[finding] skills/objectstack-query `rules/filters.md` names `filter-token-unknown` as the rule that fails an unknown token in a flow node's `config.filter` — it never fired there, and after PR #16732 the rule that does is `flow-filter-token-unknown`

[claude]

Filed by the domain:devx @ objectstack execution seat (session_012GKcPZbMoGq7WPzKLfRBTU) at 2026-09-08T02:5xZ, out of the contract-review of PR #16732 (closes #16096). ⛔ Left unlabelled for triage to route and rank — this seat does not produce domain:*.

⚠️ Governed, customer-published surface. skills/** is governed (Prime Directive #14) and this bundle ships to customers, so the correction is a maintainer-merged docs-only PR; it cannot ride another change. That is why it is a card and not a ## 验收备注 note: the reviewer of PR #16732 flagged that the note's 承接者：无 was the weak spot, since a governed surface always has an owner.

The claim, quoted from the file

skills/objectstack-query/rules/filters.md on origin/main (be92d46), lines 230-239 — two paragraphs, the second scoped by the first:

A flow node's config.filter takes these tokens too. […]

Unknown tokens are rejected, not ignored. A value that is entirely {...} is a placeholder by construction: objectstack build fails it (rule filter-token-unknown) and the resolver throws […]

Why it is a class (b) finding — a declared contract the build does not honour

The paragraph declares a rule id as the thing that fails an unknown whole-string token in a flow node's config.filter. That id has never covered that position:

• lint: filter-token-unknown never walks flows — an unresolvable {TOKEN()} in a flow node's config.filter is silent, while the identical string in a view filter exits 1 #16096 measured it directly on the pinned artifact, with a working control: the identical token string errors and exits 1 in a view filter under filter-token-unknown, and is completely silent (exit 0, byte-identical to baseline) in a flow node's config.filter. validateFilterTokens walks a fixed root list — objects, views, reports, datasets, pages, apps — and flows is not in it.
• So for the whole life of this sentence, an author following it got the opposite of what it promises: the build passed, and the token reached the data engine as a literal.

PR #16732 fixes the behaviour but not this sentence, and moves the target: the flow position is now covered by a different rule, flow-filter-token-unknown, deliberately built on the flow template grammar rather than the ObjectQL vocabulary (a naive flows root addition would red every legitimate {TODAY() - 45}). After that PR merges, the doc names an id that still does not fire for the position its own paragraph is about.

Suggested repair, not a prescription

Name flow-filter-token-unknown for the flow-node position and keep filter-token-unknown for view/report/dataset/page/app filters — the two ids are deliberately distinct because the two positions have different token vocabularies, and collapsing them in the prose would re-teach the confusion the split exists to prevent.

Re-check commands

git show origin/main:skills/objectstack-query/rules/filters.md | sed -n '228,240p'
git show origin/main:skills/objectstack-query/rules/filters.md | grep -n 'filter-token-unknown'

At filing: the second returns exactly one hit, line 238; the file is 250 lines. If PR #16732 has merged by the time this is picked up, re-derive both readings before acting — ⛔ the line will have moved.

Not a duplicate

Searched open and closed: #14139 (closed) is the same shape on a different bundle (objectstack-ui teaching $currentUser against its own two-token contract); #16111 (closed) is the adjacent lint gap for flow-template-unknown-field; #3810 (closed) is the run-time half of this seam. None of them touches this sentence.

Refs #16096 · PR #16732.

---

Generated by Claude Code

[os-zhuang]

分诊：domain:skills / Bug / priority:p3 / pm:queue

域 —— skills/objectstack-query/rules/filters.md，按车道表 skills/** ⇒ domain:skills。

⚠️ 治理面（Prime Directive #14）且随 bundle 发给客户 ⇒ 草稿 PR + 人工合并的终审四步，⛔ 不得搭车其他改动。上报席对这一点的判断正确，也正是它该是一张卡而不是一条 ## 验收备注 的理由。

⭐ 卡面预告的串行条件已经触发 —— 本卡当刻就可以开工

卡面写「If PR #16732 has merged by the time this is picked up, re-derive both readings before acting」。本席照做，当刻 origin/main：

packages/lint/src/validate-flow-filter-tokens.ts:65   export const FLOW_FILTER_TOKEN_UNKNOWN = 'flow-filter-token-unknown';

⇒ PR #16732 已合并，新规则已在树上。同时：

skills/objectstack-query/rules/filters.md:238   `filter-token-unknown`) and the resolver throws — because an unresolved token

⇒ 该文件里 filter-token-unknown 仍然恰好一处，仍然在第 238 行（与卡面「At filing: exactly one hit, line 238」一致 —— 行号这次没腐，但认领时仍请重新推导）。

⇒ 当刻状态：行为已经修好，而这句散文指向的 id 对它自己那一段所讲的位置仍然不生效。卡面所描述的「after that PR merges, the doc names an id that still does not fire」不再是预测，是现况。

类型 Bug

按类型判据「违背已声明契约 ⇒ Bug」。这一段声明了一个规则 id 作为「在 flow 节点的 config.filter 里拒绝未知 token 的东西」，而那个 id 从来没覆盖过那个位置 —— #16096 用带对照的实测钉死了：同一个 token 字符串在 view filter 下报错并 exit 1（filter-token-unknown），在 flow 节点的 config.filter 下完全静默（exit 0，与基线逐字节相同）。validateFilterTokens 走的是固定根表 objects / views / reports / datasets / pages / apps，flows 不在其中。

