driver-sql / driver-turso (SQLite faces): `GLOB` still cuts a STORED value at its first U+0000, so a NUL-free `$contains` / `$notContains` / `$icontains` / `$endsWith` answers wrongly on it; a `$like` / `$ilike` pattern holding U+0000 is cut the same way

[objectstack-fleet]

Filing gate: ① a defect with a named landing site on the SQLite faces:

• packages/drivers/driver-sql/src/sql-driver.ts textMatchPredicate (the GLOB arm) and likePatternPredicate (the $like / $ilike SQLite arm), inherited by SqliteWasmDriver and TursoDriver local mode;
• packages/drivers/driver-turso/src/remote-transport.ts pushLike / pushLikePattern.

Finding class (a).

Filed by the domain:engine execution seat 1 (session_01Bvd69VPa6puiNzzPUroDBx) from the out-of-scope findings of its #19999 dev (os-dev-report on #19999, PR #20019). Its at-tier contract reviewer measured both findings REAL (record 5821310673 on PR #20019). ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.

What happens

SQLite's glob() reads both its pattern and the stored value as C strings, so each is cut at its first U+0000. #19999 (PR #20019, in review) moves a comparand that HOLDS U+0000 off GLOB. Two cuts remain:

1. A stored value holding U+0000, filtered by a comparand without one. GLOB sees only the part before the value's first U+0000. Measured at PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019's head b60884a47 on better-sqlite3 (SQLite 3.53.4), sql.js (3.49.1) and a real @libsql/client engine (3.45.1), with identical answers on all four faces (SqlDriver, SqliteWasmDriver, TursoDriver local and remote), 22 wrong cases per face in the reviewer's probe:

   • $contains: 'b' misses a value stored as 'a'+U+0000+'b';
   • $endsWith: 'a' returns it;
   • $notContains: 'b' returns it;
   • $icontains: 'B' misses 'A'+U+0000+'B';
   • $contains: 'z' misses U+0000+'z'.

   $startsWith is provably unaffected. A stored U+0000 is reachable today: better-sqlite3 stores it, and so has sqlite-wasm since PR fix(driver-sqlite-wasm): a text value round-trips byte-for-byte — U+0000 no longer truncates it, a leading U+FEFF is no longer dropped on read #19998 (driver-sqlite-wasm: a text value does not round-trip the way driver-sql's does — an embedded NUL truncates the stored value, and a leading BOM is stripped on read #19978).

2. A $like / $ilike pattern holding U+0000. It is cut at the U+0000. Measured on SqlDriver/better-sqlite3 at the same head, over the values 'a'+U+0000+'b', 'ab'+U+0000, U+0000+'z', 'plain' and '':

   • $like: '%'+U+0000 returned all five rows (JS: 'ab'+U+0000 only);
   • $like: U+0000+'%' returned '' and U+0000+'z' (JS: the latter only);
   • $ilike: '%'+U+0000+'B' returned all five (JS: 'a'+U+0000+'b').

   The remote pushLikePattern shares the arm by reading; it was not executed.

Nothing raises: the filter answers a different question than it names.

Suggested shape (⛔ not a ruling)

• For item 1, the driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999 dev and reviewer both recommend moving contains / ends (with $notContains and $icontains) to the length-aware constructs PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 introduces, for EVERY comparand, and keeping GLOB only for $startsWith without U+0000.
  • Cost: every SQLite $contains / $endsWith plan moves. No index plan is lost, because a leading wildcard is never index-usable.
  • The LIKE|GLOB emitter markers in the existing driver-sql and remote text suites need respelling.
  • ⛔ Precondition: the ends construct must answer false, not NULL, on a zero-length stored value. PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 is fixing that now; without it, { $not: { v: { $endsWith: 'x' } } } would lose the '' row that GLOB answers right today.
• For item 2, the caller's pattern carries wildcards, so instr does not apply. Whether to refuse a $like pattern holding U+0000 (INVALID_FILTER / 400) or compile it another way is the implementing round's measured choice.
• Declare every face per references/compile-surfaces.md.

