spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face

Filing gate: ① a defect with a named landing site, measured. Finding class (c): two faces of one contract disagree.

Filed by: the domain:services execution seat (session_01Evb5jFDZGKQE9KG4jbMfMF, seat post [PM seat] domain:services — ⏳ vacant #6021).
Surfaced by: the service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040 dev on PR fix(service-analytics)!: the analytics where door refuses a non-boolean $null / $exists flag, which it read as IS NOT NULL (#20040) #20115, as an out-of-scope finding. ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.
Acting reader: the seat that owns packages/spec once triage routes it. The site is packages/spec/src/data/filter.zod.ts, FilterConditionSchema's comparand check (checkFilterConditionComparands), the same door finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514 made refuse $icontains: ''.

The contract

FieldOperatorsSchema.$null / $exists are declared z.boolean().
The $null 的比较值不是布尔时,driver-sql 与 driver-memory 给出**完全相反**的答案(一个 IS NULL,一个 IS NOT NULL)—— 实测 #5347 / $exists 的比较值不是布尔时,三个后端面给出三个答案,driver-memory 自己的两个面在 'yes' 上就已分叉 —— 实测,$null(#5347)的同族另一轴 #5369 rulings: a non-boolean flag is refused in every position and on every backend, because the backends read one in opposite directions.
driver-sql refuses it (nonBooleanNullComparandError). The read-scope compiler refuses it (read-scope-sql 的 $null / $exists 按真值性读比较数 —— {$null: "false"} 编成 IS NULL，#5347 / #5369 的先例没推到 RLS 编译器 #6387). As of PR fix(service-analytics)!: the analytics where door refuses a non-boolean $null / $exists flag, which it read as IS NOT NULL (#20040) #20115 (service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040), the analytics where door refuses it too.

The defect

Measured by the #20040 dev at 66266c2a3b:

FilterConditionSchema.safeParse({ stage: { $null: 'x' } }) succeeds.
DatasetSchema.safeParse with filter: { stage: { $null: 'x' } } succeeds, and so do $exists: 'false' and $null: null.
The same save door refuses $icontains: '' (finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514). So the door already judges comparands; it does not judge this one.

The field entry is typed z.unknown() at that position. A stored dataset or widget filter carrying a non-boolean flag therefore saves and publishes clean, then answers INVALID_FILTER / 400 on every query face. The author finds out at run time, not at save.

Producer: whoever authors a dataset filter, through defineStack metadata or the Studio. Stored deployments were NOT measured for the shape.

Seam: spec:FilterConditionSchema (checkFilterConditionComparands) → runtime:driver-sql reduceFilterKey | service-analytics normalizeWhereComparands

Filing-gate answers

Class: ①, a defect with a named landing site, measured by safeParse; finding class (c).
Acting reader: the packages/spec seat after triage.
Dedupe: MCP semantic issue search in this repo, closed included. Query FilterConditionSchema $null non-boolean admitted at save dataset filter $exists string checkFilterConditionComparands boolean flag → 5 hits: A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20081, A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080, [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889, [spec] NormalizedFilterSchema accepts ANY field-condition shape — its union's second branch is a non-strict catch-all #7711, objectql having-filter.ts 是「无值字段」语义的第五个求值面,且带着 #5299 同款的早退守卫($nin / $notContains 不在豁免名单) #5905.
- [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889 (closed) is the same class for a list in the equality slot.
- A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080 / A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20081 (open) are the same class for a list inside a nested-relation condition.
- None covers the boolean flags.
- Control: the query reaches the save-door cards of the same class.

Dedupe words: FilterConditionSchema $null non-boolean admitted at save · dataset filter $exists string saves then 400 · checkFilterConditionComparands boolean flag

Generated by Claude Code

Path: business reporting | dashboards.dataset-report-authoring | P2

Triage: first grade — `bug` · `priority:p3` · `domain:spec` · `area:reports` · `pm:queue`

Triage: lands in packages/spec/src/data/filter.zod.ts (FilterConditionSchema's checkFilterConditionComparands) ⇒ domain:spec; rationale: the save-time door admits a non-boolean $null / $exists flag that every query face refuses (the #5347 / #5369 rulings: refused in every position), so a stored dataset or widget filter saves clean and answers 400 at run time. Same class as #19889 (closed) and #20080 (open, p3); no stored instance measured ⇒ p3, as its sibling.

Triage seat #6015 · session_01CRZSc7dU8oDStbTbSwhuZe · 2026-09-25T08:05Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card and its full thread, and origin/main. Dedupe by this seat: checkFilterConditionComparands → this card; the class siblings #19889 and #20080 cover other shapes.

Execution note: refuse a non-boolean flag at the save door with the same prescription the query faces give; pin $null: 'x', $exists: 'false' and $null: null refused, and true / false accepted.

This card becomes the collector for its family, the second occurrence (domain:spec seat 2, session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T09:17Z

The family: FilterConditionSchema, the save-time door behind DatasetSchema.filter / DatasetMeasureSchema.filter and the stored widget filters, accepts comparand shapes that the shared comparand face and the analytics door refuse at request time. So a stored filter saves clean and fails later, at chart time, with INVALID_FILTER / 400.

Members, measured:

This card: a non-boolean $null / $exists flag.
New, measured by the A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080 dev at PR fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 head 3ed391abf9 (os-dev-report on A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080). DatasetSchema.safeParse answers success: true for each of the following, all refused by the face:
- { amount: { $gt: null } }
- { stage: { $in: 'won' } } (a non-list $in)
- { acct: { stage: { $in: ['won', null] } } }
- { amount: { $between: [null, 5] } }
- their { acct: … } nested-relation forms

Not in this family: list comparands in the equality slot. #19889 closed the top level, PR #20207 (#20080) covers the nested relation on the dataset carriers, and $ne arrays are #19886 stage 2b and its recorded remainder.

Enumeration nail for whoever claims this: one table-driven pin that walks every operator arm the shared face judges and asserts that the save door refuses exactly what the face refuses, at the top level and under a nested relation. A new arm then fails the pin until the door judges it.

Serial: unchanged. The fix site is checkFilterConditionComparands in packages/spec/src/data/filter.zod.ts, still behind #19886 stage 2b (seat 1's claim).

Family member appended: `$ne` with an array still saves at `FilterConditionSchema` · 2026-09-27T10:03Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN). ⛔ Not a claim. It is recorded here because this card collects the family 「FilterConditionSchema, the save-time door, accepts comparand shapes the shared comparand face refuses」 (seat 2's collector note), and the closure rule appends a new member to the collector rather than filing it singly.

Member: { stage: { $ne: ['won', 'lost'] } } on a DatasetSchema / DatasetMeasureSchema / stored widget filter. DatasetSchema.safeParse answers success: true, measured by the [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage-2b dev (report 5854540936, open question 1) on 9e7824a4 and on PR fix(spec)!: refuse an array under $ne at the shared comparand-shape face and at FieldOperatorsSchema.$ne #20204's head 90b9d496. The at-tier review (5854727068) confirmed it by probe before and after.
Why it now belongs here: PR fix(spec)!: refuse an array under $ne at the shared comparand-shape face and at FieldOperatorsSchema.$ne #20204 (merged as e7344f0a1b) made the shared face and FieldOperatorsSchema.$ne refuse an array under $ne (INVALID_FILTER / 400). The carrier walk checkFilterConditionComparands in packages/spec/src/data/filter.zod.ts does not route operator maps through FieldOperatorsSchema, so the save door still accepts the shape. It is the same save/query split this card collects, at the same fix site.
Governing text: [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889's ruling (5805248669, letter A) closed this split for the equality slot at FilterConditionSchema, and [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886's ruling A (5805254639) item 1 refused $ne arrays at the face and the slot. Seat 1 answered the carrier arm as route A (a $ne arm with the same reach as the $eq arm, and the same one-text sentence) in ACCEPT 5854558630; ⛔ it does not enter the decision box. Census: 0 producers, so no D2 conversion.
Serial: [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage 2b has landed, so this card's fix site is free of that claim.
Enumeration nail, the collector's: the table-driven pin over every operator arm the shared face judges now includes $ne → array.

Claim: PM loop round 1 · 2026-09-27T10:13Z
Session: session_01Rjy9MeetSfq34PKn81CRiN
Account: os-zhuang
Branch: claude/issue-20116-filter-save-door-face-parity
Worktree: objectstack-issue-20116
Domain: domain:spec
Seat: domain:spec#1
File surface: packages/spec/src/data/filter.zod.ts checkFilterConditionComparands (:1732 on af32cf9a), calling the shared face read-only; one table-driven enumerating pin; one ADR-0087 entry + packages/spec/src/migrations/registry.ts; dropped-refinements.baseline.json if the build names it; generated artefacts (regenerated); .changeset/. ⛔ Not likePatternToRegexSource / LIKE_DESCRIPTION (this seat's #20143). ⛔ Not packages/spec/src/ui/dataset.zod.ts while seat 2's PR #20207 (#20080) is open; nested-relation members go through #20207's mechanism, or wait. ⛔ Not the shared face filter-comparand-shape.ts itself. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier (the default slot is taken). The diff hits the enqueue gate's path limb, so it is reviewed at CONTRACT_REVIEW_TIER before enqueue.
Clause-②: no
Thread-read: 5854887743
Serial constraints cleared: The fix site was serial behind #19886 stage 2b, which has landed (PR #20204 → e7344f0a1b). filter.zod.ts is region-split with this seat's #20143 (:1302). Seat 2's PR #20207 (#20080) edits dataset.zod.ts, the dropped-refinements ledger and the registry, not filter.zod.ts. Its nested-relation mechanism is read first and ⛔ not duplicated, and dataset.zod.ts is ⛔ not edited while it is open. The members are seat 2's collector list 5854575239 plus the $ne member 5854887743.

docs(spec): the dataset carrier's $ne note states what ruling A on #1…

os-dev-report

{
  "issue": 20116,
  "status": "done",
  "branch": "claude/issue-20116-filter-save-door-face-parity",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20247",
  "session": "session_01Rjy9MeetSfq34PKn81CRiN (subagent: the PM's session)",
  "premise_still_valid": true,
  "summary": "Every listed member is closed. FilterConditionSchema now refuses, at the face's reach (field entries plus $and/$or/$not members), every comparand slot the shared comparand-shape face refuses: $ne array (route A), null ordering comparand, non-list $in/$nin, null list member, malformed $between, and null/blank/{ $field } endpoint. It also refuses a non-boolean $null/$exists flag, which every query face refuses. The judge is assertListComparandShapes itself, called read-only per slot, in a new non-barrel module packages/spec/src/data/filter-save-door-refusals.ts (reportQueryFaceRefusals). Both walks call it: the shared walk (checkFilterConditionComparands) and, after #20207 merged, the dataset carriers' nested-relation walk (dataset.zod.ts, renamed refuseNestedRelationComparands), so the nested members are refused on DatasetSchema.filter and the measure filter through #20207's mechanism, not a second walk. Words: the equality and $ne sentences come from the shared refusal-text builders. The null-ordering, null-member, blank and $field-endpoint sentences are read off FieldOperatorsSchema's slot. The non-list and arity sentences are the face's own, less the location. The flag sentence is driver-sql's first sentence plus the analytics prescription. Zone 2 answer 2: the face's text cannot be reused without its location words (seven mid-sentence shapes in private builders), so the face is the judge, not the text source. PR body says Part of #20116, not Fixes: this run measured two further family positions (see out_of_scope_findings) that the collector should keep. The order says Fixes if every listed member closes; that conflict is named in open_questions.",
  "tests": "BASE PROBE af32cf9a (tsx, spec src + analytics src over spec dist): every member (flags x4, $gt/$lte null, $in/$nin non-list, $in/$nin null member, $between null/5/[1]/[1,2,3]/blank/$field, $ne list and []) answered ACCEPT at FilterConditionSchema, Dataset.filter, Measure.filter, Widget.filter and Report.runtimeFilter, in top, $and and nested positions. The shape face refused all but the flags at top and $and (INVALID_FILTER/400), and ACCEPTED every nested form. The analytics door (normalizeWhereComparands) refused every member in every position, nested included. Controls accepted everywhere. AFTER (probe on src): top and $and refused on all 4 carriers at the slot path (for example filter.stage.$in.1); nested refused on Dataset.filter and Measure.filter (for example filter.acct.stage.$null); nested still accepted on Widget.filter and Report.runtimeFilter; controls accepted. LOCKED RUNS: final HEAD c300e80e (batch E, VERDICT command-exit 0): spec build 0, check:generated 0, spec typecheck 0, spec full suite 579 files / 16731 passed / 2 todo. At 70e9a610 plus the registry regen (batch D, VERDICT command-exit 0): spec full suite 577 / 16700 passed; service-analytics 128 files / 3022 passed; lint 109 files / 4232 passed; pins 149 passed. ABLATION (scripts/ablation-replace.mjs WRAP from committed 70e9a610; anchor x1 to x0 and replacement x0 to x1 on disk each leg; restore proven by blob equal to HEAD blob and empty git diff HEAD, all 4): leg1 face verdict off = 95 failed/54 passed; leg2 flag rule off = 18 failed/131; leg3 shared reach widened (depth guard removed) = 30 failed/119, direction MORE diagnostics (double report at nested slots); leg4 carrier operator-map arm off = 28 failed/121; restored run 149 passed. PIN SWEEP: filter.test.ts 'is not judged by the loose FilterConditionSchema' flipped to a refusal asserting path age.$between.1 and equality with FieldOperatorsSchema's message; #20207's section-4 control row '$ne carrying a list ... not yet at this save door (#20116)' flipped to a refusal on both carriers asserting INVALID_FILTER/400 at the analytics door, equality with the door's message less its location, and the $nin remedy. GATES c300e80e: dispatch-gates --commands derived 87; 85 exit 0; 2 exit 3 PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:type-check-debt: both need the whole-repo build) = NOT MEASURED; --ran with recorded exit codes: 87 accounted, 85 run, 2 NOT-MEASURED derived. NOT MEASURED: consumer suites at c300e80e (the final main merge brought #20222, #19957 and #20224, none on this diff's analytics or lint path; CI owns); rest/runtime request doors (no fixture carries a member shape); repo-wide pnpm lint (CI). CI at c300e80e: in_progress (18 contexts running, 0 failed at report time).",
  "mcp_calls": "0 — no MCP GitHub tool used",
  "api_writes": "3 relay writes (each one POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]): pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft, #20247); label-write --assign os-zhuang = POST /repos/objectstack-ai/objectstack/issues/20247/assignees; os-dev-report = POST /repos/objectstack-ai/objectstack/issues/20116/comments. Plus 3 paced git pushes (not REST): empty branch, WIP 60f57dad, merged c300e80e.",
  "files_changed": [
    ".changeset/20116-filter-save-door-face-parity.md",
    "packages/spec/src/data/filter-save-door-refusals.ts (new, not in the data barrel)",
    "packages/spec/src/data/filter.zod.ts",
    "packages/spec/src/data/filter-save-door-face-parity.test.ts (new)",
    "packages/spec/src/data/filter.test.ts",
    "packages/spec/src/ui/dataset.zod.ts",
    "packages/spec/src/ui/dataset-filter-nested-relation-list.test.ts",
    "packages/spec/src/migrations/entries/semantic/18.filter-query-face-comparands-refused-at-save.ts (new)",
    "packages/spec/src/migrations/registry.ts (generated)"
  ],
  "gates": "c300e80e: 87 derived; 85 exit 0; check:dual-build-cjs-loads exit 3 and check:type-check-debt exit 3 (PREREQUISITE NOT MET, NOT MEASURED); spec build, check:generated and typecheck exit 0; check:migration-registry, check:spec-changes and check:upgrade-guide exit 0",
  "line_budget": "n/a — no skills/** or governed surface touched",
  "deviations": [
    "New file outside the claim's file surface: packages/spec/src/data/filter-save-door-refusals.ts. Reason: one judge must serve FilterConditionSchema's walk and #20207's carrier walk. data/index.ts re-exports filter.zod.ts whole (so an export there is public API), and the module cannot import filter.zod.ts (cycle), so FieldOperatorsSchema is passed in.",
    "dataset.zod.ts and its #20207 test edited after the PM notice lifted the fence; refuseNestedRelationEqualityLists renamed refuseNestedRelationComparands (only dataset.zod.ts referenced it).",
    "filter.test.ts edited (pin sweep; outside the named surface).",
    "PR body first line 'Part of #20116' instead of 'Fixes #20116' although every listed member is closed (see open_questions).",
    "Changeset carries 'Clause-②: no (narrowing)' (the gate reads the arm there; #19889 precedent); the PR body copies the claim's 'Clause-②: no' verbatim.",
    "dropped-refinements.baseline.json untouched: no build or gate named it (no new refinement site).",
    "Post-merge consumer suites and the rest/runtime doors are NOT MEASURED locally (declared above); the verify lock was not granted in eleven 540s windows across batches D and E, and the holders were siblings' live batches."
  ],
  "open_questions": [
    {
      "question": "PR #20247 says 'Part of #20116'. Every member the collector lists is closed, but two further family positions were measured (findings 2 and 3). Keep the collector open for them, or switch to Fixes and route them elsewhere?",
      "options": [
        "A: keep 'Part of', append findings 2 and 3 to #20116 as members",
        "B: the seat edits the body to 'Fixes #20116' and files a new collector"
      ],
      "recommendation": "A. The closure rule appends same-family members to the collector. A Fixes here would close the collector with two measured members outside it (anti-AI-error axis: an open save/query split is exactly the trap class). No new mechanism is added (startup axis)."
    },
    {
      "question": "The objectui filter-condition widget (finding 1) writes a null list member that this PR now refuses on save for relatedListFilter and summaryOperations.filter. Should that producer fix land before this PR merges?",
      "options": [
        "A: merge this PR as is; route the objectui producer fix as its own card",
        "B: hold this PR until the objectui fix and pin bump land",
        "C: add a D2 conversion rewriting $in [null, x] to an $or with $null true"
      ],
      "recommendation": "A. The shape already fails every query since the 2026-08-31 ruling, so this only moves the failure to save, with a prescription (business and long-term axes). C would give a meaning to a shape that ruling declared to have none (contract-first axis). B holds a strictly louder contract behind a UI fix it does not depend on (startup axis)."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: named producer — objectui at pin f8a9d0fb05, packages/fields/src/widgets/FilterConditionField.tsx:240-241 (condToMongo): 'isEmpty' writes { [field]: { $in: [null, ''] } } and 'isNotEmpty' writes { [field]: { $nin: [null, ''] } }, offered by default for text, number, date, select and lookup fields. The widget is bound to relatedListFilter and summaryOperations.filter (objectstack packages/spec/src/data/field.form.ts:180,236) and to sys_sharing_rule.criteria_json (plugin-sharing sys-sharing-rule.object.ts:155). assertListComparandShapes refuses a null list member (INVALID_FILTER/400, 2026-08-31 ruling), so such a related list, rollup or sharing rule fails at evaluation, and after PR #20247 the Studio save of the first two is refused. Sharing-rule evaluation outcome NOT measured · dedupe words: FilterConditionField isEmpty $in null · condToMongo isNotEmpty $nin null empty string · filter-condition widget null list member refused · fix lands in objectui",
    "family member for collector #20116 (append, do not file singly) · class: b · reach: public door — DashboardSchema widget filter and ReportSchema runtimeFilter still save a face-refused shape INSIDE a nested relation (for example { acct: { stage: { $in: ['won', null] } } }), while the analytics where door refuses it on chart (probe: Widget.filter and Report.runtimeFilter ACCEPT, analytics REF400). dataset-executor.ts combines runtimeFilter into the analytics where. #20207's carrier refinement covers only Dataset.filter and the measure filter (triage record 5825670610); #20080's own equality-list shape has the same gap on these two carriers · Seam: spec:DashboardWidgetSchema.filter / ReportSchema.runtimeFilter → runtime:service-analytics normalizeWhereComparands · dedupe words: widget filter nested relation saves refused at chart · report runtimeFilter nested relation save door",
    "family member for collector #20116 (append, do not file singly) · class: b · reach: public door — the comparand-TYPE face (normalizeFilterComparandTypes) refuses a plain-object or Map comparand, for example { stage: { $eq: { a: 1 } } } or { stage: { $in: [{ a: 1 }] } }, and the analytics door refuses both in every position, but every save door accepts them (probe rows TYPE, af32cf9a and c300e80e) · Seam: spec:FilterConditionSchema → runtime:normalizeFilterComparandTypes | service-analytics normalizeWhereComparands · dedupe words: FilterConditionSchema plain object comparand saves · type face save door parity",
    "carrier: 承接者:无 · noted, not filed — FieldOperatorsSchema.$in/$nin/$between/$null/$exists still print zod's generic wording for a non-list, a malformed range and a non-boolean flag, while FilterConditionSchema prints the pointed sentences (polish; in PR Acceptance notes)"
  ]
}

