Skip to content

analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy #13926

Open
Open
analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy#13926
Labels
bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3

Description

@claude
claude
bot
opened on Aug 31, 2026

Filed unassigned by the #13640 dev while implementing that card. Recording only — severity and routing are triage's. Not resolved by #13640 and does not block it.

What was measured, on 46b53a25b

read-scope-sql.ts's module header declares this, verbatim, as a ruled follow-up of the #13571 verdict:

⚠️ Declared residue, ruled follow-up — NOT covered here: $not over $in: [] still compiles to constant TRUE at this lowering for a producer that is not the (#13570-guarded) RLS compiler. Closing that needs a polarity-aware design whose interaction with the #5322$not-over-identity reductions is ruled first — a naive "refuse NOT of the FALSE constant" cannot tell net polarity.

A targeted search over this repo's issues finds no open card carrying that follow-up. #13571 is closed; #13552 and #13496 are closed; nothing else names it. So the residue is recorded only in a source comment, where nothing schedules it.

Why #13640 makes it sharper rather than smaller

#13640 closed the same vacancy on the ObjectQL ENGINE execution path, at the getReadScope-to-engine merge, and was ruled explicitly NOT to move the two routes that go through compileScopedFilterToSql. The result is a disagreement that did not exist before, on one strategy:

  • ObjectQLStrategy.execute() now REFUSES a scope of { f: { $not: { $in: [] } } } shape (READ_SCOPE_COMPILE_FAILED / 500).
  • ObjectQLStrategy.generateSql() — the /analytics/sql echo for the same query — still COMPILES it, to a predicate that admits every row.

The echo's predicate is NOT (("deal"."owner" IS NOT NULL AND 1 = 0)) — the NULL-safe negation rewrite totalises the leaf, the empty membership folds to the FALSE constant, and NOT FALSE keeps every row. NativeSQLStrategy.applyReadScope builds its WHERE from that same compiler and the same non-RLS producer, so it carries the same predicate. ⚠️ Stated as read from the compiler, not as an end-to-end row count: what #13640 pinned is that compileScopedFilterToSql still COMPILES this shape (its immobility control), and the row consequence above is derived from the emitted predicate rather than measured against a backend. Triage should re-measure before grading.

So one read scope now has two answers on one strategy, chosen by whether the caller asked for rows or for the SQL that would produce them — and the echo's answer is the widening one.

What keeps it from biting today

The same protection profile the two sibling cards carry, and it is producer-side self-discipline, not a gate: in-repo the only scope producer is the RLS compiler, and since PR #13570 its polarity-aware guard drops both emptied-membership shapes at widening polarity before emission; the CEL lowering never emits $nin. StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts carries a hand-written example), so an out-of-repo producer is exactly the case with no mechanical guard in front of it on those two routes.

Related

#13571 / PR #13649 (the lowering-site refusal and the verdict that declared this residue) · #13640 / PR #13924 (the engine-path guard, which deliberately did not move the echo) · #13552 / PR #13570 (the producer-side polarity guard) · #5322 (empty combinators reduce as boolean identities) · ADR-0021 (read-scope contract)

