fix(objectql)!: a number or boolean written to a text-family field is stored as the string the validator judged (#29241) - #29384

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 75d1344fa04e5e3c682de5dfb38103831d021080 && git checkout 75d1344fa04e5e3c682de5dfb38103831d021080
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6fe99f8634e7da14d1af67f97a3b6b3030bf70ba 288190cde77357eee227b6f17e121511a732fc3e && git checkout -B drift-repro 6fe99f8634e7da14d1af67f97a3b6b3030bf70ba && git merge --no-ff 288190cde77357eee227b6f17e121511a732fc3e

node scripts/docs-audit/affected-docs.mjs --json 6fe99f8634e7da14d1af67f97a3b6b3030bf70ba

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract-review-claim: session_01ADHkmQjPiXgNoSaEpqeGvY · head 34c3019 · 2026-11-02T13:46Z

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 34c30195fcde0fbcc5bff2f50bbd80a295e5fe03
Local-runs: none

Read at 2026-11-02T14:04Z from the net diff against main (merge-base 57cde8cb, 5 files, +362/-7), card #29241 (body, triage 6575529488, claims 6576283748 and 6576374454, dev report 6578737095), the PR body, and the head's check-runs. Nothing was built, run or re-run. Every claim below is either read from code at the head or reasoned from the PR's own base and head measurements, and it says which.

① Derived judgments

1. The seam: right. normalizeNumericStringRow now writes String(value) for a number or boolean on a BOUNDED_STRING_FIELD_TYPES field. The field scope is the numeric half's (isInReadonlyScope(…, 'include'): readonly included, SKIP_FIELDS and non-readonly system excluded). The written string is exactly the s that the string arm's maxLength, minLength, valueDomain and format checks read (record-validator.ts ~1286). Strings, null, a missing key, objects, arrays, bigint and every type outside the set fall through unchanged.
2. Doors: no door is left half-applied. I read each one at the head:
   • insert() calls the seam at engine.ts:15391. insertMany() is insert(rows) (16737).
   • update() calls it at 16828, ahead of the by-id and predicate dispatch, so driver.update, driver.updateMany and updateByIdExpecting all receive the rewritten payload.
   • The validate() dry run calls it at engine-validate.ts:158, and validateInsertValues at record-validator.ts:2164.
   • REST create, PATCH and batch, import, and the flow create_record/update_record nodes all reach the engine through these methods.
   • The only direct driver.create calls outside the engine are testkits (default-organization*.testkit.ts) and the packages/verify conformance harness. None of them is a product writer.
   • Residuals, all accepted under the record validator's number arm accepts any value whose Number() is finite, so POST /api/v1/data with a number field [500] answers 201 and driver-sql stores the text '[500]' #20309 posture: a value written after the door is not rewritten. That covers a before* hook (the PR says so), write middleware, and a CEL-expression defaultValue on a text field whose result is a number. The CEL case is read from the defaultValue docblock and not measured. The spec refuses a non-string literal default at parse.
   • Gap: no test pins validate(). The objectql file's header says only that it "calls the same function". The changeset names validate() among the doors, so this is a nit for the follow-up.
3. Ordering: right. The rewrite runs first, before the middleware, the callerKeys snapshot, defaults, hooks, the readonly strip, the validator and the driver's unique check. All of them therefore see one image.
   • Formula fields are computed on read from the stored row, so they read the string.
   • Hooks now receive "42" where they received 42. The forced edit to protocol-save-notice-answer.test.ts shows this is visible to hooks. It is the same accident class as the numeric half, and it is acceptable.
   • Because the rewrite runs before the driver's unique check, that check now compares the judged string. That is correct, but it is also what moves the accept set in item 5.
4. The read-back type change on driver-memory (42 becomes "42") corrects an accident; it does not break a contract.
   • The published stored shape of a text-family field is a string. The arm itself says: "A string type's stored shape is a string". FieldSchema types it so. SQLite already handed back "42.0", so no reader could have relied on a raw number across drivers.
   • What answers differently now on driver-memory, read from code:
     • An equality or $in comparand 42 on a text field. mingo compares strictly, so it no longer matches newly written rows.
     • The comparand "42" now matches those rows.
     • sort and min/max order lexically instead of putting numbers first by BSON type order.
     • A formula or validation-rule expression now reads a string.
   • All four make the field behave as its declared type. None is a published surface.
   • Should-fix follow-up, not owed by this card: the filter door has no text-family comparand arm. normalizeFilterComparandTypes in packages/spec/src/data/filter-comparand-type.ts is not field-aware. So a number comparand on a text field still answers by driver. On driver-memory it misses the row. On SQLite, TEXT affinity matches '42'. The seat should file it.
5. must-fix: the accept set does move, on unique-constrained text fields. The PR, the changeset and the Clause-② measurement say "nothing is refused and nothing is newly admitted". That was measured on single writes only. The driver's unique key now compares the rewritten value. Reasoned from code (uniqueKeyOf is a JSON.stringify of the stored parts in memory-unique-constraint.ts) and from the PR's own base/head table. Not run.
   • Narrowing, on both drivers. Take a unique text field, insert { code: 42 }, then { code: "42" }.
     • On main: driver-memory keys [42] and ["42"]; SQLite stores '42.0' and '42'. Both writes answer 201.
     • On head: both store "42", so the second write is 409 DUPLICATE_RECORD.
     • The same holds for true then "true".
   • Widening, on SQLite, on an empty table. Insert { code: true }, then { code: 1 }.
     • On main: both store '1.0', so the second write is 409.
     • On head: 'true' and '1' are distinct, so both writes answer 201.
     • The same holds for false/0, and for 42 then "42.0".
   • Legacy rows. A row stored on main ('42.0', or a raw 42 on a driver-memory store with persistence: 'file', 'local' or an adapter) no longer collides with a new write of the same value.
   • The card's own business case names exactly the fields that carry unique: "a phone extension, a code, an external id".
   • Each new answer is the one the validator's reading implies. I judge the direction right. The declaration and the prose are what is wrong (see ②).
6. Prose, should-fix.
   • The PR's acceptance note says "driver-memory rows are process-lifetime". InMemoryDriver takes opt-in persistence (file, local, or a custom adapter; memory-driver.ts ~236). Persisted raw scalars outlive the change, as SQLite's '42.0' rows do.
   • The census covered objectql, rest, runtime, service-automation and dogfood. Plugin suites (for example plugin-audit and service-messaging) were not under the probe. I spot-read the obvious text-typed value columns: sys_audit_log.old_value/new_value are written through safeStringify. I found no product number writer, but the census is not exhaustive.