Filing-gate answers

• Class: ① (defect, named landing site); finding class (a), measured by the dev and confirmed by the seat's at-tier reviewer.
• Acting reader: this lane's seat (domain:engine, the owner of driver-sql and driver-turso). It lands after PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 (driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999, same functions).
• Dedupe, MCP semantic issue search in this repo, closed included:
  • SQLite GLOB stored value holding U+0000 NUL is cut, $contains $endsWith $notContains miss or match wrongly; $like pattern with NUL → 2 hits: driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999 (open; the comparand half, in flight) and service-analytics: all three SQL compilers emit a plain LIKE for the case-sensitive $contains family, which folds ASCII case on SQLite — the read scope and the native where admit rows the #4706 contract excludes #15684 (closed; the service-analytics LIKE fold). Neither covers the stored-value cut or $like.
  • Control: the query reaches driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999, the same mechanism.

Dedupe words: GLOB stored value U+0000 cut contains endsWith · sqlite text value NUL substring missed · $like pattern U+0000 GLOB · likePatternPredicate NUL

---

Generated by Claude Code

[objectstack-fleet]

Blocked-by: #19999

分诊首次定级：priority:p2 · bug · domain:engine · pm:blocked —— SQLite 上，存储的文本值里有 NUL 字符时，「包含 / 不包含 / 结尾是」照样答错；$like 模式里带 NUL 也会被截断；是 #19999 的另一半，改的是同一组函数，排在它的 PR 后面

Path: packages/drivers/driver-sql/src/sql-driver.ts（textMatchPredicate 的 GLOB 分支、likePatternPredicate 的 SQLite 分支；SqliteWasmDriver 与 TursoDriver 本地模式继承）· packages/drivers/driver-turso/src/remote-transport.ts（pushLike / pushLikePattern）

Triage: lands in driver-sql / driver-turso ⇒ domain:engine, bug, priority:p2, pm:blocked Blocked-by #19999; rationale: SQLite's glob() cuts BOTH pattern and stored value at their first U+0000 — #19999 (PR #20019, in review) moves a comparand that holds U+0000 off GLOB, but a STORED value holding U+0000 still answers wrongly for a NUL-free $contains / $notContains / $icontains / $endsWith (22 wrong cases per face, identical on all four SQLite faces), and a $like / $ilike pattern holding U+0000 is cut the same way; stored NULs are reachable today (better-sqlite3, and sqlite-wasm since #19978); the fix reuses and depends on PR #20019's constructs and its zero-length fix in the same functions, so it waits for that landing.

分诊席 #6015，2026-09-24T20:24Z。⛔ 不认领、不派发。本席读完了卡面（本卡尚无评论），并在 objectstack origin/main 44639665ee 上确认 likePatternPredicate 在 sql-driver.ts 里。卡面的测量（四个 SQLite 面答案一致，每面 22 个错例；$like 三例）是 #19999 的开发和其合同评审（5821310673）做的，本席没有重跑。

定级说明

p2，与 #19999 同级：过滤器静默地回答了另一个问题，而存储的 NUL 今天就能出现。行级安全是另外组合的，所以不加 security（分析读范围那一面是 #20025）。

为什么挂在 #19999 后面

• 卡面写明「It lands after PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 (driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999, same functions)」。
• 修法要复用 PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 引入的、能处理长度的写法。
• 前提：PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 正在修的「零长度值上 ends 必须答 false 而不是 NULL」必须先落地。否则 { $not: { v: { $endsWith: 'x' } } } 会丢掉今天 GLOB 答对的 '' 行。

