fix(service-analytics)!: the analytics where door runs every arm of the shared comparand-shape face on the object spelling (#20010)

[objectstack-fleet]

Part of #20010: this PR carries the shared comparand-SHAPE face's arms. #20010 remains open for two arms: $ne with a list, which waits on #19886 stage 2, and the comparand-TYPE face, which the card has answered and #20035 carries.

Clause-②: no (narrowing)

What this changes

The analytics where door (lowerAnalyticsWhere in packages/services/service-analytics/src/strategies/filter-normalizer.ts) now hands every field entry of an object-form condition to the shared comparand-shape face, assertListComparandShapes (@objectstack/spec/data). Before, it ran only the equality arm (PR #20008). Each shape below is now refused with INVALID_FILTER / 400, carrying the face's own message, path and prescription. The FilterArray spelling of the same condition gets the same bytes, because it met the face inside parseFilterAST all along.

The face's docblock records the rulings that put these positions on it:

• 2026-08-31 ([finding] driver-memory's matcher answers a NULL comparand inconsistently across the two readings of "no value" — $in:[null] / $nin:[null] disagree while $null / $ne:null agree #13357): "A null member of $in / $nin, and a null $between endpoint (driver-memory's reference matcher answers {$between: [null, null]} with EVERY valued row — the range arm's two comparisons are both false against a null bound, so a bounded range stops bounding #13495's shape), are refused at this door".
• 2026-09-01 ($gt/$gte/$lt/$lte with a null COMPARAND is the one null-comparand position the filter contract still accepts — and the two driver-memory faces answer it differently #14080): "A null comparand of $gt / $gte / $lt / $lte … refused at this door, same envelope, so the divergent cells are constructively unreachable".
• 2026-09-20 (finding(spec): the RUNTIME filter door accepts a blank $between endpoint that the published endpoint contract now refuses — parseFilterAST disagrees with RANGE_ENDPOINT_DESCRIPTION #19071): "'' and undefined are refused, naming the blank side (MIN / MAX and the index)".
• Its original rule (数据 API:集合算子 not_in/in 的比较值是标量(非数组)时答 500 DATABASE_ERROR,而不是带信封的 400 —— 而这个形状是 spec 合法的 ViewFilterRule #5869, moved to the face by The #5869 list-comparand rule is enforced only at the engine seam: a scalar in/nin comparand still reaches a driver, and on mingo >= 7.2.3 it escapes as a raw TypeError #9228): $in / $nin / $between receive a list at all.

How:

• assertWhereComparandShapes makes two passes over one shared traversal, forEachWhereFieldEntry. The traversal walks $and / $or / $not and field entries, the way the face walks them, and also descends a nested relation, because this compiler flattens one to its dotted member.
• Pass 1 is the [finding] service-analytics' filter normalizer reads an implicit-equality ARRAY as IN, while ruling 乙 refuses the same shape at the shared face "for every driver at once" #19888 equality pass, unchanged, so a list in the equality slot is still diagnosed first.
• Pass 2 hands each whole entry to the face as a one-entry node with the same path seed, where. The face therefore reports exactly the path and field it reports on the whole condition.
• The draft-data preview (preview-evaluator.ts) calls the same exported gate, so a drafted chart refuses what the published chart refuses.

Measured first (recorded on this branch as a508dddc2c, before any source change)

Base origin/main 44639665ee. The harness was a real sql.js engine (driver-sqlite-wasm) over rows d1 (amt 1, 'won'), d2 (5, 'lost'), d3 (10, 'open'), d4 (NULL, NULL) and d5 (3, ''). It ran five faces:

• normalizeAnalyticsFilterTree;
• the native SQL execute;
• the /analytics/sql echo;
• the ObjectQL engine path, where a probe engine.aggregate records the condition it receives and the engine seam's two spec faces are then run on it;
• the draft preview.