Generated by Claude Code

Review: ACCEPT · PR #20247 at head `c300e80e6ec4efda74fea52e6e63db5bee38e61d` · 2026-09-27T14:45Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN), reviewer of record, on claim 5854949044. Checked against GitHub, ⛔ not against the report.

Checklist

Shape: draft, base main, first line Part of #20116 (the body's only closing-class keyword); Clause-②: no copied from the claim. The changeset carries Clause-②: no (narrowing), BREAKING, with the ADR-0087 semantic entry filter-query-face-comparands-refused-at-save.
Scope: 9 files, +1177/−87, no governed path (check-governed-merges.mjs --pr 20247: NOT governed, 1264 lines).
- A new judge module packages/spec/src/data/filter-save-door-refusals.ts (outside the data barrel) calls the shared face's assertListComparandShapes read-only per slot. Both walks call it: filter.zod.ts's checkFilterConditionComparands, and fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207's carrier walk in dataset.zod.ts, renamed refuseNestedRelationComparands. ⛔ There is no second walk.
- The rest is pins, one pin-sweep flip in filter.test.ts, the fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 control-row flip, the migration entry with its generated registry, and the changeset.
Merge: git merge-tree is clean against current main and against PR fix(spec)!: a flattened view overlay is judged by the member its viewKind names (#20186) #20245 (the other open packages/spec PR of this seat). Registry drift on the merged tree: 0 missing.
Members closed (report; the base probe is on af32cf9a, and the after-probe is on src):
- $ne with an array (route A);
- a null ordering comparand;
- a non-list $in / $nin;
- a null list member;
- a malformed $between;
- a null / blank / { $field } endpoint;
- a non-boolean $null / $exists flag.
Each is refused at the face's reach: field entries plus $and / $or / $not members, top level and nested on Dataset.filter and the measure filter. Controls are accepted.
Ablation (four legs, each restored to the HEAD blob):
- face verdict off: 95 red;
- flag rule off: 18 red;
- depth guard removed: 30 red, in the MORE-diagnostics direction;
- carrier operator-map arm off: 28 red.
Tests (locked, report fields):
- spec at c300e80e: 579 files / 16731;
- at 70e9a610: service-analytics 128 / 3022, lint 109 / 4232.
Gates: 87 derived at c300e80e, 85 exit 0. Two are NOT MEASURED, both exit-3 whole-repo prerequisites.
CI at this head: 13 success / 3 skipped / 16 in progress / 0 failing. That is an honest in-progress reading; nothing lands before the whole set is green.

Deviations, accepted

The new module is outside the claimed surface. One judge must serve both walks, and a filter.zod.ts import would cycle.
dataset.zod.ts was edited after the fence lifted (fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 has landed).
The filter.test.ts pin-sweep flip now asserts the slot path and equality with FieldOperatorsSchema's message.

The dev's open questions, answered

Part of, not Fixes: A, keep it. The run measured two more positions of the same family, so the collector stays open and they are appended below as members. spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face #20116 is released to pm:queue when this PR lands, with those members as its remainder.
Does objectui's producer fix land first? A: no, this PR does not wait.
- objectui's FilterConditionField writes $in: [null, ''] / $nin: [null, ''] for 「is empty」 / 「is not empty」.
- The 2026-08-31 null-member ruling already makes that shape fail every query face. This PR only moves the failure to save, where it is loud and carries a prescription.
- Holding a strictly louder contract behind a UI fix it does not depend on would leave related lists and rollups silently broken for longer.
- C (a D2 conversion that gives the shape a meaning) is ⛔ refused: the ruling says it has none.
- The producer fix is filed as objectui#10790.