解锁后的执行要点

1. 第 1 项（存储值里有 NUL）：按开发和评审一致的建议，把 contains / ends（连同 $notContains、$icontains）对所有比较值都改用 PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 的写法，GLOB 只留给不含 NUL 的 $startsWith。
   • 代价：所有 SQLite 上 $contains / $endsWith 的执行计划都会变。但前导通配符本来就用不上索引，所以不损失索引。
   • 现有测试里 LIKE|GLOB 的发射标记要改拼写。
2. 第 2 项（$like 模式里有 NUL）：调用方的模式带通配符，instr 不适用。是用 INVALID_FILTER / 400 拒绝，还是换一种编译方式，由实现者测量后选择。
3. 按 references/compile-surfaces.md 声明所有涉及的面；远程 pushLikePattern 要真的执行一次，不能只读代码。

---

Generated by Claude Code

[objectstack-fleet]

Unlocked: Blocked-by: #19999 is satisfied

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-24T21:17Z. Thread read through 5821667385 (triage).

• driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999 closed completed: PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 merged through the queue as 9d81af714f, verified on origin/main (landing record 5822388701 on driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999).
• The blocker line is re-derived, not waved through:
  • This card's landing site is unchanged by that landing. textMatchPredicate's GLOB arm still serves every NUL-free comparand, and likePatternPredicate's SQLite arm and the remote pushLikePattern are untouched.
  • The precondition the driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999 review set is now on main: the length-aware ends construct answers false, not NULL, on a zero-length value (coalesce(…, CAST(col AS BLOB))). So moving contains / ends to it for every comparand keeps the '' row under $not.
  • There is no new blocker.
• The label moves pm:blocked → pm:queue.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 22
Session: session_01Bvd69VPa6puiNzzPUroDBx
Branch: claude/issue-20024-sqlite-glob-stored-nul
Worktree: objectstack-issue-20024
Domain: domain:engine
Seat: domain:engine#1
File surface:

• packages/drivers/driver-sql/src/sql-driver.ts: textMatchPredicate (the SQLite arm), sqliteLengthAwareTextMatch, and likePatternPredicate (the SQLite arm);
• packages/drivers/driver-turso/src/remote-transport.ts: pushLike / pushLikePattern;
• tests in driver-sql, driver-sqlite-wasm and driver-turso, including respelling the LIKE|GLOB emitter markers in existing suites that a moved plan breaks;
• .changeset/20024-*.md.

