fix(engine): CEL has(record.field) reads false for a present field — flat-input get/getOwnPropertyDescriptor trap regression (#12601/#12603 lead)

[os-zhuang]

Upstream card for objectstack-ai/cloud#1689 (the symptom record with full diagnosis; this card is where the fix lands). Part of the objectstack-ai/cloud#1653 chain — the only remaining red on cloud PR #1672.

The defect (measured twice, CI and local, different org ids, same 30-vs-38)

A script validation's has(record.<field>) answers false for a field that is present. Exercised at volume by HotCRM's seed: predicate has(record.status) && record.status == "closed" && (!has(record.resolution) || isBlank(record.resolution)) refuses 8 of 38 crm_case rows — and every refused row CARRIES a non-blank resolution, read straight out of the built artifact. Only 1 of the 5 sampled failures involves a deferred reference, so the deferred-write path is not the discriminator.

Named lead (verify, don't assume)

The flat-input get/getOwnPropertyDescriptor trap work (#12601 / #12603) — exactly what a CEL has() consults. The regression window contains it; the retired-key tolerance (1ffee51) is in the same window but touches spec parse, not evaluation.

Why this is release-blocking in its own right

has() is the standard presence guard in every script validation, sharing rule, and visibility predicate. A false negative silently rejects valid writes (or hides valid rows) for every customer who wrote a conditionally-required-field rule. HotCRM's seed is merely the first thing that exercised it at volume.

Requirements

• Root-cause at the evaluator/trap seam; fix where the evaluator lives. Predicate-semantics discipline applies: enumerate every evaluation surface that consults the same trap (script validations, sharing rules, visibility predicates, matches-filter, RLS compilation) and state per surface whether it was affected and is covered — no silent omissions.
• Regression tests at the REAL seam, including the exact HotCRM shape (a closed record WITH a present non-blank field behind the same trap path), not only a pure-function matrix.
• Ablation with disk-proven mutation.
• Consumer acceptance: hotcrm-multitenant.acceptance reaches 13/13 on a rig running your branch (the cloud checkout's harness and artifact recipe are on cloud#1689/feat(service-ai): consistent agent narration when builds auto-publish #1672); quote the run.
• .changeset per repo convention (bug fix; never major).

[os-zhuang]

Claim: PM loop (epic objectstack-ai/cloud#1653 chain, maintainer direct-dispatch channel)
Session: session_71836b57-5db6-459d-ae4d-c6d9d7dd2cc6
Branch: claude/issue-12861-has-present-field-regression
Worktree: objectstack-issue-12861
Domain: domain:engine
File surface: the CEL evaluation / flat-input trap seam (packages/formula and/or packages/objectql per root cause) + tests (stop on breach; explain)
Container & model: M, mode:subagent, model: opus — regression fix restoring declared predicate behaviour, with a named lead; multi-surface declaration required per the predicate-semantics clause
Clause-②: no (restores the declared accept set; if the fix turns out to move a contract shape, STOP and report)
Serial constraints cleared: no open PR touches the formula/trap seam (checked this hour). Consumer: cloud PR #1672 waits on this (its only red); cloud#1689 is the symptom card and is marked blocked on this one.
Audit: PM adjudication of the Phase-2 report's open question = Option A (upstream fix; ⛔ B's bisect likely has no clean SHA — the tolerance and the suspected regression share a window; ⛔ C refused by the maintainer's standing ruling on cloud#1685: the acceptance step has caught two released-toolchain defects in a row and must not be blinded).

