fix(lint): three write rules ask anchor provenance before exempting a system column (#8996)

* fix(lint): three write rules ask anchor provenance before exempting a system column (#8663)

`IMPLICIT_FIELDS` is object-independent, so on an ADR-0015 `external` object it
exempted injected anchors the platform never provisioned storage for. Measured
end to end: the engine's write-path validator PASSES the anchor (it is in the
registered schema) while refusing an undeclared name outright with
INVALID_FIELD, so the anchor is the only payload key that reaches the remote
database raw — where SQLite answers an untyped `no such column` that aborts the
whole statement.

Each of the three consumers now emits a separate advisory finding on that path,
at `warning`, reusing the read-axis anchor wording. Author-declared columns of
the same name stay untouched.

* docs(automation): record the unprovisioned-anchor write findings on the hook-bodies page (#8663)

* docs(automation): point the federation reference at the page that owns it (#8663)

The added line linked ADR-0015 to /docs/protocol/federation, which does not
exist — Check Documentation Links caught it. The ADR id now reads as bare text
(matching all eight existing ADR-0015 citations in content/docs) and the link
moves onto the concept, targeting the page that actually owns federation.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

.changeset/silly-pandas-repeat.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/lint': minor
+---
+
+Three write-surface lint rules now ask provenance, not just membership, before exempting a system column (#8663).
+
+`validate-hook-body-writes`, `validate-action-body-writes` and `validate-flow-node-writes` share one `IMPLICIT_FIELDS` set, which is object-INDEPENDENT: it answers "could this name be implicitly writable somewhere", never "did the platform provision a column for it on THIS object". On an ADR-0015 `external` object those diverge — the registry injects `owner_id` / `organization_id` / the audit family onto a federated object exactly as onto a local one, but the remote database owns the schema and no column exists behind them.
+
+Each rule now emits a new advisory finding on that path instead of staying silent — `hook-body-write-unprovisioned-anchor`, `action-body-write-unprovisioned-anchor`, `flow-node-write-unprovisioned-anchor` — sharing the `unprovisionedAnchorCause` / `unprovisionedAnchorHint` wording the read-axis rules already use. All three are `warning`: the flow-node rule's existence finding still gates at `error`, and its provenance finding deliberately does not, because the claim is about a remote schema this repo cannot see.
+
+An author-DECLARED column of the same name is untouched — on a federated object it maps a remote column the author vouches for. `FlowNodeWriteSeverity` widens from `'error'` to `'error' | 'warning'` accordingly.

content/docs/automation/hook-bodies.mdx

@@ -141,6 +141,7 @@ Static validation around a hook is asymmetric, and it is worth knowing exactly w
 - **Checked — read side.** `hook.condition` is validated at build time against the target object's fields by the expression validator (`@objectstack/lint`), including array-valued `hook.object` targets. A condition referencing a nonexistent field fails the lint.
 - **Checked — capability side.** `body.capabilities` gates which `ctx` APIs the body may call at all; the sandbox throws on an undeclared call.
 - **Checked — write side, advisory and literal-only.** Since [#4271](https://github.com/objectstack-ai/objectstack/issues/4271), `body.source` is **parsed** (never executed, never type-checked) and the field names it writes are resolved against the target object's declarations. An unknown field raises `hook-body-write-unknown-field` — a **warning** carrying a did-you-mean suggestion, which never blocks a build. Action bodies get the same check on their `ctx.api` writes (`action-body-write-unknown-field`). Both run under `os validate`, `os lint` and `os compile`.
+- **Checked — writes to a system column the object has no storage for.** Since [#8663](https://github.com/objectstack-ai/objectstack/issues/8663), a write to an injected system column is no longer exempted on the strength of its NAME alone. The registry injects `owner_id` / `organization_id` / the audit family onto an ADR-0015 [`external` object](/docs/data-modeling/external-datasources) exactly as onto a local one, but the remote database owns that schema and no column exists behind them. Writing one raises `hook-body-write-unprovisioned-anchor` (or `action-body-write-unprovisioned-anchor` / `flow-node-write-unprovisioned-anchor` on the other two surfaces) — a **warning** on all three, including the flow-node rule that otherwise gates, because the claim is about a remote schema the build cannot see. A column you **declare** yourself is untouched: on a federated object a declared `owner_id` maps a remote column you vouch for. Why it matters more than an ordinary typo: an undeclared name is refused upstream by the engine's own write-path validator (`INVALID_FIELD`), whereas the injected anchor is in the registered schema and passes it — so it is the one payload key that reaches the remote database raw, where a SQL remote aborts the **whole statement** with an untyped `no such column` and takes the correctly named fields of the same payload with it.
 - **Checked — writes that reach nothing at all.** Since [#4345](https://github.com/objectstack-ai/objectstack/issues/4345), an action body assigning to `ctx.record` raises `action-record-write-discarded`, also a warning. This one is **not** a field-resolution question: an action's `ctx.record` is a snapshot the runtime never writes back, so the assignment is discarded whether or not the field is declared — see [Signature conventions](#signature-conventions) below.
 
