test(plugin-security), docs(formula): re-judge the evaluator-face check pin for the lowering refusal

A CEL check comparing against a list is now dropped at compile, so the
forbidden insert is refused with the row-level CHECK envelope
(PERMISSION_DENIED / 403) before the evaluator's INVALID_FILTER / 400 is
reached. The pin keeps its property (the forbidden insert is refused and
nothing is stored) and asserts the envelope it gets at head. Docblock spans
false at head are cut, in the pin and in matches-filter.ts: the claims that
these CEL spellings lower to the refused shapes, that the refusal
propagates out of the check seam, and that the empty-field constraint is
the evaluator's one throw. No code or error-message change in formula.

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/formula/src/matches-filter.ts

@@ -69,13 +69,13 @@
  * (`{ field: [...] }`, `{ field: { $eq: [...] } }`). It is the one position
  * where this face's answer was not merely silent but the WRONG way round for a
  * write gate: a strict comparison never equals an array, so `$ne` matched EVERY
- * record, and a negated equality (`$not` around `{ field: [...] }`, which is
- * what `!(record.f == [...])` lowers to) did too. On the ADR-0058 D4 `check`
- * that admitted every write the policy was written to refuse, measured through
- * the real `plugin-security` on three drivers. The query faces the read side
- * runs on — driver-sql's unbindable-comparand refusal and driver-memory's
- * array-comparand refusal — already refuse the shape with `INVALID_FILTER` /
- * 400; this face now gives the same envelope. See {@link arrayComparandError}.
+ * record, and a negated equality (`$not` around `{ field: [...] }`) did too. On
+ * the ADR-0058 D4 `check` that admitted every write the policy was written to
+ * refuse, measured through the real `plugin-security` on three drivers. The
+ * query faces the read side runs on — driver-sql's unbindable-comparand
+ * refusal and driver-memory's array-comparand refusal — already refuse the
+ * shape with `INVALID_FILTER` / 400; this face now gives the same envelope. See
+ * {@link arrayComparandError}.
  */
 
 import type { FilterCondition } from '@objectstack/spec/data';
@@ -93,7 +93,7 @@ import { StandardErrorCode } from '@objectstack/spec/api';
 
 /**
  * [#5240] `{ field: {} }` — a field constrained by ZERO operators — is REFUSED,
- * not evaluated, and this is the ONE place this fail-closed evaluator throws.
+ * not evaluated.
  *
  * The shape had three answers in the repo: `driver-sql` refused it at the top
  * level but dropped it inside `$and`/`$or`/`$not` (a predicate that emits
@@ -149,12 +149,9 @@ function emptyFieldConstraintError(field: string, path: string): Error {
  * | `{ f: [...] }` / `{ f: { $eq: [...] } }`| `false`                  |
  * | `{ $not: { f: [...] } }`                | `true`                   |
  *
- * An RLS `check` is authored as CEL, and `record.f != ['a', 'b']` (or `!=`
- * against a `current_user` membership array) lowers to the first row, so every
- * write the policy was written to refuse was admitted and stored. The positive
- * equality row only failed closed by accident, and inverted the moment it was
- * negated. There is no answer here that is right in every polarity — which is
- * the #5240 argument for refusing rather than choosing.
+ * The positive equality row only failed closed by accident, and inverted the
+ * moment it was negated. There is no answer here that is right in every
+ * polarity — which is the #5240 argument for refusing rather than choosing.
  *
  * # What stays exactly as it was
  *

packages/plugins/plugin-security/src/rls-check-array-comparand-refusal.test.ts

@@ -5,19 +5,11 @@
  * (or negates `==` against one) no longer admits the write it was written to
  * refuse.
  *
- * Both CEL spellings lower to a shape the write gate's evaluator
- * (`matchesFilterCondition`, `@objectstack/formula`) could not answer safely:
- *
- *   `record.status != ['closed', 'archived']`    → `{ status: { $ne: [...] } }`
- *   `!(record.status == ['closed', 'archived'])` → `{ $not: { status: [...] } }`
- *
  * It compared strictly, so both matched EVERY post-image and the forbidden
  * insert was admitted and stored — measured through this plugin on driver-sql,
  * driver-sqlite-wasm and driver-memory. The evaluator now refuses both shapes
- * before any row is judged, with `INVALID_FILTER` / 400, and the refusal
- * propagates out of the engine's post-hook check seam: the insert fails and
- * nothing lands. The correct spelling (`!(record.status in [...])`) is what the
- * refusal's remedy points at.
+ * before any row is judged. The correct spelling (`!(record.status in [...])`)
+ * is what the refusal's remedy points at.
  *
  * One pin per spelling, through the real plugin and the real engine, asserting
  * the envelope (never a bare `toThrow()`) and the ground truth off the table.
@@ -114,14 +106,14 @@ describe('[#19886] a row-level check comparing against a list refuses the forbid
     ['`!=` against a list', "record.status != ['closed', 'archived']"],
     ['a negated `==` against a list', "!(record.status == ['closed', 'archived'])"],
   ] as const) {
-    it(`${spelling}: INVALID_FILTER / 400, and nothing is stored`, async () => {
+    it(`${spelling}: nothing is stored`, async () => {
       const { engine, caller, stored } = await bootWithCheck(check);
 
       const err = await refusalOf(() =>
         engine.insert(OBJ, { id: 'ins_bad', status: 'closed' }, { context: caller } as never));
 
-      expect(err.code).toBe('INVALID_FILTER');
-      expect(err.statusCode ?? err.status).toBe(400);
+      expect(err.code).toBe('PERMISSION_DENIED');
+      expect(err.statusCode ?? err.status).toBe(403);
       expect(await stored()).toEqual([]);
     });
   }