[hotlong]

os-dev-report

{
 "issue": 12861,
 "status": "blocked",
 "branch": "claude/issue-12861-has-present-field-regression",
 "pr": null,
 "premise_still_valid": false,
 "summary": "PREMISE FALSIFIED, and the real cause is located and reproduced end to end. CEL has() is correct on every key shape and on every evaluation surface; nothing in the flat-input trap work (#12601/#12603) can reach a has(), because NO CEL surface in this repo ever binds `record` to the flat-input proxy. What actually refuses the 8 rows is HotCRM's own `case_sla_defaults` beforeInsert hook AS PINNED: its guest-submission branch is `!ctx.previous && !ctx.user?.id`, which a seed replay satisfies (SeedLoaderService.SEED_OPTIONS is `{ isSystem: true, skipTriggers: true, seedReplay: true }` and binds no userId), so the branch runs `delete input.resolution` on every seeded case; validation runs AFTER beforeInsert, so `resolution` is absent, materializes to null, and isBlank(null) fires the rule. Those deletes were silent no-ops until framework #12396 (2af5eacc5, 2026-08-26) routed `delete ctx.input.x` into `data` - that commit is inside cloud#1672's framework bump window. HotCRM ALREADY FIXED THIS on its own main: PR hotcrm#1294 (merge d2339bbc, merged 2026-08-25) replaced the deletes with null assignments AND added the missing discriminator `&& !ctx.session?.isSystem`, citing exactly this class (its comment says a system insert would otherwise land ownerless). Cloud's `.hotcrm-sha` is 3940736bf597, dated 2026-08-20 - `git merge-base --is-ancestor d2339bbc 3940736b` exits 1, so the pin is five days BEHIND the fix. The two pins moved out of step: cloud#1672 advanced the FRAMEWORK across the commit that makes the deletes effective while leaving the HOTCRM pin at a commit older than HotCRM's remediation of exactly that. Fix = bump cloud `.hotcrm-sha` past d2339bbc. No framework change is warranted and none was made; the branch carries zero commits.",
 "tests": "All runs on the worktree at c097f7175 (= origin/main tip; the branch has no commits). Deps built first: `pnpm --filter '@objectstack/objectql^...' build` -> exit 0. VERIFICATION RAN UNLOCKED, declared: scripts/pm/os-verify-lock.sh printed `VERDICT command-exit 0 - UNLOCKED (declared) - no usable flock on this host, so the shared verify lock was NEVER taken and NOTHING was serialized`; the lock is Linux-only (util-linux flock) and this is a macOS host, so the probes were run directly. No gates were run and none are owed: the diff is EMPTY. PROBE 1 - pure CEL plus the real script-validation seam (temporary vitest file in packages/objectql, deleted after; 5 passed): has(record.resolution) over each key shape = present true / absent false / null-valued true / undefined-valued false / empty-string true, all correct per the documented contract; the full HotCRM predicate over {status:'closed', resolution:'Raised the production rate-limit tier ...'} answered {ok:true,value:false} (NO violation) as a plain object AND through a flat-input-shaped Proxy; evaluateValidationRules(schema, {subject,status:'closed',resolution:...}, 'insert') -> passed, and the same call with `resolution` OMITTED -> THREW 'Resolution is required when closing a case'. So the discriminator is key ABSENCE, not a has() fault. PROBE 2 - chain repro through wrapDeclarativeHook (3 passed): no user -> hook reports isGuestSubmission true -> persisted keys ['subject','status','origin','priority'], 'resolution' in row = false -> REFUSED 'Resolution is required when closing a case'; the same row with a user -> keys keep 'resolution' -> ACCEPTED; no hook at all -> ACCEPTED. PROBE 3 - REAL ObjectQL engine, memory driver, HotCRM crm_case validation, the PINNED HotCRM hook bound through bindHooksToEngine, inserted with the literal SeedLoaderService.SEED_OPTIONS (3 passed). Verbatim readings: 'E2E seed-replay + pinned hook | hook saw ctx.user -> undefined | hook saw ctx.session -> {isSystem:true,skipTriggers:true} | isGuestSubmission -> true | verdict -> REFUSED: Resolution is required when closing a case'; 'E2E seed-replay, no hook | verdict -> ACCEPTED - stored resolution=\"Raised the production rate-limit tier and added client-side backoff; usage now within limits.\"'; 'E2E userId bound + pinned hook | hook saw ctx.user -> {id:usr_1} | isGuestSubmission -> false | verdict -> ACCEPTED'. That is the acceptance failure reproduced exactly, with has() correct throughout, and it also measures that ctx.session.isSystem IS available to the hook - the discriminator HotCRM main already reads. ARITHMETIC CROSS-CHECK on the pinned seed (git show 3940736bf597:src/data/service.seed.ts): 8 hand-written + 30 generated = 38 crm_case rows; statuses cycle 5, so 'closed' lands at i=3,8,13,18,23,28 -> Demo case 04/09/14/19/24/29, plus the 2 hand-written closed rows = exactly 8 closed rows, every one carrying `resolution`. 