Move the six flow value expressions `os validate --strict` flags from the `{…}` template dialect to CEL envelopes, with tests

[hotlong]

Follow-up to #1983, which left these six findings on purpose: os validate --strict on main still reports six {…} template-dialect expressions in flow value slots. #1983's changeset says why they were not converted there: "Moving the arithmetic to CEL changes how it divides, so that is its own change with its own tests." This card is that change.

What the lint says (17.6.0, measured on main @ 39ba05e)

… is a {…} template-dialect expression. This slot also accepts a CEL value envelope — { dialect: 'cel', source: '…' } — evaluated by the engine flow conditions use, with the whole CEL stdlib; the template form keeps working unchanged. When moving arithmetic to CEL, give a division a decimal operand: CEL divides two integers as integers, so round(x * 100) / 100 drops the decimals there — write round(x * 100) / 100.0.

The six sites:

Flow	Node	Slot	Today
quote_generation	create_quote (create_record)	config.fields.discount_amount	{round(oppRecord.amount * (discount / 100) * 100) / 100}
quote_generation	create_quote (create_record)	config.fields.total_price	{round(oppRecord.amount * (1 - discount / 100) * 100) / 100}
forecast_snapshot	add_pipeline (assignment, in loop sum_pipeline)	config.assignments.pipelineTotal	{pipelineTotal + current_pipeline.amount * 1}
forecast_snapshot	add_best_case	config.assignments.bestCaseTotal	{bestCaseTotal + current_best_case.amount * 1}
forecast_snapshot	add_commit	config.assignments.commitTotal	{commitTotal + current_commit.amount * 1}
forecast_snapshot	add_won	config.assignments.closedTotal	{closedTotal + current_won.amount * 1}

Sources: src/revenue/flows/quote-generation.flow.ts (the two fields lines) and src/sales/flows/forecast-snapshot.flow.ts (sumBucket(); the four sites come from one template).

Why

• CEL is the value dialect the platform declares for these slots (FlowValueSlotSchema, the value role). The {…} template form is the legacy path, which the lint flags under --strict.
• The template path's arithmetic has a documented trap that the forecast code already works around: "the accumulator runs through the template evaluator, which stringifies non-numeric values — a currency that comes back from the driver as "90000" would CONCATENATE instead of add. * 1 coerces it, and maps a null/absent amount to 0." (comment above sumBucket). CEL types the operands instead.

Measured semantics the conversion must preserve (PM probe, ExpressionEngine from @objectstack/formula 17.6.0, scope built the way AutomationEngine.celScope builds it)

These are mechanism assumptions for the dev to re-measure, not a spec:

• round(oppRecord.amount * (discount / 100) * 100) / 100 with amount: 180000, discount: 30 → 54000. double(round(double(oppRecord.amount) * (double(discount) / 100.0) * 100.0)) / 100.0 → 54000; the total-price analogue → 126000. Both match test/flow-quote.test.ts's existing pins (54000 / 126000).
• double(x) accepts a number and a numeric string ("90000" → 90000).
• ⚠️ double(null) errors (found no matching overload for 'double(null)'). The template's * 1 maps a null amount to 0, so a naive conversion would turn a null amount into a failed forecast sweep. A guard such as (has(x.amount) && x.amount != null ? double(x.amount) : 0.0) evaluated to 0 in the probe.

Acceptance

1. All six sites use { dialect: 'cel', source: '…' } envelopes (the repo writes these with the P tag from @objectstack/spec). os validate --strict drops the six template-dialect findings: 14 → 8, with the other 8 unchanged.
2. Quote pricing is unchanged. The existing test/flow-quote.test.ts pins pass untouched, including the whole-cent rounding cases (Generate Quote fails for most non-zero discounts: the flow writes raw IEEE-754 products into two 2-decimal money fields, and the rejection never reaches the user #1206: 30% and 70% of 180,000).
3. Forecast totals are unchanged. Existing forecast tests pass untouched, and new tests pin, through the real AutomationEngine (the test/helpers/flow-harness.ts path):
   • a bucket whose opportunity has a null / absent amount sums as 0, and the sweep does not fail;
   • a non-integer amount keeps its decimals, so CEL does not truncate;
   • the integer-division trap is closed: a test that fails if the divisor in the quote expressions is an integer literal.
4. Update the comments beside both sites, in particular the * 1 rationale above sumBucket, to describe the CEL form. They must no longer describe the template path.
5. Changeset (patch), written for the release-notes reader. The expected user-visible change is none.

Out of scope

• The other 8 --strict findings (enterprise capability, position-routed approvals, the ruling-pinned page:card description): their reasons are recorded in chore(metadata): clear the dead-metadata findings of os validate --strict #1983's changeset.
• Any other flow's {…} interpolation in a non-value slot (strings, filters). Only the six sites the lint names are in scope.