 Four literal write shapes are recognized, and only these:

packages/lint/src/index.ts

@@ -484,6 +484,7 @@ export {
   HOOK_BODY_WRITE_PATTERN_IDS,
   HOOK_BODY_WRITE_EXCLUSIONS,
   HOOK_BODY_WRITE_UNKNOWN_FIELD,
+  HOOK_BODY_WRITE_UNPROVISIONED_ANCHOR,
 } from './validate-hook-body-writes.js';
 export type {
   HookBodyWriteFinding,
@@ -506,6 +507,7 @@ export {
   ACTION_RECORD_WRITE_PATTERN_IDS,
   ACTION_BODY_WRITE_EXCLUSIONS,
   ACTION_BODY_WRITE_UNKNOWN_FIELD,
+  ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR,
   ACTION_RECORD_WRITE_DISCARDED,
 } from './validate-action-body-writes.js';
 export type {
@@ -522,6 +524,7 @@ export type {
 export {
   validateFlowNodeWrites,
   FLOW_NODE_WRITE_UNKNOWN_FIELD,
+  FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR,
   FLOW_WRITE_NODE_TYPES,
   FLOW_WRITE_NODE_TYPES_DEFERRED,
 } from './validate-flow-node-writes.js';

packages/lint/src/validate-action-body-writes.test.ts

@@ -9,6 +9,7 @@ import {
   ACTION_RECORD_WRITE_PATTERN_IDS,
   ACTION_BODY_WRITE_EXCLUSIONS,
   ACTION_BODY_WRITE_UNKNOWN_FIELD,
+  ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR,
   ACTION_RECORD_WRITE_DISCARDED,
 } from './validate-action-body-writes.js';
 import {
@@ -446,3 +447,57 @@ describe('validateActionBodyWrites — scope and shape tolerance', () => {
     ).not.toThrow();
   });
 });
+
+// ─── [#8663] Unprovisioned injected anchors on the WRITE axis ────────────────
+//
+// This rule shares IMPLICIT_FIELDS with the hook rule, so it shared the set's
+// object-independence too: on an ADR-0015 `external` object the injected anchor
+// is registered but has no column behind it. See the hook rule's test block for
+// the measured runtime chain the diagnostic's wording reports.
+const federatedObject = {
+  name: 'wh_order',
+  datasource: 'warehouse',
+  external: { remoteName: 'fact_orders' },
+  fields: { order_id: { type: 'text' }, amount: { type: 'number' } },
+};
+const localTwin = { name: 'wh_order', fields: { order_id: { type: 'text' }, amount: { type: 'number' } } };
+
+function actionStackOver(object: Record<string, unknown>, source: string) {
+  return {
+    objects: [object],
+    actions: [{ name: 'stamp_owner', label: 'Stamp', objectName: 'wh_order', body: { language: 'js', source } }],
+  };
+}
+
+describe('[#8663] validateActionBodyWrites — unprovisioned anchor writes', () => {
+  it('warns when an action body writes an anchor the federated object has no storage for', () => {
+    const findings = validateActionBodyWrites(
+      actionStackOver(federatedObject, "await ctx.api.object('wh_order').updateById(ctx.recordId, { owner_id: ctx.user.id });"),
+    );
+    expect(findings).toHaveLength(1);
+    expect(findings[0].rule).toBe(ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR);
+    expect(findings[0].severity).toBe('warning');
+    expect(findings[0].where).toBe('action "stamp_owner" › body');
+    expect(findings[0].path).toBe('actions[0].body.source');
+    expect(findings[0].message).toContain("'owner_id'");
+    expect(findings[0].message).toContain('external object (ADR-0015)');
+    expect(findings[0].message).toContain('can never land');
+  });
+
+  it('the same write without the external binding is silent', () => {
+    expect(
+      validateActionBodyWrites(
+        actionStackOver(localTwin, "await ctx.api.object('wh_order').updateById(ctx.recordId, { owner_id: ctx.user.id });"),
+      ),
+    ).toEqual([]);
+  });
+
+  it('an author-declared column of the same name is never flagged', () => {
+    const declared = { ...federatedObject, fields: { ...federatedObject.fields, owner_id: { type: 'text' } } };
+    expect(
+      validateActionBodyWrites(
+        actionStackOver(declared, "await ctx.api.object('wh_order').updateById(ctx.recordId, { owner_id: ctx.user.id });"),
+      ),
+    ).toEqual([]);
+  });
+});

packages/lint/src/validate-action-body-writes.ts

@@ -77,11 +77,17 @@
 // match either shape and never pays the TypeScript load.
 
