Check whether a resource and everything it depends on is sound — the deployability question. Pass 'hypothetical' to preview a change instead: hypothetical='delete' or 'unpublish' reports what would break WITHOUT changing anything (run it before deleting something other resources may use), and hypothetical='publish' checks whether the draft you are about to publish actually resolves. An APP is the usual subject: it walks every root the app contains (endpoints, schedules, domains) to the end of each chain and reports what would break. Returns findings {resource, path, severity, check, message}: errors are broken now (a reference that does not resolve, a dependency never published, a declared domain that routes elsewhere, a step naming a resource outside its workflow's scope, a call to a workflow that continues, which cannot run as a sub-workflow), warnings are risks (a published resource following @latest, a sub-workflow call cycle, a domain not yet verified, a sub-workflow step that the scope it runs under for one caller will refuse), info is advisory. deployable is true when there are no errors. Also reports incomplete_nodes: resources whose references are built at run time and so cannot be checked statically. For a non-root subject like a workflow, analysis starts there rather than from whatever reaches it, so severities are not weighted by reachability.
