Repository navigation
formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242
Description
立卡门 ③:维护者直派的任务。
动手的读者:分诊定级并定车道。packages/formula 属 domain:engine(按 lanes 职责表),由该车道席位认领。
查重:mcp__github__search_issues 查 "delete lteBound formula matches-filter whole-day copy F7 retirement",0 条命中;查 "formula whole-day upper bound copy retire after RLS check stored form",1 条命中,即父卡 #21109(已 closed)。
维护者原话与裁决
#21109 的裁决 5933322270(batch #261 item 5,字母 A),维护者原话「其他四张同意」,2026-10-01T14:16Z。裁决原文:
"A: the RLS write check judges the row as it will be stored. … After that lands, F7's copy (
lteBound,packages/formula/src/matches-filter.ts:867) is deleted mechanically. Until then it stays exactly as it is."
卡片里被裁选项 A 的描述(中文原文):「随后另开一张删除卡删掉 lteBound,它的 24 个直调用例改走 lowering。」
条件已满足
- PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235([Decision] #20822 F7: retiring formula's whole-day copy — the RLS write check judges the raw post-image, so deleting the copy refuses writes the same policy's read shows #21109)已合并为
ef96c9ed:RLS 写检查在判定前,把声明为date/datetime/time的列(写入映像与检查的比较值两侧)都转成@objectstack/core的temporalStorageForm。 - 该 PR 的 pin 在 F7 不可达的条件下也通过:测试把
@objectstack/formula的matchesFilterCondition包了一层,使$lte以$lt-或-$eq的形式到达,$between以$gte加上同样的方式到达(dev 报告5939908710,H5)。
本卡要做的
- 删除
packages/formula/src/matches-filter.ts的lteBound(现在约在:902,$lte用在:688,$between用在:693),以及只为它存在的说明(约:1008)。 - 它的直调用例改走存储形的转换(lowering)。
- 先测再删: PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235 的 dev 记录 RLS 的 CEL 下沉不产生
{ $field, addDays }比较值(cel-to-filter.ts:addDays0 处命中,$field5 处作为对照)。所以 F7 的{ $field, addDays }那一半要在lteBound的其他调用方上实测:列出matchesFilterCondition的每一个生产调用方,确认删掉后没有任何调用方再依赖整日上界。 - Pins: 每个仍然存在的调用方在删除前后给出同一答案,或者给出经过记录的、由存储形决定的答案;RLS 写检查与读的一致性(PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235 的 pin)保持全绿。
不在本卡
多值字段的标量包裹(#21238)不在本卡范围。
Generated by Claude Code · domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Activity
objectstack-fleet commentedon Oct 2, 2026
Unlock: session
session_017xfMoEjKUuSh2xYB8sCozp(domain:engine#1), 2026-10-02T03:27Z.Blocked-by: #21255is met: #21255 closed when PR #21297 landed asc2cd65154(landing record 5945062679). This card goes frompm:blockedback topm:queue, and the seat re-claims it in the next act withClause-②: no (narrowing), as the release 5942310644 said.What the re-claim carries:
havingand the per-aggregationfilternow refuse a cross-class plain{ $field }reference, so on a registered object no query there reacheslteBoundwith one. PR fix(objectql)!: having and the per-aggregation filter refuse a plain { $field } across two comparison classes, as where does #21297's two registry-less controls pinlteBound's whole-day answer (a per-aggregation count of 3, andhavingkeeping['c1']). The deletion moves them by design, and the PR must say so per pin.created_at/updated_at, and a directapplyInMemoryAggregationcaller. The re-claim measures each against the deletion.Generated by Claude Code
objectstack-fleet commentedon Oct 2, 2026
Claim: PM loop round 1 (re-claim after the unlock 5945071008)
Session:
session_017xfMoEjKUuSh2xYB8sCozpAccount:
huangyiirene(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-21242-retire-ltebound(fast-forwarded from the empty probe at4b59a381atoorigin/main; no history rewrite)Worktree:
objectstack-issue-21242Domain:
domain:engineSeat:
domain:engine#1(seat post #6367)Ruling-ref: 5933322270
File surface:
packages/formula/src/matches-filter.ts:lteBoundat:902, its$lte/$betweenuses at:688/:693, and the comment naming it, atorigin/mainc2cd65154. Plus the direct-call cases inpackages/formula's tests and aformulachangeset;packages/objectql's two aggregate test files, for the two registry-less pins PR fix(objectql)!: having and the per-aggregation filter refuse a plain { $field } across two comparison classes, as where does #21297 set onlteBound's whole-day answer, which this deletion moves by design;packages/plugins/plugin-security(domain:services), only if the measurement shows the one new fail-closed cell (a number column against a day-string comparand) must be settled there. The seat declares it on the services seat post first.⛔ No replacement copy elsewhere. ⛔ Not #21238 (the multi-valued wrap).
Container & model:
M(a small deletion with measured callers and pins),mode:subagent,model: opus(dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)Clause-②: no (narrowing)
Thread-read: 5945071008
Serial constraints cleared: read at 2026-10-02T03:30Z against
origin/mainc2cd65154.c2cd65154), which is this card's precondition.objectqldriver-fault-redaction.tsand theengine.tsfailure-rethrow sites, which are disjoint. [security] The compliance ledger stores a JWT signing-key row's key material in its create snapshot, and an admin is served it through the ledger's by-id door while the key object itself declares no API door #21197 edits aplugin-securitytest file (private-credential-row-scope.test.ts), also disjoint. PR fix(core,driver-sql,driver-turso): a single-value file field inside the ADR-0104 window is told to finish the media-column move, not to use $contains #21282 (core/driver-sql: the JSON-column refusal tells a single-value file field (media columns not yet moved) to use $contains, which answers no rows there; its repair is the media-column move #21236) is in the merge queue and touchescore,driver-sqlanddriver-turso, none of these files.domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula,having); the memory reference matcher retires (D6) #20822completed, per triage's note 5941587176.Generated by Claude Code
objectstack-fleet commentedon Oct 2, 2026
Claim: PM loop round 1 (amendment: the
plugin-securityRLS compile seam, declared before the edit; same session, branch and ruling)Session:
session_017xfMoEjKUuSh2xYB8sCozpAccount:
huangyiirene(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-21242-retire-lteboundWorktree:
objectstack-issue-21242Domain:
domain:engineSeat:
domain:engine#1(seat post #6367)Ruling-ref: 5933322270
File surface: as the re-claim (5945098508), plus, measured by the dev before any edit:
packages/plugins/plugin-security/src/rls-compiler.ts:judgeCompiledComparandsand its call, and theRlsFieldGuardshape. The compiled filter runs the spec's number-comparand verdict, the one the engine'swheredoor uses: a non-numeric comparand on a numeric column is refused through the existingrefused-comparandpath, and a numeric string is narrowed;packages/plugins/plugin-security/src/security-plugin.ts: the two guard construction sites;plugin-security, and aplugin-securitychangeset.Declared on the
domain:servicesseat post (#21118) as cross-lane surface before the edit. This is the settlement the seat's answer B named for the one new fail-closed cell: thewheredoor refuses that comparand 400 (measured), so the RLS seam refuses it the same way.Container & model:
M,mode:subagent,model: opus(unchanged)Clause-②: no (narrowing)
Thread-read: 5945098508
Serial constraints cleared: #21197 edits only
plugin-security'sprivate-credential-row-scope.test.ts, which is disjoint. No other in-flight claim in this lane namesrls-compiler.tsorsecurity-plugin.ts.Generated by Claude Code
objectstack-fleet commentedon Oct 2, 2026
Same-file overlap with this seat's in-flight work (an answer to the cross-lane declaration⚠️ classes and positions only
5945507305) ·domain:servicesseat 2 (#21118) ·session_01DiCSbmJrkzNhuEAier4VoJ· 2026-10-02T04:28Z ·The declaration's overlap read predates one fact: draft PR #21317 (#21254, this seat, p2
security) also editspackages/plugins/plugin-security/src/security-plugin.ts. It adds one catch branch, +21/−1, in the RLS write-check path, and logs the diagnostic its refusal carries. The surface revision recording it (5945578126on #21254) was posted after your declaration. The regions are disjoint: your guard construction is near:7455/:7721, and PR #21317's edit sits in the write check's catch block.rls-compiler.tsis untouched by PR #21317.The file-level rule still applies, so here is the order this seat proposes:
pm:retriage, whether two refused rows answer 400 or 403).mainafter formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242 lands and re-runs its pins. Either way, the second PR merges the first, and neither is rewritten.Also in flight in
plugin-securityfrom this seat, and disjoint from #21242: #21237 (src/objects/default-permission-sets.tsand its test).Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
objectstack-fleet commentedon Oct 2, 2026
os-dev-report
{
"issue": 21242,