② Semver level

• Changeset '@objectstack/objectql': patch: right. It is a fix in a released package. A non-protocol change ships patch even when it narrows, keeping the banner. Metadata-protocol: none is also right: no key, accepted value or metadata type that an author writes moves.
• Clause-②: no: wrong. must-fix. Item ① 5 shows a write sequence accepted on main that is refused at the head (narrowing, both drivers). On SQLite it also shows a sequence refused on main that is admitted at the head (widening). Under the closed pair, the line has to carry the narrowing arm:
  • Clause-②: yes (narrowing) if the seat counts the SQLite de-collision as a widening;
  • otherwise Clause-②: no (narrowing).
  • Either way the arm is BREAKING. It owes the changeset a BREAKING banner, the ADR-0087 disposition marker beside both declaration lines (pnpm check:adr-0087-registration), and a Skills-docs: line on the PR body. A narrowing arm also moves the review face to CONTRACT_REVIEW_TIER (--face narrowing), so a TIER_DEFAULT PASS could not govern this head in any case.
• The alternative is a ruling. If the seat rules on the card that a state-dependent unique outcome between values the validator already reads as one string is outside Clause-②, plain no can stand. The prose "nothing is refused / nothing is newly admitted" in the PR body and the changeset (which ships as CHANGELOG.md) still has to be corrected to name the unique-collision change, and that ruling has to be on the card before a re-review.
• Either path owes a pin: one test of the unique-collision answer on the SQLite real-driver file the PR already adds.

