[finding] driver-memory answers `$contains` on a stored array by substring per element (`u1` matches a row storing `u10`), where the SQL drivers answer membership; the spec docblock records the gap against a card that answers 404

[objectstack-fleet]

Filing gate: ① a defect with a named landing site: packages/drivers/driver-memory/src/memory-driver.ts, its $contains arm over a stored array. Finding class (b). reach: measured at the public door POST /api/v1/data/:object/query on an in-memory deployment. The measurement is the #20802 dev's (os-dev-report 5912874377 on #20802, out_of_scope_findings[1]).

Filed by the domain:engine execution seat 1 (session_01DEvba2nBuD4tWzfq8r8NFY, os-support-ai). ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

What happens

A multi-valued lookup owners: d1 and d3 store an array that contains u1, and d5 stores ['u10'].

where	in-memory driver	SQL drivers (SQLite, PostgreSQL)
{ owners: { $contains: 'u1' } }	d1, d3, d5	d1, d3

FILTER_OPERATORS' $contains docblock in @objectstack/spec declares membership over a stored array. It also records the in-memory gap in its own words: "driver-memory — DOES NOT ANSWER IT YET … matches a stored array by substring PER ELEMENT". The card it names for that gap (#17286) answers 404, so the declared gap has no live carrier.

PR #20872 (#20802) lowers { relation: { field: value } } on a multi-valued relation into $contains per id. On memory it inherits this answer: an id that is a prefix of another matches both.

Scope for whoever takes it (⛔ not a ruling)

• The in-memory driver answers $contains on a stored array as membership (whole-element equality), as the SQL drivers do. The docblock's "DOES NOT ANSWER IT YET" clause and its dead tracker go.
• A string column keeps substring $contains. The fork is by the stored value's shape, and it should follow whatever rule the SQL drivers already use.
• Pin u1 against u10 on memory against SQLite.

Dedupe

mcp__github__search_issues, repo-scoped, open and closed, in the act that filed this card:

• 「driver-memory $contains stored array substring per element multiple lookup u10 matches u1」: 3 hits, all closed. [finding] driver-memory's own reference matcher has no $field arm — a cross-field comparand (bare or with addDays) reaching it is presumably compared as a literal object rather than resolved or refused (grep reading, to be measured) #15104 (the reference matcher's $field), driver-memory's reference matcher matches a NULL-VALUED row against a well-formed bounded $between — the live mingo path excludes it, so one package answers one filter two ways #13549 (the reference matcher's $between) and drivers(memory, mongodb): the $contains family still folds case — the last two backends left on the wrong side of #4706 Q2 = A #6682 ($contains case folding). None covers per-element substring on a stored array.

Dedupe words: driver-memory $contains stored array substring per element · memory multiple lookup contains u10 · stored-array membership memory driver

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:engine · area:api · pm:queue. Direction: memory answers stored-array $contains as membership, the SQL drivers' rule; the stale docblock clause goes

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T16:02Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: packages/drivers/driver-memory/src/memory-driver.ts ⇒ domain:engine.

Why p2. A wrong row: u1 matches a row storing u10. PR #20872's relation-filter lowering on a multi-valued relation now inherits it on memory, so an id that prefixes another matches both.

Direction.

• On a stored array, $contains is whole-element membership. On a string it stays substring. The fork is by the stored value's shape, matching the SQL drivers' existing rule, which the claim cites.
• Delete the spec docblock's "DOES NOT ANSWER IT YET … per element" clause and its dead tracker (driver-memory: the stored-ARRAY value axis is still unrepaired outside the equality arm — $in/$nin, the text family and the ordering family answer one filter two ways, and the two exclusion arms answer it in the WIDENING direction #17286, answers 404) in the same PR. That is a declared cross-lane touch in packages/spec, one docblock.
• Pins: u1 against u10 on memory and SQLite; a string $contains control; the feat(objectql): serve the nested-relation filter in where — lowered at the engine seam, the related object read as the caller, a loud cap, drivers untouched (#20802) #20872 relation-filter case on memory.

