fix(driver-sql, driver-turso): every filter-compile refusal goes through the withheld provenance seam, so a read scope refused there names no field or literal (#20039)

[objectstack-fleet]

Fixes #20039

Clause-②: no

What changed

A read scope is the RLS, sharing or tenant predicate that plugin-security (ordinary reads) and service-analytics (ObjectQLStrategy.withReadScope) AND into the caller's where. Both merges mark the scope 'policy' and the caller's own predicate 'author' (#8220, packages/spec/src/data/filter-subtree-provenance.ts). The contract for 'policy': "A refusal raised from inside it keeps the #7929 redaction: identity (INVALID_FILTER / 400) and capability statement on the wire, operands in the server log." The fail direction: "Unmarked or ambiguous ⇒ withheld."

PR #20037 brought four SqlDriver doors under that seam. This PR closes the class: every refusal on SqlDriver's filter-compile path now goes through withheldFilterError with the node it was raised from, and one pin enumerates the builders so that a new one cannot disclose by omission.

The nine SqlDriver builders converted (each of them called unsupportedFilterError directly at base):

builder	the node the seam resolves
icontainsComparandError	the comparand if it is an object, else the field's operator map
likePatternComparandError	the same
danglingLikeEscapeError	the field's operator map
unrenderableTextComparandError	the comparand (an object or array here)
unbindableListMemberError	the member if it is an object, else the list
undefinedComparandError	the nearest object holding the undefined: the node carrying the field, the operator map, or the list
assertFilterNode	the element if it is an object, else the $and / $or list that holds it, or the node carrying $not
unknownLogicalOperatorError	the node CARRYING the key, never its value
filterArrayReachedDriverError	the array itself (it is the where root). Not on the card: the enumeration found it, and it printed the whole array

The walk's refusals need the node that encloses the refused position. The spec's shared walk hands its hooks only a value, a key and a path, so sqlFilterVerdictHooks recovers the node from the path index it already kept for the combinator door (#20020). It adds one map of $and / $or lists, keyed by the combinator key's position. The spec hook signature is unchanged.

Per door, what stays on the wire is the class statement: which kind of refusal fired and the capability sentence. The field, the operator variant ($like vs $ilike, which of the three list operators, which of the five text operators), the comparand, the list index and the filter path go to the server log. 'author'-marked subtrees get the text the door answered before, byte for byte. The source templates are the same literals, now passed as the diagnostic. Code and status are unchanged on every path (INVALID_FILTER / 400), and the set of refused filters is unchanged.

Turso remote transport. RemoteTransport.buildWhereSQL refuses these classes on its own (measured, see below). Its twins now go through withheldRefusal, with the same node rules (refusalNode is refusalSubtree's twin): icontainsComparand, likePatternComparand, danglingLikeEscape, undefinedComparand, uncompilableSubFilter (a non-node $and / $or element or $not operand), undeclaredCombinator (both of its tails share one withheld sentence) and uncompilableWhere (a non-object top-level where). The transport's remaining two refusals that named the field go through too, as a bounded in-place fix within this claim's file surface: emptyFieldFilter, whose driver-sql twin has withheld since #8197, and unsupportedOperator's $between arm. TursoDriver never reaches the $between arm (it lowers $between first). After this, buildWhereSQL has no refusal outside the seam. For six classes the withheld sentence is driver-sql's behind the [RemoteTransport] prefix, pinned through TursoDriver local vs remote.

Measured: H1–H3

H1. The probe (scratch, not committed) ran a real ObjectQL over a real SqlDriver (better-sqlite3), with a first-registered middleware copying plugin-security's merge and marking. It marks the injected scope 'policy' and the caller's verbatim where 'author', then composes { $and: [where, scope] }, or the scope alone when there is no caller where. The scope used distinctive names (policy_stage, PSECRET…). A cell counts as a leak when one of them appears in the response message.

class	base (b76aad5f6f)	this branch
empty $icontains	field	none, field in the log
non-string $icontains	field, comparand	none, both in the log
non-string $like	field, comparand	none, both in the log
$like trailing escape	field, pattern	none, both in the log
object $contains comparand	field, comparand	none, both in the log
object $in member	field, comparand	none, both in the log
undefined comparand (direct, $eq, $in member)	field	none, field in the log
non-node element of $or / $not operand	the literal	none, literal in the log
undeclared node combinator	the key	none, key in the log
scope handed over as an array	whole array (field and literal)	none, both in the log

