fix(objectql)!: a stored field's declared expression is computed on every write, so a paid invoice's line amount and total stay frozen

[objectstack-fleet]

Refs #24619 (item a)

Clause-②: no (narrowing) (either shape narrows what a write of a derived stored value is accepted as: a locked value stays locked, or a declared computation is enforced; it owes a CONTRACT_REVIEW_TIER review on the narrowing face before the queue)

Row (a) only. Rows (b) (packages/rest, HookConditionError) and (c) (service-external-datasource, listRemoteTables) are not touched here; #24619 remains open for them.

What changes

A field that is not a formula and declares expression is a stored computed column: it has a column, so a summary can roll it up. The engine evaluated expression for formula fields only, so the value a client sent for such a field was stored as-is. Now @objectstack/objectql computes it on every write, so a client-sent value never stands (shape B).

• Insert (insert, batch insert, insertMany): computed over the defaulted row before the beforeInsert hooks, so a hook is handed the stored value. It is computed again over the final row, after the hooks and the strips and before validation and the driver.
• Update by id: computed over the stored row merged with the caller's patch, before beforeUpdate, written onto the raw payload (never through the hook-write recording) and never onto a readonly key the Update-side: a readonly field is stripped from persistence but still reaches beforeUpdate, so hook-derived columns persist values computed from data the row never contains #16344 hide pass withheld, so the hooks see the expression over the pre-strip row (a readonly key the caller sent stays withheld from the hooks) and the read-only strips still judge the caller's submission. It is computed again after the hooks and both read-only strips, so a locked input that the readonlyWhen strip took back out feeds the stored value, never the caller's. A key the caller sent is overwritten. A key the patch does not carry is added only when the computed value differs from the stored one.
• Predicate update (multi: true): one patch reaches every matched row (the D7 readPriorRows memo, no second read). The computed value is stored when it is the same on every row. A patch that moves no input leaves the column alone and drops the caller's value. A patch that would compute different values on different rows is refused with VALIDATION_FAILED before anything is written. The field error is invalid_value and names the field. Its per-row beforeUpdate hooks run before the settle and are handed the caller's patch.
• One evaluator: the read path's applyFormulaPlan, planned by the same entry builder as the formula read plan (formulaPlanEntry, factored out of planFormulaProjection). The scale rounding, the one hop, the can() permission map and the once-per-field fault report are the read's. An expression that does not evaluate stores null, as a formula reads null.
• No new export, class member, spec key or error code. The new helpers are module-level functions in engine.ts.
• packages/spec/src/data/field.zod.ts: the expression describe and TSDoc now say what the key means on a formula field and on a stored field. This is a domain:spec file, declared to that lane by the claim. content/docs/references/** was regenerated (gen:docs).
• Both examples' comments (showcase_invoice_line.amount, crm_opportunity_line_item.amount) now say what the server does. No metadata changed. amount needs no readonlyWhen of its own: on a paid invoice, the locked inputs keep it frozen.
• Changeset: minor for @objectstack/objectql and @objectstack/spec, with a BREAKING banner, FROM / TO / Fix, and an adr-0087: not-required (no-migration-prescription) marker.

Measurement (M, a booted composition)

The showcase and the CRM were booted with objectstack dev --seed-admin --fresh and driven over HTTP. Before: origin/main at f89d29e382. After: this branch.

Write (showcase, line of the PAID INV-1003, qty 6 × 49.99)	before: line amount / invoice total	after: line amount / invoice total
POST /api/v1/batch update {quantity:60, amount:2999.40}, atomic	2999.4 / 2999.4 (quantity dropped readonly_when)	299.94 / 299.94 (quantity dropped readonly_when)
PATCH /api/v1/data/showcase_invoice_line/ID {"amount":1}	1 / 1	299.94 / 299.94

Write (showcase, draft INV-1002, the unpaid control)	before	after
PATCH {"amount":5}	amount 5, total 5	amount unchanged
PATCH {quantity:5, unit_price:20, amount:100} (the grid's consistent save)	stored as sent	stored as sent: 5 / 20 / 100, total 100
PATCH {"quantity":7}	amount stale	amount 140, total 140
POST line {quantity:2, unit_price:10, amount:999}	amount 999	amount 20

CRM (crm_opportunity_line_item, inputs not locked)	before	after
POST line {quantity:2, unit_price:10, amount:999}	amount 999, line_total 999	amount 20, line_total 20
PATCH {"quantity":3}	amount stays 999, line_total 999	amount 30, line_total 30

Seeds: all 5 seeded showcase lines already satisfy amount == quantity * unit_price, so every invoice total is identical before and after the boot (INV-1001 1619.96, INV-1002 198, INV-1003 299.94, INV-1004 450). The CRM seeds no line items.

Census: stored, non-formula fields declaring expression

Every expression: key in the tree was scanned (*.ts, tests excluded) and each one's owning field was resolved: examples, platform-objects, plugins, services, metadata-core. Every other hit is a Field.formula / type: 'formula' or not a field. There are exactly two stored ones:

Field	Writers	Readers
showcase_invoice_line.amount (invoice.object.ts)	the console line-item grid (recomputes client-side and sends the computed value), the seed (5 rows, all consistent), the REST / MCP API (any value, before this PR). No hook, flow or import writes it.	showcase_invoice.total summary, and through it revenue-pulse.dataset.ts, renewals-pipeline.page.ts (chart + list), invoice-document.page.ts
crm_opportunity_line_item.amount (opportunity-line-item.object.ts)	the console grid (also inlineAmountField: 'amount' for the grid footer), the API. No seed, hook or flow.	crm_opportunity.line_total summary

Before this PR, nothing said what a non-formula field's expression means on the server. The spec describe said only "Formula expression (CEL)". The lint (validate-expressions.ts field-formula pass) judges any field's expression as a CEL value expression, and no rule distinguishes stored from formula. content/docs/data-modeling/validation-rules.mdx lists expression under formula only. The two example comments said the server stores the client's value.

The four-axis call (shape B over shape A)

• Actual business need. Measured: the card's paid-lock bypass, plus the stale or wrong stored amount on any unlocked line written through the API (showcase draft lines, every CRM line). An AI agent writing through MCP is exactly such a writer. Shape A (a readonlyWhen on the showcase amount) closes only the first. Shape B closes both, in both apps, with no per-app metadata.
• Long-term soundness. B is platform-first: one engine rule instead of every app remembering to copy its inputs' lock onto the derived column. Under A, expression on a stored field would stay a declared key the server does not honour.
• Preventing AI authoring errors. Under B, declaring an expression is what enforces it. An author or agent who declares expression on a stored field gets the computation it declared, and an agent that sends a wrong or stale value cannot store it.
• Startup-stage scope. No new spec key, export, error code or gate. B gives an existing, consumed key the meaning both producers already assumed.
• Overwrite, not refuse. A whole-record round-trip (form save, read-modify-write, the grid) echoes the stored amount back. Refusing a value that differs would turn those writes into 400s. The platform's precedent for a runtime-owned value is to accept the write and not store the caller's value (the formula and read-only strips). The one refusal is the predicate update that cannot be expressed as one statement. That follows the bulk readonlyWhen strip's fail-safe rule, and uses the existing VALIDATION_FAILED / invalid_value (checked first: FieldErrorCode in packages/spec/src/api/errors.zod.ts, plus the engine's ReadonlyFieldRejectedError / readonly-strict-errors.ts codes, which describe dropped locks, not a per-row computation).

