@@ -29,9 +29,17 @@
  *     as one transaction, while an author-declared federated lookup still
  *     makes the plan cross-datasource.
  *
+ * [#21918] The same four, for every OTHER anchor the registry injects into a
+ * federated object and the object does not provision, read from the
+ * registry's provenance rather than from a column name: `owning_business_unit_id`
+ * on a business-unit delete, and `owner_id` / `created_by` / `updated_by` on a
+ * user delete. Their blocks are at the foot of this file, and the predicate's
+ * own pin is `federated-object.test.ts`.
+ *
  * The seed rows are written straight into the stub's store, so no write path
- * other than the delete under test runs. The door pin is
- * `packages/qa/dogfood/test/organization-delete-federated-fixture.dogfood.test.ts`.
+ * other than the delete under test runs. The door pins are
+ * `packages/qa/dogfood/test/organization-delete-federated-fixture.dogfood.test.ts`
+ * and `packages/qa/dogfood/test/business-unit-and-user-delete-federated-fixture.dogfood.test.ts`.
  */
 
 import { describe, it, expect } from 'vitest';
@@ -44,12 +52,26 @@ const PACKAGE_ID = 'test-21910';
 
 type Row = Record<string, unknown>;
 
+/** Every field name a `where` filters on, at any depth, as `object.field`. */
+function filteredColumns(object: string, where: unknown, out: string[] = []): string[] {
+  if (Array.isArray(where)) {
+    for (const w of where) filteredColumns(object, w, out);
+  } else if (where && typeof where === 'object') {
+    for (const [k, v] of Object.entries(where)) {
+      if (k.startsWith('$')) filteredColumns(object, v, out);
+      else out.push(`${object}.${k}`);
+    }
+  }
+  return out;
+}
+
 /**
- * A stub driver that records every read into a shared log and can be told to
- * refuse reads of one object with an exact error object. Its `find` applies
- * the caller's `limit` after the filter, by presence.
+ * A stub driver that records every read into a shared log, with the columns
+ * each read filters on, and can be told to refuse reads of one object with an
+ * exact error object. Its `find` applies the caller's `limit` after the
+ * filter, by presence.
  */
-function makeDriver(name: string, log: { reads: string[]; begun: number }) {
+function makeDriver(name: string, log: { reads: string[]; probes: string[]; begun: number }) {
   const tables: Record<string, Row[]> = {};
   const failReads = new Map<string, unknown>();
   const rowsOf = (o: string): Row[] => (tables[o] ??= []);
@@ -69,6 +91,7 @@ function makeDriver(name: string, log: { reads: string[]; begun: number }) {
     registerExternalObject() {},
     async find(o: string, ast: any) {
       log.reads.push(o);
+      log.probes.push(...filteredColumns(o, ast?.where));
       const failure = failReads.get(o);
       if (failure !== undefined) throw failure;
       const hit = (tables[o] ?? []).filter((r) => matches(r, ast?.where));
@@ -176,7 +199,7 @@ function unknownColumnRefusal(object: string, column: string) {
 }
 
 async function makeEngine(objects: any[]) {
-  const log = { reads: [] as string[], begun: 0 };
+  const log = { reads: [] as string[], probes: [] as string[], begun: 0 };
   const warnings: string[] = [];
   const logger = {
     debug() {}, info() {}, error() {},
@@ -268,3 +291,164 @@ describe('[#21910] the cascade atomicity plan agrees with the scan about who tak
     expect(warnings.filter((w) => w.includes(NOT_ATOMIC))).toHaveLength(1);
   });
 });
+
+// ---------------------------------------------------------------------------
+// [#21918] Every other injected anchor of a federated object, read from the
+// registry's provenance: `owning_business_unit_id` (ADR-0117 D1) on a business
+// unit delete, and the owner and audit lookups `owner_id` / `created_by` /
+// `updated_by` on a user delete. #21910's predicate named `organization_id`
+// alone, so on the showcase with its federated fixture a business-unit delete
+// answered 400 (`INVALID_FILTER` on `showcase_ext_customer.owning_business_unit_id`)
+// and a user delete answered 500 (on `created_by`). The door pins are
+// `packages/qa/dogfood/test/business-unit-and-user-delete-federated-fixture.dogfood.test.ts`.
