feat(spec,service-automation)!: a subflow or map input and a script's inputs are value slots — a CEL envelope per key, the {…} token refused (#19939 pass 4, S1) (#22715)

Part of #19939
Clause-②: no (narrowing)

Pass 4, stage S1 of #19939 (stage plan `6096263424`, claim
`6096277270`), under ruling D on #11182 and ADR-0032 Decisions 2 and 3.
The maps a flow node hands to a callee become value slots:
`subflow.input.*`, `map.input.*` and `script.inputs.*`. Each value is a
CEL value envelope that the executor evaluates in the calling flow's
scope, or a literal. A single-brace `{…}` token there is refused. #19939
stays open for stages S2 to S7, so this PR uses `Part of`.

## What lands

**The ledger and the contracts (`@objectstack/spec`).**
- `FLOW_NODE_EXPRESSION_PATHS` gains three `value` rows:
`subflow.input.*`, `map.input.*` and `script.inputs.*`. Because the
value-slot judge (`flowNodeValueTemplateRefusals`) walks the ledger, it
refuses a token at these positions at `registerFlow` and at `objectstack
validate` with no second judge. The lint hints
`flow-bare-dollar-reference` and `flow-double-brace-interpolation` ask
that same judge, so they flip at these positions with no lint source
change.
- `SubflowConfigSchema.input`, `ScriptConfigSchema.inputs` and
`MapConfigSchema.input` take `FlowValueSlotSchema` per value. The
executor's contract parse therefore refuses a token as a guard. `map`
joins `LEDGER_DECLARED_NODE_CONFIG_SCHEMAS`, as the CRUD pair did,
because its descriptor declares `input` as `additionalProperties: true`
with no marker. `map.collection` keeps its `flow-template` slot on the
descriptor channel, so no slot is declared twice.
- `dropped-refinements.baseline.json` declares the three new dropped
value refinements (`input.valueType`, `inputs.valueType`), and its
header totals follow the body.

**The callee sentence (the judge).** A whole token that resolved to
nothing handed the callee nothing. A child flow then seeded the variable
from its `defaultValue` (`seedDeclaredVariables` applies the default
only to `undefined`). The guarded form the remedy names hands `null`. A
supplied `null` wins over the default. At a top-level value of a callee
map, the refusal now ends with a sentence that names the child variable
and the two ways to keep the default: write it in the guard's `null`
branch, or leave the key out. For a `script`, it says the function is
handed `null` where it was handed `undefined`. A `$User` path that never
resolved gets the variant "leaving the key out keeps exactly that". The
positions come from the ledger entry, inside the judge module. No new
export was added.

**The executor (`@objectstack/service-automation`).** One per-key
resolver, `resolveValueSlotMap` (`builtin/value-slot-map.ts`), is
generalised from the CRUD `resolveFieldValues`. An envelope goes through
`AutomationEngine.evaluateValueEnvelope` in the parent's scope and run
context. A literal is handed on as before. The subflow, map (once per
item, with the item variable bound) and script executors call it, and so
does the CRUD `fields` map. The dispatch is by shape. No `??` fallback
to the interpolator was added.

**ADR-0087.** The step-18 D3 entry
`18.flow-value-slot-template-dialect-refused` is amended: its surface
widens to the three maps, and its replacement and reason gain the callee
sentence. `registry.ts` is regenerated. There is no D2 entry, because
every whole-path spelling answers differently for an absent value. The
changeset marker is `not-required (already-registered …)`, and
`check-adr-0087-registration` accepts it.

**Sites migrated.** All of these are re-derived at HEAD with the stage-0
census instrument:
- showcase: 5 values in 3 nodes;
- todo: the 3 `computeNextTaskDueDate` inputs, each guarded because each
field may be absent and the function reads `null` as it read the empty
value;
- `flows.mdx`, `runtime-services/examples.mdx` and the
service-automation README;
- 2 dogfood fixtures, and the service-automation test fixtures (map 8,
script 3, subflow 2).

