diff --git a/‎.changeset/19951-rls-lint-per-request-refusals.md‎
Lines changed: 1 addition & 1 deletion b/‎.changeset/19951-rls-lint-per-request-refusals.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.changeset/20018-native-read-scope-faces.md‎
Lines changed: 2 additions & 2 deletions b/‎.changeset/20018-native-read-scope-faces.md‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.changeset/20212-rls-compiled-filter-comparand-faces.md‎
Lines changed: 40 additions & 0 deletions b/‎.changeset/20212-rls-compiled-filter-comparand-faces.md‎
Lines changed: 40 additions & 0 deletions
diff --git a/‎packages/lint/src/validate-rls-predicate-enforceability.test.ts‎
Lines changed: 12 additions & 8 deletions b/‎packages/lint/src/validate-rls-predicate-enforceability.test.ts‎
Lines changed: 12 additions & 8 deletions
diff --git a/‎packages/lint/src/validate-rls-predicate-enforceability.ts‎
Lines changed: 14 additions & 13 deletions b/‎packages/lint/src/validate-rls-predicate-enforceability.ts‎
Lines changed: 14 additions & 13 deletions
diff --git a/‎packages/plugins/plugin-security/src/rls-compiled-comparand-faces.test.ts‎
Lines changed: 160 additions & 0 deletions b/‎packages/plugins/plugin-security/src/rls-compiled-comparand-faces.test.ts‎
Lines changed: 160 additions & 0 deletions
@@ -14,7 +14,7 @@
 - FROM silent TO `rls-predicate-unenforceable`: `record.f in current_user`, `record.f.startsWith(current_user)`, `.endsWith(current_user)` and `.contains(current_user)`. Name the key that holds the value, for example `record.f in current_user.org_user_ids` or `record.f.startsWith(current_user.email)`.
 - FROM silent TO `rls-predicate-unenforceable`: `record.f.startsWith(current_user.org_user_ids)` (a list handed to a string method). Write `record.f in current_user.org_user_ids`, or pass a one-value key.
 
-**A `null` list member or `null` ordering bound.** The platform refuses both in every filter it is sent. The RLS layer does not run that check on its own filter, so the backend answers with its own semantics: on a SQL driver `record.f in [null]`, `!(record.f in ['a', null])` and `record.f > null` read no rows. Every analytics query over the object is refused.
+**A `null` list member or `null` ordering bound.** The platform refuses both in every filter it is sent. The RLS compiler runs that check on its own filter too (#20212) and drops the policy on every request: reads return no rows and `check` writes are refused 403.
 
 - FROM silent TO `rls-predicate-unenforceable`: `record.f in ['a', null]` and `!(record.f in ['a', null])`. Write `(record.f in ['a'] || record.f == null)`, or drop the `null` member.
 - FROM silent TO `rls-predicate-unenforceable`: `record.f in [null]`. Write `record.f == null`.
 
@@ -40,8 +40,8 @@ each is refused by a standing ruling the shared faces carry. Measured on SQLite:
 analytics face already refused all of them. No in-repo read-scope producer emits
 them for a policy in this repository. An RLS `using` predicate can still be
 written so that it lowers into the null shapes (a literal `null` inside an `in`
-list, or an ordering comparison against `null`), and such a policy now gets the
-withheld 500 on every analytics face.
+list, or an ordering comparison against `null`), but the RLS compiler drops such a
+policy (#20212), so the analytics faces receive the deny sentinel and answer zero rows.
 
 **Fix.** State absence with the null predicate. "One of these values, or no
 value" is `{ "$or": [{ "f": { "$in": ["a"] } }, { "f": { "$null": true } }] }`,
 
