@@ -27,6 +27,14 @@ updates:
       # failing on an impossible update; the alerts stay visible in the
       # security tab. The real fix is lifting the cap upstream in vgi-rpc.
       - dependency-name: "aiohttp"
+      # The filter evaluator implements vgi.duckdb.standard.v1, pinned to
+      # DuckDB 1.5.5 / Haybarn 1.5.5-rc1 (vgi/filter_v2.py
+      # STANDARD_V1_ENGINE_VERSIONS); any other engine build refuses every
+      # pushed-down filter. Bumping them is a deliberate profile decision, not
+      # a routine update: locking duckdb 1.5.6 broke filter pushdown in the
+      # vgi integration suite.
+      - dependency-name: "duckdb"
+      - dependency-name: "haybarn"
 
   # GitHub Actions used by the workflows in .github/workflows/.
   - package-ecosystem: "github-actions"
 
@@ -49,8 +49,14 @@ dependencies = [
 # evaluation, the transactor, and the statistics fixtures. It is resolved
 # lazily in vgi/_duckdb.py: haybarn is preferred, stock duckdb is the
 # fallback. Neither is a hard dependency — install one via these extras.
-haybarn = ["haybarn>=1.5.5rc1"]
-duckdb = ["duckdb>=1.5.3"]
+# Both are pinned EXACTLY: expression-filter evaluation implements
+# vgi.duckdb.standard.v1, whose oracle is upstream DuckDB 1.5.5 (Haybarn
+# 1.5.5-rc1), and vgi/filter_v2.py refuses any other engine build
+# (STANDARD_V1_ENGINE_VERSIONS). A looser range lets a resolver pick e.g.
+# duckdb 1.5.6, and every pushed-down filter then fails to bind. Change these
+# only together with STANDARD_V1_ENGINE_VERSIONS (a test keeps them in step).
+haybarn = ["haybarn==1.5.5rc1"]
+duckdb = ["duckdb==1.5.5"]
 http = ["vgi-rpc[http]"]
 iroh = ["vgi-rpc[http,iroh]"]
 # transport="launch": vgi_rpc.launcher imports filelock unconditionally at
@@ -84,7 +90,7 @@ test-fixtures-writable = [
     "vgi-python[transactor]",
 ]
 dev = [
-    "duckdb>=1.5.3",
+    "duckdb==1.5.5",  # pinned with the `duckdb` extra above
     "mypy",
     "pyarrow-stubs",
     # pydoclint is intentionally NOT a project dependency: it pulls
 
@@ -696,3 +696,74 @@ def test_an_unrenderable_filter_raises_rather_than_vanishing() -> None:
 
     with pytest.raises(FilterSQLUnsupportedError, match="no SQL rendering"):
         filters.to_sql()
+
+
+def test_engine_pins_match_standard_v1_oracle() -> None:
+    """The duckdb/haybarn extras pin exactly the builds the evaluator accepts.
+
+    A looser range let a lock bump resolve duckdb 1.5.6, which the evaluator
+    (correctly) refuses, so every pushed-down filter failed to bind.
+    """
+    import pathlib
+    import re
+    import tomllib
+
+    from vgi.filter_v2 import STANDARD_V1_ENGINE_VERSIONS
+
+    pyproject = tomllib.loads((pathlib.Path(__file__).parents[1] / "pyproject.toml").read_text())
+    extras = pyproject["project"]["optional-dependencies"]
+    for engine in ("duckdb", "haybarn"):
+        specs = [spec for spec in extras[engine] if re.match(rf"{engine}\b", spec)]
+        assert len(specs) == 1, specs
+        match = re.fullmatch(rf"{engine}==(\S+)", specs[0].replace(" ", ""))
+        assert match, f"{engine} extra must pin an exact version, got {specs[0]!r}"
+        assert match.group(1) in STANDARD_V1_ENGINE_VERSIONS[engine]
+    dev_duckdb = [spec for spec in extras["dev"] if re.match(r"duckdb\b", spec)]
+    assert [spec.replace(" ", "") for spec in dev_duckdb] == list(extras["duckdb"])
+
+
+@pytest.mark.parametrize(
+    ("engine", "version", "accepted"),
+    [
+        ("duckdb", "1.5.5", True),
+        ("haybarn", "1.5.5rc1", True),
+        ("duckdb", "1.5.6", False),
+        ("duckdb", "1.5.4", False),
+        ("haybarn", "1.5.6rc1", False),
+    ],
+)
+def test_standard_v1_evaluator_requires_oracle_engine(
+    monkeypatch: pytest.MonkeyPatch, engine: str, version: str, accepted: bool
+) -> None:
+    """Only the pinned oracle builds may evaluate ``vgi.duckdb.standard.v1``."""
+    import re
+    import threading
+    import types
+
+    import vgi._duckdb
+    from vgi import filter_v2
+
+    opened: list[object] = []
+
+    class _Connection:
+        def execute(self, *_args: object) -> None:
+            return None
+
+    fake = types.ModuleType(engine)
+    fake.__version__ = version  # type: ignore[attr-defined]
+    monkeypatch.setattr(vgi._duckdb, "engine_module", lambda: fake)
+
+    def _connect(**_kw: object) -> _Connection:
+        opened.append(1)
+        return _Connection()
+
+    monkeypatch.setattr(vgi._duckdb, "connect", _connect)
+    monkeypatch.setattr(filter_v2, "_evaluation_local", threading.local())
+    context = filter_v2.EvaluationContext(profile=filter_v2.NO_EVALUATION_CONTEXT)
+    if accepted:
+        filter_v2._get_evaluation_connection(context)
+        assert opened == [1]
+    else:
+        with pytest.raises(filter_v2.FilterV2Error, match=f"found {engine} {re.escape(version)}"):
+            filter_v2._get_evaluation_connection(context)
+        assert opened == []
@@ -23,6 +23,21 @@
 NO_EVALUATION_CONTEXT = "vgi.none.v1"
 DUCKDB_SESSION_CONTEXT = "vgi.duckdb.session.v1"
 
+#: Engine builds whose observable SQL behavior *is* the ``vgi.duckdb.standard.v1``
+#: oracle, by distribution name -> exact ``__version__`` strings. The profile is
+#: pinned to upstream DuckDB v1.5.5 (Haybarn v1.5.5-rc1 is its reference
+#: distribution) and is "not a reference to the moving 1.5.x release family"
+#: (vgi-filter-encoding-v2-spec.md section 6). A later patch release is not
+#: added here merely because the conformance corpus passes: DuckDB 1.5.6, for
+#: one, ships newer time-zone data (2026c/2026d) and changes integer-literal and
+#: printf behavior, so it is not the oracle. The ``duckdb``/``haybarn`` extras in
+#: pyproject.toml pin exactly these versions; tests/test_filter_v2.py keeps the
+#: two in step.
+STANDARD_V1_ENGINE_VERSIONS: dict[str, frozenset[str]] = {
+    "duckdb": frozenset({"1.5.5"}),
+    "haybarn": frozenset({"1.5.5rc1", "1.5.5-rc1"}),
+}
+
 MAX_JSON_BYTES = 1 << 20
 MAX_DEPTH = 64
 MAX_NODES = 10_000
@@ -1168,11 +1183,7 @@ def _get_evaluation_connection(context: EvaluationContext) -> Any:
         engine = engine_module()
         engine_name = engine.__name__.split(".", 1)[0]
         engine_version = str(getattr(engine, "__version__", ""))
-        accepted_versions = {
-            "duckdb": {"1.5.5"},
-            "haybarn": {"1.5.5rc1", "1.5.5-rc1"},
-        }
-        if engine_version not in accepted_versions.get(engine_name, set()):
+        if engine_version not in STANDARD_V1_ENGINE_VERSIONS.get(engine_name, frozenset()):
             raise FilterV2Error(
                 f"{DUCKDB_STANDARD_V1} requires DuckDB 1.5.5 or Haybarn 1.5.5-rc1; "
                 f"found {engine_name} {engine_version or '<unknown>'}"