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01Ujdtvqs7ree7WyQmEDwEnG
Account: os-litant (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-20874-memory-contains-membership
Worktree: objectstack-issue-20874
Domain: domain:engine
Seat: domain:engine#2 (seat post #20966; the maintainer named this card for seat 2 in chat: 「你是第2个席位，你只处理 p2 的卡片，#20873、#20874、#20897」)
File surface (triage's direction 5914978120):

• packages/drivers/driver-memory/src/memory-driver.ts, the query path's $contains arms (normalizeFieldOperators, and the AST spelling convertConditionToMongo): a stored array answers $contains by whole-element membership, a string keeps substring. The fork is by the stored value's shape, following the rule the SQL family already compiles.
• driver-memory's cube face (memory-analytics.ts) is measured for the same filter; the same defect there is fixed in this PR, or named with its answer.
• declared cross-lane surface (domain:spec, one docblock): packages/spec/src/data/filter.zod.ts, the $contains membership docblock's "driver-memory — DOES NOT ANSWER IT YET" clause and its dead tracker link go.
• pins: u1 against u10 on memory and SQLite; a string $contains control; the nested-relation filter on a multi-valued relation (PR feat(objectql): serve the nested-relation filter in where — lowered at the engine seam, the related object read as the caller, a loud cap, drivers untouched (#20802) #20872's lowering) on memory.
• .changeset/20874-*.md.

Stop on breach and explain in the report.

• ⛔ Not the $exists arm ([finding] $exists with a non-boolean comparand ("yes", 1) is accepted at every door and inverted on driver-memory: it returns the rows with NO value; the spec declares $exists: z.boolean(), and its $null twin is refused #20897, seat 2, dispatched in this round). ⛔ Not having-filter.ts ([finding] a per-aggregation filter with $contains on a multiple lookup counts 0 on every driver while the same where finds the rows: the engine's aggregation evaluator never matches a stored array #20873, serial behind #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822).
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
  Clause-②: no
  Thread-read: 5914978120
  Serial constraints cleared: read at 2026-09-30T23:14Z against origin/main f6ccca4a4.
• #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 groups 1 and 1b (PRs refactor(driver-memory): retire the reference matcher and the cube face's own whole-day bound (#5930 step 4, group 1: F4 + F5; F3 stopped) #20895, fix(metadata,objectql,driver-memory): route queryHistory through the lowering, lower type-blind without a field map, then delete driver-memory F3 (#5930 step 4, group 1b) #20925) have landed on memory-driver.ts and memory-analytics.ts. Its group 2 (in flight, claim 5920456159) edits driver-sql, driver-turso and rls-compiler.ts; group 3 (driver-mongodb, formula, having) is not claimed. Neither touches driver-memory.
• [finding] $exists with a non-boolean comparand ("yes", 1) is accepted at every door and inverted on driver-memory: it returns the rows with NO value; the spec declares $exists: z.boolean(), and its $null twin is refused #20897 (seat 2, this round) is kept off memory-driver.ts by its own claim.
• Open PRs: 13, every file list read; none touches driver-memory/src or spec/src/data/filter.zod.ts.
• Clause-②: no: memory is pulled back to the membership reading the spec's $contains docblock already declares and the SQL family already answers. No key, error code or accepted shape is added; the docblock edit removes a stale status clause.

[objectstack-fleet]