③ Boundary flags

• open_questions: the function name (normalizeNumericStringValues now also writes the string arm's reading). Answer: A, keep the name in this PR. The docblock's [#29241] section names the second half, and a rename touches engine.ts call sites that other server cards serialise on. A rename (for example normalizeJudgedScalarValues) is optional future hygiene, not owed. If the seat wants it, it belongs on records: a free-form select field (no options) admits a plain object or an array on create and stores it as-is, although a select's stored value is a scalar option value #29244, which edits the same file next.
• Deviation: no driver-memory test pin. Accepted. scripts/check-driver-memory-census.mjs and its ledger confine driver-memory test consumers to ruled files. The objectql recording-driver test pins what every driver receives (the string), and driver-memory stores what it receives (the base measurement). The real-driver pin is SQLite in packages/rest.
• Deviation: PostgreSQL and MongoDB NOT MEASURED. Accepted, with residual risk named. The engine now hands every driver a JS string, so no driver decides for new writes. What stays unmeasured is each driver's legacy rows (MongoDB keeps raw numbers and booleans as written) and their unique answer (①5). Neither blocks this card. The migration of legacy rows stays a separate card, as the PR says.
• Deviation: runtime, service-automation and dogfood ran at 27920d0a with a log-only probe, before the origin/main merge and the forced test edit. Accepted as evidence for the census, not as head verdicts.
  • The delta to the head is main's own merged work (fix(objectql): a cleared optional unique text field stores null, so the second record cleared is no longer refused 409 UNIQUE_VIOLATION (#29176) #29271 and others), plus one objectql test-file edit.
  • objectql and rest were re-run on the head, and the head's Test Core shards carry the CI verdict (see below).
  • CI's dogfood legs were skipped by the path filter ("Dogfood Regression Gate: satisfied — no shard was expected to run"). So the only dogfood reading of this stored-form change is the pre-merge local one. The seat should re-run it on the head if the card delta owes it at the head itself.
• Out-of-scope findings.
  • The string arm judges a Date or another class instance by String(value) while the raw object is stored. That is the same judged≠stored class this card fixes. The seat should file a card for it; it is not this PR's.
  • Legacy SQLite '42.0'/'1.0' rows, and persisted driver-memory raw scalars: a migration card only if wanted.
  • The filter-door text comparand gap in ①4: should be filed.
• Dev deviations "no assignee" and "no PR subscription": relay rules, no contract bearing.
• PR state. The PR is a draft. Its author is objectstack-fleet[bot] (relay), so no out-of-relay login to note.
• CI on the head: all 48 check-runs completed: 35 success and 13 skipped, with 0 failures and 0 in progress. Test Core 1–8/8, the Test Core aggregate, Type Check (workspace, source, consumer, debt ledger), Build Core, every Lint leg, Check Changeset, Governed Surface Queue Guard and PR-body guards all passed. Skipped by the path filter: the UI legs, the Dogfood shards and Verify CLI, Temporal Conformance (live PG + MySQL), and the opt-in legs. The CI gates are green, so this FAIL rests on ② alone.

Implemented-by: claude/project-thread-6u3vdx
Reviewed-by: session_01ADHkmQjPiXgNoSaEpqeGvY

VERDICT: FAIL

Must-fix before a re-review:

• (1) Fix the Clause-② declaration in the PR body and the changeset, either with the narrowing arm and its BREAKING and ADR-0087 obligations, or with a seat ruling on the card that keeps plain no.
• (2) Correct the "nothing is refused / nothing is newly admitted" prose in the PR body and the changeset to name the unique-collision change.
• (3) Pin that change in packages/rest/src/rest-data-text-scalar-value.test.ts.

The code change itself (①1–4) is judged right and needs no edit.

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract-review-claim: session_01ADHkmQjPiXgNoSaEpqeGvY · head 926fa80 · 2026-11-02T15:11Z

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 926fa801bb273e098893f224461500f73ad29987
Local-runs: none
Scope: packages/objectql/src/validation/record-validator.ts, packages/objectql/src/validation/record-validator.text-scalar-value.test.ts, packages/rest/src/rest-data-text-scalar-value.test.ts, packages/objectql/src/protocol-save-notice-answer.test.ts, .changeset/29241-text-field-scalar-stored-string.md + packages/objectql/src/engine.ts, packages/objectql/src/engine-validate.ts, packages/objectql/src/number-comparand-declared-type-door.ts, packages/spec/src/data/filter-comparand-type.ts, packages/spec/src/data/filter-number-comparand-declared-type.ts, packages/spec/src/data/filter-text-comparand.ts, packages/drivers/driver-memory/src/memory-driver.ts, packages/drivers/driver-memory/src/memory-unique-constraint.ts, content/docs/protocol/objectql/types.mdx, content/docs/protocol/objectql/query-syntax.mdx