Pins

packages/objectql/src/engine-stored-expression-write.test.ts (14 cases, the real engine over a real-shaped driver):

• the card's two writes on a paid line: the /batch-shaped update keeps quantity 6, stores amount 299.94, reports exactly [quantity] readonly_when, and leaves total 299.94. The amount-only PATCH stores 299.94 and leaves total 299.94;
• the unpaid control: the grid's consistent save is stored as sent;
• insert and update, each with no amount, a wrong amount and the right amount; batch insert per row; a patch that moves no input;
• beforeUpdate is handed the expression over the pre-strip row, and an input that a hook changes is recomputed;
• predicate update: one value stored; untouched when no input moves; refused (VALIDATION_FAILED, field amount, invalid_value) and nothing written when the values would differ per row;
• a stored field that is readonly and declares expression, updated by id with its value and a moved input: the caller's value is reported as a readonly drop and refused under strictReadonlyWrites, and the stored value is the expression's (fix round 1; ablation with pass 1 on the recording payload: 2 failed | 12 passed).

Ablation. The test imports ./engine.js relatively, so it runs source, not dist. With node scripts/ablation-replace.mjs, the planner's guard (if (def && typeof def === 'object' && def.type !== 'formula' && def.expression) {) was replaced by if (false && …. The mutation landed (anchor 1 → 0, blob fd733c5e5f21 → c7fc76a3bea4): 10 failed | 2 passed. Every paid-line pin is red. The two that stay green are the consistent grid save and the no-input patch, whose behaviour is the same either way. Restored: blob after restore fd733c5e5f21 == HEAD, git diff HEAD empty.

Pin sweep. git grep -n "expression" -- '*.object.ts' and the tests naming showcase_invoice_line / crm_opportunity_line_item were read. No existing pin asserts a client-sent stored-expression value. The dogfood persona matrix inserts a showcase line with no unit_price, which now stores amount null, as it did before (absent). No readonly_when pin moves: the drop set on the paid line is unchanged.

Verification record

Head of record: c22a069d3 (fix round 1; round 0 was c01e06227) (origin/main cc95f5e63 merged in; the incoming commits touch none of packages/objectql, packages/spec or examples/).

• pnpm --filter @objectstack/objectql test: 449 files / 8461 tests passed.
• pnpm --filter @objectstack/spec test: 702 files / 21349 passed, 1 todo.
• pnpm --filter @objectstack/core test:repo: 6 files / 82 passed.
• pnpm --filter @objectstack/example-showcase test: 36 files / 431 passed. pnpm --filter @objectstack/example-crm test: 6 files / 46 passed.
• typecheck, exit 0 each, re-run after the merge: @objectstack/objectql (incl. check:test-typecheck), @objectstack/spec, @objectstack/example-showcase, @objectstack/example-crm.
• pnpm --filter @objectstack/spec check:generated: one stale artifact (content/docs/references/**), regenerated with gen:docs, then "All 14 generated artifacts are up to date", re-run after the merge.
• Fix round 1: the 116 families derived for this round's paths were re-run on c22a069d3, all exit 0 (--ran: a DERIVED zero). The other two of the 118 read only the two example objects, byte-identical to c01e06227.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 118 families. All 118 were re-run on the head of record c01e06227, and all exited 0. --ran: "118 derived famil(ies) accounted for — 118 run, 0 NOT-MEASURED (a DERIVED zero — all 118 recorded an exit code and none of them is 3)".
  • On the first pass, three families did not pass. check:skill-examples and check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: unbuilt client-react and 7 other packages); both passed after building those packages. check:objectql-double-limit exited 1 because the new suite's find double was limit-blind; the double now honours the bound and the gate exits 0.
  • The repository was deepened first (--shallow-since=2026-07-13) for check-engine-split-ratio --days 90 and check-plugin-teardown-shape.

Acceptance notes

• Not closed by either shape: adding a line to a paid invoice. POST /api/v1/data/showcase_invoice_line on the paid INV-1003 is accepted, before and after this PR, and moves its total, because readonlyWhen is exempt on INSERT by design. Measured before the fix: total 1 → 8 with a 7.00 line. Reported to the seat as a finding; not fixed here.
• ObjectQL.validate() (the insert dry-run) does not compute stored expressions. Its preview of amount is the caller's value.
• The fault log for a stored expression that does not evaluate reuses the formula sentence ("formula field 'amount' … reads null").
• A stored currency field that declares no scale stores the evaluator's double unrounded, as a formula does (3 * 0.1 → 0.30000000000000004). Both examples' seeded values are exact.
• The console grid was not driven in a browser (no ../objectui in this container). The grid recomputes the same product client-side, so its consistent saves are stored as sent, as the API measurement of the same payload shows.
• This PR touches no governed surface.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/objectql, @objectstack/spec, touching 12 documentable anchor(s).

12 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx (via invalid_value (literal, a string literal in settleBulkStoredExpressions))
• content/docs/concepts/metadata-driven.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/external-datasources.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/field-types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/validation-rules.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/troubleshooting.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/validating-metadata.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/getting-started/quick-reference.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/kernel/contracts/data-engine.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/backward-compatibility.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectql/types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectui/concept.mdx (via FieldSchema (symbol, a top-level const))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/releases/v17/17-1.mdx (via FieldSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 144 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 045dae8f23d21e7631e425bb851cad5ab2bc26fd → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 78a567b29c467179c2960e187c8d189e99db5df8 — the merge of head c22a069d3dbc63130ecf78b590d5550ee2677d96 into base 045dae8f23d21e7631e425bb851cad5ab2bc26fd, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 78a567b29c467179c2960e187c8d189e99db5df8 && git checkout 78a567b29c467179c2960e187c8d189e99db5df8
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 045dae8f23d21e7631e425bb851cad5ab2bc26fd c22a069d3dbc63130ecf78b590d5550ee2677d96 && git checkout -B drift-repro 045dae8f23d21e7631e425bb851cad5ab2bc26fd && git merge --no-ff c22a069d3dbc63130ecf78b590d5550ee2677d96

node scripts/docs-audit/affected-docs.mjs --json 045dae8f23d21e7631e425bb851cad5ab2bc26fd

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 045dae8f23d21e7631e425bb851cad5ab2bc26fd → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c01e0622788ed39c9ac8a49096a75ceee102bc2e
Local-runs: none
Scope: packages/spec/src/data/field.zod.ts, packages/objectql/src/engine.ts, packages/objectql/src/engine-stored-expression-write.test.ts, examples/app-showcase/src/data/objects/invoice.object.ts, examples/app-crm/src/objects/opportunity-line-item.object.ts + .changeset/24619-stored-expression-computed-on-write.md and content/docs/references/data/field.mdx, content/docs/references/data/object.mdx, content/docs/references/system/migration.mdx (the prose faces, read sentence by sentence), packages/objectql/src/validation/rule-validator.ts (stripReadonlyFields, stripReadonlyWhenFields, stripReadonlyWhenFieldsMulti, needsPriorRecord, hasParentScopedRequiredWhen), packages/objectql/src/hook-write-provenance.ts (recordHookPayloadWrites, the set trap), packages/objectql/src/index.ts and packages/objectql/src/core.ts (unchanged at this head), packages/metadata-protocol/src/seed-loader.ts (writeRecord, decideWriteAction, isNoOpReplay, SEED_OPTIONS), packages/metadata-protocol/src/protocol.ts (updateManyData, runUpdateManyLoop, the data doors' engine.insert / engine.update calls), packages/rest/src/batch-routes.ts (the /batch update and the updateMany route), packages/services/service-automation/src/builtin/crud-nodes.ts (update_record), packages/plugins/organizations/src/claim-org-seed-ownership.ts (the one multi: true writer), packages/mcp/src/mcp-http-tools.ts (update by id), packages/lint/src/validate-expressions.ts (judgeFieldFormula), packages/spec/src/shared/expression.zod.ts (EvaluatedExpressionInputSchema), examples/app-showcase/src/data/seed/index.ts (the five showcase_invoice_line rows), content/docs/data-modeling/validation-rules.mdx and content/docs/data-modeling/field-types.mdx (hand-written, unchanged), scripts/check-changeset-no-major.mjs (the narrowing arm), scripts/check-adr-0087-registration.mjs (no-migration-prescription), .github/workflows/pr-automation.yml (the Check Changeset job), AGENTS.md (the trailer pair, the changeset rule, the regenerate-and-commit rule), .claude/skills/pm-dispatch/references/contract-review.md, lanes/spec.md, app-platform-boundary.md, filing-gate.md, SKILL.md (the four axes, the domain path table). Inputs: card #24619's body and all five comments (triage 6272616654, claim 6277262398, dispatch 6277306080, routing 6278345889, the os-dev-report 6278955805 read as claims); #4889 with both comments; the PR body and file list (9 files, +498/-38, matching git diff against the merge base cc95f5e63e3c96acafa55378a57d06c086e7d639); the head's check-runs, read twice.