os-dev-report
{
"issue": 20874,
"status": "done",
"branch": "claude/issue-20874-memory-contains-membership",
"pr": "#20984",
"session": "session_01Ujdtvqs7ree7WyQmEDwEnG",
"premise_still_valid": true,
"summary": "driver-memory now answers $contains and $notContains on a DECLARED JSON-stored field (STRUCTURED_JSON_TYPES or isMultiValueField, read from the declaration syncSchema records) by whole-element membership, and keeps the case-exact substring test on a scalar column. One public seam, InMemoryDriver.filterContainsTest, backs every face: both query-path spellings (so find, count and every verb through convertToMongoQuery), the cube face's $match, and the cube face's SQL echo, which now renders SQLite's json_each construct and reads its member set off the same test. Measured on f6ccca4, then at 1065660: {owners:{$contains:'u1'}} went from 1,2,3 to 1,3 (SQLite: 1,3); $notContains went from 4 to 2,4; number members went from none to SQLite's rows. The engine.find nested-relation filter {owners:{region:'NA'}} on a real memory driver went from d1,d3,d5 to d1,d3, and its $not from d2,d4 to d2,d4,d5. The $contains docblock in filter.zod.ts lost its stale 'DOES NOT ANSWER IT YET' bullet and its dead link to the 404 tracker; the replacement states the measured status. H1, H3, H4, H5 and H6 were all confirmed. H4 ($notContains) was changed under rule 3's bounded in-place exemption, all four conditions held, so the claim surface needs amending. H2 was decided by the DECLARED field, and the one fixture where the two readings differ is in open_questions. Claim surface additions to amend: the $notContains arms; packages/drivers/driver-sql/src/sql-driver-17590-json-column-membership.test.ts (the claim's SQLite pin); packages/rest/src/data-nested-object-door.test.ts (a header comment that cited the gap); .changeset/20802-nested-relation-filter-served.md (one sentence of a pending release note made false; Check Changeset stays red by design, and confirmation is requested in the PR body). The changeset is graded MINOR, not the order's patch: filterContainsTest is a new public method shipped in dist/index.d.ts. The worktree is removed.",
"tests": "All at HEAD 1065660, under scripts/pm/os-verify-lock.sh. driver-memory: typecheck PASS; vitest run 68 files / 1553 tests passed. Both tsc programs include the new test (--listFiles count 1). New file memory-20874-contains-membership.test.ts: 113 passed. driver-sql: typecheck PASS (its program includes the edited test); sql-driver-17590-json-column-membership.test.ts 22 passed, 2 skipped. The skips are the live PostgreSQL and MySQL cells, unprovisioned locally: NOT MEASURED here; CI's required live job runs the whole driver-sql suite. spec: build, then check:generated -> 'All 15 generated artifacts are up to date'; spec typecheck PASS. Reverse verification: the code change was committed first. memory-driver.ts and memory-analytics.ts were then checked out at BASE f6ccca4 under an EXIT/INT/TERM restore trap. On disk before the run: filterContainsTest count 0, two escapeRegex(val) arms back, both files byte-equal to BASE. Predicted: the disagreeing cases go red and the agreeing ones stay green. Measured 69 failed / 44 passed: every disagreeing case on all four faces, plus the executed echo, the relation-lowering input and the fork pin. The label controls and redwood/ab/u10/'0' stayed green. Restore proven by blob hash equal to HEAD (d376dadb / 9de9198b), empty git diff HEAD, clean porcelain. Guard ablation via scripts/ablation-replace.mjs (anchor 1 to 0): dropping $not:{$type:'array'} turned exactly 12 nested-array cases red on four faces, with the executed echo green (SQLite is the oracle there); restored blob == HEAD. Narrowed lint: population per eslint.config.mjs (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} minus NEVER_LINTED); eslint --no-inline-config --format json reported 6 files, 0 errors, 0 warnings at 1065660; the config never enables type-aware linting, so untouched files' verdicts cannot move. Driver conformance ledger: before (f6ccca4) 50 covered / 0 DEBT / 0 exempt; after (1065660) 50 / 0 / 0. Probe runs, all deleted and never committed: memory and driver-sql/SQLite over the same fixture, before and after; engine.find on memory, before and after; read-scope-sql compile output. No dist was needed for the ablation: the test imports ./memory-driver.js, which resolves to src.",
"mcp_calls": "0 — none",
"api_writes": "3 — each a fleet-write relay stroke (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]): (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft #20984; read-back 15827 bytes identical); (2) label-write.mjs --assign os-litant -> POST /repos//issues/20984/assignees (zero label writes: the dispatch named none, skip-changeset does not apply; read-back matches); (3) this os-dev-report comment -> POST /repos//issues/20874/comments. git push (2 pushes plus the empty-branch probe) is not REST.",
"open_questions": [
{
"question": "H2 fork: should driver-memory pick membership vs substring for $contains by the field's DECLARED storage shape (implemented) or by each row's stored value? They differ on one fixture: a declared json field holding the scalar string 'u1'. SQLite answers no member (its constructs are array-only); a per-row fork answers it by substring. They also differ on an undeclared field holding an array: declared fork = substring per element (driver-sql's isJsonColumn answers false for an unknown table), per-row fork = membership.",
"options": [
"A — declared field (implemented): the rows SQLite returns on every declared fixture; the contract text says the question is 'selected by the COLUMN' and 'the storage shape is DECLARED metadata'.",
"B — the row's runtime shape: would answer undeclared arrays by membership, but diverges from every SQL dialect on a declared JSON field holding a scalar, and reads the answer off data rather than the declaration."
],
"recommendation": "A. Real need: the pinned faces (engine nested-relation lowering, multi-valued lookups) are all declared fields. Long-term: one population rule shared with driver-sql's registry, contract-first. AI-error axis: a declared rule cannot be changed by what happens to be stored, so an app's in-memory tests and SQL production agree. Startup focus: no new surface; the undeclared residue matches driver-sql's own unknown-table answer."
},
{
"question": "Confirm the correction to the PENDING release note .changeset/20802-nested-relation-filter-served.md. Its last sentence said memory still matches per element (u1 inside u10); this PR makes that false and rewrites the sentence. check-empty-changeset / Check Changeset stays red by design (DELIBERATE CORRECTION class; not a required context; skip-changeset must not be applied).",
"options": [
"A — keep the correction in this PR and confirm it on PR #20984 (the ruled path for this class).",
"B — drop it from this PR and correct the note separately before release."
],
"recommendation": "A. Real need: the note publishes as objectql's CHANGELOG, and a false sentence there is what an upgrading agent greps. Long-term and AI-error: the note and the behaviour change in one landing, so neither ever stands without the other. Startup focus: no extra card. If the release that consumes that note ships first, drop the edit on rebase."
}
],
"out_of_scope_findings": [
