test(lint): re-pin the moved highlightFields clauses; scope the member to object writes

The #5378 injected-column counter-examples and the #8116 withheld-anchor case
move to the rule that now owns the position, at `error` rather than `warning`.
`validateSemanticRoles` keeps its own stageField copies and the provenance
question, and gains the controls that keep its new silence non-vacuous.

The suite member declares `runtimeTypes: ['object']` only: on a flow or view
snapshot the objects are context, present in baseline and candidate alike, so
every finding it could raise there cancels in the gate's differential.

Adds the changeset (minor/minor, with the Migration section).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Author: os-try2026

.changeset/studio-object-field-ref-refusal.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/lint": minor
+"@objectstack/metadata-protocol": minor
+---
+
+A publish now refuses an object whose `highlightFields` names a field that does not exist on it — the same gate that refuses a code-authored stack.
+
+`list-view-field-unknown` inspects `view.columns`, and Studio's app builder mints no `view` items at all, so the reference-integrity family had nothing to inspect on the only artifacts the click path authors. What it authors is the **object**, and an object-level field-name list was covered by nothing that could refuse: measured on `origin/main`, `runtimeAuthoringRulesFor('object')` dispatched seven rules with no reference-integrity rule among them, while the object-level existence check that did exist (`semantic-role-field-unknown`) is `warning`, advisory-tier and CLI-only. So `os validate` exited 0 on a dangling reference and the runtime publish door — the only door a Studio, REST `/meta` or MCP author has — said nothing at all.
+
+The reproduction is the natural click order, not a contrived one: click-create a field (Studio mints it as `field_10`), add it to `highlightFields`, then give it a label — the API name auto-derives to `health_score` and `highlightFields` keeps `field_10`. Anyone who names a field after placing it produces this.
+
+- **New rule `object-field-ref-unknown` (`error`)**, in `@objectstack/lint`, over the object-level field-name **lists** that no rule owned: `highlightFields` (ADR-0085) and `publicSharing.redactFields`. It resolves through the same `object-graph` seam as the rest of the family, so the three shared skips hold — an object outside the stack, an object with no readable field map (ADR-0015 `external`), and a registry-injected system column resolved **per object** (`highlightFields: ['owner_id']` is a live pointer on an owned object and a real miss under `ownership: 'none'`).
+- **It runs on the runtime publish door.** The reference-integrity suite entry's `runtimeTypes` gains `object`, and the suite's per-member declaration keeps the crossing narrow: this is the only member that judges an object snapshot; every other member keeps `['flow', 'view']` or the frozen `['flow']` default.
+- **`validateSemanticRoles` keeps the provenance question** at the same position (`semantic-role-field-unprovisioned`, still `warning`) and no longer restates existence — one finding per path, at one tier.
+- **`probes.checked` gained an `objects` counter.** Its absence was the tell: a receipt reading `{seeds: 0, views: 0, widgets: 0}` was accurate while the objects the package published were probed by nothing.
+
+## Migration
+
+**A publish that used to succeed can now be refused (HTTP 422, `INVALID_METADATA`).** The receipt names the rule id `object-field-ref-unknown` and the offending path, name-keyed on the wire — for example `objects.proj_task.highlightFields[1]` — plus the string that was written and the fields the object actually has.
+
+To fix a dangling reference, do one of:
+
+- rewrite the entry to the field's current API name (after a Studio label edit the derived name is the one to use — `field_10` becomes `health_score`); or
+- drop the entry from the list.
+
+`os validate` / `os build` / `os lint` report the same finding at `error`, so a stack can be repaired before it reaches a publish. If an object legitimately points at a platform-injected system column, no change is needed — the rule resolves those per object and stays silent where the platform really provisions them.

