finding: #8340's `unprovisionedAnchors` comment names `check-cross-package-test-inputs` as the guard that would notice a caller dropping the index — that gate does not do this

[qq9340100]

Observed while implementing #8404, which was directed to mirror #8340's parameter shape. Filed as an observation; not fixed, since #8404's scope was its own module and this comment lives in validate-page-field-bindings.ts.

The claim

packages/lint/src/validate-page-field-bindings.ts:350-357, documenting checkFieldRefs' optional trailing unprovisionedAnchors parameter, ends:

Every in-repo caller passes it; check-cross-package-test-inputs is what would notice if one stopped.

Why it appears to be wrong

scripts/check-cross-package-test-inputs.mjs is a CI input-scoping gate. Its own header states its purpose: keep CI's idea of a test's inputs equal to the test's real inputs, for tests that read outside their own package, by driving turbo's affected-package set (layer A) and the task-cache hash (layer B) from a declared glob list. It reasons about which packages CI runs and how the cache is keyed. It does not inspect call sites and has no view of argument passing.

Its @objectstack/lint entry (:117-126) declares globs for packages/cli/src/commands/**, packages/metadata-protocol/src/**, packages/objectql/src/validation/** and packages/services/service-automation/src/** — the radius of authoring-rule-wiring / validate-rule-compilability / lint-startup-registry-verdict.corpus. Nothing in that entry concerns the anchor index or the rules that consume it.

So an in-repo caller silently dropping the argument would, as far as I can tell, be caught only by a behaviour test that goes through the top-level validate* entry point — not by this gate.

Why it is worth correcting rather than ignoring

The sentence is load-bearing as a maintenance instruction: it tells the next author that the wiring is machine-guarded, which is exactly the belief that stops someone writing the test that really guards it. It also propagates — #8404 was dispatched with instructions to mirror this comment block, and the claim would have been copied verbatim into a sixth module had it not been checked. (In #8404's implementation the sentence was replaced with one naming the two in-repo callers explicitly, and the wiring is pinned instead by tests that run through validateSearchableFields, which builds and threads the index.)

Suggested disposition

Either correct the sentence to name what actually guards the wiring, or add the guard it claims exists. Worth checking the other three #8340 modules for the same copied sentence at the same time.

Related: #8340, #8404, #7802 (the gate's actual origin).

[hotlong]

Finding round — first-touch grading: PROMOTE. finding → pm:queue. domain:devx retained (lands in packages/lint). Type Task.

Graded separately from #8698, against the previous fire's suggestion to grade the two as one. They name the same gate and that is the whole of the overlap: #8698 is a genuine detector hole inside check-cross-package-test-inputs; this card is a false claim about that gate, living in another package, fixed by editing prose. Different file surfaces, different work. Reasoning recorded on #8698 as well.

Rationale for promotion — the claim is false in the dangerous direction.

The sentence tells the next author the wiring is machine-guarded. That belief is precisely what stops someone writing the test that would actually guard it, so a wrong "this is covered" is worse than no comment at all. And the card's verification of the negative is sound rather than assumed: check-cross-package-test-inputs is a CI input-scoping gate that reasons about which packages CI runs and how the task cache is keyed. It does not inspect call sites and has no view of argument passing — it structurally cannot notice a caller dropping a parameter. The @objectstack/lint entry's declared globs concern the authoring-rule-wiring / validate-rule-compilability radius and say nothing about the anchor index.

The propagation is what lifts this above a one-line note. #8404 was dispatched with instructions to mirror #8340's parameter shape, comment block included — the false sentence would have been copied verbatim into a sixth module had the implementing agent not checked it. A wrong maintenance instruction that is being actively duplicated is a growing liability, not a static one.

This is the third card in today's sweep of the same class — an authoritative, recently-dated comment that has gone false and that a reader would act on (#8732 on unbacked-conflict-target.ts, #8734 on last-admin-guard.ts, this one). Noting the pattern for the devx seat: three independent instances in one day suggests the class is worth a mechanical answer eventually, not just three prose corrections. That is an observation, not scope for this card — do not widen into it here.

Scope:

1. Correct the sentence at packages/lint/src/validate-page-field-bindings.ts:350-357 to name what actually guards the wiring. lint: searchableFields is a FIFTH blanket-SYSTEM_FIELDS read site — a declared anchor on an external object becomes a $searchFields narrowing over a column with no storage #8404 has already set the precedent worth copying: it named the two in-repo callers explicitly and pinned the wiring with tests running through validateSearchableFields, which builds and threads the index.
2. Check the other three lint: view-filter / page-binding field checks resolve against the blanket SYSTEM_FIELDS union, so the #8116 unprovisioned-anchor warning cannot reach filter surfaces #8340 modules for the same copied sentence — the card names this and it is the half most likely to be skipped. A fix that corrects one instance of a sentence known to have been mirrored leaves the finding half-open.
3. Optional, and a judgement call: if the wiring genuinely deserves a mechanical guard, a behaviour test through the top-level validate* entry point is the shape named. Adding the guard the comment claimed is a legitimate answer; so is deleting the claim. Do not do both halves badly — pick one and say which in the report.

