fix(objectql)!: refuse an engine where that is not a filter before any driver call — a string, number or Map where on a multi-row update or delete rewrote or removed every row

[objectstack-fleet]

Fixes #20121
Clause-②: no (narrowing)

Write verbs first — the base reading: a whole-table rewrite and a whole-table delete

Measured on origin/main a08e059c61 before any edit, through the real ObjectQL, four rows seeded (two per owner), on driver-memory and on SqlDriver (better-sqlite3 :memory:). The rows touched were read back past the engine.

call	no SecurityPlugin	SecurityPlugin, system context	SecurityPlugin, RLS-scoped member
update(o, {name:'Z'}, { where: 'amount > 100', multi: true })	4 of 4 rewritten (both drivers)	4 of 4 rewritten (both drivers)	refused by the driver, INVALID_FILTER, 0 rewritten
same with where: 42 / where: new Map(...)	4 of 4	4 of 4	refused by the driver, 0
delete(o, { where: 'amount > 100', multi: true })	4 of 4 deleted (both drivers)	4 of 4 deleted (both drivers)	refused by the driver, INVALID_FILTER, 0 deleted
same with where: 42 / where: new Map(...)	4 of 4	4 of 4	refused by the driver, 0
either write, where: [1, 2, 3]	refused, code/status undefined, 0	same	same
either write, same shapes, no multi	refused: "Update/Delete requires an ID or options.multi=true" (no code), 0	same	same
control: where: { amount: { $gt: 100 } } or [['amount','>',100]], multi: true	2 of 4	2 of 4	1 of 4 (the member's own row)

• Path: the multi-row path. update() and delete() lower at the [#5158] comment ("Lower before the by-id extraction below reads where.id" / "Same ordering reason as update()"), then resolveEngineUpdateDispatch / resolveEngineDeleteDispatch look for a where.id only in an object where, find none, and return { kind: 'multi' } on options.multi. The seeded AST carries the string, and the driver's updateMany / deleteMany ignores it.
• "Every row the caller can reach" holds without SecurityPlugin and under a system context with it. For an RLS-scoped caller it depends on the value:
  • A string, number or Map (and a Date, Set or true) is AND-composed by the security middleware into $and, where the driver's node gate refuses it: 0 rows.
  • The empty string is NOT refused. The composition (security-plugin.ts, opCtx.ast.where ? { $and: … } : …) reads a falsy where as absent and drops it, so the member's '' read all 2 of their rows, and update(multi) / delete(multi) rewrote or deleted 2 of 4 on both drivers: every row the member could reach.
• A second door stepped around, too: the unscoped-write guard (dispatchUnscopedMultiWriteHooks, the sys_attachment / sys_comment predicate-less-write refusals) treats only an absent or null where as unscoped, so a string / number / Map where skipped that guard while the driver treated it as no predicate at all.

The re-grade to p0 is the seat's act; this PR lands the refusal.

What changed (read from the code at the head of this branch)

packages/objectql/src/engine.ts, lowerWhereFilterArray only:

1. A shape gate at the top of the seam. A where that is not undefined, not null, not an array and not a filter object is refused with invalidFilterError (the package's existing ADR-0112 builder: code: 'INVALID_FILTER', status: 400, httpStatus: 400). All six verbs (find, findOne, count, aggregate, update, delete) call the seam before they resolve a driver, so the refusal comes before any driver call. The message uses the wire door's words: VERB('OBJECT'): 'where' must be a filter object or condition array, received string "amount > 100". It was not applied, and an unapplied filter would have returned the unfiltered result set. For update / delete, the last clause reads updated every row in scope / deleted every row in scope.
2. The non-filter-array branch carries the same envelope. Its message is unchanged; it now throws through invalidFilterError instead of a bare Error.
3. The accept set is decided by isWhereFilterObject: a non-array object whose built-in tag (Object.prototype.toString, which reads Symbol.toStringTag through the prototype chain) is [object Object]. That covers a plain object, Object.create(null), a class instance, a Proxy of one, and an object from another realm. An object that overrides Symbol.toStringTag, own or inherited, is refused and named by its tag (H4 below).