38 - 8 = 30 stored, which is the card's '30 vs 38', and the card's own named failures (04, 09, 14) are the first three. LOGICAL CLINCHER: the predicate can only FIRE when has(record.status) is TRUE, so a has() that reads false for present keys would have refused NOTHING. NO ABLATION was run and none is meaningful: there is no fix to ablate. CONSUMER ACCEPTANCE NOT RUN - hotcrm-multitenant.acceptance was not executed and no 13/13 is claimed; it cannot be moved from this repo, because the change it needs is a cloud pin bump. MULTI-SURFACE DECLARATION, every CEL evaluation surface and whether it consults the flat-input trap path: [1] script validations, packages/objectql/src/validation/rule-validator.ts - binds record to a fresh spread {...previous, ...data} then materializeDeclaredFields, NEVER the proxy; UNAFFECTED, measured green above. [2] field requiredWhen, option visibleWhen, conditional `when`, and the readonlyWhen write-path strip - same module, same plain merged object; UNAFFECTED. [3] declarative hook `condition`, packages/objectql/src/hook-wrappers.ts - the condition gate runs BEFORE installFlatInput is called (the proxy is installed only after the gate passes) and reads pickRecordPayload(ctx), a copy; UNAFFECTED. [4] sharing rules and share-link predicates, packages/plugins/plugin-sharing/src/share-link-service.ts - record: materializeDeclaredFields({ ...record }, schema?.fields), a spread copy; UNAFFECTED. [5] approvals predicates, packages/plugins/plugin-approvals/src/approval-service.ts - plain record; UNAFFECTED. [6] flow and workflow conditions, packages/services/service-automation/src/engine.ts - record: vars, a plain object; UNAFFECTED. [7] formula fields and default-value expressions, packages/objectql/src/engine.ts - record: rec read from storage; UNAFFECTED. [8] dynamic seed values, packages/formula/src/seed-eval.ts - no record proxy; UNAFFECTED. [9] matches-filter, packages/formula/src/matches-filter.ts - a filter-AST matcher, not CEL, and has() has no meaning there; UNAFFECTED. [10] RLS compilation, packages/formula/src/rls-predicate.ts - compiles a predicate ahead of any record and consults no trap; UNAFFECTED. [11] the flat-input proxy itself, installFlatInput in hook-wrappers.ts - reached ONLY by hook handler BODIES through ctx.input (in-process and across the QuickJS sandbox boundary), and no CEL is evaluated there. Mechanical backing for the whole table: grepping packages for a record binding spelled as ctx.input / input / proxy returns ZERO hits repo-wide, so no evaluation surface can see the proxy. Nothing is omitted: every ExpressionEngine.evaluate call site in packages was enumerated and each is listed above.",
 "mcp_calls": "0 - GitHub reads and searches all went through repo-scoped REST (gh api) plus one search/issues query; the REST probe succeeded, so no MCP fallback was needed.",
 "open_questions": [
 {
 "question": "Framework side, raised only because HotCRM's seed file states the opposite in a comment: should a seedReplay write run object beforeInsert hooks at all? SEED_OPTIONS sets skipTriggers (flows) but metadata hooks still fire, while HotCRM's seed says 'Mirror of case.hook's priority rank map - hooks do not run over seeds' and pre-computes every hook-derived value.",
 "options": [
 "A. No change. Hooks over seeds are load-bearing elsewhere, and the platform already gives an app the exact discriminator (ctx.session.isSystem), which HotCRM main now reads.",
 "B. Add skipAutomations to SEED_OPTIONS so metadata hooks are skipped on seed replay.",
 "C. Add a gate that flags a hook branching on absence-of-user without consulting isSystem."
 ],
 "recommendation": "A, on all four axes. Real business need: no pull - the one app that hit this has already fixed it in its own repo, the right way, with a discriminator the platform ships. Long-term soundness: B would silently change what a seed row IS (HotCRM's own rows depend on hooks stamping derived values on other objects), a semantics reversal rather than a fix. AI-authored-metadata safety: the failure is an authoring shape, so the durable remedy is the authoring guidance plus the app's own pin, not a runtime behaviour change. Startup scope discipline: C invents an enforcement surface for a single measured instance."
 },
 {
 "question": "Where does this card go? The fix is one line of cloud config, not framework code.",
 "options": [
 "A. Close objectstack#12861 as not-a-defect (with this evidence) and route the work to the cloud lane as 'bump .hotcrm-sha past hotcrm PR #1294 (merge d2339bbc), then re-run hotcrm-multitenant.acceptance'.",
 "B. Keep objectstack#12861 open pending the cloud bump.",
 "C. Land a framework change anyway."
 ],
 "recommendation": "A. The measurement rules the framework out and names the exact remedy; leaving the card open here (B) keeps a false premise in the queue that the next dev will re-verify from scratch, and C is a fix for a defect that does not exist. Note for the cloud lane: cloud#1689's 'either has() answers false for a present key, or isBlank() answers true for a non-empty string' is a true disjunction with a missing third arm - the key was neither present nor blank at validation time, because a beforeInsert hook had removed it."
 }
 ],
 "out_of_scope_findings": []
}

