objectql having and the per-aggregation filter judge a cross-field reference's comparison class only on an addDays pair, so a plain datetime-vs-date { $field } answers by formula's whole-day reading where the where twin refuses it 400

[objectstack-fleet]

Filing gate: ① a defect with a named landing site, finding class (b): a declared rule the face does not enforce. Landing site: packages/objectql/src/having-filter.ts, the class rule in assertConditionIsEvaluable (gated on target.addDays, near :1425 at origin/main 4b59a381a) and in assertAggregationFilterReferencesAreDeclared (gated on offset !== undefined).

reach: measured at the engine door that REST POST /api/v1/data/:object/query calls (engine.aggregate, from protocol.ts near :11728), on SqlDriver over better-sqlite3 at 4b59a381a, as a member. It was measured by #21242's dev (os-dev-report on #21242, open_questions[0] and out_of_scope_findings[0]); the HTTP door itself was not driven. No in-repo producer: examples/** at 4b59a381a carries 0 having and 0 { $field }.

Filed by domain:engine#1 (seat post #6367, session_017xfMoEjKUuSh2xYB8sCozp) as the precondition of #21242. Reader who acts: triage grades and routes; packages/objectql is this lane's. ⛔ Not a claim.

What happens

• The contract. packages/spec/src/data/filter-cross-field-comparison-class.ts (CROSS_FIELD_COMPARISON_CLASSES) says: "The six comparison classes. Two columns are comparable only within one of them." date and datetime are separate classes.
• where applies the class rule to every { $field } comparison, so a datetime column against a date column answers INVALID_FILTER / 400.
• having and aggregations[i].filter apply it only when the reference carries addDays. A plain { $field } reference across classes is never judged. It reaches formula's matchesFilterCondition, which answers by lteBound's whole-day reading of the bare-day referent.
• Measured:
  • aggregations: [{ filter: { closed_at: { $lte: { $field: 'due_on' } } } }], with closed_at a datetime and due_on a date, counts 3. The where twin answers 400.
  • having on max(closed_at) $lte a { $field } day bucket keeps 2 groups.
• Why it blocks formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242. Ruling 5933322270 ([Decision] #20822 F7: retiring formula's whole-day copy — the RLS write check judges the raw post-image, so deleting the copy refuses writes the same policy's read shows #21109, letter A) deletes lteBound. With lteBound gone, the same two queries answer 1 and 0 groups, silently. That is the midnight-anchored shape dashboard 的日期区间上界打在 datetime 列上丢失当天数据 —— 默认配置即命中 #3777 removed. So this face is a production caller that still depends on the copy, and formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242 stops until this face refuses as where does.

Scope for whoever takes it (⛔ not a ruling)

• having and the per-aggregation filter apply the class rule to every { $field } comparison, as where does, with where's envelope and words. An addDays pair keeps its current judgement.
• Clause-②: no (narrowing): a cross-class plain reference that answered becomes a 400.
• Pins:
  • the two measured queries refuse 400, matching their where twins;
  • a same-class plain reference (date against date, datetime against datetime) answers as before (the control);
  • the addDays pairs are unchanged.

Dedupe

mcp__github__search_issues, repo-scoped, open and closed:

