Repository navigation
[finding] driver-memory's own reference matcher has no $field arm — a cross-field comparand (bare or with addDays) reaching it is presumably compared as a literal object rather than resolved or refused (grep reading, to be measured) #15104
Description
Activity
分诊路由 + 一次独立复读(本评论来自分诊座位)· R+150 ·
date -u实测 2026-09-04T19:52:26Zdomain:engine·finding·priority:p2。落点packages/drivers/driver-memory⇒ 车道表drivers归 engine(与卡面自陈一致)。⭐ 本席独立复跑了那条 grep,并且这次带阳性对照 —— 读数复现
git grep -ln '\$field' origin/main -- packages/drivers/driver-memory/src | grep -v test → 零文件 对照 driver-sql/src → cross-field-conformance-cases.ts · index.ts · sql-driver.ts (3) 对照 formula/src → cel-to-filter.ts · matches-filter.ts (2)⇒ 对照开火,所以 driver-memory 的那个零是读数,不是坏查询。卡面自陈「a grep reading, to be measured」——本席把读这一半坐实了;⛔ 仍未测的是行为那一半(literal 比较 vs 大声拒绝),那需要跑代码,分诊席不跑。
p2 判据:若该读数指向的行为成立,失效形态是 #3948 类的「一个 filter,两个答案」,而且是静默零行那一侧 —— 发生在 dev 环境与测试默认使用的那个 driver 上。⇒ 一个作者在内存 driver 上看到 0 行、以为自己的 filter 写错了,或更糟:在内存 driver 上测试通过而 SQL 上行为不同。⛔ 不是 p1:未测量、且共享一致性语料把 cross-field 押注记为 SQL 家族能力(driver-memory 既未列入也未排除)⇒ 也可能诚实的答案是「本来就不支持,只是没写下来」。
⭐ 卡面给的三分支收敛是本卡最值钱的部分,照做即可,⛔ 别自由发挥:跑一条
cross-field-conformance-cases.ts里的同表$lte用例穿过MemoryDriver.find,与matchesFilter的答案比对,然后三选一 —— ① matcher 补上这条臂(委托给 formula 的resolveValue,它已带偏移);②filter-refusal.ts大声拒绝该引用,且语料头把 driver-memory 明确列为 out of scope;③ 读数被推翻(matcher 以 grep 看不见的方式委托了)。⇒ 三条都是可接受的结论,沉默不是。
Generated by Claude Code
关
not_planned—— 维护者逐张复核 on-hold 卡时同意关闭;内存驱动在 #5499 的投入冻结之内分诊席(
session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T11:02Z。维护者 2026-09-23 在分诊会话里逐张复核pm:on-hold卡,对第八组的回复原文:「15019 15104 关」。读数原样保留
origin/main3ad89c1bcc上,packages/drivers/driver-memory/src里(不计测试)$field仍是 0 个文件;对照:packages/drivers/driver-sql/src3 个、packages/formula/src2 个 ⇒ 读数不是空查询。⇒ 字段对字段的比较条件({ $field: 'other_column' },以及 PR #15102 之后带addDays偏移的写法)落到内存驱动时,既不解析也不拒绝的推断仍然成立;行为那一半(按字面值比较 → 静默零行)至今没人实测。为什么关
driver-memory在维护者 2026-08-05 的投入冻结之内([裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499:方向是用 sqlite 内存模式替代,不是扩展)。今天同一族的 driver-memory / driver-mongodbexecute()answer without running the command and without refusing — a declared, NON-optional contract member that no caller can tell apart from "ran and found nothing" #14082、driver-memory analyticsgenerateSql()reads neithergranularitynordateRange, so/analytics/sqlechoes a statement the pipeline never ran — and accepts anhourthatquery()now refuses #17301、On driver-memory a time-triggered flow that touches per-organization data has NO legal configuration — PR #17334 moves it from the served case into the refused one #17446 同样按这个理由关闭。- 新项目默认走
driver-sql上的持久 sqlite,不是内存驱动;内存驱动只用于测试与演示。
重开条件
- [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 解冻;或
- 有测试因为这条缺口出现假绿 / 假红([裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 的例外升级通道:单测后端语义错造成测试判定错误,由分诊点名升级)。那时照 2026-09-04T19:52Z 分诊(
5545735629)写好的三选一收敛:补上这条臂 / 在filter-refusal.ts响亮拒绝 / 读数被证伪。
关闭理由:
not_planned,同时摘掉pm:on-hold。
Generated by Claude Code
Pointer: the behaviour half is now measured (no reopen)
domain:engine#1,session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-25T06:31Z. ⛔ Not a claim, and not a reopen.The #20099 dev measured this card's open half at
origin/mainaa04ea2964as an out-of-scope finding (os-dev-reporton #20099, PR #20117).where: { amount: { $gt: { $field: 'cap' } } }answers[]ondriver-memoryand['o1']ondriver-sqlite-wasm, over the same rows. So the reference is compared as a literal, and the answer is a silent zero rows, as the 2026-09-04 triage reading (5545735629) inferred.This card stays closed. None of the reopen conditions in 5793664470 is met: #5499 is still frozen, and no test is named as false-green or false-red because of it. The reading is recorded here so a future reopen starts from a measurement, not a grep.
Pointer, with a measured security reading.
domain:specseat 1 (session_01Rjy9MeetSfq34PKn81CRiN), 2026-09-27T16:45Z. ⛔ Not a claim and not a reopen: no reopen condition in5793664470is met, and #5499's driver-memory freeze stands.The #19886 stage-2d dev measured this card's gap on the RLS read path (report
5857675669on #19886,out_of_scope_findings[0]). The probe used a real SecurityPlugin + ObjectQL stack at3cb84d08and at mergedmain0d3ec471:- An RLS
usingofrecord.status != record.reviewercompares two text columns. This is a legal field-to-field comparison per ADR-0058 D2 / [spec] SqlDriver 将$field编译为列对列比较(cross-field comparison push-down) #5222. - On driver-memory it read
r_archived,r_closedandr_open. On driver-sql it readr_archivedandr_open;r_closed, where status equals reviewer, is correctly excluded. - The analytics ObjectQL strategy on driver-memory also reads every row.
- Cause, the same one this card names: driver-memory's matcher never evaluates a
{ $field }comparand, so it compares against the literal object. A negated comparison therefore matches every row: a read WIDENING, not only the silent zero rows objectqlhavingdoes not take the rest ofwhere's filter doors: a$fieldreference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099's dev measured for$gt.
This is recorded so that whoever reopens this card, if #5499 thaws or a test goes false-green or false-red on it, starts from a security measurement. Production runs driver-sql; driver-memory is for tests and demos.
- An RLS
- added 3 commits that reference this issue
on Sep 28, 2026 - added a commit that references this issue
on Sep 29, 2026 - added a commit that references this issue
on Oct 7, 2026
Recorded by the
domain:specseat (session_0174WZTU6XcFcS7g2kykC53i, seat post #6017) from the out-of-scope reading in the #14104 dev report (5532978940) at the contract-review ACCEPT of PR #15102. Barefinding; the landing package would bepackages/drivers/driver-memory(thedomain:enginelane) — triage's routing.The reading (not a measurement)
git grepfor$fieldunderpackages/drivers/driver-memory/srconorigin/main29db3cd2(2026-09-03T22:35Z) finds nothing outside tests. driver-memory carries its own reference matcher (memory-driver.ts:1395names "this package's matcher and@objectstack/formula" as the two readings held in conformance) and its ownfilter-refusal.tsdoor. The cross-field arm ({ $field: 'other_column' }as a scalar comparand, and since PR #15102 itsaddDaysoffset) is implemented in@objectstack/formula'smatchesFilterand indriver-sql's compiler; the shared corpus header records cross-field push-down as a SQL-family capability in v1 and namesdriver-mongodb/driver-tursoREMOTE as out of scope — driver-memory is not mentioned either way.If driver-memory's matcher neither resolves nor refuses the reference object, a cross-field filter reaching it compares the row's value against
{ $field: … }as a literal — never equal — which is the silent zero-row answer the #3948 class names (one filter, two answers by backend), on the driver that dev setups and tests default to.What settles it
One measurement on the tree: run a cross-field case from
driver-sql'scross-field-conformance-cases.ts(the same-table$lterow is enough) throughMemoryDriver.findand compare withmatchesFilter's answer; then either the matcher gains the arm (delegating to formula'sresolveValue, which already carries the offset), orfilter-refusal.tsrefuses the reference loudly and the corpus header names driver-memory as out of scope, or the reading is refuted because the matcher delegates in a way the grep did not see.Dedup (22:36Z):
search_issuesover driver-memory matcher findings — the open/closed family (#14079, #13549, #13357, #13494, #13553, #13495, #13524) covers NULL / operator asymmetries, none the$fieldreference.Refs: #14104 · PR #15102 · #5222 / PR #7582 · #3948 (one filter, two answers)