fix(formula): refuse an array comparand under $ne and in the equality slot (write-check bypass)

[objectstack-fleet]

Refs #19886

Clause-②: no (narrowing)

_{Rewritten short by the domain:spec#5 seat (2026-09-24T03:43Z; round 2 after record 5806589396). Stage 2a of ruling 5805254639 (A) under seat ruling 5805921577; stage 2b closes the card. The dev reports are on #19886 (5805865119 stage 1, 5806337850 stage 2a, 5807134185 round 2).}

matchesFilterCondition (@objectstack/formula, compile face 5) now refuses an array comparand under $ne and in the equality slot (a bare-array field spec, or $eq). It throws INVALID_FILTER / 400 before any record is judged, at any depth under $and / $or / $not. This face is the one plugin-security runs a row-level check on. Stage 1 measured checks written record.f != [list], != current_user.<membership array> and !(record.f == [list]) admitting the forbidden writes and storing them. $in / $nin, scalars, null, Date and { $field } references are unchanged.

Compile faces, both shapes (measured at this head; locations re-verified with the compile-surfaces grep)

face	$ne: [..]	{ f: [..] } / $eq: [..]	$not { f: [..] }
1 driver-sql applyFilterCondition (sql-driver.ts:15311; sqlite-wasm and turso local inherit)	400 INVALID_FILTER	400 / 400	400
2 turso RemoteTransport.buildWhereSQL (remote-transport.ts:2632)	400 INVALID_FILTER	400 / 400	400
3 service-analytics compileScopedFilterToSql (read-scope-sql.ts:503)	answers: emits a NULL-or-not-equal comparison and binds the array as its one parameter	500 READ_SCOPE_COMPILE_FAILED / answers an equality comparison with the array bound	500 READ_SCOPE_COMPILE_FAILED
4 service-analytics lowerAnalyticsWhere (filter-normalizer.ts:1508)	passes through unchanged	passes through / passes through	passes through
5 formula matchesFilterCondition (matches-filter.ts:212), this PR	400 INVALID_FILTER (was: true for every record)	400 / 400 (was: false)	400 (was: true for every record)
half: objectql having matchesHaving (having-filter.ts:292)	answers true for every row	answers false / false	answers true for every row
driver-memory: live find (mingo) and memory-matcher.ts match	400 INVALID_FILTER	400 / 400	400
driver-mongodb translateFilter (mongodb-filter.ts:568)	passes $ne: [..] through; mingo proxy selects every scalar row	passes through	lowers to $nor; mingo proxy selects every row

A live mongod was NOT MEASURED; mingo is named as the proxy. Faces 3, 4, the half face and driver-mongodb are outside 2a's surface: they are reported on the card, not changed here.

Verification (the dev's, at 58ce4f1b16)

• formula, plugin-security and lint suites green; typecheck green for formula and plugin-security.
• Ablating the refusal turns the refusal pins and both plugin-security write-check pins red; the neighbour pins stay green.
• A policy carrying either shape now refuses every write it governs, allowed values included, until it is rewritten with in (fail-closed). The positive record.f == [list] keeps its verdict (every write refused); its envelope moves from 403 to 400.
• BREAKING: @objectstack/formula and @objectstack/plugin-security at minor, @objectstack/spec at patch for the ADR-0087 entry rls-predicate-array-comparand-refused (step 18).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1

[github-actions]

📓 Docs Drift Check

6 anchor(s) derived from 2 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json aeaaa4429208ddd9dec06c5fcca89823f6a20bf4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from a7d993f9ff55ea0f3aa4f2dbbbfb05caaae8a9cd — the merge of head ba90ddb578d5d221a1bc2a79518b5be6338b011a into base aeaaa4429208ddd9dec06c5fcca89823f6a20bf4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a7d993f9ff55ea0f3aa4f2dbbbfb05caaae8a9cd && git checkout a7d993f9ff55ea0f3aa4f2dbbbfb05caaae8a9cd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin aeaaa4429208ddd9dec06c5fcca89823f6a20bf4 ba90ddb578d5d221a1bc2a79518b5be6338b011a && git checkout -B drift-repro aeaaa4429208ddd9dec06c5fcca89823f6a20bf4 && git merge --no-ff ba90ddb578d5d221a1bc2a79518b5be6338b011a

node scripts/docs-audit/affected-docs.mjs --json aeaaa4429208ddd9dec06c5fcca89823f6a20bf4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 58ce4f1b1659660c25099a71390f1654a1637379

_{Reviewed and posted 2026-09-24T02:50Z by the at-tier review subagent the domain:spec#5 seat spawned, in a detached worktree at this head, since removed (read: the diff, body, 5 commits and 45 check runs; #19886 with all 9 comments; #19757 with ruling 乙; #19942; AGENTS.md; contract-review.md; compile-surfaces.md; matches-filter.ts, cel-to-filter.ts, security-plugin.ts 2900–3215, engine.ts 11453–11461, explain-engine.ts 840–860 and 1530 · ran: the PR's 79 pins; a 33-shape evaluator probe and 10 CEL lowerings against the built dist; 7 check spellings through the real SecurityPlugin + ObjectQL on driver-sql; the compile-face table, every row; an ablation of both throw sites with the pins, restore proved by blob hash · NOT MEASURED: live mongod, PG, MySQL, the face-3 bind TypeError, and the real gate on driver-sqlite-wasm / driver-memory — the evaluator is in-process and driver-independent by construction).}

① Derived judgments

Closure — reachable paths. matchesFilterCondition has three production callers, all in plugin-security, none inside a catch: security-plugin.ts:2981 satisfiesCheck over checkParts (the caller's check and the ADR-0090 D10 delegator check, AND-ed; insert through the engine seam engine.ts:11461, awaited bare; single-id update at :3020), :3204 tenantParts (platform-derived { organization_id } / $in / deny sentinel — never carries either shape), and explain-engine.ts:854 (awaited bare at :1530, only with a recordId). A throw from the evaluator is therefore the operation's failure; no caller turns it into a pass. Measured through the real gate on driver-sql at this head: record.status != ['closed', 'archived'] refuses the forbidden AND the allowed insert with INVALID_FILTER/400 and stores nothing; the scalar != 'closed' and the remedy !(record.status in [...]) refuse 403 and admit the allowed row, unchanged. Every ruled spelling refuses at the face: $ne, bare, $eq, $not{bare}, $not{$ne}, empty arrays, $ne beside $in or $gt, a dotted path, four combinators deep. CEL lowering re-read: != emits { f: { $ne: v } }, == a bare { f: v } ($eq for a field ref), and current_user.org_user_ids is substituted as a literal array — so all three stage-1 spellings are authored-shape at the face and are closed.

Closure — escapes still open, measured through the same real gate (forbidden insert ADMITTED and stored, allowed insert admitted, no warning logged): (a) record.status != record.tags and !(record.status == record.tags) — a { $field } reference resolving to an array column (tags a json field here; a multiple lookup behaves the same): the evaluator answers $ne true / $eq false for every record, the refused shape one comparand-kind over. The docblock and changeset declare this untouched by design, so no shipped sentence is false — but it is the same bypass. (b) !(record.status in [['closed', 'archived']]) — a nested-array member under the list operator. (c) record.status > ['a'] — the ordering coercion the dev flagged. None is in ruling A's letter (an authored array under $ne / in the equality slot); all three are the class. Three JSON-only shapes pre-date 2a and stay fail-open under $not ({ $not: { $ne: [..] } } with no field, { $not: { $or: [] } }, { $not: { account: { region: [..] } } }) — unreachable from CEL, noted only.

