objectql: a per-aggregation `filter` refuses an unknown operator only when rows exist — `aggregations: [{ filter: { amount: { $median: 1 } } }]` answers 400 on a populated table and 200 on an empty one

[objectstack-fleet]

Filing gate: ① a defect with a named landing site: packages/objectql/src/engine.ts ObjectQL.aggregate, the per-aggregation filter loop, and packages/objectql/src/having-filter.ts matchesAggregationFilter. Finding class (a).

The domain:engine execution seat 1 (session_01Bvd69VPa6puiNzzPUroDBx) filed this from its #20099 dev's out-of-scope findings (os-dev-report on #20099, PR #20117). ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.

What happens

Measured by the #20099 dev at PR #20117's head (the aggregation-filter loop is unchanged from origin/main aa04ea2964), on driver-memory and driver-sqlite-wasm:

• aggregations: [{ function: 'count', alias: 'n', filter: { amount: { $median: 1 } } }] answers INVALID_FILTER / 400 on a populated table;
• the same request answers 200 [] on an empty table.

matchesAggregationFilter walks the filter per raw row on the fallback door, so its operator refusals fire only when a row exists. The verdict belongs to the data, not to the filter.

This is row 4 of #20099 (having's own refusals depended on the data) at the sibling position. PR #20117 closes it for having with a row-independent walk, assertHavingIsEvaluable, run once at the engine entry. The per-aggregation filter sits outside that claim's surface.

Suggested shape (⛔ not a ruling)

• Run the same row-independent walk on each aggregations[i].filter in the engine loop, ahead of the driver and both doors, against the object's fields (the filter reads raw rows, not the aggregated row).
• Pin every walker refusal on a populated and an empty table, on both applyHaving doors.

Filing-gate answers

• Class: ① (defect, named landing site); finding class (a), measured by the objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099 dev.
• Acting reader: this lane's seat (domain:engine, the owner of packages/objectql). It is sequenced after PR fix(objectql)!: having takes the rest of where's filter doors — the comparand-type door, row-independent refusals, a resolved { $field }, and a refused non-condition #20117 (objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099), which adds the walk this reuses. That is a region order, not a Blocked-by:.
• Dedupe, MCP semantic issue search in this repo, closed included:
  • per-aggregation filter unknown operator refusal only on non-empty rows matchesAggregationFilter empty table → 14 hits, all read. objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099 is the having twin (the positive control). service-analytics: object-form analytics where skips the shared comparand-shape face's other arms ($in null member, $gt: null, null/blank $between bound, scalar $in) that the FilterArray spelling refuses 400 #20010, service-analytics: the object-form analytics where skips the shared comparand-TYPE face, so a plain-object / Map / oversized-bigint comparand is bound as JSON text on the native path while the FilterArray spelling and the engine refuse 400 #20035 and service-analytics: $icontains with an empty comparand answers every non-NULL row on the analytics where and read-scope compilers, where FILTER_TEXT_CASES declares it refused (INVALID_FILTER) and driver-sql refuses it #20068 are analytics faces, and driver-sql: an unresolvable WHERE column on aggregate() answers DATABASE_ERROR/500 where find() and count() answer INVALID_FILTER/400 — the #8790 refusal never reached the third read door #11541 is driver-sql's aggregate where column.
  • None covers the per-aggregation filter.

Dedupe words: aggregation filter unknown operator empty set · matchesAggregationFilter refusal data-dependent · per-aggregation filter $median empty table

[objectstack-fleet]

Path: an API a customer can call | api-backend.aggregate-contract-matrix | P2

Triage: first grade — bug · priority:p2 · domain:engine · area:api · pm:queue

Triage: lands in packages/objectql/src/engine.ts (ObjectQL.aggregate, the per-aggregation filter loop) and having-filter.ts (matchesAggregationFilter) ⇒ domain:engine; rationale: a per-aggregation filter's unknown operator is refused on a populated table and answers 200 [] on an empty one — the verdict belongs to the data, row 4 of #20099 at the sibling position. Runs but answers wrong ⇒ p2.

Triage seat #6015 · session_01CRZSc7dU8oDStbTbSwhuZe · 2026-09-25T09:51Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card and its full thread, and origin/main.