arm	object spelling at base	FilterArray spelling	governing record
null $in member {stage:{$in:['won',null]}}	tree in ['won',null]; native stage IN (?, ?): d1; the engine seam refused it; the preview served d1, d4	400, null list member	2026-08-31 ruling, #13357 record 5472662504
null $nin member	notSet OR notIn ['won',null]; native: d4 only; the preview served d2, d3, d5	400	2026-08-31
null ordering comparand $gt/$gte/$lt/$lte	amt > NULL: no row; the preview served d1, d2, d3, d5 for $lt / $lte	400, null ordering comparand	2026-09-01 ruling, #14080 record 5494521768
null $between endpoint [null, 5]	amt >= NULL AND amt <= 5: no row; the engine received {amt:{$gte:null,$lte:5}} and refused it as a $gte, an operator the author never wrote	400, null range bound	2026-08-31
blank $between endpoint ['', 5]	amt >= '' AND amt <= 5; the engine path ACCEPTED {$gte:''}; the preview served d1, d2, d5	400, blank bound, MIN named	2026-09-20 ruling, #19071 record 5748839561
scalar $in 'won'	laundered to in ['won']: native d1; the engine accepted it as a list	400, requires an ARRAY	#5869 / #9228
scalar $nin 'won'	laundered: native d2, d3, d4, d5; the engine accepted it	400	#5869 / #9228
$in: null	in [null]; the engine refused it as a null MEMBER (after the laundering)	400, requires an ARRAY	#5869 / #9228
undefined $between endpoint	refused 400, in this door's #6386 wording	refused 400, the face's blank wording	2026-09-20 names undefined; wording only
{ $field } $between endpoint	refused 400, this door's #7598 wording	refused 400, the face's wording	2026-08-11 (#7596); wording only
one-bound / scalar $between	refused 400, this door's "two-element" wording	refused 400, the face's wording	#5869 / #9228; wording only
nested relation {acct:{amt:{$gt:null}}}, dotted {'acct.amt':…}	compiled acct.amt gt [null]	refused	as the arm
$ne with a list {stage:{$ne:['won','lost']}}	both spellings compile stage IS NULL OR stage != 'won'; 'lost' is dropped	the same: the face does not judge $ne yet	waits on #19886 stage 2 (ruling A, record 5805254639)

After the change, re-measured at 142b554f0e, every row above except $ne is refused on all five faces. The object message equals the FilterArray message byte for byte, for every arm that has a FilterArray spelling. The one exception is the nested-relation spelling: the face names the leaf key ("amt" at where.acct.amt.$gt), which is the convention #19888 set, while the dotted spelling names "acct.amt". The $ne row is unchanged on both spellings.

Stored filters in this repository. A text scan covered 4013 non-test tracked files under examples/, packages/, content/, skills/, apps/ and docs/. Its detectors were: a null member of a $in / $nin list; a null ordering comparand; a null / blank / undefined $between endpoint; and a scalar $in / $nin. Positive controls: a synthetic fixture hit on all four detectors; C1 = 451 $in/$nin lists, C2 = 495 ordering operators and C3 = 61 $between lists were counted. Every hit is a false positive: a comment, an operator-name map, a doc line or a CHANGELOG line. No authored filter carries a moved shape. Limits: this is a text scan, not an AST scan, so a comparand held in a variable is invisible to it. Deployed sys_metadata rows: NOT MEASURED.

Compile surfaces (the face's non-equality arms)

surface	verdict
lowerAnalyticsWhere / normalizeAnalyticsFilterTree: caller where, dataset scope filter, measure filter; native execute, /analytics/sql echo, ObjectQL engine path	changed. Every arm is refused before any statement or engine.aggregate call. Measured over sql.js before and after; pinned per face.
evaluateAnalyticsQueryOverRows / matchesWhere (draft preview)	changed, as a bounded in-place fix (see Deviations). It calls the same exported gate.
assertListComparandShapes (the spec's shared face)	already compliant. It is the face; this PR calls it and does not change it.
parseFilterAST (this door's FilterArray spelling)	already compliant. Measured at base: every arm's FilterArray spelling was refused.
ObjectQL engine seam (lowerWhereFilterArray, engine.ts)	already compliant. It runs the shape and type faces on the object form. At base it refused the null arms it received, but it accepted what this door had already laundered ($in: ['won'], $gte: ''). That is no longer reachable from this door.
compileScopedFilterToSql (service-analytics read scope)	out of scope. It is a separate door with a separate envelope (500), and read-scope-sql.ts was held by PR #20017 during this dispatch. Not re-measured here.
applyFilterCondition (driver-sql), checkCondition (driver-memory), buildWhereSQL (driver-turso), matchesFilterCondition (formula), translateFieldOperators (driver-mongodb)	already compliant at the platform doors. Each sits behind parseFilterAST or the engine seam, which run the face (the rulings' own scope). Not re-measured here.
applyHaving / matchesHaving (objectql HAVING)	out of scope. A different door, over aggregated rows.