+// ---------------------------------------------------------------------------
+
+/** The business-unit object a federated object's injected `owning_business_unit_id` names. */
+const BUSINESS_UNIT = {
+  name: 'sys_business_unit',
+  label: 'Business Unit',
+  fields: { name: { name: 'name', label: 'Name', type: 'text' as const } },
+};
+
+/** The user object a federated object's injected `owner_id` / `created_by` / `updated_by` name. */
+const USER = {
+  name: 'sys_user',
+  label: 'User',
+  fields: { name: { name: 'name', label: 'Name', type: 'text' as const } },
+};
+
+/**
+ * Federated, with two lookups the AUTHOR declared on the anchors' targets: an
+ * `owner_id` of its own (it maps a real remote column) and `unit_ref`.
+ */
+const FEDERATED_AUTHOR_ANCHORS = {
+  name: 'ext_assignment',
+  label: 'External Assignment',
+  datasource: REMOTE,
+  external: { remoteName: 'assignments' },
+  fields: {
+    title: { name: 'title', label: 'Title', type: 'text' as const },
+    owner_id: { name: 'owner_id', label: 'Remote Owner', type: 'lookup' as const, reference: 'sys_user' },
+    unit_ref: { name: 'unit_ref', label: 'Unit', type: 'lookup' as const, reference: 'sys_business_unit' },
+  },
+};
+
+const UNIT_ID = 'bu_21918';
+const USER_ID = 'usr_21918';
+
+async function makeAnchorEngine(objects: any[]) {
+  const made = await makeEngine([ORGANIZATION, BUSINESS_UNIT, USER, ...objects]);
+  made.local.seed('sys_business_unit', { id: UNIT_ID, name: 'Doomed Unit' });
+  made.local.seed('sys_user', { id: USER_ID, name: 'Doomed User' });
+  return made;
+}
+
+/** The columns a delete's scan probed on one object, deduplicated and sorted. */
+const probedOn = (log: { probes: string[] }, object: string): string[] =>
+  [...new Set(log.probes.filter((p) => p.startsWith(`${object}.`)))].sort();
+
+describe('[#21918] the cascade scan skips every injected anchor a federated object does not provision', () => {
+  it('a business-unit delete never probes a federated object on its injected owning_business_unit_id, and lands', async () => {
+    const { engine, local, remote, log } = await makeAnchorEngine([LOCAL, FEDERATED]);
+    // PREMISE: the registered anchor is the registry's own, and unprovisioned.
+    expect(resolveInjectedColumnProvenance(engine.getSchema('ext_customer'), 'owning_business_unit_id'))
+      .toBe('injected-unprovisioned');
+    remote.failReads.set('ext_customer', unknownColumnRefusal('ext_customer', 'owning_business_unit_id'));
+
+    log.reads.length = 0;
+    log.probes.length = 0;
+    await engine.delete('sys_business_unit', { where: { id: UNIT_ID } } as any);
+
+    expect(local.has('sys_business_unit', UNIT_ID)).toBe(false);
+    expect(log.reads).not.toContain('ext_customer');
+    // CONTROL: the scan ran, and probed the LOCAL object's injected anchor of the same name.
+    expect(probedOn(log, 'acct')).toContain('acct.owning_business_unit_id');
+  });
+
+  it('a user delete never probes a federated object on its injected owner_id, created_by or updated_by, and lands', async () => {
+    const { engine, local, remote, log } = await makeAnchorEngine([LOCAL, FEDERATED]);
+    const schema = engine.getSchema('ext_customer');
+    for (const column of ['owner_id', 'created_by', 'updated_by']) {
+      expect(resolveInjectedColumnProvenance(schema, column), column).toBe('injected-unprovisioned');
+    }
+    remote.failReads.set('ext_customer', unknownColumnRefusal('ext_customer', 'created_by'));
+
+    log.reads.length = 0;
+    log.probes.length = 0;
+    await engine.delete('sys_user', { where: { id: USER_ID } } as any);
+
+    expect(local.has('sys_user', USER_ID)).toBe(false);
+    expect(log.reads).not.toContain('ext_customer');
+    // CONTROL: the LOCAL object's injected owner and audit lookups ARE probed.
