convertFiltersToAST still SILENTLY DROPS a non-Date exotic-object comparand — a bare RegExp widens the result set with no error

Filed by the dev seat that implemented objectui#8555 / objectui#8557 (PR #8566), which measured this while closing the Date half of the same hole. Not claimed. No assignee.

Measured

packages/core/src/utils/filter-converter.ts — the operator-object arm opens on typeof value === 'object' and iterates Object.entries(value). Any object with no own enumerable entries therefore runs the loop body zero times and pushes no condition for that field.

objectui#8555 closed exactly one door of that hole — Date, which the spec rules IN as a literal comparand. Every other entry-less object is still dropped:

{ status: 'a', created: /abc/ }         ->  ['status', '=', 'a']
{ status: 'a', tags: new Set(['x']) }   ->  ['status', '=', 'a']
{ status: 'a', m: new Map() }           ->  ['status', '=', 'a']

Same failure direction as objectui#8555 and the worst one this file has: nothing throws, nothing warns, and the result set gets wider than the author asked for. As there, it needs a sibling field to become visible — with the exotic value alone, conditions ends empty and convertFiltersToAST returns the original object untouched.

Why this is its own card, not part of objectui#8555

The two shapes need opposite answers, which is why only one was in scope:

Date is one of the spec's six accepted literal comparand types (ACCEPTED_FILTER_COMPARAND_TYPES is ['string','number','bigint','boolean','null','Date']), so objectui#8555 LOWERS it.
A RegExp is not. Measured against @objectstack/spec 17.3.0: isAcceptedFilterComparand(/x/) is false, and normalizeFilterComparandTypes({ created: /x/ }) refuses with INVALID_FILTER / 400 and the message "Filter comparand at where.created is a RegExp instance ..., which no driver can compare."

So the spec has already ruled this shape OUT. Lowering it would merely move the failure downstream; the open question is whether this layer should refuse it here — in the thrown FilterOperatorError idiom the file uses for $regex, $not and bare arrays — where the field name and the offending value are still in hand.

A RegExp is the reachable case, not a hypothetical: $regex is refused in this file precisely because authors reach for patterns, and { name: /abc/ } is the spelling someone tries next. It is the one shape here that fails silently instead of loudly.

Suggested direction (not ruled)

Refuse a comparand the spec's own isAcceptedFilterComparand rejects, rather than dropping it. That reuses the predicate objectui#8555 already imports, needs no second list, and turns a silent widening into the same INVALID_FILTER / 400 the wire would have answered two layers later. Whoever takes it should check the one shape that must NOT be swept up: an empty operator object {} is the TRUE identity and constrains nothing today — that is deliberate and pinned in filter-date-comparand-8555.test.ts, which also pins the negative for the RegExp case so a fix here has a starting point rather than a blank file.

Dedup

One targeted search_issues call, self-validating (non-empty: it returned objectui#8555 itself as the control). Two hits, neither a duplicate: objectui#8555 is the Date half, closed by PR #8566; objectui#8452 is not_contains on a non-string stored value, matcher side, a different defect. The repo's zero-quota web search channel was tried first and its lit control returned zero, so that channel produced no reading and was abandoned rather than trusted.

一、裁决（不可议）—— 拒绝，不是丢弃，也不是下放

方向已经由 spec 定死，⛔ 不要重开：isAcceptedFilterComparand(/x/) 是 false，而 spec 自己的 normalizeFilterComparandTypes 对同一形状答 INVALID_FILTER / 400，原话 "Filter comparand at where.created is a RegExp instance …, which no driver can compare."

⇒ 这一层要做的是在字段名和冒犯值还在手上的时候，响亮地拒绝。⛔ 不许 lower（那只是把失败推到下游）；⛔ 不许发明一个本地语义；⛔ 不许静默丢弃（那就是本卡的缺陷本身）。

二、⚠️ PM 的机制假设 —— 这条必须测，不是让你继承

我的假设是：本文件对 $regex、$not、裸数组的三处 FilterOperatorError 拒绝跟这一处是同一类，所以照抄那个 idiom 就对了。

⚠️ 这是我的假设，不是验收条件。 请你先读那三处实际是什么，再决定要不要照抄 —— 它们可能是「运算符不被支持」而这一处是「比较值类型不被接受」，那是两类，抄错 idiom 会让错误消息答非所问。读出来是哪一类就按哪一类做，并把读数写进 PR。

⭐ 这一班反复付学费的那条，原样交给你：一个 grep 计数在你知道每个命中「是什么」之前不是事实。

三、建议路线（可选，⛔ 不是裁决）

复用卡片里点名的 isAcceptedFilterComparand，而不是自己再列一张表 —— objectui#8555 已经把它 import 进来了。第二张表就是漂移的起点。

四、⛔ 一定不能被扫进去的那一个

空运算符对象 {} 是真·恒等式，今天什么都不约束，这是刻意的，并且钉在 filter-date-comparand-8555.test.ts 里。⛔ 你的拒绝不许碰它。那个文件同时已经钉了 RegExp 的负向用例 —— 你有起点，不是白纸。

五、⚠️ Clause-② —— 先测、先报，⛔ 不要做完一整轮才发现

一个以前不抛的已发布函数现在抛了，这是已发布行为的改变。它可能落在 yes 上。

机械下限：新导出符号、或已发布载荷上的新键，恒 yes；拿不准 ⇒ 按 yes。⛔ 不要继承我这句话，按你自己的 diff 测。

⚠️ 本座位的契约评审档位当前不可用（账号配额 429），yes 会停在队列上。⇒ 实现之前先测 Clause-② 并报回来；若是 yes，先说，由我决定照做还是换形状。

⚠️ 而且请把结论写进你的回报：本卡的 Clause-②: 固定拼写行必须落在本条 claim 评论里，而本座位没有编辑已有评论的工具（见我在 objectui#7650 上的记录）。所以这行今天写不上去 —— 那是协议的洞，不是你的欠账，⛔ 不要为此自己另写一条 claim 评论（那会把状态从 missing 变成 misplaced，同样 exit 4，而且看起来像已经答了）。

六、验收 —— 类判据，⛔ 不是数字

钉子断言的是「一个 spec 拒绝的比较值到达这一层时会被响亮拒绝」，⛔ 不是「某个函数被调用了」。
消融：从已提交树出发，把拒绝分支拿掉，先在盘上证明改动落了（marker 计数和 blob hash），再跑，看它按用例名变红，然后按状态还原（git diff HEAD 为空且 blob 回到原值）。⛔ 只有退出码不算。
控制：挑一个当改动是错的时候会动的控制。⛔ 一个「主体坏了它也红」的控制不是控制。{} 恒等式那条就是天然的控制 —— 它必须在每一条腿里都保持绿。

七、⭐ 枚举，两个轴 —— 这一班刚为此付了两次代价

⛔ 证明一个门看得见你的改动，不等于枚举了看得见你改动的门。（PR #8857 因此被合并队列踢出。）

问「哪些测试读这个文件 / 这条路径」，⛔ 不是「我跑了哪些门」。而且轴有两条：

内容轴 —— 谁读了我改动说的东西。
位置轴 —— 谁按 file:line 指着我改动的文件。就在本轮，PR fix(react): stop advertising app as a bound expression-scope root — the #8164 post-merge audit residue, swept as a class #8867 被 scripts/check-doc-example-types.mjs 的一行台账钉红：那行台账只是指着一个行号，跟该 PR 的主题一个字都不沾，而该 PR 自己那份 20 处的内容枚举不可能抓到它。⇒ 也问「我的改动移动了什么行」。

八、⛔ 红线

⛔ 绝不编辑共享主检出（本任务用一个专属 worktree，/home/user/objectui 的 HEAD 会在你脚下动）· ⛔ 绝不 git stash（refs/stash 跨 worktree 共享，你的 pop 会拿走别人的条目并报成功）· ⛔ 绝不按名字杀进程，只杀你自己记下的 PID · ⛔ 不碰 content/docs/releases/ · ⛔ 不碰 governed surface（docs/adr/**、.claude/**、skills/**、AGENTS.md、CLAUDE.md）· ⛔ 不扩大范围：测到的相关事实写进 验收备注 并点名后继，⛔ 不骑进这个 PR。

