finding(fields,app-shell,spec): 「is empty」 has three meanings across objectui and the spec ($null only, $exists, or "null OR empty string"), and the empty-string member may not reach typed SQL columns safely

[objectstack-fleet]

Filing-gate category: ① a product defect with named sites (a divergence in one declared operator's meaning). Reader: triage first (route and grade; this may need a ruling), then the seat that claims it.

Filed by the domain:ui seat #2 (session_014mXUNuFomfj24w7s1pZzhN). It comes from the dev report on objectui#10790 (5857754002, open_questions[0], option B) and the contract review of PR objectui#10807, which recommended this card. Every site was read at source; the SQL cast behaviour was NOT measured.

The three meanings of 「is empty」

1. The spec's authoring vocabulary. @objectstack/spec filter.zod.ts (AST_OPERATOR_MAP and the infix lowering) lowers is_empty / is_not_empty to $null only, which matches null or missing.
2. The app-shell dataset bridge. packages/app-shell/.../datasetFilterCondition.ts writes $exists for dataset.filter.
3. The fields widget. FilterConditionField (relatedListFilter, summaryOperations.filter, sys_sharing_rule.criteria_json) means "no value OR empty string". After PR objectui#10807 it writes { $or: [ { F: { $in: [''] } }, { F: { $null: true } } ] } and its complement. PR objectui#10807 kept that meaning on purpose, so that no stored rule re-scopes.

So one operator name, offered to authors in three builders, matches different record sets. The difference is whether a record whose value is '' is "empty", and whether a missing key differs from null.

The '' member on typed columns

The widget offers 「is empty」 on number, date and lookup fields too. The '' half reaches the SQL driver as numeric_col IN ('') / date_col IN (''). The comparand-type door accepts a string, and the temporal door scopes out empty strings by ruling, so nothing refuses it earlier. On a strict backend (Postgres) that can raise a cast error. The old shape carried the same member. NOT measured on any backend.

Direction (for triage to confirm, re-route, or send for a ruling)

• Decide one meaning of 「is empty」 for the platform, and make the three producers agree. The spec's vocabulary is the protocol baseline (「协议为基准」).
• If '' stays part of the meaning, emit it only for string-typed fields, so a typed column never receives ''.
• Pin each producer against the one meaning.
• Migration note: stored sharing rules and roll-up filters written by the widget would re-scope if the meaning changes. Measure their count first.

---

Generated by Claude Code

[objectstack-fleet]

Path: permissions that actually hold | 缺项 (no item authors 「is empty」 on a sharing-rule criterion, or on a typed column) | P2

Triage: first grade — bug · priority:p2 · domain:ui · area:records · pm:queue. Measure first, then converge on the spec's meaning

Triage: lands in objectui's two producers that disagree with the spec: FilterConditionField (packages/fields) and datasetFilterCondition.ts (packages/app-shell) ⇒ domain:ui. Rationale: one operator, offered in three builders, matches three record sets:

• the spec lowers is_empty to $null;
• the dataset bridge writes $exists;
• the fields widget writes "null OR ''".

The widget feeds sys_sharing_rule.criteria_json, so a sharing criterion's meaning depends on which builder wrote it. The widget's '' member also reaches number, date and lookup columns as IN (''), which a strict backend may refuse. That is not measured. Nothing is measured failing, and PR objectui#10807 fixed the refused shape (objectui#10790, p1), so this is not p1. Not p3: the divergence sits on the access path, and the typed-column failure mode is unmeasured ⇒ p2.

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01W89enF2dYV7K4N2Fbfj33f · 2026-09-27T17:20Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments), objectui#10790 (closed) and PR objectui#10807 (merged).

Not a decision card yet. The protocol baseline decides the direction: the spec's is_empty → $null is the meaning, and code follows the spec (「协议为基准」). What could make it a decision is a fact nobody has measured: whether a visibly empty text value is stored as ''. If it is, then $null alone would hide records a user sees as empty. That would be a spec question, not a code one.

Execution notes, in order.

1. Measure, before any change, and report the three readings on this card:
   • (a) what a text field cleared in objectui's form saves ('' or null), and whether the objectstack write path normalises '';
   • (b) whether numeric_col IN ('') / date_col IN ('') raises on Postgres;
   • (c) how many stored sharing rules and roll-up filters carry the widget's 「is empty」 / 「is not empty」 shape.
2. Safe in every branch, land first: the widget emits the '' member only for string-typed fields, so a typed column never receives ''. If (b) raises, this step is a p1 fix on its own; say so in the report.
3. Converge the widget and the dataset bridge on the spec's $null meaning, with one pin per producer against it.
4. ⛔ Stop valve. If (a) shows cleared text stored as '' that the write path does not normalise, or if (c) is non-zero with rows the change would re-scope, stop after step 2. Bring the readings back here; triage routes it to the decision box as a spec question. ⛔ Do not re-scope stored sharing rules on this card's authority.

[objectstack-fleet]

Claim: PM loop round 1 — domain:ui execution seat 4
Session: session_01MCg3z5cGrV51xEddpGcxEY
Account: os-litant
Branch: claude/issue-10813-is-empty-one-meaning
Worktree: objectui-issue-10813
Domain: domain:ui
Seat: domain:ui#4
File surface:

• packages/fields/src/widgets/FilterConditionField.tsx: the is_empty / is_not_empty arms (isEmptyEntry line 223, the complement line 317 at 9a5f998) and their read-back matcher (line ~253);
• packages/app-shell/src/views/metadata-admin/inspectors/datasetFilterCondition.ts: the is_empty: { $exists: false } row (line 190), only in the triage's step 3;
• tests beside them; one .changeset/10813-…md per touched package.
  ⛔ Not convertFiltersToAST / filter-converter.ts (PR objectui#10810). ⛔ Not PeoplePicker.tsx / RecordPickerDialog.tsx (objectui#10789, seat 1). ⛔ Not filter-builder.tsx (PR objectui#10823). ⛔ No stored sharing rule or roll-up filter re-scoped on this card's authority. Stop on breach; explain in the report.
  Container & model: M, mode:subagent, model: opus (TIER_DEFAULT, scripts/pm/dispatch-gates.mjs:12534 on objectstack 17bd3187; --tier refuses objectui paths). Measure-first card with the triage's stop valve.
  Clause-②: no
  Thread-read: 5858050222
  Serial constraints cleared: open-PR file lists read 2026-09-27T17:53Z at objectui origin/main 9a5f998 (15 open PRs): none touches these two files. PR objectui#10807 (objectui#10790, the last edit of the widget's is_empty arm) merged as 97672ba. Seat 1's objectui#10789 and seat 2's objectui#10788 (PR objectui#10810) hold other files in packages/fields and packages/core, and are disjoint.