Docs-plus-tests, no behaviour change, no changeset expected on the comment half.

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round 3
Session: session_011RB4waLuNbdruCo6X9oobm
Branch: claude/issue-8664-unprovisioned-anchors-false-guard-claim
Worktree: objectstack-issue-8664
Domain: domain:devx
File surface: packages/lint/src/validate-page-field-bindings.ts · the other unprovisionedAnchors modules if and only if they carry an equivalent false claim · tests if you add the guard (stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: opus
Serial constraints cleared: none outstanding. packages/lint is free — #7529 (which held the package) merged at 17:01:49Z, so the same-package serial bar this seat imposed is lifted. No other in-flight card in this lane touches packages/lint.

Priority basis

Maintainer, 2026-08-15, verbatim: 「尤其是 bug v17 和 影响别人的任务优先」. This card qualifies on the third clause and that is why it is in this batch: the false sentence is actively propagating — #8404 was dispatched to mirror #8340's parameter shape comment block included, and the claim would have been copied verbatim into a sixth module had the implementing agent not checked it. A wrong maintenance instruction that is being duplicated is a growing liability, not a static one.

Premise re-check — confirmed on origin/main @ 498f4e88, 2026-08-15T17:4xZ

The sentence is live, at the tail of the unprovisionedAnchors parameter comment:

Every in-repo caller passes
it; check-cross-package-test-inputs is what would notice if one stopped.

⚠️ It wraps across two source lines, which is why a single-line grep for the card's quoted form returns nothing. ⛔ Do not conclude from a zero-hit that it is gone — that trap has now fired twice in this seat today.

⚠️ A measured correction to the card's scope item 2

The card and its grading both say "check the other three #8340 modules for the same copied sentence." Measured: it was not copied. git grep -l 'is what would notice' -- packages/lint/src/** returns exactly one file — this one. The unprovisionedAnchors family is six files (validate-flow-template-paths.ts, validate-page-field-bindings.ts, validate-react-page-props.ts + its test, validate-searchable-fields.ts, validate-widget-bindings.ts).

⇒ Scope item 2 is not "fix the copies". It is: read the other five and check whether any makes an equivalent guarantee in different words. A differently-worded false claim is the same defect and my grep cannot see it. ⛔ Do not skip this because my exact-string sweep came back clean — that sweep only rules out verbatim duplication.

Zone 1 — Ruled at grading (5295994169). ⛔ Not re-litigable.

• The claim is false in the dangerous direction: it tells the next author the wiring is machine-guarded, which is exactly the belief that stops someone writing the test that would guard it. check-cross-package-test-inputs is a CI input-scoping gate — it reasons about which packages CI runs and how the task cache is keyed, structurally cannot inspect call sites, and has no view of argument passing.
• Pick ONE answer and say which: correct the sentence to name what actually guards the wiring, or add the guard it claims exists (a behaviour test through the top-level validate* entry point). ⛔ Do not do both halves badly. lint: searchableFields is a FIFTH blanket-SYSTEM_FIELDS read site — a declared anchor on an external object becomes a $searchFields narrowing over a column with no storage #8404 set the precedent worth copying: it named the two in-repo callers explicitly and pinned the wiring with tests running through validateSearchableFields, which builds and threads the index.
• ⛔ Do not widen into the class. Grading notes this is the third card in one day of "an authoritative, recently-dated comment has gone false" (with types: unbacked-conflict-target.ts's module head still says #8590 is open and unfixed — a comment reasoning from a premise that is no longer true #8732, Nothing binds the last-admin-guard standing-key lists to what the authz resolver actually reads — the correspondence is prose only #8734) and that the class may deserve a mechanical answer — explicitly not scope for this card.

Zone 2 — Verify, don't inherit

That check-cross-package-test-inputs cannot notice a dropped argument. ⚠️ That gate changed today — PR #8899 (merged 16:08Z) widened its path recognition (new URL seeds, argument-position reads, shallowest-depth escape). The widening is about which paths it sees, not about call-site inspection, so the card's conclusion should still hold — but it is now a claim about a file that moved, so re-read the gate rather than trusting the card's description of it.

Changeset

Comment-only ⇒ no changeset. If you add tests to packages/lint, tests-only still takes skip-changeset. Confirm against what you actually touch.

---

Generated by Claude Code