fix(service-analytics)!: the cube door asks the aggregate × field-type table for every measure (#21044)

[objectstack-fleet]

Fixes #21044
Clause-②: no (narrowing)

What changed

A configured cube's max over a text column was served at the cube door (POST /api/v1/analytics/query) by the native-SQL strategy, with the column's text, while the same response's fields[] declared the measure number. The dataset door refuses that pair at compile by the spec table AGGREGATE_FIELD_TYPE_COMPATIBILITY, and the cube door consulted nothing. Triage's direction (5924500811) is carried out as ruled: the cube door asks the one table, and no second table exists.

• The judgment (packages/services/service-analytics/src/cube-measure-field-type-door.ts, new, beside measure-result-type.ts): assertCubeMeasureFieldTypesAccepted refuses the first measures entry whose aggregate the table refuses for its column's declared type, INVALID_FIELD / 400 through invalidMemberError, with member, param: 'measures', cube, field and object on the error. The verdict is isAggregateCompatibleWithFieldType's; the accepted set the words name is read off the exported table. It judges every row of the table, as the dataset door does since decision batch 🔗 Broken links detected in documentation #127, with no scope condition on top of it. count_distinct keeps its own door ([finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912, structured-json-dimension-door.ts), which asks the same row plus the multiple: true declaration, so one pair has one verdict and one wording.
• Where it runs (analytics-service.ts): assertMeasureFieldTypes, called in ensureCube on all three paths (inferred cube, augmented cube, declared cube), right after the [finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807 / [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 door and before the where gate. That is ahead of callCtx and strategy selection, so both strategies see it once and nothing is read before it answers. The same placement covers the dry run (POST /api/v1/analytics/sql) and every query DatasetExecutor runs through queryIn.
• The column description (analytics-service.ts): withMeasureResultTypes, applied at the result seam in queryIn beside withDeclaredMeasureFormats, asks the dataset door's one rule, measureResultType, with the cube measure's aggregate and the declared type of the column it reads, and writes only what the rule answers. A min / max over date / datetime / time is now described time. ⛔ No copy of the rule in buildFieldMeta: both strategies are untouched.
• measure-result-type.ts: TSDoc only, one paragraph naming the cube door as the rule's second reader.
• .changeset/21044-cube-measure-field-type-table.md: @objectstack/service-analytics minor, BREAKING banner, Clause-②: no (narrowing), ADR-0087 not-required (already-registered dataset-measure-selecting-aggregate-field-type-refused, dataset-measure-aggregate-field-type-refused). check:adr-0087-registration accepts it.

The four measured questions of the dispatch

• H1, the card's reading on main. Confirmed through the real dispatcher route at base 2821e9f15b, SQLite and PostgreSQL 16.13, both strategies (table below). The native face served every refused min / max pair with the column's text under fields[] number. Since PR fix(objectql)!: engine aggregate asks the field-type table for every row — min / max / avg over a refused type answer INVALID_FIELD / 400 on every driver #21037 the ObjectQL face already answered 400 INVALID_FIELD, from the engine's aggregate door, after the strategy had begun: the words name the engine's position (aggregate('…'): aggregations[0].field takes the max of 'note', a declared text field…), and the error carries no member. sum over the same text column answered 0 on SQLite on both faces and 500 DATABASE_ERROR on PostgreSQL; avg answered 0 / 500 on the native face and 400 on the ObjectQL face.
• H2, where the door learns the source field type. From the resolver this file already uses for measure columns: declaredMemberEntry(cube, member, 'measure') (the one withDeclaredMeasureFormats reads) gives the cube measure, its sql is the column when it is a bare identifier, and the type is sourceFieldMeta(object, column).type, the base-object declaration the [finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807 / [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 door and compile() already read. ⛔ No second resolution of a member to a field. A relationship-path column is not judged (the declaration read is the base object's), which is the dataset door's tier.
• H3, where the refusal goes and its code. In ensureCube, as above. The code is INVALID_FIELD / 400, not the dataset door's DATASET_INVALID / 400, for the reason dataset-refusal.ts's header gives: DATASET_INVALID is a verdict about a dataset document, and /analytics/query carries none; a verdict about one member the request named is the INVALID_FIELD family. It is also the code the cube door's three source-field gates and its [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 count_distinct door answer, and the code the engine's door already answered for this very pair on the ObjectQL face, so that face's wire code does not move. The dataset door keeps DATASET_INVALID at compile and never reaches this door for a pair it refuses.
• H4, fields[] for an accepted non-numeric pair. By measureResultType, read at the cube door's result seam without widening the claimed surface: min / max over a temporal column is time; over a boolean column the rule declines (three readings disagree), so the producer's number stands, which is what SQLite (1) and the ObjectQL face on PostgreSQL (1) answer.

