URL env switch to production/maintenance 500s and silently reverts — bare $location() undefined at onapplicationstart.cfc:488 when redirectAfterReload auto-enables #3054

What happens

?reload=production&password=<secret> — the exact flow documented in the security-hardening guide — never completes. The gate and switch code engage correctly, but the new application's cold start throws, returns a 500, and the next request reverts to the file-configured environment.

Reproduction (Lucee 7 docker harness, develop @ f668c50)

1. Demo app in development with set(reloadPassword="smokepw").
2. curl -s -o /dev/null -w "%{http_code} %{redirect_url}" 'http://localhost:60007/?reload=production&password=smokepw' → 302 http://localhost:60007/?reload=production&password=smokepw (params correctly preserved per app template: reload redirect strips the environment-switch params, making ?reload=<env> a silent no-op #3030).
3. Follow the redirect once: → HTTP 500 with the production "Something went wrong" page.
4. wheels_security.log shows the switch DID engage: Environment switched to 'production' via URL from <ip> + Reload accepted from <ip> (environment: production).
5. wheels-errors.log shows: No matching function [$LOCATION] found (reproduced twice, timestamps matching the switch attempts).
6. Next request: app cold-starts again back in development (/wheels/info?format=json → 200; no HSTS from SecurityHeaders). The switch never survives.

Control: ?reload=testing&password=smokepw switches cleanly end-to-end (302 → app serves in testing, /wheels/info 404s). This isolates the root cause to production/maintenance targets.

Root cause

1. vendor/wheels/events/init/orm.cfm auto-flips redirectAfterReload = true when the environment is production or maintenance (if (ListFindNoCase("production,maintenance", application.$wheels.environment)) { application.$wheels.redirectAfterReload = true; }).
2. With redirectAfterReload=true and url.reload present (always true on the env-switch cold start, because $buildRedirectUrl deliberately preserves reload+password for switches), vendor/wheels/events/onapplicationstart.cfc line 488 runs:

   $location(url = local.url, addToken = false);

3. onapplicationstart.cfc is component { with no extends and no mixins — $location() (defined in vendor/wheels/Global.cfc line 326) is not in scope. Every other helper call in this file goes through application.wo.$X(...); line 488 is the lone bare call. Lucee throws No matching function [$LOCATION] found, the application start aborts, and the engine discards the half-started app.

Why CI hasn't caught it

The non-dev smoke probes (#3044) boot directly into production/testing via environment.cfm; they never exercise the URL switch INTO production. The #3030/#3031 specs cover gate/flag resolution, not the post-switch cold start with redirectAfterReload=true.

Suggested fix

Change line 488 to application.wo.$location(url = local.url, addToken = false); (matching every other call in the file).

Acceptance criteria

• From development with a reloadPassword set, ?reload=production&password=<secret> ends with the app serving in production (e.g. /wheels/info 404, SecurityHeaders emits the HSTS auto-default), no 500 during the transition.
• Same for ?reload=maintenance.
• wheels-errors.log contains no No matching function [$LOCATION] entries during the flow.
• The redirectAfterReload=true + ?reload=true combination (explicitly set in development) also completes without throwing.
• Regression spec covering the redirectAfterReload code path in onapplicationstart.cfc (the bare-call-vs-application.wo discrepancy is exactly the class of bug a structural spec could guard, like BareCfabortGuardSpec).

Evidence gathered during the security-hardening guide behavioral audit (Lucee 7 + Adobe 2023 docker harness).

Reported via guides: deployment/production-config.mdx, deployment/security-hardening.mdx