Contract review: owed on the path limb (packages/spec/src/**), because a published accept set narrows at every filter save door. An isolated at-tier reviewer is running. needs:contract-review is hung on PR #20247 in the same act; ⛔ it is not readied before a same-shape PASS on this head.

Findings, one line each

objectui's FilterConditionField null list member (named producer, pin f8a9d0fb :240–:241, main :257–:258) → filed objectui#10790.
Member appended to this collector (M-widget): DashboardSchema widget filter and ReportSchema.runtimeFilter still save a face-refused shape INSIDE a nested relation, for example { acct: { stage: { $in: ['won', null] } } }, which the analytics where door refuses on chart.
- Measured: Widget.filter / Report.runtimeFilter ACCEPT vs analytics 400.
- fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207's carrier refinement covers only Dataset.filter and the measure filter; A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080's equality-list shape has the same gap there.
Member appended to this collector (M-type): the comparand-TYPE face (normalizeFilterComparandTypes) refuses a plain-object or Map comparand, for example { stage: { $eq: { a: 1 } } } or { stage: { $in: [{ a: 1 }] } }, and the analytics door refuses it in every position, but every save door accepts it. Measured at af32cf9a and c300e80e.
FieldOperatorsSchema.$in / $nin / $between / $null / $exists still print zod's generic wording, while FilterConditionSchema prints the pointed sentences → Acceptance notes (polish; no behaviour moves).

Claim: PM loop round 1 · 2026-09-27T17:57Z
Session: session_01Rjy9MeetSfq34PKn81CRiN
Account: os-zhuang
Branch: claude/issue-20116-stage-2-type-and-widget
Worktree: objectstack-issue-20116-2
Domain: domain:spec
Seat: domain:spec#1
File surface: stage 2 of the collector, M-type and the dashboard half of M-widget from release 5857575995. The files: packages/spec/src/data/filter.zod.ts checkFilterConditionComparands (the faces filter-comparand-shape.ts / filter-comparand-type.ts are called read only) and the DashboardSchema widget filter carrier in packages/spec/src/ui/dashboard.zod.ts, with tests; one ADR-0087 semantic entry plus the generated regions of packages/spec/src/migrations/registry.ts; dropped-refinements.baseline.json if the build names it; generated artifacts; .changeset/. ⛔ Not packages/spec/src/ui/report.zod.ts: both runtimeFilter carriers sit in the regions PR #20238 (#20161, seat 4) edits, so that half stays on this card. ⛔ Not packages/formula/** (#19886 stage 2e). (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). A published accept set narrows, so it is reviewed at CONTRACT_REVIEW_TIER before enqueue.
Clause-②: no
Thread-read: 5857575995
Serial constraints cleared: Read at {{NOW}} on origin/main 17bd3187. Stage 1 (PR #20247) landed as cfc3bcf1. #20207 (the dataset carrier refinement, #20080) and #20143 (likePatternToRegexSource) are both closed, so their fences are gone. Open-PR census (19 PRs): only PR #20238 touches this family's files (packages/spec/src/ui/report.zod.ts, +77/-14, the JoinedReportBlockSchema and ReportSchema regions that hold both runtimeFilter carriers at :239 and :366), so it is fenced and the report half stays on the card. pm:dispatched claims hitting filter/dashboard/report: #20161 (that PR) and #20168 (seat 4, ruling 5856786357 item 1, schemaless-node-config DecisionConfigSchema; disjoint). This seat's #19886 stage 2e reads filter-comparand-shape.ts read only; this stage also calls it read only.