Triage's second sentence, "buildFieldMeta stops minting number for a non-numeric min / max", is delivered at the seam both strategies' results leave through rather than inside buildFieldMeta, which has no field types to read: a refused pair never reaches a descriptor, a temporal one is re-described time by the one rule, and a boolean one keeps number by that rule's own verdict.

Per-row readings, before and after

driver	strategy	measure	pair	before (2821e9f15b): status, value, fields[] type	after (d85b700030)
SQLite	native SQL	config max_note	max over note (text)	200, "y", number	400 INVALID_FIELD
SQLite	native SQL	config min_note	min over note (text)	200, "x", number	400 INVALID_FIELD
SQLite	native SQL	config max_status	max over status (select)	200, "won", number	400 INVALID_FIELD
SQLite	native SQL	config max_opened	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
SQLite	native SQL	config min_due	min over due_on (date)	200, "2026-01-15", number	200, "2026-01-15", time
SQLite	native SQL	config max_flag	max over flag (boolean)	200, 1, number	200, 1, number
SQLite	native SQL	config max_amount	max over amount (number) control	200, 32, number	200, 32, number
SQLite	native SQL	config sum_note	sum over note (text)	200, 0, number	400 INVALID_FIELD
SQLite	native SQL	config avg_note	avg over note (text)	200, 0, number	400 INVALID_FIELD
SQLite	native SQL	config cd_note	count_distinct over note (text) control	200, 2, number	200, 2, number
SQLite	native SQL	inferred note_max	max over note (text)	200, "y", number	400 INVALID_FIELD
SQLite	native SQL	inferred amount_max	max over amount (number) control	200, 32, number	200, 32, number
SQLite	native SQL	inferred opened_at_max	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
SQLite	native SQL	augmented note_max	max over note (text)	200, "y", number	400 INVALID_FIELD
SQLite	ObjectQL	config max_note	max over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
SQLite	ObjectQL	config min_note	min over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
SQLite	ObjectQL	config max_status	max over status (select)	400 INVALID_FIELD	400 INVALID_FIELD
SQLite	ObjectQL	config max_opened	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
SQLite	ObjectQL	config min_due	min over due_on (date)	200, "2026-01-15", number	200, "2026-01-15", time
SQLite	ObjectQL	config max_flag	max over flag (boolean)	200, 1, number	200, 1, number
SQLite	ObjectQL	config max_amount	max over amount (number) control	200, 32, number	200, 32, number
SQLite	ObjectQL	config sum_note	sum over note (text)	200, 0, number	400 INVALID_FIELD
SQLite	ObjectQL	config avg_note	avg over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
SQLite	ObjectQL	config cd_note	count_distinct over note (text) control	200, 2, number	200, 2, number
SQLite	ObjectQL	inferred note_max	max over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
SQLite	ObjectQL	inferred amount_max	max over amount (number) control	200, 32, number	200, 32, number
SQLite	ObjectQL	inferred opened_at_max	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
