fix(spec): fail-closed shape guard on isAggregateCompatibleWithFieldType; correct the published grounds for the boolean and time rows (#16353)

Contract-review patch round. The predicate now refuses any non-string input
(a property-key lookup alone coerced ['count'] / { toString } to a member
spelling); pinned. The TSDoc and changeset no longer claim booleans are the
divergence class - #11152 has every backend answer them as numbers - and
record that row, plus the min/max refusal over the string classes (#15768
types them as a supported 'string' result), as overrides of existing
opinions referred to the maintainer. The time justification names SQLite's
canonical TEXT form (#3994). No row changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8SRGcf2eKTK7RRpWCGxwf

Author: claude

.changeset/aggregate-field-type-compatibility.md

@@ -14,7 +14,9 @@ A dataset measure pairs an `aggregate` with a `field`, and nothing between autho
 | `min`, `max` | the numeric class plus `date`, `datetime`, `time` — both return a value of the field's own type |
 | every other pair | refused |
 
-The ruling (director, decision batch #59, 2026-09-06) named its buckets by category; the table resolves them against the real `FieldType` membership through the `field-value.zod` semantic classes: "numeric" is `NUMERIC_VALUE_TYPES` (`integer` is a driver-internal column alias, not a `FieldType` — the integer-valued authorable members are `rating` / `slider` / `progress`); "temporal" is the three temporal classes, `time` included because the driver stores it as a native TIME column and `AnalyticsResult.fields[].type` already describes `min` / `max` over it as temporal. `formula` is refused for arithmetic aggregates whatever its declared `returnType`: it is virtual in SQL storage, no column exists to aggregate.
+The ruling (director, decision batch #59, 2026-09-06) named its buckets by category; the table resolves them against the real `FieldType` membership through the `field-value.zod` semantic classes: "numeric" is `NUMERIC_VALUE_TYPES` (`integer` is a driver-internal column alias, not a `FieldType` — the integer-valued authorable members are `rating` / `slider` / `progress`); "temporal" is the three temporal classes, `time` included because its stored form is a dialect question exactly like `date` / `datetime` (native TIME on Postgres and MySQL, canonical `HH:MM:SS[.fff]` TEXT on SQLite), the canonical form orders chronologically on every dialect, and `AnalyticsResult.fields[].type` already describes `min` / `max` over it as temporal (#15768). `formula` is refused for arithmetic aggregates whatever its declared `returnType`: it is virtual in SQL storage, no column exists to aggregate.
+
+Two refused rows override existing opinions and are recorded as such, not presented as agreement. **Booleans** are refused for `sum` / `avg` / `min` / `max` by the ruling's "every other pair: refused", while maintainer ruling #11152 already has every backend answer them as numbers (`sum(flag)=3`, `avg(flag)=0.5`, `min(flag)=0`, `max(flag)=1`, pinned in the spec's `AGGREGATION_CASES`; `driver-sql` casts the aggregand on Postgres to make it hold). That refusal is therefore not grounded in backend divergence; whether booleans belong in those rows is a collision between two rulings and is referred to the maintainer as its own decision — the row ships exactly as batch #59 stated it. **The string classes** are refused for `min` / `max` here, while `service-analytics` (#15768) already types `min` / `max` over them as a supported `'string'` result; the refusal is defensible (string order is collation-dependent) but it overrides that opinion.
 
 **The narrowing, stated plainly.** Every pair outside the table — `avg` × `datetime`, `sum` × `boolean`, `min` × `text`, `sum` × `percent`, and so on — is an authoring shape `DatasetMeasureSchema` accepts today and will be REFUSED once the two consumer legs land: the compile-time refusal in the dataset compiler (#16099) and the authoring-time lint rule (its devx sub-card). A measure whose pair is refused is fixed by changing the aggregate to one the field's type supports (`min` / `max` for a temporal field; `avg` for a `percent`; `count` for anything), never by widening the table.
 

packages/spec/src/data/aggregate-field-type-compatibility.test.ts

@@ -107,7 +107,7 @@ describe('isAggregateCompatibleWithFieldType — the pairs the card is about', (
     }
   });
 