No new export, no new error code, no change to the drivers, to the REST door, to the filter alias or to the having region. The docblock hunk draft PR #20125 edits is not touched.

H4 — every where shape, base answer and head answer

Measured on both drivers with no security; find / update(multi) / delete(multi) shown (count and aggregate follow find).

shape	base	head
string, number, Map	dropped: 4 rows read / 4 rewritten / 4 deleted	INVALID_FILTER / 400, 0 driver calls
non-filter array [1,2,3]	refused, code / status undefined	INVALID_FILTER / 400, 0 driver calls
Date, Set, true, ''	dropped: 4 / 4 / 4	INVALID_FILTER / 400, 0 driver calls
undefined, null	no filter: 4 / 4 / 4 (declared unscoped)	unchanged
{}, []	no filter: 4 / 4 / 4	unchanged
Object.create(null) with the filter	filters correctly: 2 / 2 / 2	unchanged, accepted
an author's class instance with the filter on own keys	filters correctly: 2 / 2 / 2	unchanged, accepted
an object overriding Symbol.toStringTag (own or inherited) with the filter on own keys	filters correctly: 2 / 2 / 2 (contract review's reading)	INVALID_FILTER / 400, received Criteria — the one correctly-answering shape this narrows; no producer in the repo creates one

• null stays accepted: findOne's no-predicate guard and the unscoped-write detector both already read null as absent.
• '' is refused, although the wire door reads a blank ?filter= as absent. At the engine, '' deleted every row while the unscoped-write guard read it as scoped. Under RLS it was not refused either: the security middleware dropped it as absent, and the member's every reachable row (2 of 4) was rewritten or deleted. The wire door's normalizer deletes a blank ?filter= before the engine sees it; other REST paths were not measured for ''.
• findOne keeps its own no-predicate refusal (no code) for null / undefined / {} / [], exactly as at base.

H3 — other doors that take a caller where (census, base and head, driver-memory, bad value 'amount > 100', control { amount: { $gt: 100 } })

door	on this seam?	base	head
createContext().object(o).find / .delete({ multi: true })	yes, forwards to the engine	4 rows / 4 deleted	refused INVALID_FILTER / 400 (pinned)
analytics auto-bridge (engine.aggregate(o, { where: filter }))	yes, by reading service-analytics plugin.ts	follows aggregate	follows aggregate
aggregate aggregations[].filter	no, its own loop	string dropped: every group counts all rows	unchanged — Acceptance notes
a beforeFind hook assigning ctx.input.ast.where	no, runs after the seam	4 rows	unchanged — Acceptance notes
a middleware assigning opCtx.ast.where	no, runs after the seam	4 rows	unchanged — Acceptance notes
a beforeUpdate / beforeDelete hook assigning input.options.where on multi: true	no	inert: the predicate path had already seeded its AST (2 rows, same as control)	unchanged
updateMany / deleteMany / upsert / distinct on the engine	—	not engine verbs (upsert and distinct are retired)	—

Tests (at aa923a1f5c, the code head, unless noted)

Head 2bd379d22a changes only the changeset prose, after contract review 5831634153. engine.ts (4f5d28170b) and both pins are blob-identical to aa923a1f5c, so every test reading below stands for the head.

