test(rest): a plain readable column reaches the update preview's rules as its stored value

Also states the served-as-stored column rule in the changeset.

Claude-Session: https://claude.ai/code/session_01Bw3y2DWhT9RPnrmDsNqEVG
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/22445-update-preview-stored-row.md

@@ -12,7 +12,7 @@ The preview's accept set widens: rows it refused, and the write admits, are now
 
 - **Before.** An `update`-mode preview (`engine.validate(object, rows, { mode: 'update' })`, `validateData`, and the import dry run of a row that matched a stored record) read no stored row, so the record its rules judged held only the patch. A `requiredWhen`, an option `visibleWhen` or a `validations[]` rule that reads a column the patch omits faulted there, and the preview refused the row with `rule_violation` / `unevaluable`, although the real update reads the stored row first and admits it. The refusal also said the omitted column was one "which this object does not declare", sending the author looking for a field that exists.
 - **Now.** A row that carries its `id` (the address every update door already folds into the payload) is judged against the row that id names: the stored row is the rules' `previous`, and their record is the stored row merged with the patch, exactly as the by-id update judges it. A reference field a traversing rule reads is resolved from that merge too. The import dry run of a matched row sends the matched record's id this way, so nothing new crosses the protocol.
-- **Read under the caller's access.** The engine's read door, under the caller's own context, decides whether there is a row to judge: a row the caller cannot read gets the verdict a missing row gets. The values judged are the row as stored, read the way the by-id update reads its prior row (so a formula column, which has no stored value, is judged as the update judges it), kept to the columns the read door returned: a column the caller may not read is judged as empty. A preview discloses nothing about a row or column the caller could not read.
+- **Read under the caller's access.** The engine's read door, under the caller's own context, decides whether there is a row to judge: a row the caller cannot read gets the verdict a missing row gets. The values judged are the row as stored, read the way the by-id update reads its prior row (so a formula column, which has no stored value, is judged as the update judges it). A stored column is judged only where the read door served this caller that very value. A column the read door hid, or served transformed (a partially masked field, a masked secret), is judged as empty, so the verdict never depends on a value the caller could not read in full. File fields are compared in their stored form, so a readable file reference is judged as the id it holds. Measured on `driver-sql` (SQLite) and `driver-memory`, a plain readable column (number, currency, percent, boolean, date, datetime, JSON, multiselect, select, text) reaches the rules as its stored value.
 - **Unchanged.** A row with no `id`, or whose id names no row the caller can read, is judged on the patch alone, as before. `required` and value checks still look only at the supplied keys, matching a PATCH. A merge that really violates a rule is refused, as the write refuses it. The preview still runs no `readonlyWhen` or primary-key strip, so it can report fewer dropped fields than the update.
 - **The refusal names the real cause.** Where a rule reads a column the object declares and the judged record does not hold it (a preview with no stored row), the refusal now says the value was not supplied and no stored row was read, instead of saying the object does not declare the column. A column the object really does not declare keeps the old sentence.
 

packages/objectql/src/validate-update-stored-row.test.ts

@@ -356,7 +356,7 @@ describe('#22445 — an update-mode preview judges the stored row merged with th
       for (const country of ['cn', 'us']) {
         rows.set('c1', { id: 'c1', name: 'one', country });
         // Precondition: the read door serves the key, masked.
-        expect(await engine.findOne(OBJECT, { where: { id: 'c1' }, context: { userId: 'erin' } as any })).toMatchObject({ country: '**' });
+        expect(await engine.findOne(OBJECT, { where: { id: 'c1' }, context: { userId: 'erin' } })).toMatchObject({ country: '**' });
         verdicts.push(await verdictOf(engine, { province: 'zj', id: 'c1' }, { userId: 'erin' }));
       }
       expect(verdicts[0]).toEqual(verdicts[1]);

packages/rest/src/validate-update-stored-row-representation.test.ts

@@ -0,0 +1,98 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// #22445 (d4) — the `update`-mode preview keeps a stored column only where the
+// read door served the caller that very value, so a column the read door
+// served TRANSFORMED (a partial mask) is judged as empty. This file is the
+// representation control for that comparison, on a real driver (driver-sql over
+// SQLite): a plain readable column of every common type must reach the rules
+// as its stored value. If the read door and the prior-row read represented one
+// of them differently, the comparison would judge a readable column empty and
+// the preview would answer on less than the write knows.
+//
+// Each `n_<column>` is required while its column holds the stored value. The
+// stored row satisfies every rule; the patch clears every `n_<column>`, so a
+// rule that judges the STORED value refuses with `required` (a compliant row
+// made violating), and a rule that judged the column empty would answer
+// otherwise (a fault, or an admission). The by-id update is the reference.
+
+import { describe, it, expect, afterEach } from 'vitest';
+import { ObjectQL } from '@objectstack/objectql';
+import { SqlDriver } from '@objectstack/driver-sql';
+
+const OBJECT = 'pv_repr';
+
+/** column → [field definition, the predicate its `n_<column>` is required under, stored value]. */
+const COLUMNS: Record<string, [Record<string, unknown>, string, unknown]> = {
+  amount: [{ type: 'number' }, 'record.amount > 10', 50],
+  active: [{ type: 'boolean' }, 'record.active == true', true],
+  due_on: [{ type: 'date' }, 'record.due_on != null', '2026-01-15'],
+  happened_at: [{ type: 'datetime' }, 'record.happened_at != null', '2026-01-15T08:30:00.000Z'],
+  meta: [{ type: 'json' }, 'record.meta != null', { a: 1, b: [1, 2] }],
+  tags: [{ type: 'multiselect', options: [{ label: 'A', value: 'a' }, { label: 'B', value: 'b' }] }, 'record.tags != null', ['a', 'b']],
+  tier: [{ type: 'select', options: [{ label: 'Gold', value: 'gold' }, { label: 'Basic', value: 'basic' }] }, "record.tier == 'gold'", 'gold'],
+  code: [{ type: 'text' }, "record.code == 'X1'", 'X1'],
+};
+
+const fields: Record<string, Record<string, unknown>> = { title: { name: 'title', label: 'Title', type: 'text' } };
+for (const [column, [def, predicate]] of Object.entries(COLUMNS)) {
+  fields[column] = { name: column, label: column, ...def };
+  fields[`n_${column}`] = { name: `n_${column}`, label: `n_${column}`, type: 'text', requiredWhen: predicate };
+}
+
+const liveEngines: ObjectQL[] = [];
+afterEach(async () => {
+  while (liveEngines.length) {
+    try { await liveEngines.pop()?.destroy(); } catch { /* noop */ }
+  }
+});
+
+async function boot() {
+  const engine = new ObjectQL();
+  liveEngines.push(engine);
+  engine.registerDriver(new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true }), true);
+  await engine.init();
+  engine.registry.registerObject({ name: OBJECT, label: 'Preview Representation', fields } as any);
+  await engine.syncSchemas();
+  const stored: Record<string, unknown> = { title: 'stored' };
+  for (const [column, [, , value]] of Object.entries(COLUMNS)) {
+    stored[column] = value;
+    stored[`n_${column}`] = 'kept';
+  }
+  const created = await engine.insert(OBJECT, stored) as Record<string, unknown>;
+  return { engine, id: created.id as string };
+}
+
+const clearAll = () => Object.fromEntries(Object.keys(COLUMNS).map((c) => [`n_${c}`, null]));
+const findings = (errors: Array<{ field: string; code: string }>) =>
+  errors.map((e) => ({ field: e.field, code: e.code })).sort((a, b) => a.field.localeCompare(b.field));
+
+describe('#22445 (d4) a plain readable column reaches the preview\'s rules as its stored value', () => {
+  it('every column type judges the stored value, as the by-id update does', async () => {
+    const { engine, id } = await boot();
+    const expected = Object.keys(COLUMNS).map((c) => ({ field: `n_${c}`, code: 'required' }))
+      .sort((a, b) => a.field.localeCompare(b.field));
+
+    const preview = await engine.validate(OBJECT, { ...clearAll(), id }, { mode: 'update', context: { userId: 'reader' } });
+    expect(findings(preview.results![0]!.errors)).toEqual(expected);
+
+    let writeErrors: Array<{ field: string; code: string }> = [];
+    try {
+      await engine.update(OBJECT, { ...clearAll(), id }, { context: { userId: 'reader' } });
+    } catch (e: any) {
+      expect(e?.code).toBe('VALIDATION_FAILED');
+      writeErrors = e.fields;
+    }
+    expect(findings(writeErrors)).toEqual(expected);
+  });
+
+  it('control: each rule admits once its own column is cleared in the same patch', async () => {
+    const { engine, id } = await boot();
+    const patch: Record<string, unknown> = { ...clearAll(), id };
+    for (const column of Object.keys(COLUMNS)) patch[column] = null;
+    const preview = await engine.validate(OBJECT, patch, { mode: 'update', context: { userId: 'reader' } });
+    expect(findings(preview.results![0]!.errors)).toEqual(
+      // `null > 10` has no overload: the number rule cannot judge a cleared column.
+      [{ field: 'n_amount', code: 'rule_violation' }],
+    );
+  });
+});