fix(objectql)!: a number field refuses an array, a boolean or an object with invalid_number (#20309)

[objectstack-fleet]

Part of #20309

Clause-②: no (narrowing)

A number, currency, percent, rating, slider or progress field now refuses an array, a boolean or an object with 400 VALIDATION_FAILED / invalid_number, on every engine and REST write door. At base [500] answered 201 and SQLite stored the TEXT '[500]'. A number is judged and stored exactly as before. A string is unchanged: it is still judged by Number() and written as sent. That is the half this PR leaves open, which is why the first line says Part of: see "The string half" below.

What changes (read from the code at the head below)

• packages/objectql/src/validation/record-validator.ts, the number arm (NUMERIC_VALUE_TYPES minus COMPUTED_VALUE_TYPES, as record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308 left it). One guard before the old finite check: a value whose typeof is neither number nor string is invalid_number. The rest of the arm is byte-identical: the finite check, progress's early return, min, max, scale and every message.
• No change in engine.ts, no driver change, no REST change. Every REST, batch and import door reaches this validator through insert() / update().
• summary is still not judged (ruling 5860986842 on record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308). A blank is still null before the arm (record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308's normalizeBlankTypedValues).
• .changeset/20309-number-arm-non-string-refused.md: @objectstack/objectql minor, a BREAKING banner, Clause-②: no (narrowing), ADR-0087 not-required (no-migration-prescription).

Measured, base to head (H1, H2)

Instrument: a scratch script, not committed, booting the real ObjectQL, ObjectStackProtocolImplementation and RestServer from the built packages, once on InMemoryDriver and once on SqlDriver over better-sqlite3 in memory. Types: number, currency, percent, rating, slider, progress. Doors: engine insert, engine update, REST POST /data/:object, REST PATCH /data/:object/:id, REST batch create, REST batch update. Each cell records the door's answer, the physical cell (the memory driver's own store; on SQLite the column and its typeof()), engine.findOne and REST GET. Base is c74de10a94. Head is this branch at bf83ded05c (the code at the head below is the same). 1016 cells: 14 inputs x 6 types x 6 doors x 2 drivers, plus the 4 H6 cells.

input	base, memory	base, SQLite	head, both drivers
[500]	accepted, stores the array, reads [500]	201, stores TEXT '[500]', reads "[500]"	invalid_number (REST 400; batch row VALIDATION_FAILED), nothing written
[]	accepted, stores []	201, stores TEXT '[]'	invalid_number, nothing written
true / false	accepted, stores the boolean	201, stores 1 / 0 (real; integer on rating)	invalid_number, nothing written
[5, 7], {}, 'Infinity'	invalid_number	invalid_number	unchanged
500, 12.5	stored as the number	stored real (integer for 500 on rating)	unchanged
'0x10'	stored the string	stored TEXT '0x10', read back as 16	unchanged (the string half)
' 12 ', '12', '1e3'	stored the string	stored as a number (column affinity)	unchanged (the string half)
'12.5'	stored the string	stored real 12.5	unchanged (the string half)

Of 1016 cells, exactly 288 moved: [500], [], true and false, 72 cells each (6 types x 6 doors x 2 drivers). The other 728 are byte-identical base to head in all five columns.

H2. At base the arm judged Number(value) and the driver received value: the table's [500] row is that gap, read from the raw column. At head a non-string never reaches the driver. A number arrives as the same number: engine-number-value-door.test.ts asserts Object.is on the driver-facing payload for insert and update. A string still has the gap, and that is the open half.

The string half, and why this PR does not close the card

The seat's update after dispatch set two branches. (a) If no shipped producer sends a numeric string to a number-typed field, refuse every string. (b) If one does, refuse only the non-strings, leave strings exactly as base, open the PR as Part of, and sequence the string half after #20336's grammar.