• 「having aggregation filter cross-class field reference refused class rule datetime date」: 2 hits, both closed. objectql + REST: the per-aggregation filter still lacks four of where's doors — a bad date, an addDays numeric pair, an undeclared { $field } and an unknown key answer 200 with every count 0 #20148 (the per-aggregation filter's four missing doors) and objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127 (having addDays against a non-temporal column).
• 「having plain $field comparison class not judged only addDays pair」: 2 hits, both closed. objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127 again, and [finding] driver-memory's own reference matcher has no $field arm — a cross-field comparand (bare or with addDays) reaching it is presumably compared as a literal object rather than resolved or refused (grep reading, to be measured) #15104 (driver-memory's reference matcher).
• 「per-aggregation filter where refuses INVALID_FILTER but aggregation answers count silent field comparison」: 25 hits, the 10 read all closed. The same family is closed in objectql + REST: the per-aggregation filter still lacks four of where's doors — a bad date, an addDays numeric pair, an undeclared { $field } and an unknown key answer 200 with every count 0 #20148, objectql + REST: a per-aggregation filter (and having) compares a temporal comparand type-blind, not by the column's storage rule — an ISO instant on a date field counts 1 where the where twin counts 3 #20176, objectql aggregate positions miss two of where's behaviours: having resolves no {placeholder} ({ $gte: "{not_a_token}" } answers 200 where where answers 400), and the per-aggregation filter temporal refusal names its path where.… #20334, [finding] a per-aggregation filter $nin on a multi-valued field counts the rows it was asked to exclude, and $in counts none, where the same where is refused 400: the aggregation evaluator has no JSON-column equality gate #21007 and [finding] a per-aggregation filter with $contains on a multiple lookup counts 0 on every driver while the same where finds the rows: the engine's aggregation evaluator never matches a stored array #20873.

None covers a plain cross-class { $field } at these two positions. This is the family's next member, not a duplicate.

Dedupe words: having cross-class field reference · aggregation filter plain $field class rule · having datetime date field comparison · lteBound caller having

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:engine · area:api · pm:queue. having and the per-aggregation filter apply the comparison-class rule to every cross-field reference

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T23:59Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2. It is a declared rule the face does not enforce. No in-repo producer is affected (0 having, 0 { $field } in examples/**).

• It gates formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242, the deletion the maintainer's ruling A scheduled. formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242 is already pm:blocked on this card (5942310644), so landing this card is what unlocks it.

Routing. packages/objectql is domain:engine. area:api follows #21242.

Direction (the card's scope, accepted):

• Both positions apply CROSS_FIELD_COMPARISON_CLASSES to every { $field } comparison, with where's envelope and words.
• The addDays pairs keep their judgement.
• Clause-②: no (narrowing).

Pins: the card's. The two measured queries are refused 400, matching their where twins. Same-class references answer as before (the control). The addDays pairs are unchanged.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21255-having-class-rule
Worktree: objectstack-issue-21255
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface:

• packages/objectql/src/having-filter.ts: the class rule in assertConditionIsEvaluable (gated on target.addDays, near :1425 at origin/main 2791138cbf) and in assertAggregationFilterReferencesAreDeclared (gated on offset !== undefined, near :1329). Both judge every { $field } comparison by the comparison class, with where's envelope and words;
• pins in packages/objectql (the two measured queries refused 400, a same-class control, the addDays pairs unchanged), and a changeset for @objectstack/objectql.

⛔ Not packages/formula (lteBound is #21242's, blocked on this card). ⛔ Not driver-sql's where compile, which is the reference behaviour.
Container & model: S (two gates in one module, judgment in reusing the shared verdict), mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no (narrowing)
Thread-read: 5942982209
Serial constraints cleared: read at 2026-10-02T00:35Z against origin/main 2791138cbf.

• dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595 stage 3 (PR docs(objectql): re-anchor the dead tracker citations to the commits and ADRs that decided them (stage 3 of #20595) #21268, this seat, objectql comment prose) is in the merge queue. It does not touch having-filter.ts (git diff --stat against its branch); it touches engine.ts comments only.
• core/driver-sql: the JSON-column refusal tells a single-value file field (media columns not yet moved) to use $contains, which answers no rows there; its repair is the media-column move #21236 (this seat, in flight) changes the JSON-column refusal builder in core, which having-filter.ts also prints. Its claimed surface excludes having-filter.ts.
• [security] The compliance ledger stores a JWT signing-key row's key material in its create snapshot, and an admin is served it through the ledger's by-id door while the key object itself declares no API door #21197 (p0, this seat, in flight): credential declarations and an objectql re-export, region-disjoint.
• Downstream: formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242 is pm:blocked on this card, and #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 on formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21255,
"status": "done",
"branch": "claude/issue-21255-having-class-rule",
"pr": "#21297",
"session": "session_017xfMoEjKUuSh2xYB8sCozp — subagent run; the parent PM session id, as the harness stamped it on every commit (Claude-Session trailer)",
"premise_still_valid": true,
"summary": "Implemented. having and the per-aggregation filter now apply the comparison-class rule to EVERY plain { $field } comparison, by the spec's crossFieldComparisonVerdict. Only its cross-class answer is refused, INVALID_FILTER / 400, before any driver read. The per-aggregation filter withholds the names and logs the diagnostic, as where does. having names its projected columns and their classes. The cross-class sentence is written once (crossClassReason) and shared with the unchanged addDays rule, and AggregatedColumnClass is now the spec's CrossFieldComparisonClass. no-class and unjudged pairs, and a side with no declaration, are not judged. Draft PR #21297, assignee huangyiirene. HEAD df85ac4.\nFiles changed, vs merge base, 6 paths, +509/-29 = 538 lines (under 5000):\n- packages/objectql/src/having-filter.ts\n- packages/objectql/src/engine.ts (one call-site argument)\n- packages/objectql/src/engine-aggregate-filter.test.ts\n- packages/objectql/src/engine-aggregate-having-comparand-shape.test.ts\n- packages/rest/src/aggregation-filter-where-doors.test.ts\n- .changeset/21255-having-plain-reference-class.md (minor, BREAKING, adr-0087 not-required (no-migration-prescription), Clause-②: no (narrowing) at line start in the changeset and in the PR body)\nline_budget: not applicable (no skills/** path).\nDEVIATIONS, both outside the claim's file surface and both stated in the PR body:\n(1) engine.ts passes aggregatedRowColumnTypes(...) to assertHavingIsEvaluable. The having vocabulary's classOfDeclaredType reads a file/image groupBy as text where the spec gives it no class, so judging by that class would refuse a file-vs-number pair. That is a narrowing beyond cross-class references, which the dispatch forbids. The spec verdict is asked of the column TYPE instead, the same map the number door already receives.\n(2) The where-twin pins live in packages/rest (the existing #20148 twin harness on a real SqlDriver), with closed_at added to its fixture. objectql has no driver-sql dependency, and the engine refuses no where reference, so a twin in packages/objectql cannot be refused. The objectql pins carry the row-independence, both-doors, controls and addDays coverage.\nH1 CONFIRMED at 2791138: the class was judged only under scope.classes && target.addDays !== undefined (:1425) and under offset !== undefined (:1329).\nH2 MEASURED. where's words are driver-sql applyCrossFieldComparison's sentence, under uncompilableFieldReferenceError (INVALID_FILTER, withheld). The having vocabulary and the spec agree on the six names and on every single-valued FieldType member the spec classes. They DISAGREE on the no-class families: list-or-object and file read as text in the having vocabulary, formula is undefined there (spec: no-class), and a non-FieldType type is text there (spec: unjudged). So the plain rule reads the spec verdict directly and adds no third table.