Generated by Claude Code

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
     blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy · Issue #13926 · objectstack-ai/objectstack · GitHub
    Skip to content
    analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy #13926
    Open
    Open
    analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy#13926
    Labels
    bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
    Description
    @claude
    claude
    bot
    opened on Aug 31, 2026
    Filed unassigned by the #13640 dev while implementing that card. Recording only — severity and routing are triage's. Not resolved by #13640 and does not block it.
    What was measured, on 46b53a25b
    read-scope-sql.ts's module header declares this, verbatim, as a ruled follow-up of the #13571 verdict:
    ⚠️ Declared residue, ruled follow-up — NOT covered here: $not over $in: [] still compiles to constant TRUE at this lowering for a producer that is not the (#13570-guarded) RLS compiler. Closing that needs a polarity-aware design whose interaction with the #5322$not-over-identity reductions is ruled first — a naive "refuse NOT of the FALSE constant" cannot tell net polarity.
    A targeted search over this repo's issues finds no open card carrying that follow-up. #13571 is closed; #13552 and #13496 are closed; nothing else names it. So the residue is recorded only in a source comment, where nothing schedules it.
    Why #13640 makes it sharper rather than smaller
    #13640 closed the same vacancy on the ObjectQL ENGINE execution path, at the getReadScope-to-engine merge, and was ruled explicitly NOT to move the two routes that go through compileScopedFilterToSql. The result is a disagreement that did not exist before, on one strategy:
    • ObjectQLStrategy.execute() now REFUSES a scope of { f: { $not: { $in: [] } } } shape (READ_SCOPE_COMPILE_FAILED / 500).
    • ObjectQLStrategy.generateSql() — the /analytics/sql echo for the same query — still COMPILES it, to a predicate that admits every row.
    The echo's predicate is NOT (("deal"."owner" IS NOT NULL AND 1 = 0)) — the NULL-safe negation rewrite totalises the leaf, the empty membership folds to the FALSE constant, and NOT FALSE keeps every row. NativeSQLStrategy.applyReadScope builds its WHERE from that same compiler and the same non-RLS producer, so it carries the same predicate. ⚠️ Stated as read from the compiler, not as an end-to-end row count: what #13640 pinned is that compileScopedFilterToSql still COMPILES this shape (its immobility control), and the row consequence above is derived from the emitted predicate rather than measured against a backend. Triage should re-measure before grading.
    So one read scope now has two answers on one strategy, chosen by whether the caller asked for rows or for the SQL that would produce them — and the echo's answer is the widening one.
    What keeps it from biting today
    The same protection profile the two sibling cards carry, and it is producer-side self-discipline, not a gate: in-repo the only scope producer is the RLS compiler, and since PR #13570 its polarity-aware guard drops both emptied-membership shapes at widening polarity before emission; the CEL lowering never emits $nin. StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts carries a hand-written example), so an out-of-repo producer is exactly the case with no mechanical guard in front of it on those two routes.
    Related
    #13571 / PR #13649 (the lowering-site refusal and the verdict that declared this residue) · #13640 / PR #13924 (the engine-path guard, which deliberately did not move the echo) · #13552 / PR #13570 (the producer-side polarity guard) · #5322 (empty combinators reduce as boolean identities) · ADR-0021 (read-scope contract)
    Generated by Claude Code
    Metadata
    Metadata
    Assignees
    No one assigned
      Labels
      bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
      Type
      No type
      Projects
      No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy · Issue #13926 · objectstack-ai/objectstack · GitHub
      Skip to content
      analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy #13926
      Open
      Open
      analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy#13926
      Labels
      bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
      Description
      @claude
      claude
      bot
      opened on Aug 31, 2026
      Filed unassigned by the #13640 dev while implementing that card. Recording only — severity and routing are triage's. Not resolved by #13640 and does not block it.
      What was measured, on 46b53a25b
      read-scope-sql.ts's module header declares this, verbatim, as a ruled follow-up of the #13571 verdict:
      ⚠️ Declared residue, ruled follow-up — NOT covered here: $not over $in: [] still compiles to constant TRUE at this lowering for a producer that is not the (#13570-guarded) RLS compiler. Closing that needs a polarity-aware design whose interaction with the #5322$not-over-identity reductions is ruled first — a naive "refuse NOT of the FALSE constant" cannot tell net polarity.
