chore(#5322): 收官同步 —— filter.zod 空组合子宣告转正、#5366 refusal 表随裁定翻向

- filter.zod.ts:按 #5323 同步散文预留的交接("The declaration flips to
  stated contract with that PR"),空组合子单位元从「Deliberately NOT
  declared」段转为正式契约段;{field:{}} 半边保持未宣告(#5376 仍开)。
- filter-refusal-envelope.test.ts(#5366 新到):空数组两行从 REFUSALS 翻入
  ACCEPTED(单位元树断言),同一守卫点的非数组拼写补位 REFUSALS,信封不变。
- filter-logic-conformance.ts:族 1 段落按分工删除(四行已进表),族 2/3 原样。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ErbEDVAg1No9gdg1pgDAGB

Author: claude

packages/services/service-analytics/src/__tests__/filter-refusal-envelope.test.ts

@@ -85,16 +85,22 @@ const REFUSALS: Array<{ name: string; where: unknown; message: RegExp; issueBull
     message: /needs a two-element \[min, max\] array/,
     issueBullet: true,
   },
+  // FLIPPED with the #5322 ruling: these two entries were "$and/$or with an
+  // empty array". The refusing SITE is unchanged (the combinator guard #5352's
+  // body bulleted, hence issueBullet stays true) but its empty-array half
+  // graduated to a boolean identity — `{$and: []}` = TRUE, `{$or: []}` = FALSE,
+  // asserted in ACCEPTED below — so the site's remaining refusal is the
+  // non-array spelling, still carrying the same envelope.
   {
-    name: '$and with an empty array',
-    where: { $and: [] },
-    message: /"\$and" requires a non-empty array/,
+    name: '$and that is not an array',
+    where: { $and: 'won' },
+    message: /"\$and" requires an array of filter objects/,
     issueBullet: true,
   },
   {
-    name: '$or with an empty array',
-    where: { $or: [] },
-    message: /"\$or" requires a non-empty array/,
+    name: '$or that is not an array',
+    where: { $or: { stage: 'won' } },
+    message: /"\$or" requires an array of filter objects/,
     issueBullet: true,
   },
   {
@@ -176,6 +182,20 @@ const ACCEPTED: Array<{ name: string; where: unknown; tree: unknown }> = [
     where: {},
     tree: null,
   },
+  {
+    // #5322: the AND identity — a conjunction of zero conditions constrains
+    // nothing. Was in REFUSALS ("requires a non-empty array") until the ruling.
+    name: 'an empty $and as TRUE (#5322)',
+    where: { $and: [] },
+    tree: null,
+  },
+  {
+    // #5322: the OR identity — a disjunction of zero conditions matches
+    // nothing. Fail-closed for a scope whose disjunct list looped to zero items.
+    name: 'an empty $or as the FALSE constant (#5322)',
+    where: { $or: [] },
+    tree: { kind: 'const', value: false },
+  },
   {
     // #5334: `[]` is "no filter", not a failed filter.
     name: 'an empty `where` array as "no filter" (#5334)',

packages/spec/src/data/filter.zod.ts

@@ -289,22 +289,33 @@ export type FilterCondition = {
  * Directive #10, and this sentence is kept as the record that the tracking
  * worked.
  *
+ * ## Empty combinators are boolean identities (#5322, maintainer ruling 2026-08-04)
+ *
+ * `{ $and: [] }` is TRUE — the AND identity, no constraint. `{ $or: [] }` is
+ * FALSE — the OR identity, zero rows. A `{}` disjunct is TRUE and ABSORBS its
+ * `$or`; `{ $not: {} }` is `NOT TRUE` — FALSE. The ruling took the reduction
+ * over the analytics compilers' fail-closed throw for two reasons: only a
+ * reduction can evaluate a NESTED tree (a rejection must first reduce to
+ * judge an empty combinator sitting inside a `$or` branch, which concedes the
+ * point), and `{ $or: [] }` = zero rows is fail-closed exactly where it
+ * matters — an RLS scope whose disjunct list loops to zero items hides every
+ * row instead of exposing the table (#5134). An earlier revision of this
+ * paragraph kept the identities OUT of the contract because two compilers
+ * still refused them; that gap closed with PR #5365 (both
+ * `service-analytics` compilers reduce, and the four cases are enrolled in
+ * `filter-logic-conformance.ts` against every backend — the five drivers
+ * already reduced: `driver-sql` #5243, `driver-mongodb` #5323). Loud
+ * AUTHORING-time rejection of the literal spellings is a separate, optional
+ * lint concern (#5330), not a runtime semantic.
+ *
  * ## Deliberately NOT declared here
  *
- * The boolean identities of the EMPTY combinators (`{ $and: [] }` = TRUE,
- * `{ $or: [] }` = FALSE, `{ $not: {} }` = FALSE) are RULED — #5322
- * (maintainer, 2026-08-04) took the identity over the analytics compilers'
- * fail-closed throw — but not yet stated here as contract: on main today
- * `read-scope-sql` and `filter-normalizer` still refuse an empty `$and`/`$or`,
- * and the ruling's implementation PR #5365 (aligns both compilers, enrolls the
- * four cases in `FILTER_LOGIC_CASES`) is sequenced to land after this one. The
- * declaration flips to stated contract with that PR, not here — declaring it
- * first would out-run enforcement. Likewise `{ field: {} }` (a field
- * constrained by zero operators): #5240 ruled it REJECTED and #5327 gated
- * driver-sql / driver-sqlite-wasm / driver-memory / formula; `driver-mongodb`
- * still answers it (tracked by #5376), and the schema-side narrowing stays
- * with the spec lane. Declaring either before it is enforced everywhere would
- * be exactly the `declared ≠ enforced` shape this file exists to prevent.
+ * `{ field: {} }` (a field constrained by zero operators): #5240 ruled it
+ * REJECTED and #5327 gated driver-sql / driver-sqlite-wasm / driver-memory /
+ * formula; `driver-mongodb` still answers it (tracked by #5376), and the
+ * schema-side narrowing stays with the spec lane. Declaring it before it is
+ * enforced everywhere would be exactly the `declared ≠ enforced` shape this
+ * file exists to prevent.
  */
 export const FilterConditionSchema: z.ZodType<FilterCondition, FilterCondition> = z.lazy(() =>
   z.record(z.string(), z.unknown()).and(