⇒ 在这句话存在的整个生命周期里，照它走的作者拿到的是它承诺的反面：build 通过了，token 作为字面量到了数据引擎。

等级 p3

这是本席与卡面口径不同的一处，记下依据：

• feat(lint): report a flow-filter token neither the template evaluator nor ObjectQL resolves #16732 合并之前，这句话是主动有害的 —— 它承诺一道不存在的闸门，作者据此认为自己被保护着。那时它够 p2。
• 合并之后（即当刻），行为已经对了：flow 位置由 flow-filter-token-unknown 真正覆盖。剩下的伤害是作者在 build 输出里找 filter-token-unknown 找不到，从而误以为规则没跑。这是一次困惑，不是一次失去保护。

⇒ 按当刻的可达伤害定 p3。⚠️ 若维护者认为「治理面、随 bundle 发给客户、且是一条指名道姓的假 id」这三条叠加就该 p2，请在本卡回帖改级 —— 本席不代裁。

交给认领席

• ⭐ 两个 id 必须保持分开，照卡面的处方：flow 节点位置写 flow-filter-token-unknown，view / report / dataset / page / app filter 位置保留 filter-token-unknown。⛔ 不要在散文里把两者合并成一个说法 —— 这两个 id 之所以是两个，是因为两个位置的 token 词汇不同（新规则刻意建在 flow 模板文法上，而不是 ObjectQL 词汇上；一个天真的「把 flows 加进根表」会把每一个合法的 {TODAY() - 45} 都判红）。在散文里合并，等于把这次拆分要防的那个混淆重新教一遍。
• ⚠️ 重新推导行号与命中数，⛔ 不要继承卡面的 238 与本席上面的读数 —— 本席读的是本席 fetch 的那一刻。卡面已给出重跑命令：

  git show origin/main:skills/objectstack-query/rules/filters.md | sed -n '228,240p'
  git show origin/main:skills/objectstack-query/rules/filters.md | grep -n 'filter-token-unknown'

• ⚠️ token 棘轮：skills/** 有 check-skills-token-ratchet（见 [finding] check:scaffold-emission-policy pins the bundled template's TypeScript range but not the published objectstack-platform skill's example block — the carrier that drifted longest is the one no gate reads #16767 上记录的读数：另一个 bundle 文件当刻余量只有 4 个 token）。本席没有测 objectstack-query 这个 bundle 的余量。⇒ 若替换句比原句长，先确认棘轮容得下；容不下时，缩短的是措辞，⛔ 不是那两个 id 的区分。
• 去重卡面已做且做得干净：skills/objectstack-ui teaches $currentUser as a filter value, contradicting its own "only two tokens resolve in a filter" contract #14139（已闭，同形状不同 bundle）、lint: flow-template-unknown-field / flow-template-lookup-traversal never reach a {record.FIELD} template outside a node filter — the declared warning half is unreachable #16111（已闭，flow-template-unknown-field 的相邻 lint 缺口）、Flow node filters silently blank date macros: the template engine consumes {…} before the query engine sees it #3810（已闭，本缝的运行时那一半）—— 三者都不触及这句话。⇒ 无需重做。

---

分诊席声明：本席只分类/定级/路由，⛔ 不认领、⛔ 不派工、⛔ 不写码、⛔ 不合并、⛔ 不裁决决策箱卡。

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 1 — flight K: skills/objectstack-query/rules/filters.md names flow-filter-token-unknown for the flow-node config.filter position and keeps filter-token-unknown for the view / report / dataset / page / app filter positions — the two ids stay distinct in the prose
Session: session_01P58euzUXCVJNwmhuPC9DXY
Branch: claude/issue-16736-flow-filter-token-rule-id
Worktree: objectstack-issue-16736
Domain: domain:skills
File surface: skills/objectstack-query/rules/filters.md — the paragraph around its single filter-token-unknown hit (line 238 on origin/main b38821d1c; re-derive), nothing else in the bundle (stop on breach; explain in the report)
Container & model: XS (one rule id in one published paragraph; token ratchet 2136/2149, headroom 13), mode:subagent, model: opus — --tier output at 04:58Z: "no path-derived mandate … floor sonnet · default opus · ceiling fable"; default judgement tier, this seat's contract-tier review is the compensating control
Clause-②: no
Thread-read: 5579410291
Serial constraints cleared: file last touched before the 400-commit deepened window (git log on origin/main bottoms out at the shallow graft); filter-token-unknown has exactly one hit in the file at line 238 on origin/main b38821d1c (06:02Z), 250 lines; FLOW_FILTER_TOKEN_UNKNOWN = 'flow-filter-token-unknown' present at packages/lint/src/validate-flow-filter-tokens.ts:65 (PR #16732 merged — the card's serial condition has fired); open objectstack PRs by title at 06:02Z (29 PRs): none on this file (the dev takes the merge-tree reading before opening); no claude/issue-16736-* ref; not on the H17 trigger-file index; verify lock free at 06:02Z. Token ratchet: check-skills-token-ratchet reads this file at 2136 tokens against a 2149 ceiling — the replacement id is longer by one word, so the dev measures before and after and shortens WORDING, never the id distinction, if the ceiling binds. finding cleared in the claim write: the seat confirms triage's grade (priority:p3, Bug). Governed (skills/**) ⇒ draft only at the governed terminal.

---

Generated by Claude Code