• New unit pin packages/objectql/src/engine-where-shape-refusal.test.ts, 47 cases, all through a counting driver double: 6 verbs × 4 bad shapes, each asserting code, status, the VERB('deal') prefix, zero driver calls and an unwritten table; 6 × 2 controls; the scoped-repository door; five accepted edge shapes; five refused edge shapes on delete(multi). Run together with engine-filter-array-lowering.test.ts: Test Files 2 passed (2) · Tests 107 passed (107).
• New dogfood pin packages/qa/dogfood/test/engine-where-shape-refusal.test.ts: update(multi) and delete(multi) × the 4 bad shapes on SqlDriver (better-sqlite3), reading the table through knex; plus two controls. Against the base objectql/dist: 8 failed | 2 passed (the 6 string/number/Map cells: "expected the engine to refuse, and it answered"; the 2 array cells: expected undefined to be 'INVALID_FILTER'). After rebuilding objectql: 10 passed (rerun at the head: 10 passed).
• @objectstack/objectql whole suite (both vitest projects), at 6485915e34: Test Files 317 passed (317) · Tests 5499 passed (5499). Between that commit and the head, only the new test file changed: one repository case was added, and the double now honours limit and refuses combinators. engine.ts did not change.
• @objectstack/plugin-security whole suite, at 6485915e34 against the rebuilt objectql dist/: Test Files 135 passed (135) · Tests 2685 passed (2685).
• Dogfood tests that exercise an engine where, at 6485915e34, a declared subset (CI's Dogfood Regression Gate runs all of them): the new pin, attachments-unscoped-delete-gate, bulk-widener-probe, owner-anchor-and-bulk-writes, authored-row-write-scope, comments-permission-matrix, attachments-permission-matrix, owd-public-read-write-write-floor, hook-runas-fls, showcase-crud-persona-matrix: Test Files 10 passed (10) · Tests 131 passed | 1 skipped (132). The skip is the pre-existing describe.skipIf(!organizationsAvailable) in attachments-permission-matrix.
• pnpm --filter @objectstack/objectql run typecheck green, including check:test-typecheck (ledger held, 40 files / 234 errors / 65 signatures); the new test file is in the tsconfig.test.json program (--listFiles). pnpm --filter @objectstack/dogfood run typecheck green.
• check-changeset-no-major --base a08e059c6: no major. check-adr-0087-registration --base a08e059c6: 1 declared-breaking changeset, disposition not-required (no-migration-prescription).

Ablation, run at 544762f243 (the 46-case pin, before the repository case was added), both legs through scripts/ablation-replace.mjs (anchor hits verified on disk, restore proven by blob equality with HEAD and an empty git diff HEAD), with the fix committed first:

1. Shape gate disabled (the if (where !== undefined && … !isWhereFilterObject(where)) line → if (false)): 23 failed | 23 passed (46). Exactly the 18 string/number/Map cells plus the 5 refused edge shapes turned red; the 6 array cells stayed green on the array branch. Predicted direction, observed.
2. The array branch's invalidFilterError( → new Error(: 6 failed | 40 passed (46), exactly the six non-filter-array cells.

Gates

• Derived from the real diff at aa923a1f5c with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (4 paths vs merge base a08e059c6): 68 commands, all exit 0, captured before any pipe. --ran reconciliation: 68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN, a zero derived from the recorded exit codes.
• The first pass at c51cd3d02b turned up two real reds, both in the new test double: check:objectql-double-limit (the double's find ignored the caller's limit) and check:where-matcher (its matcher read a combinator as a field name). Both are fixed in aa923a1f5c. The same pass had check:dual-build-cjs-loads at exit 3, PREREQUISITE NOT MET (eight unrelated packages had no dist/). That is not a red: those eight were built and the gate reran green (105 published require entry point(s) across 67 package(s) load).
• node scripts/check-issue-citations.mjs --base a08e059c61: every citation this change adds resolves (6 judged).
• Rerun at 2bd379d22a after the prose patch: check-changeset-no-major --event over this body, check-adr-0087-registration and check-issue-citations, all exit 0 (quoted in the patch report).
• Not run locally, and left to CI: the repo-wide pnpm lint, the full dogfood suite, Build Core, and Temporal Conformance (live PG and MySQL).