What remains at these positions: the 5 historical fixtures inside
`conversions/registry.ts`, which are conversion inputs and outputs, and
the deliberate refusal fixtures in the new pins. A positive control was
measured: the census rows that carried tokens at base now read as
envelopes.

## Pins and the ablations that turn them red

- `callee-input-value-slots.test.ts` runs 16 pins through the shipped
`AutomationEngine`:
  - refusal at `registerFlow` and at the executor's guard, per position;
- evaluation: a list stays a list, a record stays a record, per item on
a `map`, and as `input` on a `script`;
  - a fault names its source;
- the callee default: the template handed `undefined` and the default
applied; the guarded form hands `null`, which wins; writing the default
in the guard keeps it, and so does leaving the key out.
- Judge, ledger and contract pins in `@objectstack/spec`, ratchet
coverage in `config-expression-ledger.test.ts`, and the hint flips in
`lint-flow-patterns.test.ts`.
- **Ablations**, through `scripts/ablation-replace.mjs` (anchor hit,
blob changed, restore proven equal to HEAD with `git diff HEAD` empty):
1. The resolver hands envelopes to `interpolate` (at `3d832770e7`): 8 of
the 16 engine pins went red. These were the evaluation and
callee-default pins, and the refusal pins stayed green as expected.
2. The callee-slot table emptied (at `9387cf70ce`): the 6
callee-sentence pins went red.
3. The `subflow.input.*` ledger row renamed (at `9387cf70ce`): 12 judge
and ledger pins went red.
- Not ablated: the service-automation registration pins read
`@objectstack/spec`'s `dist`, and a dist-level ablation was not run.
They call the same judge function that ablations 2 and 3 turned red at
source.

## Measurements

- **Gates** at `9387cf70ce`: `dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 120 commands. All 120 exited 0, and
`--ran` with recorded exit codes reports 120 run, 0 NOT-MEASURED (a
derived zero). This includes `check-adr-0087-registration`,
`check-changeset-no-major`, `check-empty-changeset`, and the spec gates
`check:generated`, `check:api-surface`, `check:export-origins`,
`check:migration-registry`, `check:docs`, `check:skill-examples` and
`check:liveness`.
- **Tests after the second merge of `main`** (at `9387cf70ce`; the
incoming commits touched no file under `spec/src/automation`,
`service-automation` or `lint`):
  - service-automation: 185 files, 2368 tests pass;
- spec `src/automation`, `src/migrations` and
`scripts/dropped-refinements.test.ts`: 41 files, 1518 pass;
- lint `lint-flow-patterns` and `validate-expressions*`: 8 files, 780
pass;
  - metadata-protocol `reference-sites`: 22 pass.
- **Tests at `7d723c9fc1`/`3d832770e7`**:
- spec full suite: 20159 pass, plus one fail on the dropped-refinements
header totals, which `3d832770e7` corrects; that test file then passed
27 of 27;
  - lint full: 135 files, 6240 pass;
  - typecheck green for spec, service-automation and lint;
- example-todo typecheck and 238 tests, example-showcase typecheck and
408 tests;
  - dogfood typecheck, plus the two touched dogfood tests (8 pass);
- `objectstack validate` on both examples exits 0 with no value-slot
finding.
- **Semver**: `@objectstack/spec` major,
`@objectstack/service-automation` major (pre mode `next`). No lint
source line changed, so there is no lint entry. No `api-surface/**` or
`export-origins/**` file moved. The exported ledger constants gain rows:
`FLOW_NODE_EXPRESSION_PATHS` +3, and
`LEDGER_DECLARED_NODE_CONFIG_SCHEMAS` + `map`, which widens the
`LedgerDeclaredNodeType` union. That is data in existing exports, not a
new export, so the line reads `no (narrowing)`. Flagged here for the
seat.
- **Size**: 38 files, +1099 / −160 against `main`.

