This is caused by https://github.com/theforeman/foreman/blob/develop/app/services/foreman/parameters/caster.rb#L13:

@value = @options[:value] || @item.send(@options[:attribute_name])

which sets the wrong value if @options[:value] is false.

root@cfg01:~# foreman-rake console
For some operations a user must be set, try User.current = User.first
Loading production environment (Rails 3.2.21)
irb(main):001:0> c = Classification::ClassParam.new(:host => Host.find('cfg01.atl.dealnews.net'))
  Host::Managed Load (1.8ms)  SELECT "hosts".* FROM "hosts" WHERE "hosts"."type" IN ('Host::Managed') AND "hosts"."name" = 'cfg01.atl.dealnews.net' LIMIT 1
=> #<Classification::ClassParam:0x000000077765f8 @host=#<Host::Managed id: 1, name: "cfg01.atl.dealnews.net", last_compile: "2015-10-28 22:23:56", last_report: "2015-10-28 22:23:52", updated_at: "2015-10-28 22:24:22", created_at: "2015-10-28 17:23:08", root_pass: "", architecture_id: 1, operatingsystem_id: 1, environment_id: 1, ptable_id: nil, medium_id: nil, build: false, comment: "", disk: "", installed_at: nil, model_id: 1, hostgroup_id: 2, owner_id: 3, owner_type: "User", enabled: true, puppet_ca_proxy_id: 1, managed: true, use_image: nil, image_file: nil, uuid: nil, compute_resource_id: nil, puppet_proxy_id: 1, certname: "cfg01.atl.dealnews.net", image_id: nil, organization_id: nil, location_id: nil, type: "Host::Managed", otp: nil, realm_id: nil, compute_profile_id: nil, provision_method: nil, grub_pass: "", global_status: 0, lookup_value_matcher: "fqdn=cfg01.atl.dealnews.net">, @safe_render=#<SafeRender:0x00000007a1b6c8 @allowed_methods=[], @allowed_vars={:host=>#<Host::Managed id: 1, name: "cfg01.atl.dealnews.net", last_compile: "2015-10-28 22:23:56", last_report: "2015-10-28 22:23:52", updated_at: "2015-10-28 22:24:22", created_at: "2015-10-28 17:23:08", root_pass: "", architecture_id: 1, operatingsystem_id: 1, environment_id: 1, ptable_id: nil, medium_id: nil, build: false, comment: "", disk: "", installed_at: nil, model_id: 1, hostgroup_id: 2, owner_id: 3, owner_type: "User", enabled: true, puppet_ca_proxy_id: 1, managed: true, use_image: nil, image_file: nil, uuid: nil, compute_resource_id: nil, puppet_proxy_id: 1, certname: "cfg01.atl.dealnews.net", image_id: nil, organization_id: nil, location_id: nil, type: "Host::Managed", otp: nil, realm_id: nil, compute_profile_id: nil, provision_method: nil, grub_pass: "", global_status: 0, lookup_value_matcher: "fqdn=cfg01.atl.dealnews.net">}>>
irb(main):002:0> c.send(:values_hash)
  Environment Load (0.7ms)  SELECT "environments".* FROM "environments" WHERE "environments"."id" = 1 ORDER BY environments.name LIMIT 1
  Hostgroup Load (1.0ms)  SELECT "hostgroups".* FROM "hostgroups" WHERE "hostgroups"."id" = 2 ORDER BY hostgroups.title LIMIT 1
  Hostgroup Load (0.9ms)  SELECT "hostgroups".* FROM "hostgroups" WHERE "hostgroups"."id" IN (3, 1, 2) ORDER BY (case when hostgroups.ancestry is null then 0 else 1 end), hostgroups.ancestry
  SQL (0.8ms)  SELECT "config_groups".id FROM "config_groups" INNER JOIN "host_config_groups" ON "config_groups"."id" = "host_config_groups"."config_group_id" WHERE "host_config_groups"."host_id" = 3 AND "host_config_groups"."host_type" = 'Hostgroup' ORDER BY config_groups.name
  SQL (0.5ms)  SELECT "config_groups".id FROM "config_groups" INNER JOIN "host_config_groups" ON "config_groups"."id" = "host_config_groups"."config_group_id" WHERE "host_config_groups"."host_id" = 1 AND "host_config_groups"."host_type" = 'Hostgroup' ORDER BY config_groups.name
  SQL (0.5ms)  SELECT "config_groups".id FROM "config_groups" INNER JOIN "host_config_groups" ON "config_groups"."id" = "host_config_groups"."config_group_id" WHERE "host_config_groups"."host_id" = 2 AND "host_config_groups"."host_type" = 'Hostgroup' ORDER BY config_groups.name
  SQL (0.6ms)  SELECT "config_groups".id FROM "config_groups" INNER JOIN "host_config_groups" ON "config_groups"."id" = "host_config_groups"."config_group_id" WHERE "host_config_groups"."host_id" = 1 AND "host_config_groups"."host_type" = 'Host::Base' ORDER BY config_groups.name
  SQL (0.5ms)  SELECT "config_group_classes"."puppetclass_id" FROM "config_group_classes" WHERE 1=0
  SQL (0.6ms)  SELECT "hostgroup_classes"."puppetclass_id" FROM "hostgroup_classes" WHERE "hostgroup_classes"."hostgroup_id" IN (3, 1, 2)
  HostClass Load (0.5ms)  SELECT "host_classes".* FROM "host_classes" WHERE "host_classes"."host_id" = 1
  SQL (1.1ms)  SELECT DISTINCT puppetclasses.id FROM "puppetclasses" INNER JOIN "environment_classes" ON "puppetclasses"."id" = "environment_classes"."puppetclass_id" WHERE "environment_classes"."environment_id" = 1 AND "puppetclasses"."id" IN (115, 410, 404)
  SQL (2.6ms)  SELECT "lookup_keys"."id" AS t0_r0, "lookup_keys"."key" AS t0_r1, "lookup_keys"."created_at" AS t0_r2, "lookup_keys"."updated_at" AS t0_r3, "lookup_keys"."puppetclass_id" AS t0_r4, "lookup_keys"."default_value" AS t0_r5, "lookup_keys"."path" AS t0_r6, "lookup_keys"."description" AS t0_r7, "lookup_keys"."validator_type" AS t0_r8, "lookup_keys"."validator_rule" AS t0_r9, "lookup_keys"."key_type" AS t0_r10, "lookup_keys"."override" AS t0_r11, "lookup_keys"."required" AS t0_r12, "lookup_keys"."lookup_values_count" AS t0_r13, "lookup_keys"."merge_overrides" AS t0_r14, "lookup_keys"."avoid_duplicates" AS t0_r15, "lookup_keys"."use_puppet_default" AS t0_r16, "lookup_keys"."type" AS t0_r17, "lookup_keys"."merge_default" AS t0_r18, "environment_classes"."id" AS t1_r0, "environment_classes"."puppetclass_id" AS t1_r1, "environment_classes"."environment_id" AS t1_r2, "environment_classes"."puppetclass_lookup_key_id" AS t1_r3 FROM "lookup_keys" INNER JOIN "environment_classes" ON "environment_classes"."puppetclass_lookup_key_id" = "lookup_keys"."id" WHERE "lookup_keys"."override" = 't' AND "lookup_keys"."type" IN ('PuppetclassLookupKey') AND "environment_classes"."puppetclass_id" IN (115, 404, 410) AND "environment_classes"."environment_id" = 1 ORDER BY lookup_keys.key
  Setting Load (0.5ms)  SELECT "settings".* FROM "settings" WHERE "settings"."name" = 'Default_variables_Lookup_Path' ORDER BY name LIMIT 1
  Nic::Base Load (0.9ms)  SELECT "nics".* FROM "nics" WHERE "nics"."host_id" = 1 ORDER BY identifier
  Domain Load (0.9ms)  SELECT "domains".* FROM "domains" WHERE "domains"."id" = 1 ORDER BY domains.name LIMIT 1
  Setting Load (0.5ms)  SELECT "settings".* FROM "settings" WHERE "settings"."name" = 'host_group_matchers_inheritance' ORDER BY name LIMIT 1
  Operatingsystem Load (0.9ms)  SELECT "operatingsystems".* FROM "operatingsystems" WHERE "operatingsystems"."id" = 1 ORDER BY title LIMIT 1
  SQL (3.2ms)  SELECT "lookup_values"."id" AS t0_r0, "lookup_values"."match" AS t0_r1, "lookup_values"."value" AS t0_r2, "lookup_values"."lookup_key_id" AS t0_r3, "lookup_values"."created_at" AS t0_r4, "lookup_values"."updated_at" AS t0_r5, "lookup_values"."use_puppet_default" AS t0_r6, "lookup_keys"."id" AS t1_r0, "lookup_keys"."key" AS t1_r1, "lookup_keys"."created_at" AS t1_r2, "lookup_keys"."updated_at" AS t1_r3, "lookup_keys"."puppetclass_id" AS t1_r4, "lookup_keys"."default_value" AS t1_r5, "lookup_keys"."path" AS t1_r6, "lookup_keys"."description" AS t1_r7, "lookup_keys"."validator_type" AS t1_r8, "lookup_keys"."validator_rule" AS t1_r9, "lookup_keys"."key_type" AS t1_r10, "lookup_keys"."override" AS t1_r11, "lookup_keys"."required" AS t1_r12, "lookup_keys"."lookup_values_count" AS t1_r13, "lookup_keys"."merge_overrides" AS t1_r14, "lookup_keys"."avoid_duplicates" AS t1_r15, "lookup_keys"."use_puppet_default" AS t1_r16, "lookup_keys"."type" AS t1_r17, "lookup_keys"."merge_default" AS t1_r18 FROM "lookup_values" LEFT OUTER JOIN "lookup_keys" ON "lookup_keys"."id" = "lookup_values"."lookup_key_id" WHERE "lookup_values"."match" IN ('fqdn=cfg01.atl.dealnews.net', 'hostgroup=Production Environment/ATL/server_type_production', 'hostgroup=Production Environment/ATL', 'hostgroup=Production Environment', 'os=Ubuntu 14.04', 'domain=atl.dealnews.net') AND "lookup_values"."lookup_key_id" IN (SELECT "lookup_keys"."id" FROM "lookup_keys" INNER JOIN "environment_classes" ON "environment_classes"."puppetclass_lookup_key_id" = "lookup_keys"."id" WHERE "lookup_keys"."override" = 't' AND "lookup_keys"."type" IN ('PuppetclassLookupKey') AND "environment_classes"."puppetclass_id" IN (115, 404, 410) AND "environment_classes"."environment_id" = 1 ORDER BY lookup_keys.key) AND "lookup_values"."use_puppet_default" = 'f'
=> {1102=>{"puppet_service_name"=>{:value=>"puppetserver", :element=>"fqdn", :element_name=>"cfg01.atl.dealnews.net"}}, 1096=>{"strict_validation"=>{:value=>false, :element=>"fqdn", :element_name=>"cfg01.atl.dealnews.net"}}}

I suspect that Tomer is right, though.

missed the last debug command

=> [#<LookupValue id: 5, match: "fqdn=cfg01.atl.dealnews.net", value: "puppetserver", lookup_key_id: 1102, created_at: "2015-10-28 22:29:25", updated_at: "2015-10-28 22:29:25", use_puppet_default: false>, #<LookupValue id: 4, match: "fqdn=cfg01.atl.dealnews.net", value: false, lookup_key_id: 1096, created_at: "2015-10-28 22:24:12", updated_at: "2015-10-28 22:24:12", use_puppet_default: false>]

Ah good, that confirms to me that Tomer's spot on - it's picking up the override OK internally. Thanks both!