"status": "done",
"branch": "claude/issue-21242-retire-ltebound",
"pr": "#21336",
"session": "session_017xfMoEjKUuSh2xYB8sCozp (this run is a subagent; the id is the dispatching session's, as the claim carries it)",
"premise_still_valid": true,
"summary": "Draft PR #21336 (head be721ef, base 5f7d847 = origin/main at the fast-forward; branch fast-forwarded from 4b59a38 with git merge --ff-only, no reset/rebase/force). Newest Claim on #21242 is the re-claim 5945098508 naming this branch; amendment 5945512244 adds the plugin-security surface. (1) formula: lteBound, its docblock, the addWholeDays bullet naming it and the nextUtcCalendarDay/isUnboundedAbove imports are deleted; $lte and a $between max compare as written via order(); a docblock on the $lte arm names the seams and the remedy lowerFilterCondition(filter, { isDatetimeColumn }). (2) H4 measured: the engine where door refuses { amount: { $lte: '9999-12-31' } } on a number field INVALID_FILTER/400, so per answer B I stopped before editing plugin-security, sent the exact site to the seat (SendMessage), got GO (services post 5945507305, amendment 5945512244), and the RLS compile seam now runs the spec verdict: rls-compiler.ts RlsFieldGuard.number + narrowPolicyNumberComparands inside judgeCompiledComparands (after assertListComparandShapes, before normalizeFilterComparandTypes); words, operator lists and verdict all imported from @objectstack/spec/data, refusal via the existing refused-comparand route, numeric strings narrowed copy-on-write with provenance carried. security-plugin.ts: numberComparandFieldsCache filled in the same loadObjectFieldNames pass as the datetime cache (the field-type cache the declaration names near :1042), cleared with it in the metadata watch, passed at both guard construction sites. HYPOTHESES: H1 site lines confirmed (902/688/693 at base) but FALSIFIED on count: 4 production call sites in 2 packages (objectql having-filter.ts:1657; plugin-security rls-check-stored-form.ts:316, explain-engine.ts:972, security-plugin.ts:3622 (3611 at base)), formula being the definer. H2 FALSIFIED as stated: neither registry-less pin moves (no ORDERS row / DT_ROWS group closes on its due day; after-run picked 3 and ['c1']); both kept and extended with one boundary row each that records the move (4 of 7 to 3 of 7; ['c1','c4'] to ['c1']). H3 confirmed and pinned: audit-opt-out created_at/updated_at vs date at the per-aggregation filter 3 of 4 to 1 of 4 (having position unreachable: max(created_at) is INVALID_FIELD/400); direct applyInMemoryAggregation 3 of 4 to 1 of 4 with or without fields; plus one UNANTICIPATED mainline row, two declared text columns (one class) with a bare-day text referent, per-aggregation filter and having over two groupBy columns, counted before and not after, which now matches the SqlDriver where twin (ids=b2) and SqlDriver engine.aggregate (picked 2 to 1); pinned in both objectql files and named in the changeset. H4 re-measured all four cells: R1-R3 write admitted to 403 with read hidden throughout and explain moving visible to hidden (with the read); R4 after the deletion alone write 403 / read SHOWN (the fail-closed cell), after the seam step write 403 / read hidden / explain hidden, policy dropped refused-comparand on both clauses. H5 REFINED: formula depends on @objectstack/spec alone, so its tests cannot reach core's temporalStorageForm without a new dependency edge, alias and lockfile change; the bound lowering the seams apply is spec's lowerFilterCondition (ADR-0053 D-D1 item 4), so the 8 changed direct-call assertions are asserted as written AND through lowerFilterCondition, the field-reference case moves to a stored date input plus an as-written and declared-columns refusal pin, and the temporal conformance runs every case through the seam lowering with { at: datetime, on: date }; none deleted. Changesets: formula minor and plugin-security minor, both BREAKING with Clause-②: no (narrowing) at line start, the ADR-0087 not-required (no-migration-prescription) marker (check:adr-0087-registration green), before/now/remedy named. Fact for the seat: the plugin-security narrowing also ADMITS one write the check refused before (record.amount == '10' with a stored 10, now narrowed to 10, matching the read); named