fix(service-analytics): one verdict for a vacating read scope on all three analytics faces (echo + native SQL)

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code

[claude]

Fixes#13926

What this closes

#13640 guarded the ObjectQL ENGINE merges (withReadScope, resolveFkAttr) with assertReadScopeCannotVacate, and its dispatch deliberately did not move the two routes that consume compileScopedFilterToSql. That left one read scope with two answers on one strategy: ObjectQLStrategy.execute() REFUSED the $not-over-$in: [] family while ObjectQLStrategy.generateSql() — the /analytics/sql echo — still COMPILED it to a predicate admitting every row, and NativeSQLStrategy.applyReadScope built a real, executed WHERE from the same compiler.

The fix is the PM-suggested route, confirmed by measurement: the SAME exported guard, called at the two remaining getReadScope merge sites. Zero compiler change (see "What did NOT move").

Measured, not read from the compiler (the card asked)

The card flagged its row consequence as derived from the emitted predicate. read-scope-vacancy-three-faces.test.ts measures it end-to-end on one real engine (driver-sqlite-wasm over driver-sql; three fixture rows, NULL owner on r3), driving all three faces and EXECUTING the echo SQL rather than string-matching it. Pre-fix, on this harness:

scope	execute()	echo (SQL executed)	native execute()
{ owner: { $nin: [] } }	refused (guard)	refused (compiler #13571 arm)	refused (compiler #13571 arm)
{ $not: { owner: { $in: [] } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { owner: [] } }	refused	refused (bare-array arm)	refused (bare-array arm)
{ $not: { owner: { $in: [], $ne: 'u_other' } } }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $or: [ { $not: { owner: { $in: [] } } }, { owner: 'u_me' } ] }	refused	ALL THREE ROWS	ALL THREE ROWS
{ $not: { $not: { owner: { $nin: [] } } } }	refused	refused (compiler arm)	refused (compiler arm)

Post-fix, all six spellings refuse on all three faces in the module's one envelope — READ_SCOPE_COMPILE_FAILED / 500 — asserted by code plus status in every refusal case, never a bare throw assertion.

The PM's question: latent execution leak, or echo truthfulness?

Both, split by route. NativeSQLStrategy.execute() runs generateSql()'s output through ctx.executeRawSql — real rows, with no other read-scope door in front of it. So the native half was a LATENT EXECUTION LEAK for any out-of-repo getReadScope producer (the spec contract in packages/spec/src/contracts/analytics-service.ts exists exactly for those), held shut in-repo only by #13570's producer-side polarity guard. The ObjectQL half was an echo-truthfulness defect only: execute() refuses at withReadScope before the engine, and the echo is a display string. The pre-fix native rows above are the leak measured, not inferred.

Also verified while counting doors: the third getReadScope reader in the package, NativeSQLStrategy.crossFieldComparisonIn, is a read-only routing probe (nothing it reads reaches a compiler or an engine), and analytics-service.ts's callCtx wrapper only pre-resolves scopes into the same StrategyContext the strategies consume. The card's count of exactly two unguarded merge sites holds.

Where the guard stands — AFTER the compiler, deliberately

At both new sites the guard runs after compileScopedFilterToSql returns. The shapes the compiler already refuses ($nin: [] at any depth, the bare-array comparand) keep their #13571 refusal messages on these routes — read-scope-empty-nin-refusal.test.ts's end-to-end message pin is green UNEDITED — so each door stays distinguishable in the operator's log (the property #13640's review called out), and the guard closes exactly the shapes that compile-but-vacate. Same verdict everywhere; door-specific messages preserved.

What did NOT move (controls)

• compileScopedFilterToSql itself: zero code diff (doc header updated to record the new call sites). The read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: $in: [] folds to 1 = 0 one arm from $not, and $nin: [] folds to 1 = 1 (constant TRUE) #13571 verdict's residue — $not over $in: [] still compiling to constant TRUE at that lowering — stays exactly where the verdict left it; the polarity-aware compiler design remains the ruled-first follow-up. The new suite pins the compiler still compiling all three leaking spellings, labelled IMMOBILITY CONTROLS, not contracts (fix(analytics): refuse a non-binding read scope before the ObjectQL engine #13924's precedent). A direct out-of-package consumer of the public export still receives the compiled constant.
• The $in: [] zero-rows reduction and the fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 RLS composite (emptied membership beside an own-rows grant): asserted unchanged on ALL THREE faces (the own row still flows; the $and composite still denies with zero rows and no refusal).
• Every pre-existing assertion: the full package suite is 87 files / 1871 tests green with zero edits to any existing assertion (two stale comments in objectql-read-scope-vacancy-refusal.test.ts were amended to name the new call sites; its assertions are byte-identical).

