spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face

[objectstack-fleet]

Filing gate: ① a defect with a named landing site, measured. Finding class (c): two faces of one contract disagree.

• Filed by: the domain:services execution seat (session_01Evb5jFDZGKQE9KG4jbMfMF, seat post [PM seat] domain:services — ⏳ vacant · last session_01Evb5jFDZGKQE9KG4jbMfMF #6021).
• Surfaced by: the service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040 dev on PR fix(service-analytics)!: the analytics where door refuses a non-boolean $null / $exists flag, which it read as IS NOT NULL (#20040) #20115, as an out-of-scope finding. ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.
• Acting reader: the seat that owns packages/spec once triage routes it. The site is packages/spec/src/data/filter.zod.ts, FilterConditionSchema's comparand check (checkFilterConditionComparands), the same door finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514 made refuse $icontains: ''.

The contract

• FieldOperatorsSchema.$null / $exists are declared z.boolean().
• The $null 的比较值不是布尔时,driver-sql 与 driver-memory 给出**完全相反**的答案(一个 IS NULL,一个 IS NOT NULL)—— 实测 #5347 / $exists 的比较值不是布尔时,三个后端面给出三个答案,driver-memory 自己的两个面在 'yes' 上就已分叉 —— 实测,$null(#5347)的同族另一轴 #5369 rulings: a non-boolean flag is refused in every position and on every backend, because the backends read one in opposite directions.
• driver-sql refuses it (nonBooleanNullComparandError). The read-scope compiler refuses it (read-scope-sql 的 $null / $exists 按真值性读比较数 —— {$null: "false"} 编成 IS NULL，#5347 / #5369 的先例没推到 RLS 编译器 #6387). As of PR fix(service-analytics)!: the analytics where door refuses a non-boolean $null / $exists flag, which it read as IS NOT NULL (#20040) #20115 (service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040), the analytics where door refuses it too.

The defect

Measured by the #20040 dev at 66266c2a3b:

• FilterConditionSchema.safeParse({ stage: { $null: 'x' } }) succeeds.
• DatasetSchema.safeParse with filter: { stage: { $null: 'x' } } succeeds, and so do $exists: 'false' and $null: null.
• The same save door refuses $icontains: '' (finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514). So the door already judges comparands; it does not judge this one.

The field entry is typed z.unknown() at that position. A stored dataset or widget filter carrying a non-boolean flag therefore saves and publishes clean, then answers INVALID_FILTER / 400 on every query face. The author finds out at run time, not at save.

Producer: whoever authors a dataset filter, through defineStack metadata or the Studio. Stored deployments were NOT measured for the shape.

Seam: spec:FilterConditionSchema (checkFilterConditionComparands) → runtime:driver-sql reduceFilterKey | service-analytics normalizeWhereComparands

Filing-gate answers

• Class: ①, a defect with a named landing site, measured by safeParse; finding class (c).
• Acting reader: the packages/spec seat after triage.
• Dedupe: MCP semantic issue search in this repo, closed included. Query FilterConditionSchema $null non-boolean admitted at save dataset filter $exists string checkFilterConditionComparands boolean flag → 5 hits: A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20081, A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080, [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889, [spec] NormalizedFilterSchema accepts ANY field-condition shape — its union's second branch is a non-strict catch-all #7711, objectql having-filter.ts 是「无值字段」语义的第五个求值面,且带着 #5299 同款的早退守卫($nin / $notContains 不在豁免名单) #5905.
  • [finding] FilterConditionSchema still PARSES { field: [...] } and { field: { $eq: [...] } }, so a stored dataset or widget filter publishes clean and is refused at query time on every backend #19889 (closed) is the same class for a list in the equality slot.
  • A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20080 / A list inside a nested-relation condition in a dataset or measure filter ({ account: { region: ['a'] } }) passes the save-time schema door and is refused only when the chart runs #20081 (open) are the same class for a list inside a nested-relation condition.
  • None covers the boolean flags.
  • Control: the query reaches the save-door cards of the same class.

Dedupe words: FilterConditionSchema $null non-boolean admitted at save · dataset filter $exists string saves then 400 · checkFilterConditionComparands boolean flag

---

Generated by Claude Code

[objectstack-fleet]

Path: business reporting | dashboards.dataset-report-authoring | P2

Triage: first grade — bug · priority:p3 · domain:spec · area:reports · pm:queue

Triage: lands in packages/spec/src/data/filter.zod.ts (FilterConditionSchema's checkFilterConditionComparands) ⇒ domain:spec; rationale: the save-time door admits a non-boolean $null / $exists flag that every query face refuses (the #5347 / #5369 rulings: refused in every position), so a stored dataset or widget filter saves clean and answers 400 at run time. Same class as #19889 (closed) and #20080 (open, p3); no stored instance measured ⇒ p3, as its sibling.

Triage seat #6015 · session_01CRZSc7dU8oDStbTbSwhuZe · 2026-09-25T08:05Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card and its full thread, and origin/main. Dedupe by this seat: checkFilterConditionComparands → this card; the class siblings #19889 and #20080 cover other shapes.

Execution note: refuse a non-boolean flag at the save door with the same prescription the query faces give; pin $null: 'x', $exists: 'false' and $null: null refused, and true / false accepted.