① Derived judgments

The computation point: two passes on insert and by-id update, one on predicate update.

• Insert (engine.insert, the batch and insertMany doors): planStoredExpressions runs once per call; pass 1 computes over defaultedData (after applyFieldDefaults and initializeSummaryFields, so quantity's default 1 is read) BEFORE the hook-write recording is armed and before beforeInsert; pass 2 computes over the final rows after the hooks, stripRuntimeOwnedFields, the static readonly strip and the post-image seam, immediately before normalizeMultiValueFields and validateRecordInScope, so the stored value is validated. Right.
• Update by id: pass 1 computes over { ...priorRecord, ...patch } after the prior-row read and before beforeUpdate; pass 2 computes over { ...priorRecord, ...finalPatch } after stripReadonlyWhenFields, stripReadonlyFields and assertNoStrictDrops(), before the post-image seam, evaluateValidationRules and driver.update. Nothing between pass 2 and the statement writes a value, so the stored value is the expression over the stored row: a hook that sets the field is overwritten (pinned), a hook that moves an input is recomputed (pinned), a locked input the readonlyWhen strip took back out feeds the stored value (the card's /batch shape, pinned). Right.
• Predicate update: ONE pass, after both strips and assertNoStrictDrops(), through settleBulkStoredExpressions. The per-row beforeUpdate dispatch (dispatchPerRowBeforeHooks) runs BEFORE it on the raw patch, so on this path the hooks are handed the CALLER's value (for example amount: 1), which the settle then deletes. The changeset's "The before* hooks are handed the computed value" is false on this path. Wrong as written; see ②.
• What a before* hook sees on by-id is not always what is stored. Pass 1 reads the pre-strip patch, so on the card's /batch write (quantity: 60, amount: 2999.4 on a paid line) the hook is handed quantity 60 and amount 2999.4, and the row stores quantity 6, amount 299.94. The locked input was already shown to hooks before this head (readonlyWhen is deliberately not hidden, engine.ts "⛔ readonlyWhen is NOT hidden and must not be", [objectql] TRUE readonlyWhen strips beforeUpdate-derived values too — a conditionally-locked derived field has no server-side write path at all (isSystem included), unlike static readonly's hook-stamp protection #9107), so the derived value shares a pre-existing exposure rather than opening one; but the code comment at the pass ("so a hook is handed the value the write stores (Update-side: a readonly field is stripped from persistence but still reaches beforeUpdate, so hook-derived columns persist values computed from data the row never contains #16344's ruling)") and the dev report's reading of Update-side: a readonly field is stripped from persistence but still reaches beforeUpdate, so hook-derived columns persist values computed from data the row never contains #16344 are false for exactly the card's case. Not a store-side defect; a wording and a citation to correct.
• Field-level security, read-only strips, later steps: the FLS write gate judges the caller's keys on opCtx.data at middleware time, never the engine-added key, so a caller editable on an input moves the derived column (right for a derived value) and a caller editable on the derived column alone cannot move it (overwritten from the stored inputs). The post-image RLS check seams on all three paths judge the final row with the computed value. stripComputedWriteFields still filters on type === 'formula' only, so a stored expression field is not stripped. No later step leaves a disagreeing value. Right.

The pre-hook pass on by-id writes inside the hook-write recording window, and that moves an undeclared accept-set edge — WRONG.

• hookContext.input.data is hookWrites.payload, the Proxy recordHookPayloadWrites(opCtx.data) returns (engine.ts, the [#14088] ARM block). Pass 1 does applyStoredExpressionsToPatch(patch, computed, priorRecord) on that Proxy, so every key it sets goes through the set trap (hook-write-provenance.ts: Reflect.set then record(key)) and lands in hookWrittenKeys as a HOOK write. The engine's own rule two screens up: "Placed BEFORE the recording is armed: a pass running inside that window is an ENGINE write recorded as a HOOK write, which is the laundering the seal note below exists to make impossible." The insert path obeys it (its pass 1 runs on defaultedData before rowHookContexts arm the recording); the by-id path does not.
• Consequence, on a shape FieldSchema admits and nothing refuses: a stored field declaring BOTH readonly: true AND expression. Before this head, a by-id update carrying the caller's value of that field had it hidden from the hooks, handed back, judged by stripReadonlyFields (supplied has it, Object.is holds), dropped with a readonly event through onFieldsDropped, and refused with ReadonlyFieldRejectedError under strictReadonlyWrites. At this head, when the same patch also moves an input, pass 1 re-adds the key with the computed value (not in the hidden patch; prior differs), the hand-back skips it (k in target), and the strip keeps it: hookWrittenKeys.has(name) is true, and even without the recorder the Object.is value test reads the engine's overwrite as "a hook overwrote this". No readonly event, no strict refusal, where both fired before. The stored value is still the computed one (pass 2), so the card's writes are unaffected.
• Reach: the census finds no in-tree stored expression field declaring readonly, and no in-repo producer passes strictReadonlyWrites: true (only the contract declarations and the error class name it). The accept/refuse behaviour of a published door is outside the in-repo radius, and the reading discipline says a missing victim is not evidence there. The changeset's "Unchanged" list does not name readonly, so this is an undeclared move on the narrowing face.
• Route (the seat's or the dev's choice, named here, not prescribed): keep the pre-hook image for the hooks but off the strips' payload, as the Update-side: a readonly field is stripped from persistence but still reaches beforeUpdate, so hook-derived columns persist values computed from data the row never contains #16344 hide/hand-back pair already does for readonly values (compute onto the hook VIEW and let the strips judge the caller's submission); or skip, in pass 1 only, any stored expression field the caller supplied, letting pass 2 overwrite it (this gives up the "hook sees the computed value" pin for a caller-sent wrong value); either way write pass 1 outside the recording window, as the insert path does, and pin a readonly plus expression field on by-id update with onFieldsDropped and with strictReadonlyWrites.