Tests and evidence (head 33c73fdff4, origin/main 26550c6603 merged in)

• Round 2 (33c73fdff4): a consumer pin in packages/rest. CI was red on a1bdbf1d59 (Test Core 3/6): src/analytics-filter-refusal-envelope.test.ts asserted the old analytics sentence for a one-bound $between (/needs a two-element \[min, max\] array/). The verdict was already right; only the message had moved. That one case is re-judged, test-only. Its verdict assertions stay (400 INVALID_FILTER through the real dataset route, which is analytics 的 filter 拒收到不了调用方:service 侧多数拒收没有 ADR-0112 信封,REST 面又用 message 正则嗅探,一律答 500 #5352's point), and the message assertion now matches the face's sentence, with a note citing the face's rule (数据 API:集合算子 not_in/in 的比较值是标量(非数组)时答 500 DATABASE_ERROR,而不是带信封的 400 —— 而这个形状是 spec 合法的 ViewFilterRule #5869, moved to the face by The #5869 list-comparand rule is enforced only at the engine seam: a scalar in/nin comparand still reaches a driver, and on mingo >= 7.2.3 it escapes as a raw TypeError #9228).

  • Census of consumer pins on the three re-worded refusals, across every test file under packages/** and examples/** (4014 files). It searched for the analytics "two-element" sentence, the [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 { $field } endpoint sentence ("may not be a field reference", "has the field reference"), the service-analytics 的 where 门把 undefined 值的键整个丢掉 —— 单键 where 退化成「无过滤器」，方向是加宽（#6125 五面表漏记的第六、七种读法） #6386 undefined sentence at a $between position, and the [analytics] "$between" prefix. It then checked, one by one, every test in the 100 files outside this package that reach service-analytics, for $between / null / scalar-$in shapes. One hit: this packages/rest case. Every other "two-element" hit is a date-range arity message, a search-term arity or a spec test. The remaining $between hits are drivers' own refusals or the read-scope door, none of which this PR moves.
  • Full @objectstack/rest suite (built against this branch's service-analytics dist/): 194 files, 3265 passed and 1 skipped. VERDICT command-exit 0. The touched file alone: 31 passed.
  • Ablation D, dist-resolved. This case reads @objectstack/service-analytics through dist/, so it was run as a dist ablation. The all-arms pass was removed through scripts/ablation-replace.mjs, the package was rebuilt, and ablation-dist-preflight put the marker in 2 built files. Predicted 1; measured 1 red / 30 green: expected '[analytics] "$between" on "amount" ne…' to match /Operator "\$between" on field "amount…/. Restore: source blob == HEAD, rebuilt, --absent read the marker absent from all 6 built files, whole tree clean.
  • pnpm --filter @objectstack/rest typecheck exits 0, but that package's tsconfig does not compile its test files (0 in --listFiles), so it measures nothing about this one. eslint --no-inline-config on the file: 0 errors, 0 warnings.

• New src/__tests__/where-face-arms-refusal.test.ts, 101 tests. Every refusal asserts code and status, plus the face's opening sentence.

  • Every arm at 25 positions: each null, blank, non-list, one-bound and { $field } shape; under $and, $or, $not and $not over $or; beside a legal operator; inside a nested relation; on a dotted member.
  • Byte identity (17): the object spelling equals the FilterArray spelling, which equals the face's own message.
  • What is diagnosed first (3). The equality list comes first even when another refused entry precedes it. The face comes before this door's member gates (service-analytics 的 where 门把 undefined 值的键整个丢掉 —— 单键 where 退化成「无过滤器」，方向是加宽（#6125 五面表漏记的第六、七种读法） #6386 undefined, service-analytics 的 where 门：字段约束里 $ 算子与非 $ 键混写时，非 $ 兄弟键被静默丢掉（方向是加宽；与值无关，不是 #6386 的 undefined） #6444 mixed wrapper). CONTROL: an undefined outside a $between endpoint keeps service-analytics 的 where 门把 undefined 值的键整个丢掉 —— 单键 where 退化成「无过滤器」，方向是加宽（#6125 五面表漏记的第六、七种读法） #6386's sentence.
  • $ne held as PARITY with the face (2). The test does not pin the [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 defect in either direction.
  • 15 neighbouring shapes that compile as before: $in: [], $nin: [], falsy members, scalar ordering comparands, { $field } in an ordering slot, the null predicate spellings, $contains: null, a nested scalar, and four legal $between ranges, including a whitespace-only endpoint, which the face does not judge.
  • Four faces over a real engine × 8 arms, plus a CONTROL. Each is refused before any statement and before any engine.aggregate call.
  • A stored dataset through the service doors (6): the dashboard door and the draft preview, for a scope filter and a measure filter; the registered cube on the ObjectQL door; and a CONTROL with the face's prescribed spelling.

• Pins re-judged with a note, each quoting the ruling that moves it:

  • comparand-door-single-source.test.ts: the null row's whereIn cell goes from accept to INVALID_FILTER/400 (2026-08-31). Its six-types assertion now names that one exception.
  • filter-normalizer-undefined-comparand.test.ts: four null-control rows leave the group: $gt: null (analytics 的 string[] 值往返对字符串比较数也有损:{code: {$eq: '007'}} 绑成数字 7、'null' 绑成真 NULL、'true' 绑成 1 —— 文本列静默取到错行 #5526's by-construction reading, which the face records was a position "no ruling covers" until 2026-09-01), $in: [null], $nin: [null] and $between: [null, 5]. The $between: [undefined, 5] row moves to the new file (2026-09-20 names undefined).
  • filter-value-type-fidelity.test.ts: $gt: null goes from "binds NULL" to refused before anything binds. The case's own concern, that no '' is bound, still holds.
  • comparand-shape-refusal.test.ts: the $in member list drops its null, and the null-carrying list is asserted refused in the face's words.
  • cross-field-reference-refusal.test.ts (2), filter-operator-coverage.test.ts (1) and filter-refusal-envelope.test.ts (1): a { $field } endpoint and a one-bound $between keep their verdict and now carry the face's wording.

• Package run (pnpm --filter @objectstack/service-analytics test, at a1bdbf1d59; no service-analytics file changed since): 119 files, 2656 tests passed. typecheck exited 0, and tsc --listFiles includes all ten touched files. Base (before the merge of origin/main): 117 files, 2541 tests.

• Ablations. Each ran from the committed fix through scripts/ablation-replace.mjs (the anchor must hit, the mutation is verified on disk, the restore is proven by the blob matching HEAD and an empty git diff HEAD), with the red count predicted before running. The tests import the source by relative path, so no build is on the path.

  • A: the all-arms pass removed (the equality pass kept). Predicted 87; measured 87 red / 2550 green: 80 in the new file, plus the 7 re-judged pins in 6 files. Samples: native execute: expected a refusal, got rows: expected [ 'd1' ] to be undefined; draft preview: expected a refusal, got rows: expected [ 'd1', 'd4' ] to be undefined; expected 'accept' to be 'INVALID_FILTER/400'.
  • B: the preview's gate call removed. Predicted 16; measured 16 red / 2621 green: this file's 8 preview face cells and 2 stored preview-door cells, plus [finding] service-analytics' filter normalizer reads an implicit-equality ARRAY as IN, while ruling 乙 refuses the same shape at the shared face "for every driver at once" #19888's 4 and 2, since the one call now carries both. Sample: draft preview: expected a refusal, got rows: expected [ 'd1', 'd2', 'd3', 'd4' ] to be undefined.
  • C: the equality-first pass removed. Predicted 1; measured 1 red / 2636 green: the precedence case. The all-arms pass runs the face's equality arm per entry, so pass 1 buys exactly the cross-entry order.

• Gates. dispatch-gates --repo objectstack-ai/objectstack --commands derived 61 at 33c73fdff4: the packages/rest edit adds check:dispatcher-error-vocabulary, which round 1 ran from the dispatch list. The union was re-run on this head.

  • 59 exited 0.
  • NOT MEASURED (2): check:dual-build-cjs-loads and check:type-check-debt exited 3 (PREREQUISITE NOT MET: they need the whole workspace built, which CI does).
  • --ran: 61 derived, 59 run, 2 NOT-MEASURED, 0 UNRUN.
  • Among the passes: check-adr-0087-registration --base origin/main (one declared-breaking changeset, not-required (already-registered)), check-changeset-no-major, check:changeset-gate-self-tests, check:nul-bytes, check:where-matcher, check:test-source-alias, and check-issue-citations in its board-probing mode (32 citations, all of which resolve).

• Lint, narrowed to the change. eslint --no-inline-config --format json over the 10 touched TypeScript files: 10 files, 0 errors, 0 warnings. eslint --print-config resolves a config for each. eslint.config.mjs never enables type-aware linting (its note near line 327), so this diff cannot move the verdict on an untouched file.

Deviations from the dispatch, stated

1. The comparand-TYPE face is not carried. Measured, the object spelling skips it too. A plain object under $gt / $ne / $eq, a $between endpoint that is a plain object, a binary or Map comparand, and a bigint beyond 2^53 are all accepted on the native path, bound as JSON text or as-is. {stage:{$ne:{a:1}}} served every row. The FilterArray spelling and the engine seam refuse each of them. undefined is not one of these: it was already refused on both spellings (the wording differs).
   • Measured cost of carrying the whole type walk the way parseFilterAST and the engine seam run it: 48 pins red, 35 more than the shape face, across nine files.
   • It re-words this door's own refusals from five earlier cards: service-analytics 的 where 门把 undefined 值的键整个丢掉 —— 单键 where 退化成「无过滤器」，方向是加宽（#6125 五面表漏记的第六、七种读法） #6386's undefined prescription, driver-sql:两类无意义比较对象仍编译成「静默空谓词」—— $in/$nin 的非 $field 对象成员,与 LIKE 族的对象比较值(String 成 [object Object]) #5234's unbindable $in member and LIKE-family sentences, service-analytics 的 where 门：字段约束里 $ 算子与非 $ 键混写时，非 $ 兄弟键被静默丢掉（方向是加宽；与值无关，不是 #6386 的 undefined） #6444's order, and [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 / [finding] $icontains is absent from analytics TEXT_PATTERN_OPERATORS, so the #5234 comparand fence never covered it on the where door — one operator, two answers inside one package #7693.
   • It flips the { $eq: {…} } account that driver-sql:两类无意义比较对象仍编译成「静默空谓词」—— $in/$nin 的非 $field 对象成员,与 LIKE 族的对象比较值(String 成 [object Object]) #5234 "left open" and that [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 made load-bearing, and [finding] service-analytics carries its own copies of the comparand-type allow-list the #7872 door now single-sources — reconcile membership and message wording to the door #8186's recorded binary admission.
   • Carrying only the accept-cells instead needs the type walk run after this door's own gates, as an assert whose narrowing is discarded. That is a second architecture.
   • Two readings lead to two architectures, so this set is returned as a decision (the dispatch's four-axis block, in the report). No door-specific ruling gives these cells a different meaning; the driver-memory has no policy for an unsupported comparand TYPE: a BigInt crashes with a raw mingo TypeError, and four other types silently answer zero rows #7872 ruling covers them. The stop is taken on the role file's two-architectures clause, not on Section 1's ruling clause.
   • Round 2: the card has answered it, and service-analytics: the object-form analytics where skips the shared comparand-TYPE face, so a plain-object / Map / oversized-bigint comparand is bound as JSON text on the native path while the FilterArray spelling and the engine refuse 400 #20035 carries it. Nothing of it is started here.
2. File surface. The claim declared filter-normalizer.ts, the matrix's where* cells, the named pin files, new tests and the changeset. This PR also touches:
   • src/preview-evaluator.ts: one import, one call and comments. This is a bounded in-place fix, and all four conditions hold. It is the same defect class. It is a mechanical call of the same exported gate, whose shape the face pins. No open PR touches the file: fix(service-analytics): the ObjectQL execute face refuses an unrunnable read scope in the withheld READ_SCOPE_COMPILE_FAILED / 500 envelope #20017, the only other PR in this package, landed before this branch merged origin/main. It is the same gate family, with no new verification surface. Without it, this change would have created a publish-refuses / preview-charts split for every moved arm. The claim's file surface needs this path added.
   • comparand-shape-refusal.test.ts, cross-field-reference-refusal.test.ts, filter-operator-coverage.test.ts and filter-refusal-envelope.test.ts: existing pins on a moved arm or its wording, re-judged with notes.
   • Round 2: packages/rest/src/analytics-filter-refusal-envelope.test.ts (the domain:cli lane), one case, test-only. The seat authorized it as this claim's own follow-through, and the claim's file surface is revised on the card. The census found no other consumer pin.
3. ADR-0087 disposition. The changeset's marker is not-required (already-registered filter-between-blank-endpoint-refused). The blank endpoint is the one moved arm whose transition is on the ledger. The null-member, null-endpoint and null-ordering transitions were ruled at the face with no ledger entry: their changesets declared no-migration-prescription. This changeset carries the FROM → TO table the dispatch asked for, so no-migration-prescription would be refused by the gate. The marker's own text states each arm's ledger status.
4. origin/main merged in (da44a2be39): PR fix(service-analytics): the ObjectQL execute face refuses an unrunnable read scope in the withheld READ_SCOPE_COMPILE_FAILED / 500 envelope #20017 landed in this package during the run. After a reinstall and a rebuild, the package suite, the typecheck and the gate union were re-run on the final head.
5. Round 1 missed a consumer outside the package. Round 1 ran only the service-analytics suite and so did not see the packages/rest pin on the re-worded one-bound $between sentence; CI did. Round 2 fixed that case, ran the census, and ran the full @objectstack/rest suite.

Acceptance notes

• $ne with a list is carried the day [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage 2 puts its refusal on the face, with no change here. The parity test holds this door to whatever the face answers.
• Wording convergence. Three shapes this door already refused now read in the face's words: a one-bound $between, a { $field } endpoint and an undefined endpoint. fieldLeaves' own checks for them stay as that function's invariants, annotated, and are no longer reached from the door.
• Nested-relation field naming follows [finding] service-analytics' filter normalizer reads an implicit-equality ARRAY as IN, while ruling 乙 refuses the same shape at the shared face "for every driver at once" #19888: the leaf key in the message, the full path in at.
• Draft preview and an undefined comparand (not this card's arm; reported). evaluateAnalyticsQueryOverRows answers no row for {stage: undefined} / {amt: {$gt: undefined}}, while every published face refuses it 400 (service-analytics 的 where 门把 undefined 值的键整个丢掉 —— 单键 where 退化成「无过滤器」，方向是加宽（#6125 五面表漏记的第六、七种读法） #6386). The preview never ran service-analytics 的 where 门把 undefined 值的键整个丢掉 —— 单键 where 退化成「无过滤器」，方向是加宽（#6125 五面表漏记的第六、七种读法） #6386's gate. This is reachable only in-process, because undefined cannot cross JSON.

[github-actions]

📓 Docs Drift Check

6 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7766b62282f456ef04fd37304658b7ecd5a0fff9 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5219153ad0cffd3dd89a3ceccaf660e4c294ed43 — the merge of head 33c73fdff48f034ec00cff0808c61839d8518717 into base 7766b62282f456ef04fd37304658b7ecd5a0fff9, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5219153ad0cffd3dd89a3ceccaf660e4c294ed43 && git checkout 5219153ad0cffd3dd89a3ceccaf660e4c294ed43
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7766b62282f456ef04fd37304658b7ecd5a0fff9 33c73fdff48f034ec00cff0808c61839d8518717 && git checkout -B drift-repro 7766b62282f456ef04fd37304658b7ecd5a0fff9 && git merge --no-ff 33c73fdff48f034ec00cff0808c61839d8518717

node scripts/docs-audit/affected-docs.mjs --json 7766b62282f456ef04fd37304658b7ecd5a0fff9

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.