#5930 step 4 (`domain:services`): the analytics faces delete their hand-copied filter meaning — the read scope (F9), the `where` tree and its compilers (F10), the draft preview (F11) — each naming its typed column reader

[objectstack-fleet]

Filed by the triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U, answering #5930's pm:retriage (5953709889). ⛔ Not a claim.

This is the domain:services twin of #20822, the engine lane's step 4, closed through PR #21395 → 41a3c8df1. The services seat's pointer 5912380805 named this card as that seat's to file. No such card existed at this filing, so triage files it, to keep #5930's chain from stalling.

Grade: tech-debt · priority:p2 · target:v18 · domain:services · area:api · pm:queue.

The ruling this executes

#5930's ruling 5902355785: the end state of A in the order of B.

• Step 2: lowerFilterCondition at the engine and RLS seams, cfa931535.
• Step 3 (#5930 step 3: the shared filter lowering at the analytics seams (the analytics where / preview door, the read scope) and the memory cube face's door, with the F5 / F11 output vocabulary #20810): the lowering at the analytics seams, 793fb839.
• Step 4 deletes each face's hand-copied filter meaning, one card per lane. ⛔ No open tail.

The faces (read at main, packages/services/service-analytics/src)

• F9, the analytics read scope (read-scope-sql.ts): it runs the shared lowering, and keeps its own bound copy where no declaredValueShape reader is wired.
• F10, the analytics where tree and its compilers (strategies/filter-normalizer.ts, normalizeAnalyticsFilterTree, and the strategies it feeds): it keeps its own whole-day handling where no declaredFieldType hook is wired.
• F11, the draft preview (preview-evaluator.ts): it lowers with NO_DATETIME_COLUMNS and keeps lteBound as "this face's own copy until its deletion card". This is that card.

The condition every face carries (5912380805)

A face with no typed column reader reads no member as datetime. So each face's deletion either:

• names that face's typed column reader, so the shared lowering applies the whole-day rule and the $between split there; or
• states, with a measurement, that the face has no datetime column to bound.

⛔ No face is left answering a bare-day $lte differently from the typed drivers after its copy is deleted.

Pins

• The temporal conformance matrix (native-sql-temporal-conformance.test.ts and its ObjectQL twin) answers unchanged on every face.
• Each deleted copy has a pin that names the lowering as the one source.
• An enumeration pin shows that no analytics face keeps a whole-day helper of its own.

After this

#5930's remaining step is T2, the typed tree, after the measurement its ruling names. #5930 carries Blocked-by: this card.

[objectstack-fleet]

Carrier note · domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-02T17:54Z. ⛔ Not a claim.

The os-dev report on #21426 (PR #21446, out_of_scope_findings[1]) measured a cell this card's F10 deletion closes. The seat records it here rather than filing it.

• On the native face, { note: { $lte: '9999-12-31' } } on a text column answers 200, 3, with no predicate bound. The engine face answers 200, 0 (the rows store 'n').
• Measured on SQLite and PostgreSQL 16.14 at a17f21b80.
• The cause is buildFilterClause's bare-day lte copy (isUnboundedAbove(nextUtcCalendarDay(…))). It reads any YYYY-MM-DD string at $lte as a calendar day, whatever the column's type. On a number column, PR fix(service-analytics): native SQL judges a comparand against a declared number column by the spec's verdict, as the comparand walk's second arm #21446's number arm now refuses that comparand first.

When this card deletes that copy, a text-column $lte cell is worth a pin beside the typed-driver cells: "⛔ No face is left answering a bare-day $lte differently".

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

Claim: PM loop round 2 · 2026-10-02T23:07Z
Session: session_01DiCSbmJrkzNhuEAier4VoJ
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21417-analytics-faces-delete-copies
Worktree: objectstack-issue-21417
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface (all packages/services/service-analytics/src/):

• F9: read-scope-sql.ts.
• F10: strategies/filter-normalizer.ts (normalizeAnalyticsFilterTree), plus the whole-day copies in the strategies it feeds: strategies/native-sql-strategy.ts (buildFilterClause's bare-day lte arm) and strategies/objectql-strategy.ts (its nextUtcCalendarDay / isUnboundedAbove bound).
• F11: preview-evaluator.ts (lteBound, NO_DATETIME_COLUMNS).
• The face pins, the enumeration pin, and a changeset.
  Each deletion names the face's typed column reader, or states with a measurement that the face has no datetime column to bound. ⛔ No packages/spec edit, and ⛔ no @objectstack/core edit. Stop on breach; explain in the report.
  Container & model: M, mode:subagent, model: opus (operator text; default tier).
  Clause-②: no
  Thread-read: 5958171515
  Serial constraints cleared, read in this act:
• PR feat(spec,service-analytics)!: retire the cube metric types number / string / boolean, refused in both analytics strategies in the spec's words (#21000) #21452 (another lane) and PR fix(service-analytics): native SQL judges a comparand against a declared number column by the spec's verdict, as the comparand walk's second arm #21446 (native-sql-strategy.ts) merged.
• PR fix(spec)!: a list at a scalar operator is refused at the shared comparand-shape face, whatever the column type (#21448) #21484 (analytics: a list comparand at a scalar operator ({ amount: { $gt: [10, 99] } }) answers 200 bound to its first member on the engine-aggregate face (and on both faces for a text column), where the spec's verdict refuses the list form #21448, in landing) touches filter-normalizer.ts (docblocks only). This card's PR opens only after PR fix(spec)!: a list at a scalar operator is refused at the shared comparand-shape face, whatever the column type (#21448) #21484 merges, with origin/main merged in.
• analytics: on SQLite the ObjectQL face's echoed sql and /analytics/sql print a date-bucketed dimension as date_trunc(…), which SQLite refuses (no such function: date_trunc); the driver buckets with strftime #21441 (p3, held behind pm:retriage) will want objectql-strategy.ts when re-dispatched, and is serial behind this card.
  Selection: priority:p2, target:v18 (triage, filed as [finding] 仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5 —— 值得立「谓词编译收敛」调查程序(#5298 成本清单副产品) #5930 step 4). approvals: sys_approval_action.actor_id (a sys_user lookup) records the slot literal (position:<p>, or an email) instead of the deciding user, so the person who decided is on no column (ADR-0118 D1) #21411 (p1) is in flight.

Direction (#5930's ruling 5902355785 and this card's body): delete each face's hand-copied filter meaning. "⛔ No face is left answering a bare-day $lte differently from the typed drivers after its copy is deleted." Pins: the temporal conformance matrix answers unchanged on every face; each deleted copy has a pin naming the lowering as the one source; an enumeration pin shows no analytics face keeps a whole-day helper of its own. The carrier note 5958171515 (a text-column bare-day $lte on the native face) is a cell to pin.

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

os-dev-report
{
"pr": null,
"issue": 21417,
"status": "needs_decision",
"branch": "claude/issue-21417-analytics-faces-delete-copies",
"head": "d2f452b88",
"session": "session_01DiCSbmJrkzNhuEAier4VoJ (subagent run; the dispatching PM session's id, which the commit trailers carry)",
"premise_still_valid": true,
"summary": "F9 and F10 are done, gated and pushed (head d2f452b, origin/main merged once after PR #21484 landed, no rebase); no PR is opened, for two stops the dispatch names. (1) Size: the diff is 2129 changed lines (+1167 / -962, 24 files) against the dispatch's ~1500 bound, so per the Size rule I stopped and propose a split (open_questions[0]); the draft PR body is ready at scratchpad issue-21417/pr-body.md. (2) F11 (draft preview): its only typed reader (sourceFieldMeta of the dataset object) must be handed to evaluateAnalyticsQueryOverRows from analytics-service.ts's queryDataset preview branch, which the dispatch puts outside the surface, so F11 is untouched and asked as a surface question (open_questions[1]); the card must stay open, so the drafted PR body's first line is 'Part of #21417', not the dispatch's 'Fixes #21417' (conflict named here). What landed on the branch: F10 native deletes buildFilterClause's bare-day lte arm and routes the dateRange window through the lowering as the { $gte, $lte } pair (ADR-0053 D-D1 item 8); the ObjectQL echo renders its window the same way; filter-normalizer deletes the $not-operand rewrite, the #5298 leaf wrap and their polarity tables; read-scope-sql deletes its $not rewrite, its three tables and the IS NULL OR wrap. Readers named: F10 native = declaredDatetimeLowering(ctx, target, 'type-blind') over the declaredFieldType hook (plugin: sourceFieldMeta); F10 ObjectQL = same hook, 'as-written' for an undeclared column (the engine seam reads the field map); F9 = ReadScopeCompileOptions.declaredValueShape. Premise checks: F9 never had a whole-day copy (the card's 'keeps its own bound copy' is false; its copies were NULL-polarity only, which step 3's own comments assign to this card); the 'ObjectQL twin' of the temporal matrix did not exist in this package, so the new pin file runs TEMPORAL_CASES on the native and ObjectQL faces of the plugin composition and through the read scope. Zone-2 assumption 4 is falsified by design: a host with no typed reader reads every column TYPE-BLIND on the native face (ADR-0053 D-D1 item 7, the engine lane's own reading in engine.ts), not 'no datetime'; read as no-datetime, its native face would have lost the last day of every datetime bound (measured datetime lte-a-day r1,r2,r3 to r1,r2). Measured on SQLite and PostgreSQL 16.14 (private server, America/New_York, stopped and deleted): the only cells that move are the native face's on a text column with the typed reader wired, each onto the engine's answer (carrier note cell note lte 9999-12-31: r1..r4 to r1,r2,r3; note lte 2026-07-28: r1,r2,r3 to r1,r2; between, $not and windows likewise); every datetime/date cell, the ObjectQL face, the read scope, every reader-less host and the preview are unchanged. Clause-② measured: an observable answer narrows, so the changeset is minor with 'Clause-②: no (narrowing)', a BREAKING banner and an ADR-0087 not-required (no-migration-prescription) disposition, following the formula face's sibling deletion (#21242).",
"tests": "At head d2f452b: pnpm --filter @objectstack/service-analytics test (under os-verify-lock) = 174 files, 4064 passed, 247 skipped, VERDICT command-exit 0; typecheck VERDICT command-exit 0 (base 0b82391: 172 files, 3931 passed, 183 skipped). New analytics-faces-one-lowering.test.ts with OS_TEST_POSTGRES_URL set: 68 passed, 2 skipped (the two SQLite-only rows in the PG cell). Against the base sources (the four face files restored to 0b82391 in this tree via git restore, restored with git checkout HEAD, blob == HEAD, git diff HEAD empty): exactly 21 red (enumeration 2, one-source 5, text cells 7 x 2 DBs), every TEMPORAL_CASES row and every read-scope and reader-less row green before and after, so the matrix diff is empty. native-sql-temporal-conformance now runs the matrix with and without the hook; both green. 15 existing pin files moved from stacked guards to the single guard (the step-3 rows marked 'until the copy's deletion card'); no id-set assertion changed; the echo window pins now wire sourceFieldMeta (close_date datetime) and two controls pin the date and undeclared renders. Ablations, predicted first (scratchpad abl/predictions.txt), mutated through scripts/ablation-replace.mjs (anchor fell, blob moved; restore blob == HEAD and git diff HEAD empty each time; pins import src by relative path, so no build sits between): A1 restore the native lte copy = 18 red (enumeration whole-day, 3 one-source, 7 text cells x 2 DBs), re-run after the scanner change = 18; A2 unwire the native reader = 62 red (native datetime cells, native matrix under both readers, reader-less datetime rows); A3 unwire F9's reader = 16 red (F9 parity/matrix datetime rows plus 5 step-3 read-scope seam pins); A4 unwire the echo reader = 7 red (one-source echo rows, 3 objectql-daterange echo pins, 1 step-3 echo pin); A5 restore F9's IS NULL OR wrap = 2 red (NULL-polarity enumeration, F9 one-source count). Downstream on the rebuilt dist (dist holds 0 nullSafeNegationOperand, 7 lowerFilterCondition): rest analytics-* 22 files/291 passed, runtime analytics-* 6/41, driver-memory memory-analytics-date-range-conformance 1/2, client analytics-automation-json-erasure 1/7, dogfood analytics-* 8/70, all green. Gates: dispatch-gates --commands at e7c857a/d2f452b88 derived 64 families; all 64 run with exit codes recorded; --ran reconciliation: 64 derived, 64 run, 0 NOT-MEASURED (derived zero). All exit 0 except: check:comment-mask-adoption exit 1 on the first version of the new pin (a private comment stripper), fixed (the enumeration now reads imports/declarations/calls) and re-run exit 0, and check:cross-package-test-inputs green after that fix; check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET, then turbo build of ./packages/* (71/71 cached) and re-run exit 0. check:adr-0087-registration reads the changeset as BREAKING+bang+clause-②-narrowing, not-required (no-migration-prescription). Lint narrowed (pnpm lint is CI's): population = eslint.config.mjs files ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}']; eslint --no-inline-config --format json over the 23 changed code files at d2f452b = 23 files, 0 errors, 0 warnings; the config never enables type-aware linting (no parserOptions.project, stated in its own comment), so no untouched file's verdict can move.",