On update, the merged row is a read the write already makes; the cost and the authority. priorRecord is read unconditionally on every by-id update since #7867 (readUpdatePriorRow: a raw driver.findOne by id under buildDriverOptions — tenant scope and the open transaction — shaped to declared columns), so pass 1 and pass 2 add no read; they add two evaluations per stored field and two resolveFormulaRelated calls that return without a query when the expression traverses nothing (both examples read own columns only). The image is the raw stored row, not the caller's served image: columns field-level security would hide from the caller still feed the expression, which is right for a column that already derives from them. On the predicate path the rows come from readPriorRows, a memo over driver.find(object, ast) on the middleware-composed AST (RLS and sharing scoped). The dev's "no second read" is true; "a read the write already makes" holds only when per-row hooks exist (hasHooksFor), needsPriorRecord holds, the payload carries a readonlyWhen field, or a post-image check is installed. On a bare @objectstack/objectql/core embedder with an object declaring a stored expression and none of those, this head adds a FIRST read of the whole matched set, with no D6 ceiling (assertBulkPerRowHookBudget runs only when hooks exist). In a composed kernel the global afterUpdate registrants already force the read. Cost note, not blocking.

Overwrite, in every context. planStoredExpressions has no isSystem gate, so the overwrite reaches the console grid (sends the computed value; stored as sent — pinned), forms and read-modify-write (echo the stored value; stored as sent), MCP (mcp-http-tools.ts update is by id), imports and /batch (batch-routes.ts calls ql.update(object, { ...data, id })), the REST updateMany door (protocol.updateManyData loops runUpdateManyLoop per record by id) and system writers. The seed loader writes under SEED_WRITE_EXECUTION_CONTEXT (isSystem: true): on insert the engine overwrites the seed's amount with the same value; on replay isNoOpReplay compares each seed key with the stored row and skips. The five seeded showcase_invoice_line rows satisfy amount == quantity * unit_price in IEEE-754 doubles (10 × 150, 4 × 29.99 = 119.96, 2 × 99, 6 × 49.99 = 299.94, 3 × 150 — the two inexact products are exactly the seeded literals), so every replay still no-ops and every invoice total is unchanged. The CRM seeds no line items. No in-repo writer stores a value its expression does not compute: the census (two stored fields) matches my own expression grep over examples/**/*.object.ts. One observation: the overwrite is silent to every onFieldsDropped consumer (automation update_record step warnings, /batch droppedFields, the PATCH door's droppedFields) — a flow that writes amount: 1 reports success while the row holds 299.94, the shape #3407 ruled must be reported for the strips. Reporting it would need a new DroppedFieldsEvent.reason (the computed reason is contracted as "dropped, and the write completed without them", and this key IS written), which is a spec widening; flagged in ③, not blocking.

The predicate-update refusal. settleBulkStoredExpressions deletes the field from the patch, then: no row's computed value moves ⇒ column untouched (the caller's value is dropped); every row moves to one value ⇒ that value is set once on the patch, so ONE updateMany statement stores it; otherwise ValidationError([{ field, code: 'invalid_value', message }]) is thrown before driver.updateMany, so nothing is written. VALIDATION_FAILED and invalid_value are existing codes. In-repo reachability: service-automation's update_record node forwards where: filter, multi: cfg.multi === true to data.update, so a flow with multi: true and a filter over lines with differing unit_price setting quantity is refused and the step returns success: false with the message naming the by-id remedy; claim-org-seed-ownership (multi: true) moves no input, so its patch is untouched. /batch, the REST updateMany door and MCP are by id and never reach it. "Moves no input" is judged on COMPUTED values before and after, not on the stored column, so a legacy row whose column disagrees with its expression keeps the stale value through a predicate update that moves no input, while a by-id update of any key corrects it (applyStoredExpressionsToPatch adds the key when prior differs). Right, with the stale-row nuance noted against the ADR-0087 marker's "keeps it until the row is next written" in ②.

Null on fault. applyFormulaPlan answers null and calls the sink once per (object, field) per engine instance (reportFormulaFault). So an insert of a line with quantity but no unit_price now stores amount: null where it stored the caller's value or nothing; the dogfood persona insert the dev names stored absent before and null now, the same read. The min: 0 on amount does not judge null. No seed loses a number (all five lines carry both inputs; CRM seeds none), and sum skips null. "A declared expression is enforced" read as "the column holds the expression's answer, null included" is the formula read path's semantic and is right for a derived column; the log line still says "reads null" for a column that now STORES null (open question 5).

The paid-line pins. engine-stored-expression-write.test.ts drives the real ObjectQL over a driver whose find honours limit, with the showcase shape trimmed and the header rows present, so the parent-scoped readonlyWhen resolves through resolveMasterDetailParent. The /batch-shaped pin asserts quantity 6, amount 299.94, the drop set exactly [quantity] readonly_when; the amount-only PATCH pin asserts 299.94. Both have teeth: with the planner guard ablated the stored amount is 2999.4 and 1. The invoice total in the suite is the test's own sum over the store, not the engine's summary recompute (showcase_invoice is registered without a total field), so "total unchanged" is pinned by proxy; the real roll-up follows the stored column through recomputeSummaries. The draft control (consistent grid save stored as sent) is right. The CRM line_total is not pinned; the dev's booted-CRM table is a claim, and the code path is the showcase's minus the strips. By my reading of the twelve cases against an empty plan, ten go red (the two paid-line writes, no-amount update, wrong-amount update, the insert trio, the batch insert, the hook case, and all three predicate cases) and two stay green (the consistent save; the no-input patch whose stored 30 equals the pre-state), matching the dev's 10/2.

No public surface moves. formulaPlanEntry, planStoredExpressions, computeStoredExpressions, settleBulkStoredExpressions, applyStoredExpressionsToPatch are module-level functions and StoredExpressionServing a module-level interface, none exported; the only new import is the existing FieldValidationError type. packages/objectql/src/index.ts, core.ts and package.json are byte-identical to the merge base; no new member on ObjectQL (both hunks are inside insert and update). Consistent with this lane's rulings on PRs #24518 and #24526. Right.

② Semver level

• @objectstack/objectql: minor with the BREAKING banner and Clause-②: no (narrowing) at a line start in the changeset and on line 3 of the PR body. Right: the write doors' accept set narrows (a client value no longer stands; one predicate shape is refused), no key, value, export or code is added, and check-changeset-no-major reads the arm as "a BREAKING change; during the launch window it ships minor" (its self-test: a declared narrowing graded minor is clean). The Check Changeset run on this head is green, so the gate read it.
• @objectstack/spec: the package's own diff is describe and TSDoc only; the schema's accept set is byte-identical, which lanes/spec.md calls the auxiliary face (normally patch). It rides the one narrowing changeset, whose arm asks minor of the bumped packages, so minor is gate-consistent; the alternative is a separate patch changeset for the describe. Acceptable as committed.
• Narrowing or widening of meaning? No new accepted key or value: expression was already optional on every field type, the lint already judged it on any field (judgeFieldFormula reads f.expression regardless of type), and the console grid already consumed it on stored fields. The describe now states the server meaning of a key the server ignored: the spec lane's "declared ≠ enforced" face (lanes/spec.md lists it among the five contract shapes, and says a narrowing does not trigger Clause-②). So Clause-②: no (narrowing) stands, the published schema face is hit, and the spec lane's review applies — served by this record at CONTRACT_REVIEW_TIER, with the cross-seat declaration still owed (③).
• adr-0087: not-required (no-migration-prescription): the category exists in check-adr-0087-registration.mjs; its mechanical check (the body carries no migration prescription) and the "Require an ADR-0087 disposition on a declared-breaking changeset" step inside Check Changeset are green on this head. The Fix line is a behavioural prescription, not a metadata rewrite — no key moves and objectstack migrate meta has nothing to do — so the category is the right one of the set. One sentence in the marker overstates: "A stored row whose value disagrees with its expression keeps it until the row is next written" — a predicate update that moves no input is a write that leaves it stale (①).
• FROM: true. TO: "computes after the before* hooks and both read-only strips" true (pass 2); "The before* hooks are handed the computed value" false on the predicate path and, on by-id, a value that is not the stored one whenever a locked input is in the patch (①) — rewrite it as "on insert and update by id, the before* hooks are handed the expression over the pre-strip row; a predicate update's per-row hooks are handed the caller's patch"; "A caller's value is overwritten, in every context" true; "A patch that moves none of the expression's inputs stores the value the row already computes to" true by id, qualified for the predicate path by the Refused bullet; the null-on-fault sentence true (sink once per object and field per engine instance); the summary sentence true. Refused: true sentence by sentence (VALIDATION_FAILED, invalid_value, before anything is written, one value stored once, no-input leaves the column alone). Unchanged: true for formula, for fields without expression and for a client sending the computed value; it omits the readonly plus expression shape ① finds moved. Fix: true, and "remove the field's expression" also removes the grid's read-only cell, which the sentence does not say.
• The spec describe: "computed by the engine on every insert and update from the row the write stores ... and stored, so a client-sent value never stands" — "never stands" is true on every path (overwritten, dropped or refused); "on every ... update ... and stored" overstates the predicate path (left alone when no input moves; refused when values differ). Tighten in the same round.

