@@ -15,7 +15,7 @@ The page action rows are `action:button` and `action:icon` (`properties`), and e
 - **`onSuccess`** was any value (`z.unknown()`). The runner reads only `ActionSchema`'s post-success block, `{ navigate, openIn }`, and classifies `navigate` with the url scheme set. So `onSuccess: { navigate: 'javascript:alert(1)' }` parsed clean, and so did a misspelled key or a callback shape, which the runner gives no reading at all. The rows now hold `ActionSchema.onSuccess`'s own block, the same instance by reference, so a row's verdict on any `onSuccess` value is the action's: the scheme set on `navigate`, the rename prescriptions for `url` / `redirectUrl` / `to` / `route` / `path` / `target` / `navigateTo` / `href`, and the closed `openIn` with its `'self'` default.
 - **The executor key** (`actionType` on a node, `type` on a member) is a free string, and the rows judged a url `target` only when it read `'url'`. The runner also dispatches `'navigation'`, its local alias of `'url'`, to the same navigator, so `actionType: 'navigation'` with `target: 'javascript:…'` parsed clean. The url executor now has one spelling on the rows: `'navigation'` is refused at the executor key, with the rename onto `'url'`. The key otherwise stays open: a handler a host registers under another name (`navigate_create`, `navigate_edit`, …) is still dispatched by name.
 
-A page's `properties` bag is outside the stack parse. `os validate` judges it through its props gate, which parses the bag against these same rows, so it reports each refusal at the row's own path with the same text, as a `component-props-invalid` finding (that gate's one tier, a warning). A stored page still saves and loads.
+A page's `properties` bag is outside the stack parse. `os validate` judges it through its props gate, which parses the bag against these same rows, so it reports each refusal at the row's own path with the same text, as a `component-props-invalid` finding (an error, like every finding of that gate). A stored page still saves and loads.
 
 ### FROM → TO
 
 
@@ -11,8 +11,9 @@
 // whose executor key refuses `'navigation'`, the runner's alias of `'url'`.
 // These pins hold that the gate reports each refusal at the row's own path,
 // with the parse's own first sentence, and stays silent on the accepted
-// control. The finding is a `component-props-invalid` warning, the gate's one
-// tier (its module header says why); no code in this package changed for it.
+// control. The finding is a `component-props-invalid` error, like every finding
+// of the gate (its module header says why); no code in this package changed for
+// it.
 import { describe, expect, it } from 'vitest';
 import { validateComponentProps, COMPONENT_PROPS_INVALID } from './validate-component-props.js';
 
 
@@ -818,8 +818,9 @@ describe('migrateStoredMetadata — a site the chain leaves as stored is a TODO,
     it('MEASURED — the write path judges the two door kinds differently, and the TODO rides on either outcome', async () => {
         // `properties.filter` sits in the page component's open `properties` bag:
         // the runtime save door does not parse it by `type` (the props gate is
-        // `@objectstack/lint`'s, advisory). `dataSource.filter` is a declared key
-        // of the strict component schema, so the save door refuses it there.
+        // `@objectstack/lint`'s, an error at the CLI doors only).
+        // `dataSource.filter` is a declared key of the strict component schema,
+        // so the save door refuses it there.
         const bindingMixed = pageRow('deal_room', [
             grid({ stage: 'open' }),
             { type: 'object-kanban', dataSource: { object: 'deal', filter: COMBINATOR }, properties: { objectName: 'deal' } },
 
@@ -8031,8 +8031,8 @@ const translationPerAppSettingsRemoved: MetadataConversion = {
  * (`actions[]`, `objects[].actions[]`, an `element:button`'s inline action).
  * Retired from the load path: an author is refused at parse — except on an
  * `element:button`'s inline action, which sits in the open `properties` bag the
- * load path keeps as written, where the refusal is an advisory
- * `component-props-invalid` finding at `os validate` / `os build` / `os lint`
+ * load path keeps as written, where the refusal is a
+ * `component-props-invalid` error at `os validate` / `os build` / `os lint`
  * (the component-props gate, `@objectstack/lint`) — and data at rest and
  * `os migrate meta` replay it.
  */
@@ -8331,11 +8331,11 @@ const translationComponentSubmitLabelRemoved: MetadataConversion = {
  * type is that component's own vocabulary and is never read here.
  *
  * `retiredFromLoadPath`: an author is not silently rewritten — `os validate`,
- * `os build` and `os lint` report an old spelling as an advisory
- * `component-props-invalid` finding carrying the prescription (the
+ * `os build` and `os lint` report an old spelling as a
+ * `component-props-invalid` error carrying the prescription (the
  * component-props gate, `@objectstack/lint`: a retired enum value is a value
- * verdict, a warning; the load path keeps the open `properties` bag as
- * written); stored rows replay it at rehydration
+ * verdict, an error like every other; the load path keeps the open `properties`
+ * bag as written); stored rows replay it at rehydration
  * (`applyConversionsToStoredItem`) and `os migrate meta` lists the edit for
  * existing sources. Idempotent by construction: the rewrite's output is
  * outside its own input set.
@@ -14925,8 +14925,8 @@ function describeBlock(component: Dict): string {
  * of the strict page-component schema, so the row's next save is refused
  * there; `properties.filter` sits in the open
  * `properties` bag the runtime save does not refuse by component type, so there
- * the refusal is the component-props gate's (`@objectstack/lint`, advisory),
- * and a re-save goes through.
+ * the refusal is the component-props gate's (`@objectstack/lint`, an error at
+ * `os validate` / `os build` / `os lint`), and a re-save goes through.
  *
  * ## Every site left as stored is reported — `context.reportTodo`
  *