@@ -117,7 +117,10 @@ import { validateJsxPages } from './validate-jsx-pages.js';
 import { validateReactPages } from './validate-react-pages.js';
 import { validatePageSourceStyling } from './validate-page-source-styling.js';
 import { validateCapabilityReferences } from './validate-capability-references.js';
-import { validateFlowTriggerReadiness } from './validate-flow-trigger-readiness.js';
+import {
+  validateFlowApiTriggerSecret,
+  validateFlowTriggerReadiness,
+} from './validate-flow-trigger-readiness.js';
 import { validateApprovalApprovers } from './validate-approval-approvers.js';
 import { validateRecordTitle } from './validate-record-title.js';
 import { validateFieldConsumers } from './validate-field-consumers.js';
@@ -1109,7 +1112,8 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
   // `type: 'record_change'` flow whose triggerType the engine's binding resolver
   // routes nowhere, silently demoting it to a manual flow. #20553 made it five: an
   // `api`-bound flow with no usable `config.secret`, which the engine's own
-  // `registerFlow` refuses (ADR-0041). None of those verdicts
+  // `registerFlow` refuses (ADR-0041) — on its OWN entry below
+  // (`validateFlowApiTriggerSecret`), because it is CLI-only for now. None of those verdicts
   // can be changed by installing a package, so there is no reading under which
   // the flow fires. `flow-trigger-unknown-object` deliberately stayed `warning`
   // (the object may come from another installed package — a hedge this rule
@@ -1139,6 +1143,35 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
     runtimeTypes: ['flow'],
     run: (stack) => validateFlowTriggerReadiness(stack),
   },
+  // #20553 — `flow-api-trigger-secret-missing`, split out of the entry above as
+  // its own exported rule (the `validateSecurityRoleWord` precedent: one rule id
+  // sits on ONE side of the runtime wall). Same family, same `error`, all three
+  // commands — but NOT the runtime publish gate yet, and #20611 is the card that
+  // moves it across. The flow read path withholds `config.secret` from every
+  // served definition (#20552) and `saveMetaItem` restores the stored secret only
+  // just before the put, AFTER this table has judged the body the caller sent —
+  // so on the gate, a signed flow's ordinary GET → edit → PUT reads as
+  // secretless. Measured on `825c33ff9f`: with this id on the gate, the two
+  // round-trip pins in `protocol.metadata-redaction.test.ts` fail; off it, 26/26.
+  // The `/meta` door therefore keeps its pre-rule behaviour (it stores a
+  // secretless flow, and the engine refuses it at registration) until the gate
+  // judges the carried-forward body — then this entry becomes `CLI_AND_RUNTIME`
+  // with `runtimeTypes: ['flow']`, like the one above.
+  {
+    name: 'validateFlowApiTriggerSecret',
+    tier: 'gating',
+    input: 'normalized',
+    commands: ALL,
+    source: 'packages/lint/src/validate-flow-trigger-readiness.ts',
+    surfaces: CLI_ONLY,
+    surfaceReason:
+      'Not yet runtime-safe: the publish gate judges a /meta save BEFORE saveMetaItem restores the ' +
+      'inbound-hook secret the flow read path withholds, so a signed api flow\'s ordinary GET, edit, PUT ' +
+      'round trip reaches this rule secretless and would be refused. It crosses when the gate judges the ' +
+      'carried-forward body (the seam follow-up named in the comment above); until then the engine\'s ' +
+      'registerFlow refusal is what a secretless flow saved through /meta meets.',
+    run: (stack) => validateFlowApiTriggerSecret(stack),
+  },
   // ADR-0090 D3 fallout — an approval `{ type: 'role' }` resolves against the
   // better-auth org-membership tier, not positions, so a position name authored
   // there routes the approval to nobody; and an expression approver that does
 
@@ -126,6 +126,7 @@ export type { ManagedApiMethodFinding } from './validate-managed-api-methods.js'
 export type { ListViewModeFinding, ListViewModeSeverity } from './validate-list-view-mode.js';
 export {
   validateFlowTriggerReadiness,
+  validateFlowApiTriggerSecret,
   FLOW_TRIGGER_UNKNOWN_OBJECT,
   FLOW_DRAFT_STATUS_AMBIGUOUS,
   FLOW_TRIGGER_UNKNOWN_EVENT,
 
@@ -11,7 +11,22 @@ import {
   FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE,
   FLOW_TRIGGER_UNROUTABLE,
   FLOW_API_TRIGGER_SECRET_MISSING,
+  validateFlowApiTriggerSecret,
 } from './validate-flow-trigger-readiness.js';
+import { AUTHORING_COMMANDS, AUTHORING_RULES, runAuthoringRules } from './authoring-rules.js';
+import { runRuntimeAuthoringRules } from './runtime-gate.js';
+
+/**
+ * [#20553] The flow-trigger family as the CLI table runs it: two registry
+ * entries over one file — `validateFlowTriggerReadiness` and, split out because
+ * it is CLI-only until #20611, `validateFlowApiTriggerSecret`. Cases that are
+ * about the WHOLE family's verdict on a stack (the severity map, the clean-stack
+ * floor, the api-secret cases' exhaustive assertions) judge through this.
+ */
+const cliFlowFamily = (stack: Record<string, unknown>) => [
+  ...validateFlowTriggerReadiness(stack),
+  ...validateFlowApiTriggerSecret(stack),
+];
 
 function recordFlow(overrides: Record<string, unknown> = {}) {
   return {
@@ -1035,7 +1050,7 @@ describe('validateFlowTriggerReadiness', () => {
       };
     }
     const judge = (flow: Record<string, unknown>) =>
-      validateFlowTriggerReadiness({ objects: [candidateObject], flows: [flow] });
+      cliFlowFamily({ objects: [candidateObject], flows: [flow] });
 