Acceptance notes

• aggregate's per-aggregation filter drops a string the same way where did. Base and head, driver-memory: aggregations: [{ function: 'count', field: 'id', alias: 'n', filter: 'amount > 100' }] counts every row (control { amount: { $gt: 100 } } counts one per group). AggregationNodeSchema.filter is declared FilterConditionSchema. The loop that walks it ([#10576] in aggregate()) is a separate door from lowerWhereFilterArray, so it is outside this claim. No public door or real producer was measured: the wire door parses aggregations through AggregationNodeSchema, and the analytics ObjectQLStrategy produces objects.
• A hook or middleware that rewrites the where after the seam (ctx.input.ast.where in beforeFind, opCtx.ast.where in a middleware) is not re-checked: a string there reads every row (census above). The written value is the hook's, not the caller's, and this seam runs before either.
• The RLS leg at base was refused by the driver, not by the engine, except for ''. For a string, number, Map, Date, Set or true, the security middleware wrapped the value into $and, where the driver's own node gate answers INVALID_FILTER. That refusal is now unreachable for those shapes, because the engine refuses first. The empty string was dropped as absent by that composition (opCtx.ast.where ? … : …) and reached every row the member could reach; the engine now refuses it too, before the middleware runs.
• Per-verb consequence clause. The message's last clause differs by verb, because a write has no result set; the rest of the sentence is the wire door's.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 5 documentable anchor(s).

13 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/data-flow.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/automation/hook-bodies.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/automation/webhooks.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/kernel/contracts/data-engine.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/kernel/contracts/index.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/kernel/events.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/permissions/attachments-access.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/permissions/field-level-security.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/permissions/record-view-auditing.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/permissions/rls.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/permissions/system-context.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/protocol/objectql/schema.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/ui/react-pages.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/releases/v16.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/releases/v17/17-0.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))
• content/docs/releases/v17/index.mdx (via findOne (symbol, a field of const object UNAPPLIED_WHERE_CONSEQUENCE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f09d4122bc8c2eb39414b83b1924217a04b66cb2 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from b38aad98721650728760092cffe64646b1bc48d0 — the merge of head 2bd379d22a84715c722a45510d0a9255fa9b3d16 into base f09d4122bc8c2eb39414b83b1924217a04b66cb2, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin b38aad98721650728760092cffe64646b1bc48d0 && git checkout b38aad98721650728760092cffe64646b1bc48d0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f09d4122bc8c2eb39414b83b1924217a04b66cb2 2bd379d22a84715c722a45510d0a9255fa9b3d16 && git checkout -B drift-repro f09d4122bc8c2eb39414b83b1924217a04b66cb2 && git merge --no-ff 2bd379d22a84715c722a45510d0a9255fa9b3d16

node scripts/docs-audit/affected-docs.mjs --json f09d4122bc8c2eb39414b83b1924217a04b66cb2

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f09d4122bc8c2eb39414b83b1924217a04b66cb2 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: aa923a1f5c4679d32b73bd784e8f8f3a3ba3e89f

Scope: 4 files (+561/−2) on merge base a08e059c61:

• packages/objectql/src/engine.ts, lowerWhereFilterArray only: an import, three module-private helpers, the gate, and the array branch's envelope;
• a unit pin and a dogfood pin;
• .changeset/20121-engine-where-shape-refused.md.

Measured in detached worktrees at head and base, through a real ObjectQL on InMemoryDriver and SqlDriver (better-sqlite3), with 4 rows seeded (2 per owner). Driver verbs were wrapped to count calls, and rows were read back past the engine. The three security legs were: no SecurityPlugin; SecurityPlugin under a system context; and an RLS-scoped member. That makes 900 cells per tree.

① Derived judgments

• The defect at base: confirmed, whole table. On both drivers, without SecurityPlugin and with it under a system context, for a string, 42, Map, Date, Set, true and '':
  • find returned all 4 rows, count 4, and aggregate one group of 4;
  • findOne returned the first row (for Map, Date and Set, the no-predicate refusal, with no code);
  • update(multi) rewrote 4 of 4 rows and delete(multi) deleted 4 of 4: 28 of 28 write cells on those legs.
  • [1,2,3] was refused with code, status and httpStatus all undefined.
• An RLS-scoped member at base:
  • A string, number, Map, Date, Set or true was refused by the DRIVER after the middleware's $and composition, with 0 rows.
  • '' was not refused. The composition (security-plugin.ts, opCtx.ast.where ? { $and: … } : …) drops a falsy where, so find answered all 2 of the member's rows, and update(multi) / delete(multi) rewrote or deleted them: every row the member could reach.
• The unscoped-write guard: at base, '', a string, a number and a Map stepped past a where === undefined || null guard and the write touched 4 of 4. At head these are refused before the guard runs.
• Head: 288 of 288 bad cells (6 legs × 6 verbs × 8 shapes) are INVALID_FILTER, status 400, httpStatus 400, with the VERB('deal') prefix, 0 driver calls and 0 rows, including the member's '' cells.
• Accept set: 324 of 324 cells are byte-identical to base in outcome, rows, code, status, message and driver calls. The shapes were absent, undefined, null, {}, [], Object.create(null) with a filter, a class instance with a filter, a plain filter and a FilterArray. A Proxy of a filter, a frozen filter and objects from another vm realm are unchanged too. SDK builders produce arrays or plain objects, and the REST parser produces a plain object.
• A legitimate shape the gate now refuses: an object carrying Symbol.toStringTag, as an own key or through a prototype getter. It filtered correctly at base (2 / 2 / 2) and is refused at head (received Criteria). Nothing in the repo produces it: the wire is JSON, the SDK produces arrays or plain objects, and the census below found none.
• Census: 0 shipped callers pass a string, number, boolean or new literal as where to the six verbs (control: 126 sites pass where: {).
• REST, byte-identical at base and head: GET ?filter= / ?where= with these shapes is refused 400 INVALID_FILTER at the wire normalizer, and POST …/query with them is refused 400 VALIDATION_FAILED by Zod. No HTTP door reaches the engine seam with them, so the head's change is in-process only.
• The pins discriminate.
  • Gate → if (false): 24 failed, 23 passed (47).
  • Array branch → new Error(: 6 failed, 41 passed (47).
  • The dogfood pin against the base dist: 8 failed, 2 passed. At head: 10 passed.
  • Restored by blob.
• Message: the wire door's words, with a per-verb consequence clause. The [1,2,3] message is unchanged. invalidFilterError and INVALID_FILTER already exist, and there is no new export.
• Scope: RIGHT. The having region, draft PR feat!: retire the saved-report stack — /api/v1/reports, client.reports, IReportService, the reports capability, sys_saved_report / sys_report_schedule, @objectstack/plugin-reports #20125's docblock, the drivers and REST are untouched. git merge-tree against f09d4122bc is clean.
• CI at this head: 35 runs, 32 success, 3 skipped, 0 failed and 0 pending. All required contexts are success.

② Semver level

Clause-②: no (narrowing), @objectstack/objectql minor, BREAKING, ADR-0087 not-required (no-migration-prescription): RIGHT.

• It adds no export and no type member, and the narrowing is BREAKING. This matches the PR fix(objectql): a formula field and a CEL defaultValue answer current_user.can() from the security service (#20082) #20138 precedent.
• check-changeset-no-major --event <PR body>: "✓ This diff introduces no major bump." and "✓ LEVEL AXIS: … no (narrowing) …" (exit 0).
• check-adr-0087-registration: "✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition." (exit 0).

③ Boundary flags

• Changeset: two FALSE sentences.
  1. "For a caller scoped by row-level security, the security middleware wrapped the value into its $and, where the driver refused it (INVALID_FILTER) and nothing was written." This is FALSE for '': the composition dropped it as absent, and the member's every reachable row was rewritten or deleted.
  2. "A filter object is accepted whatever its prototype …" This is FALSE for an object carrying Symbol.toStringTag, own or inherited: it filtered correctly at base and is refused at head.
• PR body, imprecise: "The prototype is not checked". The built-in tag is read through the prototype chain.
• Every other changeset and body sentence holds against the head.