The in-repo census (below) finds no producer that sends a numeric string. objectui's form widgets, the main row, are NOT MEASURED: this session has no read access to objectstack-ai/objectui (REST GET answered 403, "GitHub access to this repository is not enabled for this session"), and the request to attach it was refused by the session's permission classifier. So branch (a) cannot be established. This PR takes branch (b): it is the one that refuses no form a shipped producer might send. The string half is an open question in the report, not a guess here. ⛔ No numeric-string grammar is authored in packages/objectql.

Producer census (H3)

Every row is a shipped producer of values for a number-typed field, and what it sends.

producer	file	what it sends	measured how
Example seed records	examples/app-crm/src/data/index.ts, examples/app-showcase/src/data/**	JS numbers only: 35 values (crm) and 124 (showcase) on numeric fields; app-todo and app-multi-package seed none	each example's objectstack.config.ts imported with tsx and every seed record walked against its object's field types
Numeric defaultValues	the example objects	JS numbers only: 4 (crm), 11 (showcase), 2 (todo)	same walk
Example flow create_record / update_record nodes	examples/app-todo/src/flows/task.flow.ts, create_next_task	one value on a numeric field: recurrence_interval: '{completedTask.recurrence_interval}', a single-token template. interpolateString (packages/services/service-automation/src/builtin/template.ts) returns the resolved raw value for a single token, so this sends the stored number	same walk; the template rule read at source
Flow templates in general	template.ts	a single token keeps its type; an EMBEDDED template (text around a token) is stringified. No shipped flow puts one on a numeric field	read at source
CSV / JSON import	packages/rest/src/import-coerce.ts (parseNumberCell), called by import-runner.ts before the engine	a JS number, or the row's own invalid_number refusal	read at source
REST batch, createMany, updateMany, import doors	packages/rest	pass the caller's JSON through to the engine; a door, not a producer	measured above
@objectstack/client	packages/client/src/index.ts	serialises the caller's record as JSON; no value stringification	read at source
Read-modify-write through driver-sql	packages/drivers/driver-sql/src/sql-driver.ts (numericValueFields)	numeric columns are presented as JS numbers on every dialect, so a record read back and written again carries numbers	read at source
objectui form widgets	objectstack-ai/objectui	NOT MEASURED (no read access in this session). Indirect only: PR #20340 measured that a cleared number box sends null, not ''	none

Runtime sweep at head: @objectstack/service-automation (147 files, 1767 tests), @objectstack/rest and @objectstack/objectql all pass with the refusal in place.

No collateral (H4)

• A blank ('', ' ') is still null before the arm: record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308's pins pass unchanged (record-validator.blank-typed-value.test.ts, engine-blank-typed-value-door.test.ts, rest-data-blank-typed-value.test.ts), and the new files re-assert it.
• summary is not judged: the new validator pin writes [500], true and a Date to summary and all are accepted, as at base.
• Existing refusals keep their words and code: [5, 7], {}, NaN, Infinity, 'Infinity', 'abc', min_value / max_value on all six types and max_scale. That is 192 validator answers (code, message, fields) compared between the base file and the head file, en and zh-CN, insert and update: 192 identical.
• A valid JS number is stored byte-identical: the 1016-cell table, and the Object.is pin.

Declaration (H5)

Clause-②: no (narrowing), the claim's line. [500], [], true and false answered 201 at base on memory and SQLite and are refused at head. The census names no shipped producer that sends an array, a boolean or an object to a number-typed field, so no producer's form is refused. The objectui row is NOT MEASURED, as above.

• check-changeset-no-major --base origin/main --event (this body as the pull_request payload): exit 0. The gate printed LEVEL AXIS: this PR declares clause-② no (narrowing) and, for the direction arm, narrowing — a BREAKING change; during the launch window it ships minor.
• check-adr-0087-registration --base origin/main: exit 0, "1 declared-breaking changeset(s)", signals BREAKING+bang+clause-②-narrowing, disposition not-required (no-migration-prescription).
• check-empty-changeset --base origin/main: exit 0. record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308's pending changeset (.changeset/20308-blank-typed-value-null.md) reads true at this head, so there is no DELIBERATE CORRECTION.

