@@ -0,0 +1,29 @@
+---
+'@objectstack/spec': minor
+---
+
+**BREAKING** for authored metadata — an `assignment` flow node's config refuses a **top-level** key named `__proto__`, with a named, located error at parse time, instead of accepting the document and silently returning one without that key (objectstack#19151).
+
+## Why
+
+`AssignmentConfigSchema` is deliberately open at the top level: an `assignment` node is exempt from `registerFlow()`'s undeclared-key walk by design, because its top-level keys may themselves be flow variables (the bare legacy `{ <variable>: <value> }` config), and the descriptor declares `additionalProperties: true`. That openness is spelled `.catchall(z.unknown())`.
+
+zod has two open-key branches and both skip a `__proto__` own key before anything author-facing can judge it. `z.record()`'s branch skips it above the key schema — that is objectstack#17852, fixed for the `assignments` map one level down. `handleCatchall` skips it above the **catchall** schema, one function over in the same file. So a flow variable named `__proto__` declared at the top level of an `assignment` node config parsed as SUCCESS and came back missing: the contract accepted a document and handed back a different one, on a surface whose own keys are author-named by design.
+
+`JSON.parse` is what produces `__proto__` as an own key, so stored flow metadata reaches this door routinely; an object literal's `{ __proto__: … }` sets the prototype instead and never reaches either loop.
+
+## What is refused, and what is not
+
+`__proto__` only, in this position as in the sibling one. `constructor`, `prototype` and every other reserved-looking name reach the catchall unskipped and round-trip intact — measured — so they remain legal top-level flow-variable names and nothing narrows for them. The refusal is a `z.preprocess` guard on the raw input (`refuseCatchallProtoKey`, a sibling of `refuseRecordProtoKey` sharing one mechanism), because that is the only place the key is still visible: declaring it in the object's own shape was measured to refuse *every* config, since zod reads a declared key through `input["__proto__"]` and `"__proto__" in input`, which on an ordinary object both answer through the inherited accessor.
+
+The `assignments` map keeps its own guard. The two are different parsers at different depths and neither covers the other.
+
+Measured: zero authored use of `__proto__` as a top-level key on an `assignment` node config, across this repo, `examples/` and `objectui` — against a lit control of 100 authored `assignment` node declarations in 26 files here and 11 files there.
+
+## Known gap, left open on purpose
+
+Like the sibling guard, this runs at parse time only and does not project into the published JSON Schema (`packages/spec/json-schema/**`) — the general gap tracked as objectstack#18670, which stays open after this change.
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) zero authored use of `__proto__` as a top-level key on an `assignment` node config across this repo, examples/ and objectui — nobody has anything to rewrite, so there is no prescription to give. -->
@@ -383,7 +383,7 @@
     },
     "automation/AssignmentConfig": {
       "sites": [
-        "assignments.out.valueType"
+        "out.assignments.out.valueType"
       ]
     },
     "automation/AssignmentValue": {
 
@@ -665,3 +665,129 @@ describe('AssignmentConfigSchema.assignments — __proto__ pre-parse guard, cons
     expect(AssignmentConfigSchema.safeParse({ assignments: { total: '{amount}' } }).success).toBe(true);
   });
 });
+
+/**
+ * `AssignmentConfigSchema`'s OWN `.catchall()` — the third `__proto__` site
+ * of the #17852 family and the one maintainer ruling A-narrow (comment
+ * 5725370319) said would be «its own card when measured» (#19151).
+ *
+ * Different parser, different depth from the `assignments` guard above:
+ * `z.record()`'s open-key branch skips `__proto__` above the KEY schema,
+ * `handleCatchall` skips it above the CATCHALL schema (zod 4.4.3,
+ * `v4/core/schemas.js` — the two `continue`s are one function apart). Neither
+ * guard covers the other, and this object's top-level keys are an authoring
+ * surface for flow-variable names BY DESIGN (the schema's own docblock:
+ * «its top-level keys may be variables»), so the drop landed on data an
+ * author wrote on purpose.