The policy-scope cells are 13 shapes × {with, without} a caller where, 26 cells in all. All 26 leaked at base and none leak at this branch. The author arm used the same 13 shapes in the caller's own where: 13 of 13 full messages are byte-identical at base and at this branch. (Six of those 13 are refused by the engine's own comparand or where-shape door before any middleware runs, and are identical on both sides for that reason.) Base was measured by the whole-file ablation below, which reverted sql-driver.ts and rebuilt dist/.

H2: the enumeration. A TypeScript-parser walk over sql-driver.ts lists the functions calling unsupportedFilterError directly, and the functions calling withheldFilterError.

• Base: 12 direct callers (grep -c 'unsupportedFilterError(' = 13, including the definition), and 12 seam callers.
• This branch: 3 direct callers (grep 4): the seam itself, the 'author' re-issue in resolveWithheldFilterRefusal, and unresolvableFilterColumnError. That last one is raised from a dialect error after the statement ran, and resolves its own provenance by name (unresolvableColumnProvenance, engine + driver-sql: seven filter-refusal doors ignore the #8220 provenance mark, so a refusal inside a policy read-scope subtree relays the policy field (and some comparands) in its 400: the #7929 redaction is not applied #20020). 21 seam callers (withheldFilterError( grep 22).
• Positive control: the doors PR fix(driver-sql, driver-turso): four filter-refusal doors read the provenance mark before naming a read scope field or comparand (#20020) #20037 converted (retiredFilterOperatorError, unsupportedFilterOperatorError, assertFilterNodeList, nonBooleanNullComparandError, nonBooleanExistsComparandError) are in the base seam set, and its column door is in the direct set.
• The eighth door (H1's PM-grep guess): assertFilterNode is confirmed. The enumeration adds a ninth, filterArrayReachedDriverError.

RemoteTransport: base has 11 direct invalidFilterError callers and this branch 2, the seam and the re-issue. The seam callers go from 5 methods to 13.

H3. Measured on RemoteTransport with a 'policy'-marked where. The transport refuses these on its own, naming 'object.field' and the comparand: $icontains, non-string $like, trailing escape, undefined comparand, non-node $or element and $not operand, undeclared combinator (including a misplaced field operator), non-object where (the whole array), empty operator map, un-lowered $between. An object $contains comparand and an object $in member were already withheld there: both are uncompilableComparand, which #8197 converted. Through TursoDriver in REMOTE mode, toRemoteFilter rebuilds every node, so no mark reaches the transport. Every mark-reading refusal there withholds for every caller, author included. That is pinned as the declared fail-closed cost.

H4: consumer pins. Two sweeps, over test files in packages/, examples/ and apps/:

• Wording grep: the nine author texts' distinctive fragments and the remote twins'. 24 files, of which 9 are outside the three driver packages: driver-memory / driver-mongodb (their own wording) and a packages/spec test (its own). Control: the re-pinned driver-sql / driver-turso files are among the 24.
• Assertion-shaped grep over the test files outside the three drivers that reference a SQL-family driver and INVALID_FILTER: 55 files, 17 of which construct a real SQL-family driver. Every hit is service-analytics' own normalizer or read-scope compiler wording (comparand at … is undefined, normalizeAnalyticsFilterTree), plugin-auth's $regex face-3 pin (the retired door, unchanged here), or a negative assertion.

No consumer pin outside the three driver packages reads these doors' wording. None was changed, and the suites PR #20037's round 2 named are green (below).

