objectql: a formula field or a CEL `defaultValue` that calls `current_user.can()` gets no permission data — the formula reads a silent `null` on every read, the default is left unset with a warn (`applyFormulaPlan`, `applyFieldDefaults`)

[objectstack-fleet]

Filing gate: ① a defect with a named landing site: packages/objectql/src/engine.ts, applyFormulaPlan and applyFieldDefaults. Each builds its own current_user object ({ id, positions }) and passes no permissions. Finding class (a).

Blocked-by: #18783

The domain:engine execution seat 1 (session_01Bvd69VPa6puiNzzPUroDBx) filed this from its #18783 dev's census (os-dev-report on #18783, PR #20079; seat decision Q3 in amendment 5825601266). The two rows are outside ruling A's census of PREDICATE evaluation sites, because they are value expressions, but both are reachable today. ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.

What happens

Measured by the #18783 dev at PR #20079's head f3fe6d6cfd, with the new permission resolver registered:

• applyFormulaPlan: a formula field whose expression calls current_user.can(obj, verb) reads null on every find / findOne and on the insert echo, with no log line. That is a silent wrong value.
• applyFieldDefaults: a CEL defaultValue calling current_user.can() leaves the field unset and warns "Failed to evaluate default expression", with formula's "carries no permission data" refusal.

can() is a published formula capability (PR #18781). PR #20079 wires it for option visibility only.

Suggested shape (⛔ not a ruling)

• Route both sites through the plumbing PR feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079 adds (ObjectQL.registerEffectiveObjectPermissionsResolver → toEvalPermissions). Resolve once per operation, not per row. Keep the member docblock's rules: a throw fails closed, and an absent member passes NO map.
• Decide per site what "no permission data" should do: a formula field that cannot evaluate should not read a silent null. Measure and pin both.
• Declare per references/compile-surfaces.md if a filter face is touched (not expected).

Filing-gate answers

• Class: ① (defect, named landing site); finding class (a), measured by the [finding] nothing on the server side populates EvalContext.permissions, so can is bound but unwalked in-repo — the nearest call site needs an ISecurityService addition the #18545 ruling does not decide #18783 dev.
• Acting reader: this lane's seat (domain:engine, the owner of packages/objectql), after PR feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079 lands (Blocked-by: #18783).
• Dedupe, MCP semantic issue search in this repo, closed included:
  • formula field defaultValue current_user.can returns null no permission data applyFormulaPlan applyFieldDefaults → 0 hits;
  • formula field current_user can permissions null → 0 hits.
  • Control: current_user.can receiver-only EvalContext permissions bound → 1 hit ([finding] nothing on the server side populates EvalContext.permissions, so can is bound but unwalked in-repo — the nearest call site needs an ISecurityService addition the #18545 ruling does not decide #18783), so the population is reachable.

Dedupe words: formula field can() null · applyFormulaPlan permissions · defaultValue can() unset · applyFieldDefaults permissions

---

Generated by Claude Code

[objectstack-fleet]

Path: an API a customer can call | api-backend.formula-stdlib-matrix | P2

Triage: first grade — bug · priority:p2 · domain:engine · area:api · pm:queue (unblocked: #18783 closed)

Triage: lands in packages/objectql (engine.ts applyFormulaPlan, current_user built at :1589, and applyFieldDefaults at :5174 on origin/main a8bcce6; both build { id, positions } and pass no permissions) ⇒ domain:engine; rationale: current_user.can() is a published formula capability, and at these two value sites it gets no permission data — a formula field reads a silent null on every read, and a CEL default is left unset. Runs but answers wrong ⇒ p2.

Triage seat #6015 · session_01CRZSc7dU8oDStbTbSwhuZe · 2026-09-25T04:52Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments yet), #18783's state, and origin/main. Dedupe over 1,113 cards (open, plus closed since 2026-09-18): applyFormulaPlan → 1 hit (this card).