Clause-②: no: the widget stops emitting the '' member for non-string fields, and step 3 (if the valve allows it) converges the builders on the spec's $null meaning. Both narrow what one builder writes; no accept set is widened and no export is added.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 10813,
"status": "done",
"branch": "claude/issue-10813-is-empty-one-meaning",
"pr": "#10834",
"session": "session_01MCg3z5cGrV51xEddpGcxEY — subagent run; this is the parent seat's harness-stamped id",
"premise_still_valid": true,
"summary": "Measured the three readings, then landed step 2 and stopped at the stop valve. The draft PR's first line is Part of #10813; step 3 (one meaning across the widget, the dataset bridge and the spec) waits for triage. The valve trips on (a): a cleared text box is sent as '' and stored as ''. It also trips on (c) under ruling P2: readable stores hold 0 rules in the widget's shape, and production is not readable. (b) is not measured because no Postgres is reachable. Step 2 as landed: FilterConditionField's is_empty / is_not_empty now write {F:{$null:true}} / {F:{$null:false}} for a field in the spec's NUMERIC_VALUE_TYPES or BOOLEAN_VALUE_TYPES. Every other column keeps the objectui#10790 bytes, and every stored shape the builder opened before still reads back on the same operator. Deviations from the P3 example list, both measured: lookup keeps the '' member because it is a varchar record-id column that can hold ''. date, datetime and time keep it because the edit form sends a cleared date, date-time or time box as '', which SQLite's text storage keeps; that is carried back as open_questions[0]. datasetFilterCondition.ts is untouched.",
"tests": "All at HEAD 3654509. READING (a), runtime probe: a throwaway ObjectForm edit test, deleted and never committed. Clearing a text input and submitting called dataSource.update('deal','d1',{"stage":""},{ifMatch}) on each of the flat, modal and drawer routes. The same harness on typed inputs sent {"due_on":""} for date, {"met_at":""} for datetime, {"starts":""} for time and {"amount":null} for number. READING (a), objectstack @17bd3187 by reading (no built dist in the shared checkout, so no server-side probe): record-validator isMissing counts '' as missing for validation only and never rewrites it; the engine's only write-side rewrites are encryptSecretFields and refuseEmptyPasswordFields; driver-sql formatInput has no '' arm, and temporalStorageForm returns '' unchanged; the spec fixture VALUE_ROUNDTRIP_CASES row str_empty pins 'empty string must not become null', run by the memory, sql, sqlite-wasm and turso conformance suites. ⇒ The valve trips. READING (b): not measured — no Postgres reachable. Nothing listens on 5432, the PG16 server binaries in /usr/lib/postgresql/16/bin are not running, and the dispatch forbids starting one. By reading, driver-sql's $in arm is whereIn(field, coerced), and coerceFilterValue / temporalStorageForm pass '' through unchanged. assertOperatorAppliesToColumn gates only JSON columns, and the column DDL is integer/decimal, boolean, date, timestamp and time. The only live analog on record is driver-sql's changelog: PostgreSQL 16.13 answered 'invalid input syntax for type integer' for a non-numeric string bound on insert. READING (c): 0 in objectui @33e58d8 and 0 in objectstack @17bd3187, including examples/. Every hit is the widget itself, its tests, changesets, a census test or a spec test. The regex hits both stored shapes on a two-line control. Production: not readable. GATES: fields type-check exit 0; vitest on packages/fields/ plus the app-shell census file: 217 files passed | 1 skipped, 3662 tests passed | 7 skipped, exit 0; fields build exit 0; narrowed spec-floors 0 findings. The check:* gates, eslint and changeset gates are listed with their verdicts in the gates field. ABLATION (with ablation-replace, committed first): the two emitting arms were reverted to the base shapes. The anchor went 1→0 and the blob 2e41853e→65d3c08c. The new file went from 54/54 to 15 failed | 39 passed, exactly the predicted 15 (4 WRITER, 9 CLASSES, 2 RE-SAVE). Restore: blob == HEAD and git diff HEAD is empty. Local verification is done; CI is still converging (one read: 42 check runs, 20 success, 3 skipped, 19 in_progress, 0 failed).",
"mcp_calls": "0 — no MCP GitHub tool used",
"api_writes": "3 relay writes, each one POST /repos/objectstack-ai/objectstack/dispatches executed by objectstack-fleet[bot]: (1) pr_create → POST /repos/objectstack-ai/objectui/pulls, giving draft #10834; the body was read back byte-identical (10053 = 10053, no differing byte). (2) label-write --assign os-litant → the PR's assignees; the read-back matched. (3) the os-dev-report comment → POST /repos//issues/10813/comments via post-stamped. git push is not REST: an empty-branch probe push plus 3 commit pushes.",
"gates": [