Compile surfaces (per references/compile-surfaces.md, located again at this head)

#	face	this PR
1	driver-sql applyFilterCondition (sql-driver.ts:15907); driver-sqlite-wasm and Turso local by inheritance	CHANGED: nine builders, and the class is closed
2	Turso RemoteTransport buildWhereSQL (remote-transport.ts:2667)	CHANGED: seven twin classes plus the empty-operator-map and $between arms; class closed
3	service-analytics compileScopedFilterToSql (read-scope-sql.ts:582)	not touched: outside the claim; its refusals are the withheld READ_SCOPE_COMPILE_FAILED / 500
4	service-analytics lowerAnalyticsWhere (filter-normalizer.ts:1966)	not touched (outside the claim)
5	formula matchesFilterCondition (matches-filter.ts:212)	not touched, not measured
half	objectql applyHaving / matchesHaving (having-filter.ts:279 / :292)	not touched, not measured
—	driver-memory / driver-mongodb	not touched; they do not read the mark, and disclosure there is not measured

Tests

New pins:

• packages/drivers/driver-sql/src/sql-driver-compile-refusal-seam.test.ts, 91 cases:
  • the enumeration (positive control, direct-caller set, seam-caller set equal to the table);
  • 21 builders × {policy, author, unmarked, merged $and in both arm orders}, where the array-root builder has no merged arm. Each row is bound to its builder by the error's own stack;
  • five node-lookup cases.
• packages/drivers/driver-turso/src/remote-transport-compile-refusal-seam.test.ts, 96 cases:
  • the same enumeration over remote-transport.ts;
  • 13 methods plus 7 extra arms under every mark;
  • two node cases;
  • TursoDriver local vs remote: the withheld sentences of six classes are one sentence, and REMOTE withholds an author-marked where.

Per door, the pins assert: policy-marked gives INVALID_FILTER / 400, the error's own keys exactly code,status, no secret in the message, and every secret in the log or sink; author-marked gives the full text, which the policy case logged; unmarked is byte-identical to policy.

Existing pins that read a converted door's full text through an unmarked where. Each now marks it 'author', as a merge boundary marks a caller's own predicate, on a shallow copy where the case is a shared constant:

• driver-sql: filter-refusal-envelope (array cases), not-null-safe, out-of-contract-filter-input, silent-empty-predicate (its finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 comment was updated to say the family is now narrowed too), undefined-comparand-refusal.
• driver-turso: bare-date-routing, boolean-identity, node-operator-refusal, not-operator, top-level-where, undefined-comparand-refusal.
• driver-sqlite-wasm: out-of-contract-filter-input, which also gains an unmarked withheld leg.

Two remote shapes cannot get the author text back, and their pins say so:

• a PRIMITIVE top-level where cannot carry a mark, so it is withheld for everyone and its pin asserts the class statement;
• a refusal raised inside $not resolves against the NULL-safe REWRITE of the operand, which the resolver cannot find under the root. It is withheld even for an author, fail-closed by construction as driver-sql documents for its own $not rewrite. Those pins read the naming half from the diagnostic sink.

turso-local-remote-text-parity.test.ts: a withheld remote answer must still name none of the case's mentions, except the ones the refusal's CLASS statement carries. The class statement is read off the local face's unmarked answer; for the $icontains rows it is $icontains itself.

Suites. Driver suites at 8b4f1bb3ed (after merging main, which brought #20054's turso-driver.ts change), with driver-sql and the driver closures rebuilt:

• driver-sql: 185 files passed, 11 skipped; 2936 tests passed, 170 skipped.
• driver-turso: 68 files, 1606 tests passed.
• driver-sqlite-wasm: 32 files, 606 tests passed.
• typecheck exits 0 for all three. tsc --listFiles counts 1 each for the two new pin files and the changed sqlite-wasm pin.

Consumer suites at ab61f7a832: the same driver code, before the main merge. The merged commits touch no driver-sql path, and in driver-turso only turso-driver.ts (#20054's constructor seam). driver-sql and driver-turso dist/ were rebuilt first.

• plugin-auth: 114 files, 2440 tests passed.
• service-storage: 40 files, 627 tests passed.
• cloud-connection: 30 files, 396 tests passed.
• plugin-dev: 8 files, 80 tests passed.
• connector-mcp: 3 files, 23 tests passed.
• hono: 5 files, 122 tests passed.
• cli unit project (--project unit): 224 files, 3158 tests passed. The integration tier is declared to CI; this diff touches no cli file.
• plugin-security: 133 files, 2648 tests passed.
• plugin-sharing: 37 files, 913 tests passed.
• service-analytics: 120 files, 2689 tests passed.