Generated by Claude Code

[os-zhuang]

Closing not-planned — not a defect. The premise was falsified by measurement, and the refutation is the deliverable (report comment 5448636814; PM adjudication of both open questions = Option A on each).

The three-line summary of what actually happens: HotCRM's pinned case_sla_defaults beforeInsert hook reads a seed replay (no userId) as a GUEST submission and deletes resolution; those deletes were silent no-ops until framework #12396 — inside cloud#1672's bump window — made delete ctx.input.x effective; validation then correctly refuses the now-absent field. The logical clincher: the predicate can only FIRE when has(record.status) is TRUE, so a has() that misread present keys would have refused nothing.

Adjudications:

1. Hooks over seed replays: no framework change (the dev's option A, adopted on all four axes). The platform already ships the exact discriminator (ctx.session.isSystem), and HotCRM main already reads it (hotcrm PR [P0] portal: no external-user portal mechanism — customers see the full admin Console chrome #1294, merged 2026-08-25 — null assignments + !ctx.session?.isSystem, its comment citing exactly this class). Skipping hooks on seeds (B) would silently change what a seed row IS; a lint gate (C) invents an enforcement surface for one measured instance.
2. The remedy is one line of cloud config: bump cloud .hotcrm-sha (currently 3940736b, 2026-08-20 — five days BEHIND the fix; merge-base --is-ancestor d2339bbc 3940736b exits 1) past hotcrm merge d2339bbc. Routed to the cloud chain on docs(cloud-deployment): foreground os package publish; mark os publish legacy #1689/feat(service-ai): consistent agent narration when builds auto-publish #1672; nothing lands here.

The multi-surface table in the report doubles as a reusable reading: NO CEL evaluation surface in this repo binds record to the flat-input proxy — the #12601/#12603 trap work is unreachable from every predicate seam, mechanically backed by a zero-hit grep over every ExpressionEngine.evaluate call site.