[objectstack-fleet]

Fixes #20502
Clause-②: no (narrowing)

What this changes

One verdict, widened, as triage directed on the card: the published number-comparand contract now refuses any comparand compared against a declared numeric field that is neither a number nor a string the numeric grammar admits. The engine door that consumes it is unchanged in behaviour and carries no second rule.

• The verdict, packages/spec/src/data/filter-number-comparand-declared-type.ts. numberComparandDoorVerdict(field, comparand) answers door-refusal (INVALID_FILTER / 400) for a boolean, a Date and an array at a judged position, beside the non-numeric string it already refused. The string rule is byte-for-byte what PR feat(spec): the number-comparand declared-type door's contract and the platform's numeric grammar #20414 published. What still passes: a number, a bigint (the comparand-type door narrows it one call later), null (the null test), and every value outside the comparand-type door's accepted set (undefined, a plain object, a { $field } reference, a Map), which that door already refuses on every field in its own words (see Objects below).
  • Three additive exports: NON_NUMERIC_VALUE_FORMS (boolean, date, array) and the types NonNumericValueForm / NonNumericComparandForm. The refusal's form and the refusal site's value widen to carry a non-string.
  • Three refusal clauses, each stating only what was measured; a Date renders as Date(ISO) so it does not read as the quoted string the grammar refuses.
  • The derived case table gains a value group: false at $gt on every judged field, true and a Date at every judged position of f_number, an array at every judged position except the equality slots (implicit, $eq, $ne, where the comparand-shape door refuses an array one door earlier), and four passing rows (the null test twice, a boolean on a boolean field, a Date on a datetime field). filterAt now gives each filter its own copy of a Date or an array.
  • One table-derivation fix the engine suite caught: the table's unjudged rows carry the flag operators' booleans ($null: true, $exists: false, $empty: true), which the door never hands to the verdict. The table now asks whether the slot is judged before consulting the verdict, so those rows stay passes. The engine never refused them; only the table's label would have been wrong.
• The door, packages/objectql/src/number-comparand-declared-type-door.ts: the refusal site carries value: comparand instead of comparand as string, plus comments. No rule was added or changed; the compiled walk is the same.
• Tests: the spec contract suite, the objectql door suite and the REST three-dialect suite (below).
• Generated: packages/spec/api-surface/data.json and export-origins/data.json, three added lines each, regenerated by gen:api-surface / gen:export-origins after check:generated named exactly those two.
• Changeset: .changeset/20502-number-comparand-non-string.md, @objectstack/spec and @objectstack/objectql minor, BREAKING banner, a FROM → TO line, the ADR-0087 disposition not-required (no-migration-prescription).

Before and after

A declared number field, rows 5, 12 and 30. Measured through engine.find / engine.aggregate and POST /api/v1/data/:object/query (the two doors agree), on InMemoryDriver, SqlDriver on SQLite and SqlDriver on PostgreSQL 16. Before: base 4a1df19656. After: this branch at 0dc69019da.

position	comparand	before: memory · SQLite · PostgreSQL	after, all three
where	$gt true (the card)	no rows · every row · 500 DATABASE_ERROR	400 INVALID_FILTER
where	$gt false	no rows · every row · 500	400
where	$eq true / implicit true	no rows · no rows · 500	400
where	$ne true	every row · every row · 500	400
where	a $in member true	no rows · no rows · 500	400
where	$between [true, 20]	no rows · two rows · 500	400
where (in-process)	$gt / $eq / implicit / a $in member, a Date	no rows · no rows · 500	400
where	$gt [1], $lt [100]	400 in each driver's own words (SQL withholds the detail)	400 in the contract's words
where	a $in member [1]	no rows · driver 400 · driver 400	400
per-aggregation filter	$gt true / $gt [1]	count 3 on all three	400
per-aggregation filter	$gt a Date	count 0 on all three	400
having on sum(amount)	$gt true / $gt [1]	every group on all three	400
having on sum(amount)	$gt a Date	no group on all three	400
all three positions	$gt 10 (the numeric control)	2 rows / count 2 / both groups	the same
where	$gt {"a":1}, a $in member {"a":1}	400, the comparand-type door	the same, same words
where	$eq null	no rows	the same

The per-aggregation filter and having rows are the engine's own evaluator on every driver, which is why they agree across drivers before the change: JS coercion read true and [1] as 1.

Premise check, and the dispatch's hypotheses

• H1 holds. The card's table reproduces at 4a1df19656 on all three drivers (rows above), through REST and engine.find. PostgreSQL ran on a private PostgreSQL 16 cluster in this container (the same major as the Temporal Conformance (live PG + MySQL) job's postgres:16 service), started for this run and stopped after it.
• H2 holds: the door had no second rule. Its only routing is the verdict (judgeComparand calls numberComparandDoorVerdict and turns the answer into an outcome); the one assumption it carried was the type cast comparand as string, erased at compile time. Widening the verdict alone reaches where (both spellings), the per-aggregation filter and having: the door file's diff is that cast plus comments, and the after-state above is uniform.
• H3, the producer census: no real producer. git grep over examples/** and packages/** for a filter comparing with a boolean, a Date or an array (filter rules, FilterArray triples, $op literals), then each named field's declared type: every non-test hit names a boolean field (active, is_active, archived, ...) or a date field, or sits in driver-internal code. The one number-field hit, amount: { $gt: new Date(0) } in driver-sql's sql-driver-cross-field-reference.test.ts, calls SqlDriver directly, beneath the engine door, and stays green (driver-direct callers keep native binding, as the changeset says). No fixture needed triage.

Objects: served by the comparand-type door, deliberately

Triage's list names objects. Measured on the base, an object comparand against the number field is already refused with INVALID_FILTER / 400, naming the path, on all three drivers and at all three positions, by the comparand-type door (normalizeFilterComparandTypes), and at the REST ingress with VALIDATION_FAILED. The widened verdict passes such a value instead of refusing it a second time, for one measured reason: the engine runs the two doors in a different order per position (this door first on the object spelling of where and on a per-aggregation filter; the comparand-type door first on the FilterArray spelling and on having). A second refusal here would answer one mistake with two sets of words depending on where it was written, and would change the comparand-type door's pinned words for every numeric field. The engine suite pins it: for a plain object, undefined and a Map, the engine's message equals the comparand-type door's own message, on both spellings.

Tests (at 829106fd06, the final head, unless noted)

Every package run below is at 829106fd06 (this branch merged with origin/main 31d281d3b2 through scripts/pm/os-regen-merge.sh, whole workspace rebuilt: 72/72). Each run went through scripts/pm/os-verify-lock.sh; exit codes are the lock's VERDICT command-exit lines.

• @objectstack/spec: filter-number-comparand-declared-type.test.ts 41/41. --project local 573 files, 16842 passed, 1 todo. --project repo: 39 files, 701 passed.
• @objectstack/objectql: engine-number-comparand-declared-type-door.test.ts 34/34. --project local 332 files, 6641 passed. --project repo 1 file, 5 passed.
• @objectstack/rest, with OS_TEST_POSTGRES_URL set: data-number-comparand-door.test.ts 8 passed, 4 skipped (the MySQL cell); the SQLite and PostgreSQL cells both ran. --project local 222 files, 4256 passed, 22 skipped. --project repo 1 file, 8 passed.
• @objectstack/driver-sql, the whole suite under TZ=America/New_York against the live server set to Asia/Shanghai (the Temporal Conformance job's provisioning): 206 files, 3997 passed, 93 skipped (3 files skipped).
• @objectstack/driver-memory: 59 files, 1419 passed.
• Typecheck: pnpm --filter @objectstack/spec typecheck, @objectstack/objectql and @objectstack/rest: exit 0, and check:test-typecheck holds each ledger with no debt added (spec 53 files / 251 errors, objectql 40 / 234, rest 0 / 0).
• Lint, a proven narrowing (the repo-wide pnpm lint is CI's): ① population from eslint.config.mjs itself: all 5 touched lintable files answer isPathIgnored false; the other 3 changed files are JSON / Markdown, outside its globs. ② eslint --no-inline-config --format json over them: 5 files, 0 errors, 0 warnings. ③ The config never enables type-aware linting (no parserOptions.project, no projectService), so this diff cannot move any untouched file's verdict.
• Before/after table: a scratch script against the built packages, not a committed test; the after column was taken at 0dc69019da (this change before the later case-table fix, which changes test data only) and is re-pinned at the final head by the REST suite's SQLite and PostgreSQL cells and the objectql suite.

Ablation (reverse verification)

From the committed head 829106fd06, with scripts/ablation-replace.mjs in wrap mode (the mutation lives only while the tool's trap is armed). The mutation removes the widening at its one routing line in the verdict: if (form === null) return { verdict: 'passes' }; becomes the same line with || globalThis.ABLATION_20502 === undefined added to its condition (spelled with a cast to a string-keyed record so the DTS pass type-checks it), so every non-string comparand passes again. The string rule is untouched.

• Mutated leg: anchor 1 → 0, blob fdb42a2a → 55919fda. After pnpm --filter @objectstack/spec build, ablation-dist-preflight found the marker in 4 built files (exit 0). Result: the spec suite had 5 failed, 36 passed; the objectql door suite 4 failed, 30 passed; the REST door suite 2 failed, 6 passed, 4 skipped, one failure each for the SQLite and PostgreSQL cells. Every failure is a new non-string pin, or the objectql guard that counts the refused forms. Every string pin and every numeric control stayed green.
• Restore leg: the blob is back to fdb42a2a (the HEAD blob), git diff HEAD is empty and git status --porcelain is clean. After a rebuild, ablation-dist-preflight --absent found the marker absent from all 224 built files and the tree clean. The three suites passed again: 41/41, 34/34, and 8 passed with 4 skipped.
• A first attempt that did not count. It spelled the marker as a constant, || 'ABLATION_20502'. The suites went red the same way, but ablation-dist-preflight answered exit 1 because the marker was absent from dist/: spec's tsup config runs with treeshake: true, and the bundler folded the constant condition away together with its marker. The mutation was therefore not proven to have reached the built artifact, so that reading is discarded. The redo above uses a globalThis property read, which the bundler cannot fold because the read could have side effects. I checked that it survives an esbuild bundle even with minifySyntax, and the preflight found it in dist/.

Gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 829106fd06 derives 88 commands (the 86 derived before the merge, plus check:generated and check:pm-widening-tells, which the merged gate map added). All 88 ran, and each exit code was captured before any pipe: 88 exited 0. That includes check:dual-build-cjs-loads and check:type-check-debt, which answered exit 3 (PREREQUISITE NOT MET) before the whole workspace was built. Reconciliation with dispatch-gates --ran (recorded as command :: exit N): 88 derived, 88 run, 0 NOT-MEASURED, 0 UNRUN, and that zero is derived from the recorded codes. check:adr-0087-registration reads the changeset as [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription). check-changeset-no-major: no major bump.

Acceptance notes

• InMemoryDriver. Its cell is pinned by construction in the objectql door suite: the door answers before any driver is resolved, and the suite's recording driver asserts no read. Its live before/after rows above come from a scratch run against the built packages. A permanent real-InMemoryDriver cell would need a new dependency edge (@objectstack/rest or @objectstack/objectql on @objectstack/driver-memory), which this change did not add.

• PostgreSQL in CI. No CI job provisions OS_TEST_POSTGRES_URL for @objectstack/rest, so the REST suite's PostgreSQL cell is red-capable and un-run in CI (the predecessor PR recorded the same). It ran locally here, against the private cluster.