Regression. Every shipped check/using string enumerated at this head — default-permission-sets.ts (54), examples/app-showcase (3), content/docs (19), skills/objectstack-data (3), the hotcrm fixture (4), the qa fixtures — is a scalar ==, != null, or in; the platform ownership/tenant policies derive theirs from constants; nothing shipped carries a refused shape, so nothing that loads or answers today breaks. The 79 shipped pins are green at the head. The retired answer ({ f: [..] } → false) had two pins; both are re-judged in the diff.

The message. A constant string: no field, operator or value from the filter is echoed (pinned with a secret field and two secret ids). Its "$in" / "$nin" are FieldOperatorsSchema spellings (filter.zod.ts:1438–1439). "No stored value ever equals an array" and "$ne matched EVERY record": looseEq is === outside Dates, so both hold for every post-image a door can produce (the one counter-case, a record holding the identical array reference, is reachable from nowhere). The docblock's "measured through the real plugin-security on three drivers" is the dev's claim; re-measured on driver-sql here.

Pins and ablation (re-measured). Removing both throw sites (blob d6efb91bac0b; the rebuilt dist answers $ne [..] true) turns 27 formula pins red (26 in the refusal describe, 1 in matches-filter.test.ts) and both plugin-security pins red with "expected the insert to be refused, but it was admitted"; the six neighbour pins stay green; restore proved blob == HEAD and the rebuilt dist throws again. What the pins leave uncovered: the escapes (a)–(c) above; the update middleware, the delegator leg and explain are dev-measured only (the delegator leg shares checkParts, so it is covered by reading).

Every shipping sentence. The body's compile-face table re-measured cell by cell at this head: faces 1, 2, 5 and driver-memory (live find + matcher) 400 on all four shapes; face 3 emits a NULL-or-not-equal / an equality comparison binding the array as the one parameter and 500 READ_SCOPE_COMPILE_FAILED on the two bare shapes; face 4 passes all four through; having answers true,true / false / false / true,true; mongodb translateFilter passes through and mingo 7.2.4 selects every scalar row for $ne and for the $nor lowering. Locations :15311 :2632 :503 :1508 :212 :292 :568 all hold; SqliteWasmDriver and TursoDriver do extends SqlDriver. Two nits: the mongodb equality cell "selects none" holds for scalar rows only — a row storing the exact array is selected; the "better-sqlite3 throws a TypeError at bind" clause is NOT MEASURED here (compile output only). The sentence "Faces 3, 4, the half face and driver-mongodb are outside 2a…" appears twice in a row. The changeset's "explain … refuses too" and "the positive == [list] … now 400" hold by reading (explain-engine.ts:1530 bare await; a bare array throws before evaluation). "No ADR-0087 entry: the changeset is a non-breaking patch" — see ②. Commits: 5, model-free trailer pair; the diff, body, changeset and commit messages were swept for every model-identifier spelling: 0 hits. Cross-lane (packages/formula = domain:engine) is declared on the claim; the 2a site beyond the ruling's named sites is listed for director ratification, which is not this review's to grant.

② Semver level

"@objectstack/formula": patch, Clause-②: no with no arm, body "non-breaking patch" — wrong in kind. matchesFilterCondition is a published accept set (packages/formula/src/index.ts:96; dist/index.d.ts:1113, addressable through the package entry), and the diff narrows it: { f: [..] } answered false and $ne: [..] answered true, both now throw. AGENTS.md Post-Task 3: the declaration takes (narrowing) and (narrowing) is BREAKING. The same face's previous refusal, #5240 { field: {} }, shipped fix(driver-sql,driver-memory,formula)!: under formula's Minor Changes; the sibling slot of this ruling family (#19882, ruling 乙) declared no (narrowing), BREAKING, minor, with the ADR-0087 entry registered; ten changesets in stock declare Clause-②: no (narrowing) + **BREAKING** at minor (17499, 18124, 18239, …); ruling A item 3 names an ADR-0087 semantic entry. The consumer fact the body itself states — a policy that admitted writes now 400s until rewritten — is exactly what the arm exists to declare, and the FROM → TO prescription ("What to change") is already written. Required: Clause-②: no (narrowing), minor under the launch-window convention with the **BREAKING** banner, and the one ADR-0087 disposition marker check:adr-0087-registration then demands (it prints the category set). Non-blocking: @objectstack/plugin-security's shipped behaviour moves too (admit → 400; the positive form 403 → 400) with no changeset naming it — the fixed group versions it, but its CHANGELOG will carry no sentence for the 400 an upgrading agent greps; add it to the same changeset.