+ *
+ * The pins below assert BEHAVIOUR, not field presence: an authored top-level
+ * `__proto__` must be refused LOUDLY — told apart here from the two silent
+ * outcomes it could otherwise have (silently dropped, silently kept).
+ */
+describe('AssignmentConfigSchema — top-level __proto__ refused at the catchall (#19151)', () => {
+  /**
+   * The three outcomes an authored key can meet, discriminated by one
+   * function so a test cannot accidentally assert the wrong one. A bare
+   * `success === false` would pass for a schema that refused EVERY config,
+   * and a bare key check would pass for one that kept the key and reported
+   * success — the defect and its over-correction both.
+   */
+  function classify(config: unknown, key: string): 'refused' | 'silently-dropped' | 'silently-kept' {
+    const result = AssignmentConfigSchema.safeParse(config);
+    if (!result.success) return 'refused';
+    return Object.prototype.hasOwnProperty.call(result.data as object, key)
+      ? 'silently-kept'
+      : 'silently-dropped';
+  }
+
+  // `JSON.parse` is what makes `__proto__` an OWN enumerable key — an object
+  // literal's `{ __proto__: ... }` sets the actual prototype instead and
+  // never reaches `handleCatchall`'s `for (const key in input)` as a key at
+  // all. Stored flow metadata arrives through exactly this door.
+  const AUTHORED = '{"total":"{amount}","__proto__":"{evil}","other":1}';
+
+  it('REFUSES it — neither silently dropped nor silently kept', () => {
+    expect(classify(JSON.parse(AUTHORED), '__proto__')).toBe('refused');
+  });
+
+  it('names the key and locates it at the document root', () => {
+    const result = AssignmentConfigSchema.safeParse(JSON.parse(AUTHORED));
+    expect(result.success).toBe(false);
+    if (result.success) return;
+    const issue = result.error.issues.find((i) => i.path.join('.') === '__proto__');
+    expect(issue).toBeDefined();
+    expect(issue?.code).toBe('custom');
+    expect(issue?.message).toContain('__proto__');
+    // The refusal names the parser that would have dropped it. An author sent
+    // to `z.record()` here would go looking at `assignments`, a different slot
+    // with a different guard.
+    expect(issue?.message).toContain('catchall');
+    expect(issue?.message).toContain('assignment');
+  });
+
+  it('refuses a config that is `__proto__` ALONE — no sibling key masks the drop', () => {
+    expect(classify(JSON.parse('{"__proto__":"{evil}"}'), '__proto__')).toBe('refused');
+  });
+
+  it('CONTROL — the same parse WITHOUT the guard silently drops it, on this exact zod', () => {
+    // The instrument can see the defect: an unguarded object of the same
+    // shape accepts the document and returns a different one. Without this
+    // leg the pin above could be green because nothing ever reached the
+    // catchall at all.
+    const Unguarded = z.object({ assignments: z.record(z.string().min(1), z.unknown()).optional() })
+      .catchall(z.unknown());
+    const result = Unguarded.safeParse(JSON.parse(AUTHORED));
+    expect(result.success).toBe(true);
+    if (!result.success) return;
+    expect(Object.keys(result.data)).toEqual(['total', 'other']);
+  });
+
+  it.each(['constructor', 'prototype', 'toString'])(
+    'PRESERVATION: `%s` remains a legal TOP-LEVEL variable name — only `__proto__` is refused',
+    (name) => {
+      // These reach the catchall unskipped and round-trip intact, so no
+      // ruling narrows them. The guard refusing them would be a narrowing
+      // nobody ordered.