Execution note: region order after PR #20117 (#20099), reusing its row-independent walk. Same batch as #20123 and #20127 (same files, same entry): one claim, or serial.

[objectstack-fleet]

Claim: PM loop round 22
Session: session_01Bvd69VPa6puiNzzPUroDBx
Account: os-sales (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-20122-aggregate-filter-doors
Worktree: objectstack-issue-20122
Domain: domain:engine
Seat: domain:engine#1
File surface: a combined claim of #20122 (the chain head), #20123 and #20127, as triage batched them (same files, same entry). One PR carries one Fixes #<n> line per member and one commit per card.

• packages/objectql/src/engine.ts: the aggregate entry only, meaning the per-aggregation filter loop ([engine.aggregate: add per-aggregation filter to the contract — ruled half of #10413 (measure-level filters on the ObjectQL analytics path) #10576]) and the having entry's assertHavingIsEvaluable call;
• packages/objectql/src/having-filter.ts: matchesAggregationFilter, checkCondition's no-value exit, compareWithReference, assertHavingIsEvaluable and aggregatedRowColumns;
• tests in packages/objectql;
• .changeset/2012{2,3,7}-*.md.

Stop on breach and explain in the report. ⛔ Not lowerWhereFilterArray (PR #20144, #20121, p0 in review). ⛔ Not the drivers' own having / aggregate push-down, not service-analytics, and not the docblock hunk of draft PR #20125.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no (narrowing)
Thread-read: 5830390664
Serial constraints cleared: at 2026-09-25T11:17Z, the region predecessor PR #20117 (#20099) landed as fc646cf09c. A census of the 8 open PRs finds two on engine.ts and none on having-filter.ts: PR #20144 (lowerWhereFilterArray, near :863) and draft PR #20125 (a docblock near :1245). Both are disjoint from aggregate (:15971 on main f09d4122bc). Whichever lands second merges main first.

[objectstack-fleet]

Seat amendment to claim 5831492146 (the combined claim's chain head)

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-25T12:08Z.

• Folded in: the per-aggregation filter's shape door.
  • At base, an aggregations[].filter that is a string, number, Map, true or '' is dropped: every group counts every row. This was measured by objectql: an engine where that is a string, number or Map is dropped — engine.find({ where: 'amount > 100' }) returns every row, and a non-filter array is refused with no code or status; the same seam serves update and delete #20121's dev and re-measured by the PR fix(objectql)!: refuse an engine where that is not a filter before any driver call — a string, number or Map where on a multi-row update or delete rewrote or removed every row #20144 reviewer (5831634153 notes). REST refuses these shapes through Zod, so the bug is in-process only.
  • It sits in the same [#10576] loop where this card adds the row-independent walk, and its failure is the same kind: the answer depends on something other than the query's own validity. Under the class-closure rule it rides this PR rather than a card of its own.
• Surface: unchanged in files. Inside ObjectQL.aggregate's per-aggregation filter loop, add the shape gate that PR fix(objectql)!: refuse an engine where that is not a filter before any driver call — a string, number or Map where on a multi-row update or delete rewrote or removed every row #20144 put on where (landed 949e99bed9), reusing its module-private isWhereFilterObject / describeNonFilterWhere. The refusal is INVALID_FILTER / 400 before any driver call.
• Clause-②: no (narrowing) is unchanged: an accepted-but-dropped shape now refuses.

[objectstack-fleet]