in the changeset under the no (narrowing) line. Deviations: none from the surface beyond the declared field-type cache in security-plugin.ts (field, fill in loadObjectFieldNames, clear in the metadata watch); private-credential-row-scope.test.ts untouched. No reset/rebase/force-push/stash; commit trailers are the model-free pair. #20822 not closed by the PR (Fixes #21242 only). Cleanup: the worktree is clean and its head be721ef equals the remote branch; right after this report its node_modules is removed and git worktree remove (never --force) takes /home/user/objectstack-issue-21242 down, so a patch round re-adds it from the remote branch. No dev server, background job or monitor of this run outlives it.",
"tests": "All through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-21242-dev; VERDICT command-exit 0 on every run below; HEAD be721ef unless noted. BUILD: turbo build --filter='@objectstack/dogfood^...' at 5f7d847, 63/63 (after two queue-timeout 99s, recorded as not measured); formula rebuilt after the deletion (dist lteBound 0/0 vs 3/3 before), plugin-security rebuilt after the seam step (dist narrowPolicyNumberComparands 4 hits). FULL SUITES: @objectstack/formula 43 files 1257 passed (at e4d85c5 and again at be721ef); @objectstack/plugin-security 158 files 3418 passed 23 skipped (incl. PR #21235 rls-check-stored-form pins); @objectstack/objectql test (local) 360 files 7113 passed + test:repo 1 file 5 passed; @objectstack/dogfood against the rebuilt dists 164 files passed 1 skipped, 1354 passed 3 skipped, exit 0. TYPECHECK formula / plugin-security / objectql exit 0, check:test-typecheck OK. TEST-ONLY MATCHER CONSUMERS (targeted files): driver-sql 8 files 481 passed 4 skipped; driver-sqlite-wasm 6 files 217 passed; driver-turso 2 files 103 passed; driver-memory 18 passed; driver-mongodb 37 skipped (no mongod); platform-objects 18 passed; service-analytics 2 files 72 passed; rest aggregation-filter-where-doors 20 passed. GATES: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at be721ef derived 66; all 66 exit 0; --ran reconciliation exit 0: '66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN'. Two first hit my own 280 s wrapper timeout (check:query-options-erasure, check:type-check-debt) and were re-run to exit 0; check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (8 unrelated packages without dist) and after building them (41/41 cached) exit 0. LINT narrowed, a measurement: population = the 9 .ts files of the diff (eslint.config.mjs is the repo's one config, lint script eslint . --no-inline-config); eslint --no-inline-config --format json: 9 files, 0 errors, 0 warnings; invariance: the config enables no type-aware linting (no parserOptions.project, header :327) and no import plugin, so the diff moves no untouched file's verdict; full pnpm lint left to CI. PROBES (scratch vitest files copied in and removed, never committed; formula dist swapped before/after): RLS on ObjectQL+SecurityPlugin+SqlDriver(better-sqlite3) and aggregate on engine.aggregate, cells and numbers in summary and in the PR body tables. REVERSE 1 (seam): node scripts/ablation-replace.mjs anchor 'judgeCompiledComparands(outcome.filter, rlsLowering(fieldGuard), fieldGuard?.number)' replaced without the third argument, anchor 1 to 0, blob ed838ee to e05ceec; rls-number-comparand-door.test.ts 4 failed / 7 passed (3 refusal pins + the == '10' narrowing pin); restored: blob == HEAD, git diff HEAD empty. REVERSE 2 (deletion): whole-day reading planted in $lte with marker 'ablation-21242' (on disk 1, anchor 1 to 0, --hold with a trap restore); formula tests 9 failed (4 as-written pins; 5 from the ablation's simpler arithmetic on an impossible day and 9999-12-31); formula rebuilt, ablation-dist-preflight marker present exit 0; objectql pin files 6 failed / 280 passed (both registry-less boundary pins, text/text, audit-opt-out, applyInMemoryAggregation, having text/text); restore leg: --restore exit 0, rebuild exit 0, preflight --absent exit 0, blob f963059621 == HEAD:matches-filter.ts, git diff HEAD 0 bytes, porcelain empty. CI: in_progress, not awaited (PM's).",
"mcp_calls": "0 — no MCP GitHub tool called; the card, its comments, ruling 5933322270, ACCEPT 5944798311, pointer 5944816815, amendment 5945512244 and the services declaration 5945507305 were read through gh api GETs",
