#444

backend/app/services/counts_table_query.rb

@@ -220,9 +220,8 @@ class CountsTableQuery
 
   private
 
-  # Summary predicates are evaluated against public coordinates or the masked
-  # value by CountsPopulation. Never accept a private server-only coordinate in
-  # user-supplied ordering/measure state.
+  # Private predicates require visibility independently of their operator.
+  # Ordering/measure state must not select a server-only masked coordinate.
   def validate_summary_conditions!
     return if mode != 'summary' || HistoryAccess.admin?