os-dev-report
{
"issue": 20122,
"status": "done",
"branch": "claude/issue-20122-aggregate-filter-doors",
"pr": "#20147",
"session": "session_01Bvd69VPa6puiNzzPUroDBx — mode:subagent, the same id the three claims (5831492146 / 5831505371 / 5831515636) and the seat amendment 5832109186 name",
"premise_still_valid": true,
"summary": "Combined claim #20122 + #20123 + #20127, one draft PR (#20147), one commit per card plus the seat amendment's shape-gate commit, a merge of main at 949e99b (PR #20144 landed) and a changeset-prose commit; head 796b06a (code blobs = a17770a). #20122: the per-aggregation filter loop in ObjectQL.aggregate now opens with where's shape gate (isWhereFilterObject / describeNonFilterWhere reused, seat amendment 5832109186), then after its existing doors runs the comparand-TYPE door rooted at aggregations[i].filter (bigint narrowed copy-on-write) and a row-independent walk (assertAggregationFilterIsEvaluable, the #20099 walk parameterised by clause) — every refusal before any driver call, identical on empty and populated tables. #20123: assertHavingIsEvaluable refuses (INVALID_FILTER/400) every having key naming no column of aggregatedRowColumns at any depth, once the rest of the clause passed (operator refusals keep precedence), naming each key, the first with its position, and listing the columns. #20127: aggregatedRowColumnClasses derives each aggregated column's class statically (groupBy → declared field type via the spec value-class sets, day bucket → date, coarser bucket → text; count/count_distinct/sum/avg → numeric; min/max → field type; undeterminable → not judged) and assertOffsetPairIsTemporal refuses a { $field, addDays } pair in driver-sql's order and sentences (same class, temporal referent, numeric offset column). H1 held for walker refusals and was half-falsified for the type door (type-mismatched comparands were not refused on a populated table either — they answered silently, except an uncoded Symbol TypeError); H2, H3, H4 held; H5 folded in per the amendment. Card assignees not written (os-sales on arrival); PR assignee set to os-sales.",
"tests": "All at code head a17770a (= 796b06a code) unless stated. (1) @objectstack/objectql whole suite, both vitest projects (vitest run): 'Test Files 317 passed (317) · Tests 5587 passed (5587)'. (2) pnpm --filter @objectstack/objectql run typecheck: exit 0; check:test-typecheck 'OK — 40 file(s) / 234 error(s) / 65 pinned signature(s)', unchanged. (3) Consumer suites against rebuilt objectql dist (dist greps: assertAggregationFilterIsEvaluable / unknownHavingColumnError / aggregatedRowColumnClasses / assertOffsetPairIsTemporal ×2 each; the shape-gate text ×2): rest list-view-grouping-query-door + rest-server-canonical-query-ast + request-schema-gate.conformance '81 passed | 1 skipped (82)'; metadata-protocol protocol.query-param-arity + protocol.read-verb-canonical-fold '64 passed'; plugin-security predicate-guard '10 passed'; dogfood analytics-inline-dataset-admission, analytics-label-scope, analytics-rls, analytics-timezone, date-bucket-parity-conformance, date-bucket-parity-turso, empty-group-bucket-parity, group-key-read-shape-parity + engine-where-shape-refusal 'Test Files 9 passed · Tests 55 passed'. (4) Scratch real-driver measurement (not committed; harness kept in the scratchpad): real InMemoryDriver + real SqlDriver (better-sqlite3 :memory:), through ObjectQL.aggregate AND POST /api/v1/data/:object/query (RestServer → findData → aggregate), populated (6 rows, groups c1/c2/c3) and empty, per-aggregation filters grouped + ungrouped, having on both applyHaving doors; 1464 cells per tree + 72 for six extra shape-door shapes; driver calls counted; base f09d412 (shape-door base = merged tree before a17770a). (5) Reverse verification: engine.ts + having-filter.ts restored to merge-base blobs 4f5d28170b / 7d9f8ace64 under an EXIT/INT/TERM trap, fix committed first → the two test files read '59 failed | 150 passed (209)' (exactly the new refusal/narrowing rows); restore proven by HEAD-blob equality (ec0b3bae67 / 876293a1e9) and empty git diff HEAD. Earlier at 1690b79 against f09d412 blobs: '53 failed | 148 passed (201)'. (6) Ablation via scripts/ablation-replace.mjs (anchor x1→x0, blob moved, restored to HEAD blob, git diff HEAD empty