finding: driver-mongodb still lowers `array_agg` / `string_agg` — retired from `AggregationFunction` at #6188, refused by both SQL faces

[os-zhuang]

Found while fixing #12818 in the same function (buildAccumulator). Filed unassigned, not fixed — that dispatch scoped the work to the default arm, and this is a second accept-face narrowing with its own changeset and its own argument.

What was read

packages/drivers/driver-mongodb/src/mongodb-aggregation.ts, buildAccumulator, carries two arms for names the Query Protocol no longer declares:

case 'array_agg':
 return { $push: fieldRef ?? '$$ROOT' };

case 'string_agg':
 // Collect into array; caller can post-process with $reduce
 return { $push: fieldRef ?? '' };

and postProcessAggregation carries the matching string_agg join.

AggregationFunction (packages/spec/src/data/query.zod.ts) declares six values — count, sum, avg, min, max, count_distinct. array_agg and string_agg were removed at #6188 under ADR-0049 enforce-or-remove, and the enum's own error map hands each a retirement prescription. packages/spec/src/data/query.test.ts pins the six.

The divergence

Both SQL faces already treat these two as class-1 undeclared names and refuse them with INVALID_QUERY / 400:

• driver-sql: array_agg and string_agg are in the UNDECLARED roster of sql-driver-out-of-contract-aggregate-function.test.ts, whose comment records that they moved there from class 2 at [spec] AggregationFunction 声明 8 个,SQL 族只实现 5 个 —— count_distinct / array_agg / string_agg 按 ADR-0049 enforce-or-remove 定去留 #6188;
• driver-turso's remote-transport.ts carries the same note verbatim.

driver-mongodb is the only face that still answers them. So one query gets a 400 on two backends and a $push array on the third — the local/remote fork #5907 exists to prevent, one vocabulary later.

Measured, without a server (mongodb-pipeline-evaluator.testkit.ts over AGGREGATION_ROWS): { function: 'array_agg', field: 'score' } answers [10, 20, 30, 40, 50, 60], and string_agg the same array before postProcessAggregation joins it. Both are pinned as current behaviour by mongodb-unrecognised-aggregate-function.test.ts (the "recorded, not fixed" block) so this divergence cannot be mistaken for an oversight in that file, and so whichever way it is decided, the pin moves deliberately.

Why it is worth a card rather than a silent cleanup

Reachability is the part that needs deciding rather than assuming. AggregationNodeSchema.function is the enum, so the protocol door rejects both spellings before they reach any driver; what can still reach buildAggregationPipeline is a direct caller of this exported builder, or the driver's own aggregate, which reads its aggregations through (query as any).aggregations. That is the same population #12818's refusal was written for.

Dispositions, for triage:

• (a) delete both arms and let them fall to finding: driver-mongodb answers an unrecognised aggregate function as a silent SUM instead of refusing it #12818's class-1 refusal (400), matching both SQL faces. It also falsifies the converts string_agg arrays to joined strings case in mongodb-aggregation.test.ts, which would be INVERTED in place (asserting the refusal) rather than re-baselined, and postProcessAggregation's string_agg limb would go with them.
• (b) keep them as a deliberate mongodb-only extension, and say so in the code — at which point the "one condition, one wording" parity note in driver-sql should record the exception.

(a) is the ADR-0049 direction and the one I would take, but it removes something a caller could be using today, so it is a vocabulary decision rather than a repair.

What was NOT established

• Not executed against a live mongod. This fleet cannot run one (no daemon, no image path; mongodb-memory-server's download is refused by the egress proxy — driver-mongodb 测试:两个套件并发下载 MongoDB 二进制,mongodb-memory-server 的 rename 竞态让全绿测试 exit 1(队列 flaky) #5517). Every value above comes from the in-process evaluator, which models the manual rather than observing a server.
• Whether any caller writes either spelling. Not swept across examples/, the dataset compiler, or service-analytics.
• Not swept across the other faces for the reverse direction — whether driver-memory's analytics face also lowers more than the enum declares was not measured here.

Related: #12818 (the default arm, being fixed now), #6188 (the retirement), #7052 (the same interface's distinct?: boolean leftover after the same class of spec retirement — closed), #5907 (the two-class refusal these faces share).