+    expect(probedOn(log, 'acct')).toEqual(
+      expect.arrayContaining(['acct.created_by', 'acct.owner_id', 'acct.updated_by']),
+    );
+  });
+
+  it('still probes lookups the AUTHOR declared on a federated object, and a business-unit probe failure propagates (#8895)', async () => {
+    const { engine, local, remote, log } = await makeAnchorEngine([FEDERATED_AUTHOR_ANCHORS]);
+    const injected = unknownColumnRefusal('ext_assignment', 'unit_ref');
+    remote.failReads.set('ext_assignment', injected);
+
+    log.probes.length = 0;
+    const err: any = await engine.delete('sys_business_unit', { where: { id: UNIT_ID } } as any).catch((e) => e);
+
+    expect(err).toBe(injected);
+    expect(err.code).toBe('INVALID_FILTER');
+    expect(err.status).toBe(400);
+    // The probe that ran is the author's column, never the injected anchor beside it.
+    expect(probedOn(log, 'ext_assignment')).toEqual(['ext_assignment.unit_ref']);
+    expect(local.has('sys_business_unit', UNIT_ID)).toBe(true);
+  });
+
+  it('still probes an owner_id the AUTHOR declared on a federated object, and a user probe failure propagates (#8895)', async () => {
+    const { engine, local, remote, log } = await makeAnchorEngine([FEDERATED_AUTHOR_ANCHORS]);
+    expect(resolveInjectedColumnProvenance(engine.getSchema('ext_assignment'), 'owner_id')).toBe('author');
+    const injected = unknownColumnRefusal('ext_assignment', 'owner_id');
+    remote.failReads.set('ext_assignment', injected);
+
+    log.probes.length = 0;
+    const err: any = await engine.delete('sys_user', { where: { id: USER_ID } } as any).catch((e) => e);
+
+    expect(err).toBe(injected);
+    expect(err.code).toBe('INVALID_FILTER');
+    expect(err.status).toBe(400);
+    expect(probedOn(log, 'ext_assignment')).toEqual(['ext_assignment.owner_id']);
+    expect(local.has('sys_user', USER_ID)).toBe(true);
+  });
+});
+
+describe('[#21918] the cascade atomicity plan agrees with the scan for every injected anchor', () => {
+  it('runs a business-unit delete as one transaction when injected anchors were its only cross-datasource references', async () => {
+    const { engine, local, log, warnings } = await makeAnchorEngine([LOCAL, FEDERATED]);
+
+    await engine.delete('sys_business_unit', { where: { id: UNIT_ID } } as any);
+
+    expect(local.has('sys_business_unit', UNIT_ID)).toBe(false);
+    expect(log.begun).toBe(1);
+    expect(warnings.filter((w) => w.includes(NOT_ATOMIC))).toEqual([]);
+  });
+
+  it('runs a user delete as one transaction when injected anchors were its only cross-datasource references', async () => {
+    const { engine, local, log, warnings } = await makeAnchorEngine([LOCAL, FEDERATED]);
+
+    await engine.delete('sys_user', { where: { id: USER_ID } } as any);
+
+    expect(local.has('sys_user', USER_ID)).toBe(false);
+    expect(log.begun).toBe(1);
+    expect(warnings.filter((w) => w.includes(NOT_ATOMIC))).toEqual([]);
+  });
+
+  it('CONTROL: lookups the author declared on a federated object still make both plans cross-datasource', async () => {
+    for (const [object, id] of [['sys_business_unit', UNIT_ID], ['sys_user', USER_ID]] as const) {
+      const { engine, local, log, warnings } = await makeAnchorEngine([LOCAL, FEDERATED_AUTHOR_ANCHORS]);
+
+      await engine.delete(object, { where: { id } } as any);
+
+      expect(local.has(object, id), object).toBe(false);
+      expect(log.reads, object).toContain('ext_assignment');
+      expect(log.begun, object).toBe(0);
+      expect(warnings.filter((w) => w.includes(NOT_ATOMIC)), object).toHaveLength(1);
+    }
+  });
+});
@@ -0,0 +1,149 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#21918] `isFederatedUnprovisionedInjectedColumn` answers "the registry
+ * injected this column into a federated object, and the object does not
+ * provision it" for EVERY such column, and for nothing else.