SQLite	ObjectQL	augmented note_max	max over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
PostgreSQL 16.13	native SQL	config max_note	max over note (text)	200, "y", number	400 INVALID_FIELD
PostgreSQL 16.13	native SQL	config min_note	min over note (text)	200, "x", number	400 INVALID_FIELD
PostgreSQL 16.13	native SQL	config max_status	max over status (select)	200, "won", number	400 INVALID_FIELD
PostgreSQL 16.13	native SQL	config max_opened	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
PostgreSQL 16.13	native SQL	config min_due	min over due_on (date)	200, "2026-01-15", number	200, "2026-01-15", time
PostgreSQL 16.13	native SQL	config max_flag	max over flag (boolean)	500 DATABASE_ERROR	500 DATABASE_ERROR
PostgreSQL 16.13	native SQL	config max_amount	max over amount (number) control	200, 32, number	200, 32, number
PostgreSQL 16.13	native SQL	config sum_note	sum over note (text)	500 DATABASE_ERROR	400 INVALID_FIELD
PostgreSQL 16.13	native SQL	config avg_note	avg over note (text)	500 DATABASE_ERROR	400 INVALID_FIELD
PostgreSQL 16.13	native SQL	config cd_note	count_distinct over note (text) control	200, 2, number	200, 2, number
PostgreSQL 16.13	native SQL	inferred note_max	max over note (text)	200, "y", number	400 INVALID_FIELD
PostgreSQL 16.13	native SQL	inferred amount_max	max over amount (number) control	200, 32, number	200, 32, number
PostgreSQL 16.13	native SQL	inferred opened_at_max	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
PostgreSQL 16.13	native SQL	augmented note_max	max over note (text)	200, "y", number	400 INVALID_FIELD
PostgreSQL 16.13	ObjectQL	config max_note	max over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
PostgreSQL 16.13	ObjectQL	config min_note	min over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
PostgreSQL 16.13	ObjectQL	config max_status	max over status (select)	400 INVALID_FIELD	400 INVALID_FIELD
PostgreSQL 16.13	ObjectQL	config max_opened	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
PostgreSQL 16.13	ObjectQL	config min_due	min over due_on (date)	200, "2026-01-15", number	200, "2026-01-15", time
PostgreSQL 16.13	ObjectQL	config max_flag	max over flag (boolean)	200, 1, number	200, 1, number
PostgreSQL 16.13	ObjectQL	config max_amount	max over amount (number) control	200, 32, number	200, 32, number
PostgreSQL 16.13	ObjectQL	config sum_note	sum over note (text)	500 DATABASE_ERROR	400 INVALID_FIELD
PostgreSQL 16.13	ObjectQL	config avg_note	avg over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
PostgreSQL 16.13	ObjectQL	config cd_note	count_distinct over note (text) control	200, 2, number	200, 2, number
PostgreSQL 16.13	ObjectQL	inferred note_max	max over note (text)	400 INVALID_FIELD	400 INVALID_FIELD
PostgreSQL 16.13	ObjectQL	inferred amount_max	max over amount (number) control	200, 32, number	200, 32, number
PostgreSQL 16.13	ObjectQL	inferred opened_at_max	max over opened_at (datetime)	200, "2026-03-04T05:06:07.000Z", number	200, "2026-03-04T05:06:07.000Z", time
PostgreSQL 16.13	ObjectQL	augmented note_max	max over note (text)	400 INVALID_FIELD	400 INVALID_FIELD

"Before" is base 2821e9f15b; "after" is this branch's head d85b700030 (two merges of main in, the second carrying #21098's 401 for an anonymous analytics caller, so the probe signs its caller in). Both were read through the real dispatcher-plugin mount of POST /api/v1/analytics/query, over AnalyticsServicePlugin composed on a real ObjectQL engine and SqlDriver, by a scratch probe that was deleted after each run. Two rows of a ledger: note x / y (text), status open / won (select), two instants and two days, flag true / false, amount 10 / 32. "Inferred" is an unregistered cube name (the object's), "augmented" a suffix-inferred measure on the configured cube. The same 56 readings were taken again after the first merge of main (0abe2120fb): no row differs from the head's. Since #21103 landed (in the second merge) the engine's door also refuses sum over a refused type, so on the ObjectQL face the sum rows would answer 400 without this change too; this door answers first.

Pins (red first), the ablation

• Red, on the tree committed as be5c1a69b2 (pins only, no fix; base 2821e9f15b), SQLite and a private PostgreSQL 16.13:
  • service-analytics src/__tests__/cube-measure-field-type-door.test.ts (new) and the flipped native-sql-measure-number-presentation.test.ts: 16 failed, 16 passed, 1 skipped. Failures: max_note must not be served: expected { rows: [ { max_note: 'y' } ], …(1) } to be undefined (native), max_note: expected undefined to be 'max_note' (ObjectQL: the engine's refusal carries no member), max_opened is described time: expected 'number' to be 'time', expected the query to be refused, but it resolved (dry run).
  • runtime src/analytics-cube-measure-field-type-door.test.ts (new): 6 failed, 6 passed. Native max_note answered 200; both faces described max_opened number. The ObjectQL face's 400 INVALID_FIELD and both faces' number controls were green already.
• Fixture triage. native-sql-measure-number-presentation.test.ts ([finding] analytics: on PostgreSQL the native-SQL path answers a measure the response declares number as a string (count: "2"), where SQLite answers 2 — the class #20335 closed at the engine door #20889) read a configured cube's max over its code text column back as text, as the second half of its "keyed on the declared function, never on the value" control. That pin held exactly the served pair this card refuses, so it is flipped, not deleted: the case now asserts INVALID_FIELD / 400 with no statement run, keeps its text-dimension half, and the cube read above it no longer asks for max_code.
• Green, at d85b700030: the same files 32 passed, 1 skipped (the PostgreSQL native max over boolean cell, a named skip: an accepted pair that is a 500 there, see Acceptance notes) and 12 passed.
• Ablation (the cube door's table check removed), from committed code at 5d69394a60. Predicted before running, in progress.log: service-analytics 12 red (per dialect: the native refusal, the ObjectQL refusal, both inferred-measure cases, the dry run and the flipped [finding] analytics: on PostgreSQL the native-SQL path answers a measure the response declares number as a string (count: "2"), where SQLite answers 2 — the class #20335 closed at the engine door #20889 case), 20 green, 1 skipped; runtime 2 red (the native refusal on both dialects), 10 green, because the engine's door still answers the ObjectQL face's 400 INVALID_FIELD on the wire.
  • The mutation went through scripts/ablation-replace.mjs (WRAP mode, trap-restored, absolute path): if (isAggregateCompatibleWithFieldType(aggregate, declared)) continue; gained || String(aggregate) !== 'ABLATION-21044', so every pair passes. Anchor 1 to 0, marker 0 to 1, blob 6c7bdce48e43 to f49be3058c84. A second trap in the outer script restored by absolute path too.
  • service-analytics was rebuilt, and ablation-dist-preflight.mjs found the marker in 2 built files (dist/index.cjs, dist/index.js).
  • Observed: service-analytics 12 failed, 20 passed, 1 skipped; runtime 2 failed, 10 passed. Exactly as predicted.
  • Restore: blob after restore 6c7bdce48e43 equals HEAD, git diff HEAD empty, whole-tree porcelain 0 lines. Then rebuilt, and ablation-dist-preflight.mjs --absent: marker absent from all 6 built files and the tree clean. The pins are green again at both later heads.

Tests (at d85b700030, after pnpm install --frozen-lockfile and a full turbo run build, 73 tasks)

• @objectstack/service-analytics, full suite with OS_TEST_POSTGRES_URL set (no PostgreSQL cell skipped): 156 files, 3558 passed, 1 skipped (the named cell above). typecheck exit 0; tsc --noEmit --listFiles lists both touched test files.
• @objectstack/rest, src/analytics-* and rest-hook-refusal-message-parity, with PostgreSQL: 20 files, 279 passed.
• @objectstack/runtime, src/analytics-*, src/dispatcher*, src/http-dispatcher*, src/domains/analytics* and the other analytics-route suites: 51 files, 843 passed. typecheck exit 0, check:test-typecheck holds its ledger (27 files, 190 errors, 68 signatures; the new file adds none).
• Not run locally, declared to CI: the whole rest and runtime suites, and packages/qa/dogfood (Dogfood Regression Gate).