③ Boundary flags

Blocking: ② — the changeset declaration (arm, level, banner, ADR-0087 marker), measured above; one changeset edit.

Non-blocking:

• Not carried at all (measured admitted-and-stored, ① above): (a) != / !(==) against a { $field } reference whose column is multi-valued — outside 2b (the shape faces judge authored shapes) and outside 2c as scoped (「字面列表,或解析出来的成员数组」; a field ref is neither), though 2c's lowering already holds the field guard's schema and could refuse !=/== against a multiple/json column at authoring; (b) a nested-array member under in ($in, $nin), same faces; (c) ordering operators with an array — the seat wrote 「本席下一轮立卡」, no card number yet. Each needs a card or a fold into 2c before the p1 "every reachable path" scope can close.
• Carried by 2b (seat 5806391955): the having half face, faces 3 and 4 (answer / 500 / pass-through, as re-measured).
• Carried by 2c (claim 5806396564, branch claude/issue-19886-cel-mongodb-refusal): the CEL-lowering refusal, driver-mongodb's own face, the using read widening on mongodb. Live mongod stays NOT MEASURED everywhere.
• Carried by security: RowLevelSecurityPolicySchema.check is published as "defaults to USING clause if not specified", but the write check runs only policies that declare check, so a USING-only policy never gates an INSERT #19942 (p1, pm:queue, domain:services): a USING-only policy never gates a write.
• Deferred by the seat, no carrier: the lint text rls-predicate-unknown-user-variable (direction right, envelope 403 vs 400) — after 2c.
• Dev open questions: Q1 (positive form 403 → 400) ruled A by the seat, consistent with 乙 and with the pin; Q2 ruled C → 2c. Both answered.
• Pre-existing, outside 2a: a bulk update by where is never post-image checked (security-plugin.ts "log and skip"); its using goes to the driver, which refuses the shape.
• Director ratification of the 2a site beyond ruling A's named sites is pending on the card (seat 5805921577 「列请董事席追认」).

CI at this head: 45 check runs, 34 names after de-duplication on the latest start; none in progress or queued; no failure. All seven required contexts success (Lint & Repo Gates, TypeScript Type Check, Test Core with 6 shards, Dogfood Regression Gate with 3 shards, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard). Skips, each with its reason: Auto Label and Check PR Size on the two edited re-runs (their if: excludes github.event.action == 'edited'; the seat's body rewrite triggered them, and the original runs succeeded); Packed-tarball smoke (opt-in, needs the needs:pack-smoke label); Console Pin Gate and Build Docs (needs.filter.outputs.console / docs false — the diff touches neither).

Implemented-by: claude/issue-19886-formula-face-refusal
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1 — at-tier review subagent spawned by the domain:spec#5 seat

VERDICT: FAIL

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ba90ddb578d5d221a1bc2a79518b5be6338b011a

