feat(drivers,formula,objectql): the engine's filter faces answer the staged $empty operator (#20444)

[objectstack-fleet]

Fixes #20444
Clause-②: yes (widening)

The domain:engine lane's arms for the staged $empty operator, under ruling A on #20399 (5865693155): 「One sibling card per compile-surface lane, each Blocked-by: #20311's spec PR: domain:engine — driver-sql and its heirs, turso RemoteTransport, driver-memory, driver-mongodb, formula, objectql having; domain:services — service-analytics' two faces. The two faces with no field declarations (the formula matcher, objectql having) judge by value, diverging only on a non-text column holding '' (the write-door class #20308 closed).」

Every arm calls the spec's one expansion from PR #20442 (expandEmptyOperator / isEmptyFilterValue in @objectstack/spec/data); no face keeps a copy of the table. The staging does not move (the maintainer's 「照 $like 先例分阶段」, 5868169573): $empty is not added to FILTER_OPERATORS, the is_empty / is_not_empty lowering still emits $null, and the engine's front door still refuses the operator. A driver or evaluator called directly now answers it.

What each face does now

face	reads	$empty: true	undeclared field
driver-sql applyFilterCondition (and driver-sqlite-wasm, driver-turso local, which inherit it)	declared row	null-only: col IS NULL; text: (col IS NULL OR col = ''); multi-value: (col IS NULL OR L)	refused
driver-turso RemoteTransport.buildWhereSQL	declared row, via a resolver TursoDriver wires from the same registry	same SQL, SQLite dialect	refused (also when used standalone with no resolver)
driver-memory live path (find / count / update / delete through mingo)	declared row	null-only { f: { $eq: null } }; text { f: { $in: [null, ''] } }; multi-value { $or: [{ f: { $eq: null } }, { f: { $size: 0 } }] }	refused
driver-mongodb translateFilter (and the aggregate $match)	declared row, via a new optional valueShape resolver	the same three documents	refused (also standalone with no resolver)
driver-memory reference matcher (match)	by value	isEmptyFilterValue(value)	answered by value (it holds no declarations)
formula matchesFilterCondition	by value	isEmptyFilterValue(actual)	answered by value
objectql having and per-aggregation filter	by value	isEmptyFilterValue(value)	answered by value
driver-memory analytics (cube) face	—	refused INVALID_FILTER / 400 as a declared operator it cannot compile, as it refuses $null	—

$empty: false is the exact complement on every face: (col IS NOT NULL AND NOT L) / a non-null value other than '' (the not-equal operator against a bound '') / IS NOT NULL on SQL, $nin / $nor / $ne on the document faces, !isEmptyFilterValue on the value faces. A non-boolean flag is refused on every query face (INVALID_FILTER / 400, on each driver's validating walk, so an identity that settles the node first cannot skip it); formula answers it false, its standing posture for an unevaluable check.

L, the empty-list test on a multi-value column (a JSON column: TEXT on SQLite, json on PostgreSQL and MySQL):

• SQLite (and libSQL): (CASE WHEN json_valid(col) THEN json_type(col) = 'array' AND json_array_length(col) = 0 ELSE 0 END) — a malformed legacy cell answers FALSE instead of failing the statement; a non-array JSON value is not an empty list;
• PostgreSQL: (CAST(col AS jsonb) = CAST('[]' AS jsonb));
• MySQL: (JSON_TYPE(col) = 'ARRAY' AND JSON_LENGTH(col) = 0);
• any other knex dialect: the multi-value row is refused (the text and null-only rows need no dialect).

An empty list is always tested as a stored value, never bound as a $eq: [] comparand (ruling 乙 on #19757 stands). Every SQL predicate is TOTAL (never UNKNOWN), so $not over $empty needs no NULL guard: both SQL compilers' polarity tables gain the row (operatorIsNullTotal → true, nullValueSatisfiesOperator → value === true).