+      expect(classify(JSON.parse(JSON.stringify({ [name]: '{x}', keep: 1 })), name)).toBe('silently-kept');
+    },
+  );
+
+  it('PRESERVATION: every previously accepted shape still parses', () => {
+    expect(AssignmentConfigSchema.safeParse({}).success).toBe(true);
+    expect(AssignmentConfigSchema.safeParse({ assignments: {} }).success).toBe(true);
+    expect(AssignmentConfigSchema.safeParse({ assignments: { total: '{amount}' } }).success).toBe(true);
+    // The bare legacy config (no `assignments` wrapper) — the shape that makes
+    // this top level an authoring surface in the first place.
+    expect(AssignmentConfigSchema.safeParse({ decision: 'approved', digest: { dialect: 'cel' } }).success).toBe(true);
+    // The canonical map's CEL envelope, and its malformed counterpart.
+    expect(AssignmentConfigSchema.safeParse({ assignments: { d: { dialect: 'cel', source: 'a + b' } } }).success).toBe(true);
+    expect(AssignmentConfigSchema.safeParse({ assignments: { d: { dialect: 'cel' } } }).success).toBe(false);
+  });
+
+  it('leaves the `assignments` slot\'s OWN guard and prescriptions untouched', () => {
+    // Two guards, two depths: the nested one still fires at its own path, and
+    // the array-form prescription still rides the record's `invalid_type`.
+    const nested = AssignmentConfigSchema.safeParse(JSON.parse('{"assignments":{"__proto__":"{evil}"}}'));
+    expect(nested.success).toBe(false);
+    if (nested.success) return;
+    expect(nested.error.issues.some((i) => i.path.join('.') === 'assignments.__proto__')).toBe(true);
+    expect(AssignmentConfigSchema.safeParse({ assignments: [{ variable: 'digest', value: 1 }] }).error!.issues[0]!.message)
+      .toBe(ASSIGNMENT_ARRAY_FORM_PRESCRIPTION);
+  });
+
+  it('the JSON projection is UNCHANGED — the guard adds no structure the Studio or the ledger can see', () => {
+    // The wrapper is a `z.preprocess` pipe, which every spec walker resolves
+    // through (`pipeAuthorableSide`). If it did not, the expression ledger
+    // would lose `assignments.*` and the authorable surface would lose the
+    // `assignments` row — silently, in both cases.
+    const json = z.toJSONSchema(AssignmentConfigSchema, {
+      target: 'draft-2020-12', io: 'input', unrepresentable: 'any',
+    }) as { type?: string; properties?: Record<string, { additionalProperties?: Record<string, unknown> }> };
+    expect(json.type).toBe('object');
+    expect(Object.keys(json.properties ?? {})).toEqual(['assignments']);
+    expect(json.properties?.assignments?.additionalProperties?.xExpression).toBe('value');
+    const projected = getSchemalessNodeConfigJsonSchemas().assignment as
+      { properties?: Record<string, { additionalProperties?: Record<string, unknown> }> };
+    expect(projected.properties?.assignments?.additionalProperties?.xExpression).toBe('value');
+  });
+});
@@ -82,7 +82,7 @@ import { z } from 'zod';
 import { EvaluatedExpressionSchema } from '../shared/expression.zod';
 import { lazySchema } from '../shared/lazy-schema';
 import { strictObject } from '../shared/strict-object';
-import { refuseRecordProtoKey } from '../shared/record-proto-key-guard';
+import { refuseCatchallProtoKey, refuseRecordProtoKey } from '../shared/record-proto-key-guard';
 import { isExpressionEnvelopeShaped } from './flow-node-expression-paths';
 
 /** What a rejected key on these contracts silently did before #4001 批 9. */
@@ -918,8 +918,17 @@ export const ASSIGNMENT_ARRAY_FORM_PRESCRIPTION =
  * undeclared-key walk by design (its top-level keys may be variables), and a
  * closed shape here would contradict the descriptor's `additionalProperties:
  * true` the form↔Zod ledger pins.
+ *
+ * That openness is exactly why the top level needs its own `__proto__` guard
+ * (#19151). `.catchall()`'s branch skips a `__proto__` own key above the
+ * catchall schema, the same way `z.record()`'s branch skips it above the key
+ * schema — so on a surface whose own keys ARE author-named variables, a
+ * variable named `__proto__` parsed as SUCCESS and came back missing. It is
+ * refused here instead; `assignments` one level down keeps its own guard,
+ * because the two are different parsers at different depths and neither
+ * covers the other.
  */
-export const AssignmentConfigSchema = lazySchema(() => z.object({
+export const AssignmentConfigSchema = lazySchema(() => refuseCatchallProtoKey(z.object({
   /** Variable name → value; the canonical authoring surface. */
   assignments: refuseRecordProtoKey(
     z.record(z.string().min(1), AssignmentValueSchema, {
@@ -938,7 +947,19 @@ export const AssignmentConfigSchema = lazySchema(() => z.object({
   ).optional()
     .describe('Variables to set: each key is a variable name, each value a `{token}` template, a CEL value envelope, or a literal'),
 })
-  .catchall(z.unknown()));
+  // Open by design: the bare legacy `{ <variable>: <value> }` config and any
+  // top-level key an author names live here.
+  .catchall(z.unknown()),
+  // [#19151] `__proto__` ONLY, and for the same structural reason
+  // the `assignments` slot above refuses it: `handleCatchall`'s
+  // `if (key === "__proto__") continue;` runs above `_catchall.run`, so no
+  // catchall schema can ever see the key. `constructor`, `prototype` and
+  // every other reserved-looking name reach the catchall unskipped and
+  // round-trip intact (measured), so they stay legal top-level variable
+  // names — nothing here narrows this surface's accept set beyond the one
+  // name zod makes unrepresentable.
+  'an `assignment` node config',
+));
 
 export type AssignmentConfig = z.input<typeof AssignmentConfigSchema>;
 export type AssignmentConfigParsed = z.infer<typeof AssignmentConfigSchema>;
@@ -3,15 +3,15 @@
 import { z } from 'zod';
 import { describe, expect, it } from 'vitest';
 
-import { refuseRecordProtoKey } from './record-proto-key-guard';
+import { refuseCatchallProtoKey, refuseRecordProtoKey } from './record-proto-key-guard';
 
 /**
- * Isolated pin for the guard itself, independent of either real consumer
- * (`ObjectSchema.fields`, `AssignmentConfigSchema.assignments` — objectstack
- * #17852 / #18847). Those two files pin the guard wired into a real
- * authoring surface; this file pins the guard's own contract against a
- * minimal record so a future change to either consumer schema cannot mask a
- * regression here.
+ * Isolated pins for the guards themselves, independent of their real
+ * consumers (`ObjectSchema.fields`, `AssignmentConfigSchema.assignments` and
+ * `AssignmentConfigSchema`'s own catchall — objectstack #17852 / #18847 /
+ * #19151). Those files pin each guard wired into a real authoring surface;
+ * this file pins the guards' own contracts against minimal schemas so a
+ * future change to a consumer schema cannot mask a regression here.
  *
  * These assertions are BEHAVIOUR pins, not a zod-version pin (as ordered):
  * `packages/spec/package.json` pins `zod` at `^4.4.3`, and a bump inside
@@ -91,3 +91,82 @@ describe('refuseRecordProtoKey', () => {
     expect(result.error.issues[0]!.message).toBe('no arrays here');
   });
 });
+
+/**
+ * `refuseCatchallProtoKey` — the sibling for zod's OTHER open-key branch
+ * (objectstack#19151). Same mechanism, same refused name, same issue shape;
+ * what differs is the parser the message names, and that difference is the
+ * reason it is a second wrapper rather than a second call site of the first.
+ */
+describe('refuseCatchallProtoKey', () => {
+  const Open = () => z.object({ known: z.string().optional() }).catchall(z.unknown());
+  const Guarded = refuseCatchallProtoKey(Open(), 'a widget config');
+
+  it('refuses a `__proto__` own key with a named, self-locating issue', () => {
+    const input = JSON.parse('{"known":"a","__proto__":"2"}');
+    const result = Guarded.safeParse(input);
+    expect(result.success).toBe(false);
+    if (result.success) return;
+    expect(result.error.issues).toHaveLength(1);
+    const [issue] = result.error.issues;
+    expect(issue.code).toBe('custom');
+    expect(issue.path).toEqual(['__proto__']);
+    expect(issue.message).toContain('a widget config');
+    expect(issue.message).toContain('__proto__');
+  });
+
+  it('names `.catchall()`, NOT `z.record()` — the two positions drop the key for different reasons', () => {
+    // An author sent to the wrong parser looks in the wrong place. This is
+    // the whole reason the wrapper is not a relabelled `refuseRecordProtoKey`.
+    const catchallMessage = Guarded.safeParse(JSON.parse('{"__proto__":1}')).error!.issues[0]!.message;
+    const recordMessage = refuseRecordProtoKey(z.record(z.string(), z.string()), 'things')
+      .safeParse(JSON.parse('{"__proto__":"1"}')).error!.issues[0]!.message;
+    expect(catchallMessage).toContain('catchall');
+    expect(catchallMessage).not.toContain('z.record()');
+    expect(recordMessage).toContain('z.record()');
+    expect(recordMessage).not.toContain('catchall');
+  });
+
+  it('the underlying catchall really would have silently dropped it — the control this guard exists to fail', () => {
+    // Proves the defect on the pinned zod rather than from the docblock's
+    // quoted excerpt: the unguarded object accepts the document and returns a
+    // DIFFERENT one.
+    const result = Open().safeParse(JSON.parse('{"known":"a","__proto__":"2"}'));
+    expect(result.success).toBe(true);
+    if (!result.success) return;
+    expect(Object.keys(result.data)).toEqual(['known']);
+  });
+
+  it('leaves an object with no `__proto__` key untouched, catchall keys included', () => {
+    const result = Guarded.safeParse({ known: 'a', anything: 1, constructor: 'c', prototype: 'p' });
+    expect(result.success).toBe(true);
+    if (!result.success) return;
+    expect(result.data).toEqual({ known: 'a', anything: 1, constructor: 'c', prototype: 'p' });
+  });
+
+  it('does not choke on non-object input — the wrapped schema still reports its own type error', () => {
+    const result = Guarded.safeParse('nope');
+    expect(result.success).toBe(false);
+    if (result.success) return;
+    expect(result.error.issues[0]!.code).toBe('invalid_type');
+  });
+
+  it('does not choke on null or an array', () => {
+    expect(Guarded.safeParse(null).success).toBe(false);
+    expect(Guarded.safeParse([1, 2]).success).toBe(false);
+  });
+
+  it('composes with `.optional()` — undefined never runs the guard', () => {
+    expect(refuseCatchallProtoKey(Open(), 'a widget config').optional().safeParse(undefined).success).toBe(true);
+  });
+
+  it('keeps the wrapped shape readable through the spec walkers\' pipe resolution', () => {
+    // `zodShapeOf`/`pipeAuthorableSide` resolve a preprocess pipe to its OUT
+    // side; if the guard broke that, a guarded schema would walk "to no
+    // shape" and silently stop being governed (the #4488 blind spot).
+    const def = (Guarded as unknown as { _zod: { def: Record<string, unknown> } })._zod.def;
+    expect(def.type).toBe('pipe');
+    const out = def.out as z.ZodObject<z.ZodRawShape>;
+    expect(Object.keys(out.shape)).toEqual(['known']);
+  });
+});
Original file line number	Diff line number	Diff line change
`@@ -383,7 +383,7 @@`
`383`	`383`	`},`
`384`	`384`	`"automation/AssignmentConfig": {`
`385`	`385`	`"sites": [`
`386`		`- "assignments.out.valueType"`
	`386`	`+ "out.assignments.out.valueType"`
`387`	`387`	`]`
`388`	`388`	`},`
`389`	`389`	`"automation/AssignmentValue": {`