, and the only things that write it — an element bound ' +
+      'by a declaration\'s `source`, and a dashboard\'s filter bar — write declared names. So ' +
+      '`page.NAME` for a `NAME` no declaration carries is never there: the predicate cannot evaluate and ' +
+      'the console falls OPEN, rendering the element unconditionally.',
+    'It is an error on every authoring door — `os validate`, `os build`, `os lint` and the page save ' +
+      'door (Studio, REST, MCP), including a draft\'s diagnostics and its publish. Declare the variable ' +
+      'in the page\'s `variables`, or correct the name to one the page declares (names are compared ' +
+      'exactly, case included). A predicate that reads through an index (`page[\'x\']`) is not judged.',
+  ],
+};
+
 const VISIBILITY_BARE_IDENTIFIER_EXPLANATION: RuleExplanation = {
   rule: 'visibility-bare-identifier',
   covers: 'why every value is read through a namespace',
@@ -2772,6 +2788,22 @@ const PAGE_VARIABLE_DEFAULT_TYPE_EXPLANATION: RuleExplanation = {
   ],
 };
 
+const PAGE_VARIABLE_SOURCE_UNKNOWN_EXPLANATION: RuleExplanation = {
+  rule: 'page-variable-source-unknown',
+  covers: 'what a page variable `source` must name',
+  paragraphs: [
+    'A page variable\'s `source` is the `id` of the component that writes it — a record picker or a ' +
+      'text input on the same page. The console binds the writer by comparing that `id` exactly, so a ' +
+      '`source` no component on the page carries binds nothing: no element ever writes the variable, ' +
+      'and it keeps its default for as long as the page is open while the author believes it is fed.',
+    'It is an error on every authoring door — `os validate`, `os build`, `os lint` and the page save ' +
+      'door (Studio, REST, MCP), including a draft\'s diagnostics and its publish. Set `source` to the ' +
+      'writer\'s `id` (components nested inside a container count), give the writer that `id`, or drop ' +
+      '`source` when nothing on the page writes the variable. A page authored as `source` code ' +
+      '(`kind: \'react\'` or `\'html\'`) is not judged, because its components live in the code.',
+  ],
+};
+
 // ── Filter comparands (`validate-preset-comparands.ts`) ────────────────────
 
 const FILTER_PRESET_COMPARAND_EXPLANATION: RuleExplanation = {
@@ -5418,6 +5450,7 @@ export const RULE_EXPLANATIONS: Readonly<Record<string, RuleExplanation>> = Obje
   [VISIBILITY_PREDICATE_SYNTAX_EXPLANATION.rule]: VISIBILITY_PREDICATE_SYNTAX_EXPLANATION,
   [VISIBILITY_PREDICATE_UNKNOWN_FUNCTION_EXPLANATION.rule]: VISIBILITY_PREDICATE_UNKNOWN_FUNCTION_EXPLANATION,
   [VISIBILITY_PREDICATE_HAS_ARGUMENT_EXPLANATION.rule]: VISIBILITY_PREDICATE_HAS_ARGUMENT_EXPLANATION,
+  [VISIBILITY_PAGE_VARIABLE_UNDECLARED_EXPLANATION.rule]: VISIBILITY_PAGE_VARIABLE_UNDECLARED_EXPLANATION,
   [VISIBILITY_BARE_IDENTIFIER_EXPLANATION.rule]: VISIBILITY_BARE_IDENTIFIER_EXPLANATION,
   [HOOK_BODY_WRITE_UNKNOWN_FIELD_EXPLANATION.rule]: HOOK_BODY_WRITE_UNKNOWN_FIELD_EXPLANATION,
   [HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR_EXPLANATION.rule]: HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR_EXPLANATION,
@@ -5480,6 +5513,7 @@ export const RULE_EXPLANATIONS: Readonly<Record<string, RuleExplanation>> = Obje
   [PAGE_VARIABLE_NAME_DUPLICATE_EXPLANATION.rule]: PAGE_VARIABLE_NAME_DUPLICATE_EXPLANATION,
   [PAGE_VARIABLE_NAME_EMPTY_EXPLANATION.rule]: PAGE_VARIABLE_NAME_EMPTY_EXPLANATION,
   [PAGE_VARIABLE_DEFAULT_TYPE_EXPLANATION.rule]: PAGE_VARIABLE_DEFAULT_TYPE_EXPLANATION,
+  [PAGE_VARIABLE_SOURCE_UNKNOWN_EXPLANATION.rule]: PAGE_VARIABLE_SOURCE_UNKNOWN_EXPLANATION,
   [FILTER_PRESET_COMPARAND_EXPLANATION.rule]: FILTER_PRESET_COMPARAND_EXPLANATION,
   [FILTER_TOKEN_UNKNOWN_EXPLANATION.rule]: FILTER_TOKEN_UNKNOWN_EXPLANATION,
   [APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY_EXPLANATION.rule]: APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY_EXPLANATION,
 
@@ -0,0 +1,170 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #28725 — a page's references to its own variables are resolved at every door.
