[finding] `ttl.onlyWhen`'s `{$null: true}` is pinned COMPILE-ONLY on pg/mysql while a live-cell testkit exists — measured live by hand, holds on both

[os-elon]

Filed unassigned by the dev on #7826 (draft PR #10633) as an out-of-scope observation. Nothing is broken — the live measurement below passes on both servers. This records a coverage shape, with the numbers, so the measurement is not lost.

What is pinned today

packages/drivers/driver-sql/src/sql-driver-ttl-onlywhen-null-dialects.test.ts (landed by #10344 for #10165) measures the Reaper-shaped where
{ expires_at: { $lt: cutoff }, revoked_at: { $null: true } } across three dialects, but not at the same depth:

dialect	what the suite proves
sqlite (better-sqlite3)	live: find + count really return ['expired'], tombstone excluded, unfiltered counter-face returns both
pg	compile-only — new SqlDriver({ client: 'pg', connection: {} }), .toSQL(), string assertions. "Connection is never opened."
mysql2	compile-only, same shape

Compile-only proves the SQL text. It cannot prove the server returns those rows, and it never exercises the ttl cutoff against the column type the dialect actually creates — which is where the two dialects differ from sqlite: sqlite stores expires_at as TEXT, while the same declaration creates timestamp with time zone on pg and datetime on MariaDB/MySQL (measured below via columnInfo()). An ISO-8601 …Z comparand against a real temporal column under STRICT_TRANS_TABLES is exactly the class of thing a text assertion cannot see.

The repo already has the mechanism this file does not use

packages/drivers/driver-sql/src/live-dialect-matrix.testkit.ts exports PG_CELL / MYSQL_CELL (OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL, per-file schema derivation, declareUnprovisionedCell for announcing an un-run cell). Sibling suites use it — sql-driver-datetime-postgres-timezone.test.ts, sql-driver-datetime-mysql-storage.test.ts, sql-driver-time-live-dialects.test.ts. The $null suite is the only dialect suite in that directory that hand-rolls connection: {} instead. It is also the only $null dialect suite in the package (grep -l '$null' over *live*.ts / *dialect*.ts returns exactly it).

Measured by hand on #7826, on live servers, and it holds

Both servers were provisioned in the dev container (/usr/lib/postgresql/16/bin + apt-get install mariadb-server) and driven through the real SysSession declaration → real LifecycleService → real SqlDriver, i.e. the shape packages/plugins/plugin-auth/src/sys-session-ttl-sweep.test.ts runs on sqlite:

PostgreSQL 16.13
 expires_at = {"type":"timestamp with time zone",...} revoked_at = {"type":"timestamp with time zone",...}
 SPARING : survivors after sweep: ["sess_live","sess_tombstone"]
 POSITIVE : report: [{"object":"sys_session","policy":"ttl","cutoff":"2026-08-02T00:00:00.000Z","deleted":1}]
 UNFILTERED (onlyWhen dropped): survivors: ["sess_live"] ← tombstone reaped, so the filter is what spares it

MariaDB 10.11.14 (sql_mode=STRICT_TRANS_TABLES,...)
 expires_at = {"type":"datetime",...} revoked_at = {"type":"datetime",...}
 SPARING : survivors after sweep: ["sess_live","sess_tombstone"]
 POSITIVE : report: [{"object":"sys_session","policy":"ttl","cutoff":"2026-08-02T00:00:00.000Z","deleted":1}]
 UNFILTERED (onlyWhen dropped): survivors: ["sess_live"]

⚠️ MariaDB is a MySQL-protocol stand-in, not MySQL 8.0 — good for predicate compilation and row selection, not for asserting MySQL error wording.

Suggested shape, if anyone picks this up

Give the existing suite live legs through PG_CELL / MYSQL_CELL rather than adding a file — the compile-only assertions stay (they run with no server), and the live legs skipIf themselves off when the env vars are absent. Extending the existing file also avoids a second engine-double-contract pin.

⛔ Deliberately not done inside #10633: that card is a rescue completing missing evidence, and CI provisions no live servers, so a committed live test adds no CI protection today. Duplicate scan: one semantic search over open+closed issues (a second scan was cut short by a GitHub API rate limit), no match.

[huangyiirene]

Triage: lands in packages/drivers/driver-sql (test surface) → domain:engine; promoted finding → pm:queue, type Task. Rationale: scope is exact (give sql-driver-ttl-onlywhen-null-dialects.test.ts live legs through the existing PG_CELL/MYSQL_CELL testkit, keep the compile-only assertions), the sibling suites already use that mechanism so this is convergence rather than new machinery, and the hand measurement above means the expected values are already known-good. Note for the engine seat: the 2026-08-05 investment freeze covers driver-memory/driver-mongodb — driver-sql is explicitly unaffected, so this card is dispatchable. Size suggestion: S/M, mode:subagent.