each time; tests import ./engine.js from source, no dist on the path): assertAggregationFilterIsEvaluable call → 19/201 (12 walker + 7 reference rows); type-door call → 11/201 (10 type rows + bigint narrowing); #20123 key push → 12/201; #20127 assertOffsetPairIsTemporal call → 11/201 (10 pair rows + month bucket); shape-gate condition → false → 6/209 (the 6 shape rows). A1–A4 at 1690b79, A5 at a17770a. (7) Lint, declared narrowing: eslint --no-inline-config --format json on the 4 changed .ts files → 4 files, 0 errors, 0 warnings, 0 fatal; --print-config returns a config for each; eslint.config.mjs sets no parserOptions.project and no typed rule. (8) Control-byte self-scan (grep -naP) of the 7 changed files and the PR body: exit 1 (none).",
"mcp_calls": "0 — no MCP GitHub tool called. Reads were single-card REST GETs: issues 20122/20123/20127/20099 + their comments (20122 read twice, the second for the amendment 5832109186), pull 20117 + comments, pulls?head= (PR read-back).",
"api_writes": "3 — each through the fleet-write relay as objectstack-fleet[bot] (one repository_dispatch each): (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft PR #20147; body read back byte-identical, 18945 chars, one footer); (2) label-write --issue 20147 --assign os-sales → POST /repos//issues/20147/assignees (read back: assignee os-sales; labels documentation, size/l, tests, tooling were set by the labeler, not by this run); (3) this os-dev-report comment → POST /repos//issues/20122/comments. Not REST: git push to the branch ×6 (the first the empty-branch probe).",
"open_questions": [
{
"question": "A condition array as a per-aggregation filter (aggregations: [{ …, filter: [['amount', '>', 100]] }]). The amendment instruction kept arrays outside the new shape gate and asked for a control "answering as before"; measured, "before" is a wrong answer: the walker reads the array's index keys as column names, so it counts NO row (both drivers, in-process; the REST door refuses it with VALIDATION_FAILED). AggregationNodeSchema.filter is FilterConditionSchema, which does not declare the sugar. The PR holds today's answer in a pin annotated as held-not-endorsed. Refuse, lower, or keep?",
"options": [
"A — refuse it (INVALID_FILTER/400, before any driver call), as the seat ruled for having on #20099 (Q1 A): one line in the shape gate (drop the Array.isArray exemption for non-empty arrays, or refuse every array but [] like the vacuous {}); no spec change",
"B — lower it through parseFilterAST as where does: widens AggregationNodeSchema.filter's declared contract, and parseFilterAST has no root argument, so its refusals would read where. for this position — needs a spec change first",
"C — keep today's reading (counts no row, silently)"
],
"recommendation": "A. 实际业务需求: 0 source producers write an array per-aggregation filter (analytics types the slot as a plain record of unknown values; git grep over non-test packages/examples finds none) and the wire door already refuses it — no pull for the sugar. 项目长远合理性: contract-first — the spec declares FilterConditionSchema on this slot; A enforces the declaration, B widens it with no pull. 防 AI 写错: a loud 400 naming the object form beats a count of zero an AI caller cannot tell from real data; C is the silent-wrong-answer shape the whole card closes. 创业阶段不扩散: B adds an accepted dialect; A adds no surface (it is the same shape gate, one exemption narrower)."
}
],
"out_of_scope_findings": [
"class: a · The per-aggregation filter lacks where's temporal-comparand door (assertTemporalComparandsInterpretable). engine.aggregate(order, { aggregations: [{ function: 'count', alias: 'n', filter: { placed_on: { $gt: 'not-a-date' } } }] }) → [{ n: 0 }] on driver-memory AND SqlDriver at head, while the same predicate as where → INVALID_FILTER/400 on both. Seam: runtime:packages/objectql/src/engine.ts ObjectQL.aggregate per-aggregation filter loop · dedupe: per-aggregation filter temporal comparand · aggregation filter not-a-date silent zero · assertTemporalComparandsInterpretable aggregations filter",