## Acceptance notes

- The executor's contract parse judges a value with no position, so its
refusal names the base remedy without the callee sentence. The two build
doors carry the sentence, and this boundary is pinned.
- `packages/lint/src/lint-flow-patterns.ts` (the module comment near
`:659`) still lists `subflow.input` among the single-brace positions and
calls the date macros kept. It is an internal comment and is not
published. Carrier: S7, which deletes that arm.
- `engine.ts`'s `evaluateValueEnvelope` docblock lists only the
assignment and CRUD maps among its callers. The list is now incomplete
but not false. Carrier: S3, which edits `engine.ts`.
- `predicateSlotRefusal`'s message names the assignment and CRUD maps as
the value-role spelling. The list is incomplete but not false.
- `examples/app-todo/src/functions/task.functions.ts` still says no flow
node evaluates a value expression. That has been stale since the value
slots landed, before this pass.
- `validate-flow-template-paths` still path-checks single-brace tokens
at declared value slots, which doubles a finding the judge already
makes. This is the same note passes 1 to 3 carried; S7 removes it.
- The published skill (`skills/objectstack-automation/SKILL.md:268`,
"inputs are interpolated") is carried by #22585. The objectui designer
(`flow-node-config.ts` script inputs and subflow input) is carried by
the companion card. hotcrm's sites at these positions were not measured
and stay on the seat's ledger.

---

_Generated by [Claude
Code](https://claude.ai/code/session_016njDy8ozy9B9Ns5Y8kAWEK)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/19939-flow-callee-input-value-slots.md

@@ -0,0 +1,39 @@
+---
+'@objectstack/spec': major
+'@objectstack/service-automation': major
+---
+
+The maps a flow node hands to a CALLEE are value slots now: a `subflow` node's `input`, a `map` node's `input` (evaluated once per item) and a `script` node's `inputs`. Each value is a CEL value envelope, `{ dialect: 'cel', source: '…' }`, evaluated in the calling flow's scope and handed over as the value it computes, or a literal written as it is. A `{…}` template token there is refused at `objectstack validate`, at `registerFlow` and by the executor, naming its CEL spelling, as in every other value slot.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (already-registered flow-value-slot-template-dialect-refused) The value-slot retirement's step-18 D3 entry, registered on this line before this change, is amended in this diff: its surface widens to the three callee maps, and its replacement and reason gain what a guarded form's null does to a child flow's defaultValue. No new D3 entry and no D2 conversion: every whole-path spelling answers differently for an absent value. -->
+
+**BREAKING**: an accept-set narrowing on a published authoring surface, shipped as `major` on the v18 line (`.changeset/pre.json` is open on `main` in `next` pre mode, so the release is `18.0.0-next.*`).
+
+**Why.** ADR-0032 Decision 2 makes a computed value whole-field CEL, and Decision 3 deletes the single brace. These three maps are computed values: each one becomes the callee's input. Until now each executor handed its map to the single-brace interpolator, so a `{token}` resolved there, and a CEL envelope written there reached the callee as the object `{ dialect: 'cel', source: '…' }` it spells, with the run reporting success.
+
+**What changes for a value that may be absent.** Where a whole token resolved to nothing, the template handed the callee nothing. A child flow then seeded its input variable from the variable's `defaultValue`. Under CEL an absent variable or key fails the run, and the guarded form `has(vars.x) ? vars.x : null` hands `null`. A `null` the caller supplies is a value: it wins over the child's `defaultValue`. To keep the default for an absent value, write it in the guard, `has(vars.x) ? vars.x : 'standard'`. Leave the key out where the value is never meant to be supplied. A `script` function is handed `null` where the template handed `undefined`. The refusal at those positions says this.
+
+## FROM → TO
+
+| you wrote | write instead | what changes |
+|:--|:--|:--|
+| `input: { ownerId: '{record.owner}' }` on a `subflow` | `input: { ownerId: { dialect: 'cel', source: 'record.owner' } }` | an absent `owner` fails the run; guarded, it hands `null`, which wins over the child's `defaultValue` |
+| `input: { ownerId: '{x}' }` where the child's default should apply when `x` is absent | `input: { ownerId: { dialect: 'cel', source: "has(vars.x) ? vars.x : 'standard'" } }` | the default is written in the guard, because a supplied `null` is not absent |
+| `input: { row: '{item}' }` on a `map` | `input: { row: { dialect: 'cel', source: 'item' } }` | evaluated once per item, with the item variable bound; a list or a record is handed over with its type |
+| `inputs: { lines: '{lines}' }` on a `script` | `inputs: { lines: { dialect: 'cel', source: 'lines' } }` | the function receives the list; guarded, an absent value is `null` where it was `undefined` |
+| `input: { message: 'Task "{record.title}" is done.' }` | `input: { message: { dialect: 'cel', source: "'Task \"' + record.title + '\" is done.'" } }` | one CEL concatenation; wrap a hole that may be null in `coalesce(…, '')` |
+
+**The one-line fix: write each value of a `subflow` / `map` `input` and a `script`'s `inputs` as a CEL value envelope, and write a child's default into the guard where it should apply.**
+
+**Who is affected, measured.** In this repository: 5 values in 3 nodes of the showcase example (`showcase_task_completed`'s `script`, and the `subflow` nodes of `showcase_task_done_notify_owner` and `showcase_project_closure`), 3 values in the todo example's `task_completion` `script`, 2 docs pages, the service-automation README, 2 dogfood fixtures and the test fixtures; all are migrated in this change. hotcrm's sites at these positions were not measured.
+
+**Still accepted, unchanged.** A CEL value envelope and every literal. The single-brace dialect keeps resolving where it still lives: a `map` or `loop` `collection`, a `filter` value, a `notify` `recipients` entry, an `http` body, a screen's `defaults`. The value-slot retirement's earlier changesets on this line list `subflow.input` among those positions; this one supersedes that line.
+
+### The kit
+
+- **The contract.** `SubflowConfigSchema.input`, `ScriptConfigSchema.inputs` and `MapConfigSchema.input` take `FlowValueSlotSchema` per value (`@objectstack/spec/automation`), so the executor's contract parse refuses a token as a guard. Each published JSON Schema declares the dropped refinement (`dropped-refinements.baseline.json`).
+- **The ledger.** `FLOW_NODE_EXPRESSION_PATHS` gains `subflow.input.*`, `map.input.*` and `script.inputs.*` (role `value`), and `LEDGER_DECLARED_NODE_CONFIG_SCHEMAS` carries `MapConfigSchema`. `registerFlow`, `objectstack validate` and `flow-bare-dollar-reference` / `flow-double-brace-interpolation`'s value-slot hints follow the ledger, so all of them cover the three maps.
+- **The executor.** One per-key resolver, shared with the CRUD `fields` map, evaluates an envelope through `AutomationEngine.evaluateValueEnvelope` in the parent's scope and run context.
+- **ADR-0087.** The step-18 D3 entry `flow-value-slot-template-dialect-refused` is amended. No key is removed, so there is no tombstone, and there is no D2 conversion.

content/docs/automation/flows.mdx

@@ -226,10 +226,13 @@ node renders the variable as any other: `message: '{{ digest }}'`, and it render
 the **evaluated** value.
 
 The same rules hold for the field values of `create_record` / `update_record`
-(below): the `assignments` map and the `fields` map are the flow's **value
-slots**, and each takes a CEL value envelope or a literal. Only a slot's
-top-level value is an expression — an object nested inside a JSON value or an
-array is data, whatever keys it carries.
+(below), and for the maps a node hands to a **callee**: a `subflow` node's and a
+`map` node's `input` (the child flow's input variables — on a `map`, evaluated
+once per item with the item variable bound) and a `script` node's `inputs` (the
+registered function's `input`). Those maps — `assignments`, `fields`, `input`,
+`inputs` — are the flow's **value slots**, and each value takes a CEL value
+envelope or a literal. Only a slot's top-level value is an expression — an
+object nested inside a JSON value or an array is data, whatever keys it carries.
 