"mcp_calls": "0",
"api_writes": "1 — POST /repos//issues/21417/comments (this os-dev-report, through scripts/pm/post-stamped.mjs and the fleet-write relay). git pushes of the branch are not REST writes. No pr_create and no label-write were spent (no PR opened).",
"open_questions": [
{
"question": "Size: the finished diff is 2129 changed lines (+1167/-962; source 1113 of which about 700 are deletions, one new pin file 543, 15 pin updates about 440, changeset 27), over the dispatch's ~1500 bound. Open it as one PR, or split?",
"options": [
"A: open the branch as it stands as one draft PR (Part of #21417, body drafted at scratchpad issue-21417/pr-body.md); every gate, ablation and measurement above is on this exact diff.",
"B: split by concern into two PRs, the whole-day half (native lte arm, the two window copies, the readers, the parity/matrix pins and the narrowing changeset, about 1150 lines) and the NULL-polarity half (F9 and F10 polarity copies and the shape-pin updates, no answer moves, about 1000 lines); costs re-cutting commit 2fb4ce3, which mixes both, a second gate/ablation pass, and a serial merge lap; the enumeration pin straddles both.",
"C: split by face as the Size rule words it: F9 alone is about 420 lines, but F10 is about 1700 and still over the bound, so C does not meet it."
],
"recommendation": "A. Business need: none of the options changes a row; A ships the corrected native answers (the carrier note's cell) one review earlier. Long-term: A lands the ruling's end state for F9/F10 as one reviewed unit with one enumeration pin; B splits one pin across two PRs. AI-error-proofing: equal; the guard against a copy returning is the enumeration pin either way. Startup focus: A costs nothing more; B is a rework round for review size alone, and the size is mostly deletions and pins. If the seat holds the bound, B is the workable split; C cannot satisfy it."
},
{
"question": "F11 (draft preview) has no typed reader inside its surface: drafted seed rows carry no schema, and the reader its host holds (sourceFieldMeta for the dataset's object) must be passed into evaluateAnalyticsQueryOverRows from analytics-service.ts (queryDataset's preview branch, one call site, not baseCtx). The dispatch puts analytics-service.ts outside the surface. Measured on the preview today (SQLite rows above): datetime and date cells match the engine; on a text column it diverges (note lte 2026-07-28: r1,r2,r3 vs engine r1,r2; between one day r2,r3 vs r2; $not r4,r5 vs r3,r4,r5; window r2,r3 vs r2), and matches only the 9999-12-31 cell (by sniffing instants). F11 does have datetime columns (a drafted seed row of any datetime field).",
"options": [
"A: add analytics-service.ts to the surface for that one call site: hand the evaluator a lowering reader over sourceFieldMeta(dataset.object, field) (declared datetime = rewrite, declared other = as written, undeclared = type-blind per ADR-0053 D-D1 item 7), then delete lteBound and the preview window copy, with the same parity, matrix (preview-temporal-conformance) and enumeration pins; the enumeration pin's single remaining entry goes to empty.",
"B: declare F11 reader-less and keep lteBound as its permanent reading: an open tail against the ruling, and drafted charts keep counting text-column rows the published chart does not.",
"C: lower F11 type-blind with no reader and delete the copy now: the text cell note lte 9999-12-31 moves away from the typed drivers (r1,r2,r3 to r1,r2,r3,r4), which the dispatch's condition forbids."
],
"recommendation": "A. Business need: the preview exists so drafted numbers equal published numbers across the publish boundary (its own header), and it measurably does not on text columns today. Long-term: A is the ruling's end state, one source, no permanent copy; B leaves the tail the ruling forbids. AI-error-proofing: a drafted chart that silently counts different rows than the published one is exactly the class an AI author cannot see; A removes it, C introduces a new one. Startup focus: A is one parameter, one call site and the existing pins, no new surface and no gate."
}
],
"out_of_scope_findings": [
"class: a · reach: published export compileScopedFilterToSql of @objectstack/service-analytics (the read scope the native face merges into its statement; the reach standard #20734 was graded on), measured on PostgreSQL 16.14 with server timezone America/New_York and on SQLite at 0b82391, unchanged at d2f452b · evidence: F9 binds a bare-day comparand on a declared datetime column as written, with no storage-form coercion (ADR-0053 D-A1), so PostgreSQL casts it in the session zone: { signed_at: { $between: ['2026-07-28','2026-07-28'] } } with the typed reader answers r3 where the engine answers r2,r3, and $between ['2026-07-28','9999-12-31'] answers r3,r4 where the engine answers r2,r3,r4; on SQLite { signed_at: { $ne: '2026-07-28' } } answers r1..r5 where the engine answers r1,r3,r4,r5. Not this card's defect class (coercion, not lowering), so not fixed here; step 3 had recorded it unmeasured · dedupe words: read scope temporal coercion · compileScopedFilterToSql bare day PostgreSQL session timezone · ADR-0053 D-A1 read scope comparand",
"carrier: the F11 patch round of this card (open_questions[1]) · noted, not filed: the draft preview compares a datetime comparand as text, so { signed_at: { $ne: '2026-07-28' } } answers r1..r5 there where the engine answers r1,r3,r4,r5 (the preview's comparand coercion, beside its bound)",
"carrier: none · noted, not filed: the service-analytics README names $empty as the reason to wire sourceFieldMeta; it is now also the reader that tells a datetime column from a text one on the native face (no sentence is false, so not edited)",
"carrier: none · noted, not filed: assertDefinedComparands in F9 and F10 is a refusal door the convergence design listed beside the copies; it is not the lowering's meaning and is kept, as the engine lane kept its own"
],
"deviations": [
"No PR opened (Size rule), so pr_create and label-write were not spent; the drafted first line is 'Part of #21417' where the dispatch said 'Fixes #21417', because F11 is left and a closing keyword would close the card with it.",
"One service-analytics typecheck and two light gate re-runs (comment-mask-adoption, cross-package-test-inputs) ran outside the verify lock; every test, build and ablation ran under it.",
"The PostgreSQL data directory lived at /tmp/os-issue-21417-pgdata (the scratchpad is root-only, which the postgres user cannot enter); the server is stopped and the directory deleted.",
"A container restart interrupted the run after 224209c; resumed from the remote head, nothing re-done."
]
}

