fix(objectql): droppedFields on a create names only keys the caller sent, never a middleware fill (#21682)

ObjectQL.insert took its caller snapshot (suppliedPerRow) inside the
middleware chain's innermost step, after a write middleware had already
filled the payload. On a walled posture @objectstack/organizations fills an
absent organization_id, so the static-readonly strip took the platform's own
value and droppedFields reported it on every create that named no
organization. The console shows every non-empty droppedFields as a warning
toast.

The keys each row carries are now recorded at insert's entry, before the
chain runs, keyed by the row object. The snapshot keeps only those keys. The
values stay as the chain handed them on, so every key the caller did send is
judged as before. There is no name list.

Claude-Session: https://claude.ai/code/session_017ErfyP2Rx7XWHJA27QjyUi
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/objectql/src/engine-insert-static-readonly-strip.test.ts

@@ -228,6 +228,53 @@ describe('#14147 — the exemptions, each one load-bearing', () => {
     expect(o.created?.completed_at, 'the hook wrote it — provenance, not value equality').toBe('2026-01-01T00:00:00Z');
   });
 
+  // [#21682] A write MIDDLEWARE runs before the caller snapshot is taken, so
+  // its fill used to read as a key the caller sent: stripped, and reported in
+  // `droppedFields` (`@objectstack/organizations`' `organization_id` fill, on
+  // every walled create naming no organization). The column here is an
+  // arbitrary author-declared one: what makes a key the platform's is WHEN it
+  // appeared, never its name.
+  const fillAbsent = (key: string, value: unknown) => (engine: ObjectQL) => {
+    engine.registerMiddleware(async (opCtx: any, next: () => Promise<void>) => {
+      if (opCtx.operation === 'insert') {
+        for (const row of Array.isArray(opCtx.data) ? opCtx.data : [opCtx.data]) {
+          if (row && !(key in row)) row[key] = value;
+        }
+      }
+      await next();
+    });
+  };
+
+  it('[#21682] a write middleware’s fill is not caller-supplied either: it lands, and nothing is reported', async () => {
+    const o = await observeInsert({ title: 'T' }, { context: { userId: 'u1' } }, fillAbsent('completed_at', 'stamp'));
+    expect(o.created?.completed_at, 'the platform’s value reaches the driver').toBe('stamp');
+    expect(o.dropped, 'droppedFields names only keys the caller sent').toEqual([]);
+  });
+
+  it('[#21682] …per row on the batch path, beside a key the caller DID send, which is still taken and reported', async () => {
+    const { engine, creates } = await makeEngine();
+    fillAbsent('locked_note', 'stamp')(engine);
+    const dropped: DroppedFieldsEvent[] = [];
+    await engine.insert('duly_task', [
+      { title: 'A' },
+      { title: 'B', completed_at: 'forged' },
+    ] as any, { context: { userId: 'u1' }, onFieldsDropped: (e: DroppedFieldsEvent) => { dropped.push(e); } } as any);
+    expect(creates.map((c) => c.locked_note), 'the fill lands on every row').toEqual(['stamp', 'stamp']);
+    expect(creates[1]).not.toHaveProperty('completed_at');
+    expect(dropped).toEqual([{ object: 'duly_task', fields: ['completed_at'], reason: 'readonly' }]);
+  });
+
+  it('[#21682] a key the caller sent is judged as before even when a middleware rewrote its value', async () => {
+    const o = await observeInsert({ title: 'T', completed_at: 'forged' }, { context: { userId: 'u1' } }, (engine) => {
+      engine.registerMiddleware(async (opCtx: any, next: () => Promise<void>) => {
+        if (opCtx.operation === 'insert') opCtx.data.completed_at = 'rewritten';
+        await next();
+      });
+    });
+    expect(o.created, 'the caller named the key, so the strip still owns it').not.toHaveProperty('completed_at');
+    expect(o.dropped).toEqual([{ object: 'duly_task', fields: ['completed_at'], reason: 'readonly' }]);
+  });
+
   it('a PLATFORM-INTERNAL object is left to its own 403 guard (ADR-0086 / #3004, carried over)', async () => {
     // The reserved `sys_` namespace, and a `managedBy` bucket whose columns
     // carry their own fail-closed refusal, have dedicated write governance —

