finding: author-time expression validation resolves injected anchors on external objects but cannot warn they are unprovisioned — the #7865 provenance marker is unreachable from @objectstack/lint

[os-zhuang]

Observation recorded while implementing #7865 (PR #8115); the card asked whether the marker reaches the author-time surface (#5378 / #6113 history), and the measured answer is: it does not, structurally.

The gap

#5378 taught the author-time expression validator to RESOLVE registry-injected system columns (resolveInjectedSystemColumns, @objectstack/spec/data), so has(record.owner_id) on an injection-only object stopped being rejected. That derivation is deliberately storage-blind: it answers "is this name addressable", never "is there a column behind it".

After #7865 the runtime can answer the second question (resolveInjectedColumnProvenance / unprovisionedInjectedColumns, @objectstack/metadata-core): on an external (ADR-0015) object the injected anchors are registered but unprovisioned, and a predicate over one degrades silently on SQLite (constant-false: HTTP 200, zero rows, no error).

The author-time surface cannot ask it. @objectstack/lint's package contract is "depends on @objectstack/spec, never on a runtime", and the provenance derivation needs the injected-column DEFINITION tables, which live in @objectstack/metadata-core by the #3786 WHICH/WHAT split. So an author writing record.owner_id in an expression, view filter, or highlight on a federated object gets a clean lint pass today, and the failure surfaces at query time, silently, on the default dev dialect.

Why filed as a finding and not a defect

• No consumer is currently known to hit it in a shipped app; the three runtime guards (fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833 / fix(plugin-security): Layer 0 no longer walls a federated object with a phantom organization_id (#7835) #7859 / plugin-sharing lowers __readScope own/unit to an owner_id predicate on federated objects, where owner_id is a phantom column #7858) cover the runtime half of the class.
• Fixing it is a design decision, not a patch: either sink the provenance derivation into @objectstack/spec (its inputs are all document-declared keys — external, fields, the plan inputs — so it is spec-representable, but that moves part of the WHAT half of 排查「手抄 spec 清单 + "keep in sync" 注释」模式:一天内确认三例,全部曾静默漂移 #3786's split), or let lint grow a declared exception to its no-runtime rule for metadata-core (which depends only on spec + zod). Both shapes deserve a deliberate ruling, not a rider on [Decision] applySystemFields injects platform anchors into external objects the platform provisions no storage for — three consumers have now independently re-derived "that column is not really there" #7865.

Pointers

• Marker: packages/metadata-core/src/injected-system-columns.ts (provenance section, [Decision] applySystemFields injects platform anchors into external objects the platform provisions no storage for — three consumers have now independently re-derived "that column is not really there" #7865).
• Validator entry points: packages/lint/src/system-fields.ts, packages/lint/src/validate-expressions.ts (buildFieldIndex).
• History: Author-time expression validator is blind to registry-injected system columns — record.owner_id / created_at / organization_id are rejected as unknown fields #5378 (validator blindness to injected columns), 作者时表达式校验不认识平台注入列：record.owner_id == os.user.id 被判为 unknown field，最常见的归属谓词编译不过 #6113, [Decision] applySystemFields injects platform anchors into external objects the platform provisions no storage for — three consumers have now independently re-derived "that column is not really there" #7865 (the ruling and its fence).

---

Generated by Claude Code

[hotlong]

Triage: lands in domain:devx; rationale: the consumer that cannot warn is @objectstack/lint (packages/lint), and the missing producer-side marker is #7865's direction-B deliverable (in flight, domain:engine-core). Held as finding; re-grade when #7865's provenance marker lands — at that point this becomes "teach the lint walk to read the marker". Type: Task.

---

Generated by Claude Code

[hotlong]

Finding-grading round: escalated to needs-user-decision (domain:devx) — the hold trigger has already fired: #7865's provenance marker landed on origin/main (3670cf9, PR #8115: resolveInjectedColumnProvenance live in metadata-core with a 20-assertion test file).

Question: @objectstack/lint cannot reach the marker — its package contract is "Depends on @objectstack/spec; never on a runtime", and the marker lives in metadata-core. Two shapes, both maintainer-floor:

1. Sink the derivation into @objectstack/spec (moving part of 排查「手抄 spec 清单 + "keep in sync" 注释」模式:一天内确认三例,全部曾静默漂移 #3786's WHAT half) so lint reads it from the contract package.
2. Grant lint a declared exception to its no-runtime rule for metadata-core.

Four-prong analysis:

• Platform long-term coherence: (1) keeps the dependency direction clean (contract package as the single source); (2) breaches a stated package invariant and invites the next exception.
• Measured business pull: authors of external-object expressions get no author-time warning today that injected anchors are unprovisioned — the exact confusion [Decision] applySystemFields injects platform anchors into external objects the platform provisions no storage for — three consumers have now independently re-derived "that column is not really there" #7865 was ruled to prevent; three consumers independently re-derived "that column is not really there" before the marker existed.
• AI-agent error-resistance: author-time refusal/warning beats runtime surprise; either shape delivers it, (1) does so without weakening a structural rule an AI could later cite as precedent for other runtime imports.
• Startup scope discipline: (1) is a one-time move of an already-written derivation; (2) is cheaper today but creates a standing exception to maintain.

Recommendation: (1) — move the provenance derivation (or a pure predicate over it) into packages/spec, keep metadata-core re-exporting it, and let lint consume the spec export. Note this touches the spec export surface, so implementation dispatches under the spec-semantic-lane rules.

---

Generated by Claude Code