 import { findClosestMatches, formatSuggestion } from '@objectstack/spec/shared';
+import {
+  indexUnprovisionedAnchors,
+  unprovisionedAnchorCause,
+  unprovisionedAnchorHint,
+} from './system-fields.js';
 import {
   extractHookBodyWriteSet,
   indexObjectFields,
   judgeableFieldsOf,
   IMPLICIT_FIELDS,
+  unprovisionedAnchorWriteConsequence,
   HOOK_BODY_WRITE_PATTERNS,
   type BodyWritePatternExclusion,
   type HookBodyWritePattern,
@@ -105,6 +111,13 @@ export interface ActionBodyWriteFinding {
 export const ACTION_BODY_WRITE_UNKNOWN_FIELD = 'action-body-write-unknown-field';
 export const ACTION_RECORD_WRITE_DISCARDED = 'action-record-write-discarded';
 
+/**
+ * [#8663] The action-surface twin of `hook-body-write-unprovisioned-anchor`.
+ * Same question, same wording, same `warning` severity — this rule and the hook
+ * rule share {@link IMPLICIT_FIELDS}, so they shared its blind spot too.
+ */
+export const ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR = 'action-body-write-unprovisioned-anchor';
+
 // ─── The applicable-pattern ledger ──────────────────────────────────────────
 //
 // Not a second pattern list: a declared PARTITION of the shared
@@ -279,6 +292,8 @@ export function validateActionBodyWrites(stack: AnyRec): ActionBodyWriteFinding[
   // Built lazily: only the unknown-field check needs it, so a stack whose
   // action bodies never reach `ctx.api` never pays it.
   let objectFields: Map<string, Set<string>> | null = null;
+  // [#8663] Non-empty only for a stack carrying an ADR-0015 `external` object.
+  let anchors: ReadonlyMap<string, ReadonlySet<string>> | null = null;
 
   for (const site of sites) {
     // Cheap prefilter, narrower than the extractor's own: every consumed
@@ -326,6 +341,7 @@ export function validateActionBodyWrites(stack: AnyRec): ActionBodyWriteFinding[
 
     if (writes.length === 0) continue;
     objectFields ??= indexObjectFields(stack);
+    anchors ??= indexUnprovisionedAnchors(stack);
     const reported = new Set<string>();
 
     for (const w of writes) {
@@ -340,7 +356,25 @@ export function validateActionBodyWrites(stack: AnyRec): ActionBodyWriteFinding[
 
       const known = judgeableFieldsOf(objectFields, w.object);
       if (!known) continue; // cross-package, or no declared fields — cannot judge
-      if (IMPLICIT_FIELDS.has(w.field) || known.has(w.field)) continue;
+      // An author-DECLARED column is the author's, on a federated object too
+      // (it maps a remote column they vouch for) — never either finding.
+      if (known.has(w.field)) continue;
+      if (IMPLICIT_FIELDS.has(w.field)) {
+        // [#8663] Implicitly writable SOMEWHERE is not provisioned HERE.
+        if (!anchors.get(w.object)?.has(w.field)) continue;
+        reported.add(dedupeKey);
+        findings.push({
+          severity: 'warning',
+          rule: ACTION_BODY_WRITE_UNPROVISIONED_ANCHOR,
+          where,
+          path: site.path,
+          message:
+            `body calls ctx.api.object('${w.object}').${w.method ?? 'update'}(…) writing '${w.field}', and ` +
+            `${unprovisionedAnchorCause(w.object, w.field)} — ${unprovisionedAnchorWriteConsequence()}`,
+          hint: unprovisionedAnchorHint(w.object, w.field),
+        });
+        continue;
+      }
 
