lint: a locale pack's picklists.<name> translations are never checked — an option key that is not in the list, or a list no package declares, passes os lint --strict and is dropped silently at runtime #23566

Filing gate ①: a finding, class c (a declared surface whose author-time check is missing, so a mistake reaches runtime silently), with reach measured.
reach: the public door objectstack lint --strict (os lint) on hotcrm PR objectstack-ai/hotcrm#2111 (tree 2b4eb38b), @objectstack/* 18.0.0-next.1. Measured by the repo:hotcrm seat's dev while migrating HotCRM's shared option lists to picklist metadata (hotcrm#2000, report on that card).
Filed by the repo:hotcrm seat (session_01P8mZuzuyZAHSrgQKmv6ASv). The seat re-read the checker on objectstack origin/main 086fa464. ⛔ Not a claim.
Reader: objectstack triage, then the lane that owns packages/lint.
Dedupe (MCP search_issues, objectstack, open + closed): "lint translation picklists unknown option key translation-option-key-unknown picklist orphan translation" → 6 hits, all closed: #22178 (analytics labels for picklist dimensions), #19518 (the picklist kind itself), #18203 and #16310 (translation-target-unknown on navigation / severity), #8765, #7864. None covers the picklists translation face.

What happens

Two ablation legs on a zh-CN locale pack, each restored afterwards:

• A. picklists.salutation.options.mister, a key that is not a value of the salutation list: os lint --strict exits 0 with 0 picklist findings.
• B. picklists.not_a_list, an entry for a list no package declares: os lint --strict exits 0 with 0 findings.

In both, the runtime drops the translation silently: lookupPicklistOption in packages/spec/src/system/i18n-resolver.ts finds nothing and falls back to the source label.

The same two mistakes elsewhere ARE caught:

• an unknown key under a field's own options → translation-option-key-unknown;
• an orphan object or field key → translation-target-unknown.

Producer (read on origin/main 086fa464)

packages/lint/src/validate-translation-references.ts walks objects, fields and field options (checkOptionKeys, called around line 1548 and defined around line 1906). It never reads TranslationData.picklists; "picklist" appears in that file only in its header comment (line 26). No other rule reads the face: picklist-reference-unknown / -unverified judge a field's picklist reference, not the locale pack.

Expected

The two rules extend to the picklist face: an option key under picklists.<name>.options that is not a value of that list → translation-option-key-unknown, and a picklists.<name> that no package in the stack declares → translation-target-unknown, each at the severity the field-level twin has today.

Consumer note

HotCRM keeps a local guard (test/i18n-references.test.ts, which went red on both legs) until the platform covers this. Once it ships, that local guard is retired under HotCRM's "retire local reference tests the platform covers" rule.

Generated by Claude Code