Design: define, don't assign — untrusted keys are stored with define semantics, never through the __proto__ setter #2953

Summary

One rule for the write side of the prototype family: a value keyed by an externally-spellable name is stored with define semantics, never assignment semantics. Assignment (obj[key] = v, obj[key] ??= …, dst[k] = src[k] copy loops, Object.assign(dst, src)) goes through [[Set]], and for exactly one spelling — __proto__ — [[Set]] invokes the Object.prototype setter instead of creating an own property: a non-object value is silently ignored, an object value replaces the container's prototype. Three filed instances in three surfaces prove the class; this design adopts them as its phases and closes with an inventory audit.

This is the write-side counterpart of #2792 (read-side own-key lookups), whose design doc explicitly scoped this class out ("a different bug class with a different fix… a future design decides") and whose pass-23 assessment recorded the trigger: originate when a second write-side instance files after #2851. There are now three.

Design doc: files/designs/code-proto-write-side.md in the keep-the-four-repos-healthy goal workspace (problem, evidence, alternatives, risks, open questions).

The instances (audited at origin/main 106b0571)

• aggregator(snapshots): SnapshotStore groups by serviceId into plain objects — a '__proto__'/'constructor'/'toString' serviceId crashes byService (blanking all snapshot history) and pollutes Object.prototype during compact #2941 — aggregator snapshots (Phase 1, the polluting instance). SnapshotStore.byService() (pm-stack/aggregator/src/snapshots.ts:562-565) groups with (grouped[r.serviceId] ??= []).push(r) and compactInner() (:703-711) accumulates its report the same way; serviceId is validated only as a non-empty string (:303) and arrives from external feed jobs. A __proto__/constructor/toString id makes byService() throw (its only caller swallows the throw into {} — all snapshot history blanks, persistently, since the record passes validation and is stored), and compact() with a __proto__ id writes its counts onto Object.prototype itself (({}).before === NaN afterwards). The same file already groups with Map at appendLocked (~:620) and in compactRecordsToRollups — these two sites are outliers in their own file.
• aggregator(cost-explorer): a setup named '__proto__' is silently never saved — save/import assign into a plain object, so the name becomes the store's prototype instead of an entry #2851 — aggregator cost-explorer (Phase 2). Saved setups live in a plain object from localStorage (pm-stack/aggregator/src/render.ts:4338 save all[name] = …, :4359 import all[k] = parsed[k]). A setup named __proto__ is silently never saved; an imported one mutates the store object's prototype. Silent data loss both directions.
• record(loose): a '__proto__' field in loose text is silently dropped — parseLoose assigns into a plain object, so the field never reaches the JSONL line (the JSON path preserves it) #2828 — bin/record (Phase 2). parseLoose (bin/record.mjs:110) builds fields by assignment; a loose __proto__ field counts toward the keyed-segment threshold but never reaches the appended JSONL line — breaking record's never-lose-a-field contract for exactly the key an agent records while reporting this bug class. The JSON path preserves it (parse + spread = define semantics); the two paths disagree.

Decisions recorded

1. Preserve, don't reject. The key is data: a __proto__ field / setup name / serviceId is stored, listed, exported and re-read like any other key. (aggregator(cost-explorer): a setup named '__proto__' is silently never saved — save/import assign into a plain object, so the name becomes the store's prototype instead of an entry #2851's acceptance permits visible rejection for setup names; this design records preserve so all surfaces behave identically and aggregator(snapshots): SnapshotStore groups by serviceId into plain objects — a '__proto__'/'constructor'/'toString' serviceId crashes byService (blanking all snapshot history) and pollutes Object.prototype during compact #2941's already-stored records become readable instead of stranded. Validation-side rejection is also not the fix — aggregator(snapshots): SnapshotStore groups by serviceId into plain objects — a '__proto__'/'constructor'/'toString' serviceId crashes byService (blanking all snapshot history) and pollutes Object.prototype during compact #2941's acceptance already states the grouping fix must not depend on it.)
2. The prototype must not move — asserted as a test property: after any covered write, the container's prototype is unchanged (or null by design) and Object.prototype gains no own properties.
3. Accumulators are construction, not lookup. Grouping/counting sites are fixed by changing the container (Map, converted at the boundary via Object.fromEntries/spread), not by hasOwn guards — that is the boundary with design(own-key lookups): a plain object is not a map for untrusted keys — one own-key rule for every dynamic lookup #2792. (byService()'s crash is a ??= read, but its fix is container construction, so it lives here; design(own-key lookups): a plain object is not a map for untrusted keys — one own-key rule for every dynamic lookup #2792's Phase 3 audit should disposition it as covered by this design.)
4. One probe matrix everywhere: __proto__ with a string value and an object value (the setter treats them differently), constructor, toString, an ordinary key — asserting own-property presence, JSON round-trip preservation, and decision 2.

