@@ -101,6 +101,7 @@ import type { FlowNodeParsed, FlowEdgeParsed } from '@objectstack/spec/automatio
 // hand-written notion of "blank" here — that drift is what #15662 built the
 // shared refusal to prevent.
 import { EvaluatedExpressionInputSchema, EVALUATED_EXPRESSION_SOURCE_REQUIRED } from '@objectstack/spec/shared';
+import { referenceCarrierOf } from '@objectstack/spec/data';
 
 import { collectFlowVariableNames, shadowedFieldReads, shadowedFieldMessage } from './flow-variable-scope.js';
 import { injectedColumnsFor, unprovisionedInjectedColumnsFor } from './system-fields.js';
@@ -377,8 +378,16 @@ function masterDetailCount(obj: AnyRec): number {
     // rejected alias — `field.zod.ts:331` maps it to `reference` in the strict
     // error map, so a field spelling it does not parse (#5017). See the
     // `## Scope` table on this module for why a consumer must not re-admit it.
-    const ref = def.reference;
-    if (typeof ref === 'string' && ref.trim() !== '') n += 1;
+    //
+    // [#18550] Read through the ONE arbiter. ABSENCE is unchanged and still
+    // uncounted — `undefined` / `null` / `''` answer `undefined`, and the
+    // `.trim()` test below still drops a whitespace-only carrier, which names
+    // no object either. UNREADABILITY used to be uncounted too, and that is
+    // the silence: an object-valued carrier made a declared `master_detail`
+    // invisible to this count, so `parent` was judged unbound (or two masters
+    // read as one) from metadata that does declare a relationship.
+    const ref = referenceCarrierOf(def, 'validate-expressions masterDetailCount');
+    if (ref !== undefined && ref.trim() !== '') n += 1;
   }
   return n;
 }
 
@@ -121,6 +121,7 @@
 
 import { deriveFieldGroupLayout, resolveDisplayField } from '@objectstack/spec/data';
 import type { DisplayNameObjectMeta } from '@objectstack/spec/data';
+import { referenceCarrierOf } from '@objectstack/spec/data';
 import { collectionEntries } from './collection-entries.js';
 import { recordsOf } from './object-graph.js';
 import { injectedColumnsFor } from './system-fields.js';
@@ -549,7 +550,12 @@ function walkObject(ledger: ConsumerLedger, obj: AnyRec, objectName: string, obj
     walk(ledger, value, objectName, 'objects', `${objPath}.${key}`, [key], key);
   }
   for (const { rec: field, path: fieldPath } of collectionEntries(obj.fields, fieldsPath)) {
-    const reference = strName(field.reference);
+    // [#18550] The carrier through the ONE arbiter: `strName` answered
+    // `undefined` for an unreadable one exactly as it does for an absent one,
+    // so the `displayField` consumer edge below was never recorded and the
+    // ledger under-reported — a field a lookup DOES display read as unused.
+    // Absence still answers `undefined` and records nothing.
+    const reference = referenceCarrierOf(field, 'validate-field-consumers walkObject');
     const displayField = strName(field.displayField);
     if (reference && displayField && ledger.declares(reference, displayField)) {
       ledger.record(reference, displayField, { root: 'objects', path: `${fieldPath}.displayField`, kind: 'display' });
 
@@ -79,6 +79,7 @@ import {
   isPlatformProvidedObjectName,
   PLATFORM_PROVIDED_OBJECT_NAMES,
 } from '@objectstack/spec/system';
+import { referenceCarrierOf } from '@objectstack/spec/data';
 
 import { recordsOf, suggestName } from './object-graph.js';
 
@@ -293,8 +294,16 @@ export function validateObjectReferences(stack: AnyRec): ObjectRefFinding[] {
       const type = strName(field.type);
       if (!type || !RELATIONSHIP_TARGET_FIELD_TYPES.has(type)) continue;
       const fieldName = strName(field.name) ?? `#${fi}`;
+      // [#18550] Through the ONE arbiter. `strName` gave an unreadable carrier
+      // the same answer as an absent one, and `check` returns early on
+      // `undefined` — so the field that most needs a target reported NOTHING:
+      // not `relationship/missing-reference` (the target is not missing), and
+      // not this rule's unknown-object error either. Absence still answers
+      // `undefined` and this rule still, deliberately, says nothing about it —
+      // an absent target is `field/relationship-without-reference`'s subject,
+      // not this rule's.
       check(
-        strName(field.reference),
+        referenceCarrierOf(field, 'validate-object-references field target'),
         `object "${objName}" · field "${fieldName}"`,
         `objects[${oi}].fields.${fieldName}.reference`,
         `${type} target`,
@@ -312,8 +321,12 @@ export function validateObjectReferences(stack: AnyRec): ObjectRefFinding[] {
       if (!param || typeof param !== 'object') continue;
       const paramLabel = strName(param.name) ?? strName(param.field) ?? `#${pi}`;
       const where = `${actionLabel} · param "${paramLabel}"`;
+      // [#18550] Same arbiter, same split. The carrier here is
+      // `ActionParamSchema.reference`, whose own docblock says the key name
+      // "deliberately mirrors `FieldSchema.reference` so the same spelling"
+      // carries the target object's name — one contract, so one reader.
       check(
-        strName(param.reference),
+        referenceCarrierOf(param, 'validate-object-references action param target'),
         where,
         `${actionPath}.params[${pi}].reference`,
         'record-picker target',
 
@@ -137,6 +137,7 @@
  */
 
 import { compileCelToFilter } from '@objectstack/formula';
+import { referenceCarrierOf } from '@objectstack/spec/data';
 import { recordsOf } from './object-graph.js';
 
 /** A `condition` outside the pushdown subset — the rule is never seeded. */
@@ -258,8 +259,13 @@ function effectiveSharingModelOf(obj: AnyRec): 'private' | 'read' | 'public' {
 function masterOf(obj: AnyRec): string | undefined {
   for (const f of recordsOf(obj.fields)) {
     if (f.type === 'master_detail') {
-      const ref = f.reference;
-      if (typeof ref === 'string' && ref) return ref;
+      // [#18550] Through the ONE arbiter. An unreadable carrier used to read
+      // as "this master_detail names no master", so a `controlled_by_parent`
+      // detail whose master IS declared answered `undefined` here and the
+      // arm that needs the master went quiet. Absence still answers
+      // `undefined` and falls through to the `return undefined` below.
+      const ref = referenceCarrierOf(f, 'validate-sharing-rule-enforceability masterOf');
+      if (ref) return ref;
     }
   }
   return undefined;
 
@@ -13,7 +13,7 @@ import type {
   SeedLoadResultParsed,
   Seed,
 } from '@objectstack/spec/data';
-import { SeedLoaderConfigSchema, isMultiValueField } from '@objectstack/spec/data';
+import { SeedLoaderConfigSchema, isMultiValueField, referenceCarrierOf } from '@objectstack/spec/data';
 import { SEED_WRITE_EXECUTION_CONTEXT } from '@objectstack/spec/kernel';
 import { resolveSeedRecord } from '@objectstack/formula';
 import { bulkWrite, withTransientRetry, defaultIsTransientError, type BulkWriteRowResult, runWithAdvisoryAggregation, type AdvisoryGroup } from '@objectstack/core';
@@ -696,11 +696,21 @@ export class SeedLoaderService implements ISeedLoaderService {
       if (objDef && objDef.fields) {
         const fields = objDef.fields as Record<string, any>;
         for (const [fieldName, fieldDef] of Object.entries(fields)) {
-          if (
-            (fieldDef.type === 'lookup' || fieldDef.type === 'master_detail' || fieldDef.type === 'user') &&
-            fieldDef.reference
-          ) {
-            const targetObject = fieldDef.reference as string;
+          if (fieldDef.type === 'lookup' || fieldDef.type === 'master_detail' || fieldDef.type === 'user') {
+            // [#18550] The carrier goes through the ONE arbiter, which also
+            // retires the `as string` cast this read used to carry — the cast
+            // asserted exactly what the truthiness test had not checked, so an
+            // object-valued carrier became a `targetObject` that matched no
+            // name in `objectSet`, contributed no `dependsOn` edge, and was
+            // then pushed onto `references` for resolution to make of what it
+            // could. ABSENCE is unchanged: `undefined` / `null` / `''` answer
+            // `undefined` and the field is skipped, which is what a relational
+            // field naming no target means. The type gate stays FIRST so the
+            // set of fields whose carrier is read here is byte-identical to
+            // before — a `text` field carrying a stray `reference` is still
+            // never read, and so still never refused.
+            const targetObject = referenceCarrierOf(fieldDef, 'SeedLoader.buildDependencyGraph');
+            if (!targetObject) continue;
 
             // Track dependency ordering only for objects within the graph
             if (objectSet.has(targetObject) && !dependsOn.includes(targetObject)) {
 
@@ -26,7 +26,7 @@ import type { WriteObservabilityOptions } from '@objectstack/spec/contracts';
 // engine is what `metadata-protocol.validateData` returns, so letting the two
 // drift would put a translation layer between a verdict and its contract.
 import type { ValidateDataIssue, ValidateDataResponse } from '@objectstack/spec/api';
-import { parseAutonumberFormat, renderAutonumber, resolveAutonumberFormat, readAutonumberCounter, missingFieldValues, isTenancyDisabled, FILE_REFERENCE_TYPES, REFERENCE_VALUE_TYPES, referenceTargetOf, isFileIdToken, RAW_FILE_VALUES_CONTEXT_KEY, isCurrentUserDefaultToken, isNowDefaultToken, isMultiValueField, driverSupportsTransactions } from '@objectstack/spec/data';
+import { parseAutonumberFormat, renderAutonumber, resolveAutonumberFormat, readAutonumberCounter, missingFieldValues, isTenancyDisabled, FILE_REFERENCE_TYPES, REFERENCE_VALUE_TYPES, referenceTargetOf, referenceCarrierOf, isFileIdToken, RAW_FILE_VALUES_CONTEXT_KEY, isCurrentUserDefaultToken, isNowDefaultToken, isMultiValueField, driverSupportsTransactions } from '@objectstack/spec/data';
 // [#5158] Door 2's lowering sink — the SAME pair the protocol face (Door 1)
 // runs, so `FilterArray` has exactly one lowering in the product.
 import {
@@ -13093,7 +13093,24 @@ export class ObjectQL implements IObjectQLEngine {
         if (!childName || !fields) continue;
         for (const fdef of Object.values(fields)) {
           if (!fdef || (fdef.type !== 'master_detail' && fdef.type !== 'lookup')) continue;
-          const ref = fdef.reference;
+          // [#18550] The carrier is read through the ONE arbiter, so a
+          // `reference` no reader can read REFUSES here instead of reading as
+          // "this child does not reference `name`". The two answers stay
+          // different on purpose:
+          //
+          //  - ABSENCE (`undefined` / `null` / `''`) is unchanged and still
+          //    silent. `referenceCarrierOf` answers `undefined` for all three
+          //    and this `continue` skips the field, which is what a field that
+          //    names no target legitimately means (`FieldSchema.reference` is
+          //    `.optional()`, `StrictField` declares it nullable).
+          //  - UNREADABILITY is the loud one. An object- or array-valued
+          //    carrier was TRUTHY here and then failed both name comparisons
+          //    below, so the relation was dropped from the set silently — and
+          //    this function's `'none'` is, by its own docblock above, the one
+          //    verdict that asserts something POSITIVE about the schema
+          //    ("nothing references this object"). An unreadable carrier can
+          //    no more support that claim than an unreadable registry can.
+          const ref = referenceCarrierOf(fdef, 'ObjectQL.planCascadeAtomicity');
           if (!ref) continue;
           let resolvedRef: string | undefined;
           try { resolvedRef = this.resolveObjectName(ref); } catch { resolvedRef = undefined; }
@@ -13541,7 +13558,14 @@ export class ObjectQL implements IObjectQLEngine {
       if (!childName || !fields) continue;
       for (const [fieldName, fdef] of Object.entries(fields)) {
         if (!fdef || (fdef.type !== 'master_detail' && fdef.type !== 'lookup')) continue;
-        const ref = fdef.reference;
+        // [#18550] Same arbiter, same absence-vs-unreadability split as
+        // {@link ObjectQL.planCascadeAtomicity} states above — and this is the
+        // seam where the silence was measurable end to end: an unreadable
+        // carrier made the relation invisible to the cascade, so `delete()`
+        // removed the parent, left a `master_detail` child behind, and
+        // reported success. No `restrict` refusal, no `set_null`, nothing
+        // logged. Absence still `continue`s here exactly as before.
+        const ref = referenceCarrierOf(fdef, 'ObjectQL.cascadeDeleteRelations');
         if (!ref) continue;
         // Match the target object by raw or resolved name.
         let resolvedRef: string | undefined;
 
@@ -157,6 +157,7 @@ import {
     isApiOperationAllowed,
     API_PRIMITIVES,
     DATA_ACTION_TO_API_OPERATION,
+    referenceCarrierOf,
 } from '@objectstack/spec/data';
 // [#8013] The SHARED envelope writer (#3973), aliased. [#9098] The alias no
 // longer exists to dodge a NAME collision — the local responder this used to
@@ -10842,6 +10843,17 @@ export class RestServer {
                     const p = await this.resolveProtocol(environmentId, req);
                     let referenceObject: string | undefined = picker.object;
                     if (!referenceObject && typeof (p as any).getMetaItems === 'function') {
+                        // [#18550] The field def is HOISTED out of the fetch's
+                        // swallow and the carrier is read after it, deliberately.
+                        // The `catch` below exists for the metadata fetch — a
+                        // protocol that cannot answer leaves `referenceObject`
+                        // unset and the route answers `500 LOOKUP_TARGET_MISSING`
+                        // — and an unreadable carrier read INSIDE it would be
+                        // swallowed by it and land on that same envelope, which
+                        // is the conflation this card exists to end: "no target
+                        // is declared" and "the declared target cannot be read"
+                        // want different fixes from whoever owns the metadata.
+                        let fieldDef: unknown;
                         try {
                             const objectsRequest: TransportScopedMetaRequest<GetMetaItemsRequest> = {
                                 type: 'object',
@@ -10850,7 +10862,6 @@ export class RestServer {
                             const r: any = await p.getMetaItems(objectsRequest);
                             const items: any[] = Array.isArray(r?.items) ? r.items : Array.isArray(r) ? r : [];
                             const obj = items.find((o: any) => o?.name === match.object);
-                            const def = obj?.fields?.[fieldName];
                             // [#7486] Resolve the target from the canonical key — and, since
                             // [#12920], from it ALONE. `reference` is the spelling `FieldSchema`
                             // accepts, so it is the only spelling a field def can legitimately
@@ -10886,8 +10897,21 @@ export class RestServer {
                             // tolerated is the ADR-0087 conversion layer (`fieldReferenceToAlias`),
                             // replayed on stored-row rehydration — declared, tested and removable
                             // on a schedule, which a `??` arm here never was.
-                            referenceObject = def?.reference;
+                            //
+                            // [#18550] The canonical-key read itself now happens just BELOW this
+                            // `catch`, through the one arbiter — see there for why it moved.
+                            fieldDef = obj?.fields?.[fieldName];
                         } catch {/* ignore */}
+                        // ABSENCE stays silent and unchanged: `undefined` /
+                        // `null` / `''` all answer `undefined`, so the route
+                        // falls to the `LOOKUP_TARGET_MISSING` refusal below
+                        // exactly as before. UNREADABILITY throws past this
+                        // handler's outer `catch`, which classifies and LOGS it
+                        // (`mapDataError` + `logError`) rather than reporting a
+                        // missing target — and it also stops an object-valued
+                        // carrier from being forwarded as `query.object` into
+                        // `findData`, which is what it did before this change.
+                        referenceObject = referenceCarrierOf(fieldDef, 'REST public-form lookup picker');
                     }
                     if (!referenceObject) {
                         res.status(500).json({
 
@@ -19,6 +19,7 @@
 // is reported `blocked` with a precise reason — the gate stays honest.
 
 
+import { referenceCarrierOf } from '@objectstack/spec/data';
 import { declaredCollection } from './artifact-collections.js';
 
 const COMPUTED = new Set(['formula', 'summary', 'autonumber', 'rollup', 'vector']);
@@ -133,8 +134,16 @@ const REJECTED_REFERENCE_ALIASES = ['reference_to', 'referenceTo'] as const;
  * reports THAT.
  */
 function relationTarget(f: any): string | null {
-  const ref = f?.reference;
-  return typeof ref === 'string' && ref.length > 0 ? ref : null;
+  // [#18550] The carrier read through the ONE arbiter, which is the same
+  // argument the docblock above makes for {@link rejectedReferenceAlias}, one
+  // step further: degrading an UNREADABLE carrier to the generic "has no
+  // `reference` target" is the trade this reader already refused to make for a
+  // rejected alias. The operator would read "this object could not be derived"
+  // and never learn the carrier was the reason. Absence keeps its answer —
+  // `undefined` / `null` / `''` all become `null` here, exactly as before, and
+  // the report line about an absent target is still a report line.
+  const ref = referenceCarrierOf(f, 'verify deriveCrudCases relationTarget');
+  return ref ?? null;
 }
 
 /**