+ *
+ * ## The state this closes
+ *
+ * #28663 judged the `variables` list itself (names, defaults). Two references
+ * INTO it still published `valid: true` though neither can ever resolve:
+ *
+ * - a variable whose `source` names a component id the page does not hold —
+ *   the console binds a writer by `definitions.find((d) => d.source ===
+ *   schema.id)` (`usePageVariableBinding`), so no component ever writes it and
+ *   the variable keeps its default for the page's whole life;
+ * - a component `visibleWhen` reading `page.NAME` where `NAME` is not declared —
+ *   `page` binds exactly the page's declared variables (`buildNodeEvaluationScope`
+ *   → `PageVariablesProvider`, which seeds only the declarations and has no
+ *   writer for any other name), so the read faults and the element renders
+ *   unconditionally.
+ *
+ * Both are refused at `os validate` / `os build` / `os lint` and at the page
+ * save door (draft `_diagnostics`, publish), located at the reference.
+ */
+import { describe, expect, it } from 'vitest';
+import { runAuthoringRules } from './authoring-rules.js';
+import { runRuntimeAuthoringRules } from './runtime-gate.js';
+
+const SOURCE_UNKNOWN = 'page-variable-source-unknown';
+const READ_UNDECLARED = 'visibility-page-variable-undeclared';
+const IDS = new Set([SOURCE_UNKNOWN, READ_UNDECLARED]);
+
+/** A page with one picker (`project_picker`) and one gated panel. */
+const page = (variables: unknown[], visibleWhen: unknown = "page.selectedProjectId != ''") => ({
+  name: 'vars_page',
+  label: 'Vars',
+  type: 'app',
+  variables,
+  regions: [
+    {
+      name: 'main',
+      components: [
+        { type: 'page:header', properties: { title: 'Vars' } },
+        { id: 'project_picker', type: 'element:record_picker', dataSource: { object: 'project' }, properties: { label: 'Project', labelField: 'name' } },
+        { id: 'detail_panel', type: 'page:card', properties: { title: 'Detail' }, visibleWhen },
+      ],
+    },
+  ],
+});
+const PANEL = 'pages[0].regions[0].components[2]';
+const PICKED = { name: 'selectedProjectId', type: 'record_id', source: 'project_picker' };
+
+const gatePage = (item: unknown) => runRuntimeAuthoringRules({ type: 'page', item, context: { objects: [] } });
+const ours = <T extends { rule: string }>(fs: readonly T[]): T[] => fs.filter((f) => IDS.has(f.rule));
+const buildFindings = (item: unknown) => {
+  const stack = { pages: [item] };
+  return ours(runAuthoringRules('validate', { normalized: stack, parsed: stack }));
+};
+const dump = (r: unknown) => JSON.stringify(r, null, 2);
+
+const REFUSED = [
+  {
+    name: 'a `source` naming no component on the page (the card\'s shape)',
+    item: page([{ ...PICKED, source: 'no_such_component' }]),
+    rule: SOURCE_UNKNOWN,
+    path: 'pages[0].variables[0].source',
+    subject: '`no_such_component`',
+  },
+  {
+    name: 'a `source` naming a component of another page\'s spelling (case differs)',
+    item: page([{ ...PICKED, source: 'Project_Picker' }]),
+    rule: SOURCE_UNKNOWN,
+    path: 'pages[0].variables[0].source',
+    subject: '`Project_Picker`',
+  },
+  {
+    name: 'a `visibleWhen` reading an undeclared `page.nosuch` (the card\'s shape)',
+    item: page([PICKED], "page.nosuch == 'x'"),
+    rule: READ_UNDECLARED,
+    path: PANEL,
+    subject: '`page.nosuch`',
+  },
+  {
+    name: 'a `{ dialect, source }` envelope reading an undeclared variable',
+    item: page([PICKED], { dialect: 'cel', source: "page.selectedProjectID != ''" }),
+    rule: READ_UNDECLARED,
+    path: PANEL,
+    subject: '`page.selectedProjectID`',
+  },
+  {
+    name: 'an optional select `page.?nosuch`',
+    item: page([PICKED], "page.?nosuch.orValue('') == 'x'"),
+    rule: READ_UNDECLARED,
+    path: PANEL,
+    subject: '`page.nosuch`',
+  },
+  {
+    name: 'a `page.X` read on a page that declares no variables at all',
+    item: page([], "page.selectedProjectId != ''"),
+    rule: READ_UNDECLARED,
+    path: PANEL,
+    subject: '`page.selectedProjectId`',
+  },
+] as const;
+
+/** References that resolve, the showcase's own included. */
+const ACCEPTED = [
+  { name: 'the showcase picker: `source` names the picker, the panel reads the variable', item: page([PICKED]) },
+  { name: 'a variable with no `source` (nothing writes it but its default)', item: page([{ name: 'tab', type: 'string', defaultValue: 'a' }], "page.tab == 'a'") },
