@@ -113,6 +113,7 @@ import { validateReferenceIntegrity } from './reference-integrity-suite.js';
 import { validateComponentProps } from './validate-component-props.js';
 import { validateComponentTypes } from './validate-component-types.js';
 import { validatePrintPageBlocks } from './validate-print-page-blocks.js';
+import { validatePagePredicateBounds } from './validate-page-predicate-bounds.js';
 import { validateResponsiveStyles } from './validate-responsive-styles.js';
 import { validateJsxPages } from './validate-jsx-pages.js';
 import { validateReactPages } from './validate-react-pages.js';
@@ -1704,6 +1705,26 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
     runtimeTypes: ['view', 'page'],
     run: (stack) => validatePredicatePathRefs(stack),
   },
+  // #24953 — the CEL slots INSIDE a page component's `properties` bag (a
+  // `page:tabs` item `visibleWhen`, `object-form` section / field predicates,
+  // `record:alert` / `action:*` `visible` and `disabled`), judged for the
+  // platform's parse bounds with `validateExpression`'s verdict. The component
+  // node's own `visibleWhen` is the visibility family's above, an error; these
+  // slots were judged by no rule at any door. `advisory` in 18.x: refusing a
+  // page that saves today is a narrowing no ADR-0087 conversion can carry, so
+  // under the standing ruling for post-GA narrowings (「甲」, record
+  // 6292005854) only the warning ships now and the refusal waits for the next
+  // major. Page-local, so the per-write snapshot is the whole input.
+  {
+    name: 'validatePagePredicateBounds',
+    tier: 'advisory',
+    input: 'normalized',
+    commands: ALL,
+    source: 'packages/lint/src/validate-page-predicate-bounds.ts',
+    surfaces: CLI_AND_RUNTIME,
+    runtimeTypes: ['page'],
+    run: (stack) => validatePagePredicateBounds(stack),
+  },
   // #1874 — flow authoring anti-patterns. Advisory by default; a finding marked
   // `error` gates. Three do today: `flow-runas-unscoped` (#3760 — metadata the
   // runtime REFUSES to execute), plus `flow-branch-label-unmatched` and
 
@@ -601,6 +601,15 @@ export {
 } from './validate-print-page-blocks.js';
 export type { PrintPageBlockFinding } from './validate-print-page-blocks.js';
 
+// #24953 — a CEL slot inside a page component's `properties` (a `page:tabs`
+// item `visibleWhen`, an `object-form` section predicate, an `action:*`
+// `visible`, …) over the platform's parse bounds. A warning in 18.x.
+export {
+  validatePagePredicateBounds,
+  PAGE_PREDICATE_OVER_BUDGET,
+} from './validate-page-predicate-bounds.js';
+export type { PagePredicateBoundsFinding } from './validate-page-predicate-bounds.js';
+
 export {
   validateChartBindings,
   CHART_DIMENSION_UNKNOWN,
 
@@ -0,0 +1,198 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #24953 — a CEL slot inside a page component's `properties` over the
+ * platform's parse bounds is reported, with `validateExpression`'s bounds
+ * verdict, at every door that accepts a page; a WARNING in 18.x (「甲」).
+ *
+ * The card's shape is a `page:tabs` item `visibleWhen` of ~390 AST nodes,
+ * which parsed through `PageSchema` and drew no finding anywhere while the
+ * console faulted on it at every evaluation and drew the tab for everyone.
+ */
+import { validateExpression } from '@objectstack/formula';
+import { PageSchema } from '@objectstack/spec/ui';
+import { describe, expect, it } from 'vitest';
+
+import { authoringRulesFor, runAuthoringRules } from './authoring-rules.js';
+import { runRuntimeAuthoringRules, runtimeAuthoringRulesFor } from './runtime-gate.js';
+import { PAGE_PREDICATE_OVER_BUDGET, validatePagePredicateBounds } from './validate-page-predicate-bounds.js';
+import { VISIBILITY_PREDICATE_OVER_BUDGET } from './validate-visibility-predicates.js';
+
+/** `n` `||` terms — five AST nodes each, so 78 terms is the card's ~390-node class. */
+const orChain = (n: number) => Array.from({ length: n }, (_, i) => `record.f${i} == ${i}`).join(' || ');
+const OVER_AST_NODES = orChain(78);
+/** 60-level parenthesis nest — `maxDepth`. */
+const OVER_DEPTH = `${'('.repeat(60)}record.a${')'.repeat(60)} == 1`;
+/** 200-element list literal — `maxListElements`. */
+const OVER_LIST = `record.id in [${Array.from({ length: 200 }, (_, i) => `'u${i}'`).join(',')}]`;
+const WITHIN = "record.stage == 'won' || page.tab != ''";
+
+const tabsPage = (tabVisibleWhen: unknown, nodeVisibleWhen?: unknown) => ({
+  name: 'deal_home',
+  label: 'Deal',
+  type: 'app',
+  regions: [
+    {
+      name: 'main',
+      components: [
+        {
+          type: 'page:tabs',
+          ...(nodeVisibleWhen === undefined ? {} : { visibleWhen: nodeVisibleWhen }),
+          properties: {
+            items: [
+              { label: 'Overview', value: 'overview', children: [] },
+              { label: 'Finance', value: 'finance', visibleWhen: tabVisibleWhen, children: [] },
+            ],
+          },
+        },
+      ],
+    },
+  ],
+});
+const TAB_PATH = 'pages[0].regions[0].components[0].properties.items[1].visibleWhen';
+
+const pageWith = (component: Record<string, unknown>) => ({
+  name: 'deal_home',
+  label: 'Deal',
+  type: 'app',
+  regions: [{ name: 'main', components: [component] }],
+});
+
+const ours = <T extends { rule: string }>(fs: readonly T[]): T[] => fs.filter((f) => f.rule === PAGE_PREDICATE_OVER_BUDGET);
+const gatePage = (item: unknown) => runRuntimeAuthoringRules({ type: 'page', item, context: { objects: [] } });
+
+describe('#24953 — the card\'s shape: a `page:tabs` item `visibleWhen` over `maxAstNodes`', () => {
+  it('premise: the source is over the bound by `validateExpression`, and `PageSchema` still accepts the page', () => {
+    const verdict = validateExpression('predicate', OVER_AST_NODES);
+    expect(verdict.errors.map((e) => e.code)).toEqual(['cel-too-large']);
+    expect(verdict.errors[0]!.params).toMatchObject({ limit: 'maxAstNodes', limitValue: 256 });
+    // Parse acceptance is unchanged by this rule — it is a finding, not a refusal.
+    expect(PageSchema.safeParse(tabsPage(OVER_AST_NODES)).success).toBe(true);
+  });
+
+  it('is a WARNING naming the field and the bound, at the slot, without echoing the source', () => {
+    const findings = validatePagePredicateBounds({ pages: [tabsPage(OVER_AST_NODES)] });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({
+      severity: 'warning',
+      rule: PAGE_PREDICATE_OVER_BUDGET,
+      where: 'page "deal_home" · page:tabs',
+      path: TAB_PATH,
+    });
+    expect(findings[0]!.message).toContain('`visibleWhen`');
+    expect(findings[0]!.message).toContain('`maxAstNodes` budget (platform limit 256)');
+    expect(findings[0]!.message).not.toContain('record.f0');
+  });
+
+  for (const command of ['validate', 'build', 'lint'] as const) {
+    it(`\`os ${command}\` reports it as a warning, never an error`, () => {
+      const stack = { pages: [tabsPage(OVER_AST_NODES)] };
+      const findings = runAuthoringRules(command, { normalized: stack, parsed: stack });
+      expect(ours(findings).map((f) => [f.severity, f.path])).toEqual([['warning', TAB_PATH]]);
+      expect(findings.filter((f) => f.severity === 'error')).toEqual([]);
+    });
+  }
+
+  it('the page publish door carries it on the advisories channel, the build\'s finding verbatim', () => {
+    const result = gatePage(tabsPage(OVER_AST_NODES));
+    expect(result.rulesRun).toContain('validatePagePredicateBounds');
+    expect(ours(result.errors)).toEqual([]);
+    const atDoor = ours(result.advisories);
+    expect(atDoor.map((f) => f.rule)).toEqual([PAGE_PREDICATE_OVER_BUDGET]);
+    const stack = { pages: [tabsPage(OVER_AST_NODES)] };
+    const atBuild = ours(runAuthoringRules('build', { normalized: stack, parsed: stack }));
+    expect(atDoor.map(({ message, hint, severity }) => ({ message, hint, severity })))
+      .toEqual(atBuild.map(({ message, hint, severity }) => ({ message, hint, severity })));
+  });
+
+  it('CONTROL — a within-bounds tab predicate draws nothing at any door', () => {
+    const stack = { pages: [tabsPage(WITHIN)] };
+    expect(validatePagePredicateBounds(stack)).toEqual([]);
+    expect(ours(runAuthoringRules('validate', { normalized: stack, parsed: stack }))).toEqual([]);
+    const result = gatePage(tabsPage(WITHIN));
+    expect(ours([...result.errors, ...result.advisories])).toEqual([]);
+  });
+
+  it('the `{ dialect, source }` envelope is the same slot', () => {
+    const findings = validatePagePredicateBounds({ pages: [tabsPage({ dialect: 'cel', source: OVER_AST_NODES })] });
+    expect(findings.map((f) => f.path)).toEqual([TAB_PATH]);
+  });
+
+  it.each([
+    ['maxDepth', OVER_DEPTH],
+    ['maxListElements', OVER_LIST],
+  ])('names the bound the source overruns — %s', (limit, source) => {
+    const findings = validatePagePredicateBounds({ pages: [tabsPage(source)] });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]!.message).toContain(`\`${limit}\` budget`);
+  });
+});
+
+describe('#24953 — the slots are read off the props schema, not a key list', () => {
+  it.each([
+    [
+      'an `object-form` section `visibleWhen`',
+      { type: 'object-form', properties: { objectName: 'deal', sections: [{ label: 'S', visibleWhen: OVER_AST_NODES, fields: ['name'] }] } },
+      '.properties.sections[0].visibleWhen',
+    ],
+    [
+      'an `object-form` inline field `requiredWhen`',
+      { type: 'object-form', properties: { objectName: 'deal', customFields: [{ name: 'note', type: 'text', requiredWhen: OVER_AST_NODES }] } },
+      '.properties.customFields[0].requiredWhen',
+    ],
+    [
+      'a `record:alert` `visible`',
+      { type: 'record:alert', properties: { title: 'Heads up', visible: OVER_AST_NODES } },
+      '.properties.visible',
+    ],
+  ])('%s', (_label, component, rel) => {
+    const findings = validatePagePredicateBounds({ pages: [pageWith(component)] });
+    expect(findings.map((f) => f.path)).toEqual([`pages[0].regions[0].components[0]${rel}`]);
+  });
+
+  it('a `boolean` in a `boolean | expression` slot is not CEL and draws nothing', () => {
+    const stack = { pages: [pageWith({ type: 'record:alert', properties: { title: 'Heads up', visible: false } })] };
+    expect(validatePagePredicateBounds(stack)).toEqual([]);
+  });
+
+  it('a tab panel nested in another tab panel is reached through the shared page walk', () => {
+    const inner = tabsPage(OVER_AST_NODES).regions[0]!.components[0]!;
+    const outer = pageWith({
+      type: 'page:tabs',
+      properties: { items: [{ label: 'Outer', value: 'outer', children: [inner] }] },
+    });
+    expect(validatePagePredicateBounds({ pages: [outer] }).map((f) => f.path)).toEqual([
+      'pages[0].regions[0].components[0].properties.items[0].children[0].properties.items[1].visibleWhen',
+    ]);
+  });
+});
+
+describe('#24953 — no double report with the visibility family', () => {
+  it('the component NODE `visibleWhen` stays the visibility family\'s error, and this rule says nothing of it', () => {
+    const stack = { pages: [tabsPage(WITHIN, OVER_AST_NODES)] };
+    const findings = runAuthoringRules('build', { normalized: stack, parsed: stack });
+    expect(ours(findings)).toEqual([]);
+    expect(findings.filter((f) => f.rule === VISIBILITY_PREDICATE_OVER_BUDGET).map((f) => [f.severity, f.path]))
+      .toEqual([['error', 'pages[0].regions[0].components[0]']]);
+  });
+
+  it('a child component\'s node `visibleWhen` inside a tab panel is not judged here either', () => {
+    const page = pageWith({
+      type: 'page:tabs',
+      properties: { items: [{ label: 'A', value: 'a', children: [{ type: 'element:text', visibleWhen: OVER_AST_NODES }] }] },
+    });
+    expect(validatePagePredicateBounds({ pages: [page] })).toEqual([]);
+  });
+});
+
+describe('#24953 — wiring', () => {
+  it('runs on all three commands as an advisory rule, and at the page door only', () => {
+    const entry = authoringRulesFor('validate').find((r) => r.name === 'validatePagePredicateBounds');
+    expect(entry?.tier).toBe('advisory');
+    for (const command of ['build', 'lint'] as const) {
+      expect(authoringRulesFor(command).map((r) => r.name)).toContain('validatePagePredicateBounds');
+    }
+    expect(runtimeAuthoringRulesFor('page').map((r) => r.name)).toContain('validatePagePredicateBounds');
+    expect(runtimeAuthoringRulesFor('view').map((r) => r.name)).not.toContain('validatePagePredicateBounds');
+  });
+});