H6, for the seat (nothing changed for it)

Base c74de10a94, REST POST /data/:object, one field each, bounds declared on the field. The four cells are the same on SQLite and memory, and the same at head.

field	value	answer	stored
progress, max: 100	150	201	150 (SQLite real)
progress, min: 0	-5	201	-5 (SQLite real)
number, max: 100 (control)	150	400 VALIDATION_FAILED / max_value	no row
number, min: 0 (control)	-5	400 VALIDATION_FAILED / min_value	no row

It reproduces: progress stores a value outside the min / max it declares.

Tests

New files:

• packages/objectql/src/validation/record-validator.number-value.test.ts: the refusal set on the six judged types, insert and update, as the envelope (VALIDATION_FAILED plus invalid_number); parity with the spec's valueSchemaFor over every non-string input; a characterization that the string half is unchanged, which turns red when it lands; and the blank and summary controls.
• packages/objectql/src/engine-number-value-door.test.ts: what the driver receives on insert, insert([...]), insertMany, update by id and update by predicate, plus the dry run; a refused value never reaches the driver.
• packages/rest/src/rest-data-number-value.test.ts, on SQLite: POST, batch create, PATCH, batch update and updateMany, with the physical cell and its typeof().

Suites run at c135a38d31 (this branch after merging origin/main 26daf0b036):

• @objectstack/objectql, whole suite: 325 files, 6013 tests passed.
• @objectstack/rest, whole suite: 211 files, 3856 passed and 2 skipped.
• @objectstack/driver-memory: 57 files, 1374 passed.
• @objectstack/driver-sql (no live PostgreSQL or MySQL; those files skip): 192 files passed and 11 skipped; 3157 tests passed and 176 skipped.
• @objectstack/service-automation: 147 files, 1767 passed.
• pnpm --filter @objectstack/objectql --filter @objectstack/rest run typecheck: exit 0, both test layers included.

Reverse verification

The guard was removed with scripts/ablation-replace.mjs (anchor hit once, blob changed), @objectstack/objectql was rebuilt, and ablation-dist-preflight found the marker in 4 built files. Predicted before the run: 68 objectql reds (42 per-input validator cases, the spec-parity case, 24 per-input door cases and the dry run) and 24 REST reds. Measured: objectql 68 failed of 151, REST 24 failed of 43, and every red was one of the predicted cases. Measured at bf83ded05c; the merge of origin/main that followed changed no file in packages/objectql or packages/drivers. The restore proved blob equals HEAD and git diff HEAD is empty; after a rebuild the --absent preflight passed with a clean tree, and the pins were green again (151/151 and 43/43).

Gates

Derived at c135a38d31 with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 64 commands, the same 64 as the dispatch list. Each was run at that head with its exit code recorded before any pipe.

• --ran reconciliation: 64 derived famil(ies) accounted for — 62 run, 2 NOT-MEASURED.
• 62 exit 0, including check:driver-memory-census, check:engine-double-contract, check:objectql-double-limit, check:test-source-alias, check:cross-package-test-inputs, check:nul-bytes, check:issue-citations and check:type-check-coverage.
• NOT MEASURED: check:dual-build-cjs-loads and check:type-check-debt (exit 3, PREREQUISITE NOT MET). Both need every package built, and CI runs both.
• node scripts/check-issue-citations.mjs --base 26daf0b036 (the merge base): exit 0, 4 citations resolve.

Acceptance notes

• Memory is measured, not pinned at the REST door. The triage asked for REST pins on driver-sql and driver-memory. A new @objectstack/driver-memory test consumer is refused by check:driver-memory-census without a ruling, which is the same constraint PR fix(objectql)!: a cleared number, boolean, date, datetime or time field stores null on every backend, and progress refuses a non-numeric value (#20308) #20340 met. The engine pin reads the driver-facing payload, which memory stores verbatim, and the memory REST cells are in the table above.
• The import route's header (packages/rest/src/import-coerce.ts) says the validator "coerces only to check a value and then discards the coerced form". That is still true for strings, and for the boolean and date arms. It is outside this claim's file surface, so it is not edited.
• Stored rows. A value written before this change is never re-read by the check. The changeset carries a read-only SQLite query that finds TEXT cells in a numeric column; nothing is rewritten.
• driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336 and objectql: refuse a non-numeric string compared against a number field at the engine's field-aware filter door (400, every driver and position) — the door half of #20336 #20351 are not addressed here. The census found a shipped producer of numeric strings: objectui's plugin-grid CSV import legacy fallback writes the raw cell (seat answer 5863923799 on record validator's number arm accepts any value whose Number() is finite, so POST /api/v1/data with a number field [500] answers 201 and driver-sql stores the text '[500]' #20309). So the string half accepts driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336's grammar and stores the parsed number, and it waits for that grammar.
• Not filed: the boolean arm has the same judged-vs-written shape (it accepts 0, 1, '0', '1', 'true', 'false' and writes the value as sent). It was read at source only, not measured at a door, so it is not a card (filing gate ①).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 2 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx (via invalid_number (literal, a string literal in validateOne))

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 29720975b6775390d7c54cb3e51f0d70d36c6cd7 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 44a541d51a23418ca445178969de015f7f8885e4 — the merge of head c135a38d3138f4b64ec6d2c28c302dec8b4f315b into base 29720975b6775390d7c54cb3e51f0d70d36c6cd7, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 44a541d51a23418ca445178969de015f7f8885e4 && git checkout 44a541d51a23418ca445178969de015f7f8885e4
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 29720975b6775390d7c54cb3e51f0d70d36c6cd7 c135a38d3138f4b64ec6d2c28c302dec8b4f315b && git checkout -B drift-repro 29720975b6775390d7c54cb3e51f0d70d36c6cd7 && git merge --no-ff c135a38d3138f4b64ec6d2c28c302dec8b4f315b

node scripts/docs-audit/affected-docs.mjs --json 29720975b6775390d7c54cb3e51f0d70d36c6cd7

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 29720975b6775390d7c54cb3e51f0d70d36c6cd7 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c135a38d3138f4b64ec6d2c28c302dec8b4f315b
Local-runs: none

Inputs read: card #20309 body and all 6 comments (5860329599 triage, 5860927463 deferral, 5861525948 claim, 5862810526 os-dev-report, 5863869574 takeover claim, 5863923799 seat answer); PR #20370 body, 5-file list and the net diff origin/main...origin/claude/issue-20309-number-arm-coercion (merge base 26daf0b036, +538/−0); the 34 check-runs on the head (31 success, 3 skipped, 0 failure); record-validator.ts, engine.ts and field-value.zod.ts read at the head by git show only.