[os-zhuang]

Triage — bug · priority:p2 · domain:engine · pm:queue

Graded by the domain:engine PM seat (#6367).

bug, not enhancement. One query answers 400 on two backends and a $push array on the third. That is the local/remote fork #5907 exists to prevent, reappearing one vocabulary later — a correctness divergence, not a missing feature.

p2. The protocol door (AggregationNodeSchema.function) rejects both spellings before any driver sees them, so the reachable population is narrow: a direct caller of the exported builder, or the driver's own aggregate reading through (query as any).aggregations. Real, and exactly the population #12818's refusal was written for — but not a production path a tenant reaches.

pm:queue, and the first deliverable is decision-free. The card names its own gap: "Whether any caller writes either spelling — not swept across examples/, the dataset compiler, or service-analytics." ⇒ Sweep first, decide second. If the sweep finds zero live callers, (a) is a cleanup with measured blast radius rather than a vocabulary bet, and most of the decision dissolves. If it finds callers, the disposition is the maintainer's and the sweep is what they need to rule on.

⚠️ Clause-② is CONDITIONAL here — do not pre-attach, do not discover it late

• (a) delete both arms ⇒ the accept face narrows ⇒ Clause-② fires, needs:contract-review must be attached at dispatch, and ⛔ the card cannot be enqueued below CONTRACT_REVIEW_TIER.
• (b) keep them as a deliberate mongodb-only extension, recorded in code ⇒ nothing about accept/reject moves ⇒ Clause-② does not fire.

The label is deliberately not attached now: a gate that turns out not to apply is its own defect, and whoever takes the card knows which branch they are on before they write a line.

What must not happen to the pins

If (a) is taken, mongodb-aggregation.test.ts's converts string_agg arrays to joined strings case is falsified, and postProcessAggregation's string_agg limb goes with the arms. ⛔ Invert that case in place with a comment naming this card — never re-baseline it, and never delete it quietly. The card already anticipates this, which is why the two arms were pinned as current behaviour in mongodb-unrecognised-aggregate-function.test.ts rather than left unasserted: whichever way this goes, the pin moves deliberately.

⭐ Credit, because this is the behaviour that makes findings cheap

Found while fixing #12818 in the same function, and filed rather than folded in — correctly: it is a second accept-face narrowing with its own changeset and its own argument, and the dispatch had scoped that work to the default arm. Both arms were kept byte-identically working so this card inherits a clean starting state.

⚠️ Its own limits are stated rather than papered over: no live mongod in this fleet (the mongodb-memory-server download is refused by the egress proxy, #5517), so every value comes from the in-process evaluator modelling the manual, and the reverse direction — whether driver-memory's analytics face also lowers more than the enum declares — is named as unmeasured rather than assumed clean.

Related

The drift bot on PR #13076 independently listed five hand-written pages anchored on the literals array_agg / string_agg / count_distinct. ⚠️ Worth a look when this card is taken: if those pages present array_agg/string_agg as available vocabulary, they are documenting names retired at #6188, and this card's disposition decides what they should say.

---

Generated by Claude Code

[os-zhuang]

认领并派发 — pm:queue → pm:dispatched

PM seat #6367 · session session_01LZbWd2jNV1FErXTPSS4Dry · dev branch claude/issue-13075-mongodb-retired-agg-arms

⛔ 认领前已重读本卡评论线（1 条，为本席自己的分诊 5460003884）：无更早的认领，assignee 为空。这是本席的认领，不是覆盖他人的。

Container & model

执行档位 claude-fable-5。理由：本卡处置 (a)（删除两臂）收窄 accept face ⇒ 条款② 按卡片内容触发，而 gate 的单一来源写着 CONTRACT_REVIEW_TIER = 'claude-fable-5'（scripts/pm/dispatch-gates.mjs:3813，本轮现读）。卡片正文自陈 "(a) is the ADR-0049 direction and the one I would take" ⇒ ⚠️ 按最可能落地的分支预置档位，而不是等分支确定后再补，免得「gate 迟发现」。

⚠️ 配额读数（get_session，本轮现读）：rate_limit_info.status = allowed_warning、isUsingOverage = false、七日窗。⇒ 尚未触发「proactive low-headroom downgrade」退出，但读数记录在此，若本轮触顶，降到 opus 执行是有据的退出而非临时决定。

派发范围 —— ⭐ 先扫掠，后处置

第一交付物是无需裁决的，正是本卡自陈的缺口："Whether any caller writes either spelling — not swept across examples/, the dataset compiler, or service-analytics."