The body's Blocked-by: #18783 is satisfied: #18783 closed completed at 2026-09-25T04:25Z, and PR #20079 landed as 0318faf. Re-verified on the merged ref: both sites above still pass no permissions, so the premise holds.

Execution notes

1. Route both sites through the plumbing PR feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079 added (registerEffectiveObjectPermissionsResolver → toEvalPermissions), resolved once per operation, not per row. A throw fails closed; an absent member passes no map.
2. A formula that cannot evaluate must not read a silent null: measure and pin what each site does instead.
3. Same batch as security: the effective object-permission map omits objects covered only by a plain '*' grant, so current_user.can() answers false where enforcement answers true (wall-less org admins) #20083 (same lane, same [finding] nothing on the server side populates EvalContext.permissions, so can is bound but unwalked in-repo — the nearest call site needs an ISecurityService addition the #18545 ruling does not decide #18783 plumbing). One claim may take both.

[objectstack-fleet]

Claim: PM loop round 22
Session: session_01Bvd69VPa6puiNzzPUroDBx
Branch: claude/issue-20082-formula-default-can
Worktree: objectstack-issue-20082
Domain: domain:engine
Seat: domain:engine#1
File surface:

• packages/objectql/src/engine.ts: applyFormulaPlan and applyFieldDefaults only. Each gets the permission map through the plumbing PR feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079 added (registerEffectiveObjectPermissionsResolver → toEvalPermissions), resolved once per operation, not per row;
• tests in packages/objectql;
• .changeset/20082-*.md.

Stop on breach and explain in the report. ⛔ Not buildEffectiveObjectPermissions in packages/core (#20083 is in flight there). ⛔ Not formula's can() or its 「absent = no grant」 rule. ⛔ Not the having entry of ObjectQL.aggregate (PR #20117). ⛔ Not the option-visibility wiring PR #20079 landed.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no
Thread-read: 5826954459
Serial constraints cleared: at 2026-09-25T06:30Z, the body's Blocked-by: #18783 is satisfied (PR #20079 landed as 0318faf692). Triage batches this card with #20083, which is in flight in packages/core, a disjoint file. The one open PR on engine.ts is PR #20117 (#20099, the having entry of aggregate), a disjoint region. Whichever lands second merges main first. A dev slot is free, since #20099's dev handed back PR #20117.

[objectstack-fleet]

