@@ -1,14 +1,15 @@
 ---
-'@objectstack/lint': patch
+'@objectstack/lint': minor
 '@objectstack/spec': patch
 ---
 
 feat(lint,spec): `os validate`, `os build` and `os lint` warn on a `user` field whose `reference` names an object other than `sys_user`, and `Field.user()` marks `reference` deprecated
 
-Clause-②: no
+Clause-②: yes (widening)
 
 - **What was wrong.** The spec declares a `user` field's target fixed to `sys_user`, and nothing enforced it. `{ type: 'user', reference: 'probe_account' }` parsed, `os validate` passed it, and `referenceTargetOf` resolved it to `probe_account`. So every reader that follows the target (`$expand`, imports, seed loading, the object graph) treated the field as a link to `probe_account`, while every reader that branches on the type (the person picker, the `current_user` default, a sharing rule over the users a field holds) treated its values as users.
 - **What changed.** A new advisory, `user-field-foreign-reference`, fires on such a field on an object or an object extension. It names the field and the target, and its hint is the canonical spelling: `{ type: 'lookup', reference: '<target>' }` (`Field.lookup('<target>', …)`), or drop `reference` if a person was meant. It is a warning, so no command's exit code changes. `Field.user()`'s config now types `reference` as `@deprecated`. The accepted values are unchanged.
 - **Why only a warning in 18.x.** A narrowing ships its refusal in an 18.x minor only when an ADR-0087 conversion can rewrite the old shape. This one cannot, because the rewrite is not lossless. A `user` field is outside the referential delete walk, while a `lookup` gets `deleteBehavior: 'set_null'` and joins it. `deleteBehavior` has no value that means "do nothing", so a converted field would start clearing child columns when its target record is deleted, which a `user` field never does. The refusal is planned for the next major.
+- **Published.** `USER_FIELD_FOREIGN_REFERENCE` (`user-field-foreign-reference`) is exported from `@objectstack/lint` beside `OBJECT_REFERENCE_UNKNOWN`, and `RULE_EXPLANATIONS` gains its entry, so `os explain user-field-foreign-reference` prints why the field is half a link and half a user, and why the rewrite to a `lookup` is left to the author.
 - **Unchanged.** Parsing, the runtime's resolution of such a field (it still follows the authored `reference`), `Field.user()`'s output, and `user` fields written without `reference` or with `reference: 'sys_user'`.
 - **What to do.** Change a `user` field that points at another object to a `lookup` on that object. No in-repo app or package wrote this shape. Two test fixtures did: one is now a `lookup`, and the other deliberately pins the 18.x resolution.
@@ -426,6 +426,7 @@ export {
   validateObjectReferences,
   OBJECT_REFERENCE_UNKNOWN,
   OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
+  USER_FIELD_FOREIGN_REFERENCE,
 } from './validate-object-references.js';
 export type { ObjectRefFinding, ObjectRefSeverity } from './validate-object-references.js';
 
 
@@ -3562,6 +3562,28 @@ const OBJECT_REFERENCE_UNREGISTERED_PLATFORM_EXPLANATION: RuleExplanation = {
   ],
 };
 
+const USER_FIELD_FOREIGN_REFERENCE_EXPLANATION: RuleExplanation = {
+  rule: 'user-field-foreign-reference',
+  covers: 'why a user field cannot point at another object',
+  paragraphs: [
+    'A `user` field is a person picker: its target is fixed to the `sys_user` object by the type, ' +
+      'which is why `Field.user()` takes no target argument. Writing `reference` with any other ' +
+      'object name contradicts the type, and today nothing refuses it.',
+    'Such a field is half one thing and half another. Every reader that follows the target ' +
+      '(`$expand`, imports, seed loading, field paths) treats it as a link to the named object, ' +
+      'while every reader that branches on the type treats its values as users: the person picker ' +
+      'searches people, a `current_user` default stores the acting user\'s id, and a sharing rule over ' +
+      'the users a field holds shares the record with those ids.',
+    'A link to another object is a `lookup`: `{ type: \'lookup\', reference: \'<object>\' }`, or ' +
+      '`Field.lookup(\'<object>\', …)`. If a person was meant, drop `reference`.',
+    'It warns rather than refuses because no automatic rewrite keeps the field\'s behaviour: a `lookup` ' +
+      'takes part in the delete walk with `deleteBehavior: \'set_null\'` by default, so it would start ' +
+      'clearing the column when the target record is deleted, which a `user` field never does. Make ' +
+      'the change by hand and check that delete behaviour is what you want. Refusing the shape at ' +
+      'parse is planned for the next major.',
+  ],
+};
+
 // ── Capability references (`validate-capability-references.ts`) ───────────
 
 const CAPABILITY_REFERENCE_UNKNOWN_EXPLANATION: RuleExplanation = {
@@ -4858,6 +4880,7 @@ export const RULE_EXPLANATIONS: Readonly<Record<string, RuleExplanation>> = Obje
   [OBJECT_FIELD_REF_UNKNOWN_EXPLANATION.rule]: OBJECT_FIELD_REF_UNKNOWN_EXPLANATION,
   [OBJECT_REFERENCE_UNKNOWN_EXPLANATION.rule]: OBJECT_REFERENCE_UNKNOWN_EXPLANATION,
   [OBJECT_REFERENCE_UNREGISTERED_PLATFORM_EXPLANATION.rule]: OBJECT_REFERENCE_UNREGISTERED_PLATFORM_EXPLANATION,
+  [USER_FIELD_FOREIGN_REFERENCE_EXPLANATION.rule]: USER_FIELD_FOREIGN_REFERENCE_EXPLANATION,
   [CAPABILITY_REFERENCE_UNKNOWN_EXPLANATION.rule]: CAPABILITY_REFERENCE_UNKNOWN_EXPLANATION,
   [LIST_VIEW_FILTERS_IN_VIEWS_MODE_EXPLANATION.rule]: LIST_VIEW_FILTERS_IN_VIEWS_MODE_EXPLANATION,
   [LIVENESS_LEDGER_UNREADABLE_EXPLANATION.rule]: LIVENESS_LEDGER_UNREADABLE_EXPLANATION,
 
@@ -784,6 +784,17 @@ describe('[#24808] validateObjectReferences — a `user` field naming another ob
       .toThrow(/`reference` is an object/);
   });
 
+  it('prints one line each, and `os explain` carries the reasoning the verdict leaves out', () => {
+    const [f] = validateObjectReferences(stackWith(PROBE));
+    for (const text of [f.message, f.hint]) {
+      expect(text).not.toContain('\n');
+      expect(text.length, text).toBeLessThanOrEqual(200);
+    }
+    const entry = explainRule(USER_FIELD_FOREIGN_REFERENCE);
+    expect(entry?.rule).toBe(USER_FIELD_FOREIGN_REFERENCE);
+    expect(entry!.paragraphs.join('\n')).toContain("deleteBehavior: 'set_null'");
+  });
+
   for (const command of ['validate', 'build', 'lint'] as const) {
     it(`reaches \`os ${command}\` through the authoring registry, as an advisory and never a gate`, () => {
       const { errors, advisories } = splitBySeverity(runAuthoringRules(command, { normalized: stackWith(PROBE) as never }));