 <Callout type="info" title="Where a malformed envelope is refused">
 
@@ -282,9 +285,19 @@ for some input, so the rewrite is yours to judge.
 
 No spelling is kept: a value slot reads no `{…}` token at all.
 
+**A callee's input: the guarded form supplies `null`.** In a `subflow` or `map`
+`input`, a whole token that resolved to nothing handed the child flow nothing,
+and the child seeded its input variable from the variable's `defaultValue`. The
+guarded form hands `null`, and a `null` the caller supplies is a value: it wins
+over the default. So where the child's default should apply to an absent value,
+write the default in the guard — `has(vars.x) ? vars.x : 'standard'` — or leave
+the key out of `input` where the value is never meant to be supplied. A `script`
+function is handed `null` there, where the template handed `undefined`. The
+refusal at those positions says so.
+
 **Where an envelope is data, the remedy names none there.** An envelope
-evaluates only as the top-level value of the `fields` map or the `assignments`
-map. Inside an object or list value, and in the two legacy `assignment` shapes
+evaluates only as the top-level value of a value slot's map — `fields`,
+`assignments`, or a callee's `input` / `inputs`. Inside an object or list value, and in the two legacy `assignment` shapes
 (an `assignments: [{ variable, value }]` array, variables as the config's own
 keys), it is stored as the object it spells — so the refusal there names what
 does evaluate:
@@ -399,8 +412,9 @@ The built-in `script` executor never evaluates an arbitrary JavaScript string 
 it **calls a registered function**, and that is the whole of what it does.
 
 **`config.function`** names a function registered through
-`defineStack({ functions })`, and it is **required**. `config.inputs` is
-`{var}`-interpolated and handed to it; `config.outputVariable` binds the
+`defineStack({ functions })`, and it is **required**. `config.inputs` is a value
+slot — each value a CEL value envelope evaluated against the flow's variables,
+or a literal — handed to it as its `input`; `config.outputVariable` binds the
 returned value as a flow variable, so a later declarative node persists it. A
 node that names no function refuses before it runs; one naming a function
 nothing registered fails the step loudly rather than passing silently.
@@ -439,7 +453,7 @@ compile error carrying the same prescription.
   label: 'Score Lead',
   config: {
     function: 'scoreLead',                  // registered via defineStack({ functions })
-    inputs: { rating: '{record.rating}' },  // {var} templates resolve against flow variables
+    inputs: { rating: { dialect: 'cel', source: 'record.rating' } },  // CEL value envelope, type kept
     outputVariable: 'leadScore',            // later: fields: { score: { dialect: 'cel', source: 'leadScore' } }
   },
 }
@@ -1210,6 +1224,7 @@ the map waits for that item's decision, then moves to the next.
     iteratorVariable: 'task',
     flowName: 'one_task_signoff',    // the per-item subflow (it may pause)
     itemObject: 'showcase_task',     // when an item is a record, it becomes the child's `$record`
+    input: { taskId: { dialect: 'cel', source: 'task.id' } }, // evaluated per item, `task` bound
     outputVariable: 'signoffResults',// each item's subflow output, collected in order
   },
 }

content/docs/kernel/runtime-services/examples.mdx

@@ -82,7 +82,7 @@ export const RollUpOrderTotals = defineFlow({
       label: 'Sum the lines',
       config: {
         function: 'sales.orderTotals',
-        inputs: { lines: '{lines}' },
+        inputs: { lines: { dialect: 'cel', source: 'lines' } }, // the list itself, type kept
         outputVariable: 'totals',
       },
     },