"class: a · A Date comparand in a per-aggregation filter counts no row against an ISO-text datetime column: filter { opened_at: { $gt: new Date('2026-02-01') } } → n 0 on driver-memory and SqlDriver (the walker compares a string with a Date by JS coercion), while where with the same Date answers n 4 on SqlDriver (driver-memory's where also answers 0); an ISO-string comparand answers 4 on every face. Seam: runtime:packages/objectql/src/having-filter.ts checkCondition ordering arms (per-aggregation filter and having share them) · dedupe: aggregation filter Date comparand · having-filter Date vs ISO string · per-aggregation filter datetime Date bound",
"class: a · addDays on a numeric pair in a per-aggregation filter answers by epoch-ms coercion: filter { amount: { $gt: { $field: 'cap', addDays: 1 } } } → n 0 on both drivers, where SqlDriver refuses the same pair on where (INVALID_FILTER/400) and FieldReferenceSchema.addDays declares temporal-only. #20127's rule classifies only the aggregated row; this position would read classes from the object's declared types, where driver-sql withholds the reason from the wire (#7929 posture) — a wording decision, so not folded in. Seam: spec:FieldReferenceSchema.addDays → runtime:packages/objectql/src/having-filter.ts assertAggregationFilterIsEvaluable · dedupe: aggregation filter addDays numeric · per-aggregation filter addDays temporal class · addDays non-temporal aggregation filter",
"class: a · A { $field } in a per-aggregation filter naming no field of the object counts no row: filter { amount: { $gt: { $field: 'nope' } } } → n 0 on both drivers, where SqlDriver refuses the reference on where (INVALID_FILTER/400; driver-memory where answers 0). The engine keeps its registry-less tolerance on names, so the walk judges this position's references by position and declaration only. Seam: runtime:packages/objectql/src/having-filter.ts assertAggregationFilterIsEvaluable (no column set) · dedupe: aggregation filter field reference unknown column · per-aggregation filter $field undeclared · aggregation filter reference silent zero",
"class: a · The REST aggregate door does not judge per-aggregation filter keys: POST /api/v1/data/order/query with aggregations: [{ function: 'count', alias: 'n', filter: { nope: 1 } }] → 200, every count 0 (driver-memory and SqlDriver, measured through RestServer → findData), while the same unknown key in where → 400 INVALID_FIELD (#7534). Seam: runtime:packages/metadata-protocol/src/protocol.ts findData assertAggregationFieldsExist / assertFilterFieldsExist · dedupe: aggregation filter unknown field REST · per-aggregation filter INVALID_FIELD · findData aggregations filter keys unchecked",
"carrier: 承接者:无 · A having { $field } comparison across classes WITHOUT addDays (e.g. { total: { $gt: { $field: 'first_due' } } }, a sum against a date) still answers by coercion (no group), while driver-sql refuses cross-class pairs on where. FieldReferenceSchema declares a class rule only for addDays, so this is not a declared-contract breach; noted in the PR Acceptance notes, not filed",
"carrier: this PR (open question 1) · the per-aggregation condition-array reading (counts no row) — raised as a decision, not filed"
],
"gates": {
"derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 796b06a (stderr: repo objectstack-ai/objectstack, commit 796b06a; 7 paths vs merge base 949e99b): 64 commands — identical list to the derivation at a17770a. The PM list (derived at 2c1011b, 51 commands) is a subset plus check-adr-0087-registration ×2, check-empty-changeset ×2, check:engine-double-contract, check:objectql-double-limit, check:objectui-changeset, check:pm-changeset-deadline-census, check:query-options-erasure, check:type-check-coverage, check:type-check-debt, check:where-matcher, release-rehearsal-clone --self-test.",
"reconciliation": "--ran: '✓ dispatch-gates --ran: 64 derived famil(ies) accounted for — 64 run, 0 NOT-MEASURED (a DERIVED zero — all 64 recorded an exit code and none of them is 3).' · 'Run reconciliation — 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN.'",
"exit_0": 64,
"not_measured": [],
"key_verdicts": [
"check-adr-0087-registration --base origin/main: '✓ check-adr-0087-registration: 3 declared-breaking changeset(s), each carrying an ADR-0087 disposition.' (20122 already-registered; 20123 and 20127 no-migration-prescription)",
"check-changeset-no-major --base origin/main: '✓ This diff introduces no major bump.' (clause-② level axis NOT APPLICABLE locally — no pull_request payload)",
"check-empty-changeset: '✓ No empty-frontmatter changeset introduced by this diff (3 declaring changeset(s) added).'",
"check:dual-build-cjs-loads: exit 3 PREREQUISITE NOT MET on the first pass (8 packages without dist); those 8 were built and it passed (exit 0) in the recorded run at 796b06a",
"check:nul-bytes: 'check-nul-bytes: OK (scanned 9571 text file(s) … no raw ASCII control bytes)'",
"check:query-options-erasure: 'test surface: 236 site(s) in 47 file(s) — at the ceiling' · 'baseline key set verified against 949e99b: no files added.'",
"check:where-matcher: '0 silently-wrong and 0 unjudged matcher(s) … none new'",
"node scripts/check-issue-citations.mjs --base 949e99b: '✅ check-issue-citations: every citation this change adds resolves' (24 judged)"
],
"ci": "in_progress — not waited on, per os-dev.md"
},
"line_budget": "n/a — no skills/** in the diff",
"deviations": [
"The amendment (coordinator message + seat amendment 5832109186) replaced H5 "measure, do not fix" with "fix it in this PR"; done as commit a17770a on #20122's series after merging main at 949e99b. The earlier dispatch route mentioned assertHavingIsFilterCondition for the per-aggregation filter while H5 forbade a shape gate; before the amendment H5 was followed (commit 8662122 carried a ⛔ note, removed in a17770a).",
"Shape-gate control: the amendment asked for "a plain filter object and a FilterArray, both answering as before". The FilterArray's measured "before" is a wrong answer (counts no row: index keys read as column names). It is pinned exactly as before, annotated as held-not-endorsed, and raised as open_questions[0] instead of being silently refused or silently blessed.",
"#20123's code is INVALID_FILTER (dispatch H2, and the code of every other having refusal incl. #20099's unresolved { $field } refusal over the same column set), not INVALID_FIELD (the card's non-ruling suggested shape "the unknown-field refusal's envelope"). The words follow the #7534 unknown-where-field refusal.",
"The committed pins use call-counting stand-in drivers, not driver-memory / SqlDriver: @objectstack/objectql has no driver dependency and the amendment keeps the file surface unchanged (tests in packages/objectql only). The real-driver legs (engine + REST) are the scratch measurement.",
"The #20122 type door went beyond the card title (unknown operators) because dispatch H1 lists "a type-mismatched comparand"; measured, those were not data-dependent refusals but silent answers at base — reported as H1 half-falsified. where's temporal-comparand door was NOT added to the per-aggregation loop (not in H1, not in the amendment) — out_of_scope_findings[0].",
"A bare { $field } in a per-aggregation filter was refused on a populated table as an unsupported $field operator; it is now refused whatever the rows in the walk's bare-reference words (same code/status). No committed test pinned the old text.",
"One extra commit (796b06a) corrects changeset prose only (two #20122 cells, one #20127 sentence) after re-reading them against the code; card commits remain one per card plus the amendment's commit."
],
"files_changed": [
"packages/objectql/src/engine.ts (+74/-13 vs main: ObjectQL.aggregate only — the per-aggregation loop: shape gate, type door, assertAggregationFilterIsEvaluable, copy-on-write; the having entry: aggregatedRowColumnClasses passed to assertHavingIsEvaluable; imports)",
"packages/objectql/src/having-filter.ts (+299/-12: EvaluableScope, assertAggregationFilterIsEvaluable, unknownHavingColumnError, aggregatedRowColumnClasses + declaredFieldClass, offsetPairError + assertOffsetPairIsTemporal, header notes)",
"packages/objectql/src/engine-aggregate-filter.test.ts (+280/-1: #20122 walker / reference / type / shape tables and controls)",
"packages/objectql/src/engine-aggregate-having-comparand-shape.test.ts (+197: #20123 and #20127 tables and controls; two datetime fields added to the stand-in object)",
".changeset/20122-aggregation-filter-row-independent.md (new; objectql minor, fix(objectql)!, BREAKING, Clause-②: no (narrowing), adr-0087 not-required (already-registered …))",
".changeset/20123-having-unknown-column-refused.md (new; minor, BREAKING, no-migration-prescription)",