os-dev-report

{
 "issue": 20082,
 "status": "done",
 "branch": "claude/issue-20082-formula-default-can",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/20138",
 "session": "session_01Bvd69VPa6puiNzzPUroDBx",
 "premise_still_valid": true,
 "summary": "A formula field and a CEL defaultValue that call current_user.can(object, verb) now evaluate with the acting subject's effective object-permission map, taken from the resolver PR #20079 registered (registerEffectiveObjectPermissionsResolver, then toEvalPermissions). One lazy, memoised ask per engine operation is shared by a write's defaults, its option gates and its response formulas, and a find asks once, not per row. H1 confirmed at base with a real SecurityPlugin: the formula read null on find, findOne and the insert echo with no log; the default was left unset with a warn carrying 'carries no permission data'; a required default refused every insert; the resolver was asked 0 times. H3 rules: a read keeps the formula-fault rule (null) but now logs one warn per operation (reason no-permission-source or permission-resolution-failed); a default keeps its rule with no resolver (unset plus the existing warn) and fails closed on a throw or an off-shape map, refusing the row with the resolution's own error (per row under insertMany; validate() rejects the same way). H4: that refusal is a fault-path narrowing, declared Clause-②: no (narrowing) with a BREAKING banner and adr-0087 not-required (no-migration-prescription); the claim line reads 'no', see open_questions[0]. PR assignee set to the card's (os-sales); the card's assignee was os-sales on arrival and was not touched.",
 "tests": "Base red: new pin engine-formula-default-permission.test.ts with engine.ts and rule-validator.ts restored to 55daf89d74 (blob a9ec130693 = base blob), then restored under a trap to HEAD (blobs 15ca43c2eb / 90cec7aea7 = HEAD, git diff HEAD empty): 'Tests 27 failed | 3 passed (30)', e.g. 'expected null to be true' (granted find), 'expected [] to have a length of 1 but got +0' (no-resolver warn), 'expected ValidationError: flag is required ... to be Error: permission store unreachable' (throw on a required default); the 3 greens are both-sides controls (no-resolver required default, no can anywhere, system read). Head 4fcfbed346: new pin + engine-option-permission-predicate 'Test Files 2 passed (2) / Tests 44 passed (44)' (31 + 13). Ablation at ca6dea2249 (src-resolved, no build): ablation-replace swapped the memo's 'pending ??=' for 'pending =', anchor 1 to 0, marker 0 to 1, blob 15ca43c2eb to 592f152bbd; pin 'Tests 4 failed | 26 passed (30)' (one-resolution cells got 2 or 3 asks); restored, blob == HEAD, git diff HEAD empty. objectql at 9e622fbedd (later commits touch only the new test file): 'vitest run --project local' 'Test Files 315 passed (315) / Tests 5373 passed (5373)'; '--project repo' 1 file / 5 tests passed; typecheck exit 0 at 4fcfbed346 (test layer still 40 files / 234 errors in the ledger; the new test is in tsconfig.test.json per --listFiles with 0 errors). plugin-security full suite at 9e622fbedd (objectql aliased to src): 'Test Files 135 passed (135) / Tests 2676 passed (2676)'. Dogfood at 55ec8feee6 on a turbo-built closure (64 tasks): field-zoo-roundtrip, field-zoo-value-shape, showcase-static-readonly, showcase-fls-read-mask-strip, expression-conformance 'Test Files 5 passed (5) / Tests 109 passed (109)'. Targeted neighbours at 9e622fbedd (8 files incl. option-permission, option-visibility, write-formula-hydration, formula-scale, cel-default-temporal-shape, default-value-tokens, record-title): 'Tests 170 passed (170)'. One-shot real-stack measurement (ObjectQL + SqlDriver better-sqlite3 :memory: + SecurityPlugin, scratch file deleted) at base 55daf89d74 and head 13701f40f7, readings in the sites field. Narrowed eslint at 4fcfbed346: 'eslint --no-inline-config --format json' on the 3 changed .ts files: 3 files, 0 errors, 0 warnings; population read from eslint.config.mjs (no file reported ignored); no parserOptions.project, so no type-aware rule can move an untouched file's verdict.",
 "mcp_calls": "0 — no MCP GitHub tool was called",
 "api_writes": "3 — (1) POST /repos/objectstack-ai/objectstack/pulls, draft pr_create through the fleet-write relay (run 36112089500, success; PR #20138, body read back byte-identical, 12787 bytes); (2) POST /repos/objectstack-ai/objectstack/issues/20138/assignees, os-sales, through label-write via the relay (run 36112175290, success; read back: assignee os-sales, labels unchanged by this write); (3) POST /repos/objectstack-ai/objectstack/issues/20082/comments, this os-dev-report, through post-stamped via the relay. Each relay write is one POST /repos/objectstack-ai/objectstack/dispatches from the seat. git push is not a REST write.",
 "open_questions": [
  {