content/docs/references/automation/builtin-node-config.mdx

@@ -211,7 +211,7 @@ A value: a CEL value envelope `{ dialect: 'cel', source }` evaluated by the expr
 | **iteratorVariable** | `string` | optional (default: `"item"`) | Variable holding the current item |
 | **indexVariable** | `string` | optional | Optional variable holding the current index |
 | **itemObject** | `string` | optional | When items are records, the object they belong to (exposes each item as the child's record) |
-| **input** | `Record<string, any>` | optional | Params passed to each item's subflow (interpolated per item) |
+| **input** | `Record<string, any>` | optional | Params passed to each item's subflow, keyed by its input variables: each value a CEL value envelope `{ dialect: 'cel', source }` evaluated per item (the item variable is in scope), or a literal written as it is — a `{…}` template token is refused |
 | **outputVariable** | `string` | optional | Each item's subflow output, collected in order — bound to a name without a leading `$` (the `$` names are the flow engine's own), read as `{{ name }}` |
 
 

content/docs/references/automation/schemaless-node-config.mdx

@@ -163,7 +163,7 @@ const result = DecisionConditionSchema.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **function** | `string` | ✅ | Registered function to call (defineStack(`{ functions }`)). Contractually pure — it returns a value a later declarative node persists |
-| **inputs** | `Record<string, any>` | optional | Inputs passed to the function (values interpolate `{token}` templates) |
+| **inputs** | `Record<string, any>` | optional | Inputs passed to the function: each value a CEL value envelope `{ dialect: 'cel', source }` evaluated against the live flow variables, or a literal written as it is — a `{…}` template token is refused |
 | **outputVariable** | `string` | optional | Flow variable the function's return value is bound to — a name without a leading `$` (the `$` names are the flow engine's own), read as `{{ name }}` |
 | **actionType** | `never` | optional | [REMOVED] `script.config.actionType` was removed in @objectstack/spec 17 — none of its values did what it said. The two built-ins were logger-backed stubs that recorded the intent and delivered nothing under any configuration, and every other value was a second spelling of `config.function`. Replace it per branch: for `email` use a `notify` node (it delivers through the messaging service — the in-app inbox by default, real email once `@objectstack/plugin-email` is installed); for `slack` use a `connector_action` node with the Slack connector, or an `http` node posting to a webhook; for anything else, move the name into `config.function`. Run `os migrate meta --from 16` to list the mechanical edits for the shorthand case into `config.function`; `--write` applies the ones it can prove, and the stub and marker values are removed. |
 | **template** | `never` | optional | [REMOVED] `script.config.template` was removed in @objectstack/spec 17 — it fed only the logger-backed `email`/`slack` stubs, which never rendered or sent a message, so no template id was ever resolved. Delete the key. A `notify` node carries its own `title`/`message`, and stored templates live in the messaging service (`sys_notification_template`), not on the node. Run `os migrate meta --from 16` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand. |
@@ -181,7 +181,7 @@ const result = DecisionConditionSchema.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **flowName** | `string` | ✅ | Flow invoked as this step (it may pause — approval / screen / wait) |
-| **input** | `Record<string, any>` | optional | Values passed to the subflow's input variables (interpolate `{token}` templates) |
+| **input** | `Record<string, any>` | optional | Values passed to the subflow's input variables: each value a CEL value envelope `{ dialect: 'cel', source }` evaluated in the parent's scope, or a literal written as it is — a `{…}` template token is refused. A value handed over, null included, wins over the child variable's defaultValue |
 | **outputVariable** | `string` | optional | Parent flow variable the subflow's output is bound to — a name without a leading `$` (the `$` names are the flow engine's own), read as `{{ name }}` |
 
