feat(lint): the #8116 unprovisioned-anchor warning reaches filter and page-binding surfaces (#8340)

[qq9340100]

Fixes#8340

What

The #8116 unprovisioned-anchor warning could not reach the filter surfaces. Its two rules resolve fields per object; the filter-position and page-binding checks judge a name against the object-independent SYSTEM_FIELDS union, which by design answers "could this name be a system column anywhere" and therefore never flags a system name. So filter: [['owner_id', '=', '…']] on a view, widget, page or flow bound to an ADR-0015 external object linted clean while the runtime degraded exactly as #8116 describes: on SQLite, constant-false, HTTP 200, zero rows, no error.

Four rules now ask the provenance question on the path where the existence check stays silent. Per the card's assumption 2, the blanket union is not replaced anywhere — it keeps owning every pass/fail decision, and #8340 only adds a question about a name it already decided not to flag:

rule id	surface	consequence the message names
dashboard-filter-field-unprovisioned	dashboard filter (dateRange / globalFilters[], after filterBindings) ANDed into a widget's analytics query	widget renders empty instead of crashing; suppressible per widget
page-field-unprovisioned	page + react component field bindings (shared checkFieldRefs core)	QUERY positions: silent zero. display positions: blank column
react-chart-field-unprovisioned	< ObjectChart aggregate>'s field / groupBy	one empty bucket / nothing aggregated
flow-template-field-unprovisioned	{record.< anchor>} in a record-change flow on an external trigger object	in a guarded CRUD filter, the token erases the condition and the node refuses to run (framework#3810)

All four are warning, never gating — including in the two positions where the existence twin is an error. #8116's severity reasoning is unchanged: the existence question has a closed oracle (the field is absent or it is not), the provenance one does not — this pass knows the platform provisions no storage, not what the deployment's remote schema holds.

Shared, rather than four copies of one sentence: indexUnprovisionedAnchors, unprovisionedAnchorCause and unprovisionedAnchorHint in packages/lint/src/system-fields.ts, over #8116's unprovisionedInjectedColumnsFor. No new derivation — the spec predicate stays the single source (packages/spec untouched).

Per-surface false-positive analysis

The card warned each rule's tolerance for unresolvable names differs. Measured, all four could adopt the per-object derivation, and none needed a new object binding:

• widget-bindings — the object comes from dataset.object; the rule already skips when its fields are unknown in this stack. The anchor lookup rides the same skip.
• react-page-props — objectName prop, already required by the existing checks.
• page-field-bindings — the shared core already bails on a missing object name and a cross-package object. The anchor index is an optional sixth parameter, so out-of-repo callers of this exported core (cloud graph-lint, the AI authoring path) keep the pre-lint: view-filter / page-binding field checks resolve against the blanket SYSTEM_FIELDS union, so the #8116 unprovisioned-anchor warning cannot reach filter surfaces #8340 behaviour instead of silently gaining findings.
• flow-template-paths — the trigger object off the start node, already resolved and already required (the rule skips the whole flow without it). Note the token reads the TRIGGER record, so the anchors are the trigger object's, not the CRUD node's target.

Two exclusions were kept everywhere: a dotted relationship path (engine-resolved, unjudgeable here) and an author-declared column of the same name, which is the author's real remote column (#7859) and never enters the set.

Tests

New named coverage per surface, each mutation-tested in both directions:

• killing each emission turns that surface's warns… test red and leaves the is silent… tests green;
• making the derivation over-reach (every injected column treated as unprovisioned) turns the is silent on the local twin / author DECLARES the column tests red — and, as a bonus, three pre-existing false-positive-floor tests in other suites.

pnpm --filter @objectstack/lint test — 72 files, 1996 passed, 4 skipped. Typecheck, eslint, check:cross-package-test-inputs, check:spec-parsed-alias, check:nul-bytes, check:changeset-gate-self-tests, check:objectui-changeset, check:query-options-erasure, check:type-check-coverage, check-changeset-no-major all green locally.

Notes for review

• packages/lint/src/index.ts is one step beyond the card's declared file surface: the four new rule ids are exported there, as semantic-role-field-unprovisioned is. No other file outside the surface is touched.
• The changeset is minor for @objectstack/lint, following the finding: author-time expression validation resolves injected anchors on external objects but cannot warn they are unprovisioned — the #7865 provenance marker is unreachable from @objectstack/lint #8116 changeset and the other new-lint-rule changesets in .changeset/, not the patch the dispatch note guessed at.
• check:objectui-pin-fresh is red locally, on repo state (.objectui-sha lagging objectui main) and not on anything in this diff — it is only triggered here because the workflow watches .changeset. Off the release lane CI runs it --advisory.
• Out of scope, filed: lint: searchableFields is a FIFTH blanket-SYSTEM_FIELDS read site — a declared anchor on an external object becomes a $searchFields narrowing over a column with no storage #8404 (a fifth blanket-union read site, searchableFields), finding: #8116's two unprovisioned-anchor diagnostics still hand-copy the cause sentence #8340 centralized into system-fields.ts #8405 (finding: author-time expression validation resolves injected anchors on external objects but cannot warn they are unprovisioned — the #7865 provenance marker is unreachable from @objectstack/lint #8116's two originals still hand-copy the cause sentence).

Generated by Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 13, 2026 12:14pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint.

3 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/automation/hook-bodies.mdx(via @objectstack/lint)
• content/docs/deployment/validating-metadata.mdx(via packages/lint)
• content/docs/permissions/authorization.mdx(via @objectstack/lint)

⛔ 1 release-owned page(s) also reference the affected code. These are read-only:

• content/docs/releases/v17.mdx(via @objectstack/lint)

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.