PM hypotheses, measured

• H1 — held, with the sources named. Measured on base 4a1df1965 by driving each face directly (a scratch probe, not committed) with { f: { $empty: true } }, $empty: false and { $and: [{ g: 'x' }, { f: { $empty: true } }] }, beside a $null control (answered on every face) and a $bogus control. Refusal sources: driver-sql the emitter's default: arm (unsupportedFilterOperatorError); turso remote its own vocabulary refusal (unsupportedOperator); driver-memory live path and matcher both at the shared shape gate (assertFilterConditionShape, filter-refusal.ts); driver-mongodb translateFieldOperators' default:; objectql having unknownOperator. All INVALID_FILTER / 400. formula answered [] for all three shapes (the silent false), exactly as $bogus. After this PR, the same probe answers ['2','3'] / ['1'] / ['2','3'] on every face that holds the declaration or judges by value, and refuses on the two standalone entry points given no declaration.
• H2 — each declared-type face's declaration. driver-sql: a new per-table registry valueShapeFields ({ type, multiple } per field), filled beside jsonFields at registerManagedObjectMetadata (so initObjects and registerObjectMetadata), registerExternalObject, and the shard alias. turso remote: registerRemoteFieldMetadata → registerExternalObject fills the same registry, and TursoDriver hands the transport setDeclaredValueShapeResolver. driver-memory and driver-mongodb: a map filled by syncSchema beside the temporal-kind map. The engine's registry injects the audit / tenant / owner fields into the object's field map before it is synced (per registry.ts' own docblock; not re-measured end to end here), so those are declared too. A field with no declaration (a knex-built table, the builtin id, a field with no type) is a refusal, never a row guessed from a value: the spec's by-value reading has no SQL form without the type (amount = '' is a type error on PostgreSQL). A declared non-member type (string, object, array from an introspected or test object) takes the row the spec's expansion gives it, null-only.
• H3 — SQL arms, above. Pinned on SQLite locally; sql-driver-20444-empty-operator.test.ts runs on every cell of the live dialect matrix, so PostgreSQL and MySQL are measured by the Temporal Conformance (live PG + MySQL) job. Locally NOT MEASURED on PG / MySQL: no server is reachable in this container. The MySQL ' ' row relies on the NO PAD default collation of the job's mysql:8.0.
• H4 — the conformance table. FILTER_LOGIC_CASES gains seven $empty cases on the fixture's nullable column d (true, false, both under $not, inside $or, inside $and, beside $ne on the same field). The fixture stores neither '' nor [], so on it every row of the table agrees; the rows pin that every face HAS an arm, that $not over it is total and that it composes. The per-type discrimination is each face's own suite (below). Census of every consumer that iterates the table:
  • driver-sql sql-driver-or-filter.test.ts — built its table through knex, so the harness now registers the fixture's declaration (registerObjectMetadata);
  • driver-sqlite-wasm, driver-turso local and remote, driver-memory live path and matcher, driver-mongodb live suite — already declared the fixture (initObjects / syncSchema), pass unchanged;
  • driver-memory analytics face — the harness's rule is "agree or refuse loudly", and it refuses;
  • driver-mongodb mongodb-filter-logic-translation.test.ts — calls translateFilter standalone, so it now passes a declaration resolver;
  • formula matches-filter-or-semantics.test.ts — by value, passes unchanged;
  • spec filter-verdict.test.ts — the rows reduce to clause, passes unchanged; lint validate-empty-combinators.test.ts reads only the #5322 rows;
  • service-analytics read-scope-sql-conformance.test.ts and native-sql-filter-logic-conformance.test.ts — outside this lane. Since PR fix(service-analytics): both filter faces answer $empty by the field's declared type (#20445) #20498 (merged) both faces answer $empty, but only when handed the field's declaration; each harness now passes a text declaration for the fixture (test-only, no service-analytics source touched), so they pass the rows rather than partition them. Declared as a deviation below.
• H5 — having's conclusion. By value over the aggregated row: null, a column the row lacks, '' and [] are empty. A numeric aggregate holding 0 (a count over nothing, a sum netting to zero) is not empty. A groupBy text column holding '' is empty — the row a declared text field takes too. The per-aggregation filter shares the walker and the reading. Pinned in having-empty-operator.test.ts, including the row-independent refusal of a non-boolean flag.
• H6 — formula's docblock. Its header claimed a DECLARED operator never gets the silent false; that was false from [Decision] what 「is empty」 means on a text column and on a multi-value column: null only (the spec's lowering today), or null OR '' / [] — three objectui builders disagree, and a stored sharing rule's rows depend on the answer #20311's declaration until this arm. The header now records that, names the declared-but-staged set ($like, $ilike, $empty) as answered, and says the next declared name is owed an arm by the PR that lets an author write it or by its staging's lane card.

Tests (head measured: 436a10a3e)

• New per-face pins, each over a text, a multi-value and a scalar field with null, '', [] and value rows, $empty: false, nesting under $and / $or / $not, a sibling operator on the same field, and refusals asserted by code + status: sql-driver-20444-empty-operator.test.ts (dialect matrix), turso-20444-empty-operator.test.ts (local and remote held to one row set, plus count()), memory-20444-empty-operator.test.ts (live, matcher, analytics face, and the one pinned cell where the declared row and the by-value reading part), mongodb-20444-empty-operator.test.ts (emitted documents and their rows; a live-mongod half runs when the opt-in server is available), matches-filter-empty-operator.test.ts, having-empty-operator.test.ts.
• Extended: the withheld-refusal seam tests of driver-sql (three new builders, one needing the 'unknown' dialect) and of the turso remote transport (two methods, and the local / remote one-sentence table), and driver-memory's operator-key clobber sweep (now declares its column and covers $empty).
• Full package suites on the pre-merge head ea3d95994, each run through the verify lock: driver-sql 197 files passed, 1 failed, 11 skipped — the failure was the withheld-refusal seam enumeration, which the new refusal builders owed rows; they are added in this PR and that file re-ran green (107 tests); driver-turso 77 files, 2080 passed; driver-sqlite-wasm 36 files, 665 passed; driver-memory 59 files, 1419 passed; driver-mongodb 29 passed / 5 skipped, 656 passed; formula 42 files, 1227 passed; objectql --project local 332 files, 6636 passed; service-analytics 134 files, 3165 passed.
• On the merged head 436a10a3e: typecheck exit 0 for all seven packages above (spec's own typecheck ran green on the pre-merge head); the $empty suites and every FILTER_LOGIC_CASES harness re-run green (driver-sql 154 passed / 4 skipped, turso 240, sqlite-wasm 37, memory 194, mongodb 65 / 50 skipped, formula 43, objectql 36, service-analytics 72, spec 73).
• Ablations, each through scripts/ablation-replace.mjs on the committed tree with a restore trap; every leg restored to blob == HEAD with git diff HEAD empty:
  • A1 — driver-sql's text arm drops its '' limb: 4 red in sql-driver-20444-empty-operator.test.ts; the FILTER_LOGIC_CASES sweep stayed green, which is the measured proof the shared rows do not discriminate the text row.
  • A2 — driver-memory's multi-value lowering written as $in: [null, []]: 8 red (mingo does not match a stored [] that way).
  • A3 — formula's arm removed (the silent false back): 13 red, 6 in the new pins and all 7 $empty rows of the shared table. The first A3 attempt did not run: its replacement text already occurred in the anchor, the tool refused the non-rising count, and the file was restored; it was re-run with a distinct replacement.
• check:driver-conformance read before and after: 50 covered cells, 0 DEBT, 0 exempt on both sides.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 436a10a3e (after merging origin/main with a merge commit) derived 91 commands; all 91 ran, each exit code recorded before any pipe. --ran reconciliation: "91 derived famil(ies) accounted for — 89 run, 2 NOT-MEASURED". NOT MEASURED: check:dual-build-cjs-loads and check:type-check-debt, both exit 3 (PREREQUISITE NOT MET: they need the whole workspace built). Narrowed probe instead: the built CJS entry of each changed package loads under require (driver-sql 51 exports, driver-turso 14, driver-memory 23, driver-mongodb 11, formula 47, objectql 178).

Lint, narrowed: eslint.config.mjs lints packages/**/*.{ts,tsx,mts,cts} with no type-aware parsing (no parserOptions.project), so no verdict on an untouched file can move with this diff. pnpm exec eslint --no-inline-config --format json over the 26 changed .ts files: 26 file entries, 0 errors, 0 warnings.

Deviations

• service-analytics test files (read-scope-sql-conformance.test.ts, native-sql-filter-logic-conformance.test.ts) are edited, although the order bars service-analytics. The edit is test-only: it hands each harness the fixture's declaration so the new shared rows pass (H4). No service-analytics source moves.
• packages/spec/src/data/filter-logic-conformance.ts gains the seven rows and a header paragraph, a declared cross-lane test-data edit (the claim names it).

Acceptance notes (observations, not filed)

• The FILTER_OPERATORS TSDoc table in packages/spec/src/data/filter.zod.ts still says no face answers $empty and lists each face as refusing it; filter-empty-operator.ts' header still says nothing in the repository calls the expansion. Both were already stale after PR fix(service-analytics): both filter faces answer $empty by the field's declared type (#20445) #20498 and are staler now. Carrier: the flip card, which rewrites that paragraph when it adds the operator.
• @objectstack/formula's matchesFilterCondition has accepted the object's declared columns (options.fields, type and multiple) since PR fix(security)!: the RLS write check refuses a field-to-field comparison the read refuses — one comparison class, one answer per policy (#20355) #20427, after ruling A was taken. With them it could answer $empty by the declared row, as the read side of the same RLS policy does. This PR keeps the by-value reading the ruling and the card assign; the two part only on a stored state the declaration does not predict. Carrier: none named.
• For the flip card: the engine's front door is the one remaining refusal on the ObjectQL execute path PR fix(service-analytics): both filter faces answer $empty by the field's declared type (#20445) #20498 names. driver-memory's analytics face refuses $empty exactly as it refuses $null today, so the flip moves nothing there.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 7 package(s): @objectstack/driver-memory, @objectstack/driver-mongodb, @objectstack/driver-sql, @objectstack/driver-turso, @objectstack/formula, @objectstack/objectql, @objectstack/spec, touching 67 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/drivers/driver-mongodb/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

28 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 0bbe4005e82fce2058238720cac7ba5cd2f182d5.

⛔ 9 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/drivers/driver-mongodb/src/index.ts) — pages documenting those are invisible to this run
• 7 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 142 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0bbe4005e82fce2058238720cac7ba5cd2f182d5 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b14b72f2a8d2af92b517f7567b8911939a096e0 — the merge of head 436a10a3e9c7ac73ddc9983ad770e4b7469a1b72 into base 0bbe4005e82fce2058238720cac7ba5cd2f182d5, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b14b72f2a8d2af92b517f7567b8911939a096e0 && git checkout 5b14b72f2a8d2af92b517f7567b8911939a096e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0bbe4005e82fce2058238720cac7ba5cd2f182d5 436a10a3e9c7ac73ddc9983ad770e4b7469a1b72 && git checkout -B drift-repro 0bbe4005e82fce2058238720cac7ba5cd2f182d5 && git merge --no-ff 436a10a3e9c7ac73ddc9983ad770e4b7469a1b72

node scripts/docs-audit/affected-docs.mjs --json 0bbe4005e82fce2058238720cac7ba5cd2f182d5

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0bbe4005e82fce2058238720cac7ba5cd2f182d5 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 436a10a3e9c7ac73ddc9983ad770e4b7469a1b72
Local-runs: none

① Derived judgments

Inputs: card #20444 body and all six comments (triage 5871590917, unlock 5875809404, cross-lane 5876791510, claim 5878203784, os-dev-report 5880043060, seat answer 5880101190); #20399 body, ruling A 5865693155 and the pointer 5868183894; #20311's comments including the amendment 5868169573 and the flip-card naming (5870558181, 5874872012); PR #20442 and PR #20498 bodies; PR #20523 body, its 27-file list and the net diff against merge base 0bbe4005e (+1965 / −25, read in full); read-only git show of the touched modules and of every FILTER_LOGIC_CASES consumer at the head; the check-runs on the head, twice (22:49Z with nine in progress, 22:58Z final). Nothing built, run or re-run.

1. One expansion, no private reading — RIGHT. Every declared-type arm calls expandEmptyOperator (driver-sql applyEmptyOperator, turso RemoteTransport.pushEmptyOperator, driver-memory emptyOperatorCondition, driver-mongodb translateEmptyOperator) and every by-value arm calls isEmptyFilterValue (formula evalOp, driver-memory's matcher checkCondition, objectql checkCondition). Each driver switches on expansion.arm and spells that row in its own dialect; the closed union is guarded by a never default in all four, so a fourth row fails loudly instead of being guessed. No face keeps a table of its own.

2. driver-sql and its heirs — RIGHT. The registry valueShapeFields is filled beside jsonFields at registerManagedObjectMetadata (so initObjects / registerObjectMetadata), registerExternalObject and aliasShardBookkeeping, from the RAW type with no 'string' default, so a typeless field, the builtin id and a knex-built table refuse (undeclaredEmptyOperatorFieldError, withheld). Predicates: null-only IS NULL / IS NOT NULL; text (col IS NULL OR col = '') / (col IS NOT NULL AND col not-equal ''); multi-value (col IS NULL OR L) / (col IS NOT NULL AND NOT L), each one knex group so an inner OR cannot re-associate with a sibling conjunct. L: SQLite CASE WHEN json_valid(col) THEN json_type(col) = 'array' AND json_array_length(col) = 0 ELSE 0 END (a malformed TEXT cell answers FALSE, a non-array JSON value answers FALSE); PostgreSQL CAST(col AS jsonb) = CAST('[]' AS jsonb); MySQL JSON_TYPE(col) = 'ARRAY' AND JSON_LENGTH(col) = 0; null on 'unknown', which raises emptyListUnsupportedDialectError while the text and null-only rows still compile there. TOTAL on every dialect: both polarities spell the NULL case out and L is never NULL for a stored value, so $not needs no guard, and the polarity tables carry the row (operatorIsNullTotal true; nullValueSatisfiesOperator value === true). $empty: false is the exact complement on each dialect and is pinned as a partition per field on every cell. [] is never bound as a comparand (ruling 乙 on [finding] the comparand-SHAPE face declares it closes the door "for every driver at once", but an array in the IMPLICIT-EQUALITY slot passes it — and driver-mongodb alone answers it, as an exact-array match #19757 stands). The non-boolean flag is refused on the validating walk (classifyFilterKey), so an identity cannot skip it; pinned under $or: [{}, …]. The arm sits after assertCompilableComparand, assertOperatorAppliesToColumn and the TEXT_OPERATORS gate (which does not name $empty) and before the calendar-day rewrites and coercions — the right slot. PostgreSQL and MySQL: ci.yml's Temporal Conformance (live PG + MySQL) job runs the WHOLE @objectstack/driver-sql suite with OS_TEST_POSTGRES_URL, OS_TEST_MYSQL_URL and OS_EXPECT_LIVE_DIALECT_MATRIX=1, and sql-driver-20444-empty-operator.test.ts declares its cells through DIALECT_CELLS / declareDialectCell, so the new pins DID run on both live dialects; that job is success on this head (22:50:00Z). driver-sqlite-wasm overrides neither dialectName nor applyFilterCondition (grep: no hit) and reports sqlite; turso local inherits the same compiler. The MySQL ' ' row rests on the NO PAD default collation of the job's mysql:8.0, as the PR says.

3. turso RemoteTransport — RIGHT, with one surface note. setDeclaredValueShapeResolver(resolver) is a NEW PUBLIC METHOD on the exported RemoteTransport class — a surface change, and the changeset names it. TursoDriver wires it to SqlDriver.declaredValueShape, which reads the same valueShapeFields registry that registerRemoteFieldMetadata → registerExternalObject fills, so local and remote read one declaration. The remote SQL is the local twin's SQLite construct verbatim, every clause parenthesised as one conjunct (the transport joins a node's clauses with a bare AND); both polarity tables gain the row. A bare transport refuses $empty before any statement runs (pinned, executed === false). Local equals remote: pinned on one row set for text, multi-value and scalar under $and / $or / $not and a sibling operator, plus count(). $empty joins the remote SUPPORTED_FILTER_OPERATORS list and the temporal coercion's hands-off set, which is required — a transport refusing what its local twin answers is the fork the parity suites exist to catch. Note: DeclaredValueShapeResolver is exported from remote-transport.ts but not re-exported by the package index.ts (only FilterColumnSqlResolver is), so the method's parameter type is structurally usable but not nameable from the package entry.

4. driver-memory and driver-mongodb — RIGHT. Both keep a valueShapes map filled by syncSchema beside the temporal-kind map, from the RAW type. Memory: $empty is split out of the field's operator map and pushed as its own extraAndConditions conjunct (so it can contest no mingo key with a sibling — pinned in the clobber sweep), lowered { f: { $eq: null } } / { f: { $in: [null, ''] } } / { $or: [{ f: { $eq: null } }, { f: { $size: 0 } }] } with $ne / $nin / $nor as the complements; find, count, updateMany, deleteMany, distinct and aggregate all route through convertToMongoQuery → normalizeFilterCondition, so the arm reaches every query method. The reference matcher holds no declarations and judges by value; undefined is added to its no-value pass-through so a missing key reaches the arm. The shared shape gate refuses a non-boolean flag for both faces; SUPPORTED_FIELD_OPERATORS admits $empty by hand exactly as it admits $like. The analytics (cube) face refuses INVALID_FILTER / 400 — pinned, and the shared-table harness's rule ("agree with the live path or refuse, never a third answer") tolerates that refusal, verified at head. Mongo: translateFilter(where, temporalKind?, valueShape?), the resolver threaded through translateCondition into $and / $or / $not branches and into the aggregate $match through buildAggregationPipeline.valueShape; MongoDBDriver passes valueShapeFor(object) from find, findOne, count, updateMany, deleteMany, aggregate and explain. Standalone call, unknown field and typeless field refuse; the non-boolean flag is refused on the walk. The emitted documents are pinned by identity and by a server-free reader of the Mongo vocabulary; the live-mongod half is opt-in. Observation, not a breach: on both document faces { f: { $eq: null } } also matches a LIST HOLDING A NULL ELEMENT (MongoDB and mingo null-equality; the test's own mongoEquals models it), so a multi-value cell like ['a', null] reads as empty there and not on SQL. That is a stored state the declaration does not predict (the class ruling A already accepts for '' in a non-text column); the fixtures store none, and it is unpinned — carried in ③.

5. formula and objectql having — RIGHT. formula's evalOp case $empty reads raw, not the resolved v (a { $field } in the slot is not resolved into a flag): true → isEmptyFilterValue(actual), false → its negation, anything else → false, the write denied — this face's standing answer to an unevaluable condition, stated in the PR body. The header now records the window in which a declared $empty got the silent false, names the declared-but-staged set ($like, $ilike, $empty — equal to STAGED_AHEAD_OF_BACKENDS at head) as answered, and says who owes the next arm; the default-arm comment is corrected in the same sense. having: $empty joins CONDITION_OPERATORS (a ruled addition — ruling A names having), NO_VALUE_ANSWERED_BY_OPERATOR (a column the row lacks is empty), and the arm judges by value; a non-boolean flag is refused before the vocabulary check in both assertConditionIsEvaluable and checkCondition. The conclusion is explicit and pinned: 0 from a count or sum is NOT empty, a groupBy '' IS empty, a max over nothing is empty, [] and a missing column are empty; the per-aggregation filter shares the walker.

6. FILTER_LOGIC_CASES — RIGHT. The seven rows check out against the fixture (d null on rows 3-4; b: 'y' on 1 and 3; b: 'zz' on 2 and 4; d: 'v1' on 1): ['3','4'], ['1','2'], ['1','2'], ['3','4'], ['1','2','3'], ['4'], ['2']. The header paragraph states truthfully what the rows pin and do not (the fixture stores neither '' nor [], so the per-type rows are each face's own suite; ablation A1 measured exactly that). Census by grep at head: 13 harnesses iterate the table — driver-sql sql-driver-or-filter (knex-built; now registerObjectMetadata, right), driver-sqlite-wasm (initObjects with string, the null-only row, agrees on this fixture), turso local (initObjects) and remote (syncSchema), driver-memory live plus matcher plus analytics (syncSchema, text) and memory-matcher-or-semantics (by value), driver-mongodb live (syncSchema) and mongodb-filter-logic-translation (standalone; now FIXTURE_SHAPES, right), formula matches-filter-or-semantics (by value), spec filter-verdict (asserts clause, which the rows are), lint validate-empty-combinators (the #5322 subset only), service-analytics read-scope-sql-conformance and native-sql-filter-logic-conformance (now hand { type: 'text' }, matching ReadScopeCompileOptions.declaredValueShape and DatasetScopedStrategyContext.declaredValueShape from PR fix(service-analytics): both filter faces answer $empty by the field's declared type (#20445) #20498). None silently skips a row; the dev's census equals the grep. The two service-analytics edits are test-only (+13 / −1; no packages/services/service-analytics/src/*.ts source in the file list) and right: the fixture's columns are text.

7. Enrolment edits — RIGHT, no assertion weakened. driver-sql seam: three doors added (its enumeration half requires one row per withheldFilterError builder, which is the pre-merge failure the PR names); the optional per-row setup hook is additive, the 'unknown' override is applied on the last door only and the next describe builds its own driver; JSON_COL is declared lookup, multiple: true in that fixture, so the door reaches emptyListUnsupportedDialectError. turso seam: two doors plus two local/remote one-sentence rows. Clobber sweep: syncSchema('t', { v: text }) is what the declared-row refusal now requires, and $empty: false enters the comparand table so every pair is swept. mongodb translation harness: passes the declaration it now needs.

PR-body and changeset sentences: every claim I could read against the diff, the head or the check-runs is TRUE — the A1 measurement, H1 to H6, the dialect constructs, the totality argument, the refusal census, the FILTER_LOGIC_CASES census, the live-dialect claim, and the staging sentences (filter.zod.ts untouched, FILTER_OPERATORS unchanged, the is_empty / is_not_empty lowering unchanged, the $empty arms only). Not verifiable read-only and not re-run per the brief: the local suite counts, ablations A1 to A3, the 91-command gate sweep and check:driver-conformance — the head's check-runs stand in for them (all green, ③). Two changeset sentences carry a scope note, in ②.

② Semver level

RIGHT. Clause-②: yes (widening) on the PR body (line 2), the changeset and the claim — one arm from the closed pair. Seven packages minor (driver-sql, driver-turso, driver-memory, driver-mongodb, formula, objectql, spec), which is what yes requires (at least minor), and each line matches what the diff publishes: the four drivers' filter accept sets widen to the staged operator (declared INVALID_FILTER / 400 before, answered now when the declaration is held); formula's evaluator stops answering false; objectql having widens CONDITION_OPERATORS; spec's shipped FILTER_LOGIC_CASES gains seven rows, so a backend that runs the table must answer $empty or go red — a published-data change, minor is right. The widening is stated on both prose faces exactly as the brief asks: "A driver or evaluator called directly now answers it" and "the engine's front door still refuses it until the flip card adds it". driver-sqlite-wasm with no line: right — no source moved, and every one of these packages sits in the fixed group of .changeset/config.json, so it takes the same version regardless; only its CHANGELOG entry is absent. Check Changeset success.

New exports and members, read against the changeset's "New optional API" sentence. Named: translateFilter's third parameter and the ValueShapeResolver type on the driver-mongodb index; buildAggregationPipeline.valueShape; RemoteTransport.setDeclaredValueShapeResolver. Not named — each inside minor, none widening beyond the stated widening: DeclaredValueShapeResolver (a module export, not on the driver-turso index); SqlDriver.valueShapeFields and SqlDriver.declaredValueShape, both protected on an exported class and therefore in the .d.ts the heirs subclass against; driver-memory's nonBooleanEmptyComparandError and undeclaredEmptyOperatorFieldError stay internal (filter-refusal.ts is not re-exported). The sentence is TRUE as a list and incomplete as an inventory; no level moves. The sentence "Refused, never guessed (INVALID_FILTER / 400): … and a flag that is not a boolean" is TRUE for every query face and for the drivers it is scoped to; formula, in the by-value bullet above it, answers a non-boolean flag false and refuses nothing — the PR body says so, the changeset does not. A one-clause prose gap, not a level error; the seat may fold it into the changeset at landing or leave it.

③ Boundary flags

open_questions: [] — nothing to answer. The four deviations and three out-of-scope notes, each answered:

• D1 service-analytics test files (+13 / −1, test-only) — ACCEPTED. Required by H4 (pass or partition; passing is the stronger answer), no service-analytics source in the file list, admitted by the seat answer 5880101190, the services seat told on [PM seat] domain:services — 🟢 os-justin #6021; PR fix(service-analytics): both filter faces answer $empty by the field's declared type (#20445) #20498's file overlap with this PR is none.
• D2 spec filter-logic-conformance.ts rows plus header — ACCEPTED. Named in the claim as the declared cross-lane test-data edit; the header states the pin's reach truthfully; spec carries minor because the table ships.
• D3 enrolment edits (two seam tests, the clobber sweep, the translation harness) — ACCEPTED, ①.7.
• D4 changeset lines — ACCEPTED, ②.
• O1 stale spec prose (the FILTER_OPERATORS TSDoc per-face table saying each face refuses $empty; the filter-empty-operator.ts header sentence "Nothing in this repository calls these functions yet") — CARRIED to the flip card filter: flip is_empty / is_not_empty to $empty and add it to FILTER_OPERATORS, once every compile surface answers it (the last step of ruling A on #20399) #20446 (open, domain:spec, Blocked-by: #20444 and #20445), whose body already orders the docblock's staging paragraph retired. ESCALATED: filter: flip is_empty / is_not_empty to $empty and add it to FILTER_OPERATORS, once every compile surface answers it (the last step of ruling A on #20399) #20446's re-read list (record 5874872012 on [Decision] what 「is empty」 means on a text column and on a multi-value column: null only (the spec's lowering today), or null OR '' / [] — three objectui builders disagree, and a stored sharing rule's rows depend on the answer #20311) names the describe's staging sentence, view-grouping-query.ts and driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336's module sentence but not the filter-empty-operator.ts header — the seat should add that sentence to filter: flip is_empty / is_not_empty to $empty and add it to FILTER_OPERATORS, once every compile surface answers it (the last step of ruling A on #20399) #20446 so it is not left false after the flip. Not this PR's file surface: the claim bars filter.zod.ts and names only the conformance table in spec.
• O2 formula's declared-columns option (options.fields since PR fix(security)!: the RLS write check refuses a field-to-field comparison the read refuses — one comparison class, one answer per policy (#20355) #20427) — ANSWERED: by value is what ruling A assigns the formula matcher in so many words, and the card repeats it; the ruling predates fix(security)!: the RLS write check refuses a field-to-field comparison the read refuses — one comparison class, one answer per policy (#20355) #20427 but stands until re-ruled; the divergence is confined to write-door-defect states, and this PR pins the one cell where the two part. No card now; a future ruling if read/write parity of the same RLS policy on '' in a non-text column is ever wanted.
• O3 the engine front door — ANSWERED: correct — the one remaining refusal on the ObjectQL execute path PR fix(service-analytics): both filter faces answer $empty by the field's declared type (#20445) #20498 names; driver-memory's analytics face refuses $null and $empty alike, so filter: flip is_empty / is_not_empty to $empty and add it to FILTER_OPERATORS, once every compile surface answers it (the last step of ruling A on #20399) #20446 moves nothing there.

Dev flags in the PR body:

• "Locally NOT MEASURED on PG / MySQL" — CLOSED by the head's check-runs: the live job runs the whole driver-sql suite with both URLs and the matrix expectation set, and it is success (①.2).
• "The engine's registry injects the audit / tenant / owner fields … not re-measured end to end" — ESCALATED to filter: flip is_empty / is_not_empty to $empty and add it to FILTER_OPERATORS, once every compile surface answers it (the last step of ruling A on #20399) #20446. The engine's front door refuses $empty until the flip, so nothing wrong can be served today; after the flip a stored view's 「is empty」 on owner or an audit column is answered only if that column is in the object's field map when initObjects / syncSchema runs, else refused INVALID_FILTER / 400 — never wrong rows. A grep hit at registry.ts:2192 reads "Apply system-field injection (multi-tenant org_id, future owner/audit)" — read as one line, not the function — so the injected columns' declaration needs filter: flip is_empty / is_not_empty to $empty and add it to FILTER_OPERATORS, once every compile surface answers it (the last step of ruling A on #20399) #20446's pre-dispatch re-measure, which its body already orders for every face.
• The live-mongod half skipped locally — the emitted documents and the server-free reader run everywhere; the live half is opt-in by design. ACCEPTED.
• driver-sqlite-wasm carries no per-type $empty pin of its own (its only harness is the shared table on string columns, the null-only row); the multi-value construct on sql.js is the inherited compiler unchanged, and the same JSON1 functions (json_valid, json_each) already serve $contains on JSON columns there. Observation for the seat; no card required.
• The document faces' null-equality over a list holding a null element (①.4) — observation, unpinned, write-door class; the seat may note it on filter: flip is_empty / is_not_empty to $empty and add it to FILTER_OPERATORS, once every compile surface answers it (the last step of ruling A on #20399) #20446 beside the ''-in-a-number-column cell.
• [finding] a misspelt field name in a field's relatedListColumns, lookupColumns, lookupFilters[].field or dependsOn passes every authoring door, and fails only at view or picker time #20432's syncDeclaredIndexes region: UNTOUCHED — the sql-driver.ts hunks land in aliasShardBookkeeping, registerManagedObjectMetadata, registerExternalObject, the error builders, classifyFilterKey, the polarity tables and the filter arm; syncDeclaredIndexes (defined at 14604) is not in the diff.

Check-runs on the head, final read 2026-09-28T22:58:28Z: 35 runs — 32 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke: path-filtered or opt-in), 0 failure, 0 in progress. Named: Lint & Repo Gates success (22:51:22Z); Temporal Conformance (live PG + MySQL) success (22:50:00Z); Test Core and its six shards success (22:57:40Z); Type Check · workspace, source gates, consumer gates and debt ledger success; TypeScript Type Check success; Check Changeset success; Governed Surface Queue Guard success; the three claim and single-writer guards success. At the first read (22:49Z) nine of these were in progress; every one completed green.

Implemented-by: claude/issue-20444-empty-operator-engine-arms
Reviewed-by: session_01N8TPEsoJxPsdSdNKGnNGEN

VERDICT: PASS