Ablation (direction predicted before the run)

Fix committed first. Mutation replaced the two guard call lines with markers, confirmed ON DISK before measuring (per file: anchor grep count 1 to 0, marker grep count 0 to 1; editor exit codes not used as evidence). No rebuild leg is owed: the suites import the mutated sources by relative path inside their own package, so vitest transforms src directly and no dist is in the resolution path. Result matched the prediction exactly: 5 tests reddened — the three compiling spellings, the guard-message pin, and the joined-object door, with echo and native again admitting all three rows — while the other 34, including every control and the whole #13924 suite, stayed green. Restore proven by STATE, not exit code: git checkout HEAD -- with absolute paths under an EXIT/INT/TERM trap, then git diff HEAD empty, blob hashes equal to the HEAD blobs (verified non-empty before mutating), zero markers left.

Verification (all on c8ac3e7, the head of this branch)

• pnpm --filter @objectstack/service-analytics test — Test Files 87 passed (87), Tests 1871 passed (1871)
• pnpm --filter @objectstack/service-analytics exec tsc --noEmit --listFiles — zero error-TS lines; the listing shows all five touched files inside the program, so the green covers the edits
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths passed; the script derived the changeset itself, and its first line names this repo at commit c8ac3e7): 29 commands — 28 green by their own verdict lines; check-test-completeness exits 3 with its own first line "PREREQUISITE NOT MET" (it grades a CI-produced turbo log) = NOT MEASURED, neither green nor red
• pnpm lint (repo-wide eslint . --no-inline-config) ran to completion, exit 0, clean — no narrowing claimed or needed
• node scripts/check-nul-bytes.mjs OK over 7815 files
• Changeset: patch for @objectstack/service-analytics — no new exported symbol and no new payload key (reusing the exported guard was chosen over exporting anything new)

Out of scope, deliberately: the compiler-internal residue (#13571's ruled-first design fork) — this PR shrinks its reachability to direct consumers of the exported compiler and does not touch the lowering; the #5322 reductions and the #13570 producer guard are unmoved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 2 documentable anchor(s). ⚠️1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))
• content/docs/releases/v17.mdx(via generateSql (symbol, a method of class ObjectQLStrategy))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-analytics/src/read-scope-sql.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 11d84ffd864fdea7f3501749ebb615c063d41b83 — the merge of head c8ac3e7b30a098e0da83226ef114163ee0932a81 into base c5a9a437dd881df2766df8f8c44055b366bb6d57, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 11d84ffd864fdea7f3501749ebb615c063d41b83 && git checkout 11d84ffd864fdea7f3501749ebb615c063d41b83
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5a9a437dd881df2766df8f8c44055b366bb6d57 c8ac3e7b30a098e0da83226ef114163ee0932a81 && git checkout -B drift-repro c5a9a437dd881df2766df8f8c44055b366bb6d57 && git merge --no-ff c8ac3e7b30a098e0da83226ef114163ee0932a81
node scripts/docs-audit/affected-docs.mjs --json c5a9a437dd881df2766df8f8c44055b366bb6d57

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c5a9a437dd881df2766df8f8c44055b366bb6d57 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (domain:services seat, session session_01AUF1NoViznQK32gqpK8wS8): flipped ready and enqueued via auto-merge on head c8ac3e7b after the three landing checks — ① in-seat Clause-② contract review PASS on the card (13926#issuecomment-5503343895, isolated reviewer at the contract-review tier, transcript-verified 50/50 stamps, verdict adopted verbatim); ② needs:contract-review cleared on both carriers and check-clause2-carriers --pair 14322 reads consistent; ③ all 40 check runs on this head completed success or path-filter skipped (Lint & Repo Gates green 02:25:22Z). Path surface: packages/services/service-analytics/** + one changeset — no governed surface, so the merge queue is the landing path. Follow-up from the review's §5 filed as #14329.

---

Generated by Claude Code