+ *
+ * #21910 introduced the predicate for `organization_id` alone. The business
+ * unit and user deletes then failed on the next anchors the same registry pass
+ * injects (`owning_business_unit_id`, `owner_id`, `created_by`, `updated_by`),
+ * so the predicate now reads the registry's own provenance
+ * (`resolveInjectedColumnProvenance`, the #7865 marker) and names no column.
+ *
+ * Every schema below is the REGISTERED one, read back from a `SchemaRegistry`
+ * after `registerObject`, because the provenance verdict is about the
+ * definitions the injection actually stored, not about what the author wrote.
+ *
+ * The engine readers that ask the predicate are pinned at their seams:
+ * `engine-cascade-federated-tenant-anchor.test.ts` (the cascade scan and its
+ * plan) and `lifecycle/lifecycle-service.test.ts` (the tenant partition). The
+ * enumeration of every reader is `federated-injected-column-readers.test.ts`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { resolveInjectedColumnProvenance, unprovisionedInjectedColumns } from '@objectstack/spec/data';
+import { SchemaRegistry } from './registry.js';
+import { isFederatedObject, isFederatedUnprovisionedInjectedColumn } from './federated-object.js';
+
+const REMOTE = 'remote_ds';
+
+/** Federated, as the showcase declares its external objects: no column of the platform's own. */
+const FEDERATED = {
+  name: 'ext_customer',
+  label: 'External Customer',
+  datasource: REMOTE,
+  external: { remoteName: 'customers' },
+  fields: { name: { name: 'name', label: 'Name', type: 'text' as const } },
+};
+
+/** The same declaration with no `external` binding: the platform provisions its storage. */
+const LOCAL = {
+  name: 'acct',
+  label: 'Account',
+  fields: { name: { name: 'name', label: 'Name', type: 'text' as const } },
+};
+
+/**
+ * Federated, with an `organization_id` and an `owner_id` the AUTHOR declared
+ * (each maps a real remote column), and one more lookup of the author's own.
+ */
+const FEDERATED_AUTHOR_COLUMNS = {
+  name: 'ext_tenant_customer',
+  label: 'External Tenant Customer',
+  datasource: REMOTE,
+  external: { remoteName: 'tenant_customers' },
+  fields: {
+    name: { name: 'name', label: 'Name', type: 'text' as const },
+    organization_id: {
+      name: 'organization_id',
+      label: 'Remote Organization',
+      type: 'lookup' as const,
+      reference: 'sys_organization',
+    },
+    owner_id: { name: 'owner_id', label: 'Remote Owner', type: 'lookup' as const, reference: 'sys_user' },
+    unit_ref: { name: 'unit_ref', label: 'Unit', type: 'lookup' as const, reference: 'sys_business_unit' },
+  },
+};
+
+function registered(...objects: any[]): SchemaRegistry {
+  const registry = new SchemaRegistry({ multiTenant: false, searchCompanion: false } as never);
+  for (const o of objects) registry.registerObject(o, 'test-21918');
+  return registry;
+}
+
+/** The injected lookups on a federated object, read off the registered schema's relation fields. */
+function relationFieldsOf(schema: any): string[] {
+  return Object.entries<any>(schema?.fields ?? {})
+    .filter(([, f]) => f?.type === 'lookup' || f?.type === 'master_detail')
+    .map(([name]) => name);
+}
+
+describe('[#21918] isFederatedUnprovisionedInjectedColumn: every injected column a federated object does not provision', () => {
+  it('accepts every injected anchor of a federated object, the tenant anchor and every other one', () => {
+    const schema = registered(FEDERATED).getObject('ext_customer');
+    expect(isFederatedObject(schema)).toBe(true);
+
+    // PREMISE: the registry injected these lookups, and its provenance calls
+    // each one unprovisioned. The names are the measurement, not the decision.
