test(objectql): pin the two vacuous-filter carve-outs nothing held (#4121, #4181) (#4231)

`?filter=` with an empty value must mean "no filter", not "an invalid one".
Four shapes express that; only `{}` and `''` were pinned. `[]` (which #4121
exempts explicitly) and `'   '` (which #4181 blanks via .trim(), never
exercised — only `''` was tested) were decisions stated in a comment and held
by nothing, each one line from a rejection: #4121's array branch guards on
`length > 0`, #4181's blank guard calls `.trim()`. This family has moved from
tolerate to reject five times, so the next tightening would silently turn "I
sent no filter" into a 400.

Mutation-checked: dropping `length > 0` fails 1 case, replacing
`.trim() === ''` with `=== ''` fails 2.

This branch originally carried a full query-expression conformance suite;
#4240 landed the sort/select/expand half independently under the same filename
while it waited, which both conflicted and made its KNOWN GAP pins assert
behavior that no longer exists. Only the part #4240 does not cover is kept.

Author: os-zhuang

.changeset/vacuous-filter-carveouts.md

@@ -0,0 +1,6 @@
+---
+---
+
+test(objectql): pin the two vacuous-filter carve-outs (#4121, #4181)
+
+Test-only; no package behavior changes, so this changeset releases nothing.

packages/objectql/src/protocol-data.test.ts

@@ -832,6 +832,32 @@ describe('ObjectStackProtocolImplementation - Data Operations', () => {
             expect(engine.find.mock.calls[1][1].where).toEqual({ owner_id: 'usr_1' });
         });
 
+        it('every OTHER vacuous filter shape means "absent" too — the two deliberate carve-outs nothing pinned', async () => {
+            // Both of these are decisions the code states in a comment and no
+            // test held. They sit one line away from a rejection, so a future
+            // tightening of the surrounding guard would silently turn "no
+            // filter" into a 400 for callers who send an empty one:
+            //
+            //   []     — #4121 rejects an array `isFilterAST` refuses, but
+            //            deliberately exempts the EMPTY array ("it means no
+            //            filter, and every path already treats it that way").
+            //   '   '  — #4181 rejects an unparseable filter STRING via
+            //            JSON.parse, but blanks it first with `.trim()`, so a
+            //            whitespace-only filter is absent rather than invalid.
+            //            Only `''` was covered; `'   '` never exercised trim().
+            const { protocol, engine } = makeProtocol();
+            for (const filter of [[], '   ']) {
+                await protocol.findData({
+                    object: 'showcase_task',
+                    query: { filter, owner_id: 'usr_1' },
+                });
+            }
+            for (const call of engine.find.mock.calls) {
+                expect(call[1].where).toEqual({ owner_id: 'usr_1' });
+            }
+            expect(engine.find).toHaveBeenCalledTimes(2);
+        });
+
         it('count() sees the merged where — pagination totals cannot disagree with records (#4164)', async () => {
             const { protocol, engine } = makeProtocol();
             await protocol.findData({