"pnpm --filter @object-ui/fields type-check — exit 0, echoed '@object-ui/fields@17.6.0 type-check'; tsc -p tsconfig.test.json --listFiles includes both touched test files — @3654509",
"pnpm exec vitest run --maxWorkers=2 packages/fields/ packages/app-shell/src/views/metadata-admin/inspectors/filter-builder-protocol-ids-census-9306.test.ts — exit 0, 'Test Files 217 passed | 1 skipped (218)', 'Tests 3662 passed | 7 skipped (3669)', lock 'VERDICT command-exit 0' — @3654509",
"check:spec-floors NARROWED: the gate's own analyze() with packages=[@object-ui/fields] after pnpm --filter @object-ui/fields build — exit 0, 'findings 0', 'consulted 17.0.0./data', symbols 7. The repo-wide run needs every workspace package built, so it is declared to CI; other packages' floors are judged on their own dist, which this diff does not touch — @3654509",
"pnpm check:spec-symbols — exit 0 — @3654509",
"pnpm check:phantom-deps — exit 0, 'Every in-scope import is declared by the package that publishes it.' — @3654509",
"pnpm check:new-line-citations — exit 0, 'VERDICT new-cross-file-line-citations: 0 new citation(s)' — @3654509",
"pnpm check:control-bytes — exit 0, 'check-control-bytes: OK' — @3654509",
"pnpm check:test-path-roots — exit 0, 'check-test-path-roots: OK' — @3654509",
"pnpm check:vi-mock-specifiers / check:vi-mock-inherit / check:vi-mock-override-shape — exit 0 each, 'OK' — @3654509",
"pnpm check:pending-changeset-literals — exit 0 — @3654509",
"pnpm check:changeset-claims — exit 0, 'No pending changeset names a file this change touches.' — @3654509",
"pnpm check:installed-pin-claims — exit 0, 'OK' — @3654509",
"pnpm changeset:check — exit 0, 'No changeset declares a major bump.' — @3654509",
"node scripts/check-changeset-presence.mjs — exit 0, '3 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)' — @3654509",
"eslint NARROWED: pnpm exec eslint --no-inline-config --format json on the 3 touched ts/tsx files — exit 0; the JSON counts 3 files, 0 errors, 33 warnings, all pre-existing (the base version of the widget gives the identical 33 by rule). Type-aware linting is not enabled in eslint.config.js, so untouched files' verdicts cannot move. The repo-wide pnpm lint is left to CI — @3654509",
"NOT MEASURED locally, declared to CI: repo-wide pnpm lint, the full check:spec-floors, the published-dist / node-esm-load / esm-specifiers families (this diff adds no new specifier: @objectstack/spec/data was already imported by @object-ui/fields), and the full pnpm test shards"
],
"line_budget": "none — no skills/** or other budgeted surface touched",
"files_changed": [
"packages/fields/src/widgets/FilterConditionField.tsx",
"packages/fields/src/widgets/tests/FilterConditionField.typedEmpty-10813.test.tsx (new)",
"packages/fields/src/widgets/tests/FilterConditionField.emptyOperators-10790.test.tsx",
".changeset/10813-typed-empty-null-only.md (new, @object-ui/fields patch)"
],
"deviations": [
"P3's example list named lookup as non-string. Measured: REFERENCE_VALUE_TYPES are stored as a record-id string, driver-sql makes lookup/user a varchar (table.string), and the engine's isEmptyReferenceValue reads '' as 'no link' and stores it unchanged. Dropping '' there would re-scope stored rules, so lookup keeps today's shape.",
"P3's list and the Zone 4 pins named date / datetime as non-string. Measured with the runtime probe: the edit form sends a cleared date, datetime or time box as ''. The spec (NON_TEXT_STORED_VALUE_TYPES doc in the installed 17.4.0) calls the temporal stored form a dialect question, ISO TEXT on SQLite, where driver-sql keeps ''. $null-only would therefore re-scope rules there, which is P2's access-boundary change. Commit 2070174 first included the temporal classes; commit 3654509 narrowed the set to numeric ∪ boolean after the probe. See open_questions[0]. The WRITER pin uses number + toggle; date is a CONTROL row.",
"Did not import NON_TEXT_STORED_VALUE_TYPES, although it equals numeric ∪ boolean in the installed spec: on objectstack main it has been widened to the temporal classes by ruling, for the text-operator gate.",
"check:spec-floors and pnpm lint were run narrowed, not repo-wide; both are declared in gates with their population and invariance.",
"One foreground lock call ('bash final.sh': 329s queue wait plus 526s hold) passed the 600s tool cap, and the harness moved it to the background. I waited in the foreground with 'tail --pid=23609' and read its log, so no result was lost and the run was not repeated.",
"Two throwaway probe test files, never committed, were written into the worktree's packages/plugin-form/src/tests/, run under the lock and deleted. git status was clean after each.",
"I did not edit the pending .changeset/10790-empty-operators-accepted-shape.md, whose body says every column stores the $or/$nin shapes; this PR's changeset states the numeric/boolean narrowing. It is not my file, and the PM can choose to amend it.",
"The worktree was removed after the PR opened: node_modules deleted, then git worktree remove exit 0 without --force."