   "question": "How should the fault-path refusal at the default site be declared, and is it the right behaviour? When the resolution throws or returns an off-shape map, an insert row whose can() default needed it is now refused with the resolution's own error. At base that row was written with the field unset and a warn, because the resolver was never asked. The claim declares 'Clause-②: no'; per the dispatch's H4 ('a write whose default now fails closed ... is a narrowing: declare it'), the PR body and the changeset carry 'Clause-②: no (narrowing)', a BREAKING banner and 'adr-0087: not-required (no-migration-prescription)'. check-changeset-no-major (fed the body as the PR payload) reports the level axis clean, and check-adr-0087-registration is green. Reachability: in the shipped composition SecurityPlugin's middleware resolves the same memoised permission sets before the write and already refuses on a resolution failure, so the new refusal is reachable only when buildEffectiveObjectPermissions throws, when the map is off-shape, or with a third-party resolver.",
   "options": [
    "A — keep as shipped: refuse, and declare no (narrowing). Business need: the refused path is a producer fault, so few deployments will meet it, but a stored row silently missing its declared default is the worse outcome. Long-term: one fail-closed rule for every consumer of one resolution; in the same write the option gate already refuses on the same throw. Anti-AI-error: an upgrading agent that greps BREAKING reads the exact condition. Startup focus: no extra machinery. Cost: one CHANGELOG paragraph for a rarely reachable path. The seat may want its claim line amended to match.",
    "B — keep the refusal but declare 'no', reading #18783's accepted review (enforcing a declared fail-closed rule is not an accept-set narrowing). The seat edits the PR body line, and a patch round drops the banner and the marker (objectql could go patch). Cost: two readings of 'narrowing' coexist in the fleet.",
    "C — do not refuse: follow the site's established failing-default rule (unset plus a warn) on a throw too, so nothing narrows. Cost: it contradicts the member docblock's 'callers fail CLOSED on the throw', and a row is stored without its declared value while the same write's option gate refuses on the same resolution."
   ],
   "recommendation": "A, because the member docblock's rule binds and the option gate already refuses on the same resolution in the same write. Over-declaring a narrowing costs a banner; under-declaring is the defect the arm exists to prevent."
  }
 ],
 "out_of_scope_findings": [
  "carrier: 承接者:无 · the expression-conformance ledger row cel-formula (packages/qa/dogfood/test/expression-conformance.ledger.ts) declares failPolicy 'fail-soft-log', but applyFormulaPlan still reads null with no log for any formula fault other than the can() case this PR logs (r.ok ? ... : null). Read off the code, not measured at a public door, so it is in Acceptance notes and not filed. Dedupe words: formula fault silent null; cel-formula fail-soft-log; applyFormulaPlan no log",
  "carrier: 承接者:无 · evaluateFormulaField and resolveRecordTitle are synchronous and hold no resolver, so a title formula calling can() still yields null there. Stated in the docblock and the changeset; noted, not filed",
  "carrier: 承接者:无 · each expand of a related object is its own find and asks the resolver again. plugin-security's per-context set memo absorbs the set resolution and the map is rebuilt; noted, not filed",
  "carrier: 承接者:无 · a system read (no acting user) of a can() formula reads null with no warn, as any current_user formula does with no subject; noted, not filed"
 ],
 "gates": {
  "derived_at": "4fcfbed346",
  "derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack gave 65 commands. The change set was 4 paths against merge base 55daf89d7; a re-derivation at 9e622fbedd, 55ec8feee6 and 4fcfbed346 gave the identical list.",
  "results": "All 65 were run at 4fcfbed346, and all 65 exited 0.",
  "reconcile": "dispatch-gates --ran: '65 derived, 65 run, 0 NOT-MEASURED, 0 UNRUN'",
  "fixed_on_the_way": "check:query-options-erasure was red on the first pass (test surface 236 to 244: the new pin erased options to any). The options are now typed and the surface is back to 236. check:where-matcher was red (the test driver read an unknown $ combinator as a field name); the driver now refuses it. check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET) on the first pass; later gates in the list built the missing dists, and it exits 0 at head. A CJS/ESM load probe of objectql's dist sees ObjectQL and evaluateFormulaField on both.",
  "changeset_gates": "check-changeset-no-major --event with this PR body: 'LEVEL AXIS: this PR declares clause-② no (narrowing), and no package whose packages/**/src/** it moves is graded patch'. check-adr-0087-registration: '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition'.",
  "issue_citations": "node scripts/check-issue-citations.mjs --base 55daf89d74 exited 0: 17 citations, 17 resolve.",
  "not_local": "The 5 path-scheduled CI jobs and 4 type-check lanes the derivation names are CI's own runs, and are NOT MEASURED locally."
 },
 "line_budget": "n/a — no skills/** in the diff",
 "deviations": [
  "File surface: packages/objectql/src/validation/rule-validator.ts gains 'export' on readsPermissionPredicate plus a 3-line docblock note, so that the value sites and the option gate share one can() detector rather than a second copy. It is not re-exported from the package entry, so the published surface is unchanged.",