+  { name: 'a `has()` guard on a declared variable', item: page([PICKED], "has(page.selectedProjectId) && page.selectedProjectId != ''") },
+  { name: 'a deeper read through a declared object variable', item: page([PICKED, { name: 'filters', type: 'object' }], "page.filters.status == 'open'") },
+  { name: 'a comprehension binding `page` as its own loop variable', item: page([PICKED], "[1, 2].exists(page, page > 1)") },
+  { name: 'no `page` read at all', item: page([PICKED], "record.status == 'open'") },
+] as const;
+
+describe('#28725 — references into a page\'s variables are resolved at every door', () => {
+  for (const c of REFUSED) {
+    it(`⭐ LIT — ${c.name} is refused at the page door, located at the reference`, () => {
+      const result = gatePage(c.item);
+
+      const errs = ours(result.errors);
+      expect(errs, dump(result)).toHaveLength(1);
+      expect(errs[0]).toMatchObject({ rule: c.rule, severity: 'error', path: c.path, where: 'page "vars_page"' });
+      expect(errs[0]!.message).toContain(c.subject);
+    });
+  }
+
+  it('⭐ PARITY — `os validate` refuses each with the door\'s own finding', () => {
+    for (const c of REFUSED) {
+      const atBuild = buildFindings(c.item);
+      expect(atBuild, c.name).toHaveLength(1);
+      expect(ours(gatePage(c.item).errors), c.name).toEqual(atBuild);
+    }
+  });
+
+  for (const c of ACCEPTED) {
+    it(`⭐ CONTROL — ${c.name} is admitted at the door and by \`os validate\``, () => {
+      const result = gatePage(c.item);
+      expect(ours(result.errors), dump(result)).toEqual([]);
+      expect(ours(result.advisories), dump(result)).toEqual([]);
+      expect(buildFindings(c.item)).toEqual([]);
+    });
+  }
+
+  it('a `source` naming a component nested in a container\'s `children` resolves', () => {
+    const item = page([{ ...PICKED, source: 'nested_picker' }]);
+    (item.regions[0]!.components[2] as any).properties.children = [
+      { id: 'nested_picker', type: 'element:record_picker', dataSource: { object: 'project' }, properties: { label: 'Project', labelField: 'name' } },
+    ];
+    expect(ours(gatePage(item).errors)).toEqual([]);
+  });
+
+  it('a source-authored (`kind: \'react\'`) page is not judged on `source`: its components live in the source', () => {
+    const item = { ...page([{ ...PICKED, source: 'jsx_picker' }]), kind: 'react', source: 'export default () => null' };
+    expect(ours(gatePage(item).errors).filter((f) => f.rule === SOURCE_UNKNOWN)).toEqual([]);
+  });
+
+  it('two undeclared reads in one predicate are one finding naming the first', () => {
+    const errs = ours(gatePage(page([PICKED], "page.a == 'x' && page.b == 'y'")).errors);
+    expect(errs.map((f) => f.rule)).toEqual([READ_UNDECLARED]);
+    expect(errs[0]!.message).toContain('`page.a`');
+  });
+
+  it('both faults on one page are two findings, each at its own reference', () => {
+    const errs = ours(gatePage(page([{ ...PICKED, source: 'no_such_component' }], "page.nosuch == 'x'")).errors);
+    expect(errs.map((f) => [f.rule, f.path]).sort()).toEqual([
+      [SOURCE_UNKNOWN, 'pages[0].variables[0].source'],
+      [READ_UNDECLARED, PANEL],
+    ].sort());
+  });
+});
@@ -45,6 +45,7 @@ import {
   VISIBILITY_PREDICATE_SYNTAX,
   VISIBILITY_PREDICATE_HAS_ARGUMENT,
   VISIBILITY_PREDICATE_UNKNOWN_FUNCTION,
+  VISIBILITY_PAGE_VARIABLE_UNDECLARED,
   VISIBILITY_ROOT_MISLAYERED,
 } from './validate-visibility-predicates.js';
 import {
@@ -62,17 +63,23 @@ const FAMILY_IDS = new Set<string>([
   VISIBILITY_PREDICATE_SYNTAX,
   VISIBILITY_PREDICATE_HAS_ARGUMENT,
   VISIBILITY_PREDICATE_UNKNOWN_FUNCTION,
+  VISIBILITY_PAGE_VARIABLE_UNDECLARED,
   VISIBILITY_ROOT_MISLAYERED,
   PREDICATE_PATH_UNRESOLVED,
   PREDICATE_PATH_UNROOTED,
   PREDICATE_RHS_PATH_SHAPED,
 ]);
 
-/** One `page:header` whose props are declared, so a finding is the predicate's. */
+/**
+ * One `page:header` whose props are declared, so a finding is the predicate's.
+ * The page declares the one variable a control reads (#28725: an undeclared
+ * `page.NAME` read is refused).
+ */
 const page = (visibleWhen: unknown) => ({
   name: 'pipeline_home',
   label: 'Pipeline',
   type: 'app',
+  variables: [{ name: 'selectedProjectId', type: 'record_id' }],
   regions: [
     { name: 'main', components: [{ type: 'page:header', properties: { title: 'Pipeline' }, visibleWhen }] },
   ],