       reported.add(dedupeKey);
       findings.push({

packages/lint/src/validate-flow-node-writes.test.ts

@@ -11,6 +11,7 @@ import {
 import {
   validateFlowNodeWrites,
   FLOW_NODE_WRITE_UNKNOWN_FIELD,
+  FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR,
   FLOW_WRITE_NODE_TYPES,
   FLOW_WRITE_NODE_TYPES_DEFERRED,
 } from './validate-flow-node-writes.js';
@@ -482,3 +483,62 @@ describe('validateFlowNodeWrites', () => {
     expect(findings).toEqual([]);
   });
 });
+
+// ─── [#8663] Unprovisioned injected anchors on the WRITE axis ────────────────
+//
+// The third consumer of the hook rule's IMPLICIT_FIELDS, and the only one whose
+// existence finding GATES. The provenance finding deliberately does not: it is
+// a claim about a remote schema this repo cannot see, so reclassifying it up to
+// `error` would turn a silent case straight into a build break.
+const federatedDeal = {
+  name: 'wh_order',
+  datasource: 'warehouse',
+  external: { remoteName: 'fact_orders' },
+  fields: { order_id: { type: 'text' }, amount: { type: 'currency' } },
+};
+const localWhOrder = { name: 'wh_order', fields: { order_id: { type: 'text' }, amount: { type: 'currency' } } };
+
+const anchorFlow = (fields: unknown) => ({
+  name: 'stamp_owner',
+  type: 'record_change',
+  nodes: [
+    { id: 'start', type: 'start', config: {} },
+    {
+      id: 'mark',
+      type: 'update_record',
+      label: 'Stamp',
+      config: { objectName: 'wh_order', filter: { id: '{recordId}' }, fields },
+    },
+  ],
+  edges: [],
+});
+
+describe('[#8663] validateFlowNodeWrites — unprovisioned anchor writes', () => {
+  it('warns (does NOT gate) when a node writes an anchor the federated object has no storage for', () => {
+    const findings = validateFlowNodeWrites({ objects: [federatedDeal], flows: [anchorFlow({ owner_id: '{user.id}' })] });
+    expect(findings).toHaveLength(1);
+    expect(findings[0].rule).toBe(FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR);
+    // The whole point of the separate id: this rule's other finding is `error`.
+    expect(findings[0].severity).toBe('warning');
+    expect(findings[0].path).toBe('flows[0].nodes[1].config.fields.owner_id');
+    expect(findings[0].where).toBe('flow "stamp_owner" › node "Stamp"');
+    expect(findings[0].message).toContain('external object (ADR-0015)');
+    expect(findings[0].message).toContain('can never land');
+  });
+
+  it('the same node against the same object without the external binding is silent', () => {
+    expect(validateFlowNodeWrites({ objects: [localWhOrder], flows: [anchorFlow({ owner_id: '{user.id}' })] })).toEqual([]);
+  });
+
+  it('an author-declared column of the same name is never flagged', () => {
+    const declared = { ...federatedDeal, fields: { ...federatedDeal.fields, owner_id: { type: 'text' } } };
+    expect(validateFlowNodeWrites({ objects: [declared], flows: [anchorFlow({ owner_id: '{user.id}' })] })).toEqual([]);
+  });
+
+  it('the gating unknown-field finding on the same federated object is unchanged', () => {
+    const findings = validateFlowNodeWrites({ objects: [federatedDeal], flows: [anchorFlow({ ordr_id: 'x' })] });
+    expect(findings).toHaveLength(1);
+    expect(findings[0].rule).toBe(FLOW_NODE_WRITE_UNKNOWN_FIELD);
+    expect(findings[0].severity).toBe('error');
+  });
+});

packages/lint/src/validate-flow-node-writes.ts

@@ -84,13 +84,31 @@
 
 import { findClosestMatches, formatSuggestion } from '@objectstack/spec/shared';
 
-import { indexObjectFields, judgeableFieldsOf, IMPLICIT_FIELDS } from './validate-hook-body-writes.js';
+import {
+  indexObjectFields,
+  judgeableFieldsOf,
+  IMPLICIT_FIELDS,
+  unprovisionedAnchorWriteConsequence,
+} from './validate-hook-body-writes.js';
+import {
+  indexUnprovisionedAnchors,
+  unprovisionedAnchorCause,
+  unprovisionedAnchorHint,
+} from './system-fields.js';
 import { walkFlowNodes, flowNodeLabel } from './flow-walk.js';
 