Ablations. All ran on committed state. Each restore is proved by the blob equal to HEAD and an empty git diff HEAD.

1. sql-driver.ts at the base blob (463b99cf41; marker 1 → 0), driver-sql rebuilt, and ablation-dist-preflight --absent passed. The new seam pin gave 41 failed, 50 passed:

   • red: both enumeration assertions, the 35 policy/author/unmarked/merged cases of the nine builders, and four node cases;
   • green: the positive control, the 12 already-converted builders × 4, and the author-arm node case, which base satisfies by disclosing to everyone.

   The five re-pinned driver-sql files stayed 110/110 green at base, so the author text they read is unchanged. The same run produced the base column of the H1 table. Restored to blob a89054ee3a, rebuilt, and the preflight found the marker in dist/.

2. remote-transport.ts at the base blob (55148ccc94): the remote seam pin gave 67 failed, 29 passed. It imports src, so no build leg was needed.

3. The classifyKey enclosing node replaced with undefined (ablation-replace.mjs, anchor 1 → 0): 3 failed, exactly the unknown-combinator author and merged legs and the direct-undefined node case.

4. The assertNode enclosing replaced with undefined: 4 failed, the non-node element's author and merged legs and the two primitive-inheritance node cases.

5. One builder bypassing the seam (icontainsComparandError calling unsupportedFilterError): 6 failed, both enumeration assertions and its four rows. This is the red a new bypassing builder gets.

Gates

• dispatch-gates --commands --repo objectstack-ai/objectstack at 8b4f1bb3ed (merge base 249172975b, 18 paths) derived 62 families. They are the PM's 55 plus the seven that apply once the changeset exists.
• All 62 exited 0. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET), then 0 after a full turbo run build --filter=./packages/* --filter=./packages/*/* (72 of 72 tasks cached). The other dist-reading families were re-run on that build and exited 0.
• --ran: "62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero)".
• The three roster families under packages/ that the derivation flags as unreadable exited 0: check:authz-resolver, check:error-code-casing and check:filter-alias-parity.
• check-issue-citations --base 249172975b: exit 0, 56 citations resolve.
• check:driver-conformance: "50 covered cell(s), 0 in the DEBT ledger, 0 exempt" at base (b76aad5f6f, read from an archived tree) and at this head. The ledger did not move.
• ESLint (--no-inline-config --format json) on the 17 changed .ts files: 17 files, 0 errors, 0 warnings. eslint.config.mjs sets no parserOptions.project (the printed config for sql-driver.ts is {"ecmaVersion":"latest","sourceType":"module"}), so this diff cannot move a verdict on an untouched file. The repo-wide run is CI's.
• A control-byte scan of the changed files found no hits.

Acceptance notes

• What an unmarked caller loses: its own diagnostic from these nine refusals. It gets the withheld wording with the same code and status. This covers no security plugin, system context, anonymous calls, a where holding a {placeholder} token, and Turso remote mode. A member's plain where under plugin-security is marked 'author' and keeps the full text. The changeset says this.
• The two node-shape refusals inside $not on the remote transport (uncompilableSubFilter, undeclaredCombinator) resolve against the rewritten operand, so they withhold even for an author-marked where. The comparand doors there still answer an author in full. (Narrowed by the seat from contract review 5826632400.) PR fix(driver-sql, driver-turso): four filter-refusal doors read the provenance mark before naming a read scope field or comparand (#20020) #20037's nonListCombinator has the same limitation inside $not. It is fail-closed, and invisible in production, where TursoDriver never hands the transport a mark.
• Two findings are reported to the seat and not fixed here. Both are outside this claim's file surface or class:
  • TursoDriver's remote $between lowering (toRemoteFieldSpec) refuses a non-two-element range with a bare Error carrying no code / status. Local mode answers INVALID_FILTER / 400.
  • A second finding, in RemoteTransport's handling of where keys, is routed to the maintainer. (The seat removed its detail from this body before landing, pending the maintainer's decision.)

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-sql, @objectstack/driver-turso, touching 28 documentable anchor(s).

8 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/drivers.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/data-modeling/index.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/permissions/tenant-audit-census.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/plugins/packages.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/kernel/index.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/kernel/lifecycle.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/objectql/query-syntax.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/objectql/types.mdx (via SqlDriver (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via SqlDriver (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d4c897e0e700d96e29ff8a39e91c85f2a8a30909 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from bed61650d4a4525ab4bf276889f32db16063300c — the merge of head 8b4f1bb3edbd69ec9782d1c998bca7de8df7b686 into base d4c897e0e700d96e29ff8a39e91c85f2a8a30909, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin bed61650d4a4525ab4bf276889f32db16063300c && git checkout bed61650d4a4525ab4bf276889f32db16063300c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d4c897e0e700d96e29ff8a39e91c85f2a8a30909 8b4f1bb3edbd69ec9782d1c998bca7de8df7b686 && git checkout -B drift-repro d4c897e0e700d96e29ff8a39e91c85f2a8a30909 && git merge --no-ff 8b4f1bb3edbd69ec9782d1c998bca7de8df7b686

node scripts/docs-audit/affected-docs.mjs --json d4c897e0e700d96e29ff8a39e91c85f2a8a30909

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d4c897e0e700d96e29ff8a39e91c85f2a8a30909 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8b4f1bb3edbd69ec9782d1c998bca7de8df7b686

Scope: 18 files (+1706/−147) on merge base 249172975b: the refusal seam in driver-sql's sql-driver.ts and in driver-turso's remote-transport.ts, their pins in the three SQL-family drivers, and the changeset. No governed surface is touched.

Read: card #20039 and its comments, #20020 with PR #20037 and its two records (FAIL 5823428898, PASS 5824208109), the PR body, the diff, the seven commits, all 34 check-runs, AGENTS.md, contract-review.md, compile-surfaces.md, filter-subtree-provenance.ts, and the code at head.

Measured in a detached worktree at head with driver-sql, driver-turso, driver-sqlite-wasm and objectql built. The base readings put sql-driver.ts and remote-transport.ts back at their merge-base blobs, then restored them by blob. Every reading was gated on a head-only or base-only marker in dist.

① Derived judgments

• The accept set is unchanged: RIGHT. Three probes ran at base and head on identical inputs, 634 cells in all:
  • SqlDriver directly: 15 door shapes × find / count × 10 mark shapes (unmarked, 'policy', 'author', merged $and in both arm orders, $not nesting, array roots), 286 cells.
  • A real ObjectQL over the same driver, with a middleware copying plugin-security's merge and marking, 76 cells.
  • RemoteTransport with a stub client and a diagnostic sink, 272 cells.
  • In every cell the refused verdict, code and status are identical at base and head (INVALID_FILTER / 400), and no refused transport cell executed a statement.
• Disclosure at head: RIGHT.
  • 388 of the 634 cells are non-author. At base all 388 named the policy's field, comparand, key, list index, path or the whole array. At head none of them names any of these.
  • In every one of the 388 cells, every withheld value is in the driver log (one logger.warn line) or in the transport's sink.
  • The wire keeps only the refusal's class, which names the operator family, never the member that fired. The error's own enumerable keys are exactly code,status in all 634 cells.
• The author's text is byte-equal to base: RIGHT on SqlDriver, and on the transport apart from the declared exceptions.
  • On SqlDriver all 114 author cells, and on the engine all 24 author-arm cells, are byte-identical to base. The five re-pinned driver-sql files pass 110/110 with sql-driver.ts at the base blob.
  • On the transport, 98 of 108 author cells are byte-identical. The 10 that differ are exactly the shapes the body declares fail-closed: uncompilableSubFilter and undeclaredCombinator raised inside an author-marked $not, and a primitive top-level where, which cannot carry a mark.
  • The other doors inside an author-marked $not still disclose to the author. The body's "a refusal raised inside $not … is withheld even for an author" is therefore true of the two node-shape doors, not of every door. This does not move the verdict: it errs in the direction the contract prescribes, and in production toRemoteFilter drops every mark before the transport.
• The card's premise and the ninth door: REAL. At base, through the plugin-security-shaped merge, every one of the eight card doors named the scope's field or literal in the 400 (52 of 52 policy cells) and logged nothing. filterArrayReachedDriverError printed the whole scope array.
• The enumeration pins are real, and the exception list is correct and minimal: RIGHT.
  • The grep counts reproduce: unsupportedFilterError( 13 → 4, withheldFilterError( 13 → 22, invalidFilterError( 13 → 3, withheldRefusal( 7 → 17.
  • The three declared exceptions are the seam itself, the 'author' re-issue in resolveWithheldFilterRefusal, and unresolvableFilterColumnError, which is raised after the statement ran and only through the by-name resolver (engine + driver-sql: seven filter-refusal doors ignore the #8220 provenance mark, so a refusal inside a policy read-scope subtree relays the policy field (and some comparands) in its 400: the #7929 redaction is not applied #20020). None is on the compile path, and there is no fourth direct caller.
  • Ablations on committed state: sql-driver.ts at base gives 41 failed / 50 passed on the seam pin; remote-transport.ts at base gives 67 failed / 29 passed. One builder bypassing the seam gives 6 failed on each side: both enumeration assertions plus that builder's four rows. Restored by blob, both are green again (91/91 and 96/96).
• The changed in-driver pins are faithful. Each re-pinned file marks the caller's where 'author' and keeps its original full-text assertion, with the withheld half pinned in the seam files. At head: driver-sql 201/201, driver-turso 388/388, driver-sqlite-wasm 9/9.
• No consumer pin outside the three drivers reads these doors. The wording sweep over packages/, examples/ and apps/ finds 25 files, 13 of them in the three drivers. The 12 outside assert their own wording (driver-memory, driver-mongodb, packages/spec, the analytics normalizer). Of the 19 test files that construct a real SQL-family driver, none asserts one of the nine texts.
• Public surface: RIGHT. No export, public or protected line moves. packages/spec, every index.ts and every package.json are untouched. The changed builders are module-private or private, and they gain only a trailing optional parameter.
• CI at this head: 34 runs, 29 success, 5 skipped, 0 failures, and all seven required contexts are success.

② Semver level

patch for driver-sql, driver-sqlite-wasm and driver-turso, Clause-②: no: RIGHT.

• The accept set is measured unchanged in 634 of 634 cells.
• No export or signature moves.
• Message text is outside the published accept set (the driver-sql: the #7929 withhold covers the cross-field family only — every other INVALID_FILTER refusal still names the target field, which is admin-authored on a read-scope predicate #8197 and fix(driver-sql, driver-turso): four filter-refusal doors read the provenance mark before naming a read scope field or comparand (#20020) #20037 precedents).
• The three packages share one fixed group, and Check Changeset is success.

③ Boundary flags

• Changeset: every sentence is TRUE.
  • The unmarked-caller paragraph is measured for the no-plugin case. It is carried from fix(driver-sql, driver-turso): four filter-refusal doors read the provenance mark before naming a read scope field or comparand (#20020) #20037's host table for the system, anonymous and placeholder hosts, which this diff does not touch (UNMEASURED this round).
  • "Not changed: which filters are refused, and the code and status of every refusal" is TRUE.
• PR body: TRUE where measured.
  • H1, H2 and H3 are TRUE. H4's conclusion is TRUE (25 / 12 files here against 24 / 9 there, from a broader pattern, with the same result).
  • The compile-surfaces table is TRUE: every face sits at the line the body gives, faces 1 and 2 are changed and closed, and the rest are untouched.
  • The ablation counts are TRUE.
  • The scratch probe was committed and then removed. It is absent at head and from the diff, so a squash landing drops it.
• The $not sentence is stated more broadly than measured: it holds for two node-shape doors, not every door (see ①). Not verdict-moving.
• Both of the dev's out-of-scope findings are REAL.
  • toRemoteFieldSpec throws a bare Error naming 'object.field' for a malformed $between (turso-driver.ts:2009).
  • The second, in the transport's handling of where keys, is measured and was routed to the maintainer. Its detail is left out of this record.
  • Both are outside this claim's class and file surface, and were correctly reported to the seat rather than fixed here.

Implemented-by: claude/issue-20039-refusal-doors-class
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: PASS