@@ -4,19 +4,20 @@
 
 fix(spec): `defineStack(config, { strict: false })` refuses a non-array `objects` with the ADR-0112 envelope
 
-**BREAKING** — `defineStack`, a public root export, now refuses under `strict: false` a class of input it used to crash on or hand on unusable.
+**BREAKING** — `defineStack`, a public root export, now refuses under `strict: false` a class of input it used to crash on or hand on unusable: a non-array `objects`, or an `objects` array holding an entry that is not an object.
 
 The non-strict door skips the parse and hands the normalized input to the action merge that ends every `defineStack` call. That merge read `objects` with no shape guard. Measured before this change:
 
 | `objects` under `strict: false` | before | after |
 | :--- | :--- | :--- |
 | a number or a string (`5`, `'abc'`) | bare `TypeError: config.objects.map is not a function`, `code` and `status` both `undefined` | refused, `STACK_SCHEMA_INVALID`, `status: 422` |
 | `null`, `''`, `0`, `false` | returned untouched, refused one call later by `composeStacks` | refused, `STACK_SCHEMA_INVALID`, `status: 422` |
-| an array holding `null` (`[null, obj]`) | bare `TypeError` reading `actions` off `null` | accepted: the entry is handed on as written, the objects beside it get their bound actions |
+| an array holding `null` (`[null, obj]`) | bare `TypeError` reading `actions` off `null` | refused, `STACK_SCHEMA_INVALID`, `status: 422`, one issue per entry at `['objects', index]` |
+| an array holding another non-object (`[obj, 7]`, `[obj, 'x']`) | returned with the entry in place, a success whose objects are not all objects | refused, `STACK_SCHEMA_INVALID`, `status: 422`, one issue per entry at `['objects', index]` |
 
-`strict: false` skips validation — cross-references and schema detail — and never promised to accept a shape the merge cannot read. The refusal carries the code the strict parse raises for the same authored mistake, with the zod issue on `issues` (`path: ['objects']`, `expected: 'array'`), the same line `composeStacks` draws for the same key. An absent `objects` (`undefined`) is not malformed and behaves as before; the map form (`{ name: { … } }`) is still normalized to an array first and accepted.
+`strict: false` skips validation — cross-references and schema detail — and never promised to accept a shape the merge cannot read. The refusal carries the code the strict parse raises for the same authored mistake, with the zod issue on `issues` — `path: ['objects']`, `expected: 'array'` for the collection, `path: ['objects', index]`, `expected: 'object'` for each non-object entry — the same line `composeStacks` draws for a non-array `objects`. Every row narrows: nothing that used to be refused is accepted now. An absent `objects` (`undefined`) is not malformed and behaves as before; the map form (`{ name: { … } }`) is still normalized to an array first and accepted.
 
-Fix: author `objects` as an array or in the map form, or drop `strict: false` to have every schema check run.
+Fix: author `objects` as an array of object definitions or in the map form, or drop `strict: false` to have every schema check run.
 
 No code is added to the ADR-0112 ledger and no export changes: `STACK_SCHEMA_INVALID` is already registered under `@objectstack/spec`.
 
 
@@ -23,8 +23,10 @@
  * `status: 422`, the zod issue on `issues` at `path: ['objects']` — the same
  * line `composeStacks` step 2 draws for the same key.
  *
- * A non-object ENTRY is handed on exactly as written (nothing is lost at this
- * door; composition is where it would be, and it reports it there).
+ * A non-object ENTRY is refused with the same envelope, one zod issue per
+ * entry at `path: ['objects', index]` (`expected: 'object'`): handing it on
+ * would return a success whose objects are not all objects, and the next
+ * consumer (plugin-object registration) drops every object after it.
  *
  * Every refusal has its CONTROL: the same stack with `objects` authored as an
  * array, or as the map form, is accepted and its bound actions are merged.
@@ -97,13 +99,23 @@ describe('#19785 — defineStack strict: false refuses a non-array `objects` wit
     expect(stack.actions?.map((a) => a.name)).toEqual(['b_open']);
   });
 
-  it('a non-object ENTRY is handed on as written, the object beside it still merged — never a bare TypeError', () => {
-    const stack = nonStrict({ objects: [null, obj('b_item'), 7], actions: [bound] });
-    const objects = stack.objects as unknown[];
-    expect(objects).toHaveLength(3);
-    expect(objects[0]).toBeNull();
-    expect(objects[2]).toBe(7);
-    expect((objects[1] as { actions?: Array<{ name: string }> }).actions?.map((a) => a.name)).toEqual(['b_open']);
+  it('a non-object ENTRY is refused with the same envelope, one issue per entry at [objects, index] — never handed on, never a bare TypeError', () => {
+    const refused = refusal(() => nonStrict({ objects: [null, obj('b_item'), 7], actions: [bound] }));
+    expect(refused).toBeInstanceOf(Error);
+    expect(refused?.code).toBe('STACK_SCHEMA_INVALID');
+    expect(refused?.status).toBe(422);
+    expect(refused?.issues?.map((issue) => issue.path)).toEqual([
+      ['objects', 0],
+      ['objects', 2],
+    ]);
+    expect(refused?.issues?.every((issue) => issue.code === 'invalid_type' && issue.expected === 'object')).toBe(true);
+  });
+
+  it('a single non-object entry beside a good one is refused too — the card\'s `[null, obj]` repro', () => {
+    const refused = refusal(() => nonStrict({ objects: [null, obj('b_item')] }));
+    expect(refused?.code).toBe('STACK_SCHEMA_INVALID');
+    expect(refused?.status).toBe(422);
+    expect(refused?.issues?.map((issue) => issue.path)).toEqual([['objects', 0]]);
   });
 
   it('the strict door raises the SAME code for the same defect — one dialect for one authored mistake', () => {
 
@@ -2976,6 +2976,31 @@ function mergeActionsIntoObjects(config: ObjectStackDefinition): ObjectStackDefi
     );
   }
 
+  // [#19785] A non-object ENTRY is refused with the same envelope, one zod
+  // issue per entry at `['objects', index]` (`expected: 'object'`) — the
+  // strict parse's own answer for it. Never handed on: the merge cannot read
+  // it, and a stack returned with it is a success whose objects are not all
+  // objects — the next consumer (plugin-object registration) then drops every
+  // object after it inside one warn-level catch, which is concealment, not
+  // leniency.
+  if (Array.isArray(declaredObjects) && declaredObjects.some((entry) => !isRecord(entry))) {
+    const parsed = z.array(z.looseObject({})).safeParse(declaredObjects);
+    const issues = parsed.success
+      ? []
+      : parsed.error.issues.map((issue) => ({ ...issue, path: ['objects', ...issue.path] }));
+    const positions = declaredObjects
+      .map((entry, index) => (isRecord(entry) ? null : `#${index} (${entry === null ? 'null' : Array.isArray(entry) ? 'an array' : `a ${typeof entry}`})`))
+      .filter((position): position is string => position !== null);
+    throw new StackSchemaInvalidError(
+      `defineStack validation failed: 'objects' holds ${positions.length === 1 ? 'an entry' : 'entries'} ` +
+        `that ${positions.length === 1 ? 'is' : 'are'} not an object — ${positions.join(', ')}. Bound actions ` +
+        `cannot be merged into such an entry, and \`strict: false\` skips validation, not this shape. Author ` +
+        `every entry of 'objects' as an object definition, or drop \`strict: false\` to have every schema ` +
+        `check run.`,
+      issues as z.core.$ZodIssue[],
+    );
+  }
+
   // Honour `order` on the preserved top-level actions regardless of objects.
   const sortedTop = config.actions ? sortActionsByOrder(config.actions) : config.actions;
   const topChanged = sortedTop !== config.actions;
@@ -2999,12 +3024,6 @@ function mergeActionsIntoObjects(config: ObjectStackDefinition): ObjectStackDefi
   // references, consistent with mergeObjects() and Zod output).
   let objectsChanged = false;
   const newObjects = config.objects.map((obj) => {
-    // [#19785] A non-object ENTRY (only reachable unparsed) carries no actions
-    // to merge into: it is handed on exactly as written, never dereferenced.
-    // Not dropped and not warned about here — nothing is lost at this door,
-    // which is what a scalar entry already got; `composeStacks` is where such
-    // an entry would be lost, and it skips and reports it there.
-    if (!isRecord(obj as unknown)) return obj;
     const base = obj.actions ?? [];
     // Idempotent (#14847): append only the bound actions `base` does not carry
     // ALREADY — judged by identity, never by equality. The one way an entry of