fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face

[objectstack-fleet]

Fixes #19757
Clause-②: no (narrowing)

This executes ruling 5793368540 (batch #217 item 3, letter 乙, 「217 同意」): an array in the implicit-equality slot is refused at the shared comparand-shape face, for every driver at once, with ⛔ no alias and ⛔ no grace window.

The Clause-② value is no, as the claim and the ruling state it. The (narrowing) arm is added because of AGENTS.md's changeset rule: a narrowing is BREAKING, and the changeset carries the PR's Clause-② line, which check:adr-0087-registration reads for the arm. Both changesets and this body therefore carry the same line.

Session session_013RDBh5DqXd2xnLwvHLgLFr, branch claude/issue-19757-equality-slot-array-refused. Every reading below was taken on origin/main @ 2548ba57de unless it says otherwise.

1. Measured first (before the change)

What parseFilterAST lowers each spelling to:

authored	lowered to	shape face	type face
['tags','equals',['a']], and the same on =, ==, eq	{"tags":["a"]} (implicit form)	passes	passes
['tags','ne',['a']], and the same on not_equals, !=, neq, notequals and the angle-bracket pair spelling	{"tags":{"$ne":["a"]}}	passes	passes
{tags:{$eq:['a']}}, {tags:[]}, and {tags:['a']} nested under $and / $or / $not	unchanged	passes	passes

@objectstack/objectql's delegating wrapper assertListComparandShapes('deal','find', …) also passed {tags:['a']} and {tags:{$eq:['a']}}. Through a recording driver, both engine doors handed the shape to the driver:

• Door 2 carrying the FilterArray [['tags','equals',['a']]]
• the object form, which is also Door 1's hand-off after isFilterAST and parseFilterAST
• $eq
• count with the shape under $or

How each backend answered it, on the lowered node, beside a scalar and an $in control. The rows were r1=['a'], r2='a', r3=['a','b'], r4=['b','a'], r5=[['a'],'x'], r6=[['a']], r7='b' and r8=[].

backend	{tags:['a']}	{tags:{$eq:['a']}}	{tags:{$ne:['a']}}	nested {$not:{tags:['a']}}
driver-sql, SQLite	400 INVALID_FILTER	400	400	500 DATABASE_ERROR; $and / $or nesting is the same 500
driver-memory	400	400	400	400
formula matchesFilterCondition	no row, r1 included	no row	every row	every row
driver-mongodb translateFilter	emitted unchanged	emitted unchanged	emitted unchanged	{"$nor":[{"tags":["a"]}]}
mingo 7.2.4, the named proxy for MongoDB	r1,r5,r6	r1,r5,r6	r2,r3,r4,r7,r8	r2,r3,r4,r7,r8

Also measured: service-analytics' filter normalizer read [['stage','=',['won','lost']]] and {stage:['won','lost']} as stage IN (won, lost).

⚠️ NOT MEASURED: a live mongod (mingo is the proxy), MySQL, PostgreSQL and a live Turso server. driver-turso and driver-sqlite-wasm are built on driver-sql and were not run as backends.

Which operators the ruling's words cover. The ruling covers the implicit and explicit equality slots: {f:[...]} from any equality spelling, and $eq, at any depth under $and / $or / $not, the empty array included.

⛔ $ne is left out on purpose. It is equality's negation, not equality, and it measured the same split. It is reported for its own ruling and not absorbed here. This follows the face's own precedent for the $in { $field } member question, which it left to a separate card. An it.todo records it, with ⛔ no green pin. The other scalar operators carrying an array ($gt, $contains, $like, …) are not covered either.

Spellings, read at source. The ruling names FilterOperatorSchema. No such export exists on origin/main: it has zero hits under packages/spec/src, while the control FieldOperatorsSchema does resolve. So the two prescribed operators are read off FieldOperatorsSchema's keys and AST_OPERATOR_MAP's lowering:

• $in, with authoring spelling in, is the declared list operator.
• $contains, with authoring spelling contains, is the membership test the spec declares for a multiple: true / JSON-stored column.

A pin reconciles both against the schema and the vocabulary. The vocabulary declares no array-valued contains operator: $contains is z.string().

2. What changed

• packages/spec/src/data/filter-comparand-shape.ts gains the equality-slot arm.
  • {field:[...]} and {field:{$eq:[...]}} are refused with the face's existing INVALID_FILTER / 400 envelope.
  • The leading sentence is driver-memory's arrayComparandError verbatim, so one condition keeps one wording.
  • The message names the field and the path, then prescribes {"$in": […]} (authoring in) and {"$contains": "…"} (authoring contains) on a multi-value field, with an $or of those for any-of.
  • It fits under the 500-char client bound, including a 60-char received-list preview, which the bound test pins at 498.
  • Scope stops at $eq: null, every scalar and a { $field } reference pass exactly as before.
  • The header's 「closes that door for every driver at once」 now lists both slots it is true of: the list-operator slot and this one. A new "Refused BY RULING, 2026-09-23" section records the ruling, the measured table and the scope.
• Both engine doors reach the arm. The engine's object branch calls the wrapper, and its array branch calls parseFilterAST. The driver-mongodb pin measures both through the engine, as described in §3.
• Conformance. FILTER_COMPARAND_TYPE_CASES gains three door-refusal rows: implicit, $eq, and nested under $or. This is the one door-refusal table every driver suite already runs through parseFilterAST (driver-sql, driver-memory, driver-mongodb, driver-sqlite-wasm, driver-turso). Its "What belongs here" note says why an array where ONE value belongs sits beside "a plain object in a scalar slot". FILTER_TEXT_CASES is untouched.
• driver-mongodb pin — mongodb-equality-array-comparand-refusal.test.ts, 13 tests. ⛔ No driver source edit.
  • A direct caller composing parseFilterAST then translateFilter is refused, and translateFilter is never reached.
  • A recording engine whose only read path is translateFilter refuses both doors and $eq, and count nested under $or, with translateFilter called zero times.
  • Lit controls: a scalar, $in and $eq: null.
  • A reverse-direction pin shows that translateFilter handed the shape directly still emits it unchanged, so the face is the only guard.
  • mingo is the named proxy, and its readings are recorded in the docblock. mingo is not a dependency of this package, so the pin does not run it. A live mongod is stated as NOT MEASURED.
• ADR-0087: the semantic entry 18.filter-equality-array-comparand-refused is added, following the 18.view-filter-rule-scalar-operator-array-refused precedent. registry.ts was regenerated with gen:migration-registry, and check:migration-registry is green.
• Changesets:
  • @objectstack/spec: minor, with the **BREAKING** banner, fix(spec)!:, Clause-②: no (narrowing) and the adr-0087 registered filter-equality-array-comparand-refused disposition marker. The level is minor because AGENTS.md makes a (narrowing) BREAKING while check-changeset-no-major forbids major. The launch-window convention ships an accept-set narrowing as minor, and the finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514 changeset is the sibling precedent. check-changeset-no-major itself prints "narrowing — a BREAKING change; during the launch window it ships minor".
  • @objectstack/metadata-core: patch, for the retired dispatch rows below.