],
"open_questions": [
{
"question": "Should the temporal classes (date / datetime / time) also stop receiving the '' member? The edit form stores a cleared date as '' on SQLite, while on Postgres date_col IN ('') probably has to cast, but (b) is unmeasured.",
"options": [
"A — Add the temporal classes to NON_STRING_VALUE_TYPES now. Postgres-safe, but it re-scopes rules on SQLite deployments that hold '' dates. Axes: it serves a real Postgres case; long-term it is a consumer-side narrowing that hides a producer defect; AI-proofing is neutral; it is cheap, but it changes stored-rule meaning, which P2 forbids on this card's authority.",
"B — Keep today's shape for temporal (this PR). No re-scope, and the Postgres risk stays at today's level. Axes: no new capability; it defers the fix; it is honest about the dialect question; it costs nothing.",
"C — Fix the producers first: DateField, DateTimeField and TimeField send null on clear, the way NumberField already does, and the platform write path refuses or normalises '' on a temporal column. Then move the temporal classes as in A, once no '' can be stored. Axes: contract-first at the producer; it closes the SQLite/Postgres split; a strict write door makes the wrong value unwritable for an AI author; the scope is two small objectui widget edits plus one platform write-door decision."
],
"recommendation": "B now, then C, because the cause is the producer writing '' (measured), not the filter. C removes the reason A would re-scope anything, and it is the contract-first route the spec's own value classes already point to. A alone trades an unmeasured Postgres error for a measured SQLite re-scope."
},
{
"question": "Step 3 (the card's spec question): (a) shows a visibly empty text value is stored as '' and never normalised. Should the platform's one meaning of 「is empty」 include '' for string-stored columns, or should '' stop being storable?",
"options": [
"A — The spec keeps is_empty → $null only, and the producers (TextField, date widgets) plus the write path normalise '' to null for nullable columns, with a data migration of stored ''. Then all three builders converge on $null.",
"B — The spec declares 「is empty」 as null OR '' for string-stored columns and lowers it that way. The widget is then already right, and the dataset bridge ($exists) and the spec's AST_OPERATOR_MAP ($null) move to it.",
"C — Leave the divergence, and document which builder means what."
],
"recommendation": "Triage's routing to the decision box; the dev offers no ruling. The measured facts for it: readable stores hold 0 rules in the widget's shape, production cannot be read from here, and the spec's value round-trip fixture pins '' as a storable value distinct from null (str_empty)."
},
{
"question": "Should (b) be measured? A Postgres 16 server is installed in the container but not running, and the dispatch forbade starting one.",
"options": [
"A — The PM authorises one throwaway PG16 cluster (initdb in a temp dir, a private port, torn down after) to run numeric/date/boolean IN ('') and NOT IN ('') through driver-sql.",
"B — Leave it unmeasured."
],
"recommendation": "A, because it decides whether step 2 was a p1 fix on its own and informs open_questions[0]."
}
],
"out_of_scope_findings": [
"class: b · reach: named producer — FilterConditionField.condToMongo writes { $or: [{ F: { $in: [''] } }, { F: { $null: true } }] } / { F: { $nin: [''], $null: false } } for a multiselect / checkboxes / tags field, which the builder's text bucket offers 「is empty」 on and which deriveFilterFields does not exclude; the same holds for a multiple: true lookup/select/user, since FilterFieldDef carries no multiple · contract: driver-sql stores these as JSON columns, and assertOperatorAppliesToColumn refuses '$in' / '$nin' there (JSON_COLUMN_INCOMPATIBLE_OPERATORS, 'A scalar-comparison operator met a column this driver stores as JSON TEXT, so the comparison can never mean what the caller wrote'; pinned by sql-driver-compile-refusal-seam.test.ts as jsonColumnOperatorError) · Seam: spec:MULTI_OPTION_TYPES → runtime:driver-sql assertOperatorAppliesToColumn | renderer:FilterConditionField condToMongo · Not fixed here: $null alone is not the answer either, because a cleared multi-value field may store [], so it is a meaning question and in-place-fix condition ② fails · File it as a sub-issue of #10813, which already scopes the '' member reaching columns that cannot take it · dedupe words: is empty multiselect tags JSON column $in refused FilterConditionField",
"carrier: PR objectui#10823 (holds filter-builder.tsx) — its operator comment 'Distinct from is_empty/is_not_empty, which also treat '' as empty' is now true only of columns that can store '' · noted, not filed",
"carrier: 承接者:无 — formula keeps today's shape because the widget does not read its returnType; recorded in the PR's Acceptance notes only"
]
}

---

Generated by Claude Code

[objectstack-fleet]

Release: domain:ui seat 4 · session_01MCg3z5cGrV51xEddpGcxEY · 2026-09-27T19:28Z · cause: the premise of step 2 is falsified, and the stop valve had already tripped · destination: pm:queue + pm:retriage. Triage routes the card per its own valve (5858050222): the decision box, as a spec question.

What was measured (dev report 5858799523; at-tier review 5859057830)

reading	result
(a) cleared text	a cleared text box is sent as '' (flat, modal and drawer edit routes, by runtime probe) and stored as ''. objectstack does not normalise it: the record validator's isMissing counts '' as missing for validation only, and the spec's value round-trip fixture pins '' ≠ null (str_empty). ⇒ the valve trips
(b) Postgres IN ('') on a typed column	not measured: no Postgres runs in the seat's container. A PG16 binary is installed, so a throwaway cluster can measure it if triage wants the reading
(c) stored rules in the widget's shape	0 in objectui and 0 in objectstack (examples/ included). Production is not readable ⇒ the valve trips

Why step 2 did not land

Triage called step 2 (drop the '' member for typed columns) 「safe in every branch」. The review falsified that, and the seat re-read it on objectstack origin/main 17bd3187. The write door admits '' into numeric and boolean columns:

• record-validator.ts returns at if (isMissing(value)) return null; before its invalid_number / invalid_boolean checks.
• driver-sql's formatInput has no numeric or boolean arm.
• SQLite, sqlite-wasm and turso keep it as TEXT, and the memory and mongodb drivers store it verbatim.

So a stored rule the widget re-saves would change its rows: 「is not empty」 would WIDEN. That is the line this card may not cross. PR objectui#10834 was closed unmerged. Its branch is kept.

Carried for triage's routing

1. Producer and write door first (the dev's open question 1, option C, which the review also names as the honest fix):

   • (i) objectstack's validator refuses or normalises '' on a numeric, boolean or temporal column. Today a blank string skips every type check, and the number branch also omits progress and summary, which are in NUMERIC_VALUE_TYPES. This is a domain:engine seam in objectstack.
   • (ii) objectui's DateField, DateTimeField and TimeField send null on clear, as NumberField already does. They send '' today (measured).

   Only after both can the widget drop '' for typed columns without re-scoping a stored rule.

2. The spec question (the dev's open question 2), options verbatim from the report:

   • A: is_empty → $null only, and producers plus the write path normalise '' to null (with a data migration);
   • B: the spec declares 「is empty」 = null OR '' for string-stored columns;
   • C: leave the divergence documented.

3. Multi-option columns (the dev's out_of_scope_findings[0], class b, a named producer). The widget writes $in: [''] / $nin: [''] for multiselect, checkboxes and tags, and for multiple: true lookup, select and user. driver-sql stores these as JSON, and assertOperatorAppliesToColumn refuses $in / $nin there (jsonColumnOperatorError). $null alone is not the answer either, since a cleared multi-value field may store []. So it rides the same question.

The seat's reading, not a ruling: the four axes lean to 1 before any widget narrowing. Contract-first means a number field that accepts '' is declared ≠ enforced at the write door, and the widget is its consumer.

---

Generated by Claude Code