---

Generated by Claude Code

[os-elon]

Claimed for dispatch

• Seat: PM dispatch (domain:engine), session session_019yDEhPBC3tcGkW9bkce1HM
• Branch: claude/issue-10836-ttl-onlywhen-live-legs
• Tier: opus · Labels: pm:queue → pm:dispatched

⚠️ Cross-seat note. A second PM loop (epic cloud#1521 Round A) is dispatching into this repo concurrently; the maintainer has ruled domain:engine stays with this seat and that loop avoids the lane. This card's surface is packages/drivers/driver-sql/ — disjoint from #10825's packages/core/src/security/resolve-authz-context.ts, which the epic seat now holds. Verified before dispatch, not assumed.

Triage confirms the dispatch fence: the 2026-08-05 investment freeze (#5499) covers driver-memory/driver-mongodb only — driver-sql is explicitly unaffected.

The work

Give packages/drivers/driver-sql/src/sql-driver-ttl-onlywhen-null-dialects.test.ts live legs through the existing PG_CELL / MYSQL_CELL testkit (live-dialect-matrix.testkit.ts). ⭐ This is convergence onto machinery the repo already has, not new machinery — sql-driver-datetime-postgres-timezone.test.ts, sql-driver-datetime-mysql-storage.test.ts and sql-driver-time-live-dialects.test.ts are the shape to copy. That suite is the only dialect suite in the directory that hand-rolls connection: {}, and the only $null dialect suite in the package.

Extend the existing file — do not add a new one (the card's own suggestion; it also avoids a second engine-double-contract pin). Keep the compile-only assertions: they run with no server. The live legs skipIf themselves off when the env vars are absent.

⭐ What this card is really about, and the trap in it

The gap is not cosmetic. Compile-only proves the SQL text; it cannot prove the server returns those rows — and it never exercises the ttl cutoff against the column type each dialect actually creates. That is exactly where the dialects diverge:

	expires_at storage
sqlite	TEXT
pg	timestamp with time zone
MariaDB/MySQL	datetime

An ISO-8601 …Z comparand against a real temporal column under STRICT_TRANS_TABLES is precisely the class of defect a string assertion cannot see.

⛔ The trap: this card's expected outcome is that everything PASSES. The filer measured it by hand on live PostgreSQL 16.13 and MariaDB 10.11.14 and it held on both. So a green run proves nothing on its own — a live leg that is silently skipped is also green. Your evidence must separate "ran and passed" from "never ran":

• Show each live leg actually executing against a provisioned server — report the server versions and the columnInfo() types you observed, as the card does. If your numbers differ from the filed ones, that is a finding, not a discrepancy to reconcile away.
• Show the leg correctly skipping when OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL are absent, and that the skip is announced (declareUnprovisionedCell) rather than silent. An un-run cell that reports nothing is the same defect class as the compile-only gap you are closing.
• ⭐ Falsify the live leg: drop onlyWhen from the sweep and show the tombstone gets reaped (the card's own UNFILTERED control — survivors: ["sess_live"]). A live leg that stays green with the filter removed is not testing the filter. Do this on both dialects.

Three-way taxonomy, name which kind each control is. The live legs are coverage-extension controls, not defect controls — nothing is broken, so there is no red pre-fix tree to point at, and the falsification above is what earns them.

⚠️ MariaDB is a MySQL-protocol stand-in, not MySQL 8.0 — good for predicate compilation and row selection, ⛔ not for asserting MySQL error wording. If you find yourself pinning an error string, stop.

⭐ Say plainly what CI does and does not gain. The filer's reason for not doing this inside #10633 was that CI provisions no live servers, so committed live legs add no CI protection today. If that is still true, this card's value is a local/manual verification path and a skip that announces itself — say so in the PR rather than implying CI coverage that does not exist. If you find CI can provision them, that is a finding worth its own note.

Standing rules

Worktree-first before the first edit. ⛔ Never git stash — the stack is shared across every worktree of the repo. ⛔ Never edit content/docs/releases/. Baselines and debt ledgers may only shrink. Reason src/dist in both directions; prove restoration on disk. Gate union via node scripts/pm/dispatch-gates.mjs with no path arguments after the final commit; capture exits before any pipe. Open the PR as a draft — the PM flips it. Fixes #10836.

---

Generated by Claude Code