③ Boundary flags

• Deviation 1 (content/docs/references/**, three generated files outside the claim's fence): accepted. AGENTS.md "Touched packages/spec? Regenerate and commit its artifacts before pushing" makes it required; lanes/spec.md says the regenerated references belong to the source PR; the three mdx rows carry the describe byte for byte, and no "Formula expression (CEL)" remains anywhere at this head.
• Deviation 2 (commit trailers): not a deviation under this repo's rule. AGENTS.md: "an agent commit ends with the model-free trailer pair Claude-Session ... and Co-authored-by: Claude, and the pre-push hook refuses a model identifier in that pair"; the six authored commits carry exactly that pair, the merge commit none. Accepted, as on PR fix(objectql): report a bound action named like one its target already lists, and registerAction replacing another owner's handler #24526.
• Deviation 3 (shape A not taken; CRM metadata untouched): within the claim's "by the shape the measurement picks" and the dispatch's "shape A or shape B". Accepted. The showcase comment's "with no readonlyWhen of its own" is true for updates; the insert exemption is finding 1 below.
• Open questions, by the four axes (SKILL.md: actual business need; long-term soundness at or above half the weight; preventing AI authoring errors; startup-stage scope):
  1. B over A: accepted. Two measured defects and only B closes the API/MCP one; B is the SKILL's own ruling principle ("a declaration not honoured is an implementation gap: implement or retire, never narrow at the consumer"); declared becomes enforced; no new key or code.
  2. Overwrite, not refuse: accepted on the first two axes (whole-record round-trips would 400). On the third axis it is weaker than the dev says: an agent that sends a wrong value learns nothing, because the overwrite reports through no channel (①). The remedy is a spec decision (a new DroppedFieldsEvent.reason), so the seat should carry it as a question to the spec lane or a finding, not as a rider here.
  3. Refuse a per-row-different predicate update: accepted; reachable in-repo through update_record with multi: true; existing codes; the remedy is in the message.
  4. No rounding: accepted. formulaRoundingScale honours a declared scale; currency refuses scale by describe, so a currency stored expression stores the evaluator's double unrounded, as a formula reads it; both examples' seeded products are exact. A minor-unit default is a spec lane card if anyone wants it.
  5. Fault wording: accepted as polish; the line says "reads null" about a column that now stores null; one sentence in reportFormulaFault or a stored-field variant, in the same round or a follow-up.
• Out-of-scope finding 1 (an INSERT of a new line on a paid invoice moves its total): meets filing gate ① — a product defect measured once on a public entry (POST /api/v1/data/showcase_invoice_line answered 200 and the paid total moved). The insert exemption of readonlyWhen is engine behaviour by design ("INSERT stays exempt", engine.ts, the predicate branch). By the app-platform question, "no line may be added to a paid invoice" is the company's judgement, so the landing is the showcase's metadata (an insert-time validation rule reading parent.status), and the platform half is whether such a rule can bind parent on insert: today insertParentForRow resolves the header only when hasParentScopedRequiredWhen holds, so the rule may fault without a parent-scoped requiredWhen beside it. The seat files it as a finding with the dev's reach: line, reader domain:engine (the binding) with the showcase as the landing, and the triage seat grades it. Not this PR's.
• Out-of-scope finding 2 (ObjectQL.validate() does not compute stored expressions): the preview reports the caller's amount, so an import dry run previews a value the write replaces. reach: was not measured on a public door, so under the filing gate it stays noted, as the dev did (PR Acceptance notes); the seat may measure it once on the import dry run and file, or carry it on the card's Release: line. Lane: domain:engine.
• Observation, not filed by the dev: the hand-written pages content/docs/data-modeling/validation-rules.mdx and field-types.mdx describe expression under formula only; no sentence is falsified, the stored-field meaning is simply absent. A domain:devx docs follow-up, carried in the devx declaration below.
• Cross-lane surface, what the seat declares before the queue:
  • packages/spec/src/data/field.zod.ts is domain:spec. The claim said "declared to that lane before the queue"; the dispatch-runbook rule is that the PM adds the cross-seat declaration. Owed: a comment on the spec lane's seat post naming PR fix(objectql)!: a stored field's declared expression is computed on every write, so a paid invoice's line amount and total stay frozen #24673, the file, the describe and TSDoc change (a "declared ≠ enforced" closure, no shape change), the minor grade and this record, before pr_ready.
  • content/docs/references/** is domain:devx (generated). Owed: a one-line notice on the devx seat post that three reference pages were regenerated by gen:docs for the describe (lanes/spec.md: the regenerated references belong to the source PR), plus the docs gap above.
  • examples/** belongs to the subsystem it exercises (SKILL.md's path table): both line objects exercise objectql's write path and its readonlyWhen strip, domain:engine, the card's own lane; comment-only changes; nothing owed to another lane.
• The card's release: the PR body's first line is Refs #24619 (item a); no closing keyword stands beside a card number anywhere in the body (the only "closes" is prose with no number); the "Part-of PR must not also close its card" check is green. Rows (b) and (c) were split out by the triage seat's routing 6278345889 to rest: a write refused by an unevaluable hook condition answers a generic 500 INTERNAL_ERROR instead of a coded refusal (#24619 row b) #24662 and service-datasource: remote-tables?schema= never narrows on the in-tree SQL drivers, so a named schema answers 200 with the wrong tables (#24619 row c) #24664, so at merge the seat's Release: line names them as routed and releases the card with pm:retriage, per the claim.
• Check-runs on c01e0622788ed39c9ac8a49096a75ceee102bc2e: at the first read (2026-10-19T23:01Z) 40 runs, Test Core (1/6) through (6/6) in progress, every other run completed with none failed; at the second read (2026-10-19T23:14Z) 41 runs, all completed, none failed — the six Test Core shards and the aggregate Test Core succeeded; Console Pin Gate, the Dogfood Regression Gate shards, Dogfood Verify CLI, Packed-tarball smoke (opt-in) and Temporal Conformance (live PG + MySQL) skipped by design. Check Changeset, the Governed Surface Queue Guard, both claim guards and every Lint and Type Check job succeeded. The size/l label and protocol:data label were applied by Auto Label.
• The dev's gate evidence (118 derived families, all exit 0 on this head; the objectql, spec, core, showcase and CRM suites; check:generated up to date) is read as claims; the head's CI covers the suites, and this record ran nothing.