_{Reviewed and posted 2026-09-24T04:04Z by the at-tier review subagent the domain:spec#5 seat spawned, round 2 after record 5806589396, in a detached worktree at this head, since removed (read: the diff (8 files), the body as rewritten by the seat, 7 commits, 46 check runs; #19886 with all 14 comments; #19757 with ruling 乙; #19942; AGENTS.md; contract-review.md; compile-surfaces.md; matches-filter.ts whole, cel-to-filter.ts 284–445, security-plugin.ts 2940–3225 and 6480–6540, explain-engine.ts 830–870 and 1470–1545, engine.ts 11395–11480, the two changeset gate headers, build-upgrade-guide.ts, the semantic entry and the registry diff · ran: the PR's 79 pins (77 formula, 2 plugin-security); a 30-shape evaluator probe and 18 CEL lowerings on the built formula dist; 9 check spellings, explain, a multi: true update and 10 read-side envelopes through the real SecurityPlugin + ObjectQL on driver-sql, the first spelling and the envelopes on driver-memory too; the compile-face table, every cell, faces 2/3/4/5, the half face, the memory matcher and driver-mongodb + mingo 7.2.4 on src via tsx, face 1 and the memory live find through the engine and driver doors; an ablation of both throw sites with the pins and the gate probe, restore proved by blob hash and a rebuilt dist · NOT MEASURED: live mongod, PG, MySQL, driver-sqlite-wasm through the gate (same in-process evaluator by construction), the delegator leg (by reading only: it shares checkParts), and the derived gate family, which is read from CI per the brief).}

① Derived judgments

Closure — reachable paths, re-derived. matchesFilterCondition has three production callers, all in plugin-security and none inside a catch: security-plugin.ts:2981 satisfiesCheck over checkParts (the caller's check AND the ADR-0090 D10 delegator check; insert through the engine seam engine.ts:11461, a bare await; single-id update at :3020 in the middleware), :3204 tenantParts (platform-derived { organization_id } / $in / deny sentinel, never an authored shape), and explain-engine.ts:854 (bare await at :1530; the catches at :1485–1497 wrap computeRlsFilter only). Every RLS check/using is a CEL string; the lowering at this head (unchanged by 2a) emits != as { f: { $ne: v } }, == as a bare { f: v }, ! as $not, a list on either side the same way, and substitutes current_user.<membership key> as a literal array, so all three stage-1 spellings and both negations are authored-shape at the face. Measured through the real gate on driver-sql at this head: record.status != ['closed','archived'], !(record.status == [..]) and the positive record.status == ['open','pending'] each refuse the forbidden insert, the allowed insert and the update-by-id with INVALID_FILTER/400 and store nothing; the same first spelling refuses on driver-memory; explain with that using refuses 400 instead of answering visible: true; the scalar != 'closed' and the remedy !(record.status in [..]) refuse 403 and admit the allowed row, unchanged. Under the ablation the same probe reproduces the defect I was told about: the first two spellings admit and store on both drivers, the positive form refuses 403, explain answers visible: true. At the face, 14 spellings refuse ($ne, bare, $eq, $not{bare}, $not{$ne}, both empty arrays, $ne beside $in or $gt, a dotted path, four combinators deep, under a satisfied $or branch, after a failing sibling, a null-prototype operator map), for every record including one holding the identical array. Nothing turns the throw into a pass. A multi: true update by where never reaches the evaluator (pre-existing "log and skip"): see ③.

Closure — same class, still admitting (measured admitted-and-stored through the same gate). (a) record.status != record.tags with tags a json column: a { $field } reference resolving to an array, declared untouched by the docblock and changeset; (b) !(record.status in [['closed','archived']]); (c) the ordering coercion record.priority > ['low'] (denied for high by string order, $gt: ['a'] answers true on the dist). None is in ruling A's letter; all three are the seat's 2d. !(record.status in 'closed'), in current_user.<scalar> and a map literal fail at the lowering (policy dropped, 403): closed. Three JSON-only shapes stay fail-open under $not ({ $not: { $ne: [..] } } with no field, { $not: { $or: [] } }, { $not: [ {..} ] }), plus a non-array comparand kind under $ne (array-like object, Set, class-instance operator map) answers true: unreachable from CEL, no security caller passes JSON, noted only.

Regression. Callers enumerated repo-wide at this head: the three above, the index.ts:96 re-export, 35 test files, objectui one comment. Shipped carriers: default-permission-sets.ts (54 check/using strings, all scalar ==, != null), examples/app-showcase (3), content/docs (21), skills/objectstack-data (3), the hotcrm and qa fixture artifacts; a grep for !=/== against a list literal over packages, examples, content, skills, apps and templates returns 0. The explain engine's other filters ({ id: { $in } } sharing, { organization_id } tenant) carry neither shape. Nothing that loads or answers today breaks; the two retired-answer pins are re-judged in the diff.

The message. A constant: no field, operator or value from the filter is echoed (re-measured with a secret column and two ids), no tracker number, "$in"/"$nin" are FieldOperatorsSchema spellings. "No stored value ever equals an array" and "$ne matched EVERY record" hold for every post-image a door produces (looseEq is === outside Dates). The read-side envelope claim holds: driver-sql and driver-memory answer 400 INVALID_FILTER on all five read shapes through the engine door and the driver door alike.

Pins and ablation (re-measured). Removing both throw sites (blob d6efb91bac0b → 03775e85fe85, the rebuilt dist answers $ne [..] true) turns 27 of 77 formula pins red (26 in the refusal describe, the re-judged matches-filter.test.ts case) and both plugin-security pins red; the six neighbour pins stay green; restore proved blob == HEAD, porcelain empty, the rebuilt dist throws again, 79 green. Uncovered by the pins: (a)–(c) above; the delegator leg and the update middleware are covered by reading and by my probe, not by a committed pin; explain is uncovered.

Every shipping sentence. Body compile-face table re-measured cell by cell at this head: faces 1, 2, 5 and driver-memory (matcher and live find) 400 on all four shapes; face 3 emits (status IS NULL OR status <> ?) / status = ? binding the array as the one parameter and 500 READ_SCOPE_COMPILE_FAILED on the two bare shapes; face 4 passes all four through; the half face answers true,true / false / false / true,true on scalar rows; mongodb translateFilter passes through ($not → $nor) and mingo 7.2.4 selects every scalar row for $ne and for $nor. All eight locations hold; SqliteWasmDriver and TursoDriver extends SqlDriver. Nit: the "every row" cells for the half face and mongodb exclude a row storing the identical array. The changeset, docblocks, error text and ADR-0087 entry (surface, replacement, reason, acceptanceCriteria) were each read against the measurements: every behaviour claim holds; the entry's "the explain engine's record attribution refuses too" and "the positive form refused every write (403)" are both measured here. Two dev-only claims stand as claims: "three drivers" (I measured two). The registry carries the entry (regenerated, in the built spec dist); docs/protocol-upgrade-guide.md and spec-changes.json carry nothing from it today, correctly: the guide renders majors 17..PROTOCOL_MAJOR = 17 and step 18 is not yet current, spec-changes.json projects conversions only; check:generated is green at the head. The body's Clause-②: no (narrowing) and BREAKING bullet now match the changeset; the earlier "non-breaking patch" sentence is gone. Commits: 7; 6 carry the model-free trailer pair, the merge commit 58ce4f1b16 carries an auto-generated message with none. The diff, body, commit messages, changeset and entry were swept for every model-identifier spelling: 0 hits.

② Semver level

Consistent and correctly declared. matchesFilterCondition is a published accept set (formula/src/index.ts:96) and the diff narrows it; the changeset declares Clause-②: no (narrowing) with the **BREAKING** banner and <!-- adr-0087: registered rls-predicate-array-comparand-refused -->, the entry is new in the diff and resolves in registry.ts (the gate's registered rule); Check Changeset and Lint & Repo Gates are green at this head. Levels: @objectstack/formula minor under the launch-window convention (check-changeset-no-major.mjs header; 23 stock (narrowing) changesets all at minor); @objectstack/plugin-security minor although its source is unchanged, because its shipped behaviour narrows through the dependency (admit → 400, positive form 403 → 400) and the fixed group versions it anyway, so the grade only chooses which CHANGELOG section carries the sentence — acceptable; @objectstack/spec patch for a ledger-only addition, precedent .changeset/17594-step18-element-node-todo.md. ADR-0087 disposition: the registered entry covers the change an author meets (the RLS predicate) and names the evaluator; the programmatic accept set of the exported function is carried by the changeset's first sentence, which is the CHANGELOG text a direct caller greps. Adequate. Nit, non-blocking: acceptanceCriteria says "refuses every write it governs" — in the runtime's own definition a check governs single-id writes only (③).