packages/lint/src/reference-integrity-suite.ts

@@ -239,21 +239,29 @@ export const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[] = [
   // on a list view. Placed directly after them because it completes the same
   // sweep — every field name an object or its built-in views write down.
   //
-  // `runtimeTypes` gains `object`, and that is the point of the member rather
-  // than a convenience: Studio's app builder mints no `view` items at all, so
-  // the list-view members have nothing to inspect on the only artifacts the
-  // click path authors. What it authors is the OBJECT. The crossing carries
-  // the #9313 property that makes it safe — this member resolves only against
-  // `stack.objects`, the collection the per-write snapshot does carry, so it
-  // has no missing-collection false-positive channel; and it resolves each
-  // name against the object's OWN field map, so a one-object snapshot is not
+  // `runtimeTypes` is `['object']` — the ONLY member of this suite that names
+  // that type, and the only one that does not name `flow`. Both halves are
+  // deliberate.
+  //
+  // It names `object` because that is the point of the member: Studio's app
+  // builder mints no `view` items at all, so the list-view members have
+  // nothing to inspect on the only artifacts the click path authors. What it
+  // authors is the OBJECT. The crossing carries the #9313 property that makes
+  // it safe — this member resolves only against `stack.objects`, the
+  // collection the per-write snapshot does carry, so it has no
+  // missing-collection false-positive channel; and it resolves each name
+  // against the object's OWN field map, so a one-object snapshot is not
   // merely sufficient, it is the whole universe the question has.
   //
-  // `flow` and `view` ride along on the default reasoning: an object reached
-  // as context on either snapshot is judged for its own lists exactly as the
-  // CLI judges it, and the gate's differential means a stored object already
-  // in violation is never charged to someone else's write.
-  { name: 'validateObjectFieldRefs', runtimeTypes: ['flow', 'view', 'object'], run: validateObjectFieldRefs },
+  // It does NOT name `flow` or `view`, and that is not an omission. On either
+  // of those snapshots the objects are CONTEXT, present in the baseline and
+  // the candidate alike, so every finding this member could raise there
+  // cancels in the gate's differential (#4463 D4 — a stored object already in
+  // violation is never charged to someone else's write). Declaring them would
+  // buy two extra passes over the tenant's object model per flow write and
+  // change no verdict. CLI commands ignore this field entirely, so all three
+  // commands judge every object either way.
+  { name: 'validateObjectFieldRefs', runtimeTypes: ['object'], run: validateObjectFieldRefs },
   { name: 'validateActionNameRefs', run: validateActionNameRefs },
   { name: 'validatePageFieldBindings', run: validatePageFieldBindings },
   // [#14073] The same page, one question out. `validatePageFieldBindings`

packages/lint/src/validate-object-field-refs.test.ts

@@ -195,11 +195,89 @@ describe('validateObjectFieldRefs — the three shared skips', () => {
     })).toEqual([]);
   });
 