Implemented-by: claude/issue-24619-derived-amount-lock
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: FAIL

FAIL on ① alone: the by-id pre-hook pass writes through the hook-write recording and ahead of the read-only strips, so a stored field declaring readonly: true together with expression loses its readonly drop report and its strictReadonlyWrites refusal on an update that moves an input — an accept-set move the changeset does not declare, on a shape the schema admits. Everything the card asked for is right at this head (both paid-line writes, the draft control, the seeds, the predicate refusal, no public surface), so the fix round is the one pass's placement plus the ② wording (the hooks sentence in the changeset and the describe's "every update"), and the record can be re-rendered as a delta on the next head.

Seat note · domain:engine seat 1 · 2026-10-19T23:23Z

The seat checked the FAIL ground on this head:

• In packages/objectql/src/engine.ts, the update path arms the hook-write recording at the [#14088] ARM block (recordHookPayloadWrites(opCtx.data), about :17227).
• The new [#24619] pass 1 (about :17444–:17449) then calls applyStoredExpressionsToPatch on hookContext.input.data, which is that recording's payload.
• The engine's own rule a screen above (about :17156) says a pass inside that window "is an ENGINE write recorded as a HOOK write". The insert path's pass 1 obeys it; the by-id path does not.

The ground holds.

Fix round 1 (sent to the dev):

• by-id pass 1 moved out of the recording window, or onto the hook view only, so the strips judge the caller's submission;
• a readonly: true + expression pin on update by id, with onFieldsDropped and with strictReadonlyWrites;
• the ② wording made true: the changeset's hooks sentence, the describe's "every update", the adr-0087 marker's stale-row sentence, and the #16344 citation in the code comment.

The two other items are not this PR's:

• Out-of-scope finding 1 (an insert of a line on a paid invoice moves its total) is filed by the seat.
• The silent overwrite is carried to the spec lane as a question: reporting it to onFieldsDropped consumers would need a new DroppedFieldsEvent.reason.

Rows (b) and (c) are already routed by triage (6278345889, to #24662 and #24664), so the release at merge names them as routed. A delta record follows the fix round.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c22a069d3dbc63130ecf78b590d5550ee2677d96
Local-runs: none
Scope: packages/spec/src/data/field.zod.ts, packages/objectql/src/engine.ts, packages/objectql/src/engine-stored-expression-write.test.ts, examples/app-showcase/src/data/objects/invoice.object.ts, examples/app-crm/src/objects/opportunity-line-item.object.ts (the two examples byte-identical to the baseline head) + .changeset/24619-stored-expression-computed-on-write.md and content/docs/references/data/field.mdx, content/docs/references/data/object.mdx, content/docs/references/system/migration.mdx (the prose faces, read sentence by sentence), packages/objectql/src/validation/rule-validator.ts (stripReadonlyFields, isCallerSuppliedValue), packages/objectql/src/hook-write-provenance.ts (recordHookPayloadWrites: the set, defineProperty and deleteProperty traps, seal), packages/objectql/src/readonly-strict-errors.ts (ReadonlyFieldRejectedError, its fields), packages/objectql/src/index.ts and packages/objectql/src/core.ts (not in this round's diff), scripts/pm/record-recognisers.mjs (this record's shape, --template --face narrowing). Delta review on the baseline record 6279561155 (head c01e0622788ed39c9ac8a49096a75ceee102bc2e, FAIL on ①). Inputs, these and nothing else: that record with its seat note; the fix-round os-dev-report 6280174895 on #24619, read as claims; the two commits above c01e062278 (84b68deafe, c22a069d3d), read as git diff c01e062278 pr/24673d (7 files, +75/−22; the PR against its merge base cc95f5e63e is now 9 files, +551/−38, matching the API's file list); the PR body; the head's check-runs, read twice. No build, test or gate was run; the record shape was printed with record-recognisers.mjs --template --face narrowing (no network) and the merge state read with git merge-tree --write-tree on fetched refs.

① Derived judgments

The fix: by-id pass 1 now writes onto the recording's target and skips every withheld key — RIGHT.

• The one engine.ts hunk (head about :17436–:17455, replacing the baseline's :17441–:17449) binds raw = opCtx.data, computes over { ...priorRecord, ...raw }, deletes from computed every key of readonlyHiddenFromHooks, and calls applyStoredExpressionsToPatch(raw, computed, priorRecord). opCtx.data is the object the [#14088] ARM block wrapped (recordHookPayloadWrites(opCtx.data), about :17227); the hide pass set opCtx.data = hidden BEFORE that arm (about :17190), and between the arm and the pass nothing assigns opCtx.data or hookContext.input.data (checked over :17227–:17446). So the pass writes on the Proxy's target, not through its set trap: nothing it sets enters hookWrittenKeys.
• The skip is complete by construction: readonlyHiddenFromHooks holds exactly the keys the hide pass removed from preHookPayload (!(k in hidden)), and applyStoredExpressionsToPatch iterates only the keys left in computed. A hidden key is therefore neither written by the engine nor present on the raw payload when the hand-back (about :17606) asks k in target, so the hand-back restores the caller's value, and stripReadonlyFields (rule-validator.ts about :2094) judges it as before: own-property of supplied (the entry snapshot suppliedValues, untouched by the pass), not in hookWrittenKeys, Object.is holds ⇒ dropped, reported through reportDroppedFields(..., 'readonly'), and under strictReadonlyWrites refused by assertNoStrictDrops() (about :17045, ReadonlyFieldRejectedError(object, fields, strictDrops)) BEFORE pass 2 and before driver.update, so nothing is written.
• The other direction holds too: a readonly + expression key the caller did NOT send is not hidden, so pass 1 writes its computed value onto the raw payload; the strip's first test is hasOwnProperty(supplied, name), which is false, so the key is kept as server-stamped — no spurious readonly report and no spurious strict refusal of a patch that moved only an input. Pass 2 then writes the same computed value. Right.
• Hooks still see the computed value: hookContext.input.data is the Proxy over the same target with no get trap, so a write to the target reads through. On the card's shape (amount not readonly) the hooks are handed the expression over the pre-strip row, as the baseline pinned; when the caller sends a readonly + expression value, the hooks are handed NO value for that key (the caller's is withheld and the computed one is skipped) — one asymmetry the ② wording leaves implicit, noted there.
• Hook interactions, each path read: a hook that OVERWRITES a key pass 1 set goes through set, is recorded, and is overwritten again by pass 2 (the baseline's pinned case); a hook that DELETES it goes through deleteProperty, which Reflect.deletePropertys the target and only removes the key from the record (a no-op here), after which pass 2's applyStoredExpressionsToPatch re-adds it when the computed value differs from the stored one and leaves the column (already equal) alone otherwise; a hook that REPLACES the payload object carries pass 1's value across in its spread, seal returns no record, and the strips fall back to the value test, which for a key not in supplied keeps it and for a hidden key (absent from the replacement) hands the caller's value back to be judged — the pre-stripReadonlyFields uses Object.is to tell a hook write from a caller write, so a hook cannot clear a readonly field the caller also sent as null #14088 fallback, unchanged by this round. No path interacts wrongly.
• The hand-back is unaffected: it reads only the hidden keys, which pass 1 never touches, and its set-to-undefined undo concerns the same keys.
• Pass 2 (about :18014–:18019), the predicate settle (about :18293–:18300) and the insert path's two passes (about :15793–:15810, :16405–:16410) are outside the hunk and byte-identical to the baseline; so are the four #24619 helpers (:2908–:3023), both example objects, index.ts, core.ts and package.json (none in the diff).

The new pins have teeth against the baseline's defect — RIGHT. The test file gains exactly two it( cases (12 → 14, +39/−0, no existing case moved), on qa_locked_line (amount: { type: 'currency', readonly: true, expression: record.quantity * record.unit_price }, stored {quantity 3, unit_price 10, amount 30}), update by id { id, quantity: 4, amount: 5 }: (1) onFieldsDropped receives exactly { object: 'qa_locked_line', fields: ['amount'], reason: 'readonly' } and the row stores {quantity 4, amount 40}; (2) under strictReadonlyWrites: true the call rejects with ReadonlyFieldRejectedError whose fields contain amount, and the row still reads {quantity 3, amount 30}. On the baseline's code (pass 1 on hookContext.input.data, no skip) my reading is: amount: 40 enters hookWrittenKeys, the hand-back skips it (k in target), the strip keeps it on the record — so (1) sees no readonly event and (2) sees no throw and a written row: both red, which is what the dev's ablation reports (2 failed | 12 passed). The skip alone, removed, is also red (the raw write lands 40, Object.is(40, 5) fails, the strip keeps it). One limit, not a defect: with the skip in place the raw-target half is unobservable on this shape (the only stored field is hidden, so pass 1 writes nothing), so a regression that put the write back on the Proxy while keeping the skip would stay green; by my reading it would also change no verdict, because the strip asks supplied before it asks hookWrittenKeys, so that half stands on the engine's own rule rather than on a pin.

Carried over unchanged from the baseline record, since the code they rest on is byte-identical at this head: the paid-line pins (the /batch-shaped update and the amount-only PATCH, 10/2 under the planner ablation); the draft control; the seeds (five showcase_invoice_line rows exact in doubles, the CRM seeds none); the predicate refusal (settleBulkStoredExpressions, VALIDATION_FAILED / invalid_value, reachable in-repo through update_record with multi: true); no public surface (module-level functions, no new export or ObjectQL member); the cost note (a first whole-set read on a bare core embedder with a stored expression and no hooks, no D6 ceiling); the null-on-fault reading; the FLS and post-image seam readings.

② Semver level

• Levels unchanged and still right: @objectstack/objectql: minor, @objectstack/spec: minor, the BREAKING banner, Clause-②: no (narrowing) at a line start in the changeset (line 8) and on line 3 of the PR body. The spec package's diff is again describe and TSDoc only (field.zod.ts +7/−5 this round); the schema's accept set is byte-identical. Check Changeset is green on this head.
• The TO bullet: the false "The before* hooks are handed the computed value" is gone; "The stored value is computed after the before* hooks and both read-only strips" is true on all three paths; "A caller's value is overwritten, in every context" true (on the predicate path it is deleted or refused, and "never stands" either way); "An update by id that moves none of the expression's inputs stores the value the row already computes to" true (applyStoredExpressionsToPatch adds the key when the stored value differs). True.
• The new bullet, "What the before* hooks are handed": insert — "the expression over the defaulted row", true (pass 1 over defaultedData, after the insert withhold, before the arm); update by id — "the expression over the stored row merged with the caller's patch before the strips run, so it is not the stored value when the patch carries a locked input", true; "a caller's value for a field that is also readonly stays withheld from the hooks and is judged by the read-only strip as before (reported as a readonly drop, and refused under strictReadonlyWrites)", true on both paths (on insert the hooks see the computed value for that key, on by-id no value at all — the sentence says only that the caller's value is withheld, which is true on both; a reader who takes the bullet's first by-id sentence as covering that key too would be wrong on by-id); predicate — "the per-row hooks are handed the caller's patch; the value is settled after them", true. True as written.
• Unchanged now ends "the readonly drop report and the strictReadonlyWrites refusal of a caller's value for a stored expression field that is also readonly": true by id (pinned) and on insert, where the withhold runs before the pass, the hand-back's rule for a present key with a record is "not hook-written ⇒ hand back", and the create strip then drops and reports the caller's value (read, not pinned); on the predicate path there is no pass 1. The shape the baseline's ① found moved is now named and unmoved. True.
• The adr-0087 marker's stale-row sentence now reads "keeps it until an insert or an update by id writes that row, or a predicate update moves one of its expression's inputs; a predicate update that moves no input leaves it as it is": true against settleBulkStoredExpressions, which judges moved on the COMPUTED value before and after per row. Hair-split, not a falsity: an input that moves without moving the value (a zero factor) is left alone too, and "an insert writes that row" cannot apply to a row that already exists. Category not-required (no-migration-prescription) unchanged and still right; its check is green.
• The spec describe and TSDoc: "on every insert and every update by id (the stored row merged with the patch), and on a predicate update only when the patch moves an input (one value for every matched row, else the update is refused)" — true, with the same hair-split; the "every update" overstatement is gone. The five expression rows across the three regenerated content/docs/references/** files are byte-equal to the describe (checked programmatically: one row in field.mdx, two each in object.mdx and migration.mdx), and no "Formula expression (CEL)" remains.
• The pass-1 code comment no longer cites Update-side: a readonly field is stripped from persistence but still reaches beforeUpdate, so hook-derived columns persist values computed from data the row never contains #16344 for "the value the write stores"; it states the pre-strip reading, the readonlyWhen limit, the raw-payload rule and the withheld-key skip, each of which the code does. True.

③ Boundary flags

• Deviation 1 (fault wording not changed): accepted. The sentence is reportFormulaFault's one line (engine.ts about :6586, "formula field '…' could not be evaluated, so it reads null wherever this fault holds"), reached through formulaFaultSink, which the read path, the write-response hydration and the stored write's onFault all share, so a stored-only wording is a second sink or a parameter, not a one-sentence edit. Carried as the baseline's open question 5, a follow-up.
• Deviation 2 (the insert path's #16344 comment kept): accepted, as asked (the insert code was to stay untouched) and accurate for insert: withholdInsertReadonlyFromHooks runs BEFORE the defaults and before the pass (about :15737–:15750), so a static-readonly input the caller sent is already defaulted when the pass reads it and the create strip takes nothing the pass read; a readonlyWhen lock is insert-exempt. The one exception the dev's "no strip there removes an input the expression reads" does not cover is a runtime-owned (autonumber) input, deliberately not withheld and stripped after the hooks — an expression over a record number, exotic and not in the tree. The comment's own second sentence already names the hook-moves-an-input case.
• Merge state against today's origin/main (d1173825b7, fetched into a private ref): git merge-tree --write-tree answers a tree (5548b0e6f0) with no conflict; the branch is 21 commits behind and touches no file main changed since the merge base cc95f5e63e; the API reads mergeable_state: clean. The dev's "10+ commits behind, 7 gate-input files changed there" is now 21 behind; main's newest commit (2026-10-20T00:07Z) predates the head's first check-run start (2026-10-20T00:09Z), so the merge-ref CI on this head already read those baselines, and every Lint and gate job is green. Nothing to merge forward before the queue.
• PR-body lines the seat patches (the dev's suggested_pr_body_lines, weighed): (1) the replacement "Update by id" bullet is true line by line against the code; the seat may append one clause, "a readonly key the caller sent stays withheld from the hooks", which closes the asymmetry noted in ②; (2) the "Predicate update" append ("Its per-row beforeUpdate hooks run before the settle and are handed the caller's patch") is true (the baseline's ① reading); (3) "12 cases" → "14 cases" is true (counted), and the new bullet's description of the pin matches the test; its ablation figures are the dev's claims, consistent with my reading; (4) the Verification-record lines (head of record c22a069d3, 449 files / 8461 passed, 116 families re-run, all exit 0) are the dev's claims, read as such — the head's CI is the evidence this record reads. Also still true and untouched: Refs #24619 (item a) on line 1, no closing keyword beside a card number, the "Part-of PR must not also close its card" check green.
• Cross-lane surface, still owed before pr_ready: packages/spec/src/data/field.zod.ts moved again this round (describe and TSDoc), so the spec-lane declaration the baseline named is owed naming THIS head; content/docs/references/** was regenerated again, so the devx one-line notice names this head too; the hand-written validation-rules.mdx / field-types.mdx gap stands as the devx follow-up. The examples are comment-only and unchanged this round; nothing owed to another lane.
• Open questions: 1–4 carry over as accepted; 5 is deviation 1 above. The silent overwrite (no onFieldsDropped channel for an overwritten stored value) stays the seat's question to the spec lane, as the seat note routed it. Out-of-scope findings: finding 1 (an insert of a line on a paid invoice moves its total) was filed by the seat per its note; finding 2 (validate() does not compute stored expressions) stays noted, unmeasured on a public door. Nothing this round moves either.
• The card's release: unchanged — rows (b) and (c) are routed by triage 6278345889 to rest: a write refused by an unevaluable hook condition answers a generic 500 INTERNAL_ERROR instead of a coded refusal (#24619 row b) #24662 and service-datasource: remote-tables?schema= never narrows on the in-tree SQL drivers, so a named schema answers 200 with the wrong tables (#24619 row c) #24664; at merge the seat's Release: line names them as routed and releases the card with pm:retriage.
• Commit trailers: both new commits end with the model-free two-line trailer pair AGENTS.md requires and carry no model identifier; the dev's session is the first round's.
• Check-runs on c22a069d3dbc63130ecf78b590d5550ee2677d96: 41 runs at both reads (2026-10-20T00:48Z and 2026-10-20T00:58Z), every one completed, none failed: 36 succeeded — the six Test Core shards and the aggregate, Check Changeset, Governed Surface Queue Guard, both claim guards, "Part-of PR must not also close its card", "Spec property liveness", every Lint and Type Check job, Build Core, Build Docs — and 5 skipped by design (Console Pin Gate, the Dogfood Regression Gate shard matrix, Dogfood Verify CLI, Packed-tarball smoke (opt-in), Temporal Conformance (live PG + MySQL)). First start 2026-10-20T00:09Z, last completion 2026-10-20T00:44Z.
• The dev's gate evidence (the suite at 14 passed, 8461 objectql tests, 116 families, check:generated up to date) is read as claims; this record ran nothing.