+    const relations = relationFieldsOf(schema);
+    expect(relations).toEqual(
+      expect.arrayContaining(['organization_id', 'owning_business_unit_id', 'owner_id', 'created_by', 'updated_by']),
+    );
+
+    for (const column of relations) {
+      expect(resolveInjectedColumnProvenance(schema, column), column).toBe('injected-unprovisioned');
+      expect(isFederatedUnprovisionedInjectedColumn(schema, column), column).toBe(true);
+    }
+    // The anchors past the tenant one, named, because they are what #21910's
+    // tenant-only predicate missed and the business-unit and user deletes hit.
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'owning_business_unit_id')).toBe(true);
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'owner_id')).toBe(true);
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'created_by')).toBe(true);
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'updated_by')).toBe(true);
+    // And the non-lookup audit columns, which the same pass injects.
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'created_at')).toBe(true);
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'updated_at')).toBe(true);
+  });
+
+  it('agrees with the registry provenance on every field of every registered object, and asks it for nothing else', () => {
+    const registry = registered(FEDERATED, LOCAL, FEDERATED_AUTHOR_COLUMNS);
+    for (const name of ['ext_customer', 'acct', 'ext_tenant_customer']) {
+      const schema = registry.getObject(name);
+      const unprovisioned = new Set(unprovisionedInjectedColumns(schema));
+      for (const column of [...Object.keys((schema as any)?.fields ?? {}), 'id', 'no_such_column']) {
+        expect(isFederatedUnprovisionedInjectedColumn(schema, column), `${name}.${column}`).toBe(unprovisioned.has(column));
+      }
+    }
+  });
+
+  it('refuses a column the author declared on a federated object, including its own organization_id and owner_id', () => {
+    const schema = registered(FEDERATED_AUTHOR_COLUMNS).getObject('ext_tenant_customer');
+    for (const column of ['organization_id', 'owner_id', 'unit_ref', 'name']) {
+      expect(resolveInjectedColumnProvenance(schema, column), column).toBe('author');
+      expect(isFederatedUnprovisionedInjectedColumn(schema, column), column).toBe(false);
+    }
+    // The anchors the author did NOT declare are still the registry's, and still unprovisioned.
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'owning_business_unit_id')).toBe(true);
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'created_by')).toBe(true);
+  });
+
+  it('refuses every injected column of a LOCAL object: the platform provisions its storage', () => {
+    const schema = registered(LOCAL).getObject('acct');
+    expect(isFederatedObject(schema)).toBe(false);
+    for (const column of relationFieldsOf(schema)) {
+      expect(resolveInjectedColumnProvenance(schema, column), column).toBe('injected-provisioned');
+      expect(isFederatedUnprovisionedInjectedColumn(schema, column), column).toBe(false);
+    }
+  });
+
+  it('refuses a column that is neither injected nor declared, and any input that is not an object', () => {
+    const schema = registered(FEDERATED).getObject('ext_customer');
+    expect(resolveInjectedColumnProvenance(schema, 'id')).toBe('absent');
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'id')).toBe(false);
+    expect(isFederatedUnprovisionedInjectedColumn(schema, 'no_such_column')).toBe(false);
+    for (const input of [undefined, null, 'ext_customer', 42, []]) {
+      expect(isFederatedUnprovisionedInjectedColumn(input, 'organization_id')).toBe(false);
+    }
+  });
+});