".changeset/20127-having-adddays-temporal-pair.md (new; minor, BREAKING, no-migration-prescription)"
],
"cards": {
"20122": {
"legend": "base = f09d412 (shape rows: merged tree before a17770a); cells = engine.aggregate on driver-memory and SqlDriver + POST /data/:object/query on both; empty = no rows; full = 6 rows in 3 groups; grouped answers shown, ungrouped in parentheses; every head refusal is INVALID_FILTER/400 with 0 driver calls on both populations",
"refused": [
{
"shape": "unknown op { amount: { $median: 1 } }, $nand, $regex, $regex+$options, $like, dangling $like escape, $ilike, non-$ key beside op, $median under $not, bare { $field }",
"base_empty": "200 [] ([{ n: 0 }])",
"base_full": "INVALID_FILTER/400 after 1 find",
"head": "INVALID_FILTER/400, 0 calls"
},
{
"shape": "empty / non-string $icontains",
"base_empty": "engine 200 [] ([{ n: 0 }]); REST VALIDATION_FAILED/400",
"base_full": "engine INVALID_FILTER/400; REST VALIDATION_FAILED/400",
"head": "engine INVALID_FILTER/400, 0 calls; REST unchanged"
},
{
"shape": "{ nope: { $median: 1 } } (column the row lacks)",
"base_empty": "200 []",
"base_full": "every group counted 0, no error",
"head": "INVALID_FILTER/400"
},
{
"shape": "$median behind a held $or branch",
"base_empty": "200 []",
"base_full": "every row counted (c1 2, c2 3, c3 1; n 6)",
"head": "INVALID_FILTER/400"
},
{
"shape": "{ $field } as $in member / $contains pattern",
"base_empty": "200 []",
"base_full": "counted 0",
"head": "INVALID_FILTER/400"
},
{
"shape": "{ $field } as $nin member / $exists operand",
"base_empty": "200 []",
"base_full": "every row counted",
"head": "INVALID_FILTER/400"
},
{
"shape": "addDays 1.5 / addDays '7'",
"base_empty": "200 []",
"base_full": "answered (c1 1, c2 2, c3 1 / c1 2, c2 2, c3 1)",
"head": "INVALID_FILTER/400"
},
{
"shape": "type door: { $eq: { v: 1 } }, implicit undefined, $eq Map, function under $gt, undefined $in member, bigint beyond 2^53, { $gt: { $field: 5 } }",
"base_empty": "200 []",
"base_full": "counted 0",
"head": "INVALID_FILTER/400 (type door words, rooted at aggregations[i].filter)"
},
{
"shape": "type door: Symbol under $ne / under $gt",
"base_empty": "200 []",
"base_full": "every row / raw TypeError, code+status undefined",
"head": "INVALID_FILTER/400"
},
{
"shape": "shape gate: string",
"base_empty": "memory 200 []; sql NOT_IMPLEMENTED/501; REST VALIDATION_FAILED/400",
"base_full": "memory every row (dropped); sql NOT_IMPLEMENTED/501; REST VALIDATION_FAILED/400",
"head": "engine INVALID_FILTER/400, 0 calls; REST unchanged"
},
{
"shape": "shape gate: number, true, false, 0, ''",
"base_empty": "200 []; REST VALIDATION_FAILED/400",
"base_full": "every row (dropped), both drivers; REST VALIDATION_FAILED/400",
"head": "engine INVALID_FILTER/400, 0 calls"
},
{
"shape": "shape gate: Map, Date, Set",
"base_empty": "200 []",
"base_full": "every row (dropped)",
"head": "INVALID_FILTER/400, 0 calls"
}
],
"answer_changed": [
{
"shape": "{ amount: { $in: [400n, 20n] } }",
"base_full": "counted 0",
"head": "c1 1, c2 0, c3 1 (narrowed, as where does)"
}
]
},
"20123": {
"refused": [
{
"shape": "{ totl: { $gt: 100 } }, { totl: 500 }, { amount: { $gt: 100 } } (source column), $and with a typo, { 'customer_id.name': 'x' }, { customer_id: 'c1' } under groupBy alias cust",
"base_empty": "200 []",
"base_full": "no group, no error",
"head": "INVALID_FILTER/400, 0 calls, both doors, engine + REST"
},
{
"shape": "{ totl: { $ne: 1 } }, { totl: { $exists: false } }, { $not: { totl: … } }, $or with a held branch then a typo",
"base_empty": "200 []",
"base_full": "EVERY group, no error",
"head": "INVALID_FILTER/400, 0 calls"
}
]
},
"20127": {
"refused": [
{
"shape": "total vs max_cap, addDays 1 (numeric pair)",
"base_empty": "200 []",
"base_full": "no group",
"head": "INVALID_FILTER/400 "addDays adds whole days to a date or datetime column, and "max_cap" is numeric — an offset has no meaning on it.""
},
{
"shape": "n vs n, addDays 0",
"base_empty": "200 []",
"base_full": "every group",
"head": "INVALID_FILTER/400 (same words)"
},
{
"shape": "date vs numeric / numeric vs date / text (groupBy) vs date",
"base_empty": "200 []",
"base_full": "no group",
"head": "INVALID_FILTER/400 (driver-sql cross-class sentence)"
},
{
"shape": "date vs datetime / datetime vs date",
"base_empty": "200 []",