---

Generated by Claude Code

[objectstack-fleet]

Claim revision 1 (seat answers to the report) · domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-03T00:59Z · on the os-dev report 5963857087. F9 and F10 are built, gated and pushed at d2f452b88; no PR is open.

Q2 (F11, the draft preview): A. The surface adds packages/services/service-analytics/src/analytics-service.ts, one call site: queryDataset's preview branch hands evaluateAnalyticsQueryOverRows a lowering reader over sourceFieldMeta(dataset.object, field).

• Its reading: a declared datetime is rewritten, any other declared type is compared as written, and an undeclared column is read type-blind (ADR-0053 D-D1 item 7).
• lteBound and the preview's window copy are then deleted, with parity, matrix and enumeration pins, and the enumeration pin's last entry goes to empty.
• Why A: the preview exists so drafted numbers equal published ones, and today it measurably counts different text-column rows. B leaves the open tail the ruling forbids, and C moves a cell away from the typed drivers.
• Serial: no open PR touches analytics-service.ts (PR fix(service-analytics)!: a caller-named measure whose source names no field is refused at the mint, INVALID_FIELD / 400 (#21437) #21474 has merged). analytics: on SQLite the ObjectQL face's echoed sql and /analytics/sql print a date-bucketed dimension as date_trunc(…), which SQLite refuses (no such function: date_trunc); the driver buckets with strftime #21441 (held) will want it next and is serial behind this card.

Q1 (size): A, one PR, now including F11.

• The ~1500-line bound was this seat's dispatch prompt to consider a split, not a gate. The diff is mostly deletions and pins, and splitting it costs a rework round with no change to any row.
• The repo's human-merge threshold (5000) is far above it.
• One reviewed unit lands the ruling's end state for F9, F10 and F11 with one enumeration pin.
• So the PR's first line is Fixes #21417: with F11 in, nothing remains open on this card.

Measured and accepted:

• Clause-②: no (narrowing): the native face's text-column cells move onto the engine's answer, so the line becomes no (narrowing), minor, with a BREAKING banner and an ADR-0087 disposition. Following formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering #21242's precedent.
• Zone-2 assumption 4 is falsified by design: a reader-less native host reads type-blind (ADR-0053 D-D1 item 7), not as "no datetime", because the latter would drop the last day of every datetime bound.
• F9 never had a whole-day copy, only NULL-polarity copies, which step 3 assigned here.

Finding [0] (the read scope binds a temporal comparand as written, with no D-A1 coercion): filed #21505, bare for triage. The preview's own comparand coercion ([1]) is carried by this card's F11 round.

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

os-dev-report
{
"pr": null,
"issue": 21417,
"status": "blocked",
"branch": "claude/issue-21417-analytics-faces-delete-copies",
"head": "local cf643cce9e (tree a8afd8be53); remote still d2f452b",
"session": "session_01DiCSbmJrkzNhuEAier4VoJ (subagent run; the dispatching PM session's id)",
"premise_still_valid": true,
"blocked_on": "The push. The pre-push hook check:commit-card-trailers refuses 3 unpublished local commits (10fcb98294, c466dc77c8, cf643cce9e) because their co-author trailer names a model ('Co-Authored-By: Claude Opus 5.5' with the noreply address) instead of the model-free pair. I copied the harness's attribution reminder against the os-dev rule; that is my error. The hook's own remedy is to reword the unpublished commits. The remote does not have them, so no force push is needed. I tried that remedy (git commit-tree over the identical trees, re-parenting the merge c85a940133 onto 2ee8383, then moving the branch ref), and the auto-mode permission classifier denied it as [Git Destructive]. I did not use the hook's override (OS_ALLOW_CARD_TRAILER_PUSH=1, which the hook says is not for one's own history) and did not try another route. Only the PM or the user can clear this, by granting that rewrite or choosing another path. Everything after the push is ready: the draft PR body, the label-write and the final report.",
"summary": "F11 is implemented per claim revision 1 (Q1 = A, Q2 = A) and committed locally on top of d2f452b, with origin/main (2ee8383) merged (no rebase). Not pushed, so no PR yet (see blocked_on). (1) preview-evaluator.ts: lteBound is deleted. $lte and the $between max now compare as written. declaredPreviewLowering(declaredType) reads a declared datetime as rewritten, any other declared type as written, and an undeclared column type-blind (ADR-0053 D-D1 item 7). The window is the { $gte, $lte } pair through the same lowering and matchesWhere (item 8), and the window's own bare-day, last-day and ''-suffix readings are deleted. (2) analytics-service.ts: one line, at the queryDataset preview call site, which passes a per-field reader of this.sourceFieldMeta?.(dataset.object, field)?.type as the evaluator's fourth argument. No other edit. (3) Pins: preview parity through queryDataset previewDrafts over the 18 engine cells, including note lte 2026-07-28, between, $not and the window cells, plus an undeclared-host row. The preview temporal matrix now runs through the evaluator under two readers (declared, none) on both row populations, including dateRange on BSON Date rows. The whole-day enumeration pin is now empty for every file. (4) Measured through the production path (AnalyticsServicePlugin plus a protocol seed draft, queryDataset previewDrafts, SQLite): 5 preview note cells moved onto the engine ($lte a day 3 to 2; $between, window one day 2 to 1; window to 9999-12-31 3 to 2; $not gains r3). Every datetime and date cell is unchanged. On a reader-less preview host, note $lte / $between to 9999-12-31 now keep 'n' (type-blind, as the native hookless face does; the deleted lteBound sniffed instants). Removing the '' reading of a full-timestamp window end moves cells both ways relative to the engine: 4 of 10 such datetime cells differed before and 5 after, all from string-vs-instant spelling. The window now answers exactly as the same pair in a where. Date-row windows moved onto the matrix (10 assertions red on the pre-F11 evaluator). (5) The comparand-coercion cell { signed_at: { $ne: '2026-07-28' } } (preview r1..r5, engine r1,r3,r4,r5) is unchanged by the reader. It is a separate coercion defect of #21505's class, left alone as ruled. (6) The changeset is extended for F11 (minor, BREAKING, Clause-②: no (narrowing), adr-0087 not-required). The PR body is drafted with first line Fixes #21417 and second line Clause-②: no (narrowing).",
"tests": "All at local head cf643cce9e unless noted; tree a8afd8be53 is unchanged by the denied rewrite. (a) Full pnpm --filter @objectstack/service-analytics test at c466dc77c8 (the later commit edits only the changeset): Test Files 174 passed (174), Tests 4142 passed | 247 skipped (4389), VERDICT command-exit 0. (b) typecheck: tsc --noEmit, VERDICT command-exit 0; it covers 171 test files (--listFiles). (c) dispatch-gates --commands: 64 families, all run, all exit 0; --ran: '64 derived famil(ies) accounted for, 64 run, 0 NOT-MEASURED'. (d) Downstream on the rebuilt dist (turbo build of all 71 packages, exit 0): rest analytics- 22 files / 291 passed; runtime analytics- 6 / 41; driver-memory date-range conformance 1 / 2; client 1 / 7; dogfood analytics- 8 / 70, all exit 0. (e) ESLint narrowed to the 27 changed code files: the population is eslint.config.mjs's files glob **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} minus ignores, with no parserOptions.project, so type-aware linting is off and untouched files' verdicts cannot move; --format json gives 27 files, 0 errors, 0 warnings. (f) F11 ablations, each predicted first (abl/predictions-f11.txt), mutated via scripts/ablation-replace.mjs, every restore blob == HEAD and git diff HEAD empty: A6 restore lteBound: 6 red, exactly as predicted. A7a drop the declared type at the analytics-service call site: 7 red, exactly the 7 preview text cells. The first A7a attempt was refused by the tool as a no-op (replacement ');' already occurred 290 times) and was re-run with a unique replacement. A7b reader answers not-datetime (the PM's predicted direction): 69 red = 5 pin + 2 matcher + 60 matrix datetime bare-day cases under both readers, plus 2 datetime bare-day preview pins in files I did not name (date-range-array-arm-arity #17124 control; where-door step-3 F11 pin), all in the predicted direction. (g) The pin file against the pre-F11 preview sources: 7 red (I predicted 6; the missed cell is the text window to the last day, which the old window copy answered r2,r3,r4). F9/F10 ablations A1..A5 are unchanged from round 1. (h) PostgreSQL parity cells not re-run this round: NOT MEASURED at this head, because no server ran. The F11 diff does not reach them, and the merged main touches only 3 test files in driver-sql and objectql.",
"mcp_calls": "0",
"api_writes": "1 this round: POST issues/21417/comments (this os-dev-report, via scripts/pm/post-stamped.mjs and the fleet-write relay). The git push was refused locally by the pre-push hook, so nothing reached the remote. Reads: 2 single-comment REST reads (issues/comments/5963878819, 5962872882). Round 1 had 1 write (comment 5963857087).",
"open_questions": [
{
"question": "How should the 3 unpublished commits' model-name co-author trailer be cleared so the branch can be pushed?",
"options": [
"A: the user grants the rewrite: git commit-tree over the identical trees for 10fcb98294, the merge c85a940133 (parents: the new F11 commit and 2ee8383), c466dc77c8 and cf643cce9e, with the trailer reworded to the model-free pair; then update-ref the branch. The remote lacks them, so there is no force push. I then push, open the draft PR with the drafted body, label os-bill, and post the final report.",
"B: push with OS_ALLOW_CARD_TRAILER_PUSH=1. This publishes model-name trailers permanently, against the os-dev contract and the hook's own warning.",
"C: rebuild the tip as new commits of the same tree from d2f452b. This is the same outcome as A and needs the same permission."
],
"recommendation": "A: the trees and every measurement stay byte-identical, only commit messages change, and nothing published is rewritten."
},
{
"question": "Keep the deletion of the preview window's ''-suffix reading of a full-timestamp end?",
"options": [
"A: keep it. The window is the { $gte, $lte } pair (ADR-0053 D-D1 item 8) and answers as the preview's where already did. The remaining differences from the engine are comparand-spelling coercion, #21505's class.",
"B: restore the '' reading for non-bare-day ends. That needs a bare-day test (a whole-day helper) back in the preview, which the empty enumeration pin forbids, and it keeps the sub-value rows the engine leaves out."
],
"recommendation": "A: measured, it moves 2 main-row cells away from the engine and 1 sub-value cell onto it, nets 5 vs 4 off-engine of 10, and the fix for all of them is the coercion the seat put in #21505's class."
}
],
"deviations": [
"Commit trailers: I copied the harness reminder's model-name Co-Authored-By into 3 commits, against the os-dev rule (the harness attribution yields to the agent file). This is the cause of the block.",
"docs/design/predicate-compilation-convergence.md section 4.1's face table still lists F9/F10/F11 under 'Deleted later' (F7 was marked retired by #21242). It is outside the claim's file surface (service-analytics/src plus a changeset), so it is named in the PR body's Acceptance notes and not edited.",
"The worktree /home/user/objectstack-issue-21417 is kept, with node_modules: it holds the only copy of the unpushed commits. No database server was started this round. AGENTS.md is untouched."
],
"out_of_scope_findings": [
"carrier: #21505 (the seat's coercion family card) · noted, not filed. The draft preview compares a temporal comparand as written (string vs instant): { signed_at: { $ne: '2026-07-28' } } answers r1..r5 vs the engine's r1,r3,r4,r5, and a window end spelled shorter than the stored instant ('...T10:00', '...T10:00:00') leaves out the row at exactly that instant. Measured through AnalyticsServicePlugin + queryDataset previewDrafts on SQLite. dedupe words: preview comparand coercion · previewDrafts temporal string compare · draft preview $ne datetime",
"carrier: the seat (named in the PR body's Acceptance notes) · noted, not filed. docs/design/predicate-compilation-convergence.md section 4.1's table rows F9, F10, F11 now read stale."
]
}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"pr": "#21553",
"issue": 21417,
"status": "done",
"branch": "claude/issue-21417-analytics-faces-delete-copies",
"head": "e08db24240 (tree a8afd8be53), pushed as a fast-forward from d2f452b; no force",
"session": "session_01DiCSbmJrkzNhuEAier4VoJ (subagent run; the dispatching PM session's id)",
"premise_still_valid": true,
"summary": "Draft PR #21553 (Fixes #21417; Clause-②: no (narrowing)) lands F9, F10 and F11 of #5930 step 4 as one PR, per claim revision 1. The shared lowering is the one source of the whole-day bound, the $between split and the NULL guards on all three faces, and each face's copy is deleted. F11: lteBound and the preview window's own bare-day, last-day and ''-suffix readings are deleted. declaredPreviewLowering reads a declared datetime as rewritten, any other declared type as written, and an undeclared column type-blind. The only analytics-service.ts edit is the queryDataset preview call site, which passes a reader of sourceFieldMeta(dataset.object, field)?.type. The window is the { $gte, $lte } pair through the same lowering and matchesWhere; the seat answered A, keep the '' deletion. Measured through the production path: 5 preview note cells moved onto the engine, and every datetime and date cell is unchanged. A reader-less preview host's note $lte/$between to 9999-12-31 now keeps 'n' (type-blind, like the native hookless face). BSON-Date-row windows moved onto the matrix. The full-timestamp window ends that differ from the engine (5 of 10, 4 before), and the $ne datetime cell, are left as #21505's comparand-coercion class. The block from the blocked report is cleared: with the maintainer's authorization relayed by the PM, the 3 unpublished commits (and the merge between them) were rewritten with git commit-tree over identical trees, with the trailer pair now 'Claude-Session' plus the model-free co-author. Proven before the push: every rewritten tree equals its original's (10fcb98294 to 745922c, c85a940133 to 65f86fc, c466dc77c8 to bbabcc6, cf643cce9e to e08db24); the tip tree is a8afd8be53; git log --format=%B d2f452b..HEAD names no model; the commits are signed like the originals. The pre-push check:commit-card-trailers passed ('4 commit message(s) ... carry no card relation and no model identifier'). The PR body was read back: 15809 bytes sent and stored, identical. The assignee is os-bill (read back). The worktree has been removed.",