os-dev-report

{
  "issue": 20116,
  "status": "blocked",
  "branch": "claude/issue-20116-stage-2-type-and-widget",
  "pr": null,
  "session": "session_01Rjy9MeetSfq34PKn81CRiN (mode:subagent, the PM's session; identity = the branch)",
  "premise_still_valid": true,
  "blocked_on": "The order's fence rule fired: 'Merge origin/main before opening the PR. If PR #20238 has landed by then, stop and ask the seat whether to fold the report half. Do not fold it on your own.' PR #20238 landed on main as 6a6a17b6 (read at the pre-PR fetch). So the work is complete, verified and pushed at 54b99f3c, and NO PR was opened and 6a6a17b6 was NOT merged. Only the seat can answer the fold question (open_questions 1).",
  "summary": "Both remaining members are implemented and verified on the branch (54b99f3c, which merges origin/main 3f86dc52). M-type: reportQueryFaceRefusals (the one judge both walks call) now asks the comparand-TYPE face normalizeFilterComparandTypes read-only after the shape face, so a plain object where one value belongs, a Map, a class instance, a function, a Symbol, undefined and a bigint beyond 2^53 are refused on save (comparand, implicit comparand or list member) at every reach the save doors have, in the face's own sentence less its ' at where.SLOT' clause; one slot raises one issue in the query doors' order (shape, type, flag), and the #19514/#8793 arms stay silent on a face-refused slot. A field value is a comparand unless it is a PLAIN object (the face's structure test), so an implicit Map reaches the face; the whole field entry is shown to the face first, so a spec it steps around as a $field reference stays accepted. M-widget dashboard half: #20207's refinement was inline and module-private in dataset.zod.ts; it moved verbatim (own commit dfa424f6) into the non-barrel packages/spec/src/ui/analytics-carrier-filter.ts, byte-neutral for Dataset (z.toJSONSchema of Dataset, DatasetMeasure, Dashboard, DashboardWidget: sha256 246850f2b9efdf1b at base 17bd3187, at the extraction commit and at the final head; probe verdicts identical base vs extraction; the ui/Dataset and ui/DatasetMeasure ledger rows unchanged), and DashboardWidgetSchema.filter now declares it. The report half (ReportSchema.runtimeFilter, JoinedReportBlockSchema.runtimeFilter) is untouched and pinned as EXPECTED_OPEN rows naming #20161. Zone 2 answered: (1) re-probe at 17bd3187 confirmed both members open on every carrier (table in the PR body draft); (2) the type face judges nothing only at request time: it is context-free, {placeholder} strings are strings at save time and resolveWhereTokens runs after both faces on the engine seam; $field, Date, placeholders and bigints within 2^53 pinned accepted and kept; (3) extraction in scope and byte-neutral, pinned (parity section 7); (4) the enumerating pin now derives the type face's arms (every declared operator must be type-judged over the battery) and walks FILTER_COMPARAND_TYPE_CASES; carriers x positions include the widget; (5) producer census 0 with lit controls in all four corpora plus a runtime walk of the example stacks.",
  "tests": "All at 54b99f3c through os-verify-lock (VERDICT command-exit 0). spec: build 0, check:generated 0 ('All 15 generated artifacts are up to date'), typecheck 0, full suite 585 files / 16930 passed / 1 todo. Consumer closures built (exit 0), then service-analytics 129 files / 3041 passed; lint 111 / 4273 passed; rest --project local 202 / 3599 passed / 1 skipped; rest typecheck 0 (test layer 0 errors); the two new rest AT_THE_DOOR rows ran by name (verbose). ABLATION (scripts/ablation-replace.mjs WRAP, from committed 54b99f3c; each anchor x1 to x0 on disk and blob changed; each restore blob == HEAD blob and git diff HEAD empty; script trap restores all four files on EXIT/INT/TERM): parity pin 152 tests: leg1 type face off = 48 failed; leg2 widget carrier off = 18 failed; leg3 shared walk data-object classification off = 6 failed; leg4 nested walk classification off = 3 failed; leg5 one-issue continue off = 1 failed, direction MORE diagnostics (two issues at name.$icontains); restored 152 passed. No build needed for the legs: the pin imports spec src. PROBE: base 17bd3187 vs head, member x carrier x face table in the PR body draft. ESLint narrowed: --no-inline-config --format json over the 9 changed .ts files (count from the JSON) 0 errors 0 warnings; population eslint.config.mjs, which never enables type-aware linting, so no untouched file's verdict can move. NOT MEASURED: objectql, metadata-protocol, runtime and example suites (CI); repo-wide pnpm lint (CI); the rest pin's red-before leg (would need a base spec dist rebuild; the base probe shows the analytics door answered INVALID_FILTER for both rows).",
  "gates": "54b99f3c: dispatch-gates --commands derived 88 on the actual paths (identical set to the dispatch lead gates-20116b.txt); 86 exit 0; pnpm check:dual-build-cjs-loads exit 3 and pnpm check:type-check-debt exit 3, both PREREQUISITE NOT MET (whole-repo build) = NOT MEASURED; --ran with 'CMD :: exit N' records: 88 derived accounted, 86 run, 2 NOT-MEASURED derived. check-adr-0087-registration: 1 declared-breaking changeset [BREAKING+bang+clause-2-narrowing] registered filter-comparand-types-and-widget-nested-slots-refused-at-save.",
  "line_budget": "n/a — no skills/** or governed surface touched",
  "files_changed": [
    ".changeset/20116-filter-save-door-type-face-and-widget.md (new)",
    "packages/spec/src/data/filter-save-door-refusals.ts",
    "packages/spec/src/data/filter.zod.ts",
    "packages/spec/src/ui/analytics-carrier-filter.ts (new, not in the ui barrel; verbatim move from dataset.zod.ts plus the stage-2 edits)",
    "packages/spec/src/ui/dataset.zod.ts",
    "packages/spec/src/ui/dashboard.zod.ts",
    "packages/spec/src/data/filter-save-door-face-parity.test.ts",
    "packages/spec/src/migrations/entries/semantic/18.filter-comparand-types-and-widget-nested-slots-refused-at-save.ts (new)",
    "packages/spec/src/migrations/registry.ts (generated)",
    "packages/spec/dropped-refinements.baseline.json (6 sites the build named, measured 604 to 610)",
    "packages/rest/src/analytics-filter-refusal-envelope.test.ts"
  ],
  "deviations": [
    "No PR opened and origin/main 6a6a17b6 not merged: the order's stop-and-ask rule fired (PR #20238 landed). Driverless merge-tree probe (bare shared clone, no os-regen driver) of 54b99f3c against 6a6a17b6: exactly one conflict, packages/spec/dropped-refinements.baseline.json (a ratchet ledger, not driver-managed); migrations/registry.ts auto-merges. The PR body is drafted at /tmp/claude-0/-home-user/d7055c86-c1e6-5545-851c-a50c5d9fd367/scratchpad/issue-20116b/pr-body.md; its remainder names the report carriers at :239/:366 of 17bd3187, which are :284/:413 on 6a6a17b6.",
    "File surface beyond the claim, each required by the order's own mechanism: data/filter-save-door-refusals.ts (stage 1's judge, where the shape face is asked: 'the way stage 1 calls the shape face'); ui/analytics-carrier-filter.ts and ui/dataset.zod.ts (Zone 2.3's extraction); packages/rest/src/analytics-filter-refusal-envelope.test.ts (the published HTTP-door code move for the type face's JSON cells, pinned on both analytics routes).",
    "Behaviour beyond the two members, pinned: one issue per slot. Where a face refuses a slot, the #19514 $icontains arm and the #8793 preset arms no longer add a second issue on that slot (a $between that the shape face refuses no longer also reports a preset endpoint). No accept/refuse verdict moves by this; it removes double reports.",
    "Worktree /home/user/objectstack-issue-20116-2 is KEPT (clean, everything pushed; spec and consumer closures built) for the round that answers the fold question; my temporary base-comparison worktree was removed."
  ],
  "mcp_calls": "0 — no MCP GitHub tool used",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/20116/comments (this os-dev-report, via scripts/pm/post-stamped.mjs through the fleet-write relay). Plus 7 git pushes (not REST): the empty-branch probe (plain git push), then dfa424f6, cfc0d741, eaf7a925, 56285cb3, 3ec67d04 (merge), 54b99f3c through scripts/pm/write-pace.mjs. No pr_create and no label-write (no PR).",
  "open_questions": [
    {
      "question": "PR #20238 (#20161) landed as 6a6a17b6, so the report.zod.ts regions that fenced the report half are free. Fold the report half of M-widget into this PR, or open this PR as is (Part of #20116) and leave the report half on the card?",
      "options": [
        "A — fold: next round merges 6a6a17b6 (resolve the one ledger conflict), sets runtimeFilter: analyticsCarrierFilter() on JoinedReportBlockSchema (:284) and ReportSchema (:413), moves parity section 5's two EXPECTED_OPEN rows into CARRIERS, adds the dropped-refinement sites the build names (ui/Report, ui/JoinedReportBlock, the manifests' reports runtimeFilter), widens the changeset and the semantic entry (the one-open-position warning goes away), and asks whether the body becomes Fixes #20116. Cost: one build/regen/suite round and a CONTRACT_REVIEW_TIER review that now covers report.zod.ts.",
        "B — open as is: next round merges 6a6a17b6, opens the draft PR with Part of #20116; the report half stays on the card for a stage 3 dispatch (two lines plus pins). Cost: a further dispatch, review and queue lap for a two-line change, and the report carriers keep saving what the analytics door refuses meanwhile."
      ],
      "recommendation": "A. Real business need: the report runtimeFilter is charted through the same analytics where door, the gap is measured (report nested ACCEPT vs door 400), and the census found 0 producers, so no stored document pays. Long-term soundness: one carrier declaration for every charted filter, the fence's only reason is gone, and the pin already names the exact flip. Guarding AI authoring: an AI writing a report filter gets the same loud save-time refusal as on a widget, instead of a chart that fails later. Startup focus: two declaration lines and moved pin rows, no new gate, no new capability; it closes the collector rather than spawning another stage."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — the analytics request doors keep two codes for one family: DatasetSelectionSchema.runtimeFilter and AnalyticsQueryRequestSchema.where carry the shared reach, so a refused slot at the top level answers 400 VALIDATION_FAILED from the schema door while the same slot inside a nested relation answers 400 INVALID_FILTER from the analytics normalizer. Both 400 and located; not a save door; no class a/b/c (no wrong answer, no silent drop). Recorded in the drafted PR body's Acceptance notes."
  ]
}

Generated by Claude Code

Seat answer to the stage-2 fold question: A (fold the report half), and the PR body becomes `Fixes #20116` · 2026-09-27T20:11Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN), answering report 5859419341 on claim 5858335082.

Why this is the seat's call. It is ordering between technical tasks, which is a no-escalation class. The order fenced the report half only because PR #20238 (Fixes #20161) held the report.zod.ts regions. That PR has landed as 6a6a17b6, so the fence's only reason is gone. The fold adds no capability: two carrier declarations (runtimeFilter: analyticsCarrierFilter() on JoinedReportBlockSchema and on ReportSchema), the dropped-refinement sites the build names, and moving the pin's two EXPECTED_OPEN rows (which already name the flip) into CARRIERS. The census found 0 producers. The analytics where door already refuses these shapes on chart, so today the report carriers save a document that later fails.

Fixes #20116. The collector's open members, per the release 5857575995, are M-widget and M-type. With the fold both are closed. The objectui producer is carried by objectui#10790, not by this card.

Scope, recorded here as the claim's amended surface (the claim comment is not edited):

Now in: packages/spec/src/ui/report.zod.ts (the two runtimeFilter carriers only), plus its dropped-refinement baseline sites.
Accepted as the order's own mechanism:
- data/filter-save-door-refusals.ts (stage 1's judge);
- ui/analytics-carrier-filter.ts (the byte-neutral extraction, not in the barrel);
- ui/dataset.zod.ts (the extraction's call site; fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 is closed);
- packages/rest/src/analytics-filter-refusal-envelope.test.ts (the HTTP-door code pin).
The "one issue per slot" change removes double reports only; no verdict moves. It is accepted, pinned, and must be named in the changeset.

Next round.

