@@ -17,7 +17,7 @@ Clause-②: yes (narrowing)
 - At a measure's own `filter` the form is refused with `400 INVALID_FILTER`, as the engine refuses it at an aggregation's own `filter`: put the condition in the query's `where`.
 - `POST /api/v1/analytics/sql` refuses a `where` carrying the form with `400 INVALID_FILTER`: no statement it could print reproduces a read of the related object as the caller. The query itself is answered by `POST /api/v1/analytics/query`.
 
-**Why.** Measured on the base over one fixture with the real security layer (a related field the caller may not read, a related row scope, 1,001 matching related records). The native-SQL strategy flattened the form to a dotted member and joined the related table: through a dataset that `include`d the relationship it answered rows for a condition on a field the caller cannot read, answered a match past the engine's cap, and counted a measure filter carrying the form; without the declared join it named a table that does not exist (500), and a multi-valued relation was refused. The engine-aggregate strategy refused the form as a cross-object filter (400). The engine serves the form since the nested-relation filter landed in `where`.
+**Why.** Measured on the base before the field-level gate (#20917) and the relationship-path admission (#20933) landed, over one fixture with the real security layer (a related field the caller may not read, a related row scope, 1,001 matching related records). The native-SQL strategy flattened the form to a dotted member and joined the related table: through a dataset that `include`d the relationship it answered rows for a condition on a field the caller cannot read, answered a match past the engine's cap, and counted a measure filter carrying the form; without the declared join it named a table that does not exist (500), and a multi-valued relation was refused. The engine-aggregate strategy refused the form as a cross-object filter (400). The engine serves the form since the nested-relation filter landed in `where`.
 
 **How.** The native-SQL strategy declines a query in which the form appears in the `where`, the dataset's own `filter` or a requested measure's `filter`, so the query runs on the engine-aggregate path, which hands the form to the engine as written.
 
 
@@ -0,0 +1,22 @@
+---
+'@objectstack/driver-memory': minor
+'@objectstack/driver-mongodb': minor
+---
+
+fix(driver-memory, driver-mongodb)!: a non-boolean `$exists` comparand is refused with `INVALID_FILTER` / 400, as `$null`'s is, instead of selecting the rows with no value (#20897)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (already-registered filter-query-face-comparands-refused-at-save) this narrows the query faces to the rule that registered entry already records: its reason states that every query face refuses a non-boolean $null / $exists flag, and its replacement is this change's whole migration (a flag is the boolean itself; $exists true is "has a value", false "has no value"). This change makes that statement true on the two drivers that did not yet refuse. No authorable key, spelling, export or published type moves, and no stored row is read or rewritten; a stored filter carrying such a flag is already refused when it is saved, by that entry. -->
+
+**BREAKING**: this narrows what the in-memory driver and the MongoDB driver accept in a filter. A `$exists` comparand that is not a boolean (a string, a number, `null`, `undefined`, an object) is now refused with `INVALID_FILTER` / 400, where these two drivers used to answer it. It ships as `minor` under the launch-window convention for accept-set narrowings. No export or published type changes.
+
+`FieldOperatorsSchema` declares `$exists` as a boolean, and `driver-sql`, `driver-sqlite-wasm` and both Turso transports already refused any other comparand. The in-memory driver and the MongoDB driver did not: they read `$exists` as `value === true`, so every other value asked for the rows with NO value. `{ stage: { $exists: "yes" } }` and `{ stage: { $exists: 1 } }` returned the rows without a stage, the opposite of what was written. `0`, `null` and the string `"false"` landed on that same side by the same default, not because anything read them. The in-memory driver's analytics face read the same flag by truthiness and answered the valued rows for the same filter, so that driver gave two different answers.
+
+**What an author sees now.** `400 INVALID_FILTER` with `driver-sql`'s message, beginning `Operator "$exists" on field "FIELD" requires a boolean comparand (true or false).` and naming the position (`filter.stage.$exists`). On the in-memory driver the refusal covers `find`, `findOne`, `count`, `aggregate`, `updateMany`, `deleteMany` and the analytics face (`query()` and `generateSql()`). There, an `undefined` or object comparand is refused first by that face's comparand-type check, also `INVALID_FILTER` / 400, in its own words. A refused write changes nothing.
+
+**What to write instead.** Write the boolean itself. `"$exists": true` matches rows whose field has a value, and `"$exists": false` matches rows whose field has none.
+
+**Who is affected.** A caller that sent a non-boolean `$exists` to `InMemoryDriver` or `MongoDBDriver` (a test suite, a local or embedded deployment, a flow or hook calling the engine in-process) and read the answer as a real one. On `SqlDriver` the same filter was already a 400.
+
+**Unchanged.** `$exists: true` and `$exists: false` answer exactly as before. The aggregation `filter` and `having` positions, which the engine evaluates itself after the driver, are not changed by this entry.
@@ -8,7 +8,7 @@ Clause-②: yes (narrowing)
 