      A targeted search over this repo's issues finds no open card carrying that follow-up. #13571 is closed; #13552 and #13496 are closed; nothing else names it. So the residue is recorded only in a source comment, where nothing schedules it.
      Why #13640 makes it sharper rather than smaller
      #13640 closed the same vacancy on the ObjectQL ENGINE execution path, at the getReadScope-to-engine merge, and was ruled explicitly NOT to move the two routes that go through compileScopedFilterToSql. The result is a disagreement that did not exist before, on one strategy:
      • ObjectQLStrategy.execute() now REFUSES a scope of { f: { $not: { $in: [] } } } shape (READ_SCOPE_COMPILE_FAILED / 500).
      • ObjectQLStrategy.generateSql() — the /analytics/sql echo for the same query — still COMPILES it, to a predicate that admits every row.
      The echo's predicate is NOT (("deal"."owner" IS NOT NULL AND 1 = 0)) — the NULL-safe negation rewrite totalises the leaf, the empty membership folds to the FALSE constant, and NOT FALSE keeps every row. NativeSQLStrategy.applyReadScope builds its WHERE from that same compiler and the same non-RLS producer, so it carries the same predicate. ⚠️ Stated as read from the compiler, not as an end-to-end row count: what #13640 pinned is that compileScopedFilterToSql still COMPILES this shape (its immobility control), and the row consequence above is derived from the emitted predicate rather than measured against a backend. Triage should re-measure before grading.
      So one read scope now has two answers on one strategy, chosen by whether the caller asked for rows or for the SQL that would produce them — and the echo's answer is the widening one.
      What keeps it from biting today
      The same protection profile the two sibling cards carry, and it is producer-side self-discipline, not a gate: in-repo the only scope producer is the RLS compiler, and since PR #13570 its polarity-aware guard drops both emptied-membership shapes at widening polarity before emission; the CEL lowering never emits $nin. StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts carries a hand-written example), so an out-of-repo producer is exactly the case with no mechanical guard in front of it on those two routes.
      Related
      #13571 / PR #13649 (the lowering-site refusal and the verdict that declared this residue) · #13640 / PR #13924 (the engine-path guard, which deliberately did not move the echo) · #13552 / PR #13570 (the producer-side polarity guard) · #5322 (empty combinators reduce as boolean identities) · ADR-0021 (read-scope contract)
      Generated by Claude Code
      Metadata
      Metadata
      Assignees
      No one assigned
        Labels
        bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
        Type
        No type
        Projects
        No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy · Issue #13926 · objectstack-ai/objectstack · GitHub
        Skip to content
        analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy #13926
        Open
        Open
        analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy#13926
        Labels
        bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
        Description
        @claude
        claude
        bot
        opened on Aug 31, 2026
        Filed unassigned by the #13640 dev while implementing that card. Recording only — severity and routing are triage's. Not resolved by #13640 and does not block it.
        What was measured, on 46b53a25b
        read-scope-sql.ts's module header declares this, verbatim, as a ruled follow-up of the #13571 verdict:
        ⚠️ Declared residue, ruled follow-up — NOT covered here: $not over $in: [] still compiles to constant TRUE at this lowering for a producer that is not the (#13570-guarded) RLS compiler. Closing that needs a polarity-aware design whose interaction with the #5322$not-over-identity reductions is ruled first — a naive "refuse NOT of the FALSE constant" cannot tell net polarity.
        A targeted search over this repo's issues finds no open card carrying that follow-up. #13571 is closed; #13552 and #13496 are closed; nothing else names it. So the residue is recorded only in a source comment, where nothing schedules it.
        Why #13640 makes it sharper rather than smaller
        #13640 closed the same vacancy on the ObjectQL ENGINE execution path, at the getReadScope-to-engine merge, and was ruled explicitly NOT to move the two routes that go through compileScopedFilterToSql. The result is a disagreement that did not exist before, on one strategy:
        • ObjectQLStrategy.execute() now REFUSES a scope of { f: { $not: { $in: [] } } } shape (READ_SCOPE_COMPILE_FAILED / 500).
        • ObjectQLStrategy.generateSql() — the /analytics/sql echo for the same query — still COMPILES it, to a predicate that admits every row.
