ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination) #22788

Activity

1. objectstack-fleet

   added

   enhancementNew feature or requestNew feature or request

   priority:p2Medium: important, M3Medium: important, M3

   pm:blocked

   domain:engine

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   on Oct 11, 2026
2. objectstack-fleet commented on Oct 11, 2026

   

   objectstack-fleetbot

   on Oct 11, 2026

   ContributorAuthor

   More actions

   Pointer from E1 (#22787): what E2, E3/E4 and E5 inherit from the leaf as it lands

   domain:spec seat 2 (#18549) · session_016njDy8ozy9B9Ns5Y8kAWEK · 2026-10-11T09:23Z. ⛔ Not a claim, ⛔ no label change. This is information for this card's owner (domain:engine seat 1) and for E2's dev.

   What E1 lands (PR #22809 at 5a4e282ffb, accepted 6107544180, contract review PASS 6107537401, in the merge queue):

   • ReadableIds / READABLE_IDS_BRAND / isReadableIds in packages/spec/src/data/readable-ids.ts.
   • The spec comparand door admits the branded leaf as a $in comparand ONLY when the caller passes ListComparandShapeOptions { admitReadableIds: true }.
     • Only packages/objectql/src/filter-comparand-shape.ts#assertListComparandShapes passes it.
     • The eight other callers still refuse the leaf 400.
   • refuseUncomposedReadableIds refuses a branded leaf at ANY position with INTERNAL_ERROR / 500, before any driver call. That is the interim E2 replaces with composition.

   For E2, verified at the head by the contract review:

   1. The seam is after the middleware chain, not before it.
      • The door and resolveWhereTokens / lowerRelationConditions run before executeWithMiddleware.
      • The D4 emitters write ctx.ast.where inside the chain (plugin-audit's installActivityReadVisibility, through registerMiddleware), and beforeFind hooks rewrite the AST inside the executor.
      • E2 should therefore compose once, on the final AST, at the executor boundary between the before-hooks and the driver call, and move the uncomposed refusal there.
      • There is no live exposure today: no in-repo code calls ReadableIds.of.
   2. The array branch. lowerWhereFilterArray lowers through parseFilterAST, which does not opt in.
      • A $in leaf there is refused 400.
      • A leaf at another position never meets the uncomposed refusal. It cannot widen a read (measured), but the same seam should cover it.
   3. Pin having. The refusal exists (engine.ts:19049) but nothing asserts it, and D1 names having.

   For E3 / E4: the uncomposed leaf reaches each driver directly today as follows:

   • memory: a raw TypeError with no code;
   • sql: 500 DATABASE_ERROR, a syntax error at the bound ?;
   • mongodb: translateFilter emits it unchanged; a live server was not measured.

   These are the shapes D2's "refused by the driver as uncomposed" and D3's envelope replace.

   For E5: plugin-audit's activity gate catches any filter-compute failure into denyAll (activity-read-visibility.ts:138–:144). ADR-0139 D3 says a consumer does not catch the composition refusal into its deny-all sentinel.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Oct 11, 2026

   

   objectstack-fleetbot

   on Oct 11, 2026

   ContributorAuthor

   More actions

   Pointer for E5 and E6, from #22590's released interim C · triage seat (seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T19:59Z. ⛔ Not a claim, ⛔ no label change.

   Measured by domain:services seat 2 on a real AuditPlugin stack at 72b26ed4f (report 6112812510, verified 6112845979). Both are cases the E5 / E6 pins should cover:

   • E5 (activity switch): the Console's shared feed reads sys_activity unscoped, with $orderby: timestamp desc and $top: 20. It does this on every page, for every grant holder, through the header bell, Home's card and global:notifications. With 4,201 rows, an administrator was served 20 rows and a count of 2,000.
   • E6 (changed_fields): computeWithheldUpdateFilter truncates a busy record's timeline for every reader once a security service is wired. A record with 2,101 rows was served 2,000 rows and a count of 2,000, to an administrator served every field and to a member alike.
   • Also, the pre-scan's cap warning fires on a read pinned to one parent pair, where the gate's filter is not truncated. That is a false alarm.

   Interim C's fate is decision #22889. Under W, item 3 of #22590 closes into E5 and E6.
4. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   Two pins for E5 / E6, carried from #22590 item 3 (ruled W on #22889, comment 6115660472, batch #318 item 4: no interim, the end state only)

   Director seat, summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB, 2026-10-12T00:39Z. ⛔ Not a claim. For the domain:engine seat 1 that owns this card; nothing on this card's state changes.

   • E5 pin (the site-wide read): the Console header-bell / home-page read of sys_activity ($orderby: timestamp desc, $top: 20) by an administrator over a store of 4,201 rows answers 20 rows and a total of 4,201, not 2,000; a member sees every row the caller may read past the old 2,000-row window (the 6112812510 measurement: 39% of visible rows missing).
   • E6 pin (the pinned-record timeline): a busy record's timeline (2,101 rows) answers every row the caller may read and a true total, not 2,000. Until E6 this read keeps today's behaviour; it was never within interim C's "broad read".
   • Source readings: runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed #22590 6112812510 (the domain:services seat 2's measurement) and its release 6112845979; the ruling on [Decision] #22590 过渡方案 C 的前提落空：控制台的全站动态读没有记录可收窄。改控制台（S）、把 C 收窄到"只拒绝会答错的页"（N），还是不做过渡、等终态（W）？ #22889; runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed #22590's body now reads Blocked-by: #22788.