Gates (at d85b700030, as ONE sequential script under the shared verify lock, each exit code captured before any pipe)

• Derived families: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack names 62. --ran reconciles: 62 derived famil(ies) accounted for — 62 run, 0 NOT-MEASURED (a DERIVED zero — all 62 recorded an exit code and none of them is 3). All 62 exit 0. check:dual-build-cjs-loads and check:type-check-debt answered PREREQUISITE NOT MET (exit 3) on the first sweep at 0abe2120fb, which had built only the dependency closure; after a full turbo run build (73 tasks) both exit 0, and both are 0 in the sweep at this head.
• The five roster families the derivation marks ⛔ (a roster in a directory this diff touches): node scripts/check-changeset-fixed.mjs, pnpm check:authz-resolver, pnpm check:error-code-casing, pnpm check:filter-alias-parity, pnpm check:route-ledger-census. All exit 0.
• check:adr-0087-registration reads the changeset as [BREAKING+bang+clause-②-narrowing] not-required (already-registered). check-changeset-no-major: no major bump. check:nul-bytes: 9734 text files, no raw control bytes.

ESLint, a declared narrowing (the repo-wide pnpm lint is CI's)

• Touched files: eslint --no-inline-config --format json over the 6 touched .ts files at 0abe2120fb (the two later commits are a merge of main and a test-only harness change of 7 lines). From the JSON: 6 files, 0 errors, 0 warnings, 0 ignored.
• Population: eslint.config.mjs's files: ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'] minus NEVER_LINTED, which contains all 6 (none came back ignored).
• Invariance: the config enables no type-aware linting (no parserOptions.project or projectService in any block), and this diff does not touch the config, so no untouched file's verdict can move.

Beyond the claimed file surface

• The route pin lives in packages/runtime/src/, not beside packages/rest/src/analytics-*.test.ts. The cube door, POST /api/v1/analytics/query, is mounted by @objectstack/runtime's dispatcher-plugin; RestServer mounts only /analytics/dataset/query, so a pin in rest cannot reach this route. The new file is test-only and sits beside the sibling analytics route pins there. rest's analytics suites were run as well (above).
• sum / avg are judged by the same door. The claim priced the narrowing as min / max; the door asks the table for every row, as the dataset door has since decision batch 🔗 Broken links detected in documentation #127, because a min / max-only condition would be a second scope on top of the one table, the shape dataset-compiler.ts records retiring. Measured, those rows answered 0 on SQLite and 500 on PostgreSQL before (table above), and the changeset prices them. No shipped cube authors either.

Acceptance notes

• NOT MEASURED: MySQL (no server here). The door runs before any driver, so its verdict cannot depend on the dialect; the time description reads metadata only.
• NOT MEASURED locally: packages/qa/dogfood (Dogfood Regression Gate is CI's). The one shipped cube, examples/app-showcase's showcase_delivery, declares count over * and sum / avg over estimate_hours (Field.number): every pair accepted. Every other min / max / sum / avg in examples/** is a dataset measure, which the dataset door already judged.
• NOT MEASURED: the console. A console widget that sends a suffix-inferred FIELD_max / FIELD_sum to /analytics/query over a refused field now gets 400 INVALID_FIELD; the sibling repository was not read (dispatch order).
• Relationship-path measures are not judged here, measured at the head: a configured measure { type: 'max', sql: 'account.name' } over a related text field is still served on the native face (200, "zeta", fields[] number, SQLite and PostgreSQL), and { type: 'max', sql: 'account.revenue' } over a related number field answers the string "250.000000000000000000000000000000" on PostgreSQL's native face under fields[] number. The ObjectQL face refuses both as a cross-object measure (400 INVALID_FIELD). Judging them needs the declaration on the hop's object, which is the hop-object resolution this dispatch fences off (analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986's sites); the door stands down on a dotted column rather than guess, the dataset door's tier. This is the second position the seat's comment 5924234751 names; reported to the seat, not fixed here.
• PostgreSQL's native face answers 500 DATABASE_ERROR for max over a boolean column, a pair the table ACCEPTS (function max(boolean) does not exist); SQLite and the ObjectQL face on PostgreSQL answer 1. Unchanged by this PR (measured before and after); the boolean pin skips that one cell by name. Reported to the seat.
• main advanced three commits after the second merge (a11faeecb3, 99398542b3, 53ed3d1093: objectql's aggregation-filter door, driver-mongodb and the showcase's security set). None touches service-analytics, the dispatcher or the spec table; CI and the merge queue read the merged generation.
• The private PostgreSQL 16.13 cluster used for every live cell runs on 127.0.0.1 from /tmp; it is stopped and its directory removed with this delivery.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 13 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/measure-result-type.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ai/natural-language-queries.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))
• content/docs/data-modeling/queries.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))
• content/docs/deployment/validating-metadata.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))
• content/docs/kernel/contracts/data-engine.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))
• content/docs/protocol/objectql/query-syntax.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))
• content/docs/ui/dashboards.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))
• content/docs/releases/v17/17-0.mdx (via count_distinct (literal, a string literal in isJudgedAggregate))
• content/docs/releases/v17/17-5.mdx (via AnalyticsService (symbol, a top-level class), count_distinct (literal, a string literal in isJudgedAggregate))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/measure-result-type.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 10 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a11faeecb34eb14800d64769cb86a8e1140988f1 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 05e96aef676c8676a10126e490c5a7fa2348f9e3 — the merge of head d85b700030e079e1d3804c81f62e3ca208ce898f into base a11faeecb34eb14800d64769cb86a8e1140988f1, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 05e96aef676c8676a10126e490c5a7fa2348f9e3 && git checkout 05e96aef676c8676a10126e490c5a7fa2348f9e3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a11faeecb34eb14800d64769cb86a8e1140988f1 d85b700030e079e1d3804c81f62e3ca208ce898f && git checkout -B drift-repro a11faeecb34eb14800d64769cb86a8e1140988f1 && git merge --no-ff d85b700030e079e1d3804c81f62e3ca208ce898f

node scripts/docs-audit/affected-docs.mjs --json a11faeecb34eb14800d64769cb86a8e1140988f1

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs a11faeecb34eb14800d64769cb86a8e1140988f1 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d85b700030e079e1d3804c81f62e3ca208ce898f
Local-runs: none

Isolated review for the domain:services seat (#6021). Inputs: card #21044 (body and all six comments, triage's grade 5924500811 and the seat's ACCEPT 5927661478 included), PR #21128 (body, 7-file list, net diff 12fbb2fac8..d85b700030 against the merge base with main; the three main commits past that base touch no file this PR touches), and the 31 check-runs on the head. Not an input: the dispatch order's conclusions.

① Derived judgments

• One table, read through the spec's own predicate — right. cube-measure-field-type-door.ts decides with isAggregateCompatibleWithFieldType alone and names the accepted set off AGGREGATE_FIELD_TYPE_COMPATIBILITY[aggregate]; the only literals in the door are the count_distinct exclusion and two sentences of reason prose, neither a row. packages/spec/** is untouched in the diff, so the table is read, never edited.
• Ahead of strategy selection on every cube path — right. assertMeasureFieldTypes sits in ensureCube on all three arms (inferred, augmented, declared), after the [finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807 / [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 door and before the where gate; ensureCube precedes callCtx in both queryIn (query(), and every DatasetExecutor pass, which calls this.service.query) and generateSql (the /analytics/sql dry run). The pins count zero raw statements and zero engine aggregates on a refusal.
• Code and envelope — right. INVALID_FIELD / 400 through invalidMemberError with member, param: 'measures', cube, plus field and object, per dataset-refusal.ts's rule (a verdict about one member the request named; /analytics/query carries no dataset document), the code the three source-field gates, the [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 door and the engine's aggregate door already answer. The dataset door keeps DATASET_INVALID at compile and never reaches this door for a pair it refuses; a pair compile accepts, this door accepts (same predicate over the same declaration).
• Every row judged, not only min / max — right, and the seat's reading holds. dataset-compiler.ts's assertAggregateFieldTypeCompatible judges all six aggregates with no scope condition since decision batch 🔗 Broken links detected in documentation #127, so "as the dataset door does" is literal. No table-accepted pair can newly refuse: the door's only verdict is the predicate, and a column it cannot resolve, a type outside FieldType, a non-bare cube.sql, a dotted path or a host with no sourceFieldMeta stand down. The pairs that newly refuse beyond the card's min / max over strings (sum / avg over non-numeric, non-boolean types, sum over percent, every arithmetic or order aggregate over formula, the JSON-stored and file types) are all rows the table refuses, were measured on the base as 0 on SQLite / 500 on PostgreSQL, and are priced in the changeset.
• Shipped cubes carry no refused pair — right. examples/app-showcase showcase_delivery: count over *, sum / avg over estimate_hours, declared Field.number (task.object.ts). examples/app-crm registers no cube. The packages/qa/downstream-contract dc_pipeline fixture: count over *. Every other arithmetic measure under examples/** is a dataset measure, already judged at compile.
• count_distinct keeps its own door, no double judgment — right. isJudgedAggregate excludes it by name; the [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 door runs immediately before on each ensureCube arm and asks the same row plus isMultiValueField.
• The temporal fields[] description — the dataset door's one rule, unchanged; a published-shape change, priced. withMeasureResultTypes at queryIn's result seam asks measureResultType with the cube measure's aggregate and the base-object column's declared type. measure-result-type.ts changes by eight TSDoc lines only; the function body is byte-identical, and it is the same call the dataset door makes in its ADR-0021 enrichment, so a dataset pass through both seams is idempotent. On the wire a cube-door min / max over date / datetime / time now reads fields[].type: 'time' where it read number: a value change in an existing key (no new key, so Clause-② stays no), named in the changeset's third FROM → TO bullet and in "Who is affected". Boolean keeps number by the rule's own verdict. Both strategies' buildFieldMeta are untouched; triage's "buildFieldMeta stops minting number" is delivered at the one seam that holds both halves, which is the shape the dataset door chose — right.
• Public surface — right. No index.ts and no spec file in the diff: the door module is internal, no export or published type moves. AggregationFunction moves from a type import to the Zod enum value (.options), which spec/data/query.zod.ts exports.
• The flipped pin — right. native-sql-measure-number-presentation.test.ts held the exact served pair (max over the code text column) as a control; it now pins the refusal with no statement run and keeps its text-dimension half.
• Check-runs on the head, read after the last one completed: 34 runs, 31 success, 3 skipped (Build Docs, Console Pin Gate, the opt-in packed-tarball smoke — path-filtered), 0 failures. All seven required contexts success: Lint & Repo Gates (the check:* gates, check:adr-0087-registration and check-changeset-no-major included), TypeScript Type Check (and its four sub-jobs), Test Core (6/6 shards), Dogfood Regression Gate (3/3), Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. Check Changeset, Check PR Size, Part-of PR must not also close its card and The card this PR closes must claim this branch are success too. These conclusions are the gate verdicts; nothing was re-run here.

② Semver level

• .changeset/21044-cube-measure-field-type-table.md: @objectstack/service-analytics: minor, BREAKING banner, FROM → TO with the one-line fix, Clause-②: no (narrowing), matching the PR body's line 2 and the ! in the title.
• Clause-②: no (narrowing) — right. No new key on any published payload (no); the accept set of POST /api/v1/analytics/query and /analytics/sql narrows ((narrowing) is BREAKING). The fields[].type value change rides the same banner.
• minor — right. The launch-window convention (check-changeset-no-major.mjs: a breaking change ships as minor, major is refused) and Check Changeset green.
• ADR-0087 not-required (already-registered dataset-measure-selecting-aggregate-field-type-refused, dataset-measure-aggregate-field-type-refused) — right category. Both ids exist at the merge base (packages/spec/src/migrations/entries/semantic/18.*); the pairs this door refuses are exactly the pairs those two entries register, with the same three routes (count, a sort for a first or last record, a numeric or temporal field for a quantity stored as text). It is the disposition the lane landed for the identical shape, a query-time reader of the same table (.changeset/20914-aggregate-door-whole-table.md and 20914-release-sum-row.md, the engine door), and the alternatives are closed on facts: registered needs an id new in this diff (the claim fenced packages/spec/src/**, and a second entry would be a second account of one pair), no-migration-prescription is refused by the FROM → TO body, unpublished / runtime-interface-only / type-surface-only do not describe a runtime narrowing. One residual, recorded in ③: the two entries' surface prose names DatasetMeasureSchema rows and not Cube.measures.