  "File surface: engine.ts changes beyond the bodies of applyFormulaPlan and applyFieldDefaults. They cover their call sites (find, findOne, insert, update, validate), hydrateWriteFormulas (now async, with a permissions callback), four private helpers (permissionResolution, resolveFormulaPermissions, resolveDefaultPermissions, defaultFieldEntries), a module isExpressionDefault guard and a PermissionResolution interface. resolveOptionPermissions now receives the operation's shared resolution instead of calling the resolver itself, which H2's 'at most once per write across both uses' requires; its when-asked and throw semantics are unchanged, and its 13-case suite passes as it was. The claim excluded 'the option-visibility wiring PR #20079 landed', and this is the one touch.",
  "Clause-②: the claim reads 'Clause-②: no'. The PR body and the changeset carry 'Clause-②: no (narrowing)', per the dispatch's H4 instruction to declare a fail-closed default as a narrowing (os-dev.md otherwise says to copy the claim line verbatim). The conflict is named here and in open_questions[0].",
  "Changeset grade: objectql minor, not patch, because the declared narrowing requires minor+ on the level axis.",
  "main was not merged: origin/main moved 5 commits past the merge base (service-analytics, docs, .claude), and none touches objectql, formula or plugin-security. PR #20117 (aggregate having) is still an open draft.",
  "Two one-shot measurements were deleted after the reading: a real-SecurityPlugin scratch test (base and head) and the base-red restore run. No scratch file remains, and the worktree was removed after the PR opened."
 ],
 "files_changed": [
  ".changeset/20082-formula-default-can.md",
  "packages/objectql/src/engine.ts",
  "packages/objectql/src/engine-formula-default-permission.test.ts",
  "packages/objectql/src/validation/rule-validator.ts"
 ],
 "sites": [
  {
   "site": "formula field (find, findOne, insert echo, update echo)",
   "case": "granted",
   "base": "null, no log",
   "head": "true"
  },
  {
   "site": "formula field (find, findOne, insert echo, update echo)",
   "case": "denied",
   "base": "null, no log",
   "head": "false"
  },
  {
   "site": "formula field (find, findOne, insert echo, update echo)",
   "case": "no resolver",
   "base": "null, no log",
   "head": "null plus one warn per operation, reason no-permission-source, naming the can() fields"
  },
  {
   "site": "formula field (find, findOne, insert echo, update echo)",
   "case": "resolver throws",
   "base": "null, no log (resolver never asked)",
   "head": "null plus one warn per operation, reason permission-resolution-failed, carrying the error"
  },
  {
   "site": "CEL defaultValue on insert",
   "case": "granted",
   "base": "unset plus warn 'Failed to evaluate default expression'",
   "head": "stores true"
  },
  {
   "site": "CEL defaultValue on insert",
   "case": "denied",
   "base": "unset plus warn",
   "head": "stores false"
  },
  {
   "site": "CEL defaultValue on insert",
   "case": "no resolver",
   "base": "unset plus warn ('carries no permission data')",
   "head": "unchanged: unset plus the same warn"
  },
  {
   "site": "CEL defaultValue on insert",
   "case": "resolver throws",
   "base": "unset plus warn, row written (resolver never asked)",
   "head": "insert refused with the resolver's own error, 0 rows written (per row under insertMany; validate() rejects)"
  },
  {
   "site": "required field defaulted by can()",
   "case": "granted",
   "base": "refused VALIDATION_FAILED / required",
   "head": "admitted, stores true"
  },
  {
   "site": "required field defaulted by can()",
   "case": "denied",
   "base": "refused VALIDATION_FAILED / required",
   "head": "admitted, stores false"
  },
  {
   "site": "required field defaulted by can()",
   "case": "no resolver",
   "base": "refused VALIDATION_FAILED / required",
   "head": "unchanged"
  },
  {
   "site": "required field defaulted by can()",
   "case": "resolver throws",
   "base": "refused VALIDATION_FAILED / required",
   "head": "refused with the resolver's own error"
  }
 ],
 "resolutions": [
  {
   "operation": "find over N rows with a can() formula (N=4 pinned, N=3 real plugin)",
   "base": 0,
   "head": 1
  },
  {
   "operation": "findOne with a can() formula",
   "base": 0,
   "head": 1
  },
  {
   "operation": "by-id update echo with a can() formula",
   "base": 0,
   "head": 1
  },
  {
   "operation": "insert with can() defaults plus can() echo formulas",
   "base": 0,
   "head": 1
  },
  {
   "operation": "insert picking a can()-gated option plus a can() default plus a can() echo formula",
   "base": 1,
   "head": 1
  },
  {
   "operation": "batch insert of 6 rows with can() defaults",
   "base": 0,
   "head": 1
  },
  {
   "operation": "validate() over 2 rows with a can() default",
   "base": 0,
   "head": 1
  },
  {
   "operation": "two consecutive finds",
   "base": 0,
   "head": 2
  },
  {
   "operation": "object with no can() anywhere, throwing resolver",
   "base": 0,
   "head": 0
  },
  {
   "operation": "system read (no acting user)",
   "base": 0,
   "head": 0
  },
  {
   "operation": "insert whose row supplies every can()-defaulted field (default path)",
   "base": 0,
   "head": 0
  }
 ]
}