-export type FlowNodeWriteSeverity = 'error';
+/**
+ * `error` for the existence verdict — a literal key against a literal object is
+ * a certainty (see the module note). [#8663] `warning` for the provenance one:
+ * the same widening `validateFlowTemplatePaths` carries, for the same reason.
+ * The two questions have different certainties, so they cannot share a
+ * severity; the suite that runs this rule is severity-agnostic by contract and
+ * carries each finding's own value through.
+ */
+export type FlowNodeWriteSeverity = 'error' | 'warning';
 
 export interface FlowNodeWriteFinding {
-  /** Always `error` — a literal key against a literal object is a certainty (see module note). */
+  /** Per-finding — see {@link FlowNodeWriteSeverity}, which says why it is not a constant. */
   severity: FlowNodeWriteSeverity;
   rule: string;
   /** Human-readable location, e.g. `flow "close_deal" › node "Mark won"`. */
@@ -104,6 +122,21 @@ export interface FlowNodeWriteFinding {
 // Rule id (registry entry).
 export const FLOW_NODE_WRITE_UNKNOWN_FIELD = 'flow-node-write-unknown-field';
 
+/**
+ * [#8663] The flow-node twin of `hook-body-write-unprovisioned-anchor`. This
+ * rule reached the same blind spot from the same direction: it imports
+ * {@link IMPLICIT_FIELDS} from the hook rule, so it inherited the set's
+ * object-independence along with its contents.
+ *
+ * ⚠️ `warning`, NOT this rule's usual `error`. The existence verdict gates
+ * because a literal key against a literal object is a certainty; the provenance
+ * verdict is a claim about a REMOTE schema this repo cannot see, so it advises.
+ * Reclassifying it upward would convert a silent case straight into a build
+ * break — the shape ADR-0072 D1 forbids, at the one severity where it cannot be
+ * ignored.
+ */
+export const FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR = 'flow-node-write-unprovisioned-anchor';
+
 // ─── The covered-node ledger ────────────────────────────────────────────────
 //
 // Which flow node types have their `config.fields` write map resolved against
@@ -188,6 +221,8 @@ export function validateFlowNodeWrites(stack: AnyRec): FlowNodeWriteFinding[] {
 
   // Built lazily: a stack whose flows carry no write node never pays it.
   let objectFields: Map<string, Set<string>> | null = null;
+  // [#8663] Non-empty only for a stack carrying an ADR-0015 `external` object.
+  let anchors: ReadonlyMap<string, ReadonlySet<string>> | null = null;
 
   flows.forEach((flow, flowIndex) => {
     const flowName = typeof flow.name === 'string' && flow.name ? flow.name : `#${flowIndex}`;
@@ -213,6 +248,7 @@ export function validateFlowNodeWrites(stack: AnyRec): FlowNodeWriteFinding[] {
       if (!objectName) return; // templated / dynamic object — resolved at run time
 
       objectFields ??= indexObjectFields(stack);
+      anchors ??= indexUnprovisionedAnchors(stack);
       // Cross-package objects and objects declaring no fields at all (external /
       // datasource-introspected schemas) are both unjudgeable, and this rule
       // gates — see {@link judgeableFieldsOf}, which is where that guard now
@@ -226,7 +262,24 @@ export function validateFlowNodeWrites(stack: AnyRec): FlowNodeWriteFinding[] {
       const nodeWhere = regionTrail ? `${regionTrail} › node "${nodeName}"` : `node "${nodeName}"`;
 
       for (const fieldName of written) {
-        if (known.has(fieldName) || IMPLICIT_FIELDS.has(fieldName)) continue;
+        // An author-DECLARED column wins outright — on a federated object it
+        // maps a remote column the author vouches for (#7859's direction).
+        if (known.has(fieldName)) continue;
+        if (IMPLICIT_FIELDS.has(fieldName)) {
+          // [#8663] Implicitly writable SOMEWHERE is not provisioned HERE.
+          if (!anchors.get(objectName)?.has(fieldName)) continue;
+          findings.push({
+            severity: 'warning',
+            rule: FLOW_NODE_WRITE_UNPROVISIONED_ANCHOR,
+            where: `flow "${flowName}" › ${nodeWhere}`,
+            path: `${nodePath}.config.fields.${fieldName}`,
+            message:
+              `${node.type} writes '${fieldName}', and ${unprovisionedAnchorCause(objectName, fieldName)} — ` +
+              unprovisionedAnchorWriteConsequence(),
+            hint: unprovisionedAnchorHint(objectName, fieldName),
+          });
+          continue;
+        }
         // A dotted key addresses a nested path, not a top-level column — the
         // document drivers forward it verbatim. Not statically a missing field.
         if (fieldName.includes('.')) continue;