① Derived judgments

1. Number arm, non-string refusal — RIGHT. On NUMERIC_VALUE_TYPES minus COMPUTED_VALUE_TYPES (verified on packages/spec/src/data/field-value.zod.ts: exactly number, currency, percent, rating, slider, progress), a value whose typeof is neither number nor string returns invalid_number before the old finite check. Newly refused at head: [500], [], ['12'], true, false, a Date, a boxed Number, and (unlisted in the changeset, unreachable over JSON) a bigint. Every one is refused by the spec's stored schema z.number().finite(), so the door moves toward the declared contract and never past it. This is triage direction 1's non-string half and the A number field's declared scale is never enforced — values with more decimals are accepted and stored verbatim (min/max on the same field are enforced) #7501 posture (refuse, never alter).
2. null / undefined / blank never reach the guard — RIGHT. validateOne returns on isMissing(value) (undefined, null, or a string that trims empty) before every type arm, and record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308's normalizeBlankTypedValues has already made a blank null. typeof null === 'object' is therefore not a regression path; the blank controls in all three new files and record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308's three pin files re-assert it.
3. Nothing else in the arm moved — RIGHT. Read function-scoped, the only non-comment change in record-validator.ts is the three-line guard; the finite check, progress's early return, min / max, scale and every message are byte-identical to origin/main.
4. summary stays unjudged — RIGHT. Subtracted by COMPUTED_VALUE_TYPES (ruling 5860986842 on record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308); formula and autonumber were never in the numeric set. The validator pin writes [500], true and a Date to summary and all are accepted, as at base.
5. Strings unchanged — RIGHT as a Part of half. '12', '12.5', '0x10', ' 12 ', '1e3' are still judged by Number() and written as sent. This departs from triage direction 1 (hex and padded strings refused) and is the seat's branch (b); ruling 5863923799 ratifies it — a shipped producer (objectui plugin-grid/src/ImportWizard.tsx, the legacy per-row fallback) sends numeric strings, so direction 2's first arm applies and the string half is sequenced behind driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336's grammar — and states the effect on this PR is none. The characterization test in record-validator.number-value.test.ts pins the unchanged half and is written to flip when that half lands. The card correctly stays open.
6. Wire surface unchanged in vocabulary — RIGHT. No new error code, message key or status: invalid_number already exists in packages/spec/src/api/errors.zod.ts and all four message bundles; REST answers 400 VALIDATION_FAILED with fields[].code = invalid_number, batch rows success: false. The Docs Drift flag on content/docs/api/error-catalog.mdx lands on a per-type-parse code LIST (line 803) that lists the code and states no trigger; nothing in it is falsified. docs/qa/platform-checklist/areas/records-forms.json (line 3260, "a non-finite value → invalid_number") stays true as a subset. No doc edit is owed by this PR.
7. Reach — RIGHT. Every engine write door runs the validator: insert() (validateRecord at engine.ts:12623), insertMany() delegates to insert(), update() by id and by predicate (:13892, :14203), validate() dry run (:11853); there is no engine upsert (tombstoned, [finding] options.upsert is accepted by engine.update()'s option surface and never read — a declared-but-unenforced key (ADR-0049) #8057). REST POST / PATCH / batch / updateMany and the import route write through insert() / update(), the import route pre-coercing with parseNumberCell. The changeset's "every engine, REST, batch and import write door" holds.
8. Stored rows — RIGHT. Write-time refusal only; nothing is rewritten; the changeset carries a read-only SQLite typeof() query for the operator.
9. Pins — RIGHT. Validator (refusal set, spec parity over every non-string input, controls), engine driver-facing payload (stub driver captures every write call; Object.is control on insert and update), REST on SQLite with the physical cell and its storage class. Memory is pinned at the engine door and measured at REST (see ③). Check-runs: Test Core and its six shards success; Type Check · workspace / source gates / consumer gates success.
10. File surface matches the claim — RIGHT. Validator arm, objectql and rest tests, one changeset. No packages/spec, no driver, no engine.ts, no governed surface (Governed Surface Queue Guard success).

② Semver level

Clause-②: no (narrowing)

• .changeset/20309-number-arm-non-string-refused.md: @objectstack/objectql minor, a **BREAKING** banner, Clause-②: no (narrowing), and exactly one adr-0087 HTML-comment marker reading not-required (no-migration-prescription). The PR body's Clause-②: no (narrowing) matches the changeset and both claims (5861525948, 5863869574).
• Level judged right. The diff narrows a published accept set (arrays, booleans and objects answered 201 at base on the public REST door and are refused at head) and widens nothing, so no (narrowing) is the truthful arm. Per AGENTS.md rule 3 a (narrowing) arm is BREAKING, and check-changeset-no-major ships a breaking change as minor during the launch window — a patch here would carry a breaking change unmarked. Breaking-ness is a property of the contract, not of the census; triage direction 4's conditional ("BREAKING minor if a shipped producer's form is refused") resolves as: no shipped producer sends an array, boolean or object, so no prescription is owed, which is exactly the declared ADR-0087 disposition not-required (no-migration-prescription). No authorable key is removed or renamed, so no FROM → TO mapping is owed.
• packages/rest changes are test-only and publish nothing, so no second changeset is owed; skip-changeset is correctly absent.
• Gate verdicts on the head: Check Changeset (pr-automation.yml: check-empty-changeset, check-adr-0087-registration, check-changeset-no-major at the merge base) success; Lint & Repo Gates success.

③ Boundary flags

• open_questions[0] — the string half, objectui row NOT MEASURED: ANSWERED by the seat (5863923799, option B). Producer named: objectui ImportWizard.tsx legacy fallback sends raw CSV strings to the record write door; the string half accepts only driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336's grammar and stores the parsed number, one write-side rewrite beside normalizeBlankTypedValues; on landing the card goes pm:blocked, Blocked-by: #20336. Effect on this PR: none. Verified the delivered diff is branch (b) exactly — no string refusal anywhere in the net diff (commit 1e1b8f8f narrowed it before the PR opened).
• Deviation, no REST pin on driver-memory (triage direction 3): ANSWERED, accepted. check:driver-memory-census (driver-memory census in undeclared-field-write-driver-split.integration.test.ts is stale — a second packages/runtime test consumer (#6468) is outside #5704's "in this one place" ruling #6664) admits ruled test consumers only, the same constraint fix(objectql)!: a cleared number, boolean, date, datetime or time field stores null on every backend, and progress refuses a non-numeric value (#20308) #20340 met; memory is pinned at the engine door (the driver receives the payload verbatim) and measured at REST in the 1016-cell table. The census gate is hosted in lint.yml, whose every check-run on the head is success.
• Deviation, objectui read access refused: CLOSED — superseded by the seat's own source reading at objectui 6a7f24e92c.
• Deviation, first implementation refused every string, narrowed before the PR: CLOSED — the net diff carries only the guard.
• Deviation, origin/main merged into the branch (c135a38d): CLOSED — five-file net diff; the merge moved nothing under packages/objectql or packages/drivers.
• Deviation, PR assignee os-sales after the takeover by os-warren: ESCALATED to the seat as a label-write; no bearing on the diff, not a condition.
• Deviation, packages/spec/dist/index.d.ts absent in the dev's worktree after the sweep: CLOSED — a worktree artefact; CI built clean (Build Core success).
• NOT MEASURED locally, check:dual-build-cjs-loads and check:type-check-debt: ANSWERED by the head's check-runs — the first is hosted by Build Core (ci.yml:2116), success; the second by Type Check · debt ledger (lint.yml:6296), success.
• out_of_scope, the boolean arm's judged-vs-written shape: ESCALATED to the seat. Read at source only, so not a class (a) finding and rightly not filed by the dev; the seat decides whether to measure it at a door and file bare. Not a condition on this PR.
• out_of_scope, '0x10' stored as TEXT and read-repaired to 16 on SQLite: ANSWERED — folded into the string half (driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336).
• H6, progress ignores its declared min / max: ANSWERED, carrier exists. Reproduced at REST POST on both drivers, unchanged by this PR as the record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308 docblock intends; filed bare by the seat as record validator: a progress field's declared min / max are never checked — REST POST stores 150 over max: 100 and −5 under min: 0 (201), where a number field refuses both #20386 (2026-09-28T05:22Z, cites record write door: '' skips every type check, so a number, boolean, date, datetime or time column stores an empty string — normalise it to null at the door (seam from objectui#10813) #20308 and record validator's number arm accepts any value whose Number() is finite, so POST /api/v1/data with a number field [500] answers 201 and driver-sql stores the text '[500]' #20309, awaiting triage).
• Acceptance note, import-coerce.ts header prose ("coerces only to check"): ANSWERED — still true for strings and for the boolean and date arms; outside the claim surface; the string-half PR is where it is revisited.
• Acceptance note, stored rows: ANSWERED — the changeset's query is the operator's remedy; nothing rewrites.
• Skipped check-runs (Console Pin Gate, Build Docs, Packed-tarball smoke): not a gate miss — path-filtered or opt-in, and the diff touches no docs, governed or objectui-pinned path.

Implemented-by: claude/issue-20309-number-arm-coercion
Reviewed-by: session_01N8TPEsoJxPsdSdNKGnNGEN

VERDICT: PASS