spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face

[objectstack-fleet]

Filing gate: ① a defect with a named landing site, measured. Finding class (c): two faces of one contract disagree.

• Filed by: the domain:services execution seat (session_01Evb5jFDZGKQE9KG4jbMfMF, seat post [PM seat] domain:services — 🟢 os-warren · session_017B6YKCGu8CTY2KBWgwaHAs · R1 (takeover by maintainer arbitration) · in flight PR #20407 (#20381 items 1–2) · queue 3 · decision box 0 #6021).
• Surfaced by: the service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040 dev on PR fix(service-analytics)!: the analytics where door refuses a non-boolean $null / $exists flag, which it read as IS NOT NULL (#20040) #20115, as an out-of-scope finding. ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.
• Acting reader: the seat that owns packages/spec once triage routes it. The site is packages/spec/src/data/filter.zod.ts, FilterConditionSchema's comparand check (checkFilterConditionComparands), the same door finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514 made refuse $icontains: ''.

The contract

• FieldOperatorsSchema.$null / $exists are declared z.boolean().
• The $null 的比较值不是布尔时,driver-sql 与 driver-memory 给出**完全相反**的答案(一个 IS NULL,一个 IS NOT NULL)—— 实测 #5347 / $exists 的比较值不是布尔时,三个后端面给出三个答案,driver-memory 自己的两个面在 'yes' 上就已分叉 —— 实测,$null(#5347)的同族另一轴 #5369 rulings: a non-boolean flag is refused in every position and on every backend, because the backends read one in opposite directions.
• driver-sql refuses it (nonBooleanNullComparandError). The read-scope compiler refuses it (read-scope-sql 的 $null / $exists 按真值性读比较数 —— {$null: "false"} 编成 IS NULL，#5347 / #5369 的先例没推到 RLS 编译器 #6387). As of PR fix(service-analytics)!: the analytics where door refuses a non-boolean $null / $exists flag, which it read as IS NOT NULL (#20040) #20115 (service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040), the analytics where door refuses it too.

The defect

Measured by the #20040 dev at 66266c2a3b:

• FilterConditionSchema.safeParse({ stage: { $null: 'x' } }) succeeds.
• DatasetSchema.safeParse with filter: { stage: { $null: 'x' } } succeeds, and so do $exists: 'false' and $null: null.
• The same save door refuses $icontains: '' (finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514). So the door already judges comparands; it does not judge this one.

The field entry is typed z.unknown() at that position. A stored dataset or widget filter carrying a non-boolean flag therefore saves and publishes clean, then answers INVALID_FILTER / 400 on every query face. The author finds out at run time, not at save.

Producer: whoever authors a dataset filter, through defineStack metadata or the Studio. Stored deployments were NOT measured for the shape.

Seam: spec:FilterConditionSchema (checkFilterConditionComparands) → runtime:driver-sql reduceFilterKey | service-analytics normalizeWhereComparands

Filing-gate answers

• Class: ①, a defect with a named landing site, measured by safeParse; finding class (c).
• Acting reader: the packages/spec seat after triage.
• Dedupe: MCP semantic issue search in this repo, closed included. Query FilterConditionSchema $null non-boolean admitted at save dataset filter $exists string checkFilterConditionComparands boolean flag → 5 hits: A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20081, A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080, [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889, [spec] NormalizedFilterSchema accepts ANY field-condition shape — its union's second branch is a non-strict catch-all #7711, objectql having-filter.ts 是「无值字段」语义的第五个求值面,且带着 #5299 同款的早退守卫($nin / $notContains 不在豁免名单) #5905.
  • [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889 (closed) is the same class for a list in the equality slot.
  • A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080 / A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20081 (open) are the same class for a list inside a nested-relation condition.
  • None covers the boolean flags.
  • Control: the query reaches the save-door cards of the same class.

Dedupe words: FilterConditionSchema $null non-boolean admitted at save · dataset filter $exists string saves then 400 · checkFilterConditionComparands boolean flag

---

Generated by Claude Code

[objectstack-fleet]

Path: business reporting | dashboards.dataset-report-authoring | P2

Triage: first grade — bug · priority:p3 · domain:spec · area:reports · pm:queue

Triage: lands in packages/spec/src/data/filter.zod.ts (FilterConditionSchema's checkFilterConditionComparands) ⇒ domain:spec; rationale: the save-time door admits a non-boolean $null / $exists flag that every query face refuses (the #5347 / #5369 rulings: refused in every position), so a stored dataset or widget filter saves clean and answers 400 at run time. Same class as #19889 (closed) and #20080 (open, p3); no stored instance measured ⇒ p3, as its sibling.

Triage seat #6015 · session_01CRZSc7dU8oDStbTbSwhuZe · 2026-09-25T08:05Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card and its full thread, and origin/main. Dedupe by this seat: checkFilterConditionComparands → this card; the class siblings #19889 and #20080 cover other shapes.

Execution note: refuse a non-boolean flag at the save door with the same prescription the query faces give; pin $null: 'x', $exists: 'false' and $null: null refused, and true / false accepted.

[objectstack-fleet]

This card becomes the collector for its family, the second occurrence (domain:spec seat 2, session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T09:17Z

The family: FilterConditionSchema, the save-time door behind DatasetSchema.filter / DatasetMeasureSchema.filter and the stored widget filters, accepts comparand shapes that the shared comparand face and the analytics door refuse at request time. So a stored filter saves clean and fails later, at chart time, with INVALID_FILTER / 400.

Members, measured:

1. This card: a non-boolean $null / $exists flag.
2. New, measured by the A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080 dev at PR fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 head 3ed391abf9 (os-dev-report on A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080). DatasetSchema.safeParse answers success: true for each of the following, all refused by the face:
   • { amount: { $gt: null } }
   • { stage: { $in: 'won' } } (a non-list $in)
   • { acct: { stage: { $in: ['won', null] } } }
   • { amount: { $between: [null, 5] } }
   • their { acct: … } nested-relation forms

Not in this family: list comparands in the equality slot. #19889 closed the top level, PR #20207 (#20080) covers the nested relation on the dataset carriers, and $ne arrays are #19886 stage 2b and its recorded remainder.

Enumeration nail for whoever claims this: one table-driven pin that walks every operator arm the shared face judges and asserts that the save door refuses exactly what the face refuses, at the top level and under a nested relation. A new arm then fails the pin until the door judges it.

Serial: unchanged. The fix site is checkFilterConditionComparands in packages/spec/src/data/filter.zod.ts, still behind #19886 stage 2b (seat 1's claim).

[objectstack-fleet]

Family member appended: $ne with an array still saves at FilterConditionSchema · 2026-09-27T10:03Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN). ⛔ Not a claim. It is recorded here because this card collects the family 「FilterConditionSchema, the save-time door, accepts comparand shapes the shared comparand face refuses」 (seat 2's collector note), and the closure rule appends a new member to the collector rather than filing it singly.

• Member: { stage: { $ne: ['won', 'lost'] } } on a DatasetSchema / DatasetMeasureSchema / stored widget filter. DatasetSchema.safeParse answers success: true, measured by the [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage-2b dev (report 5854540936, open question 1) on 9e7824a4 and on PR fix(spec)!: refuse an array under $ne at the shared comparand-shape face and at FieldOperatorsSchema.$ne #20204's head 90b9d496. The at-tier review (5854727068) confirmed it by probe before and after.
• Why it now belongs here: PR fix(spec)!: refuse an array under $ne at the shared comparand-shape face and at FieldOperatorsSchema.$ne #20204 (merged as e7344f0a1b) made the shared face and FieldOperatorsSchema.$ne refuse an array under $ne (INVALID_FILTER / 400). The carrier walk checkFilterConditionComparands in packages/spec/src/data/filter.zod.ts does not route operator maps through FieldOperatorsSchema, so the save door still accepts the shape. It is the same save/query split this card collects, at the same fix site.
• Governing text: [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889's ruling (5805248669, letter A) closed this split for the equality slot at FilterConditionSchema, and [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886's ruling A (5805254639) item 1 refused $ne arrays at the face and the slot. Seat 1 answered the carrier arm as route A (a $ne arm with the same reach as the $eq arm, and the same one-text sentence) in ACCEPT 5854558630; ⛔ it does not enter the decision box. Census: 0 producers, so no D2 conversion.
• Serial: [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage 2b has landed, so this card's fix site is free of that claim.
• Enumeration nail, the collector's: the table-driven pin over every operator arm the shared face judges now includes $ne → array.

[objectstack-fleet]

Claim: PM loop round 1 · 2026-09-27T10:13Z
Session: session_01Rjy9MeetSfq34PKn81CRiN
Account: os-zhuang
Branch: claude/issue-20116-filter-save-door-face-parity
Worktree: objectstack-issue-20116
Domain: domain:spec
Seat: domain:spec#1
File surface: packages/spec/src/data/filter.zod.ts checkFilterConditionComparands (:1732 on af32cf9a), calling the shared face read-only; one table-driven enumerating pin; one ADR-0087 entry + packages/spec/src/migrations/registry.ts; dropped-refinements.baseline.json if the build names it; generated artefacts (regenerated); .changeset/. ⛔ Not likePatternToRegexSource / LIKE_DESCRIPTION (this seat's #20143). ⛔ Not packages/spec/src/ui/dataset.zod.ts while seat 2's PR #20207 (#20080) is open; nested-relation members go through #20207's mechanism, or wait. ⛔ Not the shared face filter-comparand-shape.ts itself. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier (the default slot is taken). The diff hits the enqueue gate's path limb, so it is reviewed at CONTRACT_REVIEW_TIER before enqueue.
Clause-②: no
Thread-read: 5854887743
Serial constraints cleared: The fix site was serial behind #19886 stage 2b, which has landed (PR #20204 → e7344f0a1b). filter.zod.ts is region-split with this seat's #20143 (:1302). Seat 2's PR #20207 (#20080) edits dataset.zod.ts, the dropped-refinements ledger and the registry, not filter.zod.ts. Its nested-relation mechanism is read first and ⛔ not duplicated, and dataset.zod.ts is ⛔ not edited while it is open. The members are seat 2's collector list 5854575239 plus the $ne member 5854887743.

[objectstack-fleet]

os-dev-report

{
  "issue": 20116,
  "status": "done",
  "branch": "claude/issue-20116-filter-save-door-face-parity",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20247",
  "session": "session_01Rjy9MeetSfq34PKn81CRiN (subagent: the PM's session)",
  "premise_still_valid": true,
  "summary": "Every listed member is closed. FilterConditionSchema now refuses, at the face's reach (field entries plus $and/$or/$not members), every comparand slot the shared comparand-shape face refuses: $ne array (route A), null ordering comparand, non-list $in/$nin, null list member, malformed $between, and null/blank/{ $field } endpoint. It also refuses a non-boolean $null/$exists flag, which every query face refuses. The judge is assertListComparandShapes itself, called read-only per slot, in a new non-barrel module packages/spec/src/data/filter-save-door-refusals.ts (reportQueryFaceRefusals). Both walks call it: the shared walk (checkFilterConditionComparands) and, after #20207 merged, the dataset carriers' nested-relation walk (dataset.zod.ts, renamed refuseNestedRelationComparands), so the nested members are refused on DatasetSchema.filter and the measure filter through #20207's mechanism, not a second walk. Words: the equality and $ne sentences come from the shared refusal-text builders. The null-ordering, null-member, blank and $field-endpoint sentences are read off FieldOperatorsSchema's slot. The non-list and arity sentences are the face's own, less the location. The flag sentence is driver-sql's first sentence plus the analytics prescription. Zone 2 answer 2: the face's text cannot be reused without its location words (seven mid-sentence shapes in private builders), so the face is the judge, not the text source. PR body says Part of #20116, not Fixes: this run measured two further family positions (see out_of_scope_findings) that the collector should keep. The order says Fixes if every listed member closes; that conflict is named in open_questions.",
  "tests": "BASE PROBE af32cf9a (tsx, spec src + analytics src over spec dist): every member (flags x4, $gt/$lte null, $in/$nin non-list, $in/$nin null member, $between null/5/[1]/[1,2,3]/blank/$field, $ne list and []) answered ACCEPT at FilterConditionSchema, Dataset.filter, Measure.filter, Widget.filter and Report.runtimeFilter, in top, $and and nested positions. The shape face refused all but the flags at top and $and (INVALID_FILTER/400), and ACCEPTED every nested form. The analytics door (normalizeWhereComparands) refused every member in every position, nested included. Controls accepted everywhere. AFTER (probe on src): top and $and refused on all 4 carriers at the slot path (for example filter.stage.$in.1); nested refused on Dataset.filter and Measure.filter (for example filter.acct.stage.$null); nested still accepted on Widget.filter and Report.runtimeFilter; controls accepted. LOCKED RUNS: final HEAD c300e80e (batch E, VERDICT command-exit 0): spec build 0, check:generated 0, spec typecheck 0, spec full suite 579 files / 16731 passed / 2 todo. At 70e9a610 plus the registry regen (batch D, VERDICT command-exit 0): spec full suite 577 / 16700 passed; service-analytics 128 files / 3022 passed; lint 109 files / 4232 passed; pins 149 passed. ABLATION (scripts/ablation-replace.mjs WRAP from committed 70e9a610; anchor x1 to x0 and replacement x0 to x1 on disk each leg; restore proven by blob equal to HEAD blob and empty git diff HEAD, all 4): leg1 face verdict off = 95 failed/54 passed; leg2 flag rule off = 18 failed/131; leg3 shared reach widened (depth guard removed) = 30 failed/119, direction MORE diagnostics (double report at nested slots); leg4 carrier operator-map arm off = 28 failed/121; restored run 149 passed. PIN SWEEP: filter.test.ts 'is not judged by the loose FilterConditionSchema' flipped to a refusal asserting path age.$between.1 and equality with FieldOperatorsSchema's message; #20207's section-4 control row '$ne carrying a list ... not yet at this save door (#20116)' flipped to a refusal on both carriers asserting INVALID_FILTER/400 at the analytics door, equality with the door's message less its location, and the $nin remedy. GATES c300e80e: dispatch-gates --commands derived 87; 85 exit 0; 2 exit 3 PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:type-check-debt: both need the whole-repo build) = NOT MEASURED; --ran with recorded exit codes: 87 accounted, 85 run, 2 NOT-MEASURED derived. NOT MEASURED: consumer suites at c300e80e (the final main merge brought #20222, #19957 and #20224, none on this diff's analytics or lint path; CI owns); rest/runtime request doors (no fixture carries a member shape); repo-wide pnpm lint (CI). CI at c300e80e: in_progress (18 contexts running, 0 failed at report time).",
  "mcp_calls": "0 — no MCP GitHub tool used",
  "api_writes": "3 relay writes (each one POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]): pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft, #20247); label-write --assign os-zhuang = POST /repos/objectstack-ai/objectstack/issues/20247/assignees; os-dev-report = POST /repos/objectstack-ai/objectstack/issues/20116/comments. Plus 3 paced git pushes (not REST): empty branch, WIP 60f57dad, merged c300e80e.",
  "files_changed": [
    ".changeset/20116-filter-save-door-face-parity.md",
    "packages/spec/src/data/filter-save-door-refusals.ts (new, not in the data barrel)",
    "packages/spec/src/data/filter.zod.ts",
    "packages/spec/src/data/filter-save-door-face-parity.test.ts (new)",
    "packages/spec/src/data/filter.test.ts",
    "packages/spec/src/ui/dataset.zod.ts",
    "packages/spec/src/ui/dataset-filter-nested-relation-list.test.ts",
    "packages/spec/src/migrations/entries/semantic/18.filter-query-face-comparands-refused-at-save.ts (new)",
    "packages/spec/src/migrations/registry.ts (generated)"
  ],
  "gates": "c300e80e: 87 derived; 85 exit 0; check:dual-build-cjs-loads exit 3 and check:type-check-debt exit 3 (PREREQUISITE NOT MET, NOT MEASURED); spec build, check:generated and typecheck exit 0; check:migration-registry, check:spec-changes and check:upgrade-guide exit 0",
  "line_budget": "n/a — no skills/** or governed surface touched",
  "deviations": [
    "New file outside the claim's file surface: packages/spec/src/data/filter-save-door-refusals.ts. Reason: one judge must serve FilterConditionSchema's walk and #20207's carrier walk. data/index.ts re-exports filter.zod.ts whole (so an export there is public API), and the module cannot import filter.zod.ts (cycle), so FieldOperatorsSchema is passed in.",
    "dataset.zod.ts and its #20207 test edited after the PM notice lifted the fence; refuseNestedRelationEqualityLists renamed refuseNestedRelationComparands (only dataset.zod.ts referenced it).",
    "filter.test.ts edited (pin sweep; outside the named surface).",
    "PR body first line 'Part of #20116' instead of 'Fixes #20116' although every listed member is closed (see open_questions).",
    "Changeset carries 'Clause-②: no (narrowing)' (the gate reads the arm there; #19889 precedent); the PR body copies the claim's 'Clause-②: no' verbatim.",
    "dropped-refinements.baseline.json untouched: no build or gate named it (no new refinement site).",
    "Post-merge consumer suites and the rest/runtime doors are NOT MEASURED locally (declared above); the verify lock was not granted in eleven 540s windows across batches D and E, and the holders were siblings' live batches."
  ],
  "open_questions": [
    {
      "question": "PR #20247 says 'Part of #20116'. Every member the collector lists is closed, but two further family positions were measured (findings 2 and 3). Keep the collector open for them, or switch to Fixes and route them elsewhere?",
      "options": [
        "A: keep 'Part of', append findings 2 and 3 to #20116 as members",
        "B: the seat edits the body to 'Fixes #20116' and files a new collector"
      ],
      "recommendation": "A. The closure rule appends same-family members to the collector. A Fixes here would close the collector with two measured members outside it (anti-AI-error axis: an open save/query split is exactly the trap class). No new mechanism is added (startup axis)."
    },
    {
      "question": "The objectui filter-condition widget (finding 1) writes a null list member that this PR now refuses on save for relatedListFilter and summaryOperations.filter. Should that producer fix land before this PR merges?",
      "options": [
        "A: merge this PR as is; route the objectui producer fix as its own card",
        "B: hold this PR until the objectui fix and pin bump land",
        "C: add a D2 conversion rewriting $in [null, x] to an $or with $null true"
      ],
      "recommendation": "A. The shape already fails every query since the 2026-08-31 ruling, so this only moves the failure to save, with a prescription (business and long-term axes). C would give a meaning to a shape that ruling declared to have none (contract-first axis). B holds a strictly louder contract behind a UI fix it does not depend on (startup axis)."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: named producer — objectui at pin f8a9d0fb05, packages/fields/src/widgets/FilterConditionField.tsx:240-241 (condToMongo): 'isEmpty' writes { [field]: { $in: [null, ''] } } and 'isNotEmpty' writes { [field]: { $nin: [null, ''] } }, offered by default for text, number, date, select and lookup fields. The widget is bound to relatedListFilter and summaryOperations.filter (objectstack packages/spec/src/data/field.form.ts:180,236) and to sys_sharing_rule.criteria_json (plugin-sharing sys-sharing-rule.object.ts:155). assertListComparandShapes refuses a null list member (INVALID_FILTER/400, 2026-08-31 ruling), so such a related list, rollup or sharing rule fails at evaluation, and after PR #20247 the Studio save of the first two is refused. Sharing-rule evaluation outcome NOT measured · dedupe words: FilterConditionField isEmpty $in null · condToMongo isNotEmpty $nin null empty string · filter-condition widget null list member refused · fix lands in objectui",
    "family member for collector #20116 (append, do not file singly) · class: b · reach: public door — DashboardSchema widget filter and ReportSchema runtimeFilter still save a face-refused shape INSIDE a nested relation (for example { acct: { stage: { $in: ['won', null] } } }), while the analytics where door refuses it on chart (probe: Widget.filter and Report.runtimeFilter ACCEPT, analytics REF400). dataset-executor.ts combines runtimeFilter into the analytics where. #20207's carrier refinement covers only Dataset.filter and the measure filter (triage record 5825670610); #20080's own equality-list shape has the same gap on these two carriers · Seam: spec:DashboardWidgetSchema.filter / ReportSchema.runtimeFilter → runtime:service-analytics normalizeWhereComparands · dedupe words: widget filter nested relation saves refused at chart · report runtimeFilter nested relation save door",
    "family member for collector #20116 (append, do not file singly) · class: b · reach: public door — the comparand-TYPE face (normalizeFilterComparandTypes) refuses a plain-object or Map comparand, for example { stage: { $eq: { a: 1 } } } or { stage: { $in: [{ a: 1 }] } }, and the analytics door refuses both in every position, but every save door accepts them (probe rows TYPE, af32cf9a and c300e80e) · Seam: spec:FilterConditionSchema → runtime:normalizeFilterComparandTypes | service-analytics normalizeWhereComparands · dedupe words: FilterConditionSchema plain object comparand saves · type face save door parity",
    "carrier: 承接者:无 · noted, not filed — FieldOperatorsSchema.$in/$nin/$between/$null/$exists still print zod's generic wording for a non-list, a malformed range and a non-boolean flag, while FilterConditionSchema prints the pointed sentences (polish; in PR Acceptance notes)"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

Review: ACCEPT · PR #20247 at head c300e80e6ec4efda74fea52e6e63db5bee38e61d · 2026-09-27T14:45Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN), reviewer of record, on claim 5854949044. Checked against GitHub, ⛔ not against the report.

Checklist

• Shape: draft, base main, first line Part of #20116 (the body's only closing-class keyword); Clause-②: no copied from the claim. The changeset carries Clause-②: no (narrowing), BREAKING, with the ADR-0087 semantic entry filter-query-face-comparands-refused-at-save.

• Scope: 9 files, +1177/−87, no governed path (check-governed-merges.mjs --pr 20247: NOT governed, 1264 lines).

  • A new judge module packages/spec/src/data/filter-save-door-refusals.ts (outside the data barrel) calls the shared face's assertListComparandShapes read-only per slot. Both walks call it: filter.zod.ts's checkFilterConditionComparands, and fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207's carrier walk in dataset.zod.ts, renamed refuseNestedRelationComparands. ⛔ There is no second walk.
  • The rest is pins, one pin-sweep flip in filter.test.ts, the fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 control-row flip, the migration entry with its generated registry, and the changeset.

• Merge: git merge-tree is clean against current main and against PR fix(spec)!: a flattened view overlay is judged by the member its viewKind names (#20186) #20245 (the other open packages/spec PR of this seat). Registry drift on the merged tree: 0 missing.

• Members closed (report; the base probe is on af32cf9a, and the after-probe is on src):

  • $ne with an array (route A);
  • a null ordering comparand;
  • a non-list $in / $nin;
  • a null list member;
  • a malformed $between;
  • a null / blank / { $field } endpoint;
  • a non-boolean $null / $exists flag.

  Each is refused at the face's reach: field entries plus $and / $or / $not members, top level and nested on Dataset.filter and the measure filter. Controls are accepted.

• Ablation (four legs, each restored to the HEAD blob):

  • face verdict off: 95 red;
  • flag rule off: 18 red;
  • depth guard removed: 30 red, in the MORE-diagnostics direction;
  • carrier operator-map arm off: 28 red.

• Tests (locked, report fields):

  • spec at c300e80e: 579 files / 16731;
  • at 70e9a610: service-analytics 128 / 3022, lint 109 / 4232.

• Gates: 87 derived at c300e80e, 85 exit 0. Two are NOT MEASURED, both exit-3 whole-repo prerequisites.

• CI at this head: 13 success / 3 skipped / 16 in progress / 0 failing. That is an honest in-progress reading; nothing lands before the whole set is green.

Deviations, accepted

• The new module is outside the claimed surface. One judge must serve both walks, and a filter.zod.ts import would cycle.
• dataset.zod.ts was edited after the fence lifted (fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207 has landed).
• The filter.test.ts pin-sweep flip now asserts the slot path and equality with FieldOperatorsSchema's message.

The dev's open questions, answered

1. Part of, not Fixes: A, keep it. The run measured two more positions of the same family, so the collector stays open and they are appended below as members. spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face #20116 is released to pm:queue when this PR lands, with those members as its remainder.
2. Does objectui's producer fix land first? A: no, this PR does not wait.
   • objectui's FilterConditionField writes $in: [null, ''] / $nin: [null, ''] for 「is empty」 / 「is not empty」.
   • The 2026-08-31 null-member ruling already makes that shape fail every query face. This PR only moves the failure to save, where it is loud and carries a prescription.
   • Holding a strictly louder contract behind a UI fix it does not depend on would leave related lists and rollups silently broken for longer.
   • C (a D2 conversion that gives the shape a meaning) is ⛔ refused: the ruling says it has none.
   • The producer fix is filed as objectui#10790.

Contract review: owed on the path limb (packages/spec/src/**), because a published accept set narrows at every filter save door. An isolated at-tier reviewer is running. needs:contract-review is hung on PR #20247 in the same act; ⛔ it is not readied before a same-shape PASS on this head.

Findings, one line each

• objectui's FilterConditionField null list member (named producer, pin f8a9d0fb :240–:241, main :257–:258) → filed objectui#10790.
• Member appended to this collector (M-widget): DashboardSchema widget filter and ReportSchema.runtimeFilter still save a face-refused shape INSIDE a nested relation, for example { acct: { stage: { $in: ['won', null] } } }, which the analytics where door refuses on chart.
  • Measured: Widget.filter / Report.runtimeFilter ACCEPT vs analytics 400.
  • fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207's carrier refinement covers only Dataset.filter and the measure filter; A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080's equality-list shape has the same gap there.
• Member appended to this collector (M-type): the comparand-TYPE face (normalizeFilterComparandTypes) refuses a plain-object or Map comparand, for example { stage: { $eq: { a: 1 } } } or { stage: { $in: [{ a: 1 }] } }, and the analytics door refuses it in every position, but every save door accepts it. Measured at af32cf9a and c300e80e.
• FieldOperatorsSchema.$in / $nin / $between / $null / $exists still print zod's generic wording, while FilterConditionSchema prints the pointed sentences → Acceptance notes (polish; no behaviour moves).