3. Tests, firing control, and gates

Firing control: the refusal pins turn red on the face as it stood. The two new throws were disabled through scripts/ablation-replace.mjs. Each anchor hit once, and the blob moved from ef772a616c to f8fd530c31. An EXIT/INT/TERM trap restored the file.

suite	on the ablated face	after restore
filter-comparand-shape + filter-field-reference-lowering, spec source	14 red / 81 green; every lit control stays green	82 + 13 green
driver-mongodb pin, spec rebuilt	10 red / 3 green (the lit controls and the reverse pin)	13 / 13 green
driver-memory comparand-type conformance, spec rebuilt	exactly the 3 new rows red / 20 green	green

For the two spec-rebuilt rows, ablation-dist-preflight found both markers present in packages/spec/dist on the mutate leg. On the restore leg it found them absent from all 216 built files, with the tree clean. The restore was proven with a HEAD blob-hash match and an empty git diff HEAD.

Suites, run on bec8f4c737. 438d385af3 differs only by the prose-id baseline JSON.

• @objectstack/spec: 525 files, 15510 passed, 2 todo
• objectql: 304 files, 5069 passed
• driver-memory: 52 files, 1248 passed
• metadata-core: 16 files, 285 passed
• driver-mongodb: 26 files passed and 5 live-mongod files skipped; 578 passed
• metadata-protocol: 188 files, 2673 passed
• service-queue: 5 files, 77 passed

Run on 723f254402, before the consumer fixes: driver-sql 2648 passed (168 skipped), formula 915, driver-turso 1302, driver-sqlite-wasm 521, service-analytics 2442, plugin-sharing 913, lint 4121.

Typecheck is clean for spec, driver-mongodb, driver-memory and metadata-core. --listFiles shows each touched test file inside its package's program.

Gates, run on the final head 438d385af3:

• dispatch-gates --commands derived 95 families. 93 exit 0.
• 2 are NOT MEASURED, both exit 3 with PREREQUISITE NOT MET because they need the whole workspace built: check:dual-build-cjs-loads and check:type-check-debt.
• --ran reconciliation: 95 derived, 93 run, 2 NOT-MEASURED, 0 UNRUN.
• Key verdict lines:
  • check-adr-0087-registration: [BREAKING+bang+clause-②-narrowing] registered filter-equality-array-comparand-refused (new here)
  • check:doc-authoring: clean, with the baseline shrink below
  • check:engine-double-contract and check:nul-bytes: green
• @objectstack/spec check:generated: all 15 artifacts current.

4. Consumers that broke, and how each was re-judged

The repo was grepped (examples, seeds, docs, published skills, fixtures, tests) for the FilterArray triple on = / == / equals / eq carrying an array, for $eq carrying an array, and for filter / where objects with an array field value. No shipped example, seed, doc or skill authors the shape. The full suites above went red in exactly four places:

1. filter-comparand-shape.test.ts pinned {tags:{$eq:['a','b']}} and {tags:['a','b']} as passing. It pinned the exact slot the ruling closes, so both rows are inverted.
2. filter-field-reference-lowering.test.ts pinned ['stage','=',['a','b']] lowering to the implicit form. The row is re-judged, not dropped: it now asserts the refusal names the implicit slot and not $eq, which still proves that an array is not promoted the way a reference is.
3. Two probe helpers passed ['a','b'] through every AST spelling. They are loweredOperatorOf in the spec suite and in driver-memory's memory-filter-ast-vocabulary.test.ts, and the latter turned 4 tests red. Each helper stated that the probe "never trips the shape door". The equality spellings now refuse it, so the helper reads that refusal as undefined, which is the answer it always gave them.
4. @objectstack/metadata-core's engine-double dispatch tables carried three ARRAY where.id rows: delete array id, no multi, and update array id, no multi and SCALAR data.id beside an ARRAY where.id. The real engine now refuses that input at the face before the dispatch runs, and objectql's 测试替身比真实实现宽松：四个缺陷因此带着绿灯发布——需要一条把替身钉在真实契约上的闸门 #4550 harness requires the engine's words to equal the predicate's. That turned 4 tests red. The rows are retired with a note, and the predicates are unchanged. The $in rows keep the non-scalar-id coverage, and scalar*Id's array pins stay. The changeset is patch. check:doc-authoring's prose-id baseline shrank by one (#11230 6 → 5 in that file) through its own --census-ledger remedy.

⚠️ Conflict, stated rather than settled silently. The dispatch said "fix a fixture only if it is plainly an authoring mistake". Items 3 and 4 are not authoring mistakes. They were fixed because the dev contract's clause wins: a published surface this change made false must be fixed in the same PR. After this change, ENGINE_*_DISPATCH_CASES claimed a dispatch refusal the real engine no longer gives.

Two alternatives were weighed and not taken:

• Make objectql's harness accept the face's refusal. That would carve an exception into the A compare-and-set where on a by-id update is silently inert — the extra predicate keys never reach the driver, and SqlHttpOutbox.redeliver's status guard is one of them #11009 contract that "both halves must refuse with the SAME words".
• Teach the predicate the face. That is impossible byte-for-byte, because the predicate has no object name for the face's update('task'): prefix.

The seat may prefer another disposition, and the change is reversible.

Files beyond the claim's declared surface, each for the reason given:

• filter-comparand-type.ts, one comment sentence. It said the equality-slot array is "answered per driver", which this change made false.
• filter-comparand-type-conformance.ts, where the conformance rows live.
• filter-field-reference-lowering.test.ts: item 2.
• driver-memory/src/memory-filter-ast-vocabulary.test.ts: item 3, test-only.
• metadata-core/src/engine-{delete,update}-dispatch.ts: item 4, table rows and notes only.
• scripts/doc-authoring-prose-id.baseline.json: the shrink.

5. Compile surfaces, face by face (seat amendment after the at-tier FAIL 5808368753)

Written by the domain:spec seat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d), which took this card over on the maintainer's 「你接手派补丁轮」. The FAIL's one blocking item was the missing face-by-face declaration. Each face below gives the review's file:line evidence and one of three conclusions: changed, already compliant, or out of scope with the reason. No code changed for this amendment; the head is still 438d385af3.

#	face	conclusion	evidence
1	driver-sql	changed — behind the shared face on both engine doors	§2 above. ⚠️ "nested → 500" describes the base 2548ba57de; origin/main has since carried #19885, whose nested leaf takes assertCompilableComparand
2	driver-turso RemoteTransport (remote mode)	already compliant, and now also behind the shared face	remote-transport.ts:487 classifies a bare array as requireValue, :612 names it for refusal, :660 sets INVALID_FILTER. "driver-turso is built on driver-sql" above is true of local mode only; remote mode is its own compiler
3	read-scope-sql compileScopedFilterToSql	out of scope — policy scopes never pass the shared face	Neither it nor its callers (native-sql-strategy.ts:654, objectql-strategy.ts:559) call parseFilterAST. A bare array fails closed as READ_SCOPE_COMPILE_FAILED / 500 (:755, :436-440). $eq: [...] binds the array (:1273). Filed as #19975
4	analytics filter-normalizer	changed for the FilterArray form; the OBJECT form is out of scope	FilterArray refused through parseFilterAST (:1521). The OBJECT form, read as IN, is #19888
5	formula	already compliant at origin/main; this PR changes no formula file	Since #19946 (#19886 phase 2a), matches-filter.ts:196-255 refuses the bare array and $eq / $ne arrays
6	objectql having (half-face)	out of scope — still answers by JS coercion	engine.ts gates where (:866, :939) and aggregations[i].filter (:14776) but hands ast.having to applyHaving ungated (:14885, :14929). having-filter.ts:357-363: having: { total: [5] } is true. A cross-lane objectql edit outside this claim; filed as #19974
7	driver-memory / driver-mongodb	changed (memory: behind the face) / pinned (mongodb: mongodb-equality-array-comparand-refusal.test.ts, 13 tests)	§2–§3 above

Correction to §2: "Both changesets and this body therefore carry the same line" is not exact. The metadata-core changeset (a patch with no BREAKING) carries no Clause-② line; the spec changeset and this body do.

Acceptance notes

These are observed and not fixed here. The report carries each one.

• driver-sql answers the equality-slot array nested under $and / $or / $not with a 500 DATABASE_ERROR on a direct SqlDriver.find: SQLite cannot bind the list. The top-level form gets its own 400. Every platform door now refuses the shape first, so only a direct-driver caller still reaches the 500. This is reported as a finding.
• service-analytics' normalizer does not route the OBJECT form {field:[...]} through the shared face, and still charts it as IN. Its FilterArray form is now refused. Reported as a finding.
• FilterConditionSchema still parses {field:[...]}, because FieldOperatorsSchema.$eq is z.any(). A stored filter carrying the shape therefore publishes clean and is refused at query time. That schema-door twin is not in the ruling and is reported as a finding.
• $ne carrying an array measured the same cross-backend split and is reported for its own ruling. The ViewFilterRule schema door already refuses not_equals plus an array.
• Two texts are now stale for the equality slot only, and neither is edited: ⛔ there is no driver source edit, and the test is not in the claim. driver-memory's arrayComparandError still says the spec "comparand door leaves this position to the driver", and filter-comparand-type.test.ts's test title says "their semantics are per-driver today". Carrier: none.
• origin/main has moved 6 commits past the base. The branch is not merged with it. A driver-less git merge-tree --write-tree against origin/main is clean, and the only overlapping path is the generated registry.ts, which is a sorted union. None of the upstream-added lines authors the shape. CI's merge-ref run and the queue validate the merged tree.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-core, @objectstack/spec, touching 10 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/src/data/filter-comparand-type.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/data-api.mdx (via INVALID_FILTER (literal, a string literal in FILTER_COMPARAND_TYPE_CASES))
• content/docs/api/error-catalog.mdx (via INVALID_FILTER (literal, a string literal in FILTER_COMPARAND_TYPE_CASES))
• content/docs/protocol/objectql/query-syntax.mdx (via INVALID_FILTER (literal, a string literal in FILTER_COMPARAND_TYPE_CASES))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-1.mdx (via INVALID_FILTER (literal, a string literal in FILTER_COMPARAND_TYPE_CASES))
• content/docs/releases/v17/17-4.mdx (via INVALID_FILTER (literal, a string literal in FILTER_COMPARAND_TYPE_CASES))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/src/data/filter-comparand-type.ts) — pages documenting those are invisible to this run
• 7 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1f89ba0d704a797225ab8cf306e4cdec89edae8e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ab43d380fe50afa502d822cd20b574496976abbd — the merge of head 438d385af3913f136ebb71f031da4a48ce0066c1 into base 1f89ba0d704a797225ab8cf306e4cdec89edae8e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ab43d380fe50afa502d822cd20b574496976abbd && git checkout ab43d380fe50afa502d822cd20b574496976abbd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1f89ba0d704a797225ab8cf306e4cdec89edae8e 438d385af3913f136ebb71f031da4a48ce0066c1 && git checkout -B drift-repro 1f89ba0d704a797225ab8cf306e4cdec89edae8e && git merge --no-ff 438d385af3913f136ebb71f031da4a48ce0066c1

node scripts/docs-audit/affected-docs.mjs --json 1f89ba0d704a797225ab8cf306e4cdec89edae8e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 1f89ba0d704a797225ab8cf306e4cdec89edae8e → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: 57/57 CONTRACT_REVIEW_TIER
Head-sha: 438d385af3913f136ebb71f031da4a48ce0066c1

Isolated at-tier reviewer subagent, run by the domain:spec seat-4 session on the maintainer's instruction in that session (「帮我处理」, with the landing route chosen there); every one of its 57 transcript turns served at the tier the constant names. Adopted by the seat 2026-09-24T05:38Z. The record below is the reviewer's, unedited except the two header lines.

Inputs read: card #19757 body plus all 6 comments (ruling 5793368540 included); PR #19882 body, pulls/19882/files (14 rows, +844/-20), the application/vnd.github.diff diff, 1 issue comment (docs-drift bot), 0 reviews, 0 review threads; commits/438d385af3913f136ebb71f031da4a48ce0066c1/check-runs → 35 rows: 32 success, 3 skipped (Packed-tarball smoke opt-in, Console Pin Gate, Build Docs), 0 failure (jq -r '.check_runs[]|"\(.status)\t\(.conclusion)"' | sort | uniq -c); no gate family re-run locally. Git: origin/main = c1641868a3da71537c9c6c572d2bd2044103236b; PR ref = 5 commits atop merge-base 2548ba57deb83062cc94ea91a644309092251a0f (git log --oneline refs/review/pr-19882 ^origin/main: 798c877, edff57a, 723f254, bec8f4c, 438d385); git merge-tree --write-tree origin/main refs/review/pr-19882 → CLEAN.

① Derived judgments

1. Shared-face arm — RIGHT against 乙 item 1. packages/spec/src/data/filter-comparand-shape.ts at refs/review/pr-19882: assertFieldListComparands throws arrayEqualityComparandError when Array.isArray(spec) (implicit slot; diff lines 806-808) and when op === '$eq' with an array comparand (diff 819-823); the existing walker recurses under $and / $or / $not, so depth and the empty array are covered (spec test rows, diff 430-447). No alias, no grace window anywhere in the arm. Envelope: invalidFilterComparandError → code: 'INVALID_FILTER', status: 400, asserted in the spec test (diff 444-445), in the mongo pin (diff 262-263, 299-300) and carried by the three conformance rows (code: 'INVALID_FILTER', diff 856-881). Scalars, null / $eq: null, { $field }, list operators incl. $in: [] / $nin: [], and no-$-key maps pass exactly as before (LIT CONTROL tests, diff 519-564).
2. Remedy spellings — RIGHT. The ruling names FilterOperatorSchema; git grep -n FilterOperatorSchema origin/main -- packages/spec/src → only a comment naming ODataFilterOperatorSchema (api/odata.zod.ts:265), no such export. The PR reads $in / in and $contains / contains off FieldOperatorsSchema and AST_OPERATOR_MAP and pins both (test diff 501-517). $contains as MEMBERSHIP on a multiple: true / JSON column is the spec's declared reading (filter.zod.ts:901-912 at origin/main, driver-sql: the $contains MEMBERSHIP spelling on any multi-valued / JSON column is a DATABASE_ERROR 500 on live PostgreSQL (SQLSTATE 42883, operator does not exist: json ~~ text) — it has only ever been executed on SQLite #17590). Same docblock :942 records driver-memory "DOES NOT ANSWER IT YET" (driver-memory: the stored-ARRAY value axis is still unrepaired outside the equality arm — $in/$nin, the text family and the ordering family answer one filter two ways, and the two exclusion arms answer it in the WIDENING direction #17286) — the prescription follows the spec as the ruling asks; the delivery gap is pre-existing and not this PR's.
3. "Leading sentence is driver-memory's verbatim" — TRUE: packages/drivers/driver-memory/src/filter-refusal.ts:729-734 at origin/main vs face diff 762-769 share the first sentence to the word.
4. Both engine doors reach the arm — RIGHT. packages/objectql/src/engine.ts at PR ref: lowerWhereFilterArray calls the delegating wrapper on the object form (:866) and parseFilterAST with the context prefix on the array form (:939); it runs for find :10075, findOne :10365, update :11683, delete :14142, count :14659, aggregate :14763, and aggregations[i].filter is gated at :14776. The wrapper packages/objectql/src/filter-comparand-shape.ts:103-109 delegates and is unchanged.
5. driver-mongodb pin — RIGHT against item 2. New mongodb-equality-array-comparand-refusal.test.ts, 13 tests: a recording double whose only read path is translateFilter gets 0 calls through Door 2, the object form, $eq and count under $or; direct-composition pin; reverse-direction pin keeps the driver's own passthrough visible; mingo 7.2.4 named, "A live mongod is NOT MEASURED" stated (docblock lines 145-153). No driver source edit (files list). @objectstack/objectql is an existing devDependency (driver-mongodb/package.json:30 at PR ref; not in the PR's file list).
6. Header sentence and conformance — RIGHT against item 3. The header now lists both slots the sentence is true of (diff 631-641). FILTER_COMPARAND_TYPE_CASES gains 3 door-refusal rows; git grep -l FILTER_COMPARAND_TYPE_CASES origin/main shows the table consumed by driver-sql, driver-memory, driver-mongodb, driver-sqlite-wasm, driver-turso and objectql suites, and driver-sql's harness runs door-refusal rows through parseFilterAST once (sql-driver-comparand-type-conformance.test.ts:37-42,99-102).
7. ADR-0087 — RIGHT. New 18.filter-equality-array-comparand-refused.ts; registry.ts +69 is the same text (generated); no D2 conversion, hand migration only, matching the sibling 18.view-filter-rule-scalar-operator-array-refused shape.
8. Follow-ups not absorbed — RIGHT. [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889: filter.zod.ts untouched, FieldOperatorsSchema.$eq remains z.any() (origin/main :266). [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886: $ne is skipped at the face (diff 815-819) and carried only as it.todo (diff 566-571), no green pin.
9. Consumer re-judgments — acceptable: two spec pins that asserted the exact slot the ruling closes are inverted; the field-reference row is re-judged to the refusal; two probe helpers now catch; metadata-core's three ARRAY where.id rows retired (see ③).
10. MISSING — the compile-surface declaration. .claude/skills/pm-dispatch/references/execution-duties.md:137 at origin/main: filter/predicate semantics ⇒ declare face by face against the compile-surface list, ⛔ never silently skip. Against compile-surfaces.md at origin/main, the PR body concludes on these faces:

• Face 1 driver-sql: declared (400 top-level / 500 nested before; behind the door after). OK. Note origin/main since the base carries [finding] driver-sql answers an equality-slot array NESTED under $and / $or / $not with 500 DATABASE_ERROR, while the same shape at top level gets 400 INVALID_FILTER #19885 (sql-driver.ts +46: the nested leaf now takes assertCompilableComparand), so the PR's "nested → 500" describes the base only.
• Face 2 turso RemoteTransport: NOT NAMED — grep -c of the PR body for RemoteTransport, remote-transport, buildWhereSQL → 0, 0, 0. The body calls driver-turso "built on driver-sql", true of local mode only; row 2 of the list says the remote compiler does not inherit face 1. Source at origin/main: remote-transport.ts:487 classifies a bare array as requireValue, :612 names it an array for refusal, :660 sets INVALID_FILTER; so it refuses on its own and now sits behind the shared face. Compliant, silently skipped.
• Face 3 read-scope-sql compileScopedFilterToSql: NOT NAMED (0 hits for read-scope, compileScopedFilterToSql). Neither read-scope-sql.ts nor its callers (native-sql-strategy.ts:654, objectql-strategy.ts:559) call parseFilterAST / assertListComparandShapes. Bare array → readScopeCompileError = READ_SCOPE_COMPILE_FAILED / 500 fail-closed (:755, :436-440); $eq: [...] → col = ? with the array bound (:1273) — a source reading, not executed; whether a policy scope crosses the face further upstream is not traced here. Silently skipped.
• Face 4 analytics filter-normalizer: declared — FilterArray form now refused through parseFilterAST (:1521), OBJECT form still read as IN and explicitly reported out of scope. OK.
• Face 5 formula: the before-state is declared ("no row"); the after-state is not. origin/main since the base carries fix(formula): refuse an array comparand under $ne and in the equality slot (write-check bypass) #19946 ([finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 phase 2a): matches-filter.ts:196-255 refuses the bare array and $eq / $ne arrays (0 hits for 19886 at base 2548ba57de). Seat-5 ruling 5805921577 left fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face #19882's scope unchanged. No conclusion in the PR body.
• Half-face objectql having-filter: NOT NAMED (0 hits for having, applyHaving, matchesHaving). Measured from source: engine.ts at PR ref gates where (:866, :939) and aggregations[i].filter (:14776) but hands ast.having to applyHaving ungated (:14885, :14929); having-filter.ts:357-363 at origin/main sends an array condition into the implicit-equality arm value == condition, and the $eq arm is value != target (:396); node -e → 5 == [5] true, 'a' == ['a'] true. So having: { total: [5] } still ANSWERS, by JS coercion, on every driver — the slot the ruling closes stays open on the one face the list marks as having no conformance table, so no gate goes red for it. Silently skipped, with a live open slot.
• driver-memory / driver-mongodb: declared. OK.
  Context, not excuse: the dispatch claim 5794711842 did not copy the face list into the order (dispatch-runbook.md:231 says the dispatcher does); the PR-side duty at execution-duties.md:137 stands regardless.

② Semver level

• .changeset/19757-equality-slot-array-refused.md: "@objectstack/spec": minor; summary fix(spec)!:; **BREAKING** banner; Clause-②: no (narrowing) — … line; exactly one HTML-comment marker reading adr-0087: registered filter-equality-array-comparand-refused. AGENTS.md at origin/main :1084-1085 ((narrowing) is BREAKING; no (widening) malformed, no (narrowing) is the valid arm) and :1095-1096 (one marker; the changeset carries the PR's Clause-② line) are met. scripts/check-changeset-no-major.mjs:63 and :1463-1467: an accept-set narrowing ships minor in the launch window. Marker spelling matches scripts/check-adr-0087-registration.mjs:62 and the registered reader at :1931; the id resolves through :1968 (id: 'filter-equality-array-comparand-refused', in the new entry) and is new in the diff, as registered requires. The arm is read by scripts/pm/clause2-line.mjs (:243-247 reads the arm with trailing prose after it). Check Changeset and Lint & Repo Gates are success at head. Level and declaration: CORRECT.
• .changeset/19757-dispatch-cases-array-where-id-retired.md: "@objectstack/metadata-core": patch, no BREAKING, no marker — consistent: three rows leave an exported conformance table, predicates and exports unchanged, nothing a consumer compiles against moves.
• PR body sentence "Both changesets and this body therefore carry the same line" is false: the metadata-core changeset carries no Clause-② line (diff lines 7-23). Prose only, non-blocking.

③ Boundary flags

• BLOCKING — compile-surface declaration duty unmet (①.10): faces 2 and 3 and the having half-face silently skipped; face 5 without an after-conclusion; the half-face carries a measured open slot (having: { total: [5] } answers true). Remedy, either shape: (a) amend the PR body face by face — changed / already compliant with the file:line evidence above / out of scope with reason — and file the having gap and the read-scope $eq array bind as their own cards; or (b) gate having at the engine seam, which is a cross-lane objectql edit outside the claim and needs the seat's word. (a) is the smaller fix and needs no code.
• Files outside the claimed surface, all declared in PR §4 with reasons: metadata-core/src/engine-delete-dispatch.ts, engine-update-dispatch.ts (rows retired, notes added), driver-memory/src/memory-filter-ast-vocabulary.test.ts, filter-field-reference-lowering.test.ts, filter-comparand-type.ts (one comment), filter-comparand-type-conformance.ts, scripts/doc-authoring-prose-id.baseline.json (shrink only, #11230 6 → 5). Non-blocking. Dev open_question answered: option A (retire the rows) is accepted — the tables' scope is dispatch-reachable input and no double models any face refusal; C carves an exception into the A compare-and-set where on a by-id update is silently inert — the extra predicate keys never reach the driver, and SqlHttpOutbox.redeliver's status guard is one of them #11009 same-words contract; D changes helper signatures. Non-blocking.
• Pin not weight-bearing and set to fight the follow-ups: filter-comparand-shape.test.ts diff 545-547 pins arrayValued exactly equal to ['$between','$eq','$in','$ne','$nin'] from FieldOperatorsSchema.safeParse — that asserts the SCHEMA door still accepts $eq / $ne arrays, which is what [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889 (and any $ne ruling) would close, while the loop below already excludes both. Non-blocking; assert containment of the three list operators instead.
• Published prose now false and not edited (dev flagged, "Carrier: none"): driver-memory/src/filter-refusal.ts:739 still ships "@objectstack/spec's comparand door leaves this position to the driver" inside a user-facing refusal; the claim forbade driver source edits, so a carrier card is the fix. filter-comparand-type.test.ts title "their semantics are per-driver today" is stale. Both non-blocking.
• Prose vs the tree that ships: PR body, changeset and the ADR-0087 entry say "at this release" driver-sql nested → 500 and formula → no row; origin/main since the base carries [finding] driver-sql answers an equality-slot array NESTED under $and / $or / $not with 500 DATABASE_ERROR, while the same shape at top level gets 400 INVALID_FILTER #19885 and fix(formula): refuse an array comparand under $ne and in the equality slot (write-check bypass) #19946, so both cells describe base 2548ba57de, not the merged tree. Non-blocking; date the measurement to the base.
• ADR-0087 entry and PR body call driver-turso "built on driver-sql" — true of local mode only; remote mode is its own compiler. Non-blocking.
• Dev out-of-scope findings answered: class a driver-sql nested 500 — already closed upstream by [finding] driver-sql answers an equality-slot array NESTED under $and / $or / $not with 500 DATABASE_ERROR, while the same shape at top level gets 400 INVALID_FILTER #19885; class b $ne — [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886, correctly not absorbed; class b analytics OBJECT form as IN — explicitly out of scope, needs its own card if none exists; class c schema door — [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889, correctly not absorbed.
• Base drift: branch not rebased; merge-tree clean; the only overlapping path is generated registry.ts. Non-blocking.
• PR is draft: true; process only, non-blocking.
• Check-runs at head: 32 success / 3 skipped / 0 failure; none re-run locally.

Implemented-by: claude/issue-19757-equality-slot-array-refused
Reviewed-by: session_019c3Hi6ZMU1p6m6aA6Bz45d

VERDICT: FAIL — one blocking item: the face-by-face compile-surface declaration required by execution-duties.md:137 is missing for turso RemoteTransport, read-scope-sql and the having half-face, and absent as an after-state for formula; the having half-face measurably still answers an array in the equality slot. Everything else, including the shared-face arm, the envelope, the mongo pin, the changeset level and the ADR-0087 registration, is correct against ruling 乙.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: 68/68 CONTRACT_REVIEW_TIER
Head-sha: 438d385af3913f136ebb71f031da4a48ce0066c1

Isolated at-tier reviewer subagent, run by the domain:spec seat-4 session; every one of its 68 transcript turns served at the tier the constant names. Re-review after the takeover patch round (the maintainer's 「你接手派补丁轮」); it supersedes the FAIL record 5808368753. Adopted by the seat 2026-09-24T14:11Z. The record below is the reviewer's, unedited except the two header lines.

Re-review on the same head after record 5808368753 (FAIL, one blocking item). Inputs read: card #19757 body plus all 7 comments (ruling 5793368540, takeover 5814344181, dev report 5796984894, seat-5 note 5805928574); PR #19882 body as amended at 2026-09-24T13:59:04Z, pulls/19882/files (14 rows, +844/-20), 2 issue comments (docs-drift bot, prior record), 0 reviews, 0 review threads; issues #19974, #19975 (both open, 0 comments, no labels, no assignee, filed 13:57:26Z and 13:57:54Z), #19886, #19889, #19888; commits/438d385af3/check-runs → 42 rows: 37 success, 5 skipped (Auto Label, Check PR Size, Console Pin Gate, Build Docs, Packed-tarball smoke opt-in), 0 failure; the 7 rows after 13:59Z are the re-runs the body edit triggered (the four claim / part-of checks and Check Changeset all success); no gate family re-run locally. Git: refs/review/pr-19882 = 438d385af3 = the same 5 commits atop merge-base 2548ba57de; origin/main = 2c1011b01b, 36 commits past the PR base 1f89ba0d70; git merge-tree --write-tree origin/main refs/review/pr-19882 exit 0 (clean). No file in the diff changed since the prior record, so every code-level judgment there holds by identity; each was spot-checked again below.

① Derived judgments

1. Head and diff unchanged — the prior record's items 1 to 9 stand. Spot-checks at the PR ref: the arm throws arrayEqualityComparandError on Array.isArray(spec) (filter-comparand-shape.ts:779-780) and on op === '$eq' with an array (:792-794); $ne is explicitly not judged (:258); the face runs inside parseFilterAST (filter.zod.ts:4 import, :2438 call) and behind the objectql wrapper (objectql/src/filter-comparand-shape.ts:43 re-export, :109); the header now names both slots the sentence is true of (:73-83); it.todo for $ne at test :400 and :623; ADR-0087 id at entries/semantic/18.filter-equality-array-comparand-refused.ts:14 and generated registry.ts:8711; three door-refusal conformance rows; FILTER_COMPARAND_TYPE_CASES consumed by the driver-sql, driver-memory, driver-mongodb, driver-sqlite-wasm, driver-turso and objectql suites at origin/main.
2. Section 5 row 1 (driver-sql, changed) — TRUE. #19885 is the issue; it landed as PR fix(driver-sql): a bare comparand nested under $and/$or/$not gets the top-level refusal and compilation #19908, commit beac79802 on origin/main (Fixes #19885), and sql-driver.ts:15673-15684 now calls assertCompilableComparand(field, '=', value, condition) on the nested leaf, so the "nested → 500" cell is indeed a base-only reading, as the row says.
3. Row 2 (turso RemoteTransport, already compliant) — TRUE at origin/main. remote-transport.ts:487 classifies Array.isArray(spec) as requireValue under the comment "A bare array is REFUSED by serializeComparand"; serializeComparand (:3946-3959) admits only null, a bindable Date and isAcceptedFilterComparand values and throws uncompilableComparand for the rest; :612 names the form an array; :658-661 sets INVALID_FILTER / 400. Pinned at remote-transport-comparand-refusal.test.ts:213-224 for both $eq and the implicit slot. compile-surfaces.md row 2 confirms remote mode is its own compiler; "now also behind the shared face" is true for engine-routed queries (engine.ts:866 / :939 gate before any driver).
4. Row 3 (read-scope-sql, out of scope, filed) — TRUE as a source reading. compileScopedFilterToSql is exported at read-scope-sql.ts:503; its only two non-test callers are native-sql-strategy.ts:654 and objectql-strategy.ts:559; none of the three files calls parseFilterAST or assertListComparandShapes (the only hits are comments at native-sql-strategy.ts:218, :278, objectql-strategy.ts:1791). A bare array throws readScopeCompileError at :755-756, whose envelope is READ_SCOPE_COMPILE_FAILED / 500 (:436-440); $eq compiles to col = ? via bind (:1273), and bind (:774-777) pushes any value unchecked, so an array is bound. read-scope-sql compiles $eq: [...] in a policy scope as col = ? with the array bound (read-scope-sql.ts:1273) — outside ruling 乙's shared face; a bare array fails closed as 500, not 400 #19975 records exactly this, with measurement as its step 1. A policy-scope compiler is not a driver, the claim's surface excluded it, and the ruling's letter names the shared face, the mongodb pin, the header sentence and the conformance suite — "out of scope with reason" is the right conclusion.
5. Row 4 (analytics filter-normalizer, FilterArray changed, OBJECT form out) — TRUE. :1521 runs parseFilterAST, which now carries the arm; the OBJECT form at :1078-1080 ("Implicit equality / array → in") is untouched and is [finding] service-analytics' filter normalizer reads an implicit-equality ARRAY as IN, while ruling 乙 refuses the same shape at the shared face "for every driver at once" #19888 (open, pm:blocked, blocked-by [finding] the comparand-SHAPE face declares it closes the door "for every driver at once", but an array in the IMPLICIT-EQUALITY slot passes it — and driver-mongodb alone answers it, as an exact-array match #19757).
6. Row 5 (formula, already compliant at origin/main) — TRUE. fix(formula): refuse an array comparand under $ne and in the equality slot (write-check bypass) #19946 is commit c1641868a on origin/main; matches-filter.ts:202 declares ARRAY_REFUSED_OPERATORS = ['$eq', '$ne'], :248 refuses the bare array, :250-253 refuse $eq / $ne arrays, all inside the up-front walk assertFilterShape called from matchesFilterCondition (:221). No formula file is in this PR's 14 rows.
7. Row 6 (objectql having half-face, out of scope, filed) — TRUE and the slot is measurably open. At the PR ref engine.ts:866 and :939 gate where, :14776 gates aggregations[i].filter, and :14885 / :14929 hand ast.having to applyHaving ungated; the same holds at origin/main at :870, :943, :15059, :15168, :15212, and this PR does not touch engine.ts. having-filter.ts:279-282 filters through matchesHaving (:292-322, no shape gate; a non-$ key goes to checkCondition), and :356-364 sends an array condition to value == condition; node -e gives 5 == [5] true and 'a' == ['a'] true. No driver consumes ast.having: git grep -i having origin/main -- packages/drivers (non-test) hits only comments in driver-memory. objectql having answers an array in the equality slot by JS coercion (having: { total: [5] } is true) — the one face ruling 乙 closes "for every driver at once" that no gate reaches #19974 records the seam and a remedy shape.
8. Row 7 (driver-memory behind the face; driver-mongodb pinned) — TRUE. The pin has 13 tests: 6 it.each rows composing parseFilterAST then translateFilter (:126-141), 1 lit control (:143), 4 it.each rows through both engine doors with translateFilter called zero times (:163-177), 1 lit control (:179), 1 reverse-direction pin (:186); mingo 7.2.4 is named (:19) and "A live mongod is NOT MEASURED" is stated (:24); the only file under driver-mongodb/src in the diff is the test. driver-memory runs the table through memory-comparand-type-conformance.test.ts.
9. Coverage of compile-surfaces.md at origin/main: faces 1 to 5, the half-face, and the 已解冻 pair map onto rows 1 to 7 with no face missing, each with one of the three allowed conclusions and file:line evidence. The duty at execution-duties.md:137 ("编译面清单逐面申报,⛔ 静默略过") is now met. The "Correction to §2" is also true: the metadata-core changeset (17 lines) carries no Clause-② line.
10. Ruling 乙 versus the having half-face — filing objectql having answers an array in the equality slot by JS coercion (having: { total: [5] } is true) — the one face ruling 乙 closes "for every driver at once" that no gate reaches #19974 is an acceptable discharge for THIS PR. The ruling's three numbered items name the shared-face arm, the driver-mongodb pin, and the header sentence plus the conformance suite; all three are delivered at this head. "For every driver at once" is a sentence about drivers, and every driver is reached only through parseFilterAST or the engine's where / aggregations[i].filter gates, both of which now carry the arm, with every driver conformance suite running the three new rows. having is not a driver face: no driver reads ast.having, applyHaving runs engine-side after aggregation, and it gives one answer on every driver — so it is not the cross-driver divergence the ruling closes but a same-package inconsistency between the where slot and the having slot. compile-surfaces.md marks it a half-face whose DECLARATION duty is undiminished, which is what the amendment satisfies; a gate there is an objectql source edit outside the claim 5794711842 (spec plus one mongodb pin, "⛔ No driver source edit"), and the prior record's remedy (a) offered exactly this filing. Correctly carried by objectql having answers an array in the equality slot by JS coercion (having: { total: [5] } is true) — the one face ruling 乙 closes "for every driver at once" that no gate reaches #19974.
11. Dedupe of the two new cards checked against the open set: [finding] service-analytics' filter normalizer reads an implicit-equality ARRAY as IN, while ruling 乙 refuses the same shape at the shared face "for every driver at once" #19888 is the analytics OBJECT form (a different face), [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 is $ne (a different slot, with its formula half already landed as fix(formula): refuse an array comparand under $ne and in the equality slot (write-check bypass) #19946), [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889 is the schema door; neither new card duplicates them.

② Semver level

Unchanged and confirmed. .changeset/19757-equality-slot-array-refused.md at the PR ref: "@objectstack/spec": minor (:2), summary fix(spec)!: (:5), **BREAKING** banner (:7), Clause-②: no (narrowing) — … (:61), and exactly one HTML-comment marker reading adr-0087: registered filter-equality-array-comparand-refused (:63). AGENTS.md at origin/main :1084-1085 ((narrowing) is BREAKING; no (widening) malformed) and :1095-1096 (one marker; the changeset carries the PR's Clause-② line) are met; scripts/check-changeset-no-major.mjs:1463-1467 and :1502 ship a declared narrowing as minor in the launch window; scripts/check-adr-0087-registration.mjs:62 is the marker spelling. Check Changeset re-ran at 2026-09-24T13:59:11Z → success. .changeset/19757-dispatch-cases-array-where-id-retired.md: "@objectstack/metadata-core": patch, no BREAKING, no marker, no Clause-② line — consistent, since three rows leave an exported table and no export or predicate moves. Level and declarations: CORRECT.

③ Boundary flags

• Non-blocking — objectql having answers an array in the equality slot by JS coercion (having: { total: [5] } is true) — the one face ruling 乙 closes "for every driver at once" that no gate reaches #19974's body cites the $eq arm at having-filter.ts:396; at origin/main (file unchanged since c1641868a3, git diff --stat empty) that arm is :393 (case '$eq': if (value != target) return false;) and :396 is $gte. The substance is right; the PR body's row 6 cites only :357-363, which is right.
• Non-blocking — row 6's engine.ts line numbers are at the PR ref; origin/main has moved engine.ts by 335 lines through upstream commits this PR does not touch, so the same sites read :870 / :943 / :15059 / :15168 / :15212 there. Substance identical.
• Non-blocking — row 2's "now also behind the shared face" holds only for engine-routed queries; turso-comparand-type-conformance.test.ts:33 runs local mode (url: ':memory:'), so the three new conformance rows never exercise the remote compiler; its refusal stands on its own pinned test.
• Non-blocking — row 3's "policy scopes never pass the shared face" is a reading of the compiler and its two callers; whether a scope crosses a face further upstream is read-scope-sql compiles $eq: [...] in a policy scope as col = ? with the array bound (read-scope-sql.ts:1273) — outside ruling 乙's shared face; a bare array fails closed as 500, not 400 #19975's step 1, which the card says.
• Non-blocking — base drift: origin/main is 36 commits past the PR base; merge-tree clean; the only overlapping paths are the generated registry.ts (+270 upstream, +69 here) and scripts/doc-authoring-prose-id.baseline.json, where upstream changed the plugin-webhooks/auto-enqueuer.ts rows (:678-686) and this PR the metadata-core/engine-update-dispatch.ts row (#11230 6 → 5), different hunks. CI's merge-ref run was against base 1f89ba0d70 (the docs-drift comment names merge ab43d380fe); the queue's run on current main validates the merged tree.
• Non-blocking — unchanged from the prior record and still true at this head: filter-comparand-shape.test.ts:604-605 pins arrayValued exactly equal to ['$between','$eq','$in','$ne','$nin'], which [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889 or a $ne ruling would flip; driver-memory/src/filter-refusal.ts:739 still ships "@objectstack/spec's comparand door leaves this position to the driver" and filter-comparand-type.test.ts:241 still says "their semantics are per-driver today", with "Carrier: none" — a carrier card is the fix; the changeset and ADR-0087 entry's "at this release" cells for driver-sql nested and formula describe base 2548ba57de, not the merged tree.
• Non-blocking — files outside the claimed surface are the same seven declared in §4 with reasons; the dev's open question stays answered as option A.
• Process only — PR is draft: true; card assignee is os-litant and the newest Claim 5814344181 names this branch, matching the success of "The card this PR closes must claim this branch" at 13:59:42Z. The seat that amended the body and filed objectql having answers an array in the equality slot by JS coercion (having: { total: [5] } is true) — the one face ruling 乙 closes "for every driver at once" that no gate reaches #19974 / read-scope-sql compiles $eq: [...] in a policy scope as col = ? with the array bound (read-scope-sql.ts:1273) — outside ruling 乙's shared face; a bare array fails closed as 500, not 400 #19975 is the same session named below as reviewer; this record is the isolated reviewer's, verified against source and GitHub, not against the seat's narrative.
• Check-runs at head: 37 success / 5 skipped / 0 failure across 42 rows; none re-run locally.

Implemented-by: claude/issue-19757-equality-slot-array-refused
Reviewed-by: session_019c3Hi6ZMU1p6m6aA6Bz45d

VERDICT: PASS

---

Generated by Claude Code