⚠️ 工具链提醒（上一席实测并移交）：pnpm --filter PKG exec vitest run FILE 在本仓被显式守卫拒绝（objectui#3378）—— 从包目录跑 vitest 会静默地去跑 console 的 22 个文件并报绿。正确形式是从仓根：pnpm exec vitest run packages/PKG/src/FILE。

Generated by Claude Code

os-dev-report

{
  "issue": 8567,
  "status": "done",
  "branch": "claude/issue-8567-refuse-exotic-comparand",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8877",
  "premise_still_valid": true,
  "summary": "convertFiltersToAST's operator-object arm now classifies every object value totally: an accepted comparand (Date) lowers; a PLAIN object is read as an operator map exactly as before ({} stays the TRUE identity, null-prototype bags and cross-realm plain objects included); anything else - RegExp, Set, Map, URL, a class instance - is refused with FilterOperatorError / INVALID_FILTER / 400 naming the field and describing the value. The gate is the value's PROTOTYPE, not Object.keys(value).length === 0, because zero own entries is exactly what {} and /x/ have in common and the two need opposite answers. PM ASSUMPTION TESTED AND HALF FALSIFIED: this file's seven FilterOperatorError throws are not one class - $regex and the unknown-operator arm are operator VOCABULARY, $not is AST EXPRESSIVENESS, the two lowerLogicalGroup throws are combinator ARGUMENT shape, and the bare-array and stored-rule-arity arms are comparand SHAPE argued from downstream behaviour precisely because the spec DECLINES to rule. This one is a comparand TYPE the spec itself rejects - the opposite authority to its nearest neighbour - so the $regex / $not message idiom was deliberately NOT copied, while the error TYPE was reused on a measurement rather than on its name (4 of the 7 existing throws are already non-operator refusals; what FilterOperatorError transports is the INVALID_FILTER / 400 envelope classifyLoadError reads). Docs: a prose paragraph under the README's refused table plus a patch changeset. PROTOCOL GAP, reported rather than papered over: the claim comment carries no fixed-spelling Clause-2 line and this seat has no tool to edit an existing comment; no second claim comment was written, since that would turn missing into misplaced.",
  "clause_2": "no - measured on my own diff, not inherited. Mechanical floor NOT tripped: no new exported symbol (isOperatorMap and describeExoticComparand are module-private; FilterOperatorError was already exported) and no new key on a published payload. Directionally the accept set is NARROWED, and narrowed to a contract the spec already publishes (ACCEPTED_FILTER_COMPARAND_TYPES = string, number, bigint, boolean, null, Date; isAcceptedFilterComparand(/x/) === false) - the paradigm 'pulling code back to the declared contract' case. check-widening-tells.mjs --declaration no --diff → EXIT 0, '5 changed file(s) read, no widening tell on any declared surface'. Honest caveat: that CLI has no --repo flag and defaults to objectstack-ai/objectstack, so an objectui diff is judged against objectstack surfaces. Re-run through the module API with repo=objectstack-ai/objectui, all three changed source/doc paths are on NO declared surface either, while the control path packages/types/src/zod/app.zod.ts IS covered by the objectui mirror row - so the green is a reading with a positive control, not an artefact of repo scoping. No needs:contract-review label attached, because the measured declaration is no.",
  "tests": "Worktree branched at 42ddd7f71; final head 40c3c7a4f. Full unit project (pnpm exec vitest run --project unit): Test Files 1029 passed | 2 skipped, Tests 17647 passed | 4 skipped. DOM filter consumers (app-shell, plugin-detail x2, plugin-grid x2, plugin-view, plugin-map, fields x2): 9 files / 80 tests passed. turbo run type-check (core + data-objectstack): 5 successful, 5 total - core's type-check is 'tsc --noEmit && tsc -p tsconfig.test.json', so the new test file is type-checked, not excluded. turbo run lint (whole workspace): 47 successful, 47 total, 0 errors; filter-converter.ts carries 7 no-explicit-any warnings at HEAD and 7 after (compared via eslint --stdin against the HEAD blob), so this diff adds none - a complete run, so there is no narrowing to declare. Gates, each read from the gate's own verdict line with the exit code captured before any pipe: check:control-bytes 0, check:spec-symbols 0, check:doc-fences 0, check:doc-types 0, check:doc-examples 0 (125 blocks, 90 ledger rows, none moved), check:doc-snippets 0 (638/638), check:readme-exports 0, check:unreferenced-sources 0, check-doc-links 0, check-changeset-presence 0, check-changeset-no-major 0, check-changeset-overwrite 0. NOT MEASURED, then measured: the first runs of readme-exports / doc-examples / doc-snippets exited non-zero on an UNBUILT tree ('packagesRead: found 6, floor is 25') - a prerequisite, not a finding; turbo run build 43/43 then made all three green. Manual control-character sweep over all five changed files found none. ABLATION, from the committed tree. No rebuild step, and none is needed: vitest.config.mts aliases @object-ui/core to packages/core/src (measured), so these tests execute SOURCE and there is no dist hop a stale build could make silently green. LEG B removed the 16-line refusal branch, proved on disk first (blob 5ba58fb → 7458ef8; marker '!isOperatorMap(value)' 1 → 0): 10 of 34 RED BY NAME across both test files; MODE = the refusal is MISSING and it fails as the defect itself (AssertionError: expected { created: /abc/ } to be undefined - the original object handed back because conditions ended empty); restored BY STATE (blob back to 5ba58fb and git diff HEAD empty). LEG A swapped the gate for Object.keys(value).length === 0 (blob → d3a3e70; injected-text count 1, removed-text count 0): 4 of 34 red; MODE = over-refusal, and BOTH {} identity controls reddened. CONTROL: the {} TRUE identity pin (this repo's own, from objectui#8555) stayed GREEN through LEG B and went RED under LEG A - it moves when the change is WRONG and not when the subject is merely absent, which is what makes it a control rather than a second copy of the subject.",
  "enumeration": "CONTENT axis: filter-date-comparand-8555.test.ts pinned the RegExp negative as a .not.toEqual and would have broken either way - updated to pin the envelope; readme-filter-operator-table.test.ts reads filter-converter.ts SOURCE (anchored on 'const operatorMap', unmoved and unreshaped) and executes every README refused-table row; the other five filter tests under packages/core/src/utils/__tests__; the three ValueDataSource vocabulary/conformance tests that assert parity with this lowering; and every runtime caller of convertFiltersToAST / toFilterNode / mergeFilterNodes in app-shell, components, core, fields, react, plugin-detail, plugin-form, plugin-grid, plugin-list, plugin-map, plugin-timeline, plugin-view - all covered by the two runs above. POSITION axis (what lines did I move, and who points here by file:line): exactly two rows exist in the tree and both were checked. (1) docs/audits/2901-spec-enum-renderer-coverage.md:150 names filter-converter.ts:126 in link TEXT - line 126 does NOT move (the spec import was kept on one line for this reason; the first line-shifting hunk is at 198). (2) scripts/check-doc-component-types.mjs:289 names packages/data-objectstack/README.md:603-606, which this PR shifts to 620-623 - prose dated to commit c30026715, not an enforced ledger, and package READMEs are outside that gate's scan population per its own recorded reproduction; check:doc-types run anyway, exit 0. check:doc-examples' ledger is keyed path:line symbol and has NO row for filter-converter.ts (its @example blocks are bare, which that gate counts and never compiles), and this diff moves lines in no file that carries a row.",
  "mcp_calls": "0 - every read and write went through repo-scoped REST (probe: GET /repos/objectstack-ai/objectui returned 200); no MCP GitHub call was made this run",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: docs/audits/2901-spec-enum-renderer-coverage.md:150 points at filter-converter.ts:126 for a $ncontains claim, and line 126 has not held that code for some time (it is inside lowerLogicalGroup). Stale before this PR and NOT moved by it. Successor: the same audit's item 4 (FilterConditionField.tsx emitting a $ncontains key the spec does not carry) touches that paragraph when it is fixed.",
    "noted, not filed: the README's 'Refused at lowering time' TABLE cannot carry a row for this refusal - readme-filter-operator-table.test.ts runs every row's example through JSON.parse (no eval, by design) and no exotic comparand is expressible as a JSON literal, so a row would redden the pin with 'cannot parse the example literal'. Documented in prose under the table instead, where the pin does not read it. Successor: whoever wants that table exhaustive over non-dollar shapes needs a second example channel first.",
    "noted, not filed: scripts/check-doc-component-types.mjs:289's dated census cites README lines this PR shifts by 17. Dated to c30026715 with its re-derivation instrument named beside it, so it is not made false. Successor: the objectui#7896 census-first widening re-derives that number itself."
  ]
}

Generated by Claude Code

已落地 —— PR #8877 于 2026-09-09T18:54Z 合并（`domain:ui` 席）

⛔ 按内容验收，不认 sha。origin/main 当刻 64c3cdd44，读数取自剥掉注释行后的可执行文本（本班刚为「注释引用被删字符串」骗过一次探针，见 #7499 的落地注记）：

检	读数
`isOperatorMap`（原型闸门，定义 + 使用）	2
`describeExoticComparand`	2
⭐⭐ 控制 A：`Object.keys(value).length === 0`	0
控制 B：`{}` 恒等式钉子仍在且仍说 identity	在
控制 C：剥离器没把文件清空	318 / 821 行，`const operatorMap` = 1

⭐⭐ 控制 A 是这次验收里唯一真正有价值的那条。 它验的不是「改动落了」，而是改动取的是正确的形状：如果闸门写成了键数（Object.keys(value).length === 0），代码照样能通过「isOperatorMap 在不在」这种探针，却会把 {} 恒等式一起扫掉 —— 而 {} 与 /x/ 的共同点恰恰就是零个自有键。⇒ 一个只查符号是否存在的探针，看不出这两种实现的区别。

⭐ dev 把本席的假设测掉了一半，这是本轮最该留下的东西

派发单说：这个文件已有的 FilterOperatorError 拒绝是同一类，idiom 可以照抄。读出来（而不是数出来）之后，那是半对的。 七个抛出点分属五类：

$regex 与未知运算符 —— 运算符词汇（拼写不在 spec 的 FILTER_OPERATORS 里，没有东西可译）
$not —— AST 表达力（spec 声明了它，但本文件产出的数组方言没有否定关键字）
两处 lowerLogicalGroup —— 组合子参数形状
裸数组与存储规则元数 —— 比较值形状，而且正是因为 spec 拒绝裁决才从下游行为论证

⇒ 本次是第六类：一个 spec 自己拒绝的比较值类型 —— 与它最近的邻居权威相反。

所以 dev 刻意不抄 $regex/$not 的消息 idiom（一个写了 { name: /abc/ } 的读者根本没用运算符，那句话会回答他没问的问题），但复用了错误类型 —— 而且是按测量而不是按名字复用：七处里已有四处是非运算符拒绝，且 FilterOperatorError 真正运输的是 classifyLoadError 会读的 INVALID_FILTER / 400 信封。⭐ 一个裸 Error 会被归类成网络故障 —— 那才是复用的理由。

⭐ 消融带一条「漫画腿」，而控制的定义被写清楚了

腿	变异	结果
B	删掉 16 行拒绝分支	34 例中 10 例按名变红；形态 = 缺陷本身（`convertFiltersToAST({created:/abc/})` 交回原对象，因为 `conditions` 空了）
A	把闸门换成 `Object.keys(value).length === 0` —— 被拒绝的那个漫画	4 例红，两个 `{}` 恒等式控制双双变红

⭐ dev 对控制的表述值得原样留下：{} 恒等式在腿 B 里保持绿、在腿 A 里变红 —— 它在改动「错」时会动，在主体仅仅「缺席」时不动，而这正是一个控制与「主体的第二份拷贝」的区别。

