fix(objectql)!: engine aggregate asks the field-type table for every row — min / max / avg over a refused type answer INVALID_FIELD / 400 on every driver

[objectstack-fleet]

Part of #20914
Clause-②: no (narrowing)

#20914 remains open for one row: the census found an authored sum over a type the table refuses, so the sum row is held back here and goes back to triage (section "The census" below). Every other row of the table is judged by this PR.

What this changes

engine.aggregate now asks AGGREGATE_FIELD_TYPE_COMPATIBILITY (@objectstack/spec/data, through isAggregateCompatibleWithFieldType) for EVERY aggregation that names a declared field, not only for count_distinct, with the isMultiValueField declaration half beside it. A pair the table refuses answers INVALID_FIELD / 400 before any driver is resolved. No second table: the door reads the table's rows and names the row's accepted set in its words, read off the table.

• The door is count-distinct-json-stored-door.ts generalized and renamed aggregate-field-type-door.ts (assertAggregationFieldTypesAccepted), at the same call site in engine.ts, right after the groupBy door. The old name would have lied about what it judges.
• count_distinct's refusal words are byte-identical, so its [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 pins are unchanged (the one clause of its GUARD pin that said "no verdict for any other function" is flipped, see Pins).
• The declaration half reads the table too: a field declared multiple: true holds the same value as the multi-option types (a list in a JSON column), so it takes the verdict the row gives that class. Rows refusing any multi-option type (count_distinct, avg, min, max) refuse it; count, which accepts every type, accepts it.
• Fail-closed tiers kept for every function: no field map, an undeclared name or a relationship path, a type outside FieldType (a driver alias such as string / integer), a fieldless aggregation or '*', and a function outside the table's vocabulary all get no verdict. Pinned.

FROM → TO, measured on three drivers

Through engine.aggregate (the door the REST query route, flows, hooks, roll-up recompute and the analytics ObjectQL strategy reach), two rows, real InMemoryDriver, SqlDriver on SQLite and a private PostgreSQL 16.14. Before = origin/main dfe5a0863; after = this branch's built dist at 9497f4c61.

aggregation	before: memory / SQLite / PostgreSQL	after, all three
max over json	{"a":1} / "{\"b\":1}" (a string) / 500 function max(json) does not exist	400 INVALID_FIELD
min over json	{"a":1} / "{\"a\":1}" / 500	400 INVALID_FIELD
max / min over tags	an array / a serialized array / 500	400 INVALID_FIELD
max over select with multiple: true	["a","b"] / "[\"a\"]" / 500	400 INVALID_FIELD
avg over datetime	null / 2026 / 500	400 INVALID_FIELD
avg over tags	null / 0 / 500	400 INVALID_FIELD
max over text, min over single select, max over email (string-class rows, as ruled)	"y" / "y" / "y"	400 INVALID_FIELD
controls: max number, min datetime, avg percent, max boolean, sum number, count_distinct text	one answer each	unchanged
sum over json / text / single select (held row)	0 / 0 / 500	unchanged (held)

The words: aggregate('OBJ'): aggregations[0].field takes the max of 'meta', a declared json field — a structured-JSON value, which the engine does not take the max of. The query was NOT run. max accepts a field of type number, currency, percent, rating, slider, progress, summary, date, datetime, time, boolean or toggle: aggregate a field of one of those types, or count the rows with count. followed by the reason. The route lands inside the 500 characters the REST door keeps. The thrown error carries code, status, httpStatus, field, fields, object, param.

The census (and the held sum row)

Query: every line carrying an aggregate-function literal 'min' | 'max' | 'sum' | 'avg' (either quote), across examples/** and the published hotcrm stack, each hit resolved by hand to its object and the field's declared type, then asked of isAggregateCompatibleWithFieldType.

• examples/** at dfe5a0863 (crm, todo, multi-package, showcase, embed-objectql): 21 lines (dataset measures, roll-up summaryOperations, a kpi metric, an ObjectChart aggregate, two cube measures). 0 min / max. Every sum / avg is over currency, number, progress or summary: 0 refused pairs.
• hotcrm (objectstack-ai/hotcrm cloned at 4ca8e2d4bb, source read, deps not installed): 41 lines in src / apps plus 2 in test. 0 min / max. 1 refused pair: src/sales/views/forecast.view.ts:28, the grouped list view all_forecasts on crm_forecast declares summary: 'sum' on expected_amount, a Field.formula. The table refuses sum × formula (a formula is virtual in SQL storage).
• In-repo shipped sources (packages/**, tests excluded): 0 refused pairs.
• Positive control: the same query finds the hotcrm hit itself, and over packages/services/service-analytics/src/__tests__/aggregate-datetime-measure-refusal.test.ts it finds that file's authored avg over a datetime.

Per triage's direction ("A hit stops that row and goes back to triage"), the sum row is held: ROWS_HELD_FOR_TRIAGE in the door, named in its header. Evidence for triage: on the base, sum over a formula already answers 400 INVALID_FIELD on SQLite and PostgreSQL (the SQL driver has no column) and 0 in memory; and at objectui be0ad00 a list view's column summary is a client-side footer, while the server header query reads object-grid.aggregations, so this hotcrm pair does not reach engine.aggregate through the console today. Releasing the row is deleting that one entry and flipping the sum pins.

Other doors on the engine path (H2)

No other door enforces a row of the table. The groupBy door (group-by-structured-json-door.ts) judges a group KEY, not a function's operand, and stays beside this one; the number-comparand, temporal-comparand, text-operator and no-operator-object doors judge filter comparands. So there is one door asking the table, and one verdict per pair.

Pins

• packages/objectql/src/engine-aggregate-field-type-door.test.ts (new, recording driver, so the in-memory cell by construction): max / min over json, tags, address, a multiple: true select; max over a lookup with multiple: true under groupBy: ['title'] (the shape a sibling card measured as PG 500 / SQLite serialized text / memory array); avg over datetime and json; max over text, min over select; first-offending-position across functions; scalar controls reach the driver; sum held for every type; a GUARD that asks every judged row × every FieldType against the table with per-row floors; the fail-closed tiers. Each refusal asserts code + status + httpStatus and the field, declaration, function and position in the message.
• packages/rest/src/data-aggregate-field-type-door.test.ts (new, POST /api/v1/data/:object/query over SqlDriver): SQLite always, live PostgreSQL where OS_TEST_POSTGRES_URL is set, MySQL a named skip. No CI job sets those variables for this package; the local PostgreSQL 16.14 run is below.
• Flipped, not deleted: engine-json-stored-group-distinct-door.test.ts's GUARD clause "no verdict for any other function" now asserts count and the held sum pass and avg / min / max over json are refused in the same envelope. engine-nested-object-door.test.ts reached having through a max over a master_detail and a json field; those two cases now pin the earlier refusal at this door (INVALID_FIELD, no having. words, no read). Its lookup group-key case is unchanged.

Ablation (from committed code)

node scripts/ablation-replace.mjs (WRAP, trap-restored) replaced the held-row check in aggregate-field-type-door.ts with one that also skips every function but count_distinct (marker ablation-20914-A1): anchor 1 to 0, blob 67c76fa23d15 to 80100111e881. pnpm --filter @objectstack/objectql build, then ablation-dist-preflight.mjs found the marker in 4 built files. Predicted red on the new pins only. Observed: objectql 8 failed / 22 passed (the new suite, the flipped GUARD clause and the flipped having fixture; every count_distinct pin green), REST 4 failed / 10 passed / 7 skipped (the SQLite and PostgreSQL refusal cells; controls and the #20808 cells green). Restore: blob equals HEAD, git diff HEAD empty, rebuilt, --absent found the marker in 0 of 14 built files and the tree clean, pins green again (30 / 30, 14 passed + 7 skipped).

Tests (at 9497f4c61, the merge of origin/main 2f2fa11d7)

• pnpm --filter @objectstack/objectql exec vitest run --project local: 349 files, 6830 passed.
• OS_TEST_POSTGRES_URL=(private PG 16.14) pnpm --filter @objectstack/rest exec vitest run --project local: 252 files, 5055 passed, 42 skipped (MySQL cells).
• pnpm --filter @objectstack/service-analytics exec vitest run: 150 files, 3458 passed.
• @objectstack/metadata-protocol and @objectstack/plugin-security full suites at e37028132, before the merge of origin/main (not re-run after it; the merge moved metadata-protocol's flow read path, not an aggregate path): 194 files / 2886 passed, and 150 files / 3262 passed.
• typecheck for objectql and rest: exit 0, test-typecheck ledgers held (objectql 40 / 234 / 65, rest 0).
• pnpm --filter @objectstack/spec build and check:generated: all 15 generated artifacts up to date.
• Lint, narrowed and proven: eslint (allowInlineConfig: false) over the 7 changed .ts files: 0 ignored, 7 results, 0 errors, 0 warnings; no file has parserOptions.project / projectService, so type-aware linting is off and this diff cannot move a verdict on any untouched file.
• Driver conformance ledger: 50 covered cells, 0 DEBT, 0 exempt, before and after.

Gates

node scripts/pm/dispatch-gates.mjs --commands at 9497f4c61: 88 derived, 88 run, all exit 0; --ran with exit codes: 0 NOT-MEASURED. check:dual-build-cjs-loads and check:type-check-debt first answered PREREQUISITE NOT MET (exit 3), then 0 after turbo run build over every package (71 tasks). Also run: check-changeset-fixed, check:authz-resolver, check:error-code-casing, check:filter-alias-parity, check:error-status-conformance, all exit 0. check:adr-0087-registration accepts not-required (already-registered dataset-measure-selecting-aggregate-field-type-refused, dataset-measure-aggregate-field-type-refused).

Beyond the claimed file surface

• packages/spec/src/data/aggregate-field-type-compatibility.ts: TSDoc only, three sentences that ship in dist/data/index.d.ts and said the engine door reads only the count_distinct row. The table's value is untouched (the diff has no non-comment line).
• packages/objectql/src/engine-nested-object-door.test.ts: the fixture triage above.

Acceptance notes

• no-operator-object-door.ts's having words for an aggregated column that "carries a" relation or JSON type were reached only through min / max over such a field. The door now refuses those pairs first, so that branch is unreachable through engine.aggregate for a declared field. Not touched here.
• .changeset/20783-groupby-structured-json-refused.md (pending) lists a structured-JSON field as an aggregated min / max column as unchanged; this PR's changeset says it is the later word on that shape, as the [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 changeset did for its two shapes.
• content/docs/data-modeling/queries.mdx still says count_distinct is not lowered by the SQL drivers; it is (measured 2 on SQLite and PostgreSQL). Not made false by this change.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/objectql, @objectstack/spec, touching 19 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/src/data/aggregate-field-type-compatibility.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

9 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ai/natural-language-queries.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))
• content/docs/api/client-sdk.mdx (via data.query (sdk, the route ledger binds it to POST /api/v1/data/:object/query))
• content/docs/api/wire-format.mdx (via /api/v1/data/:object/query (route, a path literal in a comment on a changed line))
• content/docs/data-modeling/queries.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason), /api/v1/data/:object/query (route, a path literal in a comment on a changed line))
• content/docs/deployment/validating-metadata.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))
• content/docs/kernel/contracts/data-engine.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))
• content/docs/kernel/runtime-services/data-service.mdx (via data.query (sdk, the route ledger binds it to POST /api/v1/data/:object/query))
• content/docs/protocol/objectql/query-syntax.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))
• content/docs/ui/dashboards.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))
• content/docs/releases/v17/17-0.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))
• content/docs/releases/v17/17-3.mdx (via AggregationFunction (symbol, a top-level type))
• content/docs/releases/v17/17-5.mdx (via count_distinct (symbol, a field of const object FUNCTION_WORDS), count_distinct (literal, a string literal in a comment on a changed line; a string literal in jsonStoredDistinctTargets; a string literal in routeAndReason))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/src/data/aggregate-field-type-compatibility.ts) — pages documenting those are invisible to this run
• 7 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 138 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 2f2fa11d756f665a4c06160480c1dce15b9d67a4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from aac4ffd49c9ab27bcb4532a9e3a40cbe55228be4 — the merge of head 9497f4c614e8939c3fad25bf25df08393a54c5af into base 2f2fa11d756f665a4c06160480c1dce15b9d67a4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin aac4ffd49c9ab27bcb4532a9e3a40cbe55228be4 && git checkout aac4ffd49c9ab27bcb4532a9e3a40cbe55228be4
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 2f2fa11d756f665a4c06160480c1dce15b9d67a4 9497f4c614e8939c3fad25bf25df08393a54c5af && git checkout -B drift-repro 2f2fa11d756f665a4c06160480c1dce15b9d67a4 && git merge --no-ff 9497f4c614e8939c3fad25bf25df08393a54c5af

node scripts/docs-audit/affected-docs.mjs --json 2f2fa11d756f665a4c06160480c1dce15b9d67a4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 2f2fa11d756f665a4c06160480c1dce15b9d67a4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9497f4c614e8939c3fad25bf25df08393a54c5af
Local-runs: none

Inputs, and nothing else: card #20914 (body and its five comments 5916785741, 5922062362, 5922620655, 5923896529, 5923929098), PR #21037 (body, nine-file list, net diff against the merge-base 2f2fa11d7 on origin/main: 885 added, 180 removed), and the 32 check-runs on the head. The PR is judged as the half it says it is (Part of #20914, the sum row held); the pm:retriage question on the card is not answered here.

① Derived judgments

1. The accept-set narrowing at engine.aggregate — right. Every aggregation naming a declared field whose type is in FieldType is asked of AGGREGATE_FIELD_TYPE_COMPATIBILITY for its own function through isAggregateCompatibleWithFieldType; a refused pair throws INVALID_FIELD / status 400 / httpStatus 400 with field, fields, object, param before any driver is resolved. Read off the table at the merge-base: min / max accept the numeric seven, the temporal three and the boolean two (12 types); avg the numeric seven plus the boolean two (9); count every type; count_distinct every type but the ten JSON-stored ones. The refusal's "accepts a field of type …" clause is generated from the row in the table's own order, and the pins hold the exact string. No second table: the door carries no accept list of its own.
2. The widest narrowing in the diff is the string-class min / max row, not the card's JSON case — right, as ruled. max over a text answered one string on all three drivers at the merge-base and answers 400 now. That is the table as ruled (AGGREGATE_FIELD_TYPE_COMPATIBILITY refuses min/max over the string classes while 15 shipped end-to-end cases depend on them working — the table or the uses must give #17513, the batch 🔗 Broken links detected in documentation #127 settlement named in the table's TSDoc), applied by triage's "whole table" direction and not re-ruled; the changeset names it ("a collation-dependent string for a text field"). Census: the PR and report count 0 authored min / max in examples/** and hotcrm; spot-checked at the merge-base, examples/** carries 21 aggregate-function literals, 17 sum and 4 avg, 0 min / max, every operand a currency / number / progress / hours field.
3. The declaration half — right, and byte-identical for count_distinct. isMultiValueField (spec) is true for the three multi-option types and for a multi-capable type (select, radio, lookup, user, file, image) declared multiple: true; the door derives rowAcceptsMultiValue from the row's verdict on the multi-option types, so count accepts the class and the other four judged rows refuse it. For avg / min / max every multi-value declaration is already refused by its type row, so this half adds no pair beyond the table for the newly judged rows; it only changes the words ("with multiple: true — a multi-value field"). For count_distinct the old and new message constructors were compared segment by segment (position, declaration, kind, the "also" list, the route, the reason): identical bytes, and the [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 pins are untouched. One prose nit, no behaviour on it: the changeset lists the multi-capable types without radio, which MULTI_CAPABLE_TYPES holds (radio is refused by the type row for the three rows anyway, and count_distinct × radio + multiple was refused before this PR).
4. The sum hold — right as the half it says it is. ROWS_HELD_FOR_TRIAGE skips a ROW of the table, never a pair, so it re-rules nothing and is not a second table; it is the literal execution of triage's binding rule "a hit stops that row and goes back to triage" (claim 5922620655 quoting direction 5916785741). Pinned both ways: sum × every FieldType gives no verdict, and sum amount reaches the driver on SQLite / PostgreSQL. The cost stays named in the changeset and the body: sum over json / text / select still answers 0 / 0 / 500 until the row is released, and that decision sits on the card (5923929098), not here.
5. Fail-closed tiers — right. No field map, an undeclared name or relationship path, a declared type outside FieldType (string, integer, object), a fieldless aggregation or '*', and now a function outside the table's vocabulary (median, toString, an array) all pass with no verdict, pinned; this is the table's own "cannot answer, do not block" tier, and the REST door still answers an unknown name INVALID_FIELD before the engine.
6. Door placement and the two flipped pins — right. Same call site in engine.ts, after the groupBy door and before the per-aggregation filter and having doors, so the two having fixtures in engine-nested-object-door.test.ts (max over a master_detail, max over a json) now meet this door first: moved into their own test that pins the earlier refusal (no having. words, zero reads), not deleted; the lookup group-key case still pins the having rule. The [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 GUARD clause "no verdict for any other function" flips to "count and the held sum pass; avg / min / max over json are refused in the same envelope at the same position" — the clause that could not survive the whole-table door, and nothing else in that suite moves.
7. Public surface — right, with one prose imprecision in the published .d.ts. @objectstack/objectql exports . and ./core only; count-distinct-json-stored-door.ts was imported by engine.ts and one test and never re-exported, so the rename to aggregate-field-type-door.ts is internal and "no export or published type changes" holds. @objectstack/spec: a comment-stripped diff of aggregate-field-type-compatibility.ts is empty — no non-comment line moved; the table and the predicate are byte-identical. What the published .d.ts prose now says: the module header, that the table "has a third reader, the engine's aggregate door, which refuses a query-time pair the table refuses — the count_distinct row since [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808, the other rows since [finding] max / min over a JSON-stored field answers per driver at the engine (memory an object, SQLite a string, PostgreSQL 500): the compatibility table refuses them, but the engine aggregate door enforces only its count_distinct row #20914; objectql's aggregate-field-type-door.ts names the rows it judges"; the predicate's TSDoc, that it is "the one the engine's aggregate door asks for a query-time pair ([finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808, [finding] max / min over a JSON-stored field answers per driver at the engine (memory an object, SQLite a string, PostgreSQL 500): the compatibility table refuses them, but the engine aggregate door enforces only its count_distinct row #20914)"; and the "does NOT do" section, "the engine's aggregate door at query time ([finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808, [finding] max / min over a JSON-stored field answers per driver at the engine (memory an object, SQLite a string, PostgreSQL 500): the compatibility table refuses them, but the engine aggregate door enforces only its count_distinct row #20914 — the door names the rows it judges)". Removing the three sentences that this landing would have made false is right. But "the other rows since [finding] max / min over a JSON-stored field answers per driver at the engine (memory an object, SQLite a string, PostgreSQL 500): the compatibility table refuses them, but the engine aggregate door enforces only its count_distinct row #20914" is over-inclusive by the held sum row, and the deferral clause points at an objectql source file a spec consumer's .d.ts cannot see. Judged a prose imprecision, not a contract defect: the file says of itself that it "refuses nothing itself", the normative accept-set lives in the objectql changeset, which states "Not judged yet: sum" in full. Owed: one clause ("every row but sum", or the plain list) on whichever follow-up settles the sum row; named here so it is not lost.
8. The pending .changeset/20783-groupby-structured-json-refused.md lists a structured-JSON field as an aggregated min / max column as unchanged — superseded correctly. This changeset's "Unchanged" paragraph declares itself the later word on that shape in the same release, the form the pending [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 entry already used for count_distinct. No edit to the pending file, which is right: a merged changeset is a record.
9. Check-runs on the head — their conclusions are the gate verdicts; 13 are not verdicts yet. Completed success (16): Auto Label, Build Core, Dogfood Verify CLI, Type Check · source gates, Type Check · debt ledger, Governed Surface Queue Guard, The card this PR closes must claim this branch, Spec property liveness, No other open PR may claim the same single-writer path, filter, Check Changeset (the job that runs the ADR-0087 disposition gate), Check Documentation Links, Part-of PR must not also close its card, No other open PR may claim the same issue, Check PR Size, Flag docs affected by code changes. Completed skipped (3): Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in). Still in_progress, each one not a verdict: Test Core (1/6), Test Core (2/6), Test Core (3/6), Test Core (4/6), Test Core (5/6), Test Core (6/6), Dogfood Regression Gate (1/3), Dogfood Regression Gate (2/3), Dogfood Regression Gate (3/3), Temporal Conformance (live PG + MySQL), Lint & Repo Gates (which owns pnpm lint, check:api-surface and the check:generated reconcile), Type Check · workspace, Type Check · consumer gates. Not polled. The one commit status is Vercel, cancelled by its ignored-build step. The landing waits on the 13 whatever this record says; nothing here substitutes for them.

② Semver level

• .changeset/20914-aggregate-door-whole-table.md declares @objectstack/objectql: minor and @objectstack/spec: patch, a **BREAKING** banner, Clause-②: no (narrowing), and exactly one adr-0087 marker comment, not-required (already-registered dataset-measure-selecting-aggregate-field-type-refused, dataset-measure-aggregate-field-type-refused).
• It matches what the diff publishes. objectql publishes an accept-set narrowing of aggregate and no export or type change: (narrowing) is BREAKING (AGENTS.md, Post-Task Implement ObjectStack protocol specification with Zod schemas and TypeScript interfaces #3), and a pre-GA break ships minor with the banner and its disposition (ADR-0087, the [Decision] 两条裁决援引同一个 launch-window convention，却给出相反的 changeset 等级（minor vs major）—— 退役一个可写键到底发哪一级？ #18003 level amendment; check-changeset-no-major pushes breaks to minor outside pre-mode) — the same shape as the pending [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 and [finding] groupBy on a json field answers 500 DATABASE_ERROR on PostgreSQL, one merged group on memory, and one group per serialized value on SQLite #20783 entries. spec publishes .d.ts prose only: patch, and not skip-changeset, since a released package publishes something. The migration text is present and specific: FROM → TO per pair, what to write instead (the accepted types per row, read off the table), who is affected (every caller reaching the engine, roll-up recompute, grouped header summaries, chart / metric aggregates), the held row, and the unchanged set.
• The disposition is sound: the pairs refused here are exactly the pairs the table already refuses, the table is not edited, and the two registered ids cover the min / max and avg families under protocol major 18; the door refuses a query shape, not a stored one.
• Clause-②: line: PR body line 2 reads Clause-②: no (narrowing), the changeset carries the same line, and the claim (5922620655) said Clause-②: no. Nothing is widened — every pair accepted now was accepted at the merge-base; the set only shrinks. Right.
• Check Changeset, the job carrying check-adr-0087-registration, is success on this head.

③ Boundary flags

Dev deviations (os-dev-report 5923896529), each answered:

1. Body opens Part of #20914, not the dispatch's Fixes — right for this head: the census hit holds a row, so the card must outlive the PR; the "Part-of PR must not also close its card" and "The card this PR closes must claim this branch" checks are success.
2. The sum row held by ROWS_HELD_FOR_TRIAGE — answered in ① item 4: faithful to the binding census rule, row-level, named in the door header, the changeset and the pins. The release question is already escalated (5923929098) and is not answered here.
3. File surface breached in two named places. (a) packages/spec/src/data/aggregate-field-type-compatibility.ts, TSDoc only — verified comment-only in ① item 7; the claim fenced the TABLE, and the table's value is byte-identical; leaving three sentences that this landing falsifies in a published .d.ts would have been the larger harm; carried by a spec patch; the one-row over-inclusion is named and owed on the follow-up. (b) engine-nested-object-door.test.ts — fixture triage, cases moved not deleted, the surviving case still pins the having rule (① item 6). Both accepted.
4. The coordinator's mid-task addition, max over a multi-valued lookup under groupBy: ['title'] — pinned in both files (objectql: owners; REST: grouped max owners), refused by the type row. Answered.
5. Commit trailers model-free — verified on all five non-merge commits (the session-link trailer plus the model-free co-author trailer AGENTS.md prescribes; no model name on any commit); AGENTS.md's trailer rule governs this repo. Answered.
6. metadata-protocol and plugin-security suites run at e37028132, not re-run after the merge of origin/main — escalated to the head's Test Core shards, which own those suites and are in_progress (not verdicts); no local re-run, by design of this review.

open_questions, each answered or escalated:

1. Release the sum row at the engine door (A / B / C) — escalated, not this record's question; it sits with triage on 5923929098. Whichever way it goes, the spec .d.ts clause in ① item 7 travels with it.
2. Keep Part of — answered for this head: keep; a later body edit is the seat's act after triage answers, as the report already says.

PR acceptance notes, each answered:

• no-operator-object-door.ts's having words for an aggregated relation / JSON column are now unreachable for a declared field — no contract change; a dead-path cleanup is its own card, not a rider on this one.
• The pending [finding] groupBy on a json field answers 500 DATABASE_ERROR on PostgreSQL, one merged group on memory, and one group per serialized value on SQLite #20783 changeset's "unchanged" line — superseded in-release, ① item 8.
• content/docs/data-modeling/queries.mdx still says count_distinct is not lowered by the SQL drivers — pre-existing, not made false here; out_of_scope_findings[0] carries its dedupe words for triage.

out_of_scope_findings: three, none a condition of this landing.

Reviewer's own flags:

• The REST pin's PostgreSQL and MySQL cells are env-gated and no CI job provisions them (the file header says so): the SQLite cell is the only CI-held cell of that file; the PostgreSQL evidence is the dev's local run, named as such. Acceptable for this landing, the same shape as the [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 REST pin — named so nobody reads "three drivers" as three CI cells.
• 13 check-runs were in_progress at review time, listed per check in ① item 9. This record passes the contract; it does not stand in for a green head.

Implemented-by: claude/issue-20914-aggregate-door-whole-table
Reviewed-by: session_01Ujdtvqs7ree7WyQmEDwEnG

VERDICT: PASS