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 1
Session: session_01WXp8E7s1gzSBje9ZwwqVux
Account: hotlong (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-1984-flow-values-cel
Worktree: hotcrm-issue-1984
Domain: none (hotcrm carries no domain:* labels; single-repo metadata app)
Seat: none (one-off dispatch requested by the maintainer in this session)
File surface: src/revenue/flows/quote-generation.flow.ts, src/sales/flows/forecast-snapshot.flow.ts, test/ (new or extended flow tests), .changeset/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default tier (opus) — dispatch-gates --tier --repo objectstack-ai/hotcrm: "no path-derived mandate … the tier stays the PM's per-card judgment call"; judgment surface = the null-amount guard
Clause-②: no
Thread-read: none
Serial constraints cleared: no file intersection with the 7 open PRs (#1981, #1977, #1963, #1962, #1953, #1950, #1058; files read via pulls/N/files). Semantic coupling named: #1953 (draft) raises the src/sales token ceilings that pnpm hygiene:tokens enforces, and forecast-snapshot.flow.ts is under src/sales — this card must fit the ceiling on main, not #1953's.

---

Generated by Claude Code

[hotlong]

os-dev-report

{
  "issue": 1984,
  "status": "done",
  "branch": "claude/issue-1984-flow-values-cel",
  "pr": "https://github.com/objectstack-ai/hotcrm/pull/1985",
  "session": "session_01WXp8E7s1gzSBje9ZwwqVux",
  "premise_still_valid": true,
  "summary": "All six template-dialect value expressions are now CEL envelopes authored with expression(src, 'cel') (the P tag JSON-quotes interpolated strings, so it cannot splice the shared DISCOUNT fragment or the per-bucket variable names; precedent event_attendee.object.ts). Quote: round(double(oppRecord.amount) * (DISCOUNT / 100.0) * 100.0) / 100.0 and the 1.0 - analogue. Forecast: TOTAL + (!has(ITEM.amount) || isBlank(ITEM.amount) ? 0.0 : double(ITEM.amount)). Beyond the issue table, the quote discount is guarded too: on the template baseline a cleared discount (null or empty string) priced as 0%, and a bare double(discount) errors on it. Comments at both sites, including the * 1 rationale above sumBucket and in the file header, now describe the CEL form. PR assignee set to hotlong. Card assignee not touched.",
  "gates": {
    "head": "151392a4",
    "pnpm verify": "exit 0: 174 files, 3728 passed, 1 skipped. hygiene:tokens is clean on main's ceilings: src/revenue business semantics ~15,665 of 16,000 and authored total ~18,775 of 19,000; src/sales business semantics ~54,323 of 55,000 and authored total ~97,805 of 100,000. No ceiling raised.",
    "objectstack validate --strict": "base 39ba05e2: exit 1, 14 warnings. Branch: exit 1, 8 warnings. The 6 removed are exactly the six sites; the 8 left are byte-identical to base (hierarchy-security capability, sales_home_page page:card description, six position-routed approval nodes).",
    "e2e": "NOT MEASURED: optional, skipped. It starts a server, and the flow behaviour is covered through the real AutomationEngine."
  },
  "tests": "New tests: test/flow-quote.test.ts gets describe 'CEL pricing (#1984)' (1234.56 at 10% gives 123.46 and 1111.1; a cleared discount, null and empty string, gives 0 and full price). New file test/forecast-snapshot-amounts.test.ts runs the real AutomationEngine via flow-harness, starting from a stale scheduled row: a null amount sums as 0 and the row is still overwritten (30000/30000/30000/0, snapshot_date restamped); decimal amounts keep their decimals (1000.75, 0.5, 70000.75). Existing pins pass untouched (10 related files, 248 tests, before the new tests were added). Ablations were each run from committed HEAD, with the restore done by git checkout HEAD -- PATH and proved by HEAD blob hash equality plus an empty git diff HEAD. A: quote divisors / 100.0 -> / 100 (decimal grep count 2 -> 0, int 0 -> 2): flow-quote exit 1, 'keeps the cents' red. B: forecast guard -> bare double(ITEM.amount) (guard count 1 -> 0): exit 1, 'expected 9999999 to be 30000'. C: DISCOUNT -> bare double(vars.discount): exit 1, both cleared-discount cases red. A parity probe ran the same harness inputs on base (template) and branch (CEL); every output matched.",
  "line_budget": "5 files, +182 / -23. src: quote-generation.flow.ts +19/-12, forecast-snapshot.flow.ts +18/-11. test: flow-quote.test.ts +38, forecast-snapshot-amounts.test.ts +96 (new). .changeset/flow-values-cel.md +11.",
  "files_changed": [
    "src/revenue/flows/quote-generation.flow.ts",
    "src/sales/flows/forecast-snapshot.flow.ts",
    "test/flow-quote.test.ts",
    "test/forecast-snapshot-amounts.test.ts",
    ".changeset/flow-values-cel.md"
  ],
  "mechanism_assumptions": [
    "1 CONFIRMED: through ExpressionEngine 17.6.0 with the celScope shape, the quote form gives 54000 and 126000 (30%), 126000 and 54000 (70%), 123.46 and 1111.1 for 1234.56 at 10%. Refinement: JS numbers enter CEL as doubles (discount / 100 = 0.3), so the integer-division trap comes from round(), which returns an int: round(...) / 100 with amount 1234.56 gives 123.",
    "2 CONFIRMED and extended: double('90000') = 90000. double(null) errors. double('') errors too ('cannot convert to double'). The guard returns 0 for null, absent and empty string. An absent key is not reachable through flow-harness, which materialises declared columns as null, so it was measured directly against the engine only. The reset_totals initial 0 adds to a CEL double with no overload error (measured through the real engine).",
    "3 CONFIRMED: the assignment executor routes a declared assignments-map envelope to evaluateValueEnvelope (service-automation dist ~9181). The real-engine test proves this inside loop -> try_catch -> loop: ablation B goes red, and with the guard on, the stale row is overwritten."
  ],
  "deviations": [
    "No scripts/pm in hotcrm: os-verify-lock, dispatch-gates, label-write and fleet-write were not used. Gates were run directly, as the dispatch specified; GitHub writes went through plain repo-scoped REST.",
    "expression(src, 'cel') was used instead of the P tag that the PM's suggested route proposed: P JSON-quotes interpolated strings and cannot splice a source fragment.",
    "The first POST /pulls was refused by the container proxy before reaching GitHub ('Request bodies must declare Content-Type: application/json'). It was resent once with the header, so 1 PR was created.",
    "Pre-change, a throwaway probe test file was created in the worktree and deleted again; it was never committed.",
    "To measure the base strict count, a temporary detached worktree at 39ba05e2 was created in the scratchpad (node_modules symlinked) and then removed."
  ],
  "mcp_calls": "0",
  "api_writes": "4 attempts, 3 landed: POST /repos/objectstack-ai/hotcrm/pulls (refused by the proxy, no write), POST /repos/objectstack-ai/hotcrm/pulls (#1985, draft), POST /repos/objectstack-ai/hotcrm/issues/1985/assignees (hotlong), POST /repos/objectstack-ai/hotcrm/issues/1984/comments (this report). Plus git push x2.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none. test/flow-scheduled.test.ts fixture comment o7/o8 still credits the string-amount case to 'the * 1 coercion in the accumulator'. Left untouched because Acceptance 3 asks for existing forecast tests to pass untouched; the assertion still holds. Noted in the PR Acceptance notes, not filed."
  ]
}