        The echo's predicate is NOT (("deal"."owner" IS NOT NULL AND 1 = 0)) — the NULL-safe negation rewrite totalises the leaf, the empty membership folds to the FALSE constant, and NOT FALSE keeps every row. NativeSQLStrategy.applyReadScope builds its WHERE from that same compiler and the same non-RLS producer, so it carries the same predicate. ⚠️ Stated as read from the compiler, not as an end-to-end row count: what #13640 pinned is that compileScopedFilterToSql still COMPILES this shape (its immobility control), and the row consequence above is derived from the emitted predicate rather than measured against a backend. Triage should re-measure before grading.
        So one read scope now has two answers on one strategy, chosen by whether the caller asked for rows or for the SQL that would produce them — and the echo's answer is the widening one.
        What keeps it from biting today
        The same protection profile the two sibling cards carry, and it is producer-side self-discipline, not a gate: in-repo the only scope producer is the RLS compiler, and since PR #13570 its polarity-aware guard drops both emptied-membership shapes at widening polarity before emission; the CEL lowering never emits $nin. StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts carries a hand-written example), so an out-of-repo producer is exactly the case with no mechanical guard in front of it on those two routes.
        Related
        #13571 / PR #13649 (the lowering-site refusal and the verdict that declared this residue) · #13640 / PR #13924 (the engine-path guard, which deliberately did not move the echo) · #13552 / PR #13570 (the producer-side polarity guard) · #5322 (empty combinators reduce as boolean identities) · ADR-0021 (read-scope contract)
        Generated by Claude Code
        Metadata
        Metadata
        Assignees
        No one assigned
          Labels
          bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
          Type
          No type
          Projects
          No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy · Issue #13926 · objectstack-ai/objectstack · GitHub
          Skip to content
          analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy #13926
          Open
          Open
          analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy#13926
          Labels
          bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
          Description
          @claude
          claude
          bot
          opened on Aug 31, 2026
          Filed unassigned by the #13640 dev while implementing that card. Recording only — severity and routing are triage's. Not resolved by #13640 and does not block it.
          What was measured, on 46b53a25b
          read-scope-sql.ts's module header declares this, verbatim, as a ruled follow-up of the #13571 verdict:
          ⚠️ Declared residue, ruled follow-up — NOT covered here: $not over $in: [] still compiles to constant TRUE at this lowering for a producer that is not the (#13570-guarded) RLS compiler. Closing that needs a polarity-aware design whose interaction with the #5322$not-over-identity reductions is ruled first — a naive "refuse NOT of the FALSE constant" cannot tell net polarity.
          A targeted search over this repo's issues finds no open card carrying that follow-up. #13571 is closed; #13552 and #13496 are closed; nothing else names it. So the residue is recorded only in a source comment, where nothing schedules it.
          Why #13640 makes it sharper rather than smaller
          #13640 closed the same vacancy on the ObjectQL ENGINE execution path, at the getReadScope-to-engine merge, and was ruled explicitly NOT to move the two routes that go through compileScopedFilterToSql. The result is a disagreement that did not exist before, on one strategy:
          • ObjectQLStrategy.execute() now REFUSES a scope of { f: { $not: { $in: [] } } } shape (READ_SCOPE_COMPILE_FAILED / 500).
          • ObjectQLStrategy.generateSql() — the /analytics/sql echo for the same query — still COMPILES it, to a predicate that admits every row.
          The echo's predicate is NOT (("deal"."owner" IS NOT NULL AND 1 = 0)) — the NULL-safe negation rewrite totalises the leaf, the empty membership folds to the FALSE constant, and NOT FALSE keeps every row. NativeSQLStrategy.applyReadScope builds its WHERE from that same compiler and the same non-RLS producer, so it carries the same predicate. ⚠️ Stated as read from the compiler, not as an end-to-end row count: what #13640 pinned is that compileScopedFilterToSql still COMPILES this shape (its immobility control), and the row consequence above is derived from the emitted predicate rather than measured against a backend. Triage should re-measure before grading.
          So one read scope now has two answers on one strategy, chosen by whether the caller asked for rows or for the SQL that would produce them — and the echo's answer is the widening one.
