fix(cli): declare and pin the third widening limb — a nameless functions array entry, which the same pass names anon_fn

The re-review enumerated every callable slot `lowerCallables` rewrites and
found one more accepted-set relaxation on `os validate`: the `functions`
ARRAY form requires `name`, and `normalizeStackInput` never touches
`functions`, so `functions: [{ handler: async (ctx) => { … } }]` failed the
`functions` union at the un-lowered parse (exit 1) while `lowerBody` names
it `anon_fn` before `os build`'s parse. Measured through the real CLI on
both sides: BASE validate exit 1 `invalid_union@functions`; HEAD validate
exit 0 `valid=true`; build exit 0. Declared in the changeset's widening
bullet and the `validate.ts` comment, pinned as a third INTAKE leg in the
fourth `describe`. No code change; the `functions` map forms and
`hooks[*].handler` are not limbs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

Author: claude

.changeset/validate-lowers-inline-handlers-before-parse.md

@@ -10,7 +10,7 @@ The `hook-body-write-unknown-field`, `hook-body-write-unprovisioned-anchor`, `ho
 `objectstack validate` now runs the same `lowerCallables` pass `objectstack build` runs before its parse — after its two pre-parse undeclared-key lints, which keep reading the un-lowered stack, and before the schema parse, which reads the lowered view — and hands the rule registry the parsed result as before. This moves what `objectstack validate` accepts in **both** directions, and both are parity with `objectstack build`:
 
 - **Narrowing (hooks).** A config whose inline handler writes a `readonly: true` field via `ctx.api.object(...).update()` / `.updateById()` / `.insert()` — and does not declare `runAs: 'system'` — now fails `objectstack validate` with `hook-api-update-readonly-field` (exit 1). It already failed `objectstack build` and (since #16095) `objectstack lint` with the same finding, so nothing that builds green starts failing `objectstack validate`.
-- **Widening (actions).** A plain-object config carrying an inline action `target` callable — `actions: [{ name, label, target: async (ctx) => { … } }]`, or the same on `objects[*].actions[*]` — was **refused** by `objectstack validate` before this change: `ActionSchema.target` is a string, and nothing lowered the function before the parse, so the run exited 1 with `invalid_type` at `actions.0.target` (measured through the real CLI: `valid=false errors=2 invalid_type@objects.0.actions.0.target | invalid_type@actions.0.target`). The same pass now lowers it to a ref string plus `body` on this command too, so `objectstack validate` **accepts** it (exit 0, `valid: true`) — exactly as `objectstack build` accepted it all along (exit 0 on both sides). This is an accepted-set relaxation on a published command; it is declared here rather than inferred from the build's behaviour, and pinned beside the hook legs.
+- **Widening (actions, and a nameless `functions` array entry).** A plain-object config carrying an inline action `target` callable — `actions: [{ name, label, target: async (ctx) => { … } }]`, or the same on `objects[*].actions[*]` — was **refused** by `objectstack validate` before this change: `ActionSchema.target` is a string, and nothing lowered the function before the parse, so the run exited 1 with `invalid_type` at `actions.0.target` (measured through the real CLI: `valid=false errors=2 invalid_type@objects.0.actions.0.target | invalid_type@actions.0.target`). The same pass now lowers it to a ref string plus `body` on this command too, so `objectstack validate` **accepts** it (exit 0, `valid: true`) — exactly as `objectstack build` accepted it all along (exit 0 on both sides). Likewise a nameless `functions` **array** entry, `functions: [{ handler: async (ctx) => { … } }]`, which the same pass names `anon_fn`: the array form requires `name`, so `objectstack validate` refused it at the parse (measured: `valid=false errors=1 invalid_union@functions`, exit 1) and now accepts it (exit 0, `valid: true`), as `objectstack build` did (exit 0 on both sides). The `functions` map forms and `hooks[*].handler` parse either way and are not affected. These are accepted-set relaxations on a published command; they are declared here rather than inferred from the build's behaviour, and pinned beside the hook legs.
 - The warning-severity members of the family now report on inline handlers under `objectstack validate` too; they fail a run only with `--strict`, as every other advisory does.
 - The `--json` payload gains no key and the text face prints no new step: the lowering is a view for the parse and the rule registry. A handler the extractor cannot lower (a forbidden token, a module-scope identifier) has no body on any command and is reported by `objectstack lint`'s `hook-body/*` rules and `objectstack build`'s warn-and-bundle line, never guessed at here.
 - Nothing about what `objectstack build` accepts changes; on both axes above `objectstack validate` now agrees with it.

packages/cli/src/commands/validate.ts

@@ -234,17 +234,21 @@ export default class Validate extends Command {
       //
       //     NOT A PURE NARROWING. The same pass also lowers an inline action
       //     `target` callable (`actions[*]`, `objects[*].actions[*]`) to a ref
-      //     string plus `body`. `ActionSchema.target` is `z.string()`, and
-      //     `normalizeStackInput` never touches function values, so before
-      //     this step the un-lowered parse REFUSED such a config
-      //     (`invalid_type` at `actions.0.target`, exit 1) while `os build`
-      //     accepted it all along. It is accepted here now — an accepted-set
-      //     relaxation on this command, measured through the real CLI on
-      //     both sides and pinned in
-      //     `test/lint-hook-rules-reach-handler-hooks.e2e.test.ts`; parity
-      //     with the build is the intent, and it is declared rather than
-      //     assumed because a sibling's acceptance is evidence of intent, not
-      //     a declaration on this command's face.
+      //     string plus `body`, and names a nameless `functions` ARRAY entry
+      //     (`[{ handler: fn }]`) `anon_fn`. `ActionSchema.target` is
+      //     `z.string()`, the array entry requires `name`, and
+      //     `normalizeStackInput` touches neither, so before this step the
+      //     un-lowered parse REFUSED both configs (`invalid_type` at
+      //     `actions.0.target`; `invalid_union` at `functions`; exit 1) while
+      //     `os build` accepted them all along. Both are accepted here now —
+      //     accepted-set relaxations on this command, each measured through
+      //     the real CLI on both sides and pinned in
+      //     `test/lint-hook-rules-reach-handler-hooks.e2e.test.ts`. Not
+      //     limbs: `hooks[*].handler` accepts a function un-lowered, and the
+      //     `functions` MAP forms parse either way. Parity with the build is
+      //     the intent, and it is declared rather than assumed because a
+      //     sibling's acceptance is evidence of intent, not a declaration on
+      //     this command's face.
       //
       //     Nothing is emitted, so `lowering.functions` is unused here, and
       //     the extraction refusals in `bodyExtractionWarnings` are NOT

packages/cli/test/lint-hook-rules-reach-handler-hooks.e2e.test.ts

@@ -177,6 +177,28 @@ export default {
 };
 `;
 
+/**
+ * THE THIRD LIMB (#16544 re-review) — a nameless `functions` ARRAY entry.
+ * `stack.zod.ts` requires `name: z.string()` on the array form, and
+ * `normalizeStackInput` never touches `functions`, so `[{ handler: fn }]`
+ * failed the `functions` union at the parse on the un-lowered stack (exit 1)
+ * while `lowerBody` names it `anon_fn` before `os build`'s parse. The same
+ * pass now names it here too, so `os validate` accepts it. The `functions`
+ * MAP forms parse either way (not a limb); `hooks[*].handler` accepts a
+ * function un-lowered (not a limb).
+ */
+const CONFIG_FUNCTIONS_NAMELESS = `
+export default {
+  manifest: { id: 'com.example.reach_functions_nameless', name: 'reach_functions_nameless', version: '1.0.0', type: 'app' },
+  objects: [${OBJECT}],
+  functions: [{
+    handler: async (ctx: any) => {
+      return { ok: true, id: ctx.input.id };
+    },
+  }],
+};
+`;
+
 const dirs: Record<string, string> = {};
 
 function project(key: string, source: string): string {
@@ -191,6 +213,7 @@ beforeAll(() => {
   project('body', CONFIG_BODY);
   project('handlerOk', CONFIG_HANDLER_OK);
   project('actionTarget', CONFIG_ACTION_TARGET);
+  project('functionsNameless', CONFIG_FUNCTIONS_NAMELESS);
 });
 
 afterAll(() => {
@@ -292,4 +315,13 @@ describe('#16544 — the WIDENING limb: an inline action `target` callable is no
     const run = await runCli(['build', 'objectstack.config.ts', '--json'], dirs.actionTarget);
     expect(run.code, label(run)).toBe(0);
   }, 90_000);
+
+  it('INTAKE — a nameless `functions` array entry is accepted too (the pass names it `anon_fn`; exit 0, valid)', async () => {
+    // Red-first on the same BASE/HEAD pair: on BASE the `functions` union
+    // refuses the entry (no `name`) and the run exits 1; on HEAD it parses.
+    // `os build` accepted it on both sides, as for the action leg above.
+    const run = await runCli(['validate', 'objectstack.config.ts', '--json'], dirs.functionsNameless);
+    expect(run.code, label(run)).toBe(0);
+    expect(JSON.parse(run.stdout).valid, label(run)).toBe(true);
+  }, 60_000);
 });