@@ -0,0 +1,40 @@
+---
+"@objectstack/plugin-security": minor
+"@objectstack/lint": patch
+---
+
+fix(plugin-security)!: a row-level policy whose compiled filter carries a `null` list member or a `null` ordering bound now fails closed on both clauses, so its read and its write check agree (#20212)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) an enforcement change in the RLS compiler: no authorable key, spelling or stored shape moves, so a stored `sys_metadata` row needs no conversion. The two shapes were ruled at the shared comparand face with no ledger entry, because which explicit spelling matches the author's intent is an authoring decision no migration entry can perform. `os validate` already reports each such predicate (`rls-predicate-unenforceable`) with a rewrite. -->
+
+**BREAKING**: this narrows what a row-level policy grants. A policy that returned rows on a read, or admitted a write, can now return no rows and refuse the write with 403. It ships as `minor` under the launch-window convention for accept-set narrowings.
+
+`RLSCompiler.compileFilter` now runs the platform's two shared comparand faces (`assertListComparandShapes` and `normalizeFilterComparandTypes` from `@objectstack/spec/data`) on every compiled policy filter, for `using` and `check` alike. These are the functions the engine already runs on a caller's own `where`. It runs them before the middleware chain adds the RLS filter to that `where`, so until now a compiled policy filter reached the driver unjudged. A policy they refuse is dropped the way a policy with an unresolved `current_user` variable, or a list under `==`, is already dropped. When no other applicable policy compiles, the clause answers `RLS_DENY_FILTER` and logs one `[RLS] DENY (fail closed)` WARN with `reason: 'refused-comparand'`.
+
+**Why.** The rulings refuse a `null` member of `$in` / `$nin` and a `null` comparand of `$gt` / `$gte` / `$lt` / `$lte` in every filter, because no two backends agree on what they match. On the RLS path they reached the backend, and the `check` clause of the same policy was evaluated in-process by another matcher. One policy then gave two answers. Measured with rows `open`, `closed` and a NULL status:
+
+| predicate | `using` read before, SqlDriver / InMemoryDriver | `check` insert `closed` / `open` before | after, both clauses |
+| --- | --- | --- | --- |
+| `!(record.status in ['open', null])` | the NULL row / the `closed` row | admitted / 403 | no rows, 403 |
+| `record.status in ['open', null]` | the `open` row / the `open` and NULL rows | 403 / admitted | no rows, 403 |
+| `record.status > null` | no rows / no rows | 403 / 403 | no rows, 403 |
+| `record.status <= null`, `record.status in [null]` | no rows / the NULL row | 403 / 403 | no rows, 403 |
+
+On SqlDriver the first row's read hid the `closed` row that its own write check admitted. PostgreSQL answered as SQLite.
+
+**What now answers differently.**
+
+- A read (`find`, `findOne`, `count`) under such a policy returns no rows when no other applicable policy compiles, and logs the WARN. Beside another policy that compiles, this policy no longer contributes rows: the read returns what the other policies grant, with no WARN.
+- A `check` (declared, or defaulted from `using`) refuses every insert and update it governs with the row-level CHECK denial, `403 PERMISSION_DENIED`, when no other applicable `check` compiles.
+- `explain` reports the RLS layer as `denies` instead of `narrows`.
+- Analytics: `getReadFilter` hands the deny sentinel to the analytics faces, which answer zero rows. They previously refused the whole query with `READ_SCOPE_COMPILE_FAILED` / 500.
+
+**Who is affected.** A deployment whose stored policies carry one of these shapes, for example a policy saved without `os validate`. No policy in this repository does: every `using` / `check` string under `examples/` and `packages/` (outside tests) that names `null` is a null check (`== null`, `!= null`), which is unchanged.
+
+**Fix.** Test for no value with `== null` and for a value with `!= null`. "One of these, or no value" is `record.status in ['open'] || record.status == null`. "Has a value" is `record.status != null`. `os validate` prints the rewrite for each finding.
+
+**Unchanged.** A policy whose compiled filter the faces accept compiles to the same filter as before, with the same WARNs. A caller's own `where` carrying these shapes is still refused `INVALID_FILTER` / 400 by the engine. The null checks `record.f == null` / `record.f != null` lower to `$null` and are not refused.
+
+`@objectstack/lint`: the `rls-predicate-unenforceable` finding for a `null` list member or `null` ordering bound now says what the runtime does: the policy is dropped on every request, with the clause's own fail-closed consequence. It used to say the policy survived and the backend answered.
@@ -837,10 +837,10 @@ describe('validateRlsPredicateEnforceability — the refusals the SHAPE check ca
    *    the policy: a `using` read returns zero rows (with only a per-request
    *    "DENY (fail closed)" WARN) and a `check` write is refused with 403.
    *  - NULL comparands — the shared filter faces refuse a `null` list member and
-   *    a `null` ordering bound by ruling. They compile, the RLS layer never runs
-   *    the faces on its own filter, and the backend answers: on driver-sql
-   *    `x in [null]`, `!(x in ['a', null])` and `x > null` read nothing, while
-   *    the `check` evaluator admits a write the negated read hides.
+   *    a `null` ordering bound by ruling. They compile, and `RLSCompiler` runs
+   *    the same faces on the compiled filter (#20212), so it drops the policy
+   *    exactly as it drops a TYPE fault: zero rows with the per-request WARN on
+   *    a `using` read, a 403 on a `check` write.
    */
   const TYPE_FAULTS: ReadonlyArray<readonly [string, string]> = [
     [
@@ -904,10 +904,14 @@ describe('validateRlsPredicateEnforceability — the refusals the SHAPE check ca
     expect(check.message).toMatch(/PermissionDeniedError/);
   });
 