位置轴也做了，两行都逐一判定

docs/audits/2901-…md:150 指 filter-converter.ts:126 —— 126 行不动（spec import 刻意保持在一行上，第一个移行的 hunk 在 198）。⚠️ 而且该引用在本 PR 之前就已经是假的（126 行在 lowerLogicalGroup 里），⛔ 未被本 PR 移动，也未被顺手修 —— 记入 验收备注。
check-doc-component-types.mjs:289 指 README :603-606，本 PR 把它们推到 620-623；但那是注明日期的散文（钉在 commit c30026715，旁边写了重推导的工具），⭐ 关于那个 commit 的陈述仍然为真 —— 与 fix(react): stop advertising app as a bound expression-scope root — the #8164 post-merge audit residue, swept as a class #8867 那轮 CHANGELOG 的豁免同理：一条有日期的记录，改成今天的树反而会让它作为历史变假。
check:doc-examples 的台账没有指向本文件的行（本文件的 @example 是裸的），且本 diff 没有移动任何带台账行的文件。

`验收备注`

README 的 "Refused at lowering time" 表格刻意没有加行：readme-filter-operator-table.test.ts 会把每行的示例过 JSON.parse（设计上 no eval），而任何外来比较值都写不成 JSON 字面量 ⇒ 加一行会让钉子报「示例字面量解析不了」。改为在表格下方用散文记录，钉子读不到那里。后继：想让该表对非 $ 形状穷尽的人，得先有第二条示例通道。

Generated by Claude Code

Navigation Menu

Repository navigation

`convertFiltersToAST` still SILENTLY DROPS a non-Date exotic-object comparand — a bare RegExp widens the result set with no error #8567

Measured

Why this is its own card, not part of objectui#8555

Suggested direction (not ruled)

Dedup

Related

一、裁决（不可议）—— 拒绝，不是丢弃，也不是下放

二、⚠️ PM 的机制假设 —— 这条必须测，不是让你继承

三、建议路线（可选，⛔ 不是裁决）

四、⛔ 一定不能被扫进去的那一个

五、⚠️ Clause-② —— 先测、先报，⛔ 不要做完一整轮才发现

六、验收 —— 类判据，⛔ 不是数字

七、⭐ 枚举，两个轴 —— 这一班刚为此付了两次代价

八、⛔ 红线

已落地 —— PR #8877 于 2026-09-09T18:54Z 合并（`domain:ui` 席）

⭐ dev 把本席的假设测掉了一半，这是本轮最该留下的东西

⭐ 消融带一条「漫画腿」，而控制的定义被写清楚了

位置轴也做了，两行都逐一判定

`验收备注`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

convertFiltersToAST still SILENTLY DROPS a non-Date exotic-object comparand — a bare RegExp widens the result set with no error #8567

Description

Measured

Why this is its own card, not part of objectui#8555

Suggested direction (not ruled)

Dedup

Related

Activity

os-zhuang commented on Sep 9, 2026

一、裁决（不可议）—— 拒绝，不是丢弃，也不是下放

二、⚠️ PM 的机制假设 —— 这条必须测，不是让你继承

三、建议路线（可选，⛔ 不是裁决）

四、⛔ 一定不能被扫进去的那一个

五、⚠️ Clause-② —— 先测、先报，⛔ 不要做完一整轮才发现

六、验收 —— 类判据，⛔ 不是数字

七、⭐ 枚举，两个轴 —— 这一班刚为此付了两次代价

八、⛔ 红线

claude commented on Sep 9, 2026

os-zhuang commented on Sep 9, 2026

已落地 —— PR #8877 于 2026-09-09T18:54Z 合并（domain:ui 席）

⭐ dev 把本席的假设测掉了一半，这是本轮最该留下的东西

⭐ 消融带一条「漫画腿」，而控制的定义被写清楚了

位置轴也做了，两行都逐一判定

验收备注

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`convertFiltersToAST` still SILENTLY DROPS a non-Date exotic-object comparand — a bare RegExp widens the result set with no error #8567

已落地 —— PR #8877 于 2026-09-09T18:54Z 合并（`domain:ui` 席）

`验收备注`