-  it('refuses arithmetic over the divergence class (booleans) and over the computed / text / structured types', () => {
+  it('refuses arithmetic over booleans (row as ruled; membership referred, see module TSDoc) and over the computed / text / structured types', () => {
     for (const fn of ['sum', 'avg', 'min', 'max'] as const) {
       for (const t of ['boolean', 'toggle', 'formula', 'autonumber', 'text', 'select', 'lookup', 'json', 'vector', 'file']) {
         expect(isAggregateCompatibleWithFieldType(fn, t)).toBe(false);
@@ -141,4 +141,37 @@ describe('isAggregateCompatibleWithFieldType — the pairs the card is about', (
     expect(isAggregateCompatibleWithFieldType('toString', 'text')).toBe(false);
     expect(isAggregateCompatibleWithFieldType('', '')).toBe(false);
   });
+
+  it('fails closed on SHAPE — a non-string that would coerce to a member spelling is refused, not looked up', () => {
+    // `hasOwnProperty.call` applies ToPropertyKey, so without the typeof guard
+    // `['count']` reads as 'count' and an object with a toString reads as
+    // 'sum'. A refusal gate must not be talked past by coercion.
+    const loose = isAggregateCompatibleWithFieldType as unknown as (a: unknown, f: unknown) => boolean;
+    expect(loose(['count'], 'number')).toBe(false);
+    expect(loose({ toString: () => 'sum' }, 'currency')).toBe(false);
+    expect(loose('sum', ['currency'])).toBe(false);
+    expect(loose('min', { toString: () => 'date' })).toBe(false);
+    expect(loose(undefined, 'number')).toBe(false);
+    expect(loose(null, 'number')).toBe(false);
+    expect(loose('count', undefined)).toBe(false);
+    expect(loose('count', null)).toBe(false);
+    expect(loose(1, 'number')).toBe(false);
+    expect(loose('count', 1)).toBe(false);
+    expect(loose(Symbol('count'), 'number')).toBe(false);
+  });
+
+  it('records the two overrides of existing opinions without changing the rows: booleans and the string classes', () => {
+    // Booleans: refused here by the ruling's default; #11152 / AGGREGATION_CASES
+    // answer them as numbers on every face. Row kept as ruled, question referred.
+    for (const fn of ['sum', 'avg', 'min', 'max']) {
+      expect(isAggregateCompatibleWithFieldType(fn, 'boolean')).toBe(false);
+      expect(isAggregateCompatibleWithFieldType(fn, 'toggle')).toBe(false);
+    }
+    // String classes: min/max refused here; measureResultType (#15768) types
+    // min/max over them as a supported 'string' result. Override recorded.
+    for (const t of ['text', 'select', 'lookup', 'autonumber']) {
+      expect(isAggregateCompatibleWithFieldType('min', t)).toBe(false);
+      expect(isAggregateCompatibleWithFieldType('max', t)).toBe(false);
+    }
+  });
 });

