fix(objectql): set-to-undefined of an engine-hidden readonly key is a no-op, not a hook write (#16344)

Contract-review finding F1. A `beforeUpdate` hook that assigns a hidden key
from the payload it was shown (`data.x = data.x`) reads `undefined` and
re-creates the key holding it. Three mechanisms then agreed the wrong way: the
recorder's `set` trap counted it as a hook write, the hand-back skipped the key
because `k in target`, and the static strip kept it on that record — so a driver
was handed `{ x: undefined }`.

On the memory driver that ERASES the stored read-only value; on a knex-backed
one `formatInput` does not drop `undefined` and `builder.update(payload)` hands
knex an undefined binding — a bare compile-time Error outside the ADR-0112
envelope. Neither is "the record the engine intends to persist".

At the confluence the key is now deleted, dropped from the sealed record, and
the ordinary hand-back puts the caller's value back for the strip to judge. The
write reads exactly as it would with no hook at all: stripped, reported on
`onFieldsDropped`, warned, refused under `strictReadonlyWrites`.

Dropping the key from `hookWrittenKeys` is load-bearing, not tidiness: handing
the caller's value back over a key the record still calls hook-owned would
credit the forgery with hook provenance. The narrowing reaches only keys this
card's pass hid, and only the one value no driver can store, so #14088's
deliberate blindness to VALUE is unchanged for every key a hook can see.

The pin moves in both directions: the stored value now STANDS
(`completed_at === STAMPED`, the seed), and the FORGED negative stays.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XTBcV7zZHmokdyQgXjbyEU

Author: claude

packages/objectql/src/engine-readonly-strip-caller-values.test.ts

@@ -758,7 +758,7 @@ describe('the strip reads hook-write PROVENANCE, not value equality (#14088)', (
 
   // ── The measured consequence of "an assignment ran", stated out loud ───────
 
-  it('MEASURED: a lone self-assigning hook can no longer leave the CALLER value on the key (#16344)', async () => {
+  it('MEASURED: a lone self-assigning hook is a NO-OP on a hidden key — the STORED value stands (#16344)', async () => {
     // ⚠️ RECORDING BEHAVIOUR, NOT BLESSING IT. The direct consequence of the
     // mechanism #14088 chose: the record says an ASSIGNMENT RAN and is
     // deliberately blind to the VALUE (that blindness is the whole repair — it
@@ -794,19 +794,33 @@ describe('the strip reads hook-write PROVENANCE, not value equality (#14088)', (
     // ⭐ [#16344] THE VERDICT MOVED, and this is the record of it rather than a
     // deletion. Everything above still describes the recording mechanism
     // exactly; what changed is what a `beforeUpdate` hook is SHOWN. The
-    // caller's forged `completed_at` is now hidden from the hook, so
+    // caller's forged `completed_at` is hidden from the hook, so
     // `ctx.input.data.completed_at` reads `undefined` and the self-assign
-    // writes THAT — a hook write of `undefined`, faithfully persisted, rather
-    // than the caller's timestamp promoted to hook-owned.
+    // re-creates the key holding THAT.
     //
-    // Two things follow, and both are the point:
-    //  - the laundering route this case existed to make VISIBLE is now CLOSED.
-    //    A no-op-looking line can no longer confer hook provenance on a value
-    //    the caller minted, because the line can no longer reach that value.
-    //  - the line is still not a no-op. It is an assignment, so the hook owns
-    //    the key and the column is written — with what the hook assigned. That
-    //    is #14088 working as designed, and it is why this case stays pinned
-    //    with the new reading instead of being dropped as fixed.
+    // ⛔ And a hook write of `undefined` is NOT persisted as one. The
+    // confluence treats set-to-undefined of a HIDDEN key as the no-op the line
+    // actually is: the key is deleted, its entry leaves the record, and the
+    // ordinary hand-back puts the caller's value back for the strip to judge.
+    // The write then reads EXACTLY as it would have with no hook at all —
+    // stripped, reported, warned, refused under `strictReadonlyWrites`.
+    //
+    // The direction matters, and it is why this is not `toBeUndefined()`:
+    //  - persisting the `undefined` ERASES the stored value on the memory
+    //    driver and hands knex an undefined binding on a SQL one (a bare
+    //    compile-time Error, outside the ADR-0112 envelope). Neither is "the
+    //    record the engine intends to persist", which is this card's whole
+    //    subject.
+    //  - the laundering route this case existed to make VISIBLE stays CLOSED.
+    //    A no-op-looking line still cannot confer hook provenance on a value
+    //    the caller minted — the FORGED negative below is what pins that, and
+    //    it must stay red-able: drop the record-narrowing at the confluence and
+    //    the caller's timestamp is handed back onto a key the record still
+    //    calls hook-owned, and it commits.
+    //
+    // ⚠ The blindness to VALUE stated above is unchanged for every key the
+    // hook can actually SEE. This narrowing reaches only keys hidden by this
+    // card, and only the one value — `undefined` — that no driver can store.
     const FORGED = '1999-01-01T00:00:00.000Z';
     engine.registerHook('beforeUpdate', async (ctx: any) => {
       ctx.input.data.completed_at = ctx.input.data.completed_at;
@@ -817,9 +831,12 @@ describe('the strip reads hook-write PROVENANCE, not value equality (#14088)', (
       id: 't_20', status: 'in_progress', completed_at: FORGED,
     });
 
+    // The FORGED negative, KEPT: the laundering route stays closed.
     expect(task('t_20').completed_at).not.toBe(FORGED);
-    expect(task('t_20').completed_at).toBeUndefined();
-    expect(warns).toEqual([]);
+    // ⭐ The re-pin. The stored value STANDS — not erased, not `undefined`.
+    expect(task('t_20').completed_at).toBe(STAMPED);
+    // ...and the write is reported exactly as an un-hooked one would be.
+    expect(warns.some((w) => w.includes("Field 'completed_at'"))).toBe(true);
   });
 
   it('the recording is transparent to a hook reading its own payload', async () => {

packages/objectql/src/engine.ts

@@ -11762,7 +11762,7 @@ export class ObjectQL implements IObjectQLEngine {
        // deliberately keeps the pre-#14088 over-strip instead.
        const sealedHookWrites = hookWrites?.seal(hookContext.input.data);
        if (sealedHookWrites) hookContext.input.data = sealedHookWrites.data as any;
-       const hookWrittenKeys = sealedHookWrites?.hookWrittenKeys;
+       let hookWrittenKeys = sealedHookWrites?.hookWrittenKeys;
 
        // ── [#16344] HAND BACK what was hidden from the hooks ────────────────
        //
@@ -11782,17 +11782,57 @@ export class ObjectQL implements IObjectQLEngine {
        // below reads that record for provenance — so the caller's own forgery
        // would be handed the one credential (`hookWrittenKeys`) that stops it
        // being stripped. The exact laundering #14088 exists to prevent.
+       //
+       // ⛔ ...and SET-TO-UNDEFINED of a hidden key is a NO-OP, not a hook
+       // write. A hook that assigns a hidden key from the payload it was shown
+       // (`data.x = data.x`, the shape #14088's own pin names) reads
+       // `undefined` and RE-CREATES the key holding it. Left alone, three
+       // mechanisms agree the wrong way: the recorder's `set` trap counts it as
+       // a hook write, the hand-back below skips the key because `k in target`,
+       // and the strip keeps it on that record — so a driver is handed
+       // `{ x: undefined }`. On the memory driver that ERASES the stored
+       // read-only value; on a knex-backed one `formatInput` does not drop
+       // `undefined` and `builder.update(payload)` hands knex an undefined
+       // binding, a bare compile-time `Error` OUTSIDE the ADR-0112 envelope.
+       // Neither is "the record the engine intends to persist", which is the
+       // whole subject of this card.
+       //
+       // Undoing it here — delete the key, drop it from the record, let the
+       // ordinary hand-back put the caller's value back for the strip to judge
+       // — makes the write read EXACTLY as it would have with no hook at all:
+       // stripped, `onFieldsDropped` reporting it, the WARN said, and
+       // `strictReadonlyWrites` refusing. That identity IS the invariant this
+       // hide/hand-back pair exists to hold.
+       //
+       // ⛔ Dropping the key from `hookWrittenKeys` is NOT optional and is not
+       // tidiness: leaving it there while handing the caller's value back over
+       // it would credit the caller's forgery with hook provenance — the exact
+       // laundering the note above refuses, arrived at from the other side. The
+       // narrowing reaches only keys THIS pass hid, and only the one value no
+       // driver can store; a hook write of any real value is untouched, so the
+       // recorder's deliberate blindness to VALUE (#14088) is unchanged for
+       // every key a hook can actually see.
        if (readonlyHiddenFromHooks) {
          const restoreTargets = new Set<Record<string, unknown> | null | undefined>([
            hookContext.input.data as Record<string, unknown> | null | undefined,
            opCtx.data as Record<string, unknown> | null | undefined,
          ]);
+         const undoneSelfAssigns = new Set<string>();
          for (const target of restoreTargets) {
            if (!target || typeof target !== 'object') continue;
            for (const [k, v] of Object.entries(readonlyHiddenFromHooks)) {
+             if (k in target && target[k] === undefined) {
+               delete target[k];
+               undoneSelfAssigns.add(k);
+             }
              if (!(k in target)) target[k] = v;
            }
          }
+         if (undoneSelfAssigns.size > 0 && hookWrittenKeys !== undefined) {
+           const narrowed = new Set(hookWrittenKeys);
+           for (const k of undoneSelfAssigns) narrowed.delete(k);
+           hookWrittenKeys = narrowed;
+         }
        }
 
        // ── [#13657] The POST-hook half of the declared-field door ──────────