     it('fails a secretless `type: api` flow, naming the flow and the key', () => {
       const findings = judge(apiFlow({ hookId: 'intake' }));
@@ -1144,6 +1159,66 @@ describe('validateFlowTriggerReadiness', () => {
     it('the id is the published slug', () => {
       expect(FLOW_API_TRIGGER_SECRET_MISSING).toBe('flow-api-trigger-secret-missing');
     });
+
+    // [#20611] The id is CLI-only until the runtime publish gate judges the
+    // carried-forward body: a `/meta` save is gated BEFORE `saveMetaItem`
+    // restores the `config.secret` the flow read path withholds (#20552), so a
+    // signed flow's GET → edit → PUT would reach the gate secretless. Each side
+    // of the wall is pinned, and the gate pin carries its own positive control.
+    describe('one rule id on ONE side of the runtime wall — CLI-only until #20611', () => {
+      const secretless = apiFlow({ hookId: 'intake' });
+      const stack = { objects: [candidateObject], flows: [secretless] };
+
+      it('the split is whole: validateFlowTriggerReadiness alone no longer emits the id', () => {
+        expect(validateFlowTriggerReadiness(stack).map((f) => f.rule)).not.toContain(
+          FLOW_API_TRIGGER_SECRET_MISSING,
+        );
+        expect(validateFlowApiTriggerSecret(stack).map((f) => f.rule)).toEqual([FLOW_API_TRIGGER_SECRET_MISSING]);
+      });
+
+      it('its registry entry gates all three commands on the cli surface only, with a reason', () => {
+        const entry = AUTHORING_RULES.find((r) => r.name === 'validateFlowApiTriggerSecret');
+        expect(entry).toBeDefined();
+        expect(entry!.tier).toBe('gating');
+        expect([...entry!.commands].sort()).toEqual([...AUTHORING_COMMANDS].sort());
+        expect(entry!.surfaces).toEqual(['cli']);
+        expect(entry!.runtimeTypes).toBeUndefined();
+        expect((entry!.surfaceReason ?? '').trim().length).toBeGreaterThan(40);
+        // …while the family's shared entry still crosses the wall.
+        expect(AUTHORING_RULES.find((r) => r.name === 'validateFlowTriggerReadiness')!.surfaces).toContain(
+          'runtime-publish',
+        );
+      });
+
+      it.each([...AUTHORING_COMMANDS])('os %s still refuses a secretless api flow through the table', (command) => {
+        const hits = runAuthoringRules(command, { normalized: stack, parsed: stack }).filter(
+          (f) => f.rule === FLOW_API_TRIGGER_SECRET_MISSING,
+        );
+        expect(hits.map((f) => [f.severity, f.path])).toEqual([['error', 'flows[0].nodes[0].config.secret']]);
+      });
+
+      it('the runtime publish gate does not emit it — and still runs the rest of the family', () => {
+        const gated = runRuntimeAuthoringRules({ type: 'flow', item: secretless });
+        expect(gated.rulesRun).toContain('validateFlowTriggerReadiness');
+        expect(gated.rulesRun).not.toContain('validateFlowApiTriggerSecret');
+        expect([...gated.errors, ...gated.advisories].map((f) => f.rule)).not.toContain(
+          FLOW_API_TRIGGER_SECRET_MISSING,
+        );
+        // Positive control: the same door still refuses a flow the family
+        // proves dead, so the absence above is the wall, not a gate that ran
+        // nothing.
+        const dead = runRuntimeAuthoringRules({
+          type: 'flow',
+          item: {
+            name: 'declared_dead',
+            type: 'record_change',
+            status: 'active',
+            nodes: [{ id: 'start', type: 'start', config: { objectName: 'app_candidate', triggerType: 'onCreate' } }],
+          },
+        });
+        expect(dead.errors.map((f) => f.rule)).toContain(FLOW_TRIGGER_UNROUTABLE);
+      });
+    });
   });
 
   // ── #5762 — the family's severity map ────────────────────────────────────
@@ -1297,7 +1372,7 @@ describe('validateFlowTriggerReadiness', () => {
 
     for (const [rule, severity, stack] of provoke) {
       it(`${rule} is ${severity}`, () => {
-        const matching = validateFlowTriggerReadiness(stack).filter((f) => f.rule === rule);
+        const matching = cliFlowFamily(stack).filter((f) => f.rule === rule);
         // Non-vacuous first: the fixture really does provoke this id.
         expect(matching.length, `${rule} was not provoked by its own fixture`).toBeGreaterThan(0);
         for (const f of matching) expect(f.severity).toBe(severity);
@@ -1310,7 +1385,7 @@ describe('validateFlowTriggerReadiness', () => {
       // makes a gate read as a bug — and the cross-package sentence is exactly
       // what earns `flow-trigger-unknown-object` its warning.
       for (const [rule, severity, stack] of provoke) {
-        for (const f of validateFlowTriggerReadiness(stack).filter((x) => x.rule === rule)) {
+        for (const f of cliFlowFamily(stack).filter((x) => x.rule === rule)) {
           if (severity === 'warning' && rule === FLOW_TRIGGER_UNKNOWN_OBJECT) {
             expect(f.hint, rule).toMatch(/another installed package/);
           }
@@ -1327,7 +1402,7 @@ describe('validateFlowTriggerReadiness', () => {
       // correct flow fail. Without this, "everything is an error" would pass
       // every assertion above.
       expect(
-        validateFlowTriggerReadiness({
+        cliFlowFamily({
           objects: [candidateObject, { name: 'task', label: 'Task', fields: {} }],
           flows: [
             recordFlow({ status: 'active' }),