-  it('is inert on junk: no objects, junk entries, non-array lists', () => {
+  it('is inert on junk: no objects, unnamed entries, non-array lists, non-string members', () => {
     expect(validateObjectFieldRefs({})).toEqual([]);
-    expect(validateObjectFieldRefs({ objects: [null, 7, 'x'] as never })).toEqual([]);
+    expect(validateObjectFieldRefs({ objects: [] })).toEqual([]);
+    // An entry with no `name` indexes into no graph and is skipped.
+    expect(validateObjectFieldRefs({ objects: [{ highlightFields: ['x'] }] })).toEqual([]);
     expect(validateObjectFieldRefs(stackOf({ highlightFields: 'not-an-array' }))).toEqual([]);
     expect(validateObjectFieldRefs(stackOf({ highlightFields: [null, 3, ''] }))).toEqual([]);
+    // A name-keyed `objects` map, the other shape the raw `lint` path carries.
+    expect(validateObjectFieldRefs({
+      objects: { proj_task: { fields: { name: {} }, highlightFields: ['nope'] } },
+    })).toHaveLength(1);
+    // ⛔ NOT asserted here: `objects: [null, …]`. `indexObjectGraph` throws a
+    // TypeError on a null collection entry before any member of this suite is
+    // reached — a pre-existing fragility of the shared seam, filed separately
+    // rather than worked around in one member (a local guard here would leave
+    // the same crash in every sibling and hide it).
+  });
+});
+
+// ---------------------------------------------------------------------------
+// [#5378] The injected-column derivation, at the position that moved.
+//
+// These counter-examples used to stand in `validate-semantic-roles.test.ts`,
+// against the warning-tier clause this rule took over. They are re-pinned here
+// at `error` rather than dropped: the derivation is exactly as load-bearing
+// under a gate as it was under an advisory, and a false finding now REFUSES a
+// publish instead of adding a line to a warning list.
+// ---------------------------------------------------------------------------
+describe('validateObjectFieldRefs — the #5378 derivation under a gate', () => {
+  const tag = (over: Record<string, unknown>) => ({
+    objects: [{ name: 'crm_tag', fields: { name: {} }, ...over }],
+  });
+
+  it.each(['none', 'org'])(
+    "REFUSES highlightFields: [owner_id] on ownership: '%s' — the platform injects none",
+    (ownership) => {
+      const findings = validateObjectFieldRefs(tag({
+        ownership, highlightFields: ['name', 'owner_id'],
+      }));
+      expect(findings).toHaveLength(1);
+      expect(findings[0]).toMatchObject({ severity: 'error', rule: OBJECT_FIELD_REF_UNKNOWN });
+      expect(findings[0]!.message).toContain('owner_id');
+    },
+  );
+
+  it('REFUSES an organization_id highlight when the object opts out of tenancy', () => {
+    const findings = validateObjectFieldRefs(tag({
+      tenancy: { enabled: false }, highlightFields: ['organization_id'],
+    }));
+    expect(findings).toHaveLength(1);
+    expect(findings[0]!.message).toContain('organization_id');
+  });
+
+  it('REFUSES a typo that merely LOOKS like a system column', () => {
+    const findings = validateObjectFieldRefs({
+      objects: [{ name: 'crm_contact', fields: { name: {} }, highlightFields: ['owner_ids', 'creatd_at'] }],
+    });
+    expect(findings).toHaveLength(2);
+    expect(findings.map((f) => f.message).join(' ')).toMatch(/owner_ids/);
+    expect(findings.map((f) => f.message).join(' ')).toMatch(/creatd_at/);
+  });
+
+  it.each([
+    'created_at', 'created_by', 'updated_at', 'updated_by',
+    'organization_id', 'owning_business_unit_id', 'id',
+  ])('stays silent on highlightFields: [%s] — a real column at render time', (column) => {
+    expect(validateObjectFieldRefs({
+      objects: [{ name: 'crm_contact', fields: { name: {} }, highlightFields: ['name', column] }],
+    })).toEqual([]);
+  });
+
+  it('a withheld anchor on an EXTERNAL object is still the existence verdict (#8116)', () => {
+    const findings = validateObjectFieldRefs({
+      objects: [{
+        name: 'ext_customer',
+        external: { remoteName: 'customers' },
+        fields: { email: { type: 'email' } },
+        ownership: 'none',
+        highlightFields: ['owner_id'],
+      }],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]!.rule).toBe(OBJECT_FIELD_REF_UNKNOWN);
   });
 });
 

packages/lint/src/validate-semantic-roles.test.ts

@@ -202,22 +202,18 @@ describe('validateSemanticRoles (ADR-0085)', () => {
     expect(optedOut).toEqual([]);
   });
 
-  it('flags unknown highlightFields entries, including via the compactLayout alias', () => {
+  // [#15254] `highlightFields` EXISTENCE — and the `compactLayout` alias read
+  // that went with it — moved to `validate-object-field-refs.ts`, where it
+  // gates instead of advising. The assertions that used to live here moved
+  // with it (`validate-object-field-refs.test.ts`); the boundary they now pin
+  // from THIS side is below, under "the existence clause that moved out".
+  it('stays silent on a dangling highlightFields entry — no longer this rule\'s (#15254)', () => {
     const findings = validateSemanticRoles(stack([{
       name: 'account',
       highlightFields: ['name', 'industy'], // typo
       fields: { name: {}, industry: {} },
     }]));
-    expect(findings).toHaveLength(1);
-    expect(findings[0].message).toContain('industy');
-
-    const aliased = validateSemanticRoles(stack([{
-      name: 'account',
-      compactLayout: ['ghost'],
-      fields: { name: {} },
-    }]));
-    expect(aliased).toHaveLength(1);
-    expect(aliased[0]).toMatchObject({ rule: SEMANTIC_ROLE_FIELD_UNKNOWN });
+    expect(findings, JSON.stringify(findings)).toEqual([]);
   });
 
   it('accepts objects as a name-keyed map and tolerates junk shapes', () => {
@@ -275,41 +271,25 @@ describe('validateSemanticRoles — injected system columns (#5378)', () => {
 