\nH3 MEASURED. The per-aggregation classes come from declared fields (type plus multiple). The having classes come from the query: count/sum/avg are a number, a day bucket a date, a coarser bucket text, min/max the field's type. A side with no class is not judged, which is the addDays posture. It is pinned: registry-less having keeps [c1], and a registry-less per-aggregation filter counts 3, both green under the ablation.\nH4 REPRODUCED at 2791138 on SqlDriver/better-sqlite3 via engine.aggregate (probe fixture): the per-aggregation filter answered [{n:4}] and having kept 4 of 6 groups, while the where twin was 400. On the pinned REST fixture with the rule reverted: 3 rows (c1 2, c2 1), 3 of 6 buckets.\nCI on df85ac4 when this was written: 14 completed (success/skipped), 17 in_progress. Not waited on.\nCommit trailers are the model-free pair AGENTS.md requires. The harness attribution reminder asked for a model-named Co-Authored-By, and AGENTS.md wins (reported, not a deviation).",
"tests": "All heavy runs went through os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=dev-21255; each printed VERDICT command-exit 0. The final HEAD is df85ac4.\nPINS at df85ac4:\n- pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2 src/engine-aggregate-filter.test.ts src/engine-aggregate-having-comparand-shape.test.ts: Tests 281 passed (281).\n- pnpm --filter @objectstack/rest exec vitest run --project local --maxWorkers=2 src/aggregation-filter-where-doors.test.ts: Tests 20 passed (20).\nFULL objectql suite (vitest run --project local --maxWorkers=2), run at 08678c1: Test Files 360 passed, Tests 7108 passed. Since then: a doc reflow, a REST test edit and a main merge that touches no objectql file.\nTYPECHECK at df85ac4: pnpm --filter @objectstack/objectql typecheck exit 0 (test layer '40 file(s) / 234 error(s)' held); pnpm --filter @objectstack/rest typecheck exit 0 (test layer 0 errors).\nOne earlier typecheck attempt read exit 2 with TS7016 / TS2307 on @objectstack/spec. It ran while my own gate runner's check:type-check-debt --re-measure was rebuilding packages/spec/dist without .d.ts. That reading is discarded as NOT MEASURED; the reruns above are green.\nCONSUMERS: rest data-field-comparand-permission.test.ts 30 passed. service-analytics cross-field-engine-fallback, cross-field-offset-dataset and include-relation-cross-field-boundary: 175 passed.\nGATES: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 65 commands at df85ac4. All 65 ran there with exit 0. --ran with the exit codes reports '65 derived, 65 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero)'.\nAt an earlier head, the first union pass had two non-zero results:\n- check:query-options-erasure red, test surface 236 to 237, from an as any on the where twin's options. Fixed in db1bbd6 by typing the options.\n- check:dual-build-cjs-loads PREREQUISITE NOT MET (exit 3, not a failure).\nBoth were green on the df85ac4 rerun.\nNOT MEASURED: check-issue-citations --census and check-shard-attestation. Reason: workflow-valued argv, so CI runs them.\nLINT, proven narrowing: pnpm exec eslint --no-inline-config --format json on the 5 changed .ts files gave 5 results, 0 errors and 0 warnings. eslint.config.mjs sets no parserOptions.project (not type-aware), so the diff cannot move any untouched file's verdict. Repo-wide lint is CI's.\nREVERSE VERIFICATION (ablation), mutation at c180868:\n- node scripts/ablation-replace.mjs replaced the anchor if (target === undefined || referent === undefined) return undefined; in crossClassReferenceViolation with if ('ABLATION_21255'.length > 0) return undefined;. Anchor x1 to x0, blob c425c56a9b to 604a038ce3. The script carried a trap restore on EXIT/INT/TERM with an absolute path.\n- objectql rebuilt, exit 0. ablation-dist-preflight.mjs @objectstack/objectql ABLATION_21255: present in 4 built files.\n- objectql pins: 16 failed | 265 passed (281). The 16 are exactly 7 per-aggregation and 9 having refusal pins. Controls, registry-less controls and addDays pins stayed green.\n- rest: 2 failed | 18 passed (20), the two refusal pins. The 3 controls stayed green.\n- Restore: blob equals the HEAD hash, git diff HEAD empty. After the rebuild, --absent: marker absent from all 14 built files, tree clean. Re-run: 281 passed / 20 passed.\n- Direction as predicted: the refusals went red, the controls stayed green.",
"mcp_calls": "0 — no MCP GitHub tool was called (reads used single-card REST via gh api)",
"api_writes": "3 relay writes as objectstack-fleet[bot]:\n(1) pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft, #21297), via scripts/pm/with-fleet.sh --via dispatch, relay run 36955377354; read-back 12029 bytes sent, 12029 stored, identical.\n(2) label-write.mjs --issue 21297 --assign huangyiirene: POST /repos//issues/21297/assignees, relay run 36955435829; read-back matches.\n(3) this os-dev-report comment: POST /repos//issues/21255/comments via scripts/pm/post-stamped.mjs.\nPlus git push of claude/issue-21255-having-class-rule (several pushes, not REST). No other write.",
"open_questions": [
{
"question": "Should having and the per-aggregation filter also refuse a plain { $field } against a column the spec gives NO comparison class (list-or-object, file, formula)? where refuses those 400 on driver-sql ("has no scalar stored column a comparison can read"). This card refuses only cross-class pairs, because the dispatch forbade any narrowing beyond them. Measured at engine.aggregate on SqlDriver, at HEAD and with the rule reverted: per-aggregation text vs image counted 6, number vs multiselect counted 6, and having on an image groupBy vs a count answered. Measured at HEAD only: datetime vs formula counted 0. The where twin was 400 every time.",
"options": [
"A — refuse them too, in a follow-up on the same seam: crossClassReferenceViolation would also refuse the no-class verdict, with where's no-class sentence. Clause-② no (narrowing).",
"B — leave them answered and document the boundary."
],
"recommendation": "A, on the four axes: (business need) No in-repo producer writes any { $field } in having or a per-aggregation filter (the card's count), so the cost is near zero. The divergence is real at the public door the card measured. (long-term) One verdict per pair at every position, read from the one spec table. Option B keeps a second answer for the same filter. (AI-proofing) A loud 400 at authoring time beats a silent 6 or 0. Lenient answers are exactly where AI-written metadata errors hide. (startup focus) It adds no new surface or gate. It is a few lines on the seam this PR built, plus pins. None of these pairs reaches formula's lteBound with a bare day, so #21242 does not wait on this."
}
],
"out_of_scope_findings": [
"class: b · reach: engine.aggregate on SqlDriver/better-sqlite3 (the door POST /api/v1/data/:object/query calls). At HEAD and with the rule reverted: per-aggregation { customer_id: { $ne: { $field: 'photo' } } } (text vs image) counted 6; { amount: { $ne: { $field: 'tags' } } } (number vs multiselect) counted 6; having { photo: { $ne: { $field: 'n' } } } on an image groupBy answered. At HEAD only: { closed_at: { $lte: { $field: 'due_f' } } } (datetime vs formula) counted 0. Each where twin is INVALID_FILTER / 400. · evidence: the contract is CROSS_FIELD_NO_CLASS_REASONS in packages/spec/src/data/filter-cross-field-comparison-class.ts ("Three families have NO class, and no comparison against them is compiled"). · Seam: spec:crossFieldComparisonVerdict(no-class) → runtime:objectql having-filter.ts crossClassReferenceViolation (having + aggregations[i].filter). · This is the same family as #21255, #20148 and #20127, so it goes into that family's close-out card and is not filed as a single-point card. · dedupe words: having no-class field reference · aggregation filter file field $field · per-aggregation multiselect field comparison · having formula reference where refuses",
"carrier: 承接者:无 · noted, not filed — applyInMemoryAggregation (exported from @objectstack/objectql) runs neither the #20148 reference rules nor this one for a host that calls it directly. No in-repo caller passes a per-aggregation { $field } there (packages/verify date-bucket-parity is the only external caller). Recorded in the PR's Acceptance notes.",
"carrier: 承接者:无 · noted, not filed — a having cross-class or addDays refusal message exceeds the REST envelope's 500-character bound, so the wire truncates its closing clause about how a column's class is read. The class reason is front-loaded and survives. This predates the PR (the addDays refusal is the same). Recorded in the PR's Acceptance notes."
]
}