⇒ dev 的第一步是把 array_agg / string_agg 的调用者扫掠做实（含 examples/、dataset compiler、service-analytics，以及卡片点名未测的反向：driver-memory 的 analytics face 是否也 lower 了超出 enum 的名字）。扫掠结论决定 (a) 还是停下来上报。

⛔ 围栏

• pin 只能就地反转，绝不 re-baseline。 若取 (a)，mongodb-aggregation.test.ts 的 converts string_agg arrays to joined strings 被证伪 ⇒ 就地反转为断言拒绝，并在注释里点名本卡；⛔ 不得静默删除。mongodb-unrecognised-aggregate-function.test.ts 里那两臂的 "recorded, not fixed" pin 同理，⛔ 必须有意地移动。
• 无 live mongod。 本 fleet 跑不了（mongodb-memory-server 下载被 egress proxy 拒，driver-mongodb 测试:两个套件并发下载 MongoDB 二进制,mongodb-memory-server 的 rename 竞态让全绿测试 exit 1(队列 flaky) #5517）⇒ 一切读数来自 in-process evaluator（mongodb-pipeline-evaluator.testkit.ts），它建模手册而非观测服务器。⛔ 不得把 evaluator 读数写成「已对服务器验证」。
• packages/drivers/driver-sql/src/sql-driver.ts 是本车道的热文件，且⛔ 没有任何 CI gate 护它。 本卡若走 (b) 会去动 driver-sql 的 parity note ⇒ 动它之前先回报，由本席排序；走 (a) 则不应触及该文件。
• ⚠️ 若扫掠发现活体调用者，⛔ 处置权是维护者的，不是 dev 的 ⇒ 停下来上报，把扫掠本身作为交付物。
• 相关：PR fix(driver-mongodb): refuse an unrecognised aggregate function instead of answering it as a silent SUM #13076 的 drift bot 曾就字面量 array_agg / string_agg / count_distinct 列出五个手写页面 ⇒ 若那些页面把这两个名字当可用词汇呈现，它们记录的是 [spec] AggregationFunction 声明 8 个,SQL 族只实现 5 个 —— count_distinct / array_agg / string_agg 按 ADR-0049 enforce-or-remove 定去留 #6188 已退休的名字，本卡的处置决定它们该怎么写。

落地归属

⛔ 落地（flip ready → arm auto-merge → 验证合并）是 PM 的，不是 dev 的。dev 交付到 draft PR 为止。

---

Generated by Claude Code

[os-zhuang]

Container & model 更正 —— 触发已测配额豁免：fable 不可用 ⇒ opus

补记本卡认领评论（5460486503）里 Container & model 一行的实际结果。⛔ 记录而非事后重写：那一行当时写的是 claude-fable-5，它没有兑现。

读数

按 claude-fable-5 派发，子代理开跑即终止：

HTTP 429 · error type rate_limit
"You've reached your Fable 5 limit. Switch to another model, or manage
 usage credits at claude.ai/settings/usage, to continue."
model sent to the API: claude-fable-5

⇒ ⭐ 这是实测，不是推测：请求发出去了，429 是服务端答的。与本席认领时记下的 rate_limit_info.status = allowed_warning 一致 —— 那条警告现在兑现成了硬墙。

依据的退出

scripts/pm/dispatch-gates.mjs 的 tierLines() 逐字列出三个退出，其中之一正是本情形：

the measured quota exemption (fable unavailable ⇒ opus, never lower)

⇒ 已按此重新派发至 claude-opus-5。⛔ never lower 是硬的：不降到 sonnet，也不降到 haiku。

⚠️ 该退出要求「recorded with its reason in the claim comment's Container & model line」—— 本评论即是该记录，与认领评论同线可读。

⛔ 这不是契约复审的清标依据

两件事必须分开，否则就成了「用配额豁免换掉一道门」：

• 执行档位：fable → opus，已测豁免，✅ 成立。
• 契约复审档位：⛔ 纹丝不动。本卡处置 (a) 若触发条款②，needs:contract-review 照旧要挂，且照旧要达档席位才能清 —— 而 CONTRACT_REVIEW_TIER = claude-fable-5 恰恰是刚刚测得不可用的那个档位。

⇒ ⚠️ 顺带测出一件事，值得记下：复审门与执行门共用同一个配额。fable 配额耗尽时，条款② 卡片不只是「派不到 fable 执行」，而是复审侧同样无人可达 —— PR #13076 已经在那道门后停着，本卡若走 (a) 会是第二张。这不是本卡的问题，但它把「复审容量是稀缺项」从判断变成了读数。

---

Generated by Claude Code