packages/spec/src/data/aggregate-field-type-compatibility.ts

@@ -46,18 +46,45 @@
  *   as REAL columns beside `number`. `summary` is a roll-up persisted as a
  *   numeric column.
  * - **temporal** = `CALENDAR_DATE_TYPES` ∪ `INSTANT_TYPES` ∪ `CLOCK_TIME_TYPES`:
- *   `date`, `datetime`, `time`. `time` is a native TIME column on every SQL
- *   dialect the driver emits DDL for, and `AnalyticsResult.fields[].type`
- *   already describes `min` / `max` over it as temporal (#15768), so it sits
- *   beside the two members the ruling named.
+ *   `date`, `datetime`, `time`. The ruling named the first two; `time` is the
+ *   third temporal class and takes the same treatment: its stored form is a
+ *   dialect question exactly like the other two (native TIME on Postgres and
+ *   MySQL `TIME(3)`, canonical `HH:MM:SS[.fff]` TEXT on SQLite — #3994), the
+ *   canonical form orders chronologically on every one of them, and
+ *   `AnalyticsResult.fields[].type` already describes `min` / `max` over it as
+ *   temporal (#15768, `TEMPORAL_SOURCE_FIELD_TYPES`). So it sits beside the
+ *   two members the ruling named.
  * - **everything else** — the text family, booleans, option types, references,
  *   files, structured JSON, `vector`, and the computed `formula` /
- *   `autonumber` — is refused for `sum` / `avg` / `min` / `max`. `formula`
- *   carries a declared `returnType`, but it is VIRTUAL in SQL storage (no
- *   column is emitted), so no arithmetic aggregate can be lowered to it
- *   whatever that type says; `autonumber` is a formatted string. Booleans are
- *   the divergence class exactly: one dialect sums 0/1, another has no
- *   `sum(boolean)` at all.
+ *   `autonumber` — is refused for `sum` / `avg` / `min` / `max`, the ruling's
+ *   "every other pair: refused". `formula` carries a declared `returnType`,
+ *   but it is VIRTUAL in SQL storage (no column is emitted), so no arithmetic
+ *   aggregate can be lowered to it whatever that type says; `autonumber` is a
+ *   formatted string.
+ *
+ * Two rows the ruling's default covers are recorded here as OVERRIDES of
+ * existing opinions, not as settled ground — the row stands as ruled, the
+ * text says only what this tree can defend:
+ *
+ * - **Booleans** (`boolean`, `toggle`) are refused for the four arithmetic /
+ *   order aggregates by the ruling's default, yet the runtime already ANSWERS
+ *   them: maintainer ruling #11152 pins that booleans aggregate as numbers on
+ *   every face with no per-aggregate exception (`AGGREGATION_CASES` in
+ *   `aggregation-conformance.ts`: `sum(flag)=3`, `avg(flag)=0.5`,
+ *   `min(flag)=0`, `max(flag)=1`, six backends), and `driver-sql` casts a
+ *   boolean aggregand to `int` on Postgres to make that hold (#11635). So the
+ *   refusal is NOT grounded in backend divergence — the backends agree. Whether
+ *   booleans belong in these rows is a collision between two rulings (batch
+ *   #59 and #11152) and is referred to the maintainer as its own decision; the
+ *   row is left exactly as batch #59 stated it until that decision lands.
+ * - **The string classes** (`STRING_VALUE_TYPES`, `SINGLE_OPTION_TYPES`,
+ *   `REFERENCE_VALUE_TYPES`, `autonumber`) are refused for `min` / `max` here,
+ *   while `service-analytics`' `measureResultType` (#15768,
+ *   `STRING_SOURCE_FIELD_TYPES`) already types `min` / `max` over them as a
+ *   supported `'string'` result. The refusal is defensible — the ORDER of
+ *   strings is collation-dependent, so two backends can return two different
+ *   "smallest" values — but it overrides that existing opinion, and is
+ *   recorded as such rather than presented as agreement.
  *
  * ## Relation to `isIncoherentAggregate`
  *
@@ -126,13 +153,18 @@ export const AGGREGATE_FIELD_TYPE_COMPATIBILITY: Readonly<Record<AggregationFunc
  * both consumer legs call, so one pair cannot be accepted at authoring and
  * refused at compile time.
  *
- * Fail-closed on vocabulary: a value outside `AggregationFunction` or outside
- * `FieldType` answers `false`. The parameters are typed as `string` because
- * the lint leg judges metadata BEFORE it is parsed; that is a convenience of
- * the signature, not a tolerance — off-vocabulary input is refused, never
- * mapped.
+ * Fail-closed on vocabulary AND on shape: a value outside `AggregationFunction`
+ * or outside `FieldType` answers `false`, and so does anything that is not a
+ * string at all. The second half is load-bearing for a refusal gate: the lint
+ * leg judges metadata BEFORE it is parsed, so the value it hands in may be an
+ * array or an object, and a property-key lookup alone would coerce
+ * `['count']` or `{ toString: () => 'sum' }` to a member spelling and let the
+ * pair through. The `string` parameter types are a convenience of the
+ * signature, not a tolerance — off-vocabulary or off-shape input is refused,
+ * never mapped.
  */
 export function isAggregateCompatibleWithFieldType(aggregate: string, fieldType: string): boolean {
+  if (typeof aggregate !== 'string' || typeof fieldType !== 'string') return false;
   if (!Object.prototype.hasOwnProperty.call(AGGREGATE_FIELD_TYPE_COMPATIBILITY, aggregate)) return false;
   const row: readonly string[] = AGGREGATE_FIELD_TYPE_COMPATIBILITY[aggregate as AggregationFunction];
   return row.includes(fieldType);