Implemented-by: claude/issue-24619-derived-amount-lock
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

PASS on the delta: the baseline's one FAIL ground is closed at this head — by-id pass 1 writes onto the recording's target and skips every withheld key, so a readonly: true + expression field keeps its readonly drop report and its strictReadonlyWrites refusal (pinned twice, red on the baseline's code by my reading); pass 2, the predicate path and the insert path are byte-identical; every ② sentence the baseline asked to be made true is true against the code, with the regenerated references byte-equal to the describe; the two deviations are accepted; the merge is clean and the head's CI is green. The seat patches the PR body as weighed above and posts the two cross-lane declarations on this head before pr_ready.

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-20T01:10Z · ACCEPT

Head: c22a069d3d. The commits, in order:

1. the engine computes a stored field's declared expression on every write;
2. the pins;
3. the spec describe and both examples' comments, and the regenerated field reference;
4. the changeset;
5. the suite's find double made limit-aware;
6. a merge of main (cc95f5e63e);
7. fix round 1: the by-id pre-hook pass writes outside the hook-write recording, and the describe says what each write path does.

Card #24619 (p2, family card), row (a) only: claim 6277262398, dispatch 6277306080. Dev reports: 6278955805, and fix round 1 6280174895.

Item	Reading
Shape	Draft PR → main. The body opens Refs #24619 (item a), with no closing keyword. 9 files, +551/−38. Not governed: check-governed-merges matched 0 of 9 paths.
Scope	Shape B, by the four axes in the dev's report. A stored, non-formula field's declared expression is computed by objectql on insert, on update by id (the stored row merged with the patch, after the before* hooks and both read-only strips), and on a predicate update (one value for every matched row, else refused VALIDATION_FAILED / invalid_value). A caller's value is overwritten, never stored. Measured on a booted showcase: before, the card's /batch update moved the paid INV-1003's total from 299.94 to 2999.4, and an amount-only PATCH set it to 1; after, neither moves it. Draft lines save with amount = quantity * unit_price. The CRM's line_total follows its lines. Every seed is unchanged. The census found two such fields, showcase_invoice_line.amount and crm_opportunity_line_item.amount, and both are accounted for.
Seat's own read	The record's FAIL ground was checked on the base head (seat note on 6279561155). On this head, the by-id pass 1 binds opCtx.data, the recording's target, and skips every key the hide pass withheld. git merge-tree --write-tree against today's origin/main (1c1144fcd8) is clean, and the PR reads mergeable: clean. The PR body was patched to this head with the dev's suggested lines, as the delta weighed them, plus the delta's one added clause.
Review	CONTRACT_REVIEW_TIER, narrowing face. Record 6279561155 was FAIL on c01e062278: by-id pass 1 wrote through the hook-write recording, so a readonly: true + expression field lost its readonly drop report and its strictReadonlyWrites refusal. The delta 6280886549 is PASS on this head.
Declaration	One changeset, @objectstack/objectql minor and @objectstack/spec minor, BREAKING (FROM / TO / Fix), Clause-②: no (narrowing) at a line start, with adr-0087: not-required (no-migration-prescription). The spec diff is the expression describe and its TSDoc only, so its accept set is byte-identical. No new export, no new ObjectQL member and no new error code.
Cross-lane	domain:spec, for packages/spec/src/data/field.zod.ts: 6279243125 and 6279251400, with the addenda naming this head 6280905054 and 6280912886. domain:devx, for the regenerated content/docs/references/**: 6279260461 and 6279265790, with the addenda 6280920064 and 6280927836. The hand-written validation-rules.mdx / field-types.mdx gap is noted there as devx's follow-up. No objection on the card or the seat posts.
Gates	Dev at c01e062278: 118 derived, 118 run, all exit 0. Fix round at c22a069d3: the 116 families derived for its 7 paths, all exit 0; check:generated 14 of 14 up to date. Full suites: objectql 449 files / 8461 passed, spec 702 files / 21349 passed, showcase 431 passed, CRM 46 passed, core test:repo 82 passed.
CI	At this read on c22a069d3d: ci-failure GREEN, all 41 check-runs completed, none failed.

Disposition:

• open_questions: 1–4 taken as the dev settled them, per record 6279561155 ③ and the delta: shape B; overwrite rather than refuse; the predicate update refused when the value differs per row; no rounding. Open question 5 (the fault sentence reads formula field) is the dev's deviation 1, a follow-up for the next touch of reportFormulaFault.
• deviations: both accepted (delta 6280886549 ③): the shared fault wording kept, and the insert path's #16344 comment kept.
• out_of_scope_findings:
  • finding 1, an insert of a line under a paid invoice moving its total, was filed by the seat as showcase: a new line can be inserted on a paid invoice, so its total moves — readonlyWhen is insert-exempt by design, and nothing else locks a paid header against new lines #24684 (p2, this lane, dispatched);
  • finding 2, validate() not computing stored expressions, stays noted; it is unmeasured on a public door.
• The silent overwrite has no onFieldsDropped channel. It is the seat's question to the spec lane (6279594471, 6279599508); reporting it would need a new DroppedFieldsEvent.reason.

At landing: a Release: line on the card. Row (a) is landed. Rows (b) and (c) were routed by triage 6278345889 to #24662 (domain:cli) and #24664 (domain:services). The card is released with pm:retriage, and the seat clears its pm:dispatched and assignee.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). Refs closes nothing.

---

Generated by Claude Code