   // ── Counter-examples ──
 
-  it.each(['none', 'org'])(
-    "still warns for highlightFields: [owner_id] on ownership: '%s'",
-    (ownership) => {
-      const findings = validateSemanticRoles(stack([{
-        name: 'crm_tag',
-        ownership,
-        highlightFields: ['name', 'owner_id'],
-        fields: { name: {} },
-      }]));
-      expect(findings).toHaveLength(1);
-      expect(findings[0]).toMatchObject({ rule: SEMANTIC_ROLE_FIELD_UNKNOWN });
-      expect(findings[0].message).toContain('owner_id');
-    },
-  );
-
-  it('still warns for an organization_id highlight when the object opts out of tenancy', () => {
+  // [#15254] The three counter-examples that stood here — `ownership: 'none'`
+  // / `'org'` withholding `owner_id`, tenancy opt-out withholding
+  // `organization_id`, and a typo that merely LOOKS like a system column —
+  // pinned the DERIVATION at the `highlightFields` position, and that position
+  // is `object-field-ref-unknown`'s now. They moved verbatim in substance to
+  // `validate-object-field-refs.test.ts` (at `error`), rather than being
+  // dropped: the #5378 derivation is exactly as load-bearing there, and a
+  // counter-example deleted in a move is a counter-example nobody re-runs.
+  // `stageField` keeps its own copies below — this rule still owns that one.
+  it("still warns for a stageField the derivation withholds — ownership: 'none'", () => {
     const findings = validateSemanticRoles(stack([{
       name: 'crm_tag',
-      tenancy: { enabled: false },
-      highlightFields: ['organization_id'],
+      ownership: 'none',
+      stageField: 'owner_id',
       fields: { name: {} },
     }]));
     expect(findings).toHaveLength(1);
-    expect(findings[0].message).toContain('organization_id');
-  });
-
-  it('still warns for a typo that merely LOOKS like a system column', () => {
-    const findings = validateSemanticRoles(stack([{
-      name: 'crm_contact',
-      highlightFields: ['owner_ids', 'creatd_at'],
-      fields: { name: {} },
-    }]));
-    expect(findings).toHaveLength(2);
-    expect(findings.map((f) => f.message).join(' ')).toMatch(/owner_ids/);
-    expect(findings.map((f) => f.message).join(' ')).toMatch(/creatd_at/);
+    expect(findings[0]).toMatchObject({ rule: SEMANTIC_ROLE_FIELD_UNKNOWN });
+    expect(findings[0].message).toContain('owner_id');
   });
 
   // Widening the EXISTENCE question must not make an injected column a group
@@ -395,12 +375,26 @@ describe('validateSemanticRoles — unprovisioned anchors on external objects (#
     expect(findings).toEqual([]);
   });
 
-  it('a withheld anchor still gets the UNKNOWN finding, never the provenance one', () => {
-    // `ownership: 'none'` ⇒ no owner_id anywhere ⇒ rule (c)'s existence warning
-    // owns the defect. One pointer, one finding, the right one.
+  it('a withheld anchor gets the EXISTENCE finding, never the provenance one', () => {
+    // `ownership: 'none'` ⇒ no owner_id anywhere ⇒ the existence verdict owns
+    // the defect, not this rule's provenance one. One pointer, one finding,
+    // the right one — and since #15254 the existence half is
+    // `object-field-ref-unknown`, so what this rule must do here is stay
+    // SILENT. The positive half is pinned in
+    // `validate-object-field-refs.test.ts`.
     const findings = validateSemanticRoles(stack([
       externalObject({ ownership: 'none', highlightFields: ['owner_id'] }),
     ]));
+    expect(findings, JSON.stringify(findings)).toEqual([]);
+  });
+
+  it('the same withheld anchor on a stageField DOES still warn here', () => {
+    // The control that keeps the test above from being vacuous: this rule's
+    // silence is about the position that moved, not about the rule going
+    // quiet everywhere.
+    const findings = validateSemanticRoles(stack([
+      externalObject({ ownership: 'none', stageField: 'owner_id' }),
+    ]));
     expect(findings).toHaveLength(1);
     expect(findings[0].rule).toBe(SEMANTIC_ROLE_FIELD_UNKNOWN);
   });