finding: the list-query normalizer's `where` arity note still says a repeated `?filter=` is refused by `isFilterAST` failing

[hotlong]

Observation-class finding, split out of #7390 while implementing it. Unassigned, filed per Prime Directive #10. Comment-only drift — no runtime behaviour is wrong.

The sentence

packages/metadata-protocol/src/protocol.ts, in the docblock above ARRAY_VALUED_QUERY_SLOTS (the #7321 arity survey), the where row reads:

where — a FILTER AST is an array (['status','=','open']), so a blanket arity refusal here would reject the AST body form outright. A repeated ?filter= is still refused, one block down, by isFilterAST failing to read it.

The first sentence is correct and load-bearing — it is exactly why #7386's arity gate skips this slot, and #7390 quotes the same reasoning.

The last sentence has two problems, one of them older than #7390:

1. It was always describing the defect as if it were the answer. isFilterAST failing produces malformedFilterArrayError — a 400 telling a caller whose filters were each well-formed that their filter is malformed, listing the AST operator vocabulary. That is finding: a repeated ?filter= on GET /data/:object cannot be told from a filter AST, so it is diagnosed as a malformed filter (and, rarely, succeeds) #7390's entire finding: the refusal is correct, the diagnosis is not. "Still refused" reads as handled.
2. It is now stale for the route it describes. finding: a repeated ?filter= on GET /data/:object cannot be told from a filter AST, so it is diagnosed as a malformed filter (and, rarely, succeeds) #7390 moves the arity judgement for this slot to the REST querystring ingress (packages/rest, assertFilterParamSuppliedOnce), which is the only layer that can make it — on a querystring an array is a repetition and can be nothing else. A repeated ?filter= on GET /data/:object no longer reaches this block at all.

It also does not mention the second shape at all: ?filter=status&filter=%3D&filter=open spelled a valid AST and succeeded with a filter nobody expressed, which is the sharper half of #7390.

Why it matters more than a typo

This docblock is the survey a future author reads to decide whether a slot needs arity treatment. A reader who takes "still refused, one block down" at face value concludes the filter slot is covered and stops — which is roughly how the gap survived from #7321 to #7390. The sentence should say that arity for this slot is judged at the querystring ingress and name #7390, so the next reader is told which layer owns it.

Deliberately not fixed in #7390's PR: that card's ruling put the enforcement in packages/rest and explicitly kept it out of packages/metadata-protocol, and protocol.ts is a hot shared file. Same handling as #7707 / #7874, which corrected stale comments in their own PRs.

Dedup

Searched open issues for ARRAY_VALUED_QUERY_SLOTS, isFilterAST, malformedFilterArrayError, stale comment, and arity survey. Hits: #7390 (the parent), #7321 / #7386 (the arity gate, both closed) — none covers this comment.

---

Generated by Claude Code

[hotlong]

Triage (findings round): promoted finding → pm:queue, routed domain:metadata (the docblock lives in packages/metadata-protocol/src/protocol.ts), type Task, documentation.

Grading rationale: comment-only, but load-bearing comment — this docblock is the arity survey a future author reads to decide whether a slot needs treatment, and "still refused, one block down" reading as handled is exactly how the #7321→#7390 gap survived. Cheap, concrete, single-file. Scope: rewrite the where row to say arity for this slot is judged at the REST querystring ingress (assertFilterParamSuppliedOnce, #7390), name the succeeded-with-a-filter-nobody-expressed shape, and drop the stale "isFilterAST failing" claim. Docs-only → skip-changeset.

Serial note for the dispatching seat: protocol.ts is a hot shared file and #8136 (queued this round) sweeps the same file's producer messages — these two must not be in flight together; fold this docblock fix into #8136's PR as a declared rider, or run it strictly after. Preference: fold as rider, one PR touching the hot file once.

Size/model suggestion: S-mechanical, sonnet (or absorbed into #8136's M/opus dispatch).

---

Generated by Claude Code