Round 2, on the narrowing face. Supersedes record 6579147685 (TIER_DEFAULT FAIL on head 34c30195, which failed on the declaration alone and passed the code). Read at 2026-11-02T15:22Z from the net diff against main (merge-base 57cde8cb, 5 files, +419/-7), card #29241 (body, triage 6575529488, claims 6576283748 and 6576374454, dev report 6578737095, seat ruling 6579176393), the PR body as rewritten for round 2, the PR's own comments, and the head's check-runs. Nothing was built, run or re-run; every statement about behaviour below is read from the code at the head or from the PR's own base and head measurements, and says which. The dispatch brief's conclusions were not an input.

① Derived judgments

1. The seam: right. normalizeNumericStringRow (record-validator.ts) now takes a number or boolean (isStringReadScalar) beside a string, and on a field whose type is in the spec's BOUNDED_STRING_FIELD_TYPES writes String(value), the exact s the string arm reads for maxLength, minLength, valueDomain and the email/url/phone formats. The string half is unchanged (isJudgedNumberType then parseNumericString). Field scope is the numeric half's, isInReadonlyScope(name, def, 'include'): readonly reached, SKIP_FIELDS and non-readonly system not. Strings, null, a missing key, objects, arrays, bigint, Date, and every type outside the set fall through by reference (out ?? row). Copy-on-write per row and per array holds.
2. Doors: every engine write passes the seam, read at the head. insert() calls it at engine.ts 15391 (after normalizeBlankTypedValues), update() at 16828 ahead of the by-id, updateByIdExpecting and updateMany dispatch, the validate() dry run at engine-validate.ts 158, validateInsertValues at record-validator.ts 2164. The remaining direct driver.create / driver.update sites in engine.ts (createWithAutonumberResync 8863 and 8919, the hook-context update at 18204, the bulkCreate fan-out at 16477 and 16480) all receive a row that already passed one of those two doors. REST create, PATCH, batch, import and the flow record nodes reach the engine through them. Residual, accepted under the record validator's number arm accepts any value whose Number() is finite, so POST /api/v1/data with a number field [500] answers 201 and driver-sql stores the text '[500]' #20309 posture the docblock states: a value a before* hook or write middleware writes after the door is its own.
3. Ordering: right. The rewrite runs before the middleware, the caller snapshot, defaults, hooks, the readonly strip, the validator and the driver's unique check, so every reader sees one image. Hooks now receive "42" where they received 42 (the forced edit to protocol-save-notice-answer.test.ts is that effect made visible; moving the vehicle field to json keeps the hook's raw-number case intact). Formulas, aggregation min/max/groupBy, search and the memory driver's filter all read the string.
4. Accept-set changes the diff implies, each judged:
   • Single write on a text-family field: unchanged. The arm's verdict reads s, which is byte-equal to what is now stored. Right.
   • unique text-family field, both drivers: 42 then "42" (and true then "true") was two rows, is now 409 UNIQUE_VIOLATION on the second. Read from uniqueKeyOf (JSON.stringify of the stored parts, memory-unique-constraint.ts 499-518) and from the PR's base/head table; pinned by two REST tests. A narrowing, and the right one: the validator read both writes as one value, and now the constraint does too.
   • unique text-family field, SQLite only: true then 1, false then 0, 42 then "42.0" were 409 (both bound as REAL/integer and spelled '1.0'/'0.0'/'42.0' by TEXT affinity), now two rows. A widening, and the right one: they are different strings under the spec's reading. Pinned by two REST tests. driver-memory admitted both before and still does.
   • Read-back type on driver-memory: 42 becomes "42". The published stored shape of the family is a string (types.mdx: SQL TEXT, MongoDB String; the arm: "a string type's stored shape is a string"), so this corrects an accident and publishes nothing new.
   • Filter answers (ruled on in ④): { title: 42 } at head matches no row on either driver; { title: "42" } matches every row written as 42 or "42". Right as a consequence of the write door; the comparand gap is the filter door's and pre-existing.
   • Legacy rows (SQLite '42.0'/'1.0', driver-memory with persistence, MongoDB raw scalars) are not rewritten and no longer collide with or equal new writes. Named in the changeset and the acceptance notes; a migration is a separate card. Right.
5. No public surface moves. No export, type, Zod schema or metadata key changes; packages/spec is untouched; the one new function (isStringReadScalar) is module-private.
6. Prose in the tree, should-fix (not blocking). Two sentences at the head still carry round 1's claim that the seat ruled false: the [#29241] docblock section in record-validator.ts ("Nothing is refused or newly admitted: only the stored form of a value the arm already admits changes") and the header of record-validator.text-scalar-value.test.ts ("Nothing is refused and nothing is newly admitted"). Round 1's must-fix named only the PR body and the changeset, and both are corrected; these two comments should say what the changeset says (single-write answer unchanged; the unique answer moves). Fix them in the follow-up, or when records: a free-form select field (no options) admits a plain object or an array on create and stores it as-is, although a select's stored value is a scalar option value #29244 next edits the file.