          What keeps it from biting today
          The same protection profile the two sibling cards carry, and it is producer-side self-discipline, not a gate: in-repo the only scope producer is the RLS compiler, and since PR #13570 its polarity-aware guard drops both emptied-membership shapes at widening polarity before emission; the CEL lowering never emits $nin. StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts carries a hand-written example), so an out-of-repo producer is exactly the case with no mechanical guard in front of it on those two routes.
          Related
          #13571 / PR #13649 (the lowering-site refusal and the verdict that declared this residue) · #13640 / PR #13924 (the engine-path guard, which deliberately did not move the echo) · #13552 / PR #13570 (the producer-side polarity guard) · #5322 (empty combinators reduce as boolean identities) · ADR-0021 (read-scope contract)
          Generated by Claude Code
          Metadata
          Metadata
          Assignees
          No one assigned
            Labels
            bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
            Type
            No type
            Projects
            No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy · Issue #13926 · objectstack-ai/objectstack · GitHub
            Skip to content
            analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy #13926
            Open
            Open
            analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy#13926
            Labels
            bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
            Description
            @claude
            claude
            bot
            opened on Aug 31, 2026
            Filed unassigned by the #13640 dev while implementing that card. Recording only — severity and routing are triage's. Not resolved by #13640 and does not block it.
            What was measured, on 46b53a25b
            read-scope-sql.ts's module header declares this, verbatim, as a ruled follow-up of the #13571 verdict:
            ⚠️ Declared residue, ruled follow-up — NOT covered here: $not over $in: [] still compiles to constant TRUE at this lowering for a producer that is not the (#13570-guarded) RLS compiler. Closing that needs a polarity-aware design whose interaction with the #5322$not-over-identity reductions is ruled first — a naive "refuse NOT of the FALSE constant" cannot tell net polarity.
            A targeted search over this repo's issues finds no open card carrying that follow-up. #13571 is closed; #13552 and #13496 are closed; nothing else names it. So the residue is recorded only in a source comment, where nothing schedules it.
            Why #13640 makes it sharper rather than smaller
            #13640 closed the same vacancy on the ObjectQL ENGINE execution path, at the getReadScope-to-engine merge, and was ruled explicitly NOT to move the two routes that go through compileScopedFilterToSql. The result is a disagreement that did not exist before, on one strategy:
            • ObjectQLStrategy.execute() now REFUSES a scope of { f: { $not: { $in: [] } } } shape (READ_SCOPE_COMPILE_FAILED / 500).
            • ObjectQLStrategy.generateSql() — the /analytics/sql echo for the same query — still COMPILES it, to a predicate that admits every row.
            The echo's predicate is NOT (("deal"."owner" IS NOT NULL AND 1 = 0)) — the NULL-safe negation rewrite totalises the leaf, the empty membership folds to the FALSE constant, and NOT FALSE keeps every row. NativeSQLStrategy.applyReadScope builds its WHERE from that same compiler and the same non-RLS producer, so it carries the same predicate. ⚠️ Stated as read from the compiler, not as an end-to-end row count: what #13640 pinned is that compileScopedFilterToSql still COMPILES this shape (its immobility control), and the row consequence above is derived from the emitted predicate rather than measured against a backend. Triage should re-measure before grading.
            So one read scope now has two answers on one strategy, chosen by whether the caller asked for rows or for the SQL that would produce them — and the echo's answer is the widening one.
            What keeps it from biting today
            The same protection profile the two sibling cards carry, and it is producer-side self-discipline, not a gate: in-repo the only scope producer is the RLS compiler, and since PR #13570 its polarity-aware guard drops both emptied-membership shapes at widening polarity before emission; the CEL lowering never emits $nin. StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts carries a hand-written example), so an out-of-repo producer is exactly the case with no mechanical guard in front of it on those two routes.
            Related