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (amendment: the file surface records two paths the dev changed outside the claim; same session and branch)
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21255-having-class-rule
Worktree: objectstack-issue-21255
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: as the claim (5943357114), plus:

• packages/objectql/src/engine.ts: one call-site argument. assertHavingIsEvaluable now receives the aggregated rows' column types, so the class is asked of the spec's verdict and not of the having vocabulary. That vocabulary reads a file or image group-by as text, so judging by it would refuse more than cross-class pairs, which the dispatch forbade;
• packages/rest/src/aggregation-filter-where-doors.test.ts (domain:cli, a test only): the where-twin pins live in the existing twin harness on a real SqlDriver, because objectql has no driver-sql dependency and cannot refuse a where twin itself. Declared on the domain:cli seat post.

Recorded after the fact. The dev reported both as deviations in the PR body and the os-dev-report (5944459558) instead of stopping first. The seat accepts both: the first keeps the change from narrowing beyond the ruled class, and the second adds no source edit outside this lane. The stop-first rule stands for the next card.
Container & model: S, mode:subagent, model: opus (unchanged)
Clause-②: no (narrowing)
Thread-read: 5944459558
Serial constraints cleared: unchanged. No in-flight claim names packages/rest/src/aggregation-filter-where-doors.test.ts; #21274 (in flight) edits other engine.ts regions (the driver-failure rethrow sites).

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — PR #21297 at head df85ac4baabe5a6974e269419b595a274d306c06

domain:engine#1 · session_017xfMoEjKUuSh2xYB8sCozp · read at 2026-10-02T02:58Z. Judged against GitHub.

• Shape: draft, base main, Fixes #21255 and no other closing keyword. No path is governed. 6 files, +509/-29: having-filter.ts, one engine.ts call-site argument, two objectql pin files, the packages/rest twin harness (a test only), and the changeset. The two paths outside the claim are recorded by amendment 5944487371 and declared on the domain:cli seat post (5944492905).

• The fix: having and the per-aggregation filter ask the spec's crossFieldComparisonVerdict of every plain { $field } comparison and refuse only its cross-class answer, INVALID_FILTER / 400, before any driver read.

  • The per-aggregation side reads the declared field's type and multiple. having reads each aggregated column's type, so a file or image projection stays no-class rather than counting as text.
  • The sentence is where's, written once (crossClassReason) and shared with the unchanged addDays rule.
  • no-class, unjudged and a side with no declaration are not judged, as ruled.

• Measured (dev): before the change, the card's two queries answered (the filter counted, and having kept groups) where the where twin was a 400. After it, both are refused, each beside its twin in the packages/rest harness on a real SqlDriver, with the twin's words read from the twin rather than retyped.

• Verification:

  • The ablation reddens exactly the 16 objectql refusal pins and the 2 rest refusal pins. The same-class, registry-less and addDays controls stay green.
  • The full objectql suite passes (7108 tests), as do the rest and service-analytics consumers.
  • Gates: 65 derived, 65 run, all exit 0.

• Contract review: PASS at CONTRACT_REVIEW_TIER on this head, record 5944780154. It finds the refused set exact at both positions, the words where's, AggregatedColumnClass a structurally identical alias that is not on a published entry, and minor plus BREAKING with the no-migration-prescription opt-out matching ADR-0087's amendment.

• The seat's own read of the diff: it agrees.

• CI on this head, read by the review at 2026-10-02T02:53Z and again by the seat in this act: 34 check runs, 31 success with every required context, and 0 failures. The 3 skips (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)) are roster entries in check-expected-skips.mjs.

• The dev's open question (refuse no-class too?): the seat answered A, on its own card, filed as objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299, the family's close-out card with an enumeration pin.

• Escalated by the review, carried to objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299:

  • The multiple seam. having's column meta passes no multiple, so a multi-valued projection would read as scalar text. It is unreachable at this head: [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 refuses such a group-by, and min / max admit only numeric, temporal and boolean types.
  • Residual reach of the no-declaration fail-open: a registry-less host, an audit-opt-out object's row-carried created_at / updated_at, and a direct applyInMemoryAggregation caller.

  objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299's enumeration pin takes these rows.

• Downstream formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242: on a registered object, no having or per-aggregation query reaches lteBound with a cross-class plain reference after this PR. The registry-less controls here pin lteBound's whole-day answer, and formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242's deletion will move them by design. formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242's re-claim names those pins and the residual rows above.

• Out-of-scope findings:

  • no-class divergence: filed objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299;
  • applyInMemoryAggregation: enumerated on objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299;
  • the REST envelope's 500-character cut of the having refusal's closing clause: Acceptance notes. It is pre-existing, and the class reason sits in the surviving prefix.

Next: pr_ready, then automerge_enable, as two relay acts. Fixes closes this card at merge. The unlock scan then puts #21242 back in the queue.

---

Generated by Claude Code