"tests": "All on tree a8afd8be53, the pushed head e08db24's tree, run as local commit cf643cce9e before the trailer-only rewrite (full test at c466dc77c8 = rewritten bbabcc6). (a) Full pnpm --filter @objectstack/service-analytics test at c466dc77c8 (the later commit edits only the changeset): Test Files 174 passed (174), Tests 4142 passed | 247 skipped (4389), VERDICT command-exit 0. (b) typecheck: tsc --noEmit, VERDICT command-exit 0; it covers 171 test files (--listFiles). (c) dispatch-gates --commands: 64 families, all run, all exit 0; --ran: '64 derived famil(ies) accounted for, 64 run, 0 NOT-MEASURED'. (d) Downstream on the rebuilt dist (turbo build of all 71 packages, exit 0): rest analytics- 22 files / 291 passed; runtime analytics- 6 / 41; driver-memory date-range conformance 1 / 2; client 1 / 7; dogfood analytics- 8 / 70, all exit 0. (e) ESLint narrowed to the 27 changed code files: the population is eslint.config.mjs's files glob **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} minus ignores, with no parserOptions.project, so type-aware linting is off and untouched files' verdicts cannot move; --format json gives 27 files, 0 errors, 0 warnings. (f) F11 ablations, each predicted first (abl/predictions-f11.txt), mutated via scripts/ablation-replace.mjs, every restore blob == HEAD and git diff HEAD empty: A6 restore lteBound: 6 red, exactly as predicted. A7a drop the declared type at the analytics-service call site: 7 red, exactly the 7 preview text cells. The first A7a attempt was refused by the tool as a no-op (replacement ');' already occurred 290 times) and was re-run with a unique replacement. A7b reader answers not-datetime (the PM's predicted direction): 69 red = 5 pin + 2 matcher + 60 matrix datetime bare-day cases under both readers, plus 2 datetime bare-day preview pins in files I did not name (date-range-array-arm-arity #17124 control; where-door step-3 F11 pin), all in the predicted direction. (g) The pin file against the pre-F11 preview sources: 7 red (I predicted 6; the missed cell is the text window to the last day, which the old window copy answered r2,r3,r4). F9/F10 ablations A1..A5 are unchanged from round 1. (h) PostgreSQL parity cells not re-run this round: NOT MEASURED at this head, because no server ran. The F11 diff does not reach them, and the merged main touches only 3 test files in driver-sql and objectql.",
"mcp_calls": "0",
"api_writes": "4 this round, all through scripts/pm write tools and the fleet-write relay: (1) POST issues/21417/comments: the blocked os-dev-report, comment 5964429852; (2) pr_create: PR #21553 (draft, head claude/issue-21417-analytics-faces-delete-copies, base main); (3) label-write: assignee os-bill on #21553 (additive POST, read back); (4) POST issues/21417/comments: this final os-dev-report. Plus git push (a fast-forward d2f452b..e08db24). Reads: single-comment REST reads 5963878819 and 5962872882, and pulls/21553. Round 1 had 1 write (comment 5963857087). The second os-dev-report comment goes over the original one-comment budget because the blocked report came first; the coordinator asked for both.",
"gates_state": "Local: green (see tests). CI on #21553: in_progress at report time, not waited on (CI convergence belongs to the PM).",
"open_questions": [],
"deviations": [
"The original 3 commits carried a model-name co-author trailer, copied from the harness reminder against the os-dev rule. I rewrote them only after the maintainer's authorization, relayed by the PM. They were never published, so there was no force push.",
"There are two os-dev-report comments on #21417 this round (5964429852 blocked, then this one).",
"docs/design/predicate-compilation-convergence.md section 4.1 rows F9/F10/F11 are stale. They are outside the claim surface, are named in the PR body's Acceptance notes, and were not edited.",
"PostgreSQL parity cells were not re-run at this head (NOT MEASURED; reason in tests (h)).",
"A stray --dry-run of fleet-write dispatch against a non-JSON path ran once before the real pr_create dry-run; it was refused and sent nothing."
],
"out_of_scope_findings": [
"carrier: #21505 (the seat's coercion family card) · noted, not filed. The draft preview compares a temporal comparand as written (string vs instant): { signed_at: { $ne: '2026-07-28' } } answers r1..r5 vs the engine's r1,r3,r4,r5, and a window end spelled shorter than the stored instant ('...T10:00', '...T10:00:00') leaves out the row at exactly that instant. Measured through AnalyticsServicePlugin + queryDataset previewDrafts on SQLite. dedupe words: preview comparand coercion · previewDrafts temporal string compare · draft preview $ne datetime",
"carrier: the seat (named in the PR body's Acceptance notes) · noted, not filed. docs/design/predicate-compilation-convergence.md section 4.1's table rows F9, F10, F11 now read stale."
]
}

---

Generated by Claude Code