 <!-- adr-0087: not-required (no-migration-prescription) No authorable key, export or stored shape is removed or renamed. The change refuses analytics queries that read a field the caller's field-level permissions hide, which the engine already refuses on the data API and on the ObjectQL strategy, so there is nothing for `objectstack migrate meta` to rewrite. The one public-surface addition is a new optional service hook. -->
 
-**BREAKING for analytics queries on a SQL deployment that read a field the caller may not read.**
+**BREAKING for analytics queries that read a field the caller may not read: on a SQL deployment, and on `POST /api/v1/analytics/sql` whichever strategy serves the cube.**
 
 **What changed.** `POST /api/v1/analytics/query`, `POST /api/v1/analytics/sql`
 and `POST /api/v1/analytics/dataset/query` now judge every field a query reads
@@ -19,7 +19,9 @@ filters. A member of an authored cube is judged by the field it resolves to,
 not by its name in the cube. A field the caller may not read answers
 `403 PERMISSION_DENIED`, in the words the engine uses for the same field. The
 native-SQL strategy, the one a SQL driver serves first, answered such queries;
-the ObjectQL strategy and the data API already refused them.
+the ObjectQL strategy already refused them on `POST /api/v1/analytics/query`
+and `POST /api/v1/analytics/dataset/query`, as the data API did, but printed
+the statement on `POST /api/v1/analytics/sql`.
 
 **What is not affected.** A query that reads only fields the caller may read
 answers as before. A system context, and a caller with no permission sets, are
 
@@ -8,7 +8,7 @@ Clause-②: no (narrowing)
 
 <!-- adr-0087: not-required (no-migration-prescription) No authorable key, export or stored shape is removed or renamed. The change refuses, or row-scopes, what the native-SQL strategy read from an object reached through an undeclared relationship path, the way a declared join to the same object already was; there is nothing for `objectstack migrate meta` to rewrite. -->
 
-**BREAKING for analytics queries on a SQL deployment that read a related object through a relationship path the cube does not declare.**
+**BREAKING for analytics queries that read a related object through a relationship path the cube does not declare: on a SQL deployment, and on `POST /api/v1/analytics/sql` whichever strategy serves the cube.**
 
 **What changed.** The analytics door admits and row-scopes one object set
 before either strategy runs. It held the cube's base object and the joins the
@@ -40,7 +40,9 @@ deployment with no security service applies no object-level check, as on the
 data API.
 
 **Refusals that change form.** On the ObjectQL strategy a related object the
-caller may not read was already refused; it now answers the analytics door's
+caller may not read was already refused on `POST /api/v1/analytics/query` and
+`POST /api/v1/analytics/dataset/query`, though `POST /api/v1/analytics/sql`
+printed the statement; on those two doors it now answers the analytics door's
 refusal rather than the engine's, the same one a declared join gets. A filter,
 a time window or a two-hop path through such an object moves from
 `400 INVALID_FIELD` to that `403`. A relationship path whose relationship name
 
@@ -740,7 +740,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   # ══════════════════════════════════════════════════════════════════════════
-  # PUSH LANE 2 — release integrity audit. Reads github.sha ONLY. Never mints.
+  # PUSH LANE 2 — release integrity audit. Never mints. Reads github.sha and the
+  # version commit it selects, both out of the object database; every backfill
+  # builds from that version commit's tree, as the publish job does.
   # ══════════════════════════════════════════════════════════════════════════
   release-integrity:
     name: Release integrity (audit + no-mint backfill)
@@ -999,6 +1001,9 @@ jobs:
           # has its repair — the `force` dispatch (D4) — not a push.
           vc_tree="${RUNNER_TEMP}/release-version-commit"
           git worktree add --quiet --detach "$vc_tree" "$version_commit"
+          # The backfill steps below build from this tree, not from this
+          # checkout (github.sha), so it is handed to them by name.
+          echo "version-tree=${vc_tree}" >> "$GITHUB_OUTPUT"
           if ! group=$(RELEASE_VERSION="$version" node scripts/release-verify-npm.mjs --probe --root "$vc_tree"); then
             echo "::error::could not read whether the whole fixed group of ${version} is on npm (reason above). Refusing to request a backfill nobody measured."
             exit 1
@@ -1049,13 +1054,44 @@ jobs:
 
       # Everything below is skipped on the overwhelmingly common path (nothing to
       # repair), which is why the install is here rather than at the top of the job.
+      #
+      # ── Every backfill builds from the VERSION COMMIT's tree ─────────────
+      # The publish job checks out the version commit and runs that commit's
+      # own scripts over that commit's own tree (ADR-0125 D1 as amended
+      # 2026-09-29). A repair describes the same release, so the steps below
+      # run in the worktree the audit made of the version commit (its
+      # `version-tree` output), with that commit's lockfile and tooling, and
+      # never in this checkout. This checkout is `github.sha`, the head of
+      # whichever push is being audited. A landing after the version commit
+      # that touched packages/spec/src would otherwise make the D4 asset
+      # describe a tree npm did not ship, and a Release created here would
+      # point its CHANGELOG link, and any tag it has to create, at that landing.
+      #
+      # The checkout itself is NOT swapped: the audit above reads `github.sha`
+      # and its tripwire reads this workspace, and both stay as they are. Each
+      # step re-asserts that its tree is the version commit and refuses
+      # otherwise, because an empty `version-tree` would leave the step in
+      # this checkout, which is the defect, with nothing said.
+      #
+      # Pinned by battery 13 of `node scripts/release-verify-npm.mjs
+      # --self-test` (lint.yml runs it): these steps' own text runs after the
+      # audit's, and a landing that moved packages/spec/src is the fixture.
       - name: Setup pnpm
         if: steps.audit.outputs.releases-missing == 'true'
         uses: ./.github/actions/setup-pnpm
 
-      - name: Install dependencies
+      - name: Install dependencies (the version commit's tree)
         if: steps.audit.outputs.releases-missing == 'true'
-        run: pnpm install --frozen-lockfile
+        env:
+          VERSION_COMMIT: ${{ steps.audit.outputs.version-commit }}
+          VERSION_TREE: ${{ steps.audit.outputs.version-tree }}
+        run: |
+          if [ -z "$VERSION_TREE" ] || [ "$(git -C "$VERSION_TREE" rev-parse HEAD 2>/dev/null)" != "$VERSION_COMMIT" ]; then
+            echo "::error::the version commit's tree ('${VERSION_TREE}') is not at the version commit '${VERSION_COMMIT}'. Refusing to backfill from any other tree."
+            exit 1
+          fi
+          cd "$VERSION_TREE"
+          pnpm install --frozen-lockfile
 
       - name: Backfill GitHub Releases (bodies truncated to the API limit)
         if: steps.audit.outputs.releases-missing == 'true'
@@ -1066,22 +1102,46 @@ jobs:
           # Changesets `fixed` group releases every public package at one
           # version, which check-changeset-fixed.mjs gates.
           RELEASE_VERSION: ${{ steps.audit.outputs.version }}
-        run: node scripts/release-github-releases.mjs
+          VERSION_COMMIT: ${{ steps.audit.outputs.version-commit }}
+          VERSION_TREE: ${{ steps.audit.outputs.version-tree }}
+        # The script reads every package and CHANGELOG.md from the tree it
+        # lives in, and takes `GITHUB_SHA` as each Release's `target_commitish`
+        # and as the ref of its CHANGELOG permalink. Both must be the version
+        # commit. GitHub ignores `target_commitish` when the tag already exists,
+        # but a publish that died before its tag push leaves no tag, and the
+        # Release then CREATES it at `target_commitish`. So the version
+        # commit's own script runs in its own tree, with GITHUB_SHA set for that
+        # one process only.
+        run: |
+          if [ -z "$VERSION_TREE" ] || [ "$(git -C "$VERSION_TREE" rev-parse HEAD 2>/dev/null)" != "$VERSION_COMMIT" ]; then
+            echo "::error::the version commit's tree ('${VERSION_TREE}') is not at the version commit '${VERSION_COMMIT}'. Refusing to backfill from any other tree."
+            exit 1
+          fi
+          cd "$VERSION_TREE"
+          GITHUB_SHA="$VERSION_COMMIT" node scripts/release-github-releases.mjs
 
       - name: Backfill spec-changes.json on the GitHub Release (ADR-0087 D4)
         # Ordering is load-bearing: `gh release upload` needs the Release the
         # step above creates.
         #
         # `--prepare` regenerates the manifest against the previously published
-        # tarball exactly as the publish lane does, so the asset this repair
-        # uploads carries the same per-release section the npm artifact does.
-        # It cannot repair the npm artifact itself — that tarball is immutable —
-        # and this lane never publishes one.
+        # tarball exactly as the publish job does: in the version commit's
+        # tree, with that commit's generator. So the asset this repair uploads
+        # carries the same per-release section the npm artifact does. It cannot
+        # repair the npm artifact itself — that tarball is immutable — and this
+        # lane never publishes one.
         if: steps.audit.outputs.releases-missing == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_VERSION: ${{ steps.audit.outputs.version }}
+          VERSION_COMMIT: ${{ steps.audit.outputs.version-commit }}
+          VERSION_TREE: ${{ steps.audit.outputs.version-tree }}
         run: |
+          if [ -z "$VERSION_TREE" ] || [ "$(git -C "$VERSION_TREE" rev-parse HEAD 2>/dev/null)" != "$VERSION_COMMIT" ]; then
+            echo "::error::the version commit's tree ('${VERSION_TREE}') is not at the version commit '${VERSION_COMMIT}'. Refusing to backfill from any other tree."
+            exit 1
+          fi
+          cd "$VERSION_TREE"
           bash scripts/release-spec-changes.sh --prepare
           bash scripts/release-spec-changes.sh --attach
 
 
@@ -627,17 +627,36 @@ The docs step reports what it collected, not what it attempted — a project who
 successful collection prints.
 
 Under an **ADR-0130 multi-package layout**, docs that moved into a package are
-collected too: a `src/<pkg>/docs/` directory whose `<pkg>` names one of the
+collected too: a `<pkg>/docs/` directory whose `<pkg>` names one of the
 artifact's declared `packages[]` entries is read into **that package's own
 body**, and the step line says so:
 `12 collected (4 from 2 package directories)`.
+The `<pkg>` directory is found from the packages the artifact registers, at
+**any depth** under `src/`: `src/<pkg>/docs/` and `src/packages/<pkg>/docs/`
+are one case, not two. The search descends through every directory whose name
+names none of the declared packages (never into `node_modules`) and **stops**
+at the first directory that names any of them. That directory is a package
+root and everything under it is that package's own source, so only its own
+`docs/` is read — a deeper `src/<pkg>/components/docs/` is neither read nor
+reported. A stack that declares no `packages[]` has nothing to search for: its
+docs are read from `src/docs/` alone, and a `src/<dir>/docs/` one level down
+is reported, not read.
 `<pkg>` is matched against two spellings of the package: its
 `id`, and the last dot-separated segment of that `id`. The display `name` is
 ⛔ not a directory key — it is free to be re-worded, and a docs binding a
-re-wording can break is worse than one that never existed. A directory
-that matches **none** of the declared packages, or **more than one**, is still
-not read — that case keeps the warning that names the files it skipped and the
-spellings it tried, so it is never a silent `0 collected`.
+re-wording can break is worse than one that never existed.
+Docs the search finds but cannot attribute unambiguously are still not read:
+each such `docs/` directory is reported in a warning that names the files it
+skipped, so it is never a silent `0 collected`. Three cases lead there:
+
+- a directory the search passes through, `src/packages/` itself included,
+  whose name matches **none** of the declared packages — the warning lists the
+  declared packages;
+- a directory whose name matches **more than one** declared package — the
+  warning names those packages;
+- one package that answers to **more than one** directory with Markdown in its
+  `docs/`, such as `src/core/docs/` beside `src/packages/core/docs/` — ⛔
+  neither is read and nothing is merged, and each warning names the others.
 
 The resulting `dist/objectstack.json` is a **portable, self-describing deployment unit** —
 you can hand it to `os start` (locally or on a server), publish it to a CDN, or fetch it