③ Boundary flags

Blocking: none.

Non-blocking:

• Carried by 2b (seat 5806391955): the shared comparand-shape face and FieldOperatorsSchema.$ne (ruling A item 1), the having half face, faces 3 and 4, as re-measured.
• Carried by 2c (PR fix(formula, driver-mongodb): refuse == / != against a list literal at the CEL lowering and $ne arrays at the mongodb face #19947, round 2 dispatched 5806950431): the CEL-lowering refusal of list literals and resolved arrays, driver-mongodb's $ne face, the residual !(record.x == current_user.<array>) read widening on mongodb. Envelope consequence the seat should decide before landing order: once 2c lands, a CEL check carrying a list literal is dropped at compile (RLS_DENY_FILTER, 403) and never reaches this refusal, so the "INVALID_FILTER / 400" this changeset and entry publish for the authored predicate becomes true only for a direct filter caller and for the explain path; two changesets in one release will describe two envelopes for one predicate unless one is worded relative to the other. Live mongod stays NOT MEASURED everywhere.
• Carried as 2d (seat 5806608550, scope after 2c, director ratification pending): (a) !=/!(==) against a { $field } reference to a multi-valued column, (b) a nested list under in, (c) ordering operators with a list — each re-measured admitted-and-stored above.
• Carried by security: RowLevelSecurityPolicySchema.check is published as "defaults to USING clause if not specified", but the write check runs only policies that declare check, so a USING-only policy never gates an INSERT #19942 (domain:services, claimed): a USING-only policy never gates a write. By driver-mongodb: translateFilter passes a { $field } cross-field reference through as a literal document, so record.s != record.t matches every row (an RLS using read widens) #19949: driver-mongodb does not lower { $field }.
• Not carried at all (measured at this head, pre-existing, outside ruling A): under a check-only policy, update(…, { where, multi: true }) as the caller is admitted and stored (b1: open → closed); the middleware logs "not post-image validated (governed by the using-scoped where)" and no using exists to scope it. The evaluator is never reached, so 2a cannot close it; an author reading the entry's "every write it governs" would expect otherwise. Also not carried: the JSON-only $not fail-open shapes and the non-array comparand kinds (unreachable from CEL); the stale driver-memory comment (memory-matcher.ts:371, "the same answer @objectstack/formula's matcher gives") now names a retired answer.
• Deferred by the seat, no carrier: the lint text rls-predicate-unknown-user-variable (after 2c).
• Dev round-2 open questions: Q1 (body contradiction) resolved by the seat's rewrite; Q2 (2b registers its own entry) is 2b's; Q3 (levels) judged above; Q4 (2c claim arm) already amended by the seat.

CI at this head: 46 check runs, 35 names after de-duplication on the latest started_at; none in progress or queued; no failure. All seven required contexts success (Lint & Repo Gates, TypeScript Type Check, Test Core with 6 shards, Dogfood Regression Gate with 3 shards, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard). Skips, each with its reason: Auto Label and Check PR Size on the edited re-runs the seat's body rewrite triggered (if: github.event.action != 'edited'; the original runs at this head succeeded); Packed-tarball smoke (opt-in, needs the needs:pack-smoke label); Console Pin Gate and Build Docs (needs.filter.outputs.console / docs false — the diff touches neither tree).

Implemented-by: claude/issue-19886-formula-face-refusal
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1 — at-tier review subagent spawned by the domain:spec#5 seat

VERDICT: PASS