Phased breakdown

• Phase 1 = aggregator(snapshots): SnapshotStore groups by serviceId into plain objects — a '__proto__'/'constructor'/'toString' serviceId crashes byService (blanking all snapshot history) and pollutes Object.prototype during compact #2941 (aggregator snapshots): Map grouping in byService() + compactInner(), converted at the boundary. Lands first — the only instance that corrupts global state and blanks a whole surface, and its store may already hold a poisoned line.
• Phase 2 = record(loose): a '__proto__' field in loose text is silently dropped — parseLoose assigns into a plain object, so the field never reaches the JSONL line (the JSON path preserves it) #2828 + aggregator(cost-explorer): a setup named '__proto__' is silently never saved — save/import assign into a plain object, so the name becomes the store's prototype instead of an entry #2851 (silent loss at the edges): define-semantics construction in record.mjs's loose parser and in the cost-explorer save/import paths. Independent of Phase 1.
• Phase 3 = new issue (filed with this design): closing inventory audit — grep TS/JS/mjs (vendored assets and tests excluded) for the four non-conforming forms with dynamic keys, disposition each (covered / external-key → fixed here or filed as a named follow-up / internal-only → named in the closing evidence), state the contract in the app docs that already state contracts, and close this design with the evidence. Candidates already visible, to be dispositioned not pre-judged: antigravity-direct's schema walkers (merged[k], sub[name], props[name] — external tool-schema keys); provider-catalog-sync's report.providers[providerId] and (added[pid] ??= []); pkgs/id/web Object.assign(records, frame.records) (world.ts:181, a peer-supplied frame); sync-models' prov.models[baseId] family. Gated on Phases 1–2.

Phases 1–2 adopt the origin issues (no parallels — they carry explicit acceptance with verified probes and queued triage packets). Related, deliberately NOT adopted: today's read-side filings #2920 / #2919 (id/web) belong to #2792's Phase 3 audit — their fix is a read guard.

Open questions (stay in the design doc, not filed)

• Lint enforcement of define-semantics (false-positive rate known only after Phase 3's inventory — same deferred question as design(own-key lookups): a plain object is not a map for untrusted keys — one own-key rule for every dynamic lookup #2792's for reads).
• Recursive/deep-merge helpers, if Phase 3's audit finds one in-tree (none known).
• Cost-explorer storage-format change (per-name keys) — unnecessary once names are safe; revisit only if that format is revised for another reason.

Filed by the repo design architect (pass 24, 2026-10-31) for developing-today/code. Implementation phases are the linked sub-issues; phases with open questions stayed in the design doc.

Acceptance criteria

• The design doc (files/designs/code-proto-write-side.md, goal workspace) is adopted or amended with the decision recorded on this issue.
• Each filed write-side instance (the three surfaces named in the design, incl. aggregator(cost-explorer): a setup named '__proto__' is silently never saved — save/import assign into a plain object, so the name becomes the store's prototype instead of an entry #2851) is linked as a phase of this epic, with its fix approach stated in define-semantics terms.
• The closing inventory audit is posted: every externally-keyed write site in the prototype family is listed and dispositioned (define semantics, guarded, or filed as a follow-up).
• Read-side counterpart design(own-key lookups): a plain object is not a map for untrusted keys — one own-key rule for every dynamic lookup #2792 is cross-linked and the boundary between the two classes stays explicit.