fix(objectql,metadata-protocol)!: the per-aggregation filter takes where's remaining doors — a bad date, an addDays numeric pair, an undeclared { $field } and an unknown key are refused; a Date bound compares as an instant

[objectstack-fleet]

Fixes #20148
Clause-②: no (narrowing)

A per-aggregation filter (aggregations[i].filter) now meets the doors where meets. A bad date, an addDays numeric pair, an undeclared { $field } and an unknown key each answered 200 with the filtered count 0 (every row under a negation). Now each is refused 400, identically on an empty and on a populated table, before any driver call. A Date bound is compared as an instant, as the same bound in a where is.

Head 4da90165cd: a prose-only patch round (contract review 5853139988, seat amendment 5853144038 on #20148) over the reviewed head f22f0e875f. Every code and test blob is unchanged: engine.ts 4e1ebbf2a4, having-filter.ts ab6ba1df00, protocol.ts a9a77c8f6d, and the three test files. Base 49144fccc8. The branch merged main at 369bcbeda7; the merge touched none of these files. Written by session session_01Bvd69VPa6puiNzzPUroDBx, branch claude/issue-20148-aggregation-filter-doors.

commit	change
3129311d33	engine loop: temporal door and declared-reference rules; having-filter.ts: reference walk, Date instant comparison; protocol.ts: filter keys through where's gate
d831680d7c	pins in objectql, metadata-protocol and rest; two changesets
f22f0e875f	merge of main at 369bcbeda7
4da90165cd	changeset prose only: the 20148-* wording (see Patch round), and a DELIBERATE CORRECTION of one clause in each of two pending changesets (see that section)

1. Measured first (H1)

A scratch harness (not committed) ran every shape through ObjectQL.aggregate and through POST /api/v1/data/:object/query (RestServer, then findData, then ObjectQL.aggregate). It used a real InMemoryDriver and a real SqlDriver (better-sqlite3 :memory:), both schema-synced, on a populated table (6 rows, groups c1 / c2 / c3) and an empty one, with driver reads counted. The REST body is JSON round-tripped, as the wire carries it. Every per-aggregation shape ran grouped and ungrouped. Beside each ran the same condition as the call's where (the twin), on the aggregate verb and on find. 2896 cells per tree.

Legend: m is the filtered count, over n rows. "Base" and "head" are the per-aggregation filter's answer; the twin is identical at base and head.

#	aggregations[i].filter	base, memory and sql, engine and REST	head	the where twin
1	{ placed_on: { $gt: 'not-a-date' } } (date)	empty m0, populated m0 of 6	INVALID_FILTER / 400, 0 reads, all 8 cells	INVALID_FILTER / 400, 0 reads, all 8 cells
1+	the same as an $in member / a $between endpoint / implicit / behind a held $or / under $not; 'noon' on a time	populated m1 / m6 / m0 / m6 / m6 / m0	INVALID_FILTER / 400, 0 reads, all 8 cells	INVALID_FILTER / 400
1+	'last_30_days' on a datetime	engine m0; REST VALIDATION_FAILED (ingress)	engine INVALID_FILTER; REST unchanged	the same split
2	{ amount: { $gt: { $field: 'cap', addDays: 1 } } }	populated m0	INVALID_FILTER / 400, 0 reads, all 8 cells	sql INVALID_FILTER / 400; memory n0
2+	addDays date-to-numeric, date-to-datetime, text-to-date, time pair, text or date offset column, a numeric pair behind a held $or	m0 (date/datetime m4, held $or m6)	INVALID_FILTER / 400, 0 reads	sql INVALID_FILTER; memory a count
3	{ amount: { $gt: { $field: 'nope' } } }	populated m0	INVALID_FILTER / 400, 0 reads, all 8 cells	sql INVALID_FILTER / 400; memory n0
3+	under $ne / $not / a held $or; a dotted referent; an undeclared addDays offset column	m6 / m6 / m6 / m0 / m3	INVALID_FILTER / 400, 0 reads	sql INVALID_FILTER; memory a count
4	{ nope: 1 } over REST	200, m0	REST INVALID_FIELD / 400, 0 reads; the engine door is unchanged (a count)	REST INVALID_FIELD / 400; engine: sql INVALID_FILTER, memory n0
4+	under $and / $ne / $not / a held $or	m0 / m6 / m6 / m6	REST INVALID_FIELD / 400	REST INVALID_FIELD / 400
4+	{ nope: { $median: 1 } }	INVALID_FILTER everywhere	REST INVALID_FIELD (the field gate runs first, as for where); engine INVALID_FILTER	the same split
5	{ opened_at: { $gt: new Date('2026-02-01') } }, in-process	m0	m4	n4 on both drivers

Found beyond the card: the $between and held-$or rows counted every row, not zero. The card's row 5 reads "4 rows on both drivers" for the twin, and the #20122 dev report reads memory 0. Both are right about their harness: driver-memory coerces a Date comparand by the column's storage rule only after syncSchema has indexed the object's temporal fields. Schema-synced, as a booted runtime is, the twin answers 4 on both drivers.