packages/objectql/src/engine.ts

@@ -2063,6 +2063,63 @@ function droppedFieldEvents(
   return events;
 }
 
+/**
+ * [#21682] The keys the CALLER sent on each row of an insert, recorded at
+ * `insert`'s entry, BEFORE the middleware chain runs, and keyed by the row
+ * OBJECT.
+ *
+ * `insert` takes its caller snapshot (`suppliedPerRow`) inside the middleware
+ * chain's innermost step, so by then a write middleware may already have
+ * filled the payload: `@objectstack/organizations` fills an absent
+ * `organization_id` with the active organization, and
+ * `@objectstack/plugin-security` fills an absent `owner_id` with the acting
+ * user. Both write IN PLACE, onto the very row objects recorded here. Without
+ * this record the snapshot reads those fills as keys the caller sent, so the
+ * static-`readonly` strip took the platform's own `organization_id` and
+ * `droppedFields` reported it, on every walled create that named no
+ * organization. The console announces every non-empty `droppedFields` as a
+ * warning toast. This is the insert-side twin of the update path's #8093
+ * (ADDRESSING IS NOT PAYLOAD): a value the platform put on the payload is
+ * not one the caller lost.
+ *
+ * Keyed by IDENTITY, not by index, so the answer survives a middleware that
+ * reorders a batch. A row a middleware REPLACED wholesale has no entry, and
+ * {@link callerSuppliedRow} then keeps every key it carries: the verdict from
+ * before this record existed. That is the over-reporting direction, never the
+ * under-stripping one.
+ *
+ * ⛔ No name list. Which keys are the platform's is answered by WHEN they
+ * appeared, so a new stamping middleware is covered without being named here.
+ */
+function callerKeySets(data: unknown): WeakMap<object, ReadonlySet<string>> {
+  const sets = new WeakMap<object, ReadonlySet<string>>();
+  for (const row of Array.isArray(data) ? data : [data]) {
+    if (row !== null && typeof row === 'object' && !sets.has(row)) {
+      sets.set(row, new Set(Object.keys(row)));
+    }
+  }
+  return sets;
+}
+
+/**
+ * One row of `insert`'s caller snapshot: a shallow COPY of the row as the
+ * middleware chain handed it on, keeping only the keys the caller sent
+ * (`sent`, from {@link callerKeySets}).
+ *
+ * Only WHICH keys is narrowed. A kept key keeps the value the chain handed
+ * on, so every key the caller did send is judged exactly as it was before
+ * #21682. `sent` undefined means "this row has no record" and keeps every key.
+ */
+function callerSuppliedRow(row: unknown, sent: ReadonlySet<string> | undefined): Record<string, unknown> {
+  const copy: Record<string, unknown> = { ...((row ?? {}) as Record<string, unknown>) };
+  if (sent) {
+    for (const key of Object.keys(copy)) {
+      if (!sent.has(key)) delete copy[key];
+    }
+  }
+  return copy;
+}
+
 /**
  * Evaluate formula virtual fields against the raw rows a driver handed back —
  * the read path (`find` / `findOne`) and, since #5504, the write path's
@@ -12817,6 +12874,10 @@ export class ObjectQL implements IObjectQLEngine {
     data = normalizeBlankTypedValues(this._registry.getObject(object), data);
     data = normalizeNumericStringValues(this._registry.getObject(object), data);
 
+    // [#21682] What the CALLER sent, recorded before any write middleware
+    // fills the payload. See `callerKeySets`.
+    const callerKeys = callerKeySets(data);
+
     const opCtx: OperationContext = {
       object,
       operation: 'insert',
@@ -12844,6 +12905,14 @@ export class ObjectQL implements IObjectQLEngine {
       // untouched, hooks run after and may override.
       const nowSnap = new Date();
       const isBatch = Array.isArray(opCtx.data);
+      // [#21682] Each row's caller key set, looked up NOW, on the row objects
+      // the middleware chain handed on. The computed-field door below may
+      // replace a row with a copy. Index-aligned from here on: every pass
+      // between here and the snapshot keeps the rows' order and count.
+      const callerKeysPerRow: Array<ReadonlySet<string> | undefined> =
+        (isBatch ? (opCtx.data as unknown[]) : [opCtx.data]).map(
+          (row) => (row !== null && typeof row === 'object' ? callerKeys.get(row) : undefined),
+        );
       // [#8682] The declared-field door — see `undeclaredWriteFieldErrors` for
       // what used to run below it for a request that was already refused.
       // FIRST, so nothing downstream (defaults, summary seeding, the hooks, the
@@ -12879,10 +12948,17 @@ export class ObjectQL implements IObjectQLEngine {
       }
       // [#4441] The RAW caller payload per row — before `applyFieldDefaults`
       // resolves any `defaultValue` / `current_user` token and before the
-      // beforeInsert hooks stamp `owner_id` / `organization_id` /
-      // `created_by`. The reference check consults it to decide WHAT THE
-      // CALLER ACTUALLY SENT, so neither a platform stamp nor a backfilled
-      // default is ever reported as the caller's bad reference.
+      // beforeInsert hooks stamp `created_by`. The reference check consults it
+      // to decide WHAT THE CALLER ACTUALLY SENT, so neither a platform stamp
+      // nor a backfilled default is ever reported as the caller's bad
+      // reference.
+      //
+      // [#21682] ...and without the keys a write MIDDLEWARE filled, which ran
+      // before this step: `organization_id` (`@objectstack/organizations`) and
+      // `owner_id` (`@objectstack/plugin-security`) are filled there, not by a
+      // hook. Each row keeps only the keys the caller sent (`callerKeySets`,
+      // recorded at entry), so the strips below report and take only those.
+      // The values stay as the chain handed them on.
       //
       // [#6339] It carries the caller's VALUES, and it is taken HERE — ahead of
       // the hooks — as an explicit shallow COPY. Both halves are load-bearing:
@@ -12904,7 +12980,7 @@ export class ObjectQL implements IObjectQLEngine {
       //    (#5591).
       const suppliedPerRow: Array<Record<string, unknown>> =
         (isBatch ? (opCtx.data as any[]) : [opCtx.data]).map(
-          (row) => ({ ...((row ?? {}) as Record<string, unknown>) }),
+          (row, i) => callerSuppliedRow(row, callerKeysPerRow[i]),
         );
       // [#20082] The write's ONE permission resolution, shared by every consumer
       // below that needs the map: the CEL defaults here, the re-default after

packages/plugins/organizations/src/create-explicit-organization-wall.test.ts

@@ -385,6 +385,8 @@ describe('[#21682] droppedFields names only keys the caller sent, so the organiz
   });
 
   it('a readonly key the caller sends beside the fill is reported alone', async () => {
+    // `created_by` is an injected readonly column. No audit hook stamps it in
+    // this composition, so the caller's value is the one the strip takes.
     const b = await boot();
 
     const { outcome, dropped } = await createReporting(b, INJECTED, { id: 'r2', name: 'new', created_by: 'usr_forged' }, MEMBER_CTX);