save-time parser is more permissive than the runtime parser?

Hi, I would not necessarily interpret this as the save-time parser being more permissive. It may be a difference between compile-time validation and runtime execution.

The rule editor can validate the rule syntax and some static logic successfully, while the detection pane may show an error that happened during live rule execution, testing, or retrohunt. Those runtime errors may not be visible at save time because they depend on the actual data, execution window, joins, aggregations, repeated fields, or other runtime conditions.