Implemented-by: claude/issue-20121-where-shape-refused
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: FAIL

Must-change (prose only; engine.ts blob 4f5d28170b, both pins and the declaration need no change):

1. .changeset/20121-engine-where-shape-refused.md, "What it replaces": qualify the RLS sentence. The driver refused a string, number, Map, Date, Set or true after the $and composition, but the composition dropped the empty string as absent, and every row the member could reach was rewritten or deleted.
2. Same file, "Unchanged": replace "whatever its prototype" with the real accept condition: a non-array object whose built-in tag is [object Object] (a plain object, Object.create(null), a class instance, a Proxy, an object from another realm). An object that overrides Symbol.toStringTag is refused and named by its tag.
3. (should) PR body: "The prototype is not checked" → the tag is read through the prototype chain.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2bd379d22a84715c722a45510d0a9255fa9b3d16

Scope: a DELTA review of PR #20144 after FAIL 5831634153 on aa923a1f5c. This record supersedes that FAIL on the prose. There is one new commit, 2bd379d22a, which touches only .changeset/20121-engine-where-shape-refused.md (+23/−7).

① Derived judgments

• Blob identity, verified by the reviewer:
  • engine.ts is 4f5d28170b, engine-where-shape-refusal.test.ts is 285177d8cb and the dogfood pin is a7b7b4892f, all the same as aa923a1f5c.
  • The 900-cell readings, both ablations (24/23 and 6/41 of 47), the dogfood pin (8 failed, 2 passed at base; 10 passed at head) and the REST readings in 5831634153 carry over unchanged.
• Must-change 1, the RLS sentence split by value: TRUE.
  • A string, number, Map, Date, Set or true was refused by the driver after the $and composition.
  • The empty string was dropped as absent, and the member's every reachable row was rewritten or deleted: 2 of 4 on both drivers, matching the base readings.
• Must-change 2, the accept condition: TRUE.
  • A non-array object whose built-in tag is [object Object] is accepted: a plain object, Object.create(null), a class instance, a Proxy, or an object from another realm. Each of these is byte-identical at base and head on all six legs.
  • An object that overrides Symbol.toStringTag, own or inherited, is refused and named by its tag. It filtered correctly at base, and no in-repo producer creates one.
• Must-change 3, the PR body: done. "The prototype is not checked" is gone, and the tag is read through the prototype chain. The H4 table gains the Symbol.toStringTag row.
• No new FALSE sentence in the whole new changeset or the whole new body. Two precision nits, not false:
  • For findOne with Map, Date or Set, the engine's own no-predicate guard refuses first, as the changeset already states.
  • Under RLS at base, the variant with an inherited tag was already refused by the driver.
• git merge-tree against origin/main f09d4122bc is clean.

② Semver level

Unchanged: Clause-②: no (narrowing), @objectstack/objectql minor, BREAKING, ADR-0087 not-required (no-migration-prescription).

• check-changeset-no-major --event <edited body>: "✓ This diff introduces no major bump." and "✓ LEVEL AXIS: … no (narrowing) …" (exit 0).
• check-adr-0087-registration: "✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition." (exit 0).
• check-empty-changeset: "✓ No changeset from the merge base modified or deleted by this diff." (exit 0).
• check-issue-citations: 6 citations, all resolve (exit 0).

③ Boundary flags

• The dev has no open questions. The two out-of-scope notes stand as measured in 5831634153. The per-aggregation filter string drop folds into the objectql: a per-aggregation filter refuses an unknown operator only when rows exist — aggregations: [{ filter: { amount: { $median: 1 } } }] answers 400 on a populated table and 200 on an empty one #20122 combined claim once this PR lands.
• CI at this head: complete and green. 42 runs: 37 success, 5 skipped, 0 failed and 0 pending. All seven required contexts are success.

Implemented-by: claude/issue-20121-where-shape-refused
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: PASS