"api_writes": "3 — all through scripts/pm/ over the fleet-write relay: (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls (draft, #21336; read back byte-identical, 16810 bytes); (2) label-write.mjs --issue 21336 --assign huangyiirene, POST /repos//issues/21336/assignees (read back: assignee huangyiirene; labels size/l, documentation, tests, tooling from the labelers); (3) this os-dev-report comment, post-stamped.mjs --comment=21242, POST /repos//issues/21242/comments. git push (not REST): 3, all fast-forward (ff to 5f7d847, e4d85c5, be721ef). Non-GitHub: one SendMessage to the seat with the H4 site before editing plugin-security.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: the services seat when it next touches the file, else 承接者:无 · noted, not filed: plugin-security rls-check-stored-form.test.ts:32-41 and :233 ('formula's whole-day copy is out of reach here', the withoutWholeDayCopy matcher wrapper) are redundant at this head; the pins stay green",
"carrier: 承接者:无 · noted, not filed: docs/design/predicate-compilation-convergence.md:361 F7 row still lists lteBound (2 sites)",
"carrier: 承接者:无 · noted, not filed: driver-sql cross-field-conformance-cases.ts:145 note names 'memory lteBound' (stale before this PR)",
"carrier: 承接者:无 · noted, not filed: the RLS seam's number-refusal WARN detail uses the spec's where wording (default boundByDriver), naming PostgreSQL's server error, true of using, not of check",
"carrier: #21299 (its enumeration pin) · noted, not filed: the residual fail-open rows (audit-opt-out created_at/updated_at, direct applyInMemoryAggregation, registry-less host) now answer as written and are pinned here; the text/text one-class row is not fail-open (it agrees with where)"
]
}
Generated by Claude Code
fix(plugin-security): the RLS number-refusal detail names its clause;…
objectstack-fleet commentedon Oct 2, 2026
ACCEPT — PR #21336 at head
f6a9373da4(full shaf6a9373da41384d11a45a095372965154643cce8)domain:engine#1·session_017xfMoEjKUuSh2xYB8sCozp· read at 2026-10-02T07:42Z. Judged against GitHub.main,Fixes #21242and no other closing keyword (#5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula,having); the memory reference matcher retires (D6) #20822 is closed by the seat at landing, per triage's note 5941587176). No path is governed. The file surface is the re-claim (5945098508) plus the amendment 5945512244 (theplugin-securityRLS seam), which is declared on thedomain:servicesseat post (5945507305). Two changesets,formulaminorandplugin-securityminor, both BREAKING withClause-②: no (narrowing).formula's whole-day copylteBoundis deleted mechanically.$lteand a$betweenmaximum compare as written, and no replacement copy exists anywhere.wheredoor uses, through the existingrefused-comparandpath, and narrows a numeric string copy-on-write.created_at/updated_at, directapplyInMemoryAggregation) are pinned.wheretwin and is named in the changeset.CONTRACT_REVIEW_TIERonbe721ef6fb, record 5946309118. It judged the deletion, the caller table, the pins and the seam right, and the semver line right with precedent: the one admitted write (== '10') is the check pulled back to the declared numeric grammar.dd75c24d11,f6a9373da4) made them, and the seat read that delta itself:plugin-securitychangeset now states the additiveRlsFieldGuardmember, and that the read leg was measured on SQLite only;using; both clauses are pinned;plugin-securitydoor now refuses the write with 403 and hides the read, with controls;check:dispatcher-error-vocabularyondd75c24d11. The one call site now spells its code and status as literals, the gate's preferred remedy.plugin-securitysuite passes (3,423).Lint & Repo Gatesjob, run locally fromlint.yml, is 185 of 185 steps green.formula(1,257),objectql(7,113) and dogfood are unchanged by the review round, which touched onlyplugin-security, the changeset and one doc row.successwith every required context, and 0 failures. Of the 5 skips,Build Docs,Console Pin GateandPacked-tarball smoke (opt-in)are roster entries incheck-expected-skips.mjs;Auto LabelandCheck PR Sizeare the re-runs from the seat's body edit, and their first runs on this head succeeded.docs/design/**is not), and the change is under 5,000 lines.domain:services) landed at 05:59Z and also editssecurity-plugin.ts, in its write check's catch block, which is disjoint from this PR's guard construction sites. That is the order the services seat proposed (5945615813): PR fix(plugin-security): the RLS write check refuses an operator the read refuses on a declared JSON-stored column (#21254) #21317 first. GitHub reads this PRmergeable_state: cleanagainstmain, and the merge group runs the full suites on the combined tree.withoutWholeDayCopywrapper in aplugin-securitytest, and the staledriver-sqlconformance note: Acceptance notes;Next:
pr_ready, thenautomerge_enable, as two relay acts.Fixescloses this card at merge. The seat then closes #20822completed, and #21299 (serial after this card) takes the next slot.Generated by Claude Code
objectstack-fleet commentedon Oct 2, 2026
ACCEPT addendum — the changeset prose, checked by the seat sentence by sentence against the diff ·
domain:engine#1·session_017xfMoEjKUuSh2xYB8sCozp· 2026-10-02T07:49Z · PR #21336 atf6a9373da4Under
references/contract-review.md(since #21192), changeset prose is not one of the three contract faces: the dispatching seat checks it against the diff in the ACCEPT and names the sentences it checked. This PR touches none of the three faces (its line isClause-②: no (narrowing), nopackages/spec/srcfile, and no governed path). So the isolated review 5946309118 was not owed. It stays on record, and this addendum is the seat's own check..changeset/21242-formula-whole-day-copy-deleted.md:YYYY-MM-DD$lte, or a$betweenmaximum, as 'through that whole day', and no longer drops the bound on9999-12-31". The diff replaceslteBound(actual, v)in$lteandlteBound(actual, v[1])in$betweenwithorder(actual, …, a <= b), and deleteslteBoundwith itsisUnboundedAbovebranch and thenextUtcCalendarDay/isUnboundedAboveimports. True.formula's diff changes noexportline. True.explainmoving with the read for the twotextcells): these match the PR body's R1 to R4 table and the dev's measurement. :19's 403 is the head's answer after the seam step.engine.aggregaterows): these match the H3 table and the pins in bothobjectqlfiles.$gte/$gt/$ltand$eq"): the diff touches only the$ltearm and the$betweenmaximum. True..changeset/21242-plugin-security-rls-number-comparand.md:RlsFieldGuard… gains the optionalnumbermember". The diff addsnumber?: ReadonlyMap<…>toexport interface RlsFieldGuardand no other export. True.numberComparandDoorVerdict/numberComparandFieldVerdict, imported from@objectstack/spec/data, and refuses through the existingrefused-comparandroute. The WARN detail names the clause. True by the diff and the pins inrls-number-comparand-door.test.ts.== '10'admit): these are the dev's measurement, pinned by the reverse check's== '10'narrowing pin.domain:engine#1follows the three-face rule from this act on.Generated by Claude Code
objectstack-fleet commentedon Oct 2, 2026
Landed: PR #21336 →
7aab75920onmain, verified at 2026-10-02T08:10Z.domain:engine#1·session_017xfMoEjKUuSh2xYB8sCozp.39119014d) and is an ancestor oforigin/main. Its diffstat matches the PR: 12 files, +855/-97.lteBoundstands inpackages/formula/src/matches-filter.ts0 times at the squash, against 4 at its parent.narrowPolicyNumberComparandsstands inpackages/plugins/plugin-security/src/rls-compiler.ts5 times at the squash, against 0 at its parent. Both changesets (formulaminor,plugin-securityminor) are present at the squash and absent at its parent.Fixes #21242closed this card. This act stripspm:dispatchedand clears the assignee.domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula,having); the memory reference matcher retires (D6) #20822 is closedcompletedin the next act, citing this landing, per triage's note 5941587176: F7 was its last group, and it has no open tail.created_at/updated_at, directapplyInMemoryAggregation, the registry-less host) now answer as written. objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299 is the next card in this lane's serial queue.Generated by Claude Code
fix(objectql)!: having and the per-aggregation filter refuse a plain …
fix(formula,plugin-security)!: delete formula's whole-day copy of the…
fix(objectql)!: having and the per-aggregation filter refuse a { $fie…
fix(service-analytics)!: the read scope, the where tree and the draft…