fix(objectql)!: exempt summary from the numeric type check; progress keeps it

Seat ruling 5860986842 on #20308: the number branch's door is
NUMERIC_VALUE_TYPES minus COMPUTED_VALUE_TYPES, so a roll-up max/min over a
temporal child field recomputes as at base. The changeset declares the
progress narrowing (Clause-② no, narrowing; BREAKING, minor).

Claude-Session: https://claude.ai/code/session_01Bvd69VPa6puiNzzPUroDBx
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20308-blank-typed-value-null.md

@@ -1,11 +1,16 @@
 ---
-"@objectstack/objectql": patch
+"@objectstack/objectql": minor
 ---
 
-fix(objectql): a cleared number, boolean, date, datetime or time field stores `null`, on every backend (#20308)
+fix(objectql)!: a cleared number, boolean, date, datetime or time field stores `null` on every backend, and a `progress` field refuses a non-numeric value (#20308)
 
-`patch` — a bug fix in a released package. No exported symbol, no spec key and
-no API signature changes.
+Clause-②: no (narrowing)
+
+**BREAKING** — shipped as `minor` under the launch-window convention
+(`check-changeset-no-major` refuses `major` until GA; breaking-ness is carried by
+this banner and the ADR-0087 disposition below, never by the level). The one
+narrowing: a non-numeric string written to a `progress` field is now refused
+with `invalid_number` on memory and SQLite, where it used to be stored.
 
 ## What was wrong
 
@@ -25,8 +30,9 @@ had three outcomes:
 objectui's edit form sends a cleared date, datetime or time box as `''`, so this
 is the ordinary "clear the field and save" gesture.
 
-Separately, `progress` and `summary` had no type check at all: a non-numeric
-string such as `'abc'` was stored verbatim on memory and SQLite.
+Separately, `progress` had no type check at all: a non-numeric string such as
+`'abc'` was stored verbatim on memory and SQLite, and failed at the driver as a
+`500` on PostgreSQL.
 
 ## What changes
 
@@ -42,28 +48,31 @@ string such as `'abc'` was stored verbatim on memory and SQLite.
 - **What that means for a write:** the column stores `null` on every backend,
   and PostgreSQL no longer refuses the request. A blank on a `required` field is
   refused with `required`, exactly as `null` is. On create, a blank takes the
-  field's `defaultValue` exactly as `null` does.
+  field's `defaultValue` exactly as `null` does, so a blank on a required field
+  that declares a `defaultValue` is now accepted with the default.
 - **String-stored columns are untouched.** A text, lookup or select `''` is still
   stored as `''`.
-- **`progress` and `summary` join the numeric type check.** A non-numeric
-  string on either is refused with `invalid_number`, as on `number`. No `min`,
-  `max` or `scale` is newly enforced on them.
-- **One consequence for roll-ups.** A `summary` whose `summaryOperations` takes
-  `min` or `max` over a `date`, `datetime` or `time` field writes a date string
-  into the numeric summary. PostgreSQL already refused that recompute
-  (`ERR_SUMMARY_RECOMPUTE`). Memory and SQLite now refuse it the same way,
-  instead of storing the string.
+- **`progress` joins the numeric type check.** A non-numeric string on it is
+  refused with `invalid_number`, as on `number`. No `min`, `max` or `scale` is
+  newly enforced on it. This is the narrowing above.
+- **`summary` is exempt from that type check.** It is in the spec's
+  `COMPUTED_VALUE_TYPES` ("never client-written; shape is producer-owned"), so
+  the roll-up producer decides its value's shape. A `max` or `min` roll-up over a
+  date, datetime or time child field keeps recomputing on memory and SQLite as
+  before, and a non-numeric value written to a `summary` is not judged by this
+  check. A blank on a `summary` still becomes `null`.
 
 ## Rows already stored
 
 This fixes new writes only. Rows written earlier on SQLite (and on memory,
 MongoDB or libSQL) may still hold `''` in such a column; on SQLite a boolean
 holding `''` reads back as `false`, and one holding whitespace as `true`.
-PostgreSQL never stored one. To repair a
-SQLite table, run this once per non-string-typed column (a field of one of the
-types listed above):
+PostgreSQL never stored one. To repair a SQLite table, run this once per
+non-string-typed column (a field of one of the types listed above):
 
 ```sql
 UPDATE "<object>" SET "<field>" = NULL
  WHERE typeof("<field>") = 'text' AND trim("<field>", ' ' || char(9) || char(10) || char(13)) = '';
 ```
+
+<!-- adr-0087: not-required (no-migration-prescription) Nothing authored moves: `packages/spec` is untouched and no metadata key is added, removed or reshaped, so `objectstack migrate meta` has nothing to rewrite and the ledger has no row to gain. What is refused is a caller-written VALUE — a non-numeric string on a `progress` field — at the write door; stored rows are never re-read by the check, and a caller that sends a number or a blank is unaffected. The other categories are closed on facts: the package publishes (not `unpublished`); no ADR-0087 id covers a write-door value check (not `registered` / `already-registered`); and the change is runtime behaviour, not a TypeScript declaration (not `runtime-interface-only` / `type-surface-only`). -->

packages/objectql/src/validation/record-validator.blank-typed-value.test.ts

@@ -6,9 +6,10 @@
  *
  * `normalizeBlankTypedValues` rewrites `''` / whitespace on a non-string-typed
  * column to `null` and leaves everything else alone. Both populations are read
- * from the spec's own sets, so a type joining `NON_TEXT_STORED_VALUE_TYPES` or
- * `NUMERIC_VALUE_TYPES` tomorrow is covered here without an edit — and a type
- * leaving the string side would turn the control half red.
+ * from the spec's own sets, so a type joining `NON_TEXT_STORED_VALUE_TYPES`,
+ * `NUMERIC_VALUE_TYPES` or `COMPUTED_VALUE_TYPES` tomorrow is covered here
+ * without an edit — and a type leaving the string side would turn the control
+ * half red.
  *
  * The engine-level half (what reaches the driver on every door) is
  * `../engine-blank-typed-value-door.test.ts`; the physical-column half, through
@@ -17,6 +18,7 @@
 
 import { describe, it, expect } from 'vitest';
 import {
+  COMPUTED_VALUE_TYPES,
   NON_TEXT_STORED_VALUE_TYPES,
   NUMERIC_VALUE_TYPES,
   STRING_VALUE_TYPES,
@@ -109,7 +111,12 @@ describe('normalizeBlankTypedValues (#20308)', () => {
   });
 });
 
-describe('the numeric type door is NUMERIC_VALUE_TYPES (#20308)', () => {
+// The door the number branch reads: the numeric class minus the server-computed
+// class (seat ruling on #20308 — `summary` is producer-owned).
+const typeChecked = [...NUMERIC_VALUE_TYPES].filter((t) => !COMPUTED_VALUE_TYPES.has(t));
+const computedNumeric = [...NUMERIC_VALUE_TYPES].filter((t) => COMPUTED_VALUE_TYPES.has(t));
+
+describe('the numeric type door is NUMERIC_VALUE_TYPES minus COMPUTED_VALUE_TYPES (#20308)', () => {
   function refusal(type: string, value: unknown) {
     try {
       validateRecord(schemaOf([type]), { [`f_${type}`]: value }, 'insert');
@@ -120,7 +127,14 @@ describe('the numeric type door is NUMERIC_VALUE_TYPES (#20308)', () => {
     }
   }
 
-  it.each([...NUMERIC_VALUE_TYPES])('%s refuses a non-numeric string with invalid_number', (type) => {
+  it('the two populations are the ones the ruling names — progress judged, summary exempt', () => {
+    // A control on the sets themselves: if either emptied, the cases below
+    // would pass over nothing.
+    expect(typeChecked.sort()).toEqual(['currency', 'number', 'percent', 'progress', 'rating', 'slider']);
+    expect(computedNumeric).toEqual(['summary']);
+  });
+
+  it.each(typeChecked)('%s refuses a non-numeric string with invalid_number', (type) => {
     const e = refusal(type, 'abc');
     expect(e?.code).toBe('VALIDATION_FAILED');
     expect(e?.fields.map((f) => [f.field, f.code])).toEqual([[`f_${type}`, 'invalid_number']]);
@@ -130,7 +144,15 @@ describe('the numeric type door is NUMERIC_VALUE_TYPES (#20308)', () => {
     expect(refusal(type, 7)).toBeNull();
   });
 
-  it('progress and summary take the type check only — no bound or scale is newly enforced', () => {
+  it.each(computedNumeric)('%s is exempt: its shape is the producer\'s (COMPUTED_VALUE_TYPES), not this check\'s', (type) => {
+    // What the roll-up recompute writes — a date string for a `max` over a
+    // temporal child field — is not refused here. (A blank still becomes null
+    // at the door; that is `normalizeBlankTypedValues`, above.)
+    expect(refusal(type, '2026-01-05')).toBeNull();
+    expect(refusal(type, 'abc')).toBeNull();
+  });
+
+  it('progress takes the type check only, and summary none — no bound or scale is newly enforced', () => {
     // The boundary the branch states: a declared `max` / `scale` on these two
     // was never enforced, and this change does not start (a separate decision).
     for (const type of ['progress', 'summary']) {

packages/objectql/src/validation/record-validator.ts

@@ -66,6 +66,7 @@ import {
   FILE_REFERENCE_TYPES,
   STRUCTURED_JSON_TYPES,
   NUMERIC_VALUE_TYPES,
+  COMPUTED_VALUE_TYPES,
   NON_TEXT_STORED_VALUE_TYPES,
   percentScaleOf,
 } from '@objectstack/spec/data';
@@ -838,30 +839,36 @@ function validateOne(
     return null;
   }
 
-  // ── number types (NUMERIC_VALUE_TYPES) ──────────────────────────
-  // The door is the SPEC'S numeric class, read as a constant for the reason the
-  // string branch above reads `BOUNDED_STRING_FIELD_TYPES` (#11875): a type
-  // joining the class there joins the type check here, with no second list to
-  // forget. It was a hand-list of five until #20308 — `progress` and `summary`,
-  // both members of the class, had no type check at all, so `'abc'` was stored
-  // verbatim in a numeric column on memory and SQLite (and failed at the
-  // driver, as a 500, on PostgreSQL).
-  if (NUMERIC_VALUE_TYPES.has(t)) {
+  // ── number types (NUMERIC_VALUE_TYPES ∖ COMPUTED_VALUE_TYPES) ────
+  // The door is the SPEC'S numeric class minus the spec's server-computed
+  // class, both read as constants for the reason the string branch above reads
+  // `BOUNDED_STRING_FIELD_TYPES` (#11875): a type joining either set there moves
+  // this door with no second list to forget. It was a hand-list of five until
+  // #20308 — `progress`, a member of the numeric class, had no type check at
+  // all, so `'abc'` was stored verbatim in a numeric column on memory and SQLite
+  // (and failed at the driver, as a 500, on PostgreSQL).
+  //
+  // ⛔ `summary` is subtracted, by the seat ruling on #20308: it is also in
+  // `COMPUTED_VALUE_TYPES` — 「Server-computed types: never client-written;
+  // shape is producer-owned」 — so its value's shape is the roll-up producer's
+  // to decide, not this caller-value check's. Judging it here refused the
+  // producer's own write: a `max` / `min` roll-up over a temporal child field
+  // recomputes to a date string, and the child write that triggered it then
+  // failed with `ERR_SUMMARY_RECOMPUTE` on memory and SQLite. A blank on a
+  // `summary` is still `null` at the door (`normalizeBlankTypedValues` reads the
+  // whole numeric class).
+  if (NUMERIC_VALUE_TYPES.has(t) && !COMPUTED_VALUE_TYPES.has(t)) {
     const n = typeof value === 'number' ? value : Number(value);
     if (!Number.isFinite(n)) {
       return fail('invalid_number');
     }
-    // [#20308] `progress` and `summary` joined the TYPE check above, and only
-    // that. The bounds and `scale` below keep the five types they always read:
-    //  - `summary` is also PLATFORM-written — the roll-up recompute stores its
-    //    aggregate through `update()` — and a platform-computed value has
-    //    nobody to refuse (the `scale` note below says so for `formula`).
-    //  - `scale`'s own contract names the types it is enforced on (`number`,
-    //    `percent`, `rating`, `slider`), and `min` / `max` on these two were
-    //    never enforced; starting to enforce either would narrow what a caller
-    //    may write, which is a separate decision from "a numeric column holds a
-    //    number".
-    if (t === 'progress' || t === 'summary') return null;
+    // [#20308] `progress` joined the TYPE check above, and only that. The
+    // bounds and `scale` below keep the five types they always read: `scale`'s
+    // own contract names the types it is enforced on (`number`, `percent`,
+    // `rating`, `slider`), and `min` / `max` on `progress` were never enforced;
+    // starting to enforce either would narrow what a caller may write, which is
+    // a separate decision from "a numeric column holds a number".
+    if (t === 'progress') return null;
     if (def.min !== undefined && n < def.min) {
       return fail('min_value', { min: def.min });
     }
@@ -879,9 +886,9 @@ function validateOne(
     // refuse — so its `scale` is applied by rounding at the producer, in
     // `applyFormulaPlan`. Rounding here instead would convert #7501's rejection
     // into the silent alteration the ruling forbids. Nothing was carved out of
-    // #7501 to make that work: formula / autonumber outputs never reach this
-    // branch, and a `summary` returns above, after the type check alone
-    // (#20308), so the formula rounding fills a hole #7501 never covered.
+    // #7501 to make that work: the type door below already excludes formula /
+    // summary / autonumber outputs from this function's reach, so the formula
+    // rounding fills a hole #7501 never covered.
     // Only a well-formed declaration (integer ≥ 0) is enforced: `scale: 2.5`
     // has no defined meaning, and inventing one here (floor? round?) would be
     // the consumer-side guessing PD #12 forbids — a malformed declaration
@@ -1090,9 +1097,8 @@ function validateOne(
     return null;
   }
 
-  // Remaining types (formula/autonumber outputs, json/code payloads) are
-  // explicitly open per the spec contract — see field-value.zod.ts. (`summary`
-  // is judged by the numeric branch above since #20308.)
+  // Remaining types (formula/summary/autonumber outputs, json/code payloads)
+  // are explicitly open per the spec contract — see field-value.zod.ts.
   return null;
 }
 

packages/rest/src/rest-data-blank-typed-value.test.ts

@@ -17,7 +17,14 @@
  * `str_empty` — an empty string must not become null); a valid value on every
  * typed column is stored unchanged; a required field's blank is refused as
  * `400 VALIDATION_FAILED` / `required`; and a non-numeric string on `progress`
- * or `summary` is refused as `invalid_number`.
+ * is refused as `invalid_number`.
+ *
+ * `summary` is exempt from that type check (seat ruling on #20308: it is in the
+ * spec's `COMPUTED_VALUE_TYPES`, "never client-written; shape is
+ * producer-owned"), so a roll-up `max` over a temporal child field recomputes
+ * as it did at base: the child write succeeds and the recompute lands. Measured
+ * on this change before the exemption, that child write failed with
+ * `ERR_SUMMARY_RECOMPUTE` on memory and SQLite.
  */
 
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
@@ -52,6 +59,26 @@ const REQ = {
   },
 };
 
+// A roll-up whose value is not a number: `max` over a temporal child field.
+const PARENT = {
+  name: 'blank_rollup_parent', label: 'Parent', systemFields: false,
+  fields: {
+    id: { name: 'id', type: 'text' as const, primaryKey: true },
+    latest_due: {
+      name: 'latest_due', type: 'summary' as const,
+      summaryOperations: { object: 'blank_rollup_child', field: 'due', function: 'max' as const, relationshipField: 'parent' },
+    },
+  },
+};
+const CHILD = {
+  name: 'blank_rollup_child', label: 'Child', systemFields: false,
+  fields: {
+    id: { name: 'id', type: 'text' as const, primaryKey: true },
+    parent: { name: 'parent', type: 'lookup' as const, reference: 'blank_rollup_parent' },
+    due: { name: 'due', type: 'date' as const },
+  },
+};
+
 const VALID: Record<string, unknown> = {
   f_number: 42, f_currency: 9.5, f_percent: 0.25, f_rating: 3, f_slider: 10, f_progress: 50, f_summary: 7,
   f_boolean: true, f_toggle: false, f_date: '2026-09-27', f_datetime: '2026-09-27T10:00:00.000Z', f_time: '14:30:00',
@@ -90,6 +117,8 @@ async function boot() {
   engine.registry.registerObject(REF as any);
   engine.registry.registerObject(OBJ as any);
   engine.registry.registerObject(REQ as any);
+  engine.registry.registerObject(PARENT as any);
+  engine.registry.registerObject(CHILD as any);
   await engine.syncSchemas();
   await engine.insert('blank_ref', { id: 'ref1' });
 
@@ -181,11 +210,23 @@ describe('REST write doors on SQLite: a cleared typed column stores null (#20308
     expect(await ctx.stored('blank_rest_req', 'q1')).toBeUndefined();
   });
 
-  it('progress and summary refuse a non-numeric string: 400 VALIDATION_FAILED / invalid_number', async () => {
-    const res = await ctx.call('POST', '/api/v1/data/:object', { object: 'blank_rest' }, { id: 'g1', f_progress: 'abc', f_summary: 'abc' });
+  it('progress refuses a non-numeric string: 400 VALIDATION_FAILED / invalid_number', async () => {
+    const res = await ctx.call('POST', '/api/v1/data/:object', { object: 'blank_rest' }, { id: 'g1', f_progress: 'abc' });
     expect(res.status).toBe(400);
     expect(res.body).toMatchObject({ code: 'VALIDATION_FAILED' });
-    expect(res.body.fields.map((x: any) => [x.field, x.code]).sort()).toEqual([['f_progress', 'invalid_number'], ['f_summary', 'invalid_number']]);
+    expect(res.body.fields.map((x: any) => [x.field, x.code])).toEqual([['f_progress', 'invalid_number']]);
     expect(await ctx.stored('blank_rest', 'g1')).toBeUndefined();
   });
+
+  it('a roll-up max over a temporal child field still recomputes: the child write succeeds, as at base', async () => {
+    await ctx.engine.insert('blank_rollup_parent', { id: 'p1' });
+    const first = await ctx.call('POST', '/api/v1/data/:object', { object: 'blank_rollup_child' }, { id: 'k1', parent: 'p1', due: '2026-01-05' });
+    expect(first.status).toBe(201);
+    const second = await ctx.call('POST', '/api/v1/data/:object', { object: 'blank_rollup_child' }, { id: 'k2', parent: 'p1', due: '2026-02-07' });
+    expect(second.status).toBe(201);
+    expect(await ctx.stored('blank_rollup_child', 'k2')).toBeTruthy();
+    // The recompute landed — the base answer. What a date string in a summary
+    // column should be is a separate authoring question, not pinned here.
+    expect((await ctx.stored('blank_rollup_parent', 'p1'))?.latest_due).toBe('2026-02-07');
+  });
 });