---

Generated by Claude Code

[hotlong]

Review: ACCEPT — PR #1985 @ 151392a4

Checked against GitHub and a local re-run, not against the report's self-description.

• Shape: the PR is a draft against main, its first line is Fixes #1984, and its PR assignee is hotlong, the same as this card's. It changes 5 files, all inside the claimed file surface (+182 / −23), and carries a patch changeset. No governed path is touched.
• Six sites: the diff converts exactly the six expressions in the issue table to expression(…, 'cel') envelopes. P was not used because it JSON-quotes spliced strings; the comment beside the code explains this. Both rationale comments, including the old * 1 note above sumBucket, now describe the CEL form.
• Local re-run on a detached worktree at the PR head:
  • test/flow-quote.test.ts, test/forecast-snapshot-amounts.test.ts and test/flow-scheduled.test.ts: 75 passed.
  • objectstack validate --strict: 8 warnings, down from 14 on main.
• Ablation, repeated by the reviewer:
  • I changed the quote divisor / 100.0 back to / 100.
  • keeps the cents: both divisors are decimal, not integer division went red: 1 failed / 5 passed.
  • I restored the file with git checkout --, and the diff is clean.
• One point beyond the card, which I accept: the quote's discount is guarded too. A cleared discount (null or '') prices as 0%, as the template did; a bare double() would have failed the quote. Two tests pin it.
• Out-of-scope finding: the test/flow-scheduled.test.ts fixture comment still credits * 1, but its assertion still holds. I am not filing it; it is recorded under the PR's Acceptance notes.
• CI at review time: CodeQL, Check Changeset, link-check, Quality Checks and Analyze Code are green. Build and Test and Playwright are still running, and the PR lands only once every check is green.

---

Generated by Claude Code