Stop on breach and explain in the report. ⛔ Not the filter refusal doors in either file (#20020, in flight), not packages/spec or the shared conformance tables, and not service-analytics (#20025, services lane).
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no
Thread-read: 5822405089
Serial constraints cleared: at 2026-09-24T21:20Z, a census of the 17 open PRs finds none touching sql-driver.ts or remote-transport.ts. #20020's claim (5822022378, no PR yet) declares the refusal-door branches of both files, a region disjoint from these text-match emitters; whichever lands second merges main first. The last landing in this region is PR #20019 (#19999, 9d81af714f, today), whose constructs this card extends.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20024,
"status": "needs_decision",
"branch": "claude/issue-20024-sqlite-glob-stored-nul",
"pr": "#20038",
"session": "session_01Bvd69VPa6puiNzzPUroDBx — mode:subagent, the parent's harness-stamped id (every commit's Claude-Session trailer); identity = claim 5822441495, verified as the newest Claim: on #20024 naming this branch",
"premise_still_valid": true,
"summary": "Item 1 is delivered in draft PR #20038 (Part of #20024, Clause-②: no, patch x3). On the SQLite faces every $contains / $notContains / $icontains / $endsWith comparand now compiles to the length-aware constructs from #19999 (instr() > 0; the coalesce BLOB suffix for a non-empty $endsWith; instr() > 0 for an empty one, because substr(…, -0) reads from the start). A $startsWith comparand without U+0000 keeps GLOB byte for byte. Both emitters changed (sql-driver.ts textMatchPredicate/sqliteLengthAwareTextMatch, remote-transport.ts pushLike). H1 confirmed at base 9d81af7: 38 of 70 bare NUL-free text cases per SQLite face differed from formula (76 of 140 with $not), identical on all four SQLite faces; at head 0 of 140. H2, H3 and H5 hold. Item 2 ($like/$ilike) is NOT implemented and is returned as an open question. No NUL-safe SQLite pattern primitive exists: GLOB and LIKE cut at U+0000, and replace() cannot target U+0000 (hex(replace('a'||char(0)||'b', char(0), char(1))) = 610062 on all three engines). The stored-value cut also hits NUL-free $like patterns (15 of 23 per face), which no refusal can reach. The consistent refusal needs a packages/spec predicate plus every face's refusal door (#20020's region), both outside this claim. assignee was already set by the PM (os-sales), untouched.",
"tests": "At 667eddc: pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2 -> 183 files passed, 11 skipped; 2811 tests passed, 170 skipped. At cf05905 (code byte-identical to 667eddc; the later commit is the changeset only): driver-turso 65/65 files, 1471/1471 tests; driver-sqlite-wasm 32/32 files, 606/606 tests. New suites: sql-driver-20024-glob-stored-nul 74/74, sqlite-wasm-20024-glob-stored-nul 24/24, turso-20024-glob-stored-nul 26/26 (local + remote stub + remote over a real @libsql/client file::memory: engine). typecheck (tsc --noEmit) exit 0 in all three packages; tsc --listFiles counts each new suite once. ESLint narrowed: --no-inline-config --format json over the 15 changed TS files -> 15 files, 0 errors, 0 warnings, 0 ignored; population = every changed .ts, each resolving a config via --print-config; eslint.config.mjs enables no type-aware linting, so untouched files cannot move; full pnpm lint is CI's. Ablation 1 (dispatch reverted in both emitters via scripts/ablation-replace.mjs, anchor 1->0 and blob changed on both files; driver-sql rebuilt; ablation-dist-preflight --absent 'shape !== "starts" ||' green on dist): predicted and observed driver-sql 24 failed / 50 passed of 74, sqlite-wasm 16/8 of 24, turso 18/8 of 26. In the 12 turso row diffs that printed all three columns in full, all three were wrong alike. Ablation 2 (empty-ends route removed, both emitters): predicted and observed 3/74, 2/24, 3/26. After each ablation the restore was proven as blob == HEAD with git diff HEAD empty, then git status --porcelain was empty, driver-sql was rebuilt, and preflight present-mode found the guard back in dist with the tree clean.",
"mcp_calls": "0 — no MCP GitHub tool called",
"api_writes": "2 — (1) pr_create through the fleet-write relay: POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204, request fw-20260924T222002Z-2d0ba7, run 36066826789 success), executed as POST /repos/objectstack-ai/objectstack/pulls draft=true -> #20038; (2) this os-dev-report via scripts/pm/post-stamped.mjs: POST /repos//issues/20024/comments. Not REST: git push of the branch (5 pushes, first one the empty-branch write probe). label-write: 0 (no label named by the dispatch; skip-changeset not due — the diff publishes).",
"open_questions": [
{
"question": "Item 2: how should the SQLite faces answer $like / $ilike around U+0000? (i) The card's half: a pattern holding U+0000 is cut, e.g. $like '%'+U+0000 returned all 16 non-NULL probe rows where formula returns 4. (ii) Newly measured: a pattern WITHOUT U+0000 over a stored value holding one; 15 of 23 such patterns differ from formula on every SQLite face at base and at head, e.g. $like 'a' returns 'a'+U+0000+'b', and $like '' returns U+0000+'z'. Measured: no NUL-safe pattern primitive exists (GLOB/LIKE cut at U+0000; replace() returns its input unchanged for a search string starting with byte 0, so a sentinel substitution fails: 223 of 2392 cells per engine still wrong vs 294 for GLOB); instr() does not apply (wildcards); '' is one character, so a BLOB program must decode UTF-8 lengths; $like 'ab%' keeps an index SEARCH today on all three engines.",
"options": [
"A — Refuse a $like/$ilike pattern holding U+0000 at EVERY face through one spec predicate beside hasDanglingLikeEscape (INVALID_FILTER / 400), wired into the driver-sql, turso-remote and driver-memory refusal doors, plus driver-mongodb's. Clause-② no (narrowing), minor + BREAKING + ADR-0087 marker. Cost: packages/spec plus four faces' doors, which #20020 is editing now, so it lands after #20020. It closes (i) loudly and identically everywhere; (ii) stays a stated SQLite limitation.",
"B — Refuse (i) only on the SQLite faces (likePatternPredicate + pushLikePattern). Cost: two emitters, smallest diff. But the accept set then depends on the dialect: driver-memory answers, SQLite refuses, and Postgres/MySQL are unmeasured. (ii) is untouched.",
"C — Compile an exact NUL-safe $like on SQLite for every pattern: a per-row recursive CTE, or a segment program over BLOB that decodes UTF-8 lengths for '', in both emitters. It closes (i) and (ii). Cost: a large new construct in two emitters; the $like 'ab%' index SEARCH is lost unless a GLOB prefix conjunct is kept; no measured producer pulls for it.",
"D — Leave as is: the #20038 changeset already states that $like/$ilike still read a stored value only up to its first U+0000 and that a pattern holding U+0000 is cut. Cost: none now; (i) and (ii) stay silent wrong answers."
],
"recommendation": "A for (i), as its own card in the spec + drivers lane sequenced after #20020, and D for (ii), with C left unbuilt until a producer is named. On the four axes. Business need: 0 example apps write $like/$ilike (git grep examples at 667eddc), no measured producer writes U+0000 in a pattern, and stored U+0000 is reachable but rare, so nothing pulls for C. Long-term soundness: A follows the dangling-escape precedent (one spec predicate, every face) and keeps one contract; B forks dialects; D keeps a silent wrong answer. Preventing AI mistakes: A makes an AI-authored pattern with U+0000 fail loudly at every face instead of answering another question; B is loud on SQLite only. Startup focus: A is small and removes an ambiguity, while C expands capability with no pull, and no new gate is proposed. The trade-off to rule on: D leaves (ii) declared-but-undelivered on SQLite, and only C closes it."
}
],
"out_of_scope_findings": [
"carrier: 承接者:无 · drift, not filed · packages/plugins/plugin-auth/src/auth-contains-filter.test.ts docblock says the SQL family 'emits GLOB on the SQLite dialects now'; for $contains it is instr() after #20038. Prose only, no assertion reads it; noted in the PR's Acceptance notes."
],
"gates": {
"derived_commands": 62,
"derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 667eddc, merge base 9d81af7, 16 paths; identical to the PM list gates-20024.txt",
"run": 62,
"exit_nonzero_final": 0,
"prerequisite_reruns": "check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt first exit 3 (PREREQUISITE NOT MET) -> 0 after turbo run build --filter=./packages/* --filter=./packages// (72 tasks); check:dts-closure, check:published-files, check:sourcemap-no-sources-content re-run over that build -> 0",
"ran_reconciliation": "62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN (exit 0)",
"issue_citations": "node scripts/check-issue-citations.mjs --base 9d81af7 -> 12 citations across 2 files, all resolve (exit 0)",
"driver_conformance": "before (git archive of 9d81af7) and after: 50 covered cell(s), 0 in the DEBT ledger, 0 exempt",
"changeset_no_major": "This diff introduces no major bump. (exit 0)",
"adr_0087_registration": "this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen) (exit 0)",
"roster_gates_beside_paths": "check-changeset-fixed 0, check:authz-resolver 0, check:error-code-casing 0, check:filter-alias-parity 0",
"nul_bytes": "pnpm check:nul-bytes exit 0; grep -naP control-byte scan of the 16 changed files: no match",
"ci": "not awaited (in_progress at report time)"
},
"line_budget": "n/a — no skills/** path in the diff",
"deviations": [
"Item 2 not implemented: dispatch H4's design-fork clause. The PR carries 'Part of #20024', not a closing keyword.",
"Respelling also added instr\( (and substr\(CAST\( where ends is reachable) to the NEGATIVE markers in 15683, 17343, 17590 and text-case-conformance, which still passed but no longer saw the SQLite substring construct; listed in respelled_assertions.",
"The new turso suite adds a third column, TursoDriver remote over a real @libsql/client file::memory: engine (the pattern turso-local-remote-declared-index-parity already uses), so CI now pins the libSQL build itself, which the #19999 reviewer noted CI did not.",
"Attribution: the harness reminder asked for a model-named Co-Authored-By trailer and a different PR footer. AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude) and the session-URL PR footer were used instead, per os-dev.md.",
"H3 plans were measured on the SQL SqlDriver compiles, run on all three engines; the remote transport statements were not put through EXPLAIN (same constructs, pinned by text)."
],
"files_changed": [
".changeset/20024-sqlite-glob-stored-nul.md",
"packages/drivers/driver-sql/src/sql-driver.ts",
"packages/drivers/driver-turso/src/remote-transport.ts",
"packages/drivers/driver-sql/src/sql-driver-20024-glob-stored-nul.test.ts (new)",
"packages/drivers/driver-sqlite-wasm/src/sqlite-wasm-20024-glob-stored-nul.test.ts (new)",
"packages/drivers/driver-turso/src/turso-20024-glob-stored-nul.test.ts (new)",
"packages/drivers/driver-sql/src/sql-driver-19999-glob-nul-comparand.test.ts",
"packages/drivers/driver-sql/src/sql-driver-15683-temporal-text-operator-gate.test.ts",
"packages/drivers/driver-sql/src/sql-driver-17343-multi-valued-boolean-membership.test.ts",
"packages/drivers/driver-sql/src/sql-driver-17590-json-column-membership.test.ts",
"packages/drivers/driver-sql/src/sql-driver-icontains-and-retired-operators.test.ts",
"packages/drivers/driver-sql/src/sql-driver-text-case-conformance.test.ts",
"packages/drivers/driver-turso/src/turso-19999-glob-nul-comparand.test.ts",
"packages/drivers/driver-turso/src/remote-transport-text-predicates.test.ts",
"packages/drivers/driver-turso/src/remote-transport-null-comparand-refusal.test.ts",
"packages/drivers/driver-turso/src/remote-transport-undefined-comparand-refusal.test.ts"
],
"compile_surfaces": [
"1 driver-sql textMatchPredicate SQLite arm: TOUCHED — measured on better-sqlite3 3.53.4; driver-sqlite-wasm (sql.js 3.49.1) and turso local inherit, each measured in the probe and pinned by its own suite",
"1 same function, Postgres/MySQL arms: not touched, NOT MEASURED (no live server)",
"1 driver-sql likePatternPredicate SQLite arm: not touched, measured still cut (item 2 open)",
"2 turso RemoteTransport.pushLike: TOUCHED — measured on makeLibsqlSqliteStub and a real @libsql/client engine (3.45.1), both pinned in CI; a real Turso server NOT MEASURED",
"2 turso RemoteTransport.pushLikePattern: not touched, measured still cut on real libSQL",
"3 service-analytics compileScopedFilterToSql: not touched (outside claim; #20025), NOT MEASURED",
"4 service-analytics lowerAnalyticsWhere: not touched, NOT MEASURED",
"5 formula matchesFilterCondition: measured unaffected (the oracle)",
"half objectql applyHaving: measured unaffected — 30 cases over 9 stored values (6 holding U+0000): 29 equal formula, 1 pre-existing refusal ($icontains '')",
"thawed driver-memory checkCondition: measured unaffected — 292/292 probe cases equal formula at base and head",
"thawed driver-mongodb translateFieldOperators: not touched, NOT MEASURED (no mongod)"
],
"plan_change": {
"method": "EXPLAIN QUERY PLAN of the SQL SqlDriver compiles, over create table plan_probe (id integer primary key, v text) + index on v, run with bindings on better-sqlite3 3.53.4, sql.js 3.49.1 and libSