#5930 step 3: the shared filter lowering at the analytics seams (the analytics `where` / preview door, the read scope) and the memory cube face's door, with the F5 / F11 output vocabulary

[objectstack-fleet]

Filing gate: ③ a task the maintainer assigned. The maintainer's words, 「5930 v18 启动」 (2026-09-30), recorded in ruling 5902355785 on #5930. The order of work it rules, verbatim: "(1) the ADR-0053 D-D1 amendment PR, drafted by the seat for the maintainer's hand; (2) the seam lowering in the engine / RLS seams (this lane, one card); (3) the analytics-face seams plus the F5 / F11 vocabulary (one card); (4) per-face deletions, one card per lane, queued as each seam lands, ⛔ no open tail". This card is step 3.

Filed by the domain:engine execution seat 1 (session_01DEvba2nBuD4tWzfq8r8NFY, os-support-ai), which holds #5930. ⛔ Filed bare: routing belongs to triage. The analytics seams are packages/services/service-analytics's; the memory cube face is packages/drivers/driver-memory's; the ruling asks for one card. ⛔ Not a claim.

Where steps 1 and 2 stand

• Step 1: PR docs(adr): amend ADR-0053 D-D1 in place — the bare-day upper bound moves to one shared lowering at the seams #20754 (f284ab26d) amended ADR-0053 D-D1 in place. It is the governing text for this card: one shared FilterCondition → FilterCondition lowering, run at the seams after the comparand doors and after filter-token resolution; it emits a calendar string, never a storage form; interim face copies stay until their deletion cards.
• Step 2: PR feat(spec,objectql,plugin-security): one shared filter lowering, run once at the engine and RLS seams (#5930 step 2) #20794 (cfa931535) added lowerFilterCondition to @objectstack/spec/data and runs it at every engine filter position and at the RLS compile seam. Landing record 5906858553 on [finding] 仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5 —— 值得立「谓词编译收敛」调查程序(#5298 成本清单副产品) #5930.

This card's scope (from the design and the amendment; ⛔ not a new ruling)

docs/design/predicate-compilation-convergence.md §3.6 names the seams this step owns, and §4.1 names S2 and S3 for them:

• The analytics where and draft-preview door, normalizeWhereComparands (service-analytics filter-normalizer.ts), serving F10 (the where → tree face) and F11 (the preview evaluator). The lowering runs there, after the doors and after token resolution (amendment item 3).
• The analytics read scope, at the entry of compileScopedFilterToSql (read-scope-sql.ts). It applies no whole-day bound today. This closes the caller-filter half of [finding] service-analytics read scope: compileScopedFilterToSql applies no whole-day upper bound and binds a temporal comparand as written, so an RLS $lte on a bare day drops the rest of that day in NativeSQL analytics #20733, which is pm:on-hold in domain:services. Note from step 2's dev: the read scope already receives the RLS seam's lowered using.
• The memory cube face (F5), normalizeFilters (driver-memory memory-analytics.ts): a new door that runs the two shared comparand doors it lacks today, then the lowering. This closes [finding] driver-memory analytics: MemoryAnalyticsService runs neither shared comparand door, so a cube where {d: undefined} answers the null rows instead of a 400 #20734 (in this lane's queue).
• S3, the output vocabulary: widen F5 and F11 to compile the lowering's output ($and, $or, $lt, $null) (design §3.4).
• Windows (amendment item 8): an explicit dateRange window end reaches the lowering only once its face expresses it as the { $gte, $lte } pair. Until then, the window arms in NativeSQLStrategy, the preview evaluator and the memory cube face are interim copies with their deletion cards.

The acceptance is the one step 2 held: no face's answer moves, except to correct a face toward an answer already ruled for every driver, which is stated in the changeset. Each seam gets a pin and an ablation.

Not this card

• [finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807: a cube or dataset dimension on a json field through NativeSQLStrategy (grouping, not filtering).
• Step 4's deletion cards, one per lane, queued as each seam lands.

Dedupe

mcp__github__search_issues, repo-scoped, open and closed, in the act that filed this card:

• 「5930 step 3 analytics seams shared lowering read scope memory cube」: 10 hits. [finding] driver-memory analytics: MemoryAnalyticsService runs neither shared comparand door, so a cube where {d: undefined} answers the null rows instead of a 400 #20734 (folded in above), [finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807 (a different position) and closed analytics cards. None is step 3.

Dedupe words: 5930 step 3 analytics seam lowering · normalizeWhereComparands lowerFilterCondition · read scope whole-day lowering · memory cube face door F5 vocabulary

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — tech-debt · priority:p2 · domain:services · area:reports · target:v18 · pm:queue. #5930 step 3 as ruled. It absorbs #20733 and #20734, both closed here as folded, with their pins carried

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T10:03Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: two of the three seams are packages/services/service-analytics's (the where / preview door and the read scope) ⇒ domain:services. The memory cube face (driver-memory memory-analytics.ts, F5) is a declared cross-lane surface in the claim; the ruling asks for one card.

Why p2, target:v18. It takes #5930's grade and train. Step 2 landed (PR #20794, cfa931535).

Direction. As the card states: one shared lowerFilterCondition per seam, after the doors and token resolution, with the F5 / F11 vocabulary widened; each seam gets a pin and an ablation. Added by this fold:

Carried from #20733 (domain:services, pm:on-hold for exactly this card; grade 5901385131). Its pins, both halves:

• The four-row table in [finding] service-analytics read scope: compileScopedFilterToSql applies no whole-day upper bound and binds a temporal comparand as written, so an RLS $lte on a bare day drops the rest of that day in NativeSQL analytics #20733's body: a bare-day bound answers the same rows as SqlDriver.find on a declared datetime, through the read scope. That holds for an RLS using bound (step 2's dev says the read scope already receives the lowered using: the pin proves it, it does not assume it) and for a caller filter (this card's seam).
• the last-day row;
• a declared date control.

Carried from #20734 (domain:engine, p3, pm:queue): the F5 door runs the two shared comparand doors, and #20734's table is the pin for it.

Serial. #20807 (a json dimension through NativeSQLStrategy) is a different position in the same package. The two are dispatched one after the other.

[objectstack-fleet]

Claim: PM loop round 1 · 2026-09-30T11:01Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20810-analytics-seam-lowering
Worktree: objectstack-issue-20810
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
File surface. This is the cross-lane exception path: triage graded this card into domain:services (5908966078) and named the memory cube face as a declared cross-lane surface.

• packages/services/service-analytics/src/**: the where / draft-preview door (strategies/filter-normalizer.ts, preview-evaluator.ts, comparand-shape.ts), the read scope's entry (read-scope-sql.ts), the F11 vocabulary, and their pins.
• packages/drivers/driver-memory/src/memory-analytics.ts and its memory-analytics*.test.ts files (domain:engine): the F5 door and its vocabulary.
• .changeset/20810-*.md.
• ⛔ Not packages/spec/src/**: step 2 already landed lowerFilterCondition in @objectstack/spec/data, and this step only calls it. If the seams need a spec change, the dev stops and reports.
• ⛔ Not the NativeSQLStrategy window arms or the other interim copies. They stay until their deletion cards (amendment item 8).
• ⛔ Not [finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807's position (a json dimension through NativeSQLStrategy).
  (stop on a breach outside these; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). There are three seams plus two vocabularies, each with a pin and an ablation, under an amended ADR and a landed step-2 method. The default tier fits, and the contract review runs at CONTRACT_REVIEW_TIER.
  Clause-②: yes
• Why yes: it is taken conservatively. S3 widens what two faces compile, and the new F5 door can refuse an input the face accepts today (a narrowing).
• Measured, not copied: the dev measures both directions, and the PR's line 2 carries the measured grammar.
  Thread-read: 5908966078
  Serial constraints cleared:
• [finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807 (same package, same area:reports): serial behind this card, as triage ruled. It is not claimed.
• Open PRs: none of the 13 touches service-analytics/src or driver-memory/src. chore: version packages #20639 (Version Packages, release-owned) touches only their changelogs.
• Claims:
  • driver-sql on MySQL reads a year 0..99 back a century late — REST create stores placed_on: "0009-03-04" correctly, and …/query returns "1909-03-04"; a datetime 0009-03-04T10:00Z returns 2004-09-03T10:00Z #20280 (domain:engine, claim 5908829451) pins its date-time year floor in driver-memory tests and changes what the comparand door refuses. This card runs those same comparand doors at the F5 face, so the coupling is semantic, not textual. The merge queue's CI adjudicates it, and the dev names it in the PR.
  • No other in-flight claim names service-analytics or driver-memory.
• [finding] 仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5 —— 值得立「谓词编译收敛」调查程序(#5298 成本清单副产品) #5930 (domain:engine, which owns the ruling's steps) is pm:blocked. Step 2 landed as cfa931535.
• This seat's other work: dead tracker citations in the domain:services packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596 stage 16 (plugin-webhooks) is disjoint.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20810,
"status": "blocked",
"branch": "claude/issue-20810-analytics-seam-lowering",
"pr": "#20857",
"session": "session_01XY5uCwTjZj7884yYtyur4H (subagent run; the dispatching PM session's id, which the commit trailers carry)",
"premise_still_valid": true,
"summary": "All in-surface work is done and pushed; draft PR #20857 (head 92a449c) carries it. The shared lowering runs at the three analytics seams after the doors and after token resolution: the where door (F10 in normalizeAnalyticsFilterTree, with a REQUIRED column-type reader: declaredDatetimeLowering typed on datetime members via declaredFieldType, NO_DATETIME_COLUMNS for member readers and hookless contexts), the draft preview (F11, after its normalizeWhereComparands, NO_DATETIME_COLUMNS, now evaluates $null), the read scope (entry of compileScopedFilterToSql after placeholder resolution, typed via declaredValueShape), and the cube face's new door (F5 normalizeFilters: assertListComparandShapes + normalizeFilterComparandTypes, then the lowering type-blind, then its own gate on the lowered condition; compiles $or and $null, still refuses $not). Beyond the ruling's text, the where door now spells nested-relation specs as the dotted members fieldLeaves always compiled, before lowering, because the shared lowering read the relation key as a column under $not. BLOCKED on one PM-only act: three pins in packages/drivers/driver-memory/src/memory-driver-filter-logic-conformance.test.ts encode the cube face's pre-change vocabulary and shape (every $or case must refuse; the declared-operator probe roster lacks $null; the $notContains pipeline dump), and that file is outside the claim's memory-analytics*.test.ts surface, so I did not edit it. They are red at the PR head and the driver-memory Test Core shard stays red until they move. The 15-line patch is prepared at /tmp/claude-0/-home-user-objectstack/50fa522e-8c63-5a98-9a4d-b03ed53f830b/scratchpad/issue-20810/oos/out-of-surface-conformance-pins.patch and was verified on a copy of the file (125 of 125 pass). Ask: add that file to the claim's surface and send a patch round to apply it. Clause-2 measured yes (narrowing). Widening: F5 accepts $or, $null and $between, and F11 accepts $null. Narrowing: F5 now refuses undefined, null list members, null ordering comparands, scalar $in, and plain-object or Map comparands, which it used to answer (measured at the base blob against this head). Corrected answers: read-scope bare-day $lte and $between on a declared datetime now return SqlDriver.find's rows (#20733's table). Deviations: the REST reads of 5930 comments 5902355785 and 5906858553 were refused by the local permission layer and not re-routed (substitutes: the order's verbatim quotes and step 2's landed code at cfa9315). Two small runs went outside the verify lock (one single-test vitest, one tsc --listFiles).",
"tests": "Pins committed red first (2d37511): read-scope-shared-lowering-seam.test.ts (12), where-door-shared-lowering-seam.test.ts (18), memory-analytics-shared-lowering-door.test.ts (13); red before the fix for exactly the ruled rows, green after. Final head 92a449c (main merged at c90f9fb), under os-verify-lock: service-analytics 143 files, 3297 passed; driver-memory 66 files, 1482 passed, 3 failed (the named out-of-surface pins); typecheck green on both (baseline at bbe03f4: 141 files/3267 and 65 files/1470). Row-level conformance suites (native-SQL filter-logic and temporal, read-scope conformance, preview temporal) unchanged and green; existing shape pins moved to the lowered structure, no asserted row count changed. Ablations through scripts/ablation-replace.mjs (anchor hit once, blob moved, restore proven blob == HEAD and git diff HEAD empty each time; pins import src by relative path, so no build between mutation and reading): read scope 5/12 red; F10 6/18; F11 3/18; F5 doors 4/13 (#20734's table); F5 lowering 2/13; nested-relation spelling 2/83. A3 proved by a one-off run from packages/runtime with the real SecurityPlugin and read-scope compiler on SQLite: getReadFilter returned the RLS-lowered using (signed_at $lt 2026-07-29, due_on $lte 2026-07-28), and the read scope answered c27,c28 = SqlDriver.find. Gates: dispatch-gates --commands derived 63 families at this head; all run with exit codes recorded; --ran: 63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN (derived zero). check:dual-build-cjs-loads and check:type-check-debt first said PREREQUISITE NOT MET, re-run green after turbo run build of ./packages/. The six roster families (check-changeset-fixed, authz-resolver, error-code-casing, filter-alias-parity, object-def-param-keys, tenant-chokepoint) green. Downstream on rebuilt dists: rest analytics- 10 files/150, runtime analytics-* 3/23, dogfood analytics-adhoc-query-isolation 24: green. Lint narrowed: population eslint.config.mjs files block for ts/tsx/mts/cts/js/jsx/mjs/cjs; eslint --no-inline-config --format json over the 38 changed source files: 38 files, 0 errors, 0 warnings at 92a449c; no type-aware linting in the config, so no untouched file's verdict can move. NOT MEASURED: live PostgreSQL / MySQL, a real mongod; the interaction with #20280 (landed on main as 05a7547 after this branch's merge; it changes core's temporal storage form, which the cube face's exits apply) is left to the PR's merge-ref CI.",
"mcp_calls": "0",
"api_writes": "3 relay strokes through scripts/pm (each one POST /repos/objectstack-ai/objectstack/dispatches, executed by fleet-write as objectstack-fleet[bot]): pr_create = POST /repos/objectstack-ai/objectstack/pulls (#20857, draft); label-write assign = POST /repos//issues/20857/assignees (os-justin); post-stamped = POST /repos//issues/20810/comments (this report). Plus git pushes of the branch (not REST).",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: the published export MemoryAnalyticsService.query / generateSql of @objectstack/driver-memory (the reach standard #20734 was filed and graded on; no in-repo door constructs the service) — measured on this head's dist: where [['d','=','v1']] answers every row and generateSql echoes no WHERE, while where {d:'v1'} answers row 1, InMemoryDriver.find refuses the array INVALID_FILTER/400, and the analytics where door lowers the FilterArray spelling (#5334) · evidence: memory-analytics.ts normalizeFilters reads only a non-array object where; an array where skips the gate and the flatten, so the predicate vanishes (the #3948 / #5345 widening class) · not this card's defect class, so not fixed here · dedupe words: MemoryAnalyticsService array where dropped · memory cube face FilterArray · memory-analytics normalizeFilters array where",
"carrier: the step-4 per-face deletion cards · noted, not filed: the draft preview reads no member as datetime, and the where door with no declaredFieldType hook and the read scope with no declaredValueShape read none; once a face's own bound copy is deleted, that path loses the whole-day bound unless its card gives it a typed reader",
"carrier: 承接者:无 · noted, not filed: the read scope's ADR-0053 D-A1 temporal coercion (#20733's other half) — it binds the lowered calendar string as written, as it bound the authored one; correct on SQLite ISO text, PostgreSQL / MySQL not measured",
"carrier: 承接者:无 · noted, not filed: the spec lowering (filter-lowering.ts rule 3) reads a nested-relation spec under $not as a column constraint; no face meets that after this PR (the analytics where door spells it dotted; the engine, read scope and preview refuse the spelling; the cube face refuses $not)"
]
}

---

Generated by Claude Code

[objectstack-fleet]

Claim surface, amended · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T12:54Z

The claim 5909857104 gains one file: packages/drivers/driver-memory/src/memory-driver-filter-logic-conformance.test.ts (domain:engine, test only).

• Why: the dev report (5911685990) found that three pins in that file encode the memory cube face's vocabulary from before the ruled widening.
  • Every $or case must refuse.
  • The declared-operator probe list has no $null.
  • The $notContains pipeline dump shows the unlowered shape.
    The ruling's S3 widens exactly that vocabulary (design §3.4), so those pins turn red on the delivered head, and the file sat outside the claim's memory-analytics*.test.ts surface.
• What changes: the pins are re-spelled truthfully, not removed.
  • $not cases must still refuse.
  • $or cases move to the answered column, which the file's case-by-case invariant holds to the live query path's answer.
  • $null joins the probe list.
  • The $notContains dump shows the lowered shape.
    That is 15 lines, and the seat has read them.
• Who else holds the file: no open PR (14 read) and no in-flight claim (18 read).
• A patch round applies it on PR feat(service-analytics,driver-memory): the shared filter lowering at the analytics seams and the cube face's new door (#5930 step 3) #20857.

---

Generated by Claude Code

[objectstack-fleet]

Patch round 1 · #20810 / PR #20857 · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T13:29Z

New head: edb3e2de482cf74a6d1c438b4ecd354fec64e799 on claude/issue-20810-analytics-seam-lowering, pushed.

The commit. edb3e2de4 test(driver-memory): move the cube face's conformance pins to its widened vocabulary — one file, packages/drivers/driver-memory/src/memory-driver-filter-logic-conformance.test.ts, +11 / −4, the file the surface amendment 5911719808 added. It is the prepared patch (md5 b8c3e1886777a37443c94dc864469eb1) applied with git apply after git apply --check passed; the resulting blob equals the copy verified in the last round. Nothing was hand-edited, and no other file is in the commit.

Merged: nothing. Five commits reached main after c90f9fb6e (820d3f4f8, 05a7547c9 #20280, 40d6c5fbd, a94f3bad3, 660a9b247); none touches this PR's file surface, so the branch was not re-merged. The one derivation input they changed, scripts/doc-authoring-prose-id.baseline.json, names no file of this diff.

Readings on edb3e2de4, each under os-verify-lock.sh, exit code captured before any pipe:

Command	Exit	Reading
pnpm --filter @objectstack/driver-memory test	0	66 files, 1485 passed: the three pins green, the total unchanged (last round 1482 passed + 3 failed)
pnpm --filter @objectstack/driver-memory typecheck	0	both tsc programs
pnpm --filter @objectstack/service-analytics test	0	143 files, 3297 passed, unchanged
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack	0	63 families, the same set as last round: the file adds none
the 63 families, plus the six roster families under this card's directories	0 each	69 of 69 exit 0, no PREREQUISITE NOT MET (full turbo run build of ./packages/* first: 71 tasks, 55 cached)
dispatch-gates --ran	0	63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN (a derived zero)
eslint --no-inline-config --format json on the one file	0	1 file, 0 errors, 0 warnings

Writes this round: git push of the branch, and this comment. No MCP write, no PR body PATCH.

Deviation: I had removed the worktree during the last round's cleanup; it was recreated at the pushed head 92a449c2d before the patch was applied.

Patch round 1 (for the seat to append to the PR body)

The named gap is closed. The claim's surface gained packages/drivers/driver-memory/src/memory-driver-filter-logic-conformance.test.ts (amendment 5911719808), and edb3e2de4 applies the prepared 15-line patch to it and to nothing else:

• every $not case must still refuse; the $or cases moved to the answered column, which the file's case-by-case invariant holds to find()'s rows;
• $null joins the declared-operator probe roster;
• the $notContains pipeline dump shows the lowering's NULL escape.

Evidence on head edb3e2de4:

• @objectstack/driver-memory: 66 files, 1485 passed (the three pins green, nothing else moved); typecheck green.
• @objectstack/service-analytics: 143 files, 3297 passed.
• Gates: the same 63 derived families, all exit 0; --ran reports 63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN; the six roster families green.
• main was not re-merged: none of the five commits after c90f9fb6e touches this PR's files.

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT: #20810 · PR #20857 at edb3e2de · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T13:33Z

The dev reports are 5911685990 (delivery) and 5912301552 (patch round 1).

Checklist, read on GitHub rather than from the reports:

• Shape: a draft onto main. 41 files, +1490 / −234, merge base c90f9fb6. Every path sits inside the claim 5909857104 as amended by 5911719808: service-analytics/src/**, driver-memory/src/memory-analytics*.ts, the one amended conformance test file, and two changesets. No packages/spec path and no governed path.
  • Line 1 is Fixes #20810, and line 2 is Clause-②: yes (narrowing), measured rather than copied from the claim.
• Changesets:
  • @objectstack/driver-memory is minor, with the BREAKING banner, Clause-②: yes (narrowing) and exactly one ADR-0087 marker, not-required (no-migration-prescription). The new F5 door refuses comparands the face used to answer; every other face and the engine already refuse them.
  • @objectstack/service-analytics is minor with Clause-②: yes, and it lists each corrected answer. A bare-day $lte and a one-day $between on a declared datetime now return SqlDriver.find's rows through the read scope, which is [finding] service-analytics read scope: compileScopedFilterToSql applies no whole-day upper bound and binds a temporal comparand as written, so an RLS $lte on a bare day drops the rest of that day in NativeSQL analytics #20733's table.
    The contract review judges the split, where the narrowing sits in driver-memory's note.
• The patch round: edb3e2de4 changes only the amended file, +11 / −4. Its changed lines equal the 15-line patch this seat read before the amendment.
• Pins and ablations (per the reports and the PR body):
  • the pins were committed red first (2d3751109), and each seam has an ablation;
  • the read scope, F10, F11 and the F5 door each go red with their piece removed;
  • [finding] service-analytics read scope: compileScopedFilterToSql applies no whole-day upper bound and binds a temporal comparand as written, so an RLS $lte on a bare day drops the rest of that day in NativeSQL analytics #20733's four-row table covers the RLS using half as well as the caller half, and the RLS half was proven through the real SecurityPlugin rather than assumed;
  • [finding] driver-memory analytics: MemoryAnalyticsService runs neither shared comparand door, so a cube where {d: undefined} answers the null rows instead of a 400 #20734's table is the F5 door pin.
• CI at this reading: 25 success, 5 skipped, 4 in progress, 0 failure.

Deviations accepted:

• The nested-relation spelling at the where door. Before lowering, the door now spells a nested-relation spec as the dotted members fieldLeaves always compiled, because the shared lowering read the relation key as a column under $not. This goes beyond the ruling's text but inside its intent. It has its own pin and ablation (2 of 83 red). The contract review judges it.
• Two REST reads of [finding] 仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5 —— 值得立「谓词编译收敛」调查程序(#5298 成本清单副产品) #5930's comments were refused by the local permission layer. They were not re-routed; the order's verbatim quotes and step 2's landed code stood in.
• Two small runs went outside the verify lock (one single-test vitest, one tsc --listFiles).
• The worktree was recreated at the pushed head for the patch round.

Findings, line by line:

• MemoryAnalyticsService drops an array where and answers every row. → filed [finding] driver-memory analytics: MemoryAnalyticsService drops an array (FilterArray) where and answers every row, where the object spelling filters and the engine refuses 400 #20859 (class a; could leak data; serial after this PR, same function).
• Faces with no typed column reader would lose the whole-day bound once their own copy is deleted. This covers the draft preview, and the where door and read scope without their hooks. → a pointer on [finding] 仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5 —— 值得立「谓词编译收敛」调查程序(#5298 成本清单副产品) #5930, which carries step 4's per-face deletion cards, posted in the same act.
• The read scope binds the lowered calendar string as written (ADR-0053 D-A1 coercion). It is right on SQLite ISO text; PostgreSQL and MySQL are not measured. → Acceptance notes.
• The spec lowering's rule 3 reads a nested-relation spec under $not as a column constraint. No face meets it after this PR. → Acceptance notes. It has no reach, so it is not a card.

Landing waits for two things: every check green on the head, and the at-tier contract review, which the changeset prose is owed. After the merge, Fixes #20810 closes the card, and #20807 is claimed.

---

Generated by Claude Code