2. What changed

• packages/objectql/src/engine.ts, the per-aggregation loop of ObjectQL.aggregate.
  • (a) It runs assertTemporalComparandsInterpretable, the function where runs fourth on its seam, fourth here too: after the text-operator door, before the type door.
  • (b) It hands assertAggregationFilterIsEvaluable the object's declared field map, and a sink that logs the withheld diagnostic at warn.
• packages/objectql/src/having-filter.ts.
  • assertAggregationFilterIsEvaluable(filter, index, declared?): after the walker's own refusals, assertAggregationFilterReferencesAreDeclared walks each scalar-comparison { $field }. The referent, and an addDays offset's nested $field, must name a declared field (the field map plus id, created_at, updated_at: the set the REST field gate reads). An addDays pair must pass the class rule.
  • The class rule is objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127's, factored out of assertOffsetPairIsTemporal into offsetPairViolation, so having and this position judge one rule. having's words are byte-identical.
  • The words withhold the fields, the operator and the reason, as driver-sql withholds them for the same comparison in where. They name the aggregation (aggregations[1].filter) and the rule, and say the diagnostic is in the server log. The message is sized under the REST envelope's 500-character bound.
  • checkCondition: when a Date sits on either side of an equality, ordering, $between or list arm, and both sides denote an instant (utcInstantMs, @objectstack/spec/data), it compares instants. That is the lift @objectstack/formula's evaluator applies. Every other pair compares exactly as before.
• packages/metadata-protocol/src/protocol.ts, findData's assertAggregationFieldsExist only. After its entry and field checks, each entry's filter goes through assertFilterFieldsExist, the gate the explicit where meets. It uses the same field set and the same unknown, dotted and virtual ladder, answers INVALID_FIELD / 400, and passes aggregations[i].filter as the parameter.

3. The hypotheses

• H1, held. The measured rows are in §1.
• H2, half-falsified, and no copy was needed.
  • Row 1 calls the same function where calls.
  • Row 4 calls where's own gate from inside assertAggregationFieldsExist.
  • Rows 2 and 3 have no engine function on where's side. where's refusal is driver-sql's cross-field compiler (applyCrossFieldComparison). objectql cannot import it, and the claim excludes driver-sql. On driver-memory the twin is not refused at all: a count. The per-aggregation filter never reaches a driver, because it forces the in-memory fallback. So these rules reuse the having walker's own rule functions (objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099 / objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127) against the object's declared fields, not the aggregated row's. Nothing is copied, and nothing new needed exporting.
• H3, held.
  • Base to head over 2896 cells: 2392 identical, 504 moved. Every moved cell is a per-aggregation cell of rows 1 to 5 or of the added rows, or a having cell with an in-process Date bound.
  • Every where twin (aggregate and find), every groupBy probe, every per-aggregation control, and every having cell without a Date is byte-identical, including objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123's key refusals and objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127's pair refusals.
  • The 36 having cells that moved are the engine-door Date cells (9 shapes, both having doors, both drivers, populated table). Each now keeps the groups the same bound's ISO spelling keeps (the REST cell), except the two UTC-midnight-Date shapes on max(date), a date-class column. $gte keeps c2, c3 where the ISO-instant spelling keeps c2, and $eq keeps c3 where the ISO-instant spelling keeps none. Both follow the calendar-day reading a where gives, and the ISO-instant text, compared as text, does not. See the out-of-scope note in Acceptance notes.
  • The reverse state (the three source files at the base blobs) reproduced the base table exactly: 2704 of 2704.
• H4, held. Two changesets, each minor, BREAKING, Clause-②: no (narrowing), disposition not-required (no-migration-prescription) (the objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123 / objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127 precedent). One is @objectstack/objectql, one is @objectstack/metadata-protocol. At head 4da90165cd, check-adr-0087-registration --base 49144fccc8 reports 4 declared-breaking changesets, each with a disposition: this PR's two 20148-*, and main's 19856-* (registered) and 20055-* (not-required), which arrived with the merge. Against origin/main it reports this PR's two. check-changeset-no-major reports no major, and its level axis reads this body's Clause-②: no (narrowing).
• H5, decided.
  • where gives 4 of 6 for the row-5 bound on both drivers (schema-synced). Each driver reads a Date by the column's storage rule: canonical UTC ISO for datetime, the UTC calendar day for date, the UTC time of day for time.
  • checkCondition holds a flat row and no declaration, so it reads the pair the way the spec defines for a type-blind evaluator (utcInstantMs). Every datetime shape ($gt, $gte, $lt, $lte, $eq, $ne, implicit, $in, $nin, $between) and a UTC-midnight Date on a date field now count what the twin counts.
  • having's answers move, toward the twin (H3).
  • Two in-process readings still differ from the twin: a Date carrying a time of day against a date field ($gte 1 vs 3, $lt 5 vs 3, $eq 0 vs 2), and a Date against a time field (0 vs 3). Matching them needs the column's class in the per-row walker. See the open question in the report.

4. Tests

All at code head f22f0e875f unless stated.

• pnpm --filter @objectstack/objectql exec vitest run (whole suite, before the merge, at d831680d7c): Test Files 317 passed (317) · Tests 5633 passed (5633).
• pnpm --filter @objectstack/metadata-protocol exec vitest run (whole suite, at d831680d7c): Test Files 189 passed | 3 skipped (192) · Tests 2699 passed | 19 skipped (2718).
• typecheck for @objectstack/objectql, @objectstack/metadata-protocol and @objectstack/rest: each exit 0. --listFiles shows each new test file in its package's program. check:test-typecheck for objectql: 40 file(s) / 234 error(s) / 65 pinned, unchanged.
• REST aggregate tests (aggregation-filter-where-doors, list-view-grouping-query-door, request-schema-gate.conformance, rest-server-canonical-query-ast): 96 passed | 1 skipped.
• driver-sql aggregate suites (10 files): 125 passed | 10 skipped (live PG / MySQL not run). driver-memory aggregate suites (3 files): 75 passed.
• @objectstack/service-analytics, the consumer that lowers measure filters here (whole suite): 128 files, 3017 passed.
• After the merge: the objectql aggregate / having files, the two protocol files and the four REST files were green again.
• Reverse verification. The fix was committed first. The three source files were restored to their base blobs (bc4f337220, 876293a1e9, ba5fbccde6) under an EXIT / INT / TERM trap. On-disk hashes and marker counts (0 / 0 / 0) were checked. objectql and metadata-protocol were force-rebuilt, and ablation-dist-preflight --absent passed for both.
  • The new pins then read: engine-aggregate-filter.test.ts 34 failed of 107, protocol.aggregation-filter-fields.test.ts 7 of 13, aggregation-filter-where-doors.test.ts 10 of 15.
  • Those are exactly the new refusal and Date rows. The controls, the walker-first row and the "not refused by the engine" control stayed green.
  • Restored with git checkout HEAD --. Proven by HEAD-blob equality for all three and an empty whole-tree git status. dist/ was rebuilt from HEAD and the preflight found the markers present.

5. Gates

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at f22f0e875f: 65 commands, 65 run.
• --ran with the exit codes: 65 derived famil(ies) accounted for — 65 run, 0 NOT-MEASURED.
• check:dual-build-cjs-loads and check:type-check-debt first answered PREREQUISITE NOT MET (3). After turbo run build --filter='./packages/*' --filter='./packages/*/*', both exit 0.
• node scripts/check-issue-citations.mjs --base 369bcbeda7: 20 citations, all resolve.
• pnpm check:nul-bytes: exit 0. A control-byte self-scan of the 8 changed files found none.
• Lint, a declared narrowing:
  • eslint --no-inline-config --format json on the 6 changed .ts files: 6 files, 0 errors, 0 warnings, 0 fatal.
  • --print-config returns a config for each.
  • eslint.config.mjs enables no type-aware linting (no parserOptions.project), so this diff cannot move a verdict on an untouched file.

Patch round (contract review 5853139988)

Prose only; every code and test blob is identical to f22f0e875f (git diff --name-only f22f0e875f 4da90165cd lists three .changeset/ files and nothing else).

• .changeset/20148-aggregation-filter-where-doors.md (git diff --numstat: 2 2):
  • The having Date sentence is qualified. It now reads that a Date bound keeps the groups its ISO spelling keeps on a datetime column. On a date-class column (min / max of a date field), a UTC-midnight Date follows the calendar-day reading a where gives ({ $gte: new Date('2026-02-01') } keeps the group whose max is 2026-02-01, and so does $eq), which the ISO-instant text, compared as text, did not.
  • "refused in the words driver-sql uses" now reads "refused in the withholding posture driver-sql applies". The sentence on the wire is new; only the posture is borrowed.
• Gates at 4da90165cd:
  • check-empty-changeset --base origin/main: exit 1. It names exactly .changeset/20099-having-where-doors.md and .changeset/20127-having-adddays-temporal-pair.md, each "present on the merge base and CHANGED by this PR". This is by design; see the next section.
  • check-adr-0087-registration: "4 declared-breaking changeset(s), each carrying an ADR-0087 disposition" with --base 49144fccc8, and 2 with --base origin/main. Exit 0.
  • check-changeset-no-major --base 49144fccc8 --event (this body, as a pull_request payload): exit 0.
  • check-issue-citations --base 369bcbeda7: 20 citations, all resolve. Exit 0.

DELIBERATE CORRECTION

Two PENDING changesets carried one clause each that is false at this head. Each file's git diff --numstat is 1 1, and every other line is byte-identical. check-empty-changeset refuses both by name, which is the gate's own path for this class: the correction is said here, for confirmation.

• .changeset/20127-having-adddays-temporal-pair.md, its last sentence. This PR made it false: the per-aggregation filter is now judged by the class rule, through offsetPairViolation, against the object's declared fields.
  • Before: "A per-aggregation filter (aggregations[i].filter) is not judged by this rule: it reads the object's raw columns, and this change classifies only the aggregated row's."
  • After: "A per-aggregation filter (aggregations[i].filter) is not judged by this change: it reads the object's raw columns, and this change classifies only the aggregated row's. Since objectql + REST: the per-aggregation filter still lacks four of where's doors — a bad date, an addDays numeric pair, an undeclared { $field } and an unknown key answer 200 with every count 0 #20148 it is judged by the same class rule, against the object's declared fields."
• .changeset/20099-having-where-doors.md, one clause of its "Not changed" paragraph. This has been false since PR fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147: objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123 refuses a having key that names no column of the aggregated row.
  • Before: "A having key that names no column still keeps no group rather than being refused."
  • After: "A having key that names no column is not judged by this change; since objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123 it is refused (INVALID_FILTER / 400) rather than keeping no group."

Acceptance notes

• The card's two observations.
  • The formula min / max addDays pair is still unclassified in having (objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127's rule answers undefined for a formula), and a formula referent here is judged by name only.
  • The REST envelope's 500-character truncation (truncateClientMessage) still applies to objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123's column list. It bit this PR's first draft of the withheld message, which is now 440 characters at a two-digit index. Neither is changed.
• Position label. The temporal door is where's function, run unchanged, so its message reads at where.placed_on.$gt for a per-aggregation filter. The [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661 text-operator door already reads where.… at this position. The pins assert the field and the value, not the path. A path parameter on assertTemporalComparandsInterpretable would fix both; temporal-comparand-door.ts is outside the claim.
• Withholding at this position. Rows 2 and 3 withhold their names, per the ruling. The objectql: a per-aggregation filter refuses an unknown operator only when rows exist — aggregations: [{ filter: { amount: { $median: 1 } } }] answers 400 on a populated table and 200 on an empty one #20122 reference refusals at the same position (bare reference, list-member reference, malformed addDays) name the fields. Nothing reaches a per-aggregation filter from a read-scope merge: RLS and sharing compose into ast.where only, and analytics merges its scope into where. See the report's open question.
• Two named deltas from driver-sql's where rules, both deliberate.
  • id is accepted as a referent. driver-sql refuses it (not in its declared map), but every fallback row carries it, and the base counted it correctly.
  • The tenant-isolation column is not forbidden as a referent. That rule is driver-sql's guard for policy compilation, and no policy reaches this position.
• Held, not endorsed. A cross-class { $field } pair without addDays ({ amount: { $gt: { $field: 'placed_on' } } }) still counts by coercion, as objectql: a per-aggregation filter refuses an unknown operator only when rows exist — aggregations: [{ filter: { amount: { $median: 1 } } }] answers 400 on a populated table and 200 on an empty one #20122's notes record for having. FieldReferenceSchema declares a class rule for addDays only.
• Out of scope, reported to the seat. An interpretable temporal STRING in a per-aggregation filter is compared as text, not read by the column's storage rule as where reads it. This is reachable over REST today and unchanged by this PR (base = head, 192 cells).
  • { placed_on: { $gte: '2026-02-01T00:00:00.000Z' } } counts 1 where the twin counts 3.
  • { opened_at: { $lte: '2026-02-01' } } counts 2 where the twin counts 3, because where reads a bare day as the whole day.
  • An epoch-ms bound on a datetime counts 0 where the twin counts 3.

Deviations

• The claim names assertAggregationFilterIsEvaluable and checkCondition in having-filter.ts. This PR also adds module-level helpers there: the reference walk, the withheld error, the instant helpers, and the AggregationFilterDeclaration interface. That interface is exported at module level but package-private, because having-filter.ts is not re-exported by packages/objectql/src/index.ts. The PR also refactors assertOffsetPairIsTemporal into offsetPairViolation plus a wrapper so both positions share one rule, adds one import, and adds a paragraph to the header comment. having's cells are byte-identical (H3).

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/objectql, touching 18 documentable anchor(s).

17 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 3bd28e2b2ea81206dc9f5507de205b564bd97097.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: created_at (literal, 34 pages)
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 207 client-bound route-ledger rows — the other 153 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 153: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 98 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 3bd28e2b2ea81206dc9f5507de205b564bd97097 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 084b27869487861f3f0eafb801a7292c6bd6fca0 — the merge of head 4da90165cd7deebc159117dfb9c2b5b26e26a9a3 into base 3bd28e2b2ea81206dc9f5507de205b564bd97097, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 084b27869487861f3f0eafb801a7292c6bd6fca0 && git checkout 084b27869487861f3f0eafb801a7292c6bd6fca0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 3bd28e2b2ea81206dc9f5507de205b564bd97097 4da90165cd7deebc159117dfb9c2b5b26e26a9a3 && git checkout -B drift-repro 3bd28e2b2ea81206dc9f5507de205b564bd97097 && git merge --no-ff 4da90165cd7deebc159117dfb9c2b5b26e26a9a3

node scripts/docs-audit/affected-docs.mjs --json 3bd28e2b2ea81206dc9f5507de205b564bd97097

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 3bd28e2b2ea81206dc9f5507de205b564bd97097 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f22f0e875f54c812b39af25c31ebfda8fd5a44b9

Scope: PR #20174 (card #20148, priority:p2, class-closure, 5 pin rows). 8 files, +972/−29, all in the PR's own two commits (3129311d33, d831680d7c); the merge f22f0e875f brings main at 369bcbeda7 and no main commit in 49144fccc8..e2c4e125f9 touches any of the 8 paths (blobs engine.ts bc4f337220→4e1ebbf2a4, having-filter.ts 876293a1e9→ab6ba1df00, protocol.ts ba5fbccde6→a9a77c8f6d; main's copies of all three are still the base blobs). Measured, not inferred: detached worktrees of head and base (49144fccc8) with the rest / driver-sql / driver-memory closures built (dist markers verified head 1/2/4, base 0/0/0), my own harness on a real InMemoryDriver and a real SqlDriver (better-sqlite3 :memory:), schema-synced, populated (6 rows, c1/c2/c3) and empty, through engine.aggregate / engine.find and POST /api/v1/data/:object/query (JSON round-tripped), driver reads counted, engine warn captured: 3136 cells per tree; 2624 identical base→head, 512 moved — 460 per-aggregation cells, 52 having cells, 0 where twins, 0 groupBy. Inputs: card + comments 5834285763 / 5852472098 / 5852943342 / 5852957006, #20122 / #20123 / #20127 / PR #20147, #20099 / PR #20117, #7534, #7929 / #8220, PR body, diff, check-runs. Dev's scratch not read.

① Derived judgments

• Rows 1–4 refused at head, bar met. Every refusal fires with aggregate 0 / find 0 / count 0 driver reads, the same code/status/message on the empty and the populated table, grouped and ungrouped, both drivers, engine and REST (0 bar violations over all refused cells). Row 1 family (8 shapes incl. $in member, $between endpoint, implicit, held $or, $not, 'noon' on time): base counted 0 / 1 / 6 / 0 / 6 / 6 / 0, head INVALID_FILTER/400 all 16 cells; twin INVALID_FILTER/400·0 reads on both drivers. 'last_30_days': engine INVALID_FILTER, REST VALIDATION_FAILED unchanged (= twin split). Row 2 family (8 shapes): base 0 (date/datetime 4, held $or 6), head INVALID_FILTER all 16; twin sql INVALID_FILTER (driver compiler, r1/0), memory a count (0 or 6). Row 3 family (6 shapes incl. dotted referent, undeclared addDays offset): base 0 / 6 / 6 / 6 / 3 / 0, head INVALID_FILTER all 16; twin same split as row 2. Row 4 family: REST INVALID_FIELD/400·0 reads (8 cells; field: nope, message names 'aggregations[1].filter'), engine unchanged (a count, as ruled: engine keeps registry-less name tolerance on this position, REST is the gate — same as where); { nope: { $median: 1 } } REST INVALID_FIELD (field gate first, as for where), engine INVALID_FILTER; id / created_at keys admitted (m1 / m6, = twin). Row 5 (in-process): Date $gt on datetime base m0 → head m4 = twin n4 on both drivers; all ten datetime shapes and UTC-midnight Date on date ($gt 1, $gte 3, $eq 2) now equal the twin. Residual as disclosed: Date with time-of-day on date ($gte 1 vs 3, $lt 5 vs 3, $eq 0 vs 2) and Date on time (0 vs 3) — open question 2 → A stands.
• Valid per-aggregation filters keep their counts: 16 controls (implicit 2, $gt 3, $in 2, $or 3, $field numeric pair 4, addDays date/date 5, offset column 3, datetime/datetime 2, created_at 6, id 6, good date 3, {today} 6, {} 6, $ne null 6, $between 4, cross-class $field without addDays held at 0) byte-identical base→head.
• No collateral. Every where twin (aggregate verb and find, engine and REST, both drivers, both populations, 76 shapes): 0 moved. 4 groupBy probes: 0 moved. Every having cell without a Date bound (objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123 key refusals ×6, objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127 pair refusals ×5, objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099 walker ×3, 8 controls, 5 ISO controls; both applyHaving doors): 0 moved. objectql: a per-aggregation filter refuses an unknown operator only when rows exist — aggregations: [{ filter: { amount: { $median: 1 } } }] answers 400 on a populated table and 200 on an empty one #20122's landed refusals (unknown op, bare $field, $field as $in member / $exists operand, addDays 1.5, type door) and [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's text-operator door: messages byte-identical, still naming the fields.
• having Date cells. 52 moved on my set (13 Date shapes × 2 doors × 2 drivers, populated only; the dev's 36 = 9 shapes). Every min(datetime) cell moves to exactly the REST/ISO answer. Two max(date) shapes move toward the where date rule and away from the ISO-instant text: midnight $gte on max(date) [] → c2,c3 (ISO-instant keeps c2; bare-day '2026-02-01' keeps c2,c3) — the one the dev named — and midnight $eq on max(date) [] → c3 (ISO-instant keeps none; bare-day keeps c3) — not named in the PR body's "except" clause. No cell moves away from the where answer.
• Pins discriminate. At head: PR pins green (objectql 4 aggregate/having files 316 passed incl. fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147 / fix(objectql)!: having takes the rest of where's filter doors — the comparand-type door, row-independent refusals, a resolved { $field }, and a refused non-condition #20117 pins; protocol 13; rest 15). Reverse state (three files restored by blob to bc4f337220 / 876293a1e9 / ba5fbccde6, #20148 marker counts 0/0/0, objectql + metadata-protocol force-rebuilt, dist markers 0/0): engine-aggregate-filter.test.ts 34 failed | 73 passed (107), protocol.aggregation-filter-fields.test.ts 7 | 6 (13), aggregation-filter-where-doors.test.ts 10 | 5 (15) — exactly the dev's counts; the red set is the 14 reference rows, 8 temporal rows, 12 Date rows (incl. the having row); controls stayed green. Restored to HEAD blobs (4e1ebbf2a4 / ab6ba1df00 / a9a77c8f6d), clean status, dist rebuilt with markers present.
• Disclosure. Rows 2/3 wire message (439 chars at index 1, under the 500 bound): names aggregations[1].filter, the rule, and "the full diagnostic is in the server log"; contains none of the fixture's field names nor any $op (leak set empty on all 14 shapes). Engine logs exactly one warn per refusal carrying the full diagnostic. Referent set = declared fields + id/created_at/updated_at — verified equal to resolveQueryFields's known set, so the changeset's "the set the REST field gate reads" is TRUE. Mixed posture (rows 2/3 withheld, objectql: a per-aggregation filter refuses an unknown operator only when rows exist — aggregations: [{ filter: { amount: { $median: 1 } } }] answers 400 on a populated table and 200 on an empty one #20122's refusals named) is exactly as the seat ruled (Q1 → A).
• Code reading confirms the PR body's mechanics: temporal door fourth (after text-operator door, before type door) inside the loop only; assertAggregationFilterReferencesAreDeclared runs after assertNodeIsEvaluable (walker first — pinned); offsetPairViolation is the pure extraction of assertOffsetPairIsTemporal's three arms, having's words unchanged; instantsOf lifts only when a Date is on one side and utcInstantMs reads both (a time value / junk → unchanged comparison); protocol.ts hunks inside assertAggregationFieldsExist only, filter keys judged only after the aggregated-field check passes, saveMetaItem untouched.
• PR body sentences judged FALSE / stale at head: (a) H4 "check-adr-0087-registration reports 2 declared-breaking changesets" — at f22f0e875f with --base 49144fccc8 it reports 4 (main's 19856-* and 20055-* ride in via the merge; verdict unchanged, both of the PR's carry not-required (no-migration-prescription)); the "2" is the pre-merge d831680d7c reading. (b) H3 "except the midnight-Date on max(date) row" under-names the class: $eq midnight on max(date) also departs from the ISO-instant answer (see above). Every other numeric cell in §1, §3, §4 that my fixture can reproduce matched.
• Changeset sentences judged FALSE: .changeset/20148-aggregation-filter-where-doors.md — (1) "having shares this comparison, so a Date bound in having keeps the groups its ISO spelling keeps." FALSE for a date-class aggregated column: { last_placed: { $gte: Date('2026-02-01T00:00Z') } } keeps c2,c3 while the ISO-instant spelling keeps c2; $eq keeps c3 while the ISO spelling keeps none (both drivers, both doors). True for datetime columns. The PR body's H3 knows the exception; the shipped sentence does not carry it. (2) "refused in the words driver-sql uses for the same comparison in a where" — the wire sentence is new prose in driver-sql's withholding posture; it is not driver-sql's text. Every other sentence in both changesets checked TRUE against code and cells.
• Pending changesets: 20127-having-adddays-temporal-pair.md last sentence "A per-aggregation filter (aggregations[i].filter) is not judged by this rule…" is now FALSE at head (it is judged, via offsetPairViolation against the object's declared fields) — outside this claim's file surface, see ③. 20122-aggregation-filter-row-independent.md "Not changed: … a { $field } reference as the whole comparand of a scalar comparison (with or without a whole-day addDays)" reads stale relative to the release (now conditional on a declared referent and the class rule) though framed as that PR's own before/after — see ③. 20099-having-where-doors.md "A having key that names no column still keeps no group rather than being refused" has been FALSE since PR fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147 (objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123), not this PR's doing — see ③. 20123-* unaffected.
• Scope. packages/spec, driver-sql, driver-memory: 0 files touched by the PR's commits. where path untouched (engine hunks inside the per-aggregation loop only). Private helpers + offsetPairViolation refactor: all inside having-filter.ts; the one export change is the optional third parameter on assertAggregationFilterIsEvaluable (in surface) plus export interface AggregationFilterDeclaration — having-filter.ts is not re-exported by packages/objectql/src/index.ts, so no published-surface change; the PR body calls this type "private", which it is at package level but not at module level (nit). Accepted deviations per amendment 5852957006 stand.
• Merge. git merge-tree --write-tree of head onto current origin/main e2c4e125f9: clean, tree a6eb4ce478 (none of the 8 paths is merge=os-regen routed; merge-base 369bcbeda7).

② Semver level

• Declaration Clause-②: no (narrowing) is correct: requests that answered 200 with a zero count now answer 400 (rows 1–4) — an accept-set narrowing, BREAKING, and no spec/published-payload key changes. Row 5 / the having Date cells change the answer of already-accepted inputs toward the where answer — a correction, not a widening (the PR fix(objectql)!: having takes the rest of where's filter doors — the comparand-type door, row-independent refusals, a resolved { $field }, and a refused non-condition #20117 / fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147 bigint precedent), correctly carried under "Not refused, but answering differently".
• Level per package: @objectstack/objectql minor (BREAKING narrowing under the launch-window convention); @objectstack/metadata-protocol minor (same). Both changesets say minor, BREAKING banner, disposition not-required (no-migration-prescription) — consistent with objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123 / objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127.
• check-changeset-no-major --base 49144fccc8 --event <verbatim PR body> at head: "✓ This diff introduces no major bump." · "✓ LEVEL AXIS: this PR declares clause-② no (narrowing), and no package whose packages/**/src/** it moves is graded patch." · "direction arm: narrowing — a BREAKING change; during the launch window it ships minor" (exit 0).
• check-adr-0087-registration --base 49144fccc8 at head: "✓ check-adr-0087-registration: 4 declared-breaking changeset(s), each carrying an ADR-0087 disposition." — the PR's two 20148-* changesets [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription) (the other two, 19856-* registered and 20055-* not-required, are main's). check-empty-changeset: ✓.
• CI at head (34 check runs, all completed): 31 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failed. All seven required contexts success: Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard.

③ Boundary flags

• Open question 1 (disclosure) → A: confirmed implemented as ruled; C stays the maintainer's (a withholding-posture relaxation, finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 / [A of #7929] a spec-declared provenance mark set at both read-scope merge boundaries, so the driver can restore the author-facing cross-field diagnostic without re-disclosing policy #8220). Open question 2 (row-5 residual) → A: confirmed; the residual plus out-of-scope finding 1 (interpretable temporal STRING compared as text — reproduced: { placed_on: { $gte: '2026-02-01T00:00:00.000Z' } } counts 1 vs twin 3; { opened_at: { $lte: '2026-02-01' } } 2 vs 3; epoch-ms 0 vs 4; base = head) belong in the seat's follow-up card. Out-of-scope finding 2 reproduced (InMemoryDriver where { $field } → 0 rows vs SqlDriver 4).
• Pending-changeset drift, seat's call: 20127-*'s final sentence is FALSE at head; amending it is outside the claim's file surface (.changeset/20148-*.md). Either widen the surface by that one file for a one-clause amendment in the patch round, or accept the compiled CHANGELOG reading both entries. 20099-*'s "still keeps no group" clause has been FALSE since PR fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147 — pre-existing. 20122-*'s "Not changed … { $field } reference" is stale in the release frame only.
• Position label where.FIELD.OP on rows 1 and the [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661 door: accepted deviation (needs a path parameter in temporal-comparand-door.ts, outside the claim) — carrier still 承接者:无.
• param is dropped from the REST envelope for row 4 (err.param set, wire carries field + object + the message naming 'aggregations[1].filter') — pre-existing envelope behaviour shared with where, not this PR's.

Implemented-by: claude/issue-20148-aggregation-filter-doors
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: FAIL

Must-change (one file, prose only; code, tests and gates need no change):

1. .changeset/20148-aggregation-filter-where-doors.md, the "Not refused, but answering differently" bullet: qualify "having shares this comparison, so a Date bound in having keeps the groups its ISO spelling keeps" so it is true for what was measured — e.g. "…keeps the groups its ISO spelling keeps on a datetime column; on a date-class column (min / max of a date field) a UTC-midnight Date follows the calendar-day reading a where gives ({ $gte: Date('2026-02-01') } keeps the group whose max is 2026-02-01), which the ISO-instant text compared as text did not." In the same edit, replace "refused in the words driver-sql uses for the same comparison in a where" with the accurate "refused in the withholding posture driver-sql applies to the same comparison in a where" (the sentence is new; the posture is borrowed).

Optional in the same push (PR body, not shipped prose): H4 "reports 2" → the at-head reading (4, two of them main's); H3 "except" clause → name both max(date) midnight shapes ($gte and $eq).

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4da90165cd7deebc159117dfb9c2b5b26e26a9a3

Scope: delta review of PR #20174 (card #20148) after FAIL 5853139988 at f22f0e875f, under seat amendment 2 (5853144038: file surface widened by two pending changesets for one-clause DELIBERATE CORRECTIONS). This record carries forward my measured code judgments from the review of f22f0e875f on the identical blobs: git diff-tree -r f22f0e875f 4da90165cd lists exactly three paths, all under .changeset/; every non-changeset file is blob-identical (engine.ts 4e1ebbf2a4, having-filter.ts ab6ba1df00, protocol.ts a9a77c8f6d, engine-aggregate-filter.test.ts f9700d89a4, protocol.aggregation-filter-fields.test.ts 13a6e9a0ef, aggregation-filter-where-doors.test.ts e98e39a758, 20148-aggregation-filter-keys-rest.md 4d50a11e34). git diff --numstat f22f0e875f 4da90165cd is exactly 1 1 .changeset/20099-having-where-doors.md, 1 1 .changeset/20127-having-adddays-temporal-pair.md, 2 2 .changeset/20148-aggregation-filter-where-doors.md — the dev's claim holds; in each foreign file the single changed line is the paragraph named below and every other line is byte-identical (unified diff shows one -/+ pair per file). The branch did not re-merge main: merge-base with origin/main is still 369bcbeda7; origin/main is now 455dcc060d (7 commits ahead), and none of those 7 commits touches any of the PR's 10 paths (git diff --name-only 369bcbeda7 origin/main -- <the 10 paths> = empty). A worktree at 4da90165cd was built (closure cache-hit; dist markers 1/1) and my harness re-run: 3136 cells, 3136 identical to the f22f0e875f run, 0 differ — the code judgments transfer without exception.

① Derived judgments

• Rewritten sentences, read literally at this head against code and cells:
  • 20148-aggregation-filter-where-doors.md, the Date bullet: "having shares this comparison, so a Date bound in having keeps the groups its ISO spelling keeps on a datetime column" — TRUE (all 10 min(datetime) shapes equal the REST/ISO cell on both doors, both drivers). "on a date-class column (min / max of a date field) a UTC-midnight Date follows the calendar-day reading a where gives ({ $gte: new Date('2026-02-01') } keeps the group whose max is 2026-02-01, and so does $eq), which the ISO-instant text, compared as text, did not" — TRUE on my cells: $gte midnight Date on max(placed_on) keeps c2,c3 (c3's max is 2026-02-01), $eq keeps c3; the ISO-instant text keeps c2 / none; the bare-day where reading keeps c2,c3 / c3 — and the where twin on the raw column counts 3 for the midnight $gte. min is asserted by symmetry only (I measured max); scoped-true.
  • 20148-*, the posture sentence: "refused in the withholding posture driver-sql applies to the same comparison in a where: the message names the aggregation that carries the reference (aggregations[1].filter) and the rule, and withholds the fields, the operator and the specific reason" — TRUE (wire message names aggregations[1].filter, 439 chars, leak set empty for all 14 row-2/3 shapes; one warn per refusal carries the diagnostic).
  • 20127-having-adddays-temporal-pair.md, last sentence: "A per-aggregation filter (aggregations[i].filter) is not judged by this change: it reads the object's raw columns, and this change classifies only the aggregated row's. Since objectql + REST: the per-aggregation filter still lacks four of where's doors — a bad date, an addDays numeric pair, an undeclared { $field } and an unknown key answer 200 with every count 0 #20148 it is judged by the same class rule, against the object's declared fields." — TRUE. The rule is one function, offsetPairViolation, called by having through assertOffsetPairIsTemporal and by the per-aggregation walk assertAggregationFilterReferencesAreDeclared, with classes from declaredFieldClass(fields, name) over declared fields + id/created_at/updated_at. Measured at this head: addDays numeric pair, date→numeric, date/datetime, text/date, time pair, text or date offset column: INVALID_FILTER/400·0 reads on all 16 cells each. Words differ by position, and the sentence does not claim otherwise: having names the columns; the per-aggregation position withholds them on the wire and puts the same objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127 sentence in the warn line.
  • 20099-having-where-doors.md, "Not changed" paragraph: "A having key that names no column is not judged by this change; since objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123 it is refused (INVALID_FILTER / 400) rather than keeping no group." — TRUE: { totl: { $gt: 100 } }, $ne, under $not, behind a held $or, a source column, a dotted key: INVALID_FILTER/400 with 0 driver reads on all 16 cells per shape (native and fallback applyHaving doors × InMemoryDriver/SqlDriver × empty/populated × engine/REST). "since objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123" names the card; the code landed in PR fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147 — a reference, not a falsity.
• PR body, changed sections, sentence by sentence (final body, 19775 bytes): header ("prose-only patch round … every code and test blob is unchanged" + the three blob ids) TRUE; commit-table row for 4da90165cd TRUE; H3 "except the two UTC-midnight-Date shapes on max(date) … $gte keeps c2, c3 where the ISO-instant spelling keeps c2, and $eq keeps c3 where the ISO-instant spelling keeps none" TRUE; H4 "reports 4 … this PR's two 20148-*, and main's 19856-* (registered) and 20055-* (not-required) … Against origin/main it reports this PR's two" TRUE; "Patch round" section TRUE (three files, numstat, the two wording sentences, gate lines); "DELIBERATE CORRECTION" section — "1 1, every other line byte-identical" TRUE, each Before/After quotation matches the -/+ lines byte for byte; Deviations — "module-level helpers … AggregationFilterDeclaration … package-private" TRUE. No FALSE sentence remains in the body or in the three changesets.
• DELIBERATE CORRECTION confirmation (landing-operations: the record names each changed note and judges each rewritten sentence). Note .changeset/20099-having-where-doors.md: one clause rewritten, judged TRUE above; the pre-change clause was FALSE since PR fix(objectql)!: per-aggregation filter and having refusals belong to the query, not the data — row-independent walk, shape and type doors, unknown having keys, temporal addDays pairs #20147. Note .changeset/20127-having-adddays-temporal-pair.md: one sentence rewritten, judged TRUE above; the pre-change sentence was made FALSE by this PR. Both are corrections of pending release notes into truth; the files' remaining lines are the merge-base bytes. Confirmed.
• Docs (the drift bot's hand-written pages, re-derived on e2c4e125f9: 21 listed, 4 release-owned). None describes the per-aggregation filter. data-modeling/queries.mdx having callout and its group-by/having examples: TRUE at head. api/data-api.mdx aggregate table (groupBy: ["no_such_field"] → 400 INVALID_FIELD; aggregations sum no_such_field → 400 INVALID_FIELD) and the measure-spelling callout: TRUE. kernel/runtime-services/data-service.mdx: TRUE. No sentence in the listed pages reads FALSE. Finding for a later docs card, pre-existing and outside the bot's list: content/docs/protocol/objectql/query-syntax.mdx lines 92 and 136 still mark aggregations[].filter [EXPERIMENTAL — not enforced] — FALSE since engine.aggregate: add per-aggregation filter to the contract — ruled half of #10413 (measure-level filters on the ObjectQL analytics path) #10576.
• Merge. git merge-tree --write-tree --name-only origin/main(455dcc060d) 4da90165cd: clean, tree eb7088ba59, no conflicted paths.

② Semver level

• Unchanged from the f22f0e875f record: Clause-②: no (narrowing) correct; @objectstack/objectql minor, @objectstack/metadata-protocol minor (BREAKING narrowings under the launch-window convention); both changesets BREAKING with not-required (no-migration-prescription). The two corrected foreign changesets keep their frontmatter and disposition markers untouched.
• check-changeset-no-major --base 49144fccc8 --event <final PR body> at 4da90165cd: "✓ This diff introduces no major bump." · "✓ LEVEL AXIS: this PR declares clause-② no (narrowing), and no package whose packages/**/src/** it moves is graded patch." · "direction arm: narrowing — a BREAKING change; during the launch window it ships minor" — exit 0.
• check-adr-0087-registration --base 49144fccc8: "✓ check-adr-0087-registration: 4 declared-breaking changeset(s), each carrying an ADR-0087 disposition." — exit 0. --base origin/main: 2 (this PR's two) — exit 0.
• check-empty-changeset --base origin/main: exit 1, by design: "This PR changes a changeset it did not add: .changeset/20099-having-where-doors.md — present on the merge base and CHANGED by this PR …; .changeset/20127-having-adddays-temporal-pair.md — present on the merge base and CHANGED by this PR …" — exactly the two files.
• CI at 4da90165cd, complete: 41 check runs — 34 success, 5 skipped, 2 failure. All seven required contexts success: Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. The two failures are both Check Changeset (jobs 108561828229 on synchronize and 108562075562 on edited), each red for the same reason, from the job log: "This PR changes a changeset it did not add: .changeset/20099-having-where-doors.md — present on the merge base and CHANGED by this PR -- this is somebody else's release note; .changeset/20127-having-adddays-temporal-pair.md — present on the merge base and CHANGED by this PR … ##[error]Process completed with exit code 1." — exactly the two corrected files. No other failure.

③ Boundary flags

• Open question 1 → A and open question 2 → A stand as at f22f0e875f; the seat's correction 5852968007 (out-of-scope finding 2 is [finding] driver-memory's own reference matcher has no $field arm — a cross-field comparand (bare or with addDays) reaching it is presumably compared as a literal object rather than resolved or refused (grep reading, to be measured) #15104, closed not_planned, not re-filed) noted.
• The DELIBERATE-CORRECTION red on Check Changeset is the gate's intended path; this same-head PASS record is the confirmation, and the PR enters the queue with that check red under SKILL.md's three conditions.
• The final PR body no longer carries the session-link footer; durable attribution survives in the header prose. A form nit, not a contract item.
• Docs finding for a later docs card: content/docs/protocol/objectql/query-syntax.mdx lines 92 and 136 (aggregations[].filter [EXPERIMENTAL — not enforced]) — pre-existing, FALSE.

Implemented-by: claude/issue-20148-aggregation-filter-doors
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: PASS