-  it('a NULL comparand is NOT reported as a drop — the policy survives and the backend answers', () => {
-    const [f] = validateRlsPredicateEnforceability(siteWith('using', NULL_COMPARANDS[2][0]));
-    expect(f.message).toMatch(/the policy is NOT dropped/);
-    expect(f.message).not.toMatch(/DROPS the policy/);
+  it('a NULL comparand is reported as a DROP with the clause’s own consequence, as the runtime drops it', () => {
+    const [using] = validateRlsPredicateEnforceability(siteWith('using', NULL_COMPARANDS[2][0]));
+    expect(using.message).toMatch(/DROPS the policy on EVERY request/);
+    expect(using.message).toMatch(/RLS_DENY_FILTER/);
+
+    const [check] = validateRlsPredicateEnforceability(siteWith('check', NULL_COMPARANDS[2][0]));
+    expect(check.message).toMatch(/DROPS the policy on EVERY request/);
+    expect(check.message).toMatch(/PermissionDeniedError/);
   });
 
   it('rewrites EVERY site the fault lands in, in one finding', () => {
 
@@ -815,9 +815,9 @@ const HOLDING_RULE: Readonly<Record<RuntimeHolding, string>> = {
  * The verdict of the shared filter faces on this predicate's LOWERED filter —
  * `assertListComparandShapes` and `normalizeFilterComparandTypes`
  * (`@objectstack/spec/data`), the same pair the analytics read-scope compiler
- * runs on every RLS read scope (`assertReadScopeComparandsRunnable`) and the
- * engine runs on every caller-supplied filter. The RLS data path does not run
- * them on its own filter, which is why a refused comparand gets through there.
+ * runs on every RLS read scope (`assertReadScopeComparandsRunnable`), the
+ * engine runs on every caller-supplied filter and, since #20212, `RLSCompiler`
+ * runs on every compiled policy filter, which drops a policy they refuse.
  *
  * Graded by the refusal's `code` (`INVALID_FILTER`), never by its prose (#6223);
  * the returned message is quoted, never parsed.
@@ -891,16 +891,17 @@ function firstSentence(message: string): string {
 }
 
 /**
- * What a face-refused comparand does at request time. Not a drop: the compile
- * succeeds and the policy's filter reaches the backend unjudged.
+ * How a face-refused comparand is dropped at request time. [#20212]
+ * `RLSCompiler.compileFilter` runs the same two faces on every compiled policy
+ * filter, for `using` and `check` alike, so the policy joins the per-request
+ * denial route before any backend or the in-process `check` evaluator sees the
+ * comparand: the same drop, WARN and per-clause consequence as a TYPE fault.
  */
-const FACE_REFUSED_CONSEQUENCE =
-  'The RLS layer does not pass its own filter through that check, so the policy is NOT dropped: the refused ' +
-  'comparand reaches the backend, which answers it with semantics the platform has ruled undefined — backends ' +
-  'disagree, and on the SQL drivers a `null` member or bound matches no row, so a negated list holding `null` ' +
-  'or an ordering against `null` can admit NOTHING. One policy can even disagree with itself: a `using` read ' +
-  'on a SQL driver hides rows that its `check` evaluator admits on write. Every analytics query over the ' +
-  'object is refused outright, because its read-scope compiler runs the same check.';
+const DROPPED_FACE_REFUSED =
+  'so `RLSCompiler` DROPS the policy on EVERY request: it runs that same check on every compiled policy ' +
+  'filter, before any backend sees it. The shape check passes, so the "uncompilable predicate" WARN is never ' +
+  'logged; the only signal is a per-request "DENY (fail closed)" WARN, emitted only when nothing else ' +
+  'applicable compiles. ';
 
 /**
  * What a reference miss costs at request time, per clause. Measured, not inferred.
@@ -1075,7 +1076,7 @@ function referenceFindings(
       path,
       message:
         `RLS ${clause} \`${quote(source)}\` lowers, but to a comparand the platform's shared filter check ` +
-        `refuses (${firstSentence(faced)}). ${FACE_REFUSED_CONSEQUENCE}`,
+        `refuses (${firstSentence(faced)}), ${consequence(clause, DROPPED_FACE_REFUSED)}`,
       hint:
         rewrites.length > 0
           ? '`null` has no place inside a list or opposite an ordering operator — the platform refuses both in ' +
 
@@ -0,0 +1,160 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#20212] `RLSCompiler.compileFilter` runs the platform's two shared comparand
+ * faces (`assertListComparandShapes`, `normalizeFilterComparandTypes`,
+ * `@objectstack/spec/data`) on every compiled policy filter, for `using` and
+ * `check` alike, with or without a field guard.
+ *
+ * What these pins hold, unit-side (the real-stack half is
+ * `rls-null-comparand-fails-closed.test.ts`):
+ *  1. a policy whose compiled filter the faces refuse is DROPPED onto the
+ *     per-request fail-closed route: alone, the clause answers `RLS_DENY_FILTER`
+ *     and one `DENY (fail closed)` WARN carrying `reason: 'refused-comparand'`;
+ *  2. beside a granting sibling it vanishes from the OR in silence, exactly as a
+ *     per-request refusal does;
+ *  3. every other compiled filter passes through unchanged: the faces add
+ *     nothing to a filter they accept (they return it by reference).
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import type { RowLevelSecurityPolicy } from '@objectstack/spec/security';
+import { compileCelToFilter } from '@objectstack/formula';
+
+import { RLSCompiler, RLS_DENY_FILTER } from './rls-compiler.js';
+
+type WarnCall = [string, Record<string, unknown>?];
+
+function compilerWithLogger() {
+  const warn = vi.fn();
+  const compiler = new RLSCompiler();
+  compiler.setLogger({ warn });
+  return { compiler, warn };
+}
+
+function policy(clause: 'using' | 'check', predicate: string, name = 'status_scope'): RowLevelSecurityPolicy {
+  return { name, object: 'ticket', operation: 'all', [clause]: predicate } as RowLevelSecurityPolicy;
+}
+
+const CTX = {
+  userId: 'u1',
+  tenantId: 'org-1',
+  positions: ['p_sales'],
+  org_user_ids: ['u1', 'u2'],
+  email: 'u1@example.com',
+} as never;
+
+/** The field guard the plugin passes when the schema resolves. */
+const GUARD = { declared: new Set(['id', 'status', 'owner', 'score']) };
+
+const NULL_FAMILY = [
+  "!(record.status in ['open', null])",
+  "record.status in ['open', null]",
+  'record.status > null',
+  'record.status >= null',
+  'record.status < null',
+  'record.status <= null',
+  'record.status in [null]',
+] as const;
+
+describe('[#20212] a compiled filter the shared faces refuse is dropped, fail closed', () => {
+  for (const clause of ['using', 'check'] as const) {
+    for (const guard of [undefined, GUARD]) {
+      for (const predicate of NULL_FAMILY) {
+        it(`${clause} \`${predicate}\` (${guard ? 'with' : 'without'} a field guard) → RLS_DENY_FILTER, one refused-comparand WARN`, () => {
+          const { compiler, warn } = compilerWithLogger();
+
+          const filter = compiler.compileFilter([policy(clause, predicate)], CTX, clause, guard);
+
+          expect(filter).toBe(RLS_DENY_FILTER);
+          expect(warn).toHaveBeenCalledTimes(1);
+          const [message, meta] = warn.mock.calls[0] as WarnCall;
+          expect(message.startsWith('[RLS] DENY (fail closed)')).toBe(true);
+          expect(meta).toMatchObject({
+            object: 'ticket',
+            policy: 'status_scope',
+            clause,
+            reason: 'refused-comparand',
+            filter: RLS_DENY_FILTER.id,
+          });
+          expect(String(meta?.detail)).toContain('INVALID_FILTER');
+        });
+      }
+    }
+  }
+
+  it('beside a granting sibling the refused policy vanishes from the OR, with no WARN, like a per-request refusal', () => {
+    for (const clause of ['using', 'check'] as const) {
+      const results: unknown[] = [];
+      for (const refused of [NULL_FAMILY[0], 'record.status == current_user.positions']) {
+        const { compiler, warn } = compilerWithLogger();
+        const filter = compiler.compileFilter(
+          [policy(clause, refused, 'refused'), policy(clause, "record.status == 'open'", 'sibling')],
+          CTX,
+          clause,
+          GUARD,
+        );
+        results.push({ filter, warned: warn.mock.calls.length });
+      }
+      expect(results, clause).toEqual([
+        { filter: { status: 'open' }, warned: 0 },
+        { filter: { status: 'open' }, warned: 0 },
+      ]);
+    }
+  });
+
+  it('two refused policies deny with one line each', () => {
+    const { compiler, warn } = compilerWithLogger();
+    const filter = compiler.compileFilter(
+      [policy('using', 'record.status > null', 'a'), policy('using', 'record.status in [null]', 'b')],
+      CTX,
+    );
+    expect(filter).toBe(RLS_DENY_FILTER);
+    expect((warn.mock.calls as WarnCall[]).map(([, meta]) => [meta?.policy, meta?.reason])).toEqual([
+      ['a', 'refused-comparand'],
+      ['b', 'refused-comparand'],
+    ]);
+  });
+});
+
+describe('[#20212] CONTROL — a compiled filter the faces accept passes through unchanged', () => {
+  const ACCEPTED = [
+    "record.status == 'open'",
+    "record.status != 'open'",
+    "record.status in ['open', 'pending']",
+    "!(record.status in ['open', 'pending'])",
+    'record.score > 2',
+    'record.score <= 2',
+    'record.score >= 1 && record.score < 5',
+    'record.status == null',
+    'record.status != null',
+    "record.status.startsWith('op')",
+    "record.status.endsWith('ed')",
+    "record.status.contains('lose')",
+    'record.owner in current_user.org_user_ids',
+    '!(record.owner in current_user.org_user_ids)',
+    'record.owner == current_user.id',
+    'record.owner != current_user.id',
+    'record.owner == current_user.email',
+    "record.status == 'open' || record.owner == current_user.id",
+  ];
+
+  for (const clause of ['using', 'check'] as const) {
+    for (const predicate of ACCEPTED) {
+      it(`${clause} \`${predicate}\``, () => {
+        const { compiler, warn } = compilerWithLogger();
+        const compiled = compileCelToFilter(predicate, {
+          variables: {
+            current_user: { id: 'u1', organization_id: 'org-1', positions: ['p_sales'], org_user_ids: ['u1', 'u2'], email: 'u1@example.com' },
+          },
+        });
+        expect(compiled.ok, predicate).toBe(true);
+
+        const filter = compiler.compileFilter([policy(clause, predicate)], CTX, clause, GUARD);
+
+        expect(filter).toEqual(compiled.ok ? compiled.filter : undefined);
+        expect(warn).not.toHaveBeenCalled();
+      });
+    }
+  }
+});