② Semver level

• Changeset '@objectstack/objectql': patch: right. A fix in a released package; AGENTS Post-Task step 3: a non-protocol change, widening or breaking, ships patch and keeps its BREAKING banner and ADR-0087 disposition.
• Clause-②: yes (narrowing) in the PR body and the changeset: right, and it is the arm the seat ruling 6579176393 amended the claim to. ①4 shows the narrowing (both drivers) and the widening (SQLite), so yes with the (narrowing) arm is the one well-formed spelling under the closed pair.
• Metadata-protocol: none: right. No key, accepted value or metadata type an author writes moves.
• BREAKING banner: present, and it names the FROM → TO case ({ code: 42 } then { code: "42" }: two rows → 409 UNIQUE_VIOLATION), the caller's one-line fix, and the SQLite widening in the other direction. The code name matches what the REST test asserts and what engine.ts 8773 documents (UNIQUE_VIOLATION / 409).
• ADR-0087 marker: exactly one, not-required (no-migration-prescription), honest. No metadata key, export or type moves, so objectstack migrate meta has nothing to rewrite and no tombstone is owed; the body's "send the string once, or update the existing row" is a behavioural note, not a code-rewrite prescription. The gate (Lint · CI, release & engine gates) is green on the head, and the dev reports check-adr-0087-registration --base origin/main exit 0 with the [BREAKING+bang+clause-②-narrowing] signal set.
• PR title fix(objectql)!: carries the bang and matches the changeset summary's !, so the gate's three signals (bang, banner, narrowing arm) agree.
• Skills-docs: none — … line: present and true as far as the tree shows: no file under skills/**, .claude/skills/** or content/docs/** teaches writing a number or boolean into a text-family field or how unique compares 42 with "42"; the types page already states the family's stored shape.