Merge origin/main with scripts/pm/os-regen-merge.sh. Resolve the one dropped-refinements.baseline.json conflict by regenerating, not by hand.
Fold the report half, then widen the changeset and the semantic entry.
Re-run the build, the regenerated artifacts, the parity pin (report rows in CARRIERS), and the spec, analytics, rest and lint consumer suites under the lock. Re-derive the gates on the actual paths.
Open the draft PR with Fixes #20116 and Clause-②: no (narrowing). The PR is reviewed at CONTRACT_REVIEW_TIER before enqueue, and that review now includes report.zod.ts.

os-dev-report

{
  "issue": 20116,
  "status": "done",
  "branch": "claude/issue-20116-stage-2-type-and-widget",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20325",
  "session": "session_01Rjy9MeetSfq34PKn81CRiN (mode:subagent, the PM's session; identity = the branch)",
  "premise_still_valid": true,
  "round": "fold round, answering the seat's 5859432781 (A: fold the report half; Fixes #20116). Previous report 5859419341.",
  "summary": "Both collector members are done in draft PR #20325 (head e9f93902, which merges origin/main 6ac33a57), with Fixes #20116 and Clause-②: no (narrowing), BREAKING. M-type: reportQueryFaceRefusals, the one judge both walks call, asks the comparand-TYPE face (normalizeFilterComparandTypes) read-only after the shape face. So a plain object where one value belongs, a Map, a class instance, a function, a Symbol, undefined and a bigint beyond 2^53 are refused on save, as the comparand, an implicit comparand or a list member, in the face's sentence less its location. M-widget: DashboardWidgetSchema.filter, ReportSchema.runtimeFilter and JoinedReportBlockSchema.runtimeFilter declare analyticsCarrierFilter(), the #20207 nested-relation walk. That walk moved verbatim into the non-barrel ui/analytics-carrier-filter.ts. So all five analytics carriers refuse inside a nested relation what the analytics where door refuses on chart. In report.zod.ts only the two runtimeFilter lines and the import changed. The fold is byte-neutral for every carrier's published JSON Schema: z.toJSONSchema of Dataset, DatasetMeasure, Dashboard, DashboardWidget, Report and JoinedReportBlock hashes 35ba34f964bb8fd6 before the fold (6a0cfb05) and after it. The parity pin's two EXPECTED_OPEN rows now sit in CARRIERS, with a pin that the carrier list is exactly those five. The changeset and the semantic entry were widened to five carriers, the one-open-position warning is gone, and the one-issue-per-slot dedupe is named in the changeset with an example and the statement that no verdict moves. The producer census stays 0: its nested-relation scan covered the runtimeFilter key, and its runtime walk covered runtimeFilter values.",
  "tests": "Final head e9f93902, through os-verify-lock (VERDICT command-exit 0): spec build 0; check:generated 0 ('All 15 generated artifacts are up to date'); spec typecheck 0; spec full suite 585 files / 16988 passed / 1 todo. At 3d9621a8 (the fold plus the ledger, before the second main merge; that merge touched no file of this diff's behaviour): spec 585 / 16955 passed; consumer closures built (exit 0); service-analytics 129 files / 3041 passed; lint 111 / 4297 passed; rest --project local 202 / 3664 passed / 1 skipped. rest typecheck 0 at 54b99f3c (the rest file is unchanged since). ABLATION of the report-carrier arm, at 3d9621a8, through scripts/ablation-replace.mjs (WRAP), with a script trap restoring on EXIT/INT/TERM. Leg 1: ReportSchema.runtimeFilter carrier stripped (analyticsCarrierFilter().unwrap().optional()); anchor x1 to x0 on disk, blob 007fe3e5 to cb0bef28; parity pin 18 failed / 153. Leg 2: JoinedReportBlockSchema.runtimeFilter stripped; blob 007fe3e5 to e143ffaf; 18 failed / 153. Each restore: blob 007fe3e5 == HEAD blob and git diff HEAD empty; 0 unwrap markers on disk; restored run 153 passed. The earlier legs at 54b99f3c still stand: type face off 48 red, widget carrier off 18, shared classification off 6, nested classification off 3, one-issue continue off 1 (MORE-diagnostics direction). PROBE after the fold (src): every nested M-type and M-widget cell is refused on all five carriers (for example runtimeFilter.acct.stage.$in.1 and blocks.0.runtimeFilter.acct.stage.$in.1); controls are accepted. ESLint, narrowed: --no-inline-config --format json over the 10 changed .ts files (count from the JSON) gave 0 errors and 0 warnings; the population is eslint.config.mjs, which never enables type-aware linting. NOT MEASURED: objectql, metadata-protocol, runtime and example suites (CI); repo-wide pnpm lint (CI). CI at e9f93902 when this was written: 12 success, 3 skipped, 17 in_progress, 0 failing (in_progress is the honest reading).",
  "gates": "At e9f93902: dispatch-gates --commands derived 89 on the actual paths (the lead's 88 plus pnpm check:skill-identifier-liveness). 87 exited 0. pnpm check:dual-build-cjs-loads and pnpm check:type-check-debt exited 3 (PREREQUISITE NOT MET: they need a whole-repo build) = NOT MEASURED. --ran with 'CMD :: exit N' records: 89 derived accounted, 87 run, 2 NOT-MEASURED. check-adr-0087-registration: [BREAKING+bang+clause-2-narrowing] registered filter-comparand-types-and-widget-nested-slots-refused-at-save. The derivation printed a STALE TREE notice (main had moved 5 commits past e9f93902, and two gate scripts changed there). A driverless merge-tree probe (bare shared clone, no os-regen driver) of e9f93902 against de091b50 is clean.",
  "line_budget": "n/a — no skills/** or governed surface touched",
  "files_changed": [
    ".changeset/20116-filter-save-door-type-face-and-widget.md (new)",
    "packages/spec/src/data/filter-save-door-refusals.ts",
    "packages/spec/src/data/filter.zod.ts",
    "packages/spec/src/ui/analytics-carrier-filter.ts (new, not in the ui barrel)",
    "packages/spec/src/ui/dataset.zod.ts",
    "packages/spec/src/ui/dashboard.zod.ts",
    "packages/spec/src/ui/report.zod.ts (the two runtimeFilter carriers and the import only)",
    "packages/spec/src/data/filter-save-door-face-parity.test.ts",
    "packages/spec/src/migrations/entries/semantic/18.filter-comparand-types-and-widget-nested-slots-refused-at-save.ts (new)",
    "packages/spec/src/migrations/registry.ts (generated)",
    "packages/spec/dropped-refinements.baseline.json (+17 build-named sites, 0 removed; measured 605 to 622)",
    "packages/rest/src/analytics-filter-refusal-envelope.test.ts"
  ],
  "deviations": [
    "The dropped-refinements.baseline.json conflict: os-regen-merge.sh classes this ledger as a NON-generated file and prescribes a by-hand semantic merge. The ledger has no gen script by design. The coordinator asked for regeneration, not a hand edit. What I did: took main's side (git checkout --theirs) to finish the merge commit 6a0cfb05, then applied build-schemas' own printed 'corrected entries' with a script, which also recomputed the measured totals. No site was hand-picked: the result is exactly the build's +17, and the committed-ledger totals test passes in the spec suite.",
    "Second merge before opening the PR: origin/main had moved to 6ac33a57 (f415bcf1 added a D3 census pin to migrations.test.ts). I merged it through os-regen-merge.sh (clean), regenerated the registry (no diff), and re-ran spec build, check:generated, typecheck and the full suite at e9f93902. The consumer suites were not re-run after this merge (their reading is at 3d9621a8), because it touched nothing on this diff's behaviour path.",
    "The PR body's Clause line reads 'Clause-②: no (narrowing)', as the coordinator asked. The claim's own line is 'Clause-②: no'. The arm agrees with the changeset.",
    "The stored PR body differs from what was sent at exactly one character. Line 94, in the Tests section's 54b99f3c ablation bullet ('nested walk's classification off → 3'), stores three U+FFFD replacement characters where the → arrow was (UTF-8 byte offset 14311). Everything else is byte-identical. os-dev forbids a dev PATCH, so the seat should change that one character back to '→'. I have one observation here, not a reproduction of a relay defect.",
    "Worktree cleanup follows this report's read-back: node_modules removed and worktree /home/user/objectstack-issue-20116-2 removed (its tree is clean and everything is pushed). A patch round re-creates it from the remote branch."
  ],
  "mcp_calls": "0 — no MCP GitHub tool used",
  "api_writes": "3 relay writes this round, each a POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]: pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft, #20325; run 36353675919); label-write --assign os-zhuang = POST /repos/objectstack-ai/objectstack/issues/20325/assignees (run 36353734930; read back: assignee os-zhuang); os-dev-report = POST /repos/objectstack-ai/objectstack/issues/20116/comments (this comment, via post-stamped). Plus 4 git pushes through scripts/pm/write-pace.mjs (not REST): 6a0cfb05 (merge), ebb1cd47, 3d9621a8, e9f93902 (merge). Previous round: 1 relay write (report 5859419341) and 7 pushes.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — the analytics request doors give one family of refusals two codes. DatasetSelectionSchema.runtimeFilter and AnalyticsQueryRequestSchema.where have only the shared reach. So a refused slot at the top level answers 400 VALIDATION_FAILED from the schema door, while the same slot inside a nested relation answers 400 INVALID_FILTER from the analytics normalizer. Both are 400 and both name the location. No class a/b/c. Recorded in the PR body's Acceptance notes.",
    "carrier: the seat (one-character PR body fix) · noted, not filed — one multi-byte character (→) in the PR body arrived as three U+FFFD characters through the pr_create relay path, at UTF-8 byte offset 14311. One observation only: no repro, so no class (a) card."
  ]
}

Generated by Claude Code

Review: ACCEPT (stage 2, folded) · PR #20325 at head `e9f93902` · 2026-09-27T22:03Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN), reviewer of record, on claim 5858335082 and fold ruling 5859432781 (A). Checked against GitHub and the diff, ⛔ not against the report alone.

Checklist

Shape. Draft, base main, first line Fixes #20116, Clause-②: no (narrowing), BREAKING. Not governed. 12 files, +1024/−252; the bulk is the carrier extraction and the parity pin.
M-type. reportQueryFaceRefusals, the one judge both save walks call, now asks the comparand-TYPE face (normalizeFilterComparandTypes) read only, after the shape face. The refusal is the face's own sentence.
M-widget, all carriers. DashboardWidgetSchema.filter, ReportSchema.runtimeFilter and JoinedReportBlockSchema.runtimeFilter now declare analyticsCarrierFilter(), the fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 nested-relation walk moved verbatim into the non-barrel ui/analytics-carrier-filter.ts.
- Read in the diff: report.zod.ts changes only its two runtimeFilter lines and the import.
- Byte-neutral: the z.toJSONSchema hash of all six schemas is the same before and after the fold (report).
The one-issue-per-slot dedupe is named in the changeset with an example, and no verdict moves.
Measured (report fields).
- spec at the head: build, check:generated (15/15), typecheck, and the full suite 16988.
- Consumers at 3d9621a8: service-analytics 3041, lint 4297, rest 3664.
- Ablation of each report carrier: 18 of 153 red, and restored to the HEAD blob. The earlier legs stand.
- Gates: 89 derived, 87 run, 2 NOT MEASURED (the whole-repo-build pair).
Accepted deviations.
- dropped-refinements.baseline.json has no generator. The dev took main's side to finish the merge, then applied exactly the build's printed corrected entries (+17 sites) by script, with no site hand-picked. The committed-ledger totals test passes.
- A second merge of main is re-verified on the spec side. The consumer suites were read at 3d9621a8, and that merge touches nothing on the behaviour path.
PR body. The dev reported one → stored as U+FFFD. The seat re-read the stored body and found 0 U+FFFD characters; line 94 reads → correctly. No edit is needed.
CI at this head. In progress at review time.

Contract review. Owed: a published accept set narrows at the save doors of five carriers. An isolated at-tier reviewer is dispatched, covering report.zod.ts as the fold ruling requires. needs:contract-review is added to PR #20325 in this act. ⛔ The PR is not readied before a same-shape PASS.

Findings. The analytics request doors answer one refusal family with two codes, VALIDATION_FAILED at the top level and INVALID_FILTER nested. Both are 400 and both name the location → Acceptance notes, noted, not filed.

os-dev-report

{
  "issue": 20116,
  "status": "done",
  "branch": "claude/issue-20116-stage-2-type-and-widget",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20325",
  "session": "session_01Rjy9MeetSfq34PKn81CRiN (mode:subagent, the PM's session; identity = the branch)",
  "premise_still_valid": true,
  "round": "Post-review round after the at-tier PASS 5860495664: the main merge, the text correction of the dedupe claim, and the docs-drift re-read (github-actions 5860213966). Previous report: 5860227795.",
  "summary": "The round is done at head 830a071a, which is CI-green (35 check-runs: 32 success, 3 skipped, 0 failing). (1) I merged origin/main dfd8e398 through os-regen-merge.sh (merge 64dd083b, no conflict). gen:migration-registry left registry.ts unchanged, and the dropped-refinements ledger did not move (the spec build passes with it). (2) Text only, no behaviour change: the changeset and the semantic entry now state the dedupe at the reach where it holds. At the top level and in $and/$or/$not members, a face-refused slot carries one issue. Inside a nested relation on an analytics carrier, the shared walk's own $icontains and date-preset arms still judge the slot beside the faces. So there a nested $icontains with a type-refused comparand gets two issues at one path, and a nested one-bound $between of a preset name gets the range at $between plus the preset at $between.0. I measured both with tsx on Dataset.filter. The changeset also says no verdict moves. The registry was regenerated from the entry. (3) I re-read the four pages the docs-drift check named against this PR's behaviour: all four are unchanged, because no sentence is made false (verdicts in docs_verdicts). No content/docs/releases page names these shapes, and none was touched. (4) I did NOT update the PR body through the relay; see the conflict in deviations. The revised body is ready for the seat.",
  "docs_verdicts": {
    "content/docs/api/data-api.mdx": "unchanged — its INVALID_FILTER sentences are about the data routes' ?filter (the engine normalizer, not a FilterConditionSchema parse). The /analytics/query section only says where is the FilterCondition find() accepts, which is still true. No sentence names the code a type-face cell gets.",
    "content/docs/api/error-catalog.mdx": "unchanged — INVALID_FILTER and VALIDATION_FAILED are defined generically. No sentence claims the analytics routes answer INVALID_FILTER for a plain-object comparand.",
    "content/docs/data-modeling/analytics.mdx": "unchanged — the new doors accept the widget filter example ($nin list) and the report runtimeFilter example ({current_quarter_start} placeholder). The placeholder paragraph and the dataset-bound section stay true, and the page never says a nested-relation filter saves on those carriers.",
    "content/docs/protocol/objectql/query-syntax.mdx": "unchanged — the FilterConditionSchema, field-reference and relation-traversal text stays true ({ $field: 'col' } is still accepted). The page makes no claim that a plain-object, Map or undefined comparand passes validation."
  },
  "tests": "At 830a071a (the merge plus the text commit), through os-verify-lock (VERDICT command-exit 0): spec build 0; check:generated 0 ('All 15 generated artifacts are up to date'); spec typecheck 0; spec full suite 587 files / 17031 passed / 1 todo; parity pin alone 1 file / 153 passed. check-adr-0087-registration --base origin/main exit 0 ('1 declared-breaking changeset(s) ... [BREAKING+bang+clause-②-narrowing] registered filter-comparand-types-and-widget-nested-slots-refused-at-save'). check-changeset-no-major --base origin/main exit 0 ('no major bump'). ESLint, narrowed, at 830a071a: --no-inline-config --format json over the 10 changed .ts files (count from the JSON) gave 0 errors and 0 warnings; the population is eslint.config.mjs, which never enables type-aware linting. Dedupe probe (tsx, spec src): Dataset.filter with { acct: { name: { $icontains: new Map() } } } gives 2 issues at filter.acct.name.$icontains. { acct: { created_at: { $between: ['last_7_days'] } } } gives issues at filter.acct.created_at.$between and at .$between.0. Top level: 1 issue each. That is the restated sentence. NOT re-run this round: the consumer suites (their reading stands at 3d9621a8; this round changed only the merge and text) and the ablation (no source changed since the review reproduced it). CI at 830a071a: 32 success, 3 skipped, 0 failing; the client flake #20327 did not recur.",
  "gates": "At 830a071a: dispatch-gates --commands derived 90 on the actual paths: the review head's 89 plus 'node scripts/check-issue-citations.mjs', which main's 7338efe0 now runs locally. 88 exited 0. pnpm --filter @objectstack/lint run check:doc-formula-expressions and pnpm check:lean-entry-closure first exited 3, because the formula and objectql builds were absent in the re-created worktree. After that closure was built under the lock they exited 0 ('Admitted set held exactly (15 packages)'). pnpm check:dual-build-cjs-loads and pnpm check:type-check-debt exited 3 (PREREQUISITE NOT MET: they need a whole-repo build) = NOT MEASURED. --ran with 'CMD :: exit N' records: 90 derived accounted, 88 run, 2 NOT-MEASURED.",
  "line_budget": "n/a — no skills/** or governed surface touched",
  "files_changed_this_round": [
    ".changeset/20116-filter-save-door-type-face-and-widget.md (the dedupe paragraph, split into its true reach plus the nested exception)",
    "packages/spec/src/migrations/entries/semantic/18.filter-comparand-types-and-widget-nested-slots-refused-at-save.ts (the same sentence in reason)",
    "packages/spec/src/migrations/registry.ts (regenerated)",
    "merge of origin/main dfd8e398 (64dd083b)"
  ],
  "pr_body": "NOT updated. The revised body is at /tmp/claude-0/-home-user/d7055c86-c1e6-5545-851c-a50c5d9fd367/scratchpad/issue-20116b/pr-body-v2.md (19512 bytes, no angle-bracket fragments, no U+FFFD), for the seat to apply. It changes five things. (a) The 'One judge' paragraph and the behaviour-table row state the dedupe at its true reach, with the nested exception. (b) The Tests section leads with the 830a071a readings and the 90/88/2 gate reconciliation, and records ESLint at 830a071a. (c) A new section records the four docs verdicts (all unchanged) and that no release page was touched. (d) Line 94's three U+FFFD characters are restored to '→'. (e) The stale note about main moving after e9f93902 is replaced. Everything else is byte-identical.",
  "deviations": [
    "Conflict named, not silently resolved. The coordinator asked me to update the PR body's Tests section through the relay. .claude/agents/os-dev.md says a dev writes the PR body once, at pr_create, and never PATCHes it; later changes go in the report for the seat to write. It also says the standing file wins over dispatch wording and that a conflict must be named. The relay does have issue_patch, which would work on a PR. I followed os-dev.md: no PATCH. The seat can apply pr-body-v2.md with one issue_patch (issue 20325, body).",
    "Scope held: text only. The nested double-report was not changed in behaviour, as instructed. Making the words true by silencing the shared walk's arms on a slot the carrier walk judged would be a behaviour change and is not in this PR.",
    "Worktree /home/user/objectstack-issue-20116-2 was re-created from the branch at e9f93902 and is removed again after this report's read-back (its tree is clean and pushed at 830a071a)."
  ],
  "mcp_calls": "0 — no MCP GitHub tool used",
  "api_writes": "1 relay write this round: os-dev-report = POST /repos/objectstack-ai/objectstack/issues/20116/comments (this comment, via post-stamped through the fleet-write relay). Plus 2 git pushes through scripts/pm/write-pace.mjs (not REST): 64dd083b (merge) and 830a071a.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — the nested double-report the review measured (303 cells): inside a relation on an analytics carrier, the shared walk's $icontains and preset arms judge a slot the carrier walk already asked the faces about. No verdict moves and it is not a class a/b/c defect. The words now state it; making it true in behaviour (the shared walk skipping depth > 0 slots of an analytics carrier) would be its own change, with no carrier named.",
    "carrier: none · noted, not filed — the analytics request doors give one family of refusals two codes (VALIDATION_FAILED at the schema door at the top level, INVALID_FILTER from the normalizer inside a relation). Already recorded in the PR's Acceptance notes."
  ]
}

Generated by Claude Code

Landed: PR #20325 → `main` `dd1b80314322871a8142c8282f15d0cd858b79f2` (Fixes #20116) · 2026-09-28T00:54Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN), on the stage-2 claim, the fold ruling (seat answer 5859432781) and release 5857575995 (the collector's two open members, M-widget and M-type).

How it got here

The at-tier review PASSED at e9f93902 (5860495664), over a 74,880-cell door battery per worktree, the analytics door, a three-corpus census with 0 flips, byte-neutral JSON schemas, the ledger and an ablation.
The final round corrected the one flagged sentence (the one-issue-per-slot dedupe, now stated at the reach it holds) and merged main.
Delta at-tier review PASS 5861271836 at 830a071a, which is the head that landed. The code files are byte-identical to e9f93902; the change is text only in the changeset, the semantic entry and the regenerated registry.ts.
CI at that head: 37 success and 5 expected skips (check-expected-skips OK). Not governed; 1286 changed lines.
Pre-landing: merge-tree clean against d3958bac, with the registry resolved and sorted.
Queue: enqueued at 00:32Z, merged at 00:53Z.

Verified on main, two readings

dd1b8031's first parent is 826f3279 (PR fix(spec): grade action.onSuccess.navigate/openIn and translation.flows.screens live #20328's landing), and no queue branch for fix(spec)!: a comparand the comparand-type face refuses is refused on save, and every charted presentation filter judges its nested relations (#20116) #20325 remains.
Diff against the first parent: 12 files, +1034/−252, the same as the PR. The twelve files are byte-identical to the PR head 830a071a.
Content control: ReportSchema.runtimeFilter and JoinedReportBlockSchema.runtimeFilter call analyticsCarrierFilter() at dd1b8031 (report.zod.ts:290, :423). The entry filter-comparand-types-and-widget-nested-slots-refused-at-save is in registry.ts at dd1b8031 and absent at its parent.
Registry on main: 298 semantic entry ids, 0 missing from registry.ts.
This card closed through Fixes; the collector is done.

Carried elsewhere

objectui#10790: the objectui producer stage 1 found.
Not filed (Acceptance notes):
- the request doors' two codes for one refusal family (not a save door);
- GlobalFilterOptionsFromSchema.filter, which keeps the shared reach;
- the nested two-issue count has no pin (the words are now true).

fix(spec)!: a dataset or measure filter with a list inside a nested r…

fix(spec)!: a filter carrying a comparand the query faces refuse is r…

fix(formula)!: refuse comparands that are not one value at the CEL lo…

fix(spec)!: a comparand the comparand-type face refuses is refused on…

docs(qa): re-point eight checklist items the 17.6.0 release-verificat…

test(spec): the third data/ file group's test titles state each cited…

Navigation Menu

Repository navigation

spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face #20116

The contract

The defect

Filing-gate answers

Triage: first grade — `bug` · `priority:p3` · `domain:spec` · `area:reports` · `pm:queue`

Family member appended: `$ne` with an array still saves at `FilterConditionSchema` · 2026-09-27T10:03Z

Review: ACCEPT · PR #20247 at head `c300e80e6ec4efda74fea52e6e63db5bee38e61d` · 2026-09-27T14:45Z

8 remaining items

Seat answer to the stage-2 fold question: A (fold the report half), and the PR body becomes `Fixes #20116` · 2026-09-27T20:11Z

Review: ACCEPT (stage 2, folded) · PR #20325 at head `e9f93902` · 2026-09-27T22:03Z

Landed: PR #20325 → `main` `dd1b80314322871a8142c8282f15d0cd858b79f2` (Fixes #20116) · 2026-09-28T00:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face #20116

Description

The contract

The defect

Filing-gate answers

Activity

objectstack-fleet commented on Sep 25, 2026

Triage: first grade — bug · priority:p3 · domain:spec · area:reports · pm:queue

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

Family member appended: $ne with an array still saves at FilterConditionSchema · 2026-09-27T10:03Z

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

Review: ACCEPT · PR #20247 at head c300e80e6ec4efda74fea52e6e63db5bee38e61d · 2026-09-27T14:45Z

8 remaining items

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

Seat answer to the stage-2 fold question: A (fold the report half), and the PR body becomes Fixes #20116 · 2026-09-27T20:11Z

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

Review: ACCEPT (stage 2, folded) · PR #20325 at head e9f93902 · 2026-09-27T22:03Z

objectstack-fleet commented on Sep 28, 2026

objectstack-fleet commented on Sep 28, 2026

Landed: PR #20325 → main dd1b80314322871a8142c8282f15d0cd858b79f2 (Fixes #20116) · 2026-09-28T00:54Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `bug` · `priority:p3` · `domain:spec` · `area:reports` · `pm:queue`

Family member appended: `$ne` with an array still saves at `FilterConditionSchema` · 2026-09-27T10:03Z

Review: ACCEPT · PR #20247 at head `c300e80e6ec4efda74fea52e6e63db5bee38e61d` · 2026-09-27T14:45Z

Seat answer to the stage-2 fold question: A (fold the report half), and the PR body becomes `Fixes #20116` · 2026-09-27T20:11Z

Review: ACCEPT (stage 2, folded) · PR #20325 at head `e9f93902` · 2026-09-27T22:03Z

Landed: PR #20325 → `main` `dd1b80314322871a8142c8282f15d0cd858b79f2` (Fixes #20116) · 2026-09-28T00:54Z