 

examples/app-showcase/src/automation/flows/index.ts

@@ -48,7 +48,14 @@ export const TaskCompletedFlow = defineFlow({
         // A flow function is PURE: it takes `inputs`, RETURNS a value, and a
         // later declarative node uses or persists it (#4396).
         function: 'summarizeCompletedTask',
-        inputs: { title: '{record.title}', priority: '{record.priority}' },
+        // Each input is a CEL value envelope (the `{…}` template dialect is
+        // retired from value slots). `priority` is optional and a task that
+        // never set it has no such key, which CEL refuses, so it is guarded;
+        // the function reads the `null` as "normal".
+        inputs: {
+          title: { dialect: 'cel', source: 'record.title' },
+          priority: { dialect: 'cel', source: 'has(record.priority) ? record.priority : null' },
+        },
         outputVariable: 'summary',
       },
     },
@@ -718,7 +725,7 @@ export const TaskDoneNotifyOwnerFlow = defineFlow({
         triggerType: 'record-after-update',
         condition: 'status == "done" && previous.status != "done"',
         // The SAME resume-time trap this flow's sibling hit (#7381): the node
-        // below hops `{record.project.owner}`, and a flow record carries
+        // below hops `record.project.owner`, and a flow record carries
         // `project` as a scalar FK. Un-hydrated it resolved to nothing, the
         // subflow's `notify` refused for want of a recipient, and every
         // completion of a task ran this flow to a failure. Unlike the invoice
@@ -733,9 +740,13 @@ export const TaskDoneNotifyOwnerFlow = defineFlow({
       label: 'Notify Owner',
       config: {
         flowName: 'showcase_notify_owner',
+        // CEL value envelopes, evaluated in this flow's scope and handed to the
+        // subflow's input variables. A project with no owner hands `null`, as
+        // the template's empty value did, and the subflow's notify then has
+        // no recipient — guarded, because CEL refuses the absent key.
         input: {
-          ownerId: '{record.project.owner}',
-          message: 'Task "{record.title}" is done.',
+          ownerId: { dialect: 'cel', source: 'has(record.project.owner) ? record.project.owner : null' },
+          message: { dialect: 'cel', source: `'Task "' + record.title + '" is done.'` },
         },
         outputVariable: 'notifyResult',
       },
@@ -843,7 +854,8 @@ export const ProjectClosureFlow = defineFlow({
       config: {
         flowName: 'showcase_closure_signoff',
         input: {
-          reason: 'Project "{record.name}" was marked completed — please sign off the closure.',
+          // A CEL concatenation — `name` is required on a project.
+          reason: { dialect: 'cel', source: `'Project "' + record.name + '" was marked completed — please sign off the closure.'` },
         },
         outputVariable: 'signoffResult',
       },

examples/app-todo/src/flows/task.flow.ts

@@ -366,10 +366,22 @@ export const TaskCompletionFlow: Flow = {
         // Registered in `defineStack({ functions })` — see objectstack.config.ts
         // and src/functions/task.functions.ts.
         function: 'computeNextTaskDueDate',
+        // CEL value envelopes, evaluated against the flow's variables — the
+        // `{…}` template dialect is retired from the function's `inputs` too.
+        // Each field may be absent from the completed task's row, and CEL
+        // refuses an absent key where the template handed nothing, so each is
+        // guarded: the function reads `null` exactly as it read the empty
+        // value (no due date → `null`, no interval → the field's default 1).
         inputs: {
-          dueDate: '{completedTask.due_date}',
-          recurrenceType: '{completedTask.recurrence_type}',
-          interval: '{completedTask.recurrence_interval}',
+          dueDate: { dialect: 'cel', source: 'has(completedTask.due_date) ? completedTask.due_date : null' },
+          recurrenceType: {
+            dialect: 'cel',
+            source: 'has(completedTask.recurrence_type) ? completedTask.recurrence_type : null',
+          },
+          interval: {
+            dialect: 'cel',
+            source: 'has(completedTask.recurrence_interval) ? completedTask.recurrence_interval : null',
+          },
         },
         outputVariable: 'nextDueDate',
       },