…4380)

Every lint rule that inspects flow nodes had hand-written the same one-liner —
`const nodes = Array.isArray(flow.nodes) ? flow.nodes : []` — and every one was
therefore blind to the same thing. `FlowRegionSchema` holds a full
`nodes: z.array(FlowNodeSchema)`, and four config slots carry one:
`try_catch.config.try` / `.catch`, `loop.config.body`, and
`parallel.config.branches[].nodes`. Regions nest arbitrarily. Move a node into
any of them and the checking stayed behind.

Measured, same bad nodes flat vs inside a try_catch:

  flow-node-write-unknown-field (error)  1 → 0
  flow-update-readonly-field    (error)  1 → 0
  approval-approver-*                    1 → 0
  flow-template-unknown-field   (error)  1 → 1, but as a WARNING

The last one is the one a reader would not predict. This rule scans a node's
whole config for string leaves, so it still SAW tokens inside a region — but its
`filter`-position split only looks at the top level of the node it was handed.
A nested filter token lost its position, so the #3810 finding ("this node cannot
run — an erased condition WIDENS the query") degraded to an advisory warning,
reported against the wrapping try_catch instead of the get_record that is
broken. Being visible is not the same as being judged correctly, and that is
worse than a clean miss: a yellow line reads as "checked, merely advisory".

One shared walk, not five. `flow-walk.ts` is the flow-side counterpart of the
existing `page-walk.ts`, here for the same stated reason — getting the traversal
right is subtle enough that duplicating it has already produced dead rules.
`walkFlowNodes` yields every node with its real config path
(`flows[0].nodes[1].config.catch.nodes[0]`), a region breadcrumb for diagnostics
(`try_catch "Guard" › catch`), and depth. Four rules route through it. Findings
now land on the node that is actually wrong — a path pointing at the container
is not actionable in a flow with several regions.

The double-count trap is handled once, not left to each caller. A container is
walked too (its own config is worth checking — a loop's `collection`, a
try_catch's `retry`), but its config physically contains every descendant, so a
recursive scanner would report each nested finding twice. `localConfig` is the
container's config with region slots removed; a test pins that a nested token is
reported once while the container's own token still is.

`REGION_SLOTS` is data, pinned against the spec's region-bearing config schemas
by behavioural derivation rather than restatement, so a fifth construct fails
that test instead of becoming a fifth blind spot. `MAX_REGION_DEPTH` keeps a
hand-authored (pre-parse) stack from hanging a lint.

Verified end to end: nested now matches flat on every rule, including the
restored error severity. app-showcase ships an update_record inside a `catch`
branch that had never been checked by anything; it is correct, so validation
stays clean, and breaking its field name on purpose now fails `os validate` at
`flows[24].nodes[1].config.catch.nodes[0].config.fields.sync_statuss`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>