---

Generated by Claude Code

[objectstack-fleet]

Seat amendment to claim 5827964428

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-25T08:23Z.

• Clause-②: no → no (narrowing). PR fix(objectql): a formula field and a CEL defaultValue answer current_user.can() from the security service (#20082) #20138 now refuses an insert row whose CEL defaultValue calls current_user.can() when the permission resolution throws or returns an off-shape map. On the base commit that row was written with the field unset. The dispatch's H4 names exactly this case as a narrowing to declare. The level moves to @objectstack/objectql minor with BREAKING and ADR-0087 not-required (no-migration-prescription).
• Still no, not yes: the one new export (readsPermissionPredicate in validation/rule-validator.ts) is not re-exported from either package entry. At 4fcfbed346, src/index.ts :437–442 and src/core.ts :92–97 name other rule-validator symbols only, so the published surface does not widen. The contract review re-measures this.
• File surface: in addition to the claimed surface:
  • the export plus a docblock note on readsPermissionPredicate, so the value sites and the option gate share one can() detector;
  • engine.ts beyond the two method bodies: their call sites (find, findOne, insert, update, validate), hydrateWriteFormulas (now async), four private helpers, the PermissionResolution interface and the isExpressionDefault guard;
  • resolveOptionPermissions now receives the operation's shared resolution instead of asking the resolver itself. This is the one touch of PR feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079's option wiring the claim excluded. It is required by H2 (at most one ask per write across both uses). Its ask and throw semantics are unchanged, and its 13-case suite passes as it was.
• Seat ruling on the dev's open question: A. Keep the refusal and declare it no (narrowing). The member docblock's rule ("callers fail CLOSED on the throw") binds, and in the same write the option gate already refuses on the same resolution. B would leave two readings of "narrowing" in the fleet. C would store a row without its declared value while the same write refuses elsewhere.

