[finding] ObjectGrid's legacy defaultFilters leg still reaches $filter without the toFilterNode hop

Observation-class finding, recorded from the objectui#4041 implementation (PR #4081) so it is not rediscovered. Unassigned, and no pm:queue — I did not measure a live producer, so I am not claiming a user hits this today. Filed plainly; let triage grade it.

The fact

packages/plugin-grid/src/ObjectGrid.tsx, the query assembly, after PR #4081:

if (schemaFilter !== undefined) {
  params.$filter = schemaFilter;      // lowered through toFilterNode at the read point
} else if (schema.defaultFilters) {
  // Legacy support
  params.$filter = schema.defaultFilters;   // byte-for-byte, no lowering
}

objectui#4041 converged the declared filter key onto the repo's single lowering hop (toFilterNode, "the last hop before the wire"). The legacy defaultFilters fallback beside it was deliberately left untouched as out of scope for that card — it is a different key, undeclared in the block's inputs, and widening #4041 to it would have been scope creep on a ruled card.

But the hazard toFilterNode exists to close applies to it verbatim. defaultFilters is the MongoDB-style Record< string, any > shape (plugin-list's buildEffectiveFilter names it as exactly that: "its last fallback is table.defaultFilters, declared Record< string, any >"). isFilterAST is false for a plain object, so such a value sent raw is the 400 INVALID_FILTER shape objectui#3431 measured against a real backend. toFilterNode already handles this case — it routes objects through convertFiltersToAST — so the fix, if wanted, is a one-line reuse of the sink rather than new logic.

Why I am not asserting impact

Two reasons to let triage decide rather than grade it myself:

No measured producer. defaultFilters is not in object-grid's registered inputs, so an author writing it gets unknown-prop from the save gate (a warning, not a rejection — sdui-parser/src/validate.ts pushes severity: 'warning'). Whether any host injects it onto an object-grid node was not measured.
The sibling path already lowers. Where ObjectView feeds a list, the value goes through buildEffectiveFilter, which does call toFilterNode. So the un-lowered leg may be dormant in practice — which is precisely the "dormant code / unexercised drift" class rather than a live defect.

Severity judged at filing time is unreliable in both directions, so this is recorded as observed rather than argued up or down.

objectui#4041 / PR fix(plugin-grid): object-grid publishes the filter key it reads — filter, singular (#4041) #4081 — the card that converged the declared key and left this leg alone.
objectui#3431 — the real-backend measurement of 400 INVALID_FILTER for a non-AST $filter.
objectui#2890 — the broader ListView legacy-vocabulary migration (scope A lists filters → filter); this finding is a narrower runtime fact about a different key and is not covered there.

Generated by Claude Code

Findings triage: held — finding stays.

Premise check (origin/main @ 9154d9e): the un-lowered leg is live exactly as filed — packages/plugin-grid/src/ObjectGrid.tsx:647-648 (// Legacy support → params.$filter = schema.defaultFilters with no toFilterNode hop). PR fix(plugin-grid): object-grid publishes the filter key it reads — filter, singular (#4041) #4081 (the object-grid 的 inputs 声明 filters(复数),渲染器只读 filter(单数):按已发布词汇写筛选条件静默无效 #4041 convergence that deliberately left this leg alone) is merged.
Why held rather than promoted: the card's own two reasons stand up — no measured producer (defaultFilters is not in object-grid's registered inputs; authoring it draws a save-gate warning), and the ObjectView→list sibling path already lowers via buildEffectiveFilter. That is the dormant-code / unexercised-drift class the finding state exists for. Real hazard (a plain object sent raw is [finding] 已保存视图的 ViewFilterRule[] 被原样当 FilterNode 送进 $filter,未在客户端折成 AST #3431's measured 400 INVALID_FILTER), but nothing reaches it today on any path that was measured.
Why not closed: the fix is a one-line reuse of the existing sink, and the leg sits squarely in Migrate the remaining ListView legacy vocabulary to spec-canonical keys, and audit ObjectView/DetailView (#2231 phases 4–5) #2890's legacy-vocabulary territory — cheap to fold in when that migration or any grid-filter work next touches this file.
Promotion triggers recorded: (a) any measured host injecting defaultFilters onto an object-grid node, or (b) Migrate the remaining ListView legacy vocabulary to spec-canonical keys, and audit ObjectView/DetailView (#2231 phases 4–5) #2890 scope-A work touching this file — fold it in or promote then.
Dedup: object-grid 的 inputs 声明 filters(复数),渲染器只读 filter(单数):按已发布词汇写筛选条件静默无效 #4041/PR fix(plugin-grid): object-grid publishes the filter key it reads — filter, singular (#4041) #4081 scope-disjoint by that card's ruling; Migrate the remaining ListView legacy vocabulary to spec-canonical keys, and audit ObjectView/DetailView (#2231 phases 4–5) #2890 lists the vocabulary migration but not this runtime fact; no twin.