③ Boundary flags

• open_questions — the function name (normalizeNumericStringValues now carries the string arm's half). Answer: A, keep the name. The docblock's [#29241] section names the second half, and a rename touches engine.ts call sites other server cards serialise on. Optional hygiene for records: a free-form select field (no options) admits a plain object or an array on create and stores it as-is, although a select's stored value is a scalar option value #29244, which edits the same file next; not owed.
• Round 1 must-fixes, all three met at the head: (1) the declaration in body and changeset now reads yes (narrowing) with banner, marker and Skills-docs: line; (2) the "nothing is refused / nothing is newly admitted" prose in the body and the changeset is replaced by the single-write / unique-answer distinction (the two in-tree comments in ①6 remain, should-fix); (3) the unique answer is pinned: four REST tests on SQLite (two 409, two 201/201) and one objectql recording-driver test.
• Deviation: no driver-memory test pin. Accepted. The driver-memory census gate admits only ruled consumers; the recording-driver test pins what every driver receives, and the real-driver pin is SQLite in packages/rest.
• Deviation: PostgreSQL and MongoDB NOT MEASURED. Accepted with the residual named: the engine now hands every driver a JS string, so no driver decides for new writes; what stays unmeasured is each backend's legacy rows and their unique answer. Not this card's.
• Deviation: runtime, service-automation and the round-1 dogfood reading ran at 27920d0a with a log-only probe in objectql's dist. Accepted as census evidence, not as head verdicts. The head's verdicts are the check-runs below plus the dev's round-2 dogfood reading at 926fa801 (393 files, no failures; CI's dogfood shards were skipped by the path filter, so that local reading is the only dogfood reading of this head).
• Round 2 ran only the two edited test files and the changeset gate locally; the full objectql and rest suites were last run at 34c30195. Accepted: round 2 changed only the changeset and the two new test files, and Test Core 1–8 on the head is green.
• No round-2 os-dev-report comment exists on the card or the PR at the time of this read; the rewritten PR body is the round-2 account. The dev should post the round-2 report on the card so the card thread carries it; no contract bearing.
• Out-of-scope findings, routing: (i) the filter-door text-family comparand gap → a follow-up card, filed by the seat (④); (ii) a Date or other class instance on a text field is judged by String(value) while the raw object reaches the driver (isPlainObjectValue excludes it) → a card of its own, same judged ≠ stored class; (iii) legacy '42.0'/'1.0' SQLite rows and persisted driver-memory scalars → a migration card only if wanted.
• "No assignee", "no PR subscription": relay rules, no contract bearing. The PR is a draft; its author is the relay bot.
• Check-runs on 926fa801: 52 check-runs, all completed: 37 success, 15 skipped, 0 failure, 0 in progress. Test Core 1–8/8 and the aggregate, Build Core, Type Check (workspace, source gates, consumer gates, debt ledger), every Lint leg, Check Changeset, PR-body guards, Governed Surface Queue Guard, Dogfood Regression Gate (satisfied, shards skipped by path filter), Flag docs affected, Test UI and Live E2E UI all green. Skipped by filter or opt-in: Type Check UI, Lint UI, the UI shards and artifacts, Build Docs, Dogfood shards and Verify CLI, Temporal Conformance (live PG + MySQL), the packed-tarball and 18.x harnesses. Those conclusions are the gate verdicts.

④ Design judgment

The narrowing against the published spec on main. The spec declares a text-family field's stored value to be a string (types.mdx: TEXT on every SQL dialect, String on MongoDB; the record validator: "a string type's stored shape is a string; everything below is a bound, a domain or a format"), and unique as a constraint over stored values. On main the validator read 42 as "42" and admitted it, while the driver stored the raw scalar, so a unique column held two rows for one value on both drivers, and SQLite refused two different values (true, 1) because its affinity spelled them alike. Neither answer was declared anywhere; both were the judged ≠ stored accident reaching the constraint. The narrowing takes no declared capability away at the consumer: it makes the spec's own refusal (one value, one row) real, and the SQLite widening is the same reading applied to values the spec says are different. Pinned on the real driver in both directions. I tried to break the design on -0 ("0"), 1e21 ("1e+21"), NaN, a password or valueDomain field, a readonly text field, update by predicate, updateByIdExpecting under a precondition, the autonumber resync path and the bulkCreate fan-out: in each case the stored string is byte-equal to the s the arm judged, and the rewritten row is the one every later reader gets. No must-fix.

The filter measurement the dev reported (two rows, 42 and "42"; base { title: 42 } matched the raw-42 row on both drivers; head it matches nothing on both, { title: "42" } matches both rows). Ruling: (b), a pre-existing filter-door gap this PR exposes, not a regression it introduces. Argued from the published filter contract and the code:

• The filter contract has two kinds of door. The comparand-TYPE door (filter-comparand-type.ts, driver-memory has no policy for an unsupported comparand TYPE: a BigInt crashes with a raw mingo TypeError, and four other types silently answer zero rows #7872 ruling) judges the comparand's JS type alone: number is one of the six accepted literal types on any field. The field-aware declared-type doors live at the engine's single filter seam (number-comparand-declared-type-door.ts, engine.ts 1300-1352) and exist for number fields (objectql: refuse a non-numeric string compared against a number field at the engine's field-aware filter door (400, every driver and position) — the door half of #20336 #20351: a numeric string is narrowed to its number, a non-numeric string, boolean, Date or array is refused INVALID_FILTER/400), boolean fields (objectql: a string comparand against a boolean field answers wrong rows under 200 — "true"/"false" match nothing, $ne "true" returns the true row, and ?f=true / ?f=false on the GET door both answer zero rows #21333), temporal fields (An unparseable date comparand on a datetime filter is passed through and compares false — HTTP 200, zero rows, no diagnostic — while an unknown {placeholder} is correctly rejected 400 (17.0.0 GA) #8690, and the docs' sentence "the same normalization is applied on write, on read, and to every filter comparand, so the two sides of a comparison can never disagree") and the text operators ([Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661; $icontains refuses a non-string comparand, spec: publish the icontains text-comparand refusal (predicate + reason) beside FILTER_TEXT_CASES so every face reads one implementation — ruling D on objectui#9048 #18113). For a scalar comparand under equality or $in on a text-family field there is no arm: a number or boolean comparand passes to the driver as written. That absence is on main, in files this PR does not touch.
• What main did with it was never a declared answer. driver-memory hands the predicate to mingo, which compares strictly, so { title: 42 } matched only a row holding the JS number 42, i.e. only a row produced by the accident this card fixes; it never matched a row written as "42". SQLite binds the comparand as a REAL and TEXT affinity spells it '42.0', so { title: 42 } matched only rows the same accident had stored as '42.0', missed every '42' row, and would match a row a client wrote as the string "42.0". The "found its row" on main was the write-side accident reflected on the read side, driver-shaped on both drivers, not a capability the spec published. The published stored shape is a string, and the published filter posture for a comparand the column cannot hold is a loud door, never a driver-decided answer.
• What this PR changes on the read side is only that every text row is now stored as the spec says, so the missing arm is visible to the client that relied on the accident. That client's symmetric filter { title: "42" } now matches on both drivers, and its read-back is "42" on both; before, neither held across drivers.
• Why the fix does not belong here: on the [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661 / driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336 / objectql: refuse a non-numeric string compared against a number field at the engine's field-aware filter door (400, every driver and position) — the door half of #20336 #20351 two-lane precedent the contract half of a declared-type arm lives in packages/spec/src/data and the door half at the engine seam, and the direction is a decision (narrow 42 to "42" the way the number arm narrows "12", or refuse it the way that arm refuses a boolean on a number field; driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336 recorded such a direction by triage before the door was built). The claim's file surface fences this PR off packages/spec/**, and a filter refusal would be a second accept-set change riding on a PR declared and reviewed for one. So: a follow-up card on the filter seam, filed by the seat, carrying the dev's measurement as its repro.
• should-fix here, not blocking: add one sentence to the changeset's "What you will see" naming the visible effect, in substance: a number or boolean comparand on a text-family field ({ title: 42 }) now matches no row on any driver, the string comparand ({ title: "42" }) is the one that matches, and the filter door's own arm for that comparand is a follow-up. The paragraph already says "filters now see the string"; the sentence makes the consequence concrete for the CHANGELOG reader.

Findings. must-fix: none. should-fix: (1) the two in-tree sentences in ①6; (2) the changeset sentence above; (3) the follow-up cards in ③ (filter-door text-family comparand arm; Date/class instance on a text field); (4) carried from round 1 as a nit: no test pins the validate() dry run's call of the seam.

Implemented-by: claude/project-thread-6u3vdx
Reviewed-by: session_01ADHkmQjPiXgNoSaEpqeGvY

VERDICT: PASS

Generated by Claude Code

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Regen-provenance: contract review 6580906146 (PASS, head 926fa801bb273e098893f224461500f73ad29987) carries over to head 288190cde77357eee227b6f17e121511a732fc3e. The one commit between them is prose only. It touches .changeset/29241-text-field-scalar-stored-string.md (+1 / −1, the filter sentence) and comment lines in record-validator.ts (docblock) and record-validator.text-scalar-value.test.ts (header), and so applies that record's three should-fixes. No code line, test assertion or level changes; checked against the compare diff.

席位核对 · ACCEPT · domain:server seat 1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY · 2026-11-02T15:49Z

Head 288190cde7, claim 6576283748 as amended by seat ruling 6579176393. The diff narrows one accept set and widens another, so it is declared Clause-②: yes (narrowing). A contract review is owed at CONTRACT_REVIEW_TIER. Record 6580906146 is a PASS with no must-fix; it supersedes the TIER_DEFAULT FAIL 6579147685 and is carried to this head by the provenance line above.