• MySQL: NOT MEASURED. No MySQL server in this container; the REST suite's MySQL cell is a named skip.

• having words. A numeric aggregated column has no declared type; the door hands the verdict number, so the words read "compares a declared number field" for having.total.$gt. Inherited from the predecessor, unchanged.

• The flag operators. $null / $exists / $empty take a boolean and are never judged; pinned in both the spec suite and, through the table, the engine suite.

• Out of scope, measured and handed to the seat, not filed here: a plain object with no $ key in a scalar field's value position, where { amount: { "a": 1 } }. This is filter STRUCTURE (a nested-relation / deep-equality condition), which no field-aware door descends into. On the base it answers 200 with no rows on InMemoryDriver and a driver 400 on SQLite and PostgreSQL, through POST /api/v1/data/:object/query and engine.find. It is not specific to numeric fields, and this change leaves it as it was.

• The save-time door, one family over. No lint or save rule reads the number verdict, so a stored filter comparing a number field with a string, and now also with a boolean or an array, saves clean and is refused at query time. The predecessor's report already carries that family. This change widens its population, and the census above found no in-repo producer of the new shapes.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/objectql, @objectstack/spec, touching 22 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/spec/api-surface/data.json, packages/spec/export-origins/data.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/data-api.mdx (via INVALID_FILTER (literal, a string literal in numberComparandDoorVerdict))
• content/docs/api/error-catalog.mdx (via INVALID_FILTER (literal, a string literal in numberComparandDoorVerdict))
• content/docs/deployment/validating-metadata.mdx (via INVALID_FILTER (literal, a string literal in numberComparandDoorVerdict))
• content/docs/protocol/objectql/query-syntax.mdx (via INVALID_FILTER (literal, a string literal in numberComparandDoorVerdict))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-1.mdx (via INVALID_FILTER (literal, a string literal in numberComparandDoorVerdict))
• content/docs/releases/v17/17-4.mdx (via INVALID_FILTER (literal, a string literal in numberComparandDoorVerdict))
• content/docs/releases/v17/17-5.mdx (via INVALID_FILTER (literal, a string literal in numberComparandDoorVerdict))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/spec/api-surface/data.json, packages/spec/export-origins/data.json) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 138 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 288611e3e58f6d8af50b889abcdde3e413e0eaa0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 4757b433e7745bf7d6dee3c184cce564fa11761a — the merge of head 829106fd061463f52c1c56b91883690d390d078b into base 288611e3e58f6d8af50b889abcdde3e413e0eaa0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4757b433e7745bf7d6dee3c184cce564fa11761a && git checkout 4757b433e7745bf7d6dee3c184cce564fa11761a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 288611e3e58f6d8af50b889abcdde3e413e0eaa0 829106fd061463f52c1c56b91883690d390d078b && git checkout -B drift-repro 288611e3e58f6d8af50b889abcdde3e413e0eaa0 && git merge --no-ff 829106fd061463f52c1c56b91883690d390d078b

node scripts/docs-audit/affected-docs.mjs --json 288611e3e58f6d8af50b889abcdde3e413e0eaa0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 288611e3e58f6d8af50b889abcdde3e413e0eaa0 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 829106fd061463f52c1c56b91883690d390d078b
Local-runs: none

Read: card #20502 (body, triage grade 5877498426, claim 5878166283, os-dev-report 5882074829), card #20510 (body and triage 5879512564), PR #20545 (body, comments, file list, the 8-file net diff against the merge-base), the source at the head that the diff touches or calls (packages/spec/src/data/filter-number-comparand-declared-type.ts, filter-comparand-type.ts, filter-comparand-shape.ts, filter.zod.ts, packages/objectql/src/number-comparand-declared-type-door.ts, engine.ts, the three test files, .github/workflows/ci.yml / lint.yml / pr-automation.yml), and the check-runs on the head, read once at 2026-09-29T01:55Z. Rendered at 2026-09-29T01:58Z.

① Derived judgments

1. The narrowing, at the one rule. numberComparandDoorVerdict(field, comparand) now answers door-refusal (INVALID_FILTER, 400) with form boolean / date / array for a boolean, a Date (valid or invalid) or an array, on a judged field only: numberComparandFieldVerdict runs first and a not-judged field answers passes before the comparand is looked at, so every non-numeric field type is untouched (pinned across BOOLEAN_VALUE_TYPES, CALENDAR_DATE_TYPES, INSTANT_TYPES, STRING_VALUE_TYPES with true, a Date and [1]). The string arm is the same readNumericString path as before, byte for byte, so a numeric string still narrows and a non-numeric string is refused with its old form. Still passes: a number, a bigint, null, undefined, a plain object, a { $field } reference, a Map, a symbol, a function. Right.

2. Positions and the flag operators. The objectql door's judgeFieldSpec hands the verdict the implicit comparand, the six scalar operators from NUMBER_COMPARAND_DOOR_SCALAR_OPERATORS, and each member of $in / $nin / $between; every other operator key is continued, so $null / $exists / $empty booleans never reach the verdict and are not refused. A $between [true, 20], a $in [10, true] and a $in [[1], 10] are refused member by member. Right (objectql suite drives the table's unjudged rows end to end and they pass; the REST suite drives the list shapes over the wire).

3. One rule, no second rule, no driver change. The objectql door file's diff is the cast comparand as string → value: comparand plus comments; judgeComparand still routes on numberComparandDoorVerdict alone and turns narrows / door-refusal into an outcome. No file under any driver package is in the diff. Right.

4. Every judged position routes through the door, read off engine.ts at the head: object-form where (narrowNumberComparands at :1024, then the comparand-type door at :1034), FilterArray where (:1110, after parseFilterAST, which itself ends in normalizeFilterComparandTypes at filter.zod.ts:2776), the per-aggregation filter (:16362 rooted at aggregations[i].filter, then the type door at :16387), having (narrowHavingNumberComparands at :16495 over the columns aggregatedRowColumnClasses classes numeric, after the type door at :16470 and the shape door at :16453). All six verbs and judgeFilter share lowerWhereFilterArray. Right.

5. The dev's open question (objects, undefined, a Map), answered from the code. The comparand-type door refuses each at every literal position: judgeLiteralComparand refuses undefined by name, and refuses anything that is neither in isAcceptedFilterComparand's set nor an array nor a { $field } reference (a Map is a comparand there, not structure: isFilterNode is prototype-based). It runs on the object-form where, inside parseFilterAST for the FilterArray spelling, on the per-aggregation filter and on having, and the door ORDER really differs per position exactly as the dev says (number door first on object-form where and the per-aggregation filter; type door first on FilterArray and having). So a second refusal in the number verdict would answer one mistake in two vocabularies depending on where it was written. The objectql suite pins that the engine's message EQUALS normalizeFilterComparandTypes' own for a plain object, undefined and a Map, on both spellings, with no read. Option A is sound; no comparand position lets an object through. The one object shape that passes every door is { amount: { "a": 1 } } (a plain object with no $ key in the field's value position): that is filter STRUCTURE, which no field-aware door descends into, pre-existing, not numeric-specific, and unchanged by this diff (the dev's out-of-scope finding; ③6 below).

6. Arrays at the equality slots. The comparand-shape door (filter-comparand-shape.ts, the implicit / $eq ruling and the $ne arm) refuses an array one door earlier at every position; the verdict still answers door-refusal for it (one rule), and the derived table omits those rows via isEqualitySlot so the engine suite pins the door that actually speaks. Right.

7. The case-table change. caseFor now consults the verdict only for a judged slot (isJudgedSlot); without it, the widened verdict would have labelled the unjudged rows ($null: true, $exists: false, $empty: true) door-refusal while the engine never judges them. A correctness fix in the table derivation inside the claimed file, not a rule. Pinned three ways: the spec suite's per-case verdict check now asks the position first, a new spec test pins the three flag rows as passes while the same boolean at a judged slot is refused, and the objectql suite drives the passes rows to the recording driver unchanged ($empty at the door alone, as before).

8. Words and rendering. comparandPreview renders a Date as Date(ISO) / Date(Invalid Date) and everything else through the shared shapePreview (JSON, 60-char bound); mustMention and the message use the same renderer; the 500-char bound is re-pinned with the longest non-string values. The three new clauses carry no tracker number (pinned). Right.

9. Public surface. Three additive exports (NON_NUMERIC_VALUE_FORMS, NonNumericValueForm, NonNumericComparandForm) and three widened members (NumberComparandDoorVerdict.form, NumberComparandRefusalSite.value: unknown from string, .form; NumberComparandDoorRefusalCase.form). api-surface/data.json and export-origins/data.json each carry exactly the three new names, in sort order; the widened members keep their names so no other entry moves. Consumer census of the widened value at the head (packages, services, apps; tests excluded): no reader outside the two claimed files, so nothing downstream stops compiling. Right.

10. Pins, cell by cell. Spec suite: the verdict for every judged type × 7 non-string values, the pass list, the non-numeric field types, rendering, table shape, per-filter copies of a Date / an array. Objectql suite (recording driver, InMemoryDriver's answer by construction since the refusal precedes driver resolution and zero reads are asserted): the whole table end to end; true / false / a Date / [10] at the per-aggregation filter ($gt, $lte) and at having over count / sum / a numeric min; FilterArray sugar and $and / $or / $not; judgeFilter; the numeric control at all three positions (driver receives $gt 10, count 2, groups r2 / r3). REST suite: 9 JSON-carried non-string shapes at where over the wire, true / a Date / [1] in-process at where, the per-aggregation filter and having (native and rows paths × total / top), the wire boolean at filter and having, zero reads, and the numeric control unchanged. Each new pin asserts code AND status, the field, and the position path. Which cells run in CI: SQLite, in Test Core. PostgreSQL: a named skip in CI for @objectstack/rest (ci.yml provisions OS_TEST_POSTGRES_URL for driver-sql, metadata-protocol and one runtime file only), so the PostgreSQL row's evidence is the dev's local PostgreSQL 16 run at this head; the cell is red-capable wherever the variable is set. MySQL: a named skip everywhere, NOT MEASURED. Memory: by construction only (no real InMemoryDriver cell; packages/rest and packages/objectql declare no driver-memory edge, as the dev says).

② Semver level

• @objectstack/spec minor: three additive exports (minor on their own) and a published verdict that narrows (BREAKING, shipped minor under the launch-window convention that check-changeset-no-major applies to a declared (narrowing)). Right.
• @objectstack/objectql minor: its source change is a cast, but its published behaviour narrows (the engine refuses more at every position); a patch would understate a declared narrowing and major is the launch-window guard's refusal. Right.
• Not skip-changeset: both packages publish and both carry the changeset. Right.
• Clause-②: no (narrowing), in the PR body and the changeset: clause ② is a new key on a published payload; three TS exports are not one, and the arm names the accept-set narrowing. Right. The fix(spec)!: title and the **BREAKING** banner agree with it.
• ADR-0087 not-required (no-migration-prescription): nothing an author writes is removed or renamed (the verdict function, the table and the words keep their names; exports are only added), no stored row is read or rewritten, and a stored filter that compares a number field with true cannot be rewritten by a ledger entry because the number it meant is unknowable. The other categories are closed on facts as the marker says. The FROM → TO line is a before / after of the ANSWER, not a rewrite of a spelling, and check-adr-0087-registration (run by Check Changeset on this head, success) reads it that way, as it did for the predecessor door's changeset on main. Right.

③ Boundary flags

1. Objects left to the comparand-type door (dev open question, options A / B): answered in ①5, option A is sound and pinned. Not escalated.
2. Memory cell by construction: accepted. The door answers before any driver is resolved and the suite asserts zero reads, so InMemoryDriver's row is structurally every driver's; a real InMemoryDriver cell would test the driver, not the door, and would need a dependency edge neither package has. Not escalated.
3. Case-table fix inside the file surface: a correctness fix, pinned (①7). Not escalated.
4. PostgreSQL not in CI for @objectstack/rest, MySQL not measured: verified from ci.yml; the PostgreSQL row rests on the dev's local run at this head plus the fact the refusal precedes the driver. Named, not a FAIL: the shape the predecessor landed with, and nothing in this diff binds anything to a driver.
5. The having and per-aggregation filter words, and card spec: the number-comparand refusal says "a declared number field" and "PostgreSQL with a server error" at having and the per-aggregation filter, where the column is aggregated and the engine evaluates the clause on every driver #20510. This diff does NOT do what spec: the number-comparand refusal says "a declared number field" and "PostgreSQL with a server error" at having and the per-aggregation filter, where the column is aggregated and the engine evaluates the clause on every driver #20510 asks, in either part: the refusal at having still reads compares a declared number field (the objectql suite pins that phrase at having.total.$gt), and the two NEW clauses (boolean, date) carry (PostgreSQL with a server error) at every position, including having and the per-aggregation filter, where the engine evaluates the clause; only the array clause is free of it. So spec: the number-comparand refusal says "a declared number field" and "PostgreSQL with a server error" at having and the per-aggregation filter, where the column is aggregated and the engine evaluates the clause on every driver #20510 proceeds after this landing, with its population grown by the two new clauses, and its fix will move the objectql having pin and the REST where phrase pin. Not this card's scope (triage made spec: the number-comparand refusal says "a declared number field" and "PostgreSQL with a server error" at having and the per-aggregation filter, where the column is aggregated and the engine evaluates the clause on every driver #20510 serial after it); not a FAIL here.
6. Out-of-scope finding handed to the seat, not filed: where { amount: { "a": 1 } } answers 200 with no rows on InMemoryDriver and a driver 400 on SQLite / PostgreSQL through REST and engine.find, measured on the base and unchanged at the head. Filter structure, not a comparand, not numeric-specific. It is a class (a) defect with a measured reach, so it is the seat's to file (or dedupe), per Prime Directive chore: version packages #10. Not escalated; the seat owns the filing.
7. The save-time door (no lint or save rule reads the number verdict; the population now includes a stored boolean or array): the family the predecessor's report already carries, noted.
8. Generated artifacts and merges: the only generated files the diff touches are the two spec artifacts (①9), both in sort order; the second merge went through os-regen-merge.sh. Lint & Repo Gates is CI's reading of that family and had not concluded at the read.
9. Check-runs on the head at the read: 33 runs, 25 concluded (22 success, 3 skipped: Build Docs, Console Pin Gate, Packed-tarball smoke), none red. Answered green: Build Core, Check Changeset (check-empty-changeset, check-adr-0087-registration, check-changeset-no-major), Type Check source gates / consumer gates / debt ledger, Spec property liveness, Governed Surface Queue Guard, Temporal Conformance (driver-sql on live PostgreSQL / MySQL, not this diff's REST cells), Dogfood Regression Gate 1–3 and Dogfood Verify CLI, Check PR Size, Check Documentation Links, the claim / single-writer / part-of guards, Auto Label, Flag docs. Not concluded at the read, not presumed green: Lint & Repo Gates (eslint and the repo check:* family, including the generated-artifact checks), Test Core (1/6) through (6/6) (the spec, objectql and REST SQLite pins in CI), Type Check · workspace. Their conclusions are the gate verdicts the seat reads before enqueue.

Implemented-by: claude/issue-20502-number-comparand-non-string
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code