"base_full": "c3 / c2, c3",
"head": "INVALID_FILTER/400 (cross-class)"
},
{
"shape": "date pair, offset column text / date",
"base_empty": "200 []",
"base_full": "no group",
"head": "INVALID_FILTER/400 "the addDays offset … is not a numeric column, and a day offset must be a number of days.""
}
]
}
},
"controls": "664 control cells over 43 shapes byte-identical at base and head (0 moved). #20122: implicit eq, $gt, $in, $nin, $between, $icontains non-empty, $startsWith, $ne null, $exists, $null, $or, $not, {}, scalar { $field }, addDays date/date literal and offset column, exact bigint implicit, Date bound (the Date bound answers 0 at both — see out_of_scope_findings[1]), unknown field key, undeclared { $field }, addDays numeric pair, temporal bad date / macro, scalar $in (face), [] and a condition array and a null-prototype object under the shape gate. #20123: groupBy column, alias, count alias, nested under $or/$and/$not, $not of a column, structured alias cust. #20127: date/date +7 and -3, offset from max (numeric) and from count, datetime/datetime, day bucket vs date, and { $field } pairs without addDays (numeric pair, date pair, numeric vs date). Unit pins hold the same controls on both stand-in doors.",
"aggregation_filter_shapes": {
"reach": "in-process only: every JSON-expressible shape (string, number, boolean, '', 0, [], a condition array) is refused at the REST door (VALIDATION_FAILED/400 via AggregationNodeSchema) at base and head; Map / Date / Set are not expressible over the wire. Direct engine.aggregate callers (and the analytics service, which lowers measure filters to objects) are the reach.",
"base": "string: driver-memory every row of every group (dropped), SqlDriver NOT_IMPLEMENTED/501; number, true, false, 0, '': every row (dropped) on both; Map, Date, Set: every row (dropped) on both; []: no filter (every row, correct); [['amount','>',100]]: counts no row (index keys as columns); null-prototype object: filters correctly",
"head": "string, number, true, false, 0, '', Map, Date, Set: INVALID_FILTER/400 before any driver call, message "aggregate('order'): 'aggregations[i].filter' must be a filter object or condition array, received … It was not applied, and an unapplied filter would have aggregated every row of each group for that aggregation."; [], condition array, null-prototype object: unchanged (open_questions[0] for the condition array)"
},
"cleanup": "worktree /home/user/objectstack-issue-20122: branch fully pushed (remote head 796b06a = local), git status clean, node_modules removed, git worktree remove exit 0 without --force; the scratch measurement harness was never committed and its copy lives in the scratchpad; no background process was started by this run"
}

[objectstack-fleet]

Seat amendment 2 to claim 5831492146 (the combined claim's chain head)

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-25T13:02Z.

• Ruling on the dev's open question (PR fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147): A. Refuse an array per-aggregation filter, INVALID_FILTER / 400, before any driver call, including [].

  • AggregationNodeSchema.filter is declared FilterConditionSchema, which admits no array form. So the engine enforces the declaration (spec > implementation), and does not widen it the way B would, with nothing asking for it.
  • REST already refuses every array there, [] included (VALIDATION_FAILED). One rule at both doors.
  • This follows the seat's objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099 Q1 A, which refused a FilterArray on having.
  • Today an array filter counts no row, a silent wrong answer (C). A census found no source that writes one.

• The out-of-scope findings of this round are one family (the per-aggregation filter and having still lack some of where's doors):

  • the temporal-comparand door;
  • Date against ISO text in checkCondition;
  • addDays on a numeric pair in a per-aggregation filter;
  • an undeclared { $field };
  • REST not key-checking inside a per-aggregation filter (200, every count 0, measured at the public door).

  They do NOT widen this PR, which is already three cards plus the shape gate. The seat files them as ONE class-closure card, with an enumeration pin, after this PR lands.

• Clause-②: no (narrowing) is unchanged.