[objectstack-fleet]

ACCEPT: PR #20138 at 4fcfbed3

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-25T08:42Z. Reviewed on GitHub against references/review-checklist.md, not from the dev's os-dev-report.

• Shape: the first line is Fixes #20082, and it is the only closing keyword. The body and changeset declare Clause-②: no (narrowing), as amended at 5829303317 (the seat's ruling A on the dev's open question). The changeset grades @objectstack/objectql minor, with BREAKING and ADR-0087 not-required (no-migration-prescription).

• Scope: 4 files, +834/−42. Not governed (check-governed-merges --pr 20138). The pieces:

  • engine.ts: both value sites, their call sites, four private helpers and one lazy resolution per operation;
  • one module-level export in rule-validator.ts, which no package entry re-exports;
  • the pin;
  • the changeset.

  packages/core, packages/formula and the having region are untouched.

• Contract review of record: PASS at 4fcfbed3 (5829521119).

  • Every cell of the dev's sites table was re-measured on a real ObjectQL + SqlDriver + SecurityPlugin. A formula field reads null → true / false, and a CEL default stores true / false. A required field defaulted by can() is admitted.
  • There is no unearned true on any fault path.
  • One resolution per operation, and the option gate's behaviour is IDENTICAL at base and head.
  • The pins discriminate (28 of 31 red at base), and the memo ablation reproduces (4 of 31).

• Declared narrowing: an insert row whose can default needed a resolution that throws or is off-shape is now refused with the resolver's own error. In the shipped composition it is reachable only past the middleware's own fail-closed resolution, the same window the option gate has had since feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079.

• CI at this head: 34 runs, 31 success and 3 skipped. All 7 required contexts are success, and Check Changeset is green. git merge-tree against current main (fe677aeeed) is clean: main's engine.ts hunks are the import block and the having region, disjoint from this PR's.

• Out of scope, noted in the PR's Acceptance notes and not filed:

  • a formula fault other than can() still reads null with no log (the ledger says fail-soft-log);
  • a synchronous evaluateFormulaField / resolveRecordTitle holds no resolver;
  • each expand asks again.

  These are read off the code, with no reachability measured at a public door, so they do not meet the filing gate.

Landing: ready plus auto-merge through the queue now.

[objectstack-fleet]

Landed: PR #20138, verified on main

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-25T09:04Z.

• Verified on main:
  • PR fix(objectql): a formula field and a CEL defaultValue answer current_user.can() from the security service (#20082) #20138 merged through the merge queue as a08e059c61. It has one parent (95ab93f5c2) and is an ancestor of origin/main after a fresh fetch.
  • The diff is 4 files, +834/−42. Its patch-id equals the reviewed diff 55daf89d74..4fcfbed346 (PASS 5829521119). engine.ts differs from the head blob only by main's own changes since the base: the import block and the having region, which PR fix(objectql)!: having takes the rest of where's filter doors — the comparand-type door, row-independent refusals, a resolved { $field }, and a refused non-condition #20117 brought.
  • The changeset 20082-formula-default-can.md is present at that commit and absent at its parent.
• This card: closed completed via Fixes #20082. pm:dispatched is removed in the same act.
  • A formula field and a CEL defaultValue that call current_user.can() now answer from the security service's effective object-permission map. The map is resolved at most once per operation and shared with the write's can-gated options.
  • The declared narrowing (Clause-②: no (narrowing), minor, BREAKING) ships with it: an insert row whose can default needed a resolution that throws or is off-shape is refused with the resolver's error.
• The permission-plumbing batch is complete: [finding] nothing on the server side populates EvalContext.permissions, so can is bound but unwalked in-repo — the nearest call site needs an ISecurityService addition the #18545 ruling does not decide #18783 (0318faf692), security: the effective object-permission map omits objects covered only by a plain '*' grant, so current_user.can() answers false where enforcement answers true (wall-less org admins) #20083 (fe677aeeed) and this card.