            #13571 / PR #13649 (the lowering-site refusal and the verdict that declared this residue) · #13640 / PR #13924 (the engine-path guard, which deliberately did not move the echo) · #13552 / PR #13570 (the producer-side polarity guard) · #5322 (empty combinators reduce as boolean identities) · ADR-0021 (read-scope contract)
            Generated by Claude Code
            Metadata
            Metadata
            Assignees
            No one assigned
              Labels
              bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
              Type
              No type
              Projects
              No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy · Issue #13926 · objectstack-ai/objectstack · GitHub
              Skip to content
              analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy #13926
              Open
              Open
              analytics: read-scope-sql's ruled $not-over-$in-empty residue has no open card — and #13640 turned it into an echo-vs-execution disagreement on the ObjectQL strategy#13926
              Labels
              bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
              Description
              @claude
              claude
              bot
              opened on Aug 31, 2026
              Filed unassigned by the #13640 dev while implementing that card. Recording only — severity and routing are triage's. Not resolved by #13640 and does not block it.
              What was measured, on 46b53a25b
              read-scope-sql.ts's module header declares this, verbatim, as a ruled follow-up of the #13571 verdict:
              ⚠️ Declared residue, ruled follow-up — NOT covered here: $not over $in: [] still compiles to constant TRUE at this lowering for a producer that is not the (#13570-guarded) RLS compiler. Closing that needs a polarity-aware design whose interaction with the #5322$not-over-identity reductions is ruled first — a naive "refuse NOT of the FALSE constant" cannot tell net polarity.
              A targeted search over this repo's issues finds no open card carrying that follow-up. #13571 is closed; #13552 and #13496 are closed; nothing else names it. So the residue is recorded only in a source comment, where nothing schedules it.
              Why #13640 makes it sharper rather than smaller
              #13640 closed the same vacancy on the ObjectQL ENGINE execution path, at the getReadScope-to-engine merge, and was ruled explicitly NOT to move the two routes that go through compileScopedFilterToSql. The result is a disagreement that did not exist before, on one strategy:
              • ObjectQLStrategy.execute() now REFUSES a scope of { f: { $not: { $in: [] } } } shape (READ_SCOPE_COMPILE_FAILED / 500).
              • ObjectQLStrategy.generateSql() — the /analytics/sql echo for the same query — still COMPILES it, to a predicate that admits every row.
              The echo's predicate is NOT (("deal"."owner" IS NOT NULL AND 1 = 0)) — the NULL-safe negation rewrite totalises the leaf, the empty membership folds to the FALSE constant, and NOT FALSE keeps every row. NativeSQLStrategy.applyReadScope builds its WHERE from that same compiler and the same non-RLS producer, so it carries the same predicate. ⚠️ Stated as read from the compiler, not as an end-to-end row count: what #13640 pinned is that compileScopedFilterToSql still COMPILES this shape (its immobility control), and the row consequence above is derived from the emitted predicate rather than measured against a backend. Triage should re-measure before grading.
              So one read scope now has two answers on one strategy, chosen by whether the caller asked for rows or for the SQL that would produce them — and the echo's answer is the widening one.
              What keeps it from biting today
              The same protection profile the two sibling cards carry, and it is producer-side self-discipline, not a gate: in-repo the only scope producer is the RLS compiler, and since PR #13570 its polarity-aware guard drops both emptied-membership shapes at widening polarity before emission; the CEL lowering never emits $nin. StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts carries a hand-written example), so an out-of-repo producer is exactly the case with no mechanical guard in front of it on those two routes.
              Related
              #13571 / PR #13649 (the lowering-site refusal and the verdict that declared this residue) · #13640 / PR #13924 (the engine-path guard, which deliberately did not move the echo) · #13552 / PR #13570 (the producer-side polarity guard) · #5322 (empty combinators reduce as boolean identities) · ADR-0021 (read-scope contract)
              Generated by Claude Code
              Metadata
              Metadata
              Assignees
              No one assigned
                Labels
                bugSomething isn't workingdomain:servicespm:queuepriority:p2Medium: important, M3
                Type
                No type
                Projects
                No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions