@@ -0,0 +1,27 @@
+---
+'@objectstack/lint': minor
+---
+
+fix(lint)!: `os build`, `os validate`, `os lint` and the page save door refuse a page component props CEL slot over the platform's parse bounds (#25002)
+
+Clause-②: no (narrowing: a page component props CEL slot over the platform parse bounds is refused at `os build` and the page door; it ships now under the amended 「甲」, #6015 `6303865025`)
+
+A CEL source over `DEFAULT_LIMITS` (`maxAstNodes` 256, `maxDepth`, `maxListElements`) does not parse anywhere on the platform. It faults on every evaluation, and the console fails open, so the element it was written to gate draws for everyone. `page-predicate-over-budget` (`validatePagePredicateBounds`) finds such a source in the CEL slots declared inside a page component's `properties` bag: a `page:tabs` item `visibleWhen`, an `object-form` section or inline field `visibleWhen` / `readonlyWhen` / `requiredWhen`, `record:alert` `visible`, and the `visible` / `disabled` of the `action:*` blocks. The finding was a warning. It is now an error, and its authoring-rules entry moves from the advisory tier to the gating tier. This supersedes the warning-only behaviour described for the same rule earlier in this release line; its message no longer says "A future major release refuses it."
+
+**BREAKING — what moves for consumers.**
+
+- FROM: a warning at `os validate`, `os build` and `os lint`, and an entry on the page save door's `advisories` channel while the page saved. TO: an error. The three commands fail, and an active page write answers `422 INVALID_METADATA` with a `page-predicate-over-budget` issue located at the slot and naming the bound it overruns. The page is not stored. This covers `saveMetaItem` in publish mode (Studio, REST `/meta`, MCP) and the promotion of a draft (`publishMetaItem`).
+- The page door answers `INVALID_METADATA`, its existing author-time refusal envelope, not `VALIDATION_ERROR`.
+
+**Fix (one line).** Shrink the predicate (collapse an `||` chain into one `in ['a', 'b', …]` test), or precompute the heavy part into a formula or roll-up field on the object and test that one field.
+
+**Unchanged.**
+
+- A within-bounds source draws nothing at any door.
+- The component node's own `visibleWhen` keeps its existing verdict (`visibility-predicate-over-budget`), and this rule does not report it twice.
+- Stored pages are not migrated and are not refused on read. A stored page with such a slot keeps loading and serving until it is next saved, and that save is judged. Saving a page as a draft is still allowed; publishing the draft is judged.
+- `OS_ALLOW_UNLINTED_METADATA_WRITES=1` still turns a refusal into a logged write.
+- No public export or signature moves; `PagePredicateBoundsFinding.severity` is now `'error'`.
+- Measured before crossing, through the built `@objectstack/lint`: 0 in-repo producers carry such a slot. Every page module under `examples/` and `packages/` (30 files, 65 page values) draws 0 findings, and so do the `app-crm`, `app-multi-package` and `app-todo` composed stacks. A literal scan of 9,919 tracked source files (13,840 string literals of 120+ characters) finds 0 sources over the bounds, and HotCRM at `c8a7a70` (611 files) finds 0. A planted 78-term control is found by both instruments.
+
+<!-- adr-0087: not-required (no-migration-prescription) a refusal at `os build`, `os validate`, `os lint` and the page save door of a page component props CEL slot whose source overruns the platform's parse bounds: no authorable key, spelling, export or stored shape moves, and no stored row is read, rewritten or converted. A stored page whose slot is refused keeps loading until it is next saved, and the repair is the author's rewrite of the predicate (shrinking it, or precomputing it into a formula or roll-up field), which no ledger entry can derive. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers this verdict (not already-registered); and the change is a build and door verdict, not a declaration (not runtime-interface-only or type-surface-only). -->
@@ -3471,6 +3471,116 @@ describe('runtime authoring gate on PAGE writes — the component visibleWhen ve
     });
 });
 
+// #25002 — a CEL slot INSIDE a page component's `properties` bag that overruns
+// the platform's parse bounds (`page-predicate-over-budget`,
+// `validatePagePredicateBounds`) is refused at the runtime save door, as
+// `os build` refuses it. #24953 shipped it as an advisory (the door admitted the
+// save and listed the finding); the amended 「甲」 (record 6303865025) ships
+// the refusal in 18.x. The card's shape: a `page:tabs` item `visibleWhen` of
+// ~390 AST nodes, over `maxAstNodes` (256). Pinned through the REAL
+// `saveMetaItem`:
+//
+//  (a) the active save is refused — 422 `INVALID_METADATA`, the door's own
+//      envelope — naming the slot and the bound, and nothing lands; the draft
+//      promotion is refused the same way;
+//  (b) the door's finding IS the build's;
+//  (c) control: a within-bounds tab predicate saves, and the row lands.
+//
+// ⚠️ As above: this package reaches `@objectstack/lint` through its built
+// `dist/`, so a registry or rule edit is invisible here until
+// `pnpm --filter @objectstack/lint build` has run.
+describe('runtime authoring gate on PAGE writes — a props-bag CEL slot over the parse bounds (#25002)', () => {
+    const RULE = 'page-predicate-over-budget';
+    const TAB_PATH = 'pages[0].regions[0].components[0].properties.items[1].visibleWhen';
+    /** 78 `||` terms, five AST nodes each — the card's ~390-node class. */
+    const OVER = Array.from({ length: 78 }, (_, i) => `record.f${i} == ${i}`).join(' || ');
+    const WITHIN = "record.stage == 'won' || page.tab != ''";
+    const page = (tabVisibleWhen: string) => ({
+        name: 'deal_home',
+        label: 'Deal',
+        type: 'app',
+        regions: [{
+            name: 'main',
+            components: [{
+                type: 'page:tabs',
+                properties: {
+                    items: [
+                        { label: 'Overview', value: 'overview', children: [] },
+                        { label: 'Finance', value: 'finance', visibleWhen: tabVisibleWhen, children: [] },
+                    ],
+                },
+            }],
+        }],
+    });
+
+    const savePage = (protocol: any, item: unknown, extra: Record<string, unknown> = {}) =>
+        protocol.saveMetaItem({ type: 'page', name: 'deal_home', item, ...extra });
+    const activePageRows = (rows: Map<string, Row>) =>
+        Array.from(rows.values()).filter((r) => r.type === 'page' && r.state === 'active');
+
+    let warn: ReturnType<typeof vi.spyOn>;
+    beforeEach(() => {
+        warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+        delete process.env.OS_ALLOW_UNLINTED_METADATA_WRITES;
+    });
+    afterEach(() => {
+        warn.mockRestore();
+        delete process.env.OS_ALLOW_UNLINTED_METADATA_WRITES;
+    });
+
+    it('(a) REFUSES an active save of the card\'s tab-item `visibleWhen`, naming the bound; nothing stored', async () => {
+        const { protocol, rows } = makeProtocol();
+
+        const err = await savePage(protocol, page(OVER)).catch((e: any) => e);
+
+        expect(err, 'the save resolved — the door still admits the over-budget slot').toBeInstanceOf(Error);
+        expect({ code: err.code, status: err.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        expect(err.rulesRun).toContain('validatePagePredicateBounds');
+        const issues = (err.issues ?? []).filter((i: any) => i.rule === RULE);
+        expect(issues, `issues: ${JSON.stringify(err.issues)}`).toHaveLength(1);
+        expect(issues[0]).toMatchObject({ severity: 'error', path: TAB_PATH });
+        expect(issues[0].message).toContain('`maxAstNodes` budget (platform limit 256)');
+        expect(activePageRows(rows)).toEqual([]);
+    });
+
+    it('(a) gates the draft → active promotion of the same page', async () => {
+        const { protocol, rows } = makeProtocol();
+        await expect(savePage(protocol, page(OVER), { mode: 'draft' })).resolves.toMatchObject({ success: true });
+
+        const err = await protocol.publishMetaItem({ type: 'page', name: 'deal_home' }).catch((e: any) => e);
+
+        expect({ code: err?.code, status: err?.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        expect((err.issues ?? []).map((i: any) => i.rule)).toContain(RULE);
+        expect(activePageRows(rows)).toEqual([]);
+    });
+
+    it('(b) the door and `os build` give the SAME finding', async () => {
+        const { protocol } = makeProtocol();
+        const err = await savePage(protocol, page(OVER)).catch((e: any) => e);
+        const atDoor = (err?.issues ?? []).filter((i: any) => i.rule === RULE);
+
+        const stack = { pages: [page(OVER)] };
+        const atBuild = runAuthoringRules('build', { normalized: stack, parsed: stack })
+            .filter((f) => f.severity === 'error');
+
+        expect(atBuild.map((f) => f.rule)).toEqual([RULE]);
+        expect(atDoor).toHaveLength(1);
+        for (const k of ['rule', 'where', 'path', 'message', 'hint'] as const) {
+            expect(atDoor[0][k], `door and build disagree on '${k}'`).toBe(atBuild[0]![k]);
+        }
+    });
+
+    it('(c) CONTROL — a within-bounds tab predicate saves, and the row lands', async () => {
+        const { protocol, rows } = makeProtocol();
+
+        await expect(savePage(protocol, page(WITHIN))).resolves.toMatchObject({ success: true });
+
+        expect(activePageRows(rows)).toHaveLength(1);
+        const stack = { pages: [page(WITHIN)] };
+        expect(runAuthoringRules('build', { normalized: stack, parsed: stack }).filter((f) => f.rule === RULE)).toEqual([]);
+    });
+});
+
 // A page component's `data` prop naming the retired view-level `api` provider,
 // at the runtime save door. `object-grid`, `object-map`, `object-gantt` and
 // `object-tree` take a view data source (`ViewDataSchema`) as `data`, so the