[observation] config.objects[].actions[] (object-embedded actions) may also bypass defineStack's cross-reference walk — unverified, same mechanism as #6889's row E #7397

Observation-class record, deliberately unverified — filing so it is not lost, per the finding-first discipline. Surfaced by the #6889 dev while implementing PR #7392; reported to the PM rather than filed as a defect because it was not probed.

The hypothesis

defineStack's action cross-reference walk (packages/spec/src/stack.zod.ts, validateCrossReferences) iterated config.actions — the registered list — and, since PR #7392, also inline page-element actions collected from page regions/slots/nested containers. Neither walk visits actions embedded on objects (config.objects[].actions[]), if that authoring position carries the same modal/flow target keys. A dangling type: 'modal' or type: 'flow' target there would build clean by the same mechanism as #6889's row E — silent until clicked.

Status of the claim

• NOT probed. The Inline (page-element) actions bypass defineStack's action cross-reference validation entirely — a dangling type: 'modal' target builds clean #6889 dev reported it as an unverified observation ("a ~10-minute probe of the same shape as this card's five-stack probe") and did not measure it; neither has this seat. Nothing here asserts the hole exists — the schema may not accept cross-referencing action shapes at that position at all, which would void the observation.
• The probe that settles it: one defineStack call with an object-embedded action carrying type: 'modal', target: 'nowhere' (and a flow twin), expecting either a rejection (observation void — close this) or an acceptance (the Inline (page-element) actions bypass defineStack's action cross-reference validation entirely — a dangling type: 'modal' target builds clean #6889 defect class, one surface over — promote to a queue card).

Context

• Inline (page-element) actions bypass defineStack's action cross-reference validation entirely — a dangling type: 'modal' target builds clean #6889 / PR fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392 — the inline-page-action half, landed with the traversal + 20-case pin suite; its PR body documents the walk's roots (registered list + page trees).
• showcase's registered showcase_new_task action targets a PAGE, so the global_nav "New Task" command opens the home page in a dialog instead of creating a task #6739's maintainer ruling (2026-08-09): a modal target names a PAGE only — the contract any new arm would enforce.
• The fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392 test file (stack-inline-action-crossref.test.ts) is the natural home for the probe's pins if the hole is real.

Filed unlabeled and unassigned for triage per #4949 discipline. Dedup: open-issue search for objects actions cross-reference / object-embedded action target / defineStack validation returns #6889 (closed by PR #7392, inline half) and #6739 (closed, target semantics) — no card covers the object-embedded position.