③ Boundary flags

• Dev deviation 1, every row judged — answered right (① above); the seat's acceptance "as the dataset door does" is the compile leg's literal scope.
• Dev deviation 2, the route pin in packages/runtime/src — answered right. /analytics/query and /analytics/sql are mounted by runtime's domains/analytics.ts; packages/rest carries only the dataset door (analytics-selection-door.ts says so). Four sibling analytics-*.test.ts route pins already live beside the new file.
• Dev deviation 3, the third commit signs the pin's caller in — answered right. Test-only, seven lines: an auth slot whose getSession answers a session, the shape fix(runtime)!: the analytics dispatcher faces refuse an unauthenticated caller with 401 UNAUTHENTICATED (#21061) #21098's 401 door reads; route, service and engine stay real.
• Dev deviations 4 and 5, the private PostgreSQL under /tmp, the port held by another agent's cluster (one database created and dropped), the scratchpad parent modes — container-local, no repository effect; recorded by the seat. The port collision is the near miss of Multi-agent discipline §8 (a server one did not start); it was noticed and undone within a minute and touched nothing else.
• Open question, Fixes versus Part of — the seat's A is right. Triage's acceptance (5924500811) is met clause by clause on the base-object column that is the card's title and reach: judged by the one table at the cube door as the dataset door does; no second table; a served non-numeric min / max no longer reads number; max over text refused and max over a number served typed number, both pinned on both strategies. The relationship-path position is the seat's own later note (5924234751, not a claim, never folded into the grade), and the dataset door stands down on a dotted field in exactly the same way; Part-of PR must not also close its card is green.
• Finding carrier, PostgreSQL native max / min over boolean answers 500 — analytics: the native-SQL strategy skips the engine aggregate policies — SUM/AVG exact decimal on PostgreSQL (not #20387's double), and an all-NULL group sums to null where the ObjectQL face folds it to 0 (#15546) #21042 is right. The pair is table-ACCEPTED, so no door's; ruling 5925613967 Q2 applies the boolean-aggregand cast to sum / avg / min / max in the native compile, and the reading is unchanged by this PR. Note for analytics: the native-SQL strategy skips the engine aggregate policies — SUM/AVG exact decimal on PostgreSQL (not #20387's double), and an all-NULL group sums to null where the ObjectQL face folds it to 0 (#15546) #21042's build: the new service pin skips that one cell by name (it.skipIf on PostgreSQL native for max_flag); lift the skip when the cast lands. The PostgreSQL cell is un-run in CI, so the skip hides nothing today.
• Finding carrier, relationship-path min / max — analytics: a config cube min / max whose sql is a relationship path is neither judged by the aggregate field-type table nor presented by its declared type on the native face (#21044's family, the dotted half) #21129 is right. The base-object door is complete and pinned; the dotted half needs the hop's object declaration through the one resolver (analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986, PR fix(service-analytics)!: a relationship-path hop with no declared join reads the object its lookup field declares (#20986) #21088) and names its own pins; the card carries the dev's measured readings and "no second resolution".
• Escalated to the owning seat (not a landing condition): the ADR-0087 entries' surface prose. dataset-measure-selecting-aggregate-field-type-refused and dataset-measure-aggregate-field-type-refused describe DatasetMeasureSchema rows; a cube author reading the upgrade guide for an analytics_cube measure finds the same pair and routes under the dataset heading only. The [finding] two more JSON-stored columns as a group or distinct key answer 500 on PostgreSQL: groupBy on a multiple: true select, and count_distinct on a json field #20808 changeset amended one entry's prose for its rider; the same one-line amendment in packages/spec/src/migrations/entries/semantic/18.* would name Cube.measures as a reader. Spec-side, outside this PR's fenced surface.
• NOT MEASURED, declared and acceptable: MySQL (the door reads metadata before any driver, and Temporal Conformance (live PG + MySQL) is in the gate set above); the console sibling (not read, per the order; a widget sending a suffix-inferred measure over a refused field now receives the 400 the changeset's "Who is affected" names).

Read at 2026-10-01T08:38Z: the card, the PR, the net diff and the head's check-runs; nothing built, run or re-run.

Implemented-by: claude/issue-21044-cube-measure-type-table
Reviewed-by: session_01XY5uCwTjZj7884yYtyur4H

VERDICT: PASS

---

Generated by Claude Code