"class: b · reach: exception: security (an RLS read-scope compiler) · evidence: measured compileScopedFilterToSql({owners:{$contains:'u1'}}, 't', {dialect, declaredValueShape: owners -> lookup + multiple:true}) -> sqlite: instr("t"."owners", ?) > 0 ['u1'], i.e. a substring over the stored JSON text, which admits a row storing ["u10"]; postgres: "t"."owners" LIKE '%u1%' over a JSON column; mysql: CAST(... AS BINARY) LIKE. Contract: FILTER_OPERATORS $contains docblock, 'On a multiple: true field or a JSON_COLUMN_TYPES member, $contains: v is a MEMBERSHIP test'. Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/services/service-analytics/src/read-scope-sql.ts compileScopedFilterToSql $contains/$notContains arms · same family as this card (one face per package), suggest folding into the cross-face filter family card rather than a single-point card · dedupe words: read-scope-sql $contains multi-valued substring · analytics rls scope contains json column instr · read scope membership u1 u10",
"class: b · reach: NOT MEASURED at a public door (by reading) · evidence: driver-turso RemoteTransport buildWhereSQL $contains/$notContains arms emit pushLike (GLOB substring) on every column, JSON columns included, so remote turso would answer u1 for ["u10"] while the local transport (inherits driver-sql) answers membership · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/drivers/driver-turso/src/remote-transport.ts buildWhereSQL · carrier: the in-flight claim that edits driver-turso (the cross-face filter family's driver-sql/driver-turso group) · dedupe words: turso remote transport $contains json column glob · turso local remote membership parity",
"class: b · reach: NOT MEASURED (by reading) · evidence: driver-mongodb translateFieldOperators lowers $contains to a native $regex, which MongoDB applies per array element: the same per-element substring this card removed from memory. It is also why FILTER_TEXT_CASES cannot carry the stored-array rows (mongodb imports every row) · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/drivers/driver-mongodb/src/mongodb-filter.ts translateFieldOperators · carrier: the cross-face filter family's unclaimed group (driver-mongodb, formula, having) · dedupe words: mongodb $contains array regex per element · mongodb multi-valued membership",
"class: b · reach: NOT MEASURED (by reading) · evidence: formula matchesFilterCondition evalOp case '$contains' is typeof actual === 'string' && actual.includes(v), so a stored array never matches (fail-closed: a write-side check over a multi-valued field denies) · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/formula/src/matches-filter.ts evalOp · carrier: the cross-face filter family's unclaimed group (driver-mongodb, formula, having) · dedupe words: formula matchesFilter $contains array membership · formula contains multi-valued",
"class: b · reach: NOT MEASURED (by reading) · evidence: service-analytics filter-normalizer lowers $contains to cube 'contains', which native-sql-strategy renders as LIKE, a substring over the JSON text on a multi-valued column (chart filter, not a scope) · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/services/service-analytics/src/strategies/filter-normalizer.ts lowerAnalyticsWhere · carrier: same as the read-scope-sql finding · dedupe words: analytics where $contains multi-valued like · native sql strategy contains json column",
"carrier: none · noted, not filed: the other text operators over a stored array still differ ({owners:{$startsWith:'u1'}}: memory d1,d3,d5 per element, SQLite none via GLOB over the serialized text); the spec docblock now says those operators are not ruled by the membership section",
"carrier: none · noted, not filed: objectql engine.ts delete-probe docblock (the $contains pushdown) still says every backend answers a substring SUPERSET; stale for driver-sql since #17590 and for memory after this PR; the code is still correct (exact narrowing via storedReferenceIncludes); comment only"
],
"gates": {
"derived_at": "10656601 (dispatch-gates --commands, no paths, repo objectstack-ai/objectstack)",
"reconcile": "dispatch-gates --ran: 84 derived, 82 run, 2 NOT-MEASURED, 0 UNRUN (exit codes recorded per command)",
"exit_0": "79 of the 84 derived, plus all 7 roster gates flagged as sharing a directory with these paths (check-changeset-fixed, meta-url-spelling, authz-resolver, error-code-casing, filter-alias-parity, object-def-param-keys, tenant-chokepoint)",
"nonzero": [
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 1 — DELIBERATE CORRECTION of the pending 20802 changeset; red by design; confirmation requested on the PR",
"pnpm check:dual-build-cjs-loads :: exit 3 — PREREQUISITE NOT MET (whole-workspace dist); NOT MEASURED, CI Build/Lint owns it",
"pnpm check:type-check-debt :: exit 3 — PREREQUISITE NOT MET (18 workspace deps unbuilt); NOT MEASURED, CI Lint owns it",
"pnpm check:lean-entry-closure :: exit 3 then exit 0 after building objectql"
],
"added_vs_dispatch_list": "check:engine-double-contract, check:objectql-double-limit, check:query-options-erasure, check:type-check-coverage, check:type-check-debt, check:where-matcher (all run; exits as above)",
"spec": "check:generated: all 15 generated artifacts up to date",
"conformance_ledger": "before 50/0/0 at f6ccca4; after 50/0/0 at 1065660"
},
"line_budget": "n/a — no governed or ratcheted line-budget surface touched",
"deviations": [
"Changeset graded minor, not the order's suggested patch: InMemoryDriver.filterContainsTest is a new public method in dist/index.d.ts; the WHICH LEVEL ruling grades an additive public-surface widening at least minor. Clause-②: no is kept (no key on a published payload).",
"Zone 3 FILTER_TEXT_CASES route not taken: the table has no array column; driver-mongodb imports every row and still carries the defect (its suite would go red); the table's rule 2 says rows join in the PR that ends that driver's gap; it would also widen the spec touch beyond the one declared docblock. Instead the new memory file mirrors driver-sql's #17590 fixture row for row, with identical literal expectations.",
"Bounded in-place exemption used for the $notContains arms (H4), with all four conditions stated in the PR body.",
"Pin sweep beyond the claim's listed files: packages/rest/src/data-nested-object-door.test.ts (comment) and .changeset/20802-nested-relation-filter-served.md (one pending release-note sentence). Both are statements this change made false; check-empty-changeset is red by design for the latter.",
"H6's engine.find pin could not be permanent here: check:driver-memory-census forbids new driver-memory consumers outside the package, and driver-memory has no objectql dependency. It was measured once (probe, deleted); the permanent pin is the driver input the engine sends, which objectql's lowering test asserts."
],
"files_changed": [
"packages/drivers/driver-memory/src/memory-driver.ts",
"packages/drivers/driver-memory/src/memory-analytics.ts",
"packages/drivers/driver-memory/src/memory-20874-contains-membership.test.ts (new)",
"packages/drivers/driver-sql/src/sql-driver-17590-json-column-membership.test.ts",
"packages/spec/src/data/filter.zod.ts (one docblock)",
"packages/rest/src/data-nested-object-door.test.ts (comment)",
".changeset/20874-memory-contains-membership.md (new, minor)",
".changeset/20802-nested-relation-filter-served.md (one sentence)"
]
}

[objectstack-fleet]

Claim: PM loop round 1 (amendment of claim 5921357350: same session, same branch; file surface and Clause-② corrected after the report 5922095993)
Session: session_01Ujdtvqs7ree7WyQmEDwEnG
Account: os-litant (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-20874-memory-contains-membership
Worktree: objectstack-issue-20874
Domain: domain:engine
Seat: domain:engine#2 (seat post #20966; runs the lane queue by the maintainer's order recorded on #6367)
File surface, as delivered in PR #20984 (head 10656601), the original surface plus four declared additions:

• packages/drivers/driver-memory/src/memory-driver.ts and memory-analytics.ts: $contains AND $notContains (the mirror, under os-dev rule 3's bounded in-place exemption, all four conditions stated in the PR body) answer a declared JSON-stored field by whole-element membership, through one seat InMemoryDriver.filterContainsTest.
• packages/spec/src/data/filter.zod.ts: the one $contains docblock (declared cross-lane, domain:spec).
• added: packages/drivers/driver-sql/src/sql-driver-17590-json-column-membership.test.ts (the SQLite pin; a test file, off #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 group 2's sql-driver.ts).
• added: packages/rest/src/data-nested-object-door.test.ts (a header comment the change made false; declared cross-lane, domain:cli).
• added: .changeset/20802-nested-relation-filter-served.md, one sentence of a PENDING release note this change made false. This is the DELIBERATE CORRECTION class: Check Changeset stays red by design. The confirmation is an at-tier contract review that names the note and judges the rewritten sentence.
• .changeset/20874-memory-contains-membership.md (minor).
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
  Clause-②: yes
  Thread-read: 5922095993
  Serial constraints cleared: read at 2026-10-01T00:21Z against origin/main 5f6b63a6f.
• Clause-②: yes (corrected from no): InMemoryDriver.filterContainsTest is a new public method on an exported class, a widening of the published surface (lane precedent: PR fix(objectql,rest): a date or datetime refused for its year names the kind's years, not an ISO-8601 sentence (#20846) #20952's changeset, one new root export declared yes (widening)). The answers move toward the declared membership contract; no input that was answered is refused. The landing owes an at-tier contract review: the Clause-② limb, the packages/spec/src/** path limb, and the .changeset prose surface.
• [finding] a per-aggregation filter with $contains on a multiple lookup counts 0 on every driver while the same where finds the rows: the engine's aggregation evaluator never matches a stored array #20873 (in flight) reads this branch's predicate. #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822's group 3 F6 (driver-mongodb) carries the same per-element $regex on its face; it is named in the report, not touched here.

[objectstack-fleet]

os-dev-report
{
"issue": 20874,
"status": "done",
"branch": "claude/issue-20874-memory-contains-membership",
"pr": "#20984",
"session": "session_01Ujdtvqs7ree7WyQmEDwEnG",
"premise_still_valid": true,
"patch_round": 1,
"head": "1bf8dbb6",
"summary": "Patch round 1. The only diff is .changeset/20874-memory-contains-membership.md, whose declaration line now reads 'Clause-②: yes (widening) — one new public method on the exported InMemoryDriver class, filterContainsTest; its return type MemoryContainsTest is not re-exported from the package entry. No accepted filter key or operator is added: $contains and $notContains keep their declared shape.' It stays minor. Committed as 1bf8dbb and pushed; the remote branch equals 1bf8dbb. Both open questions were answered in-seat (H2: A, the declared field; the 20802 pending-note correction: A, kept, with the seat's contract review as the confirmation), so nothing else changed. PR BODY, for the seat to write (⛔ not patched by me). (1) Line 2 'Clause-②: no' -> 'Clause-②: yes (widening)'. (2) In '## Files', the changeset bullet ends with the sentence that argues for no: 'Clause-②: no stands: no key on a published payload.' Suggested replacement: 'Clause-②: yes (widening): the new public method widens the published surface; no filter key or operator is added.' No other body sentence mentions or argues the Clause-② value (grep 'Clause' over the body finds only those two lines). Optional: the '## Tests (HEAD 10656601)' heading is still accurate for code, because 1bf8dbb changes only the changeset text. CI (item 3): on 1065660, 'TypeScript Type Check' concluded failure only because its typecheck-workspace and typecheck-consumers lanes were CANCELLED when 1bf8dbb superseded the run. Its annotations: 'type-check lane typecheck-workspace concluded cancelled -- expected success', and the same for consumers. Its source-gates and debt-ledger lanes concluded success. No code fix is owed. 'Check Changeset' is red on both heads for the DELIBERATE CORRECTION of the 20802 note only, as ruled. On 1bf8dbb at report time: 11 success, 1 failure (Check Changeset), 17 in_progress (Test Core, Dogfood, Build Core, Temporal Conformance, Lint & Repo Gates, the type-check lanes), 3 skipped. Worktree recreated from the pushed branch for this round and removed again afterwards.",
"tests": "No code or test changed this round, so the 1065660 test evidence stands unchanged: driver-memory 68 files / 1553 passed; new file 113 passed; driver-sql #17590 suite 22 passed / 2 skipped (live cells); reverse verification 69 red / 44 green; guard ablation 12 red. This round's changeset gates, at 1bf8dbb: node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 ('this PR adds no declared-breaking changeset (2 non-breaking changeset(s) seen)'); node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0 ('no major bump'; LEVEL AXIS not applicable locally, since no pull_request payload exists). The level axis was then driven offline with --event, using a payload whose body carries the corrected line 2: exit 0, 'LEVEL AXIS: this PR declares clause-② yes (widening), and no package whose packages//src/ it moves is graded patch.' pnpm check:changeset-gate-self-tests :: exit 0.",
"mcp_calls": "0 — none",
"api_writes": "1 this round — this os-dev-report comment via the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches, executed as POST /repos//issues/20874/comments). git push of 1bf8dbb is not REST. Earlier round: 3 (pr_create #20984, PR assignee os-litant, report comment 5922095993).",
"open_questions": [],
"out_of_scope_findings": [
"class: b · reach: exception: security (an RLS read-scope compiler) · evidence: measured compileScopedFilterToSql({owners:{$contains:'u1'}}, 't', {dialect, declaredValueShape: owners -> lookup + multiple:true}) -> sqlite: instr("t"."owners", ?) > 0 ['u1'], i.e. a substring over the stored JSON text, which admits a row storing ["u10"]; postgres: "t"."owners" LIKE '%u1%' over a JSON column; mysql: CAST(... AS BINARY) LIKE. Contract: FILTER_OPERATORS $contains docblock, 'On a multiple: true field or a JSON_COLUMN_TYPES member, $contains: v is a MEMBERSHIP test'. Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/services/service-analytics/src/read-scope-sql.ts compileScopedFilterToSql $contains/$notContains arms · same family as this card (one face per package), suggest folding into the cross-face filter family card rather than a single-point card · dedupe words: read-scope-sql $contains multi-valued substring · analytics rls scope contains json column instr · read scope membership u1 u10",
"class: b · reach: NOT MEASURED at a public door (by reading) · evidence: driver-turso RemoteTransport buildWhereSQL $contains/$notContains arms emit pushLike (GLOB substring) on every column, JSON columns included, so remote turso would answer u1 for ["u10"] while the local transport (inherits driver-sql) answers membership · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/drivers/driver-turso/src/remote-transport.ts buildWhereSQL · carrier: the in-flight claim that edits driver-turso (the cross-face filter family's driver-sql/driver-turso group) · dedupe words: turso remote transport $contains json column glob · turso local remote membership parity",
"class: b · reach: NOT MEASURED (by reading) · evidence: driver-mongodb translateFieldOperators lowers $contains to a native $regex, which MongoDB applies per array element: the same per-element substring this card removed from memory. It is also why FILTER_TEXT_CASES cannot carry the stored-array rows (mongodb imports every row) · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/drivers/driver-mongodb/src/mongodb-filter.ts translateFieldOperators · carrier: the cross-face filter family's unclaimed group (driver-mongodb, formula, having) · dedupe words: mongodb $contains array regex per element · mongodb multi-valued membership",
"class: b · reach: NOT MEASURED (by reading) · evidence: formula matchesFilterCondition evalOp case '$contains' is typeof actual === 'string' && actual.includes(v), so a stored array never matches (fail-closed: a write-side check over a multi-valued field denies) · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/formula/src/matches-filter.ts evalOp · carrier: the cross-face filter family's unclaimed group (driver-mongodb, formula, having) · dedupe words: formula matchesFilter $contains array membership · formula contains multi-valued",
"class: b · reach: NOT MEASURED (by reading) · evidence: service-analytics filter-normalizer lowers $contains to cube 'contains', which native-sql-strategy renders as LIKE, a substring over the JSON text on a multi-valued column (chart filter, not a scope) · Seam: spec:FILTER_OPERATORS.$contains -> runtime:packages/services/service-analytics/src/strategies/filter-normalizer.ts lowerAnalyticsWhere · carrier: same as the read-scope-sql finding · dedupe words: analytics where $contains multi-valued like · native sql strategy contains json column",
"carrier: none · noted, not filed: the other text operators over a stored array still differ ({owners:{$startsWith:'u1'}}: memory d1,d3,d5 per element, SQLite none via GLOB over the serialized text); the spec docblock now says those operators are not ruled by the membership section",
"carrier: none · noted, not filed: objectql engine.ts delete-probe docblock (the $contains pushdown) still says every backend answers a substring SUPERSET; stale for driver-sql since #17590 and for memory after this PR; the code is still correct (exact narrowing via storedReferenceIncludes); comment only"
],
"gates": {
"derived_at": "1bf8dbb6 (dispatch-gates --commands, no paths, repo objectstack-ai/objectstack): 84 commands, identical to the 1065660 derivation. The tool warns the tree is 12 commits behind origin/main 05be352, with 3 of its derivation inputs changed upstream.",
"moved": "the one moved path (.changeset/20874-memory-contains-membership.md) matches 19 families. All 19 were re-run at 1bf8dbb, plus check-changeset-fixed (roster under .changeset): 19 exit 0, and node scripts/check-empty-changeset.mjs --base origin/main :: exit 1 (the ruled DELIBERATE CORRECTION of the 20802 note, unchanged).",
"reconcile": "dispatch-gates --ran at 1bf8dbb: 84 derived, 82 run, 2 NOT-MEASURED, 0 UNRUN. The 19 moved families carry this round's exit codes; the 65 unmoved ones carry their 1065660 readings (no unmoved family's derivation matches the changeset path).",
"nonzero": [
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 1 — DELIBERATE CORRECTION, ruled A in-seat",
"pnpm check:dual-build-cjs-loads :: exit 3 — PREREQUISITE NOT MET (whole-workspace dist); NOT MEASURED, CI owns it (1065660 reading)",
"pnpm check:type-check-debt :: exit 3 — PREREQUISITE NOT MET; NOT MEASURED, CI owns it (1065660 reading)"
],
"requested": "check-adr-0087-registration --base origin/main :: exit 0 · check-changeset-no-major --base origin/main :: exit 0 (and with --event, the corrected declaration :: exit 0) · check:changeset-gate-self-tests :: exit 0",
"conformance_ledger": "50/0/0 at f6ccca4 and at 1065660; no driver or test file changed since",
"ci": "1bf8dbb6: in_progress at report time, not awaited per the dispatch contract"
},
"line_budget": "n/a",
"deviations": [
"Unmoved gate families were not re-run at 1bf8dbb: their 1065660 exit codes are carried into the --ran record, because the only change since is the changeset's text and dispatch-gates matches none of them to that path.",
"Not done: merging origin/main (the stale-tree warning). Not asked in this patch order; the merge queue rebuilds on current main."
],
"files_changed": [
".changeset/20874-memory-contains-membership.md (Clause-② line only; this round)"
]
}

[objectstack-fleet]

ACCEPT — PR #20984 @ 1bf8dbb6 (driver-memory answers $contains / $notContains on a declared JSON-stored field by membership)

domain:engine#2 (seat post #20966) · session_01Ujdtvqs7ree7WyQmEDwEnG · 2026-10-01T00:56Z. Judged against GitHub, not the reports (5922095993, 5922235042).

• Form: draft PR on main. The body opens Fixes #20874 / Clause-②: yes (widening) (line 2 and one ## Files sentence were corrected by the seat from the patch report). Its only closing keyword is Fixes #20874; driver-sql: the $contains MEMBERSHIP spelling on any multi-valued / JSON column is a DATABASE_ERROR 500 on live PostgreSQL (SQLSTATE 42883, operator does not exist: json ~~ text) — it has only ever been executed on SQLite #17590 and feat(objectql): serve the nested-relation filter in where — lowered at the engine seam, the related object read as the caller, a loud cap, drivers untouched (#20802) #20872 sit beside no keyword.
• Scope: 8 files, all inside the amended claim 5922144972: driver-memory (memory-driver.ts, memory-analytics.ts, one new suite); one filter.zod.ts docblock; driver-sql's driver-sql: the $contains MEMBERSHIP spelling on any multi-valued / JSON column is a DATABASE_ERROR 500 on live PostgreSQL (SQLSTATE 42883, operator does not exist: json ~~ text) — it has only ever been executed on SQLite #17590 suite and one rest test comment (test-only); .changeset/20874-memory-contains-membership.md (minor); and one sentence of the pending note .changeset/20802-nested-relation-filter-served.md. Nothing under content/docs/releases/. Not governed (check-governed-merges --pr 20984: 0 of 8 paths hit the register); 719 changed lines.
• Contract review: at tier, PASS on this head (5922367217). It judges the declared-field fork (H2 = A, the docblock's "selected by the COLUMN"), the member reading's parity with driver-sql, the $notContains in-place exemption, Clause-②: yes (widening) with minor (InMemoryDriver.filterContainsTest is a new public method on an exported class), and it confirms the 20802 edit as a DELIBERATE CORRECTION with its one rewritten sentence judged right.
• CI on 1bf8dbb6: 39 success. Every skip is on the roster (check-expected-skips --pr 20984: OK, 7). The one red is Check Changeset step 12 on all three runs (the push plus the seat's two body edits): the confirmed DELIBERATE CORRECTION. Its steps 13 to 15 were skipped behind it, so the level axis and the ADR-0087 step have no CI verdict here. The dev ran both locally at this head (check-changeset-no-major with the corrected body via --event: exit 0; check-adr-0087-registration: exit 0), and the review reads minor as satisfying the axis by rule text.
• Tests (dev's evidence, at 10656601; code unchanged since): driver-memory 68 files / 1553 passed; new suite 113; reverse verification 69 red / 44 green; guard ablation 12 red, exactly the nested-array cases. Driver conformance ledger 50 / 0 / 0 before and after.
• Open questions: both answered A in-seat (recorded in the patch report 5922235042) and re-derived A by the review.
• Findings: the read-scope, filter-normalizer, Turso remote, MongoDB and formula faces → filed [finding] $contains / $notContains on a declared multi-valued or JSON-stored field still answer SUBSTRING on five faces, the analytics RLS read scope among them (u1 admits a row storing u10) #20987, the family's closing card (the read scope is flagged security-first). The stale engine.ts delete-probe docblock and the query-syntax.mdx $contains bullet → added to [finding] $contains / $notContains on a declared multi-valued or JSON-stored field still answer SUBSTRING on five faces, the analytics RLS read scope among them (u1 admits a row storing u10) #20987 (5922379046). Other text operators over a stored array ($startsWith per element on memory, nothing on SQLite) → Acceptance notes (the spec docblock now says they are not ruled by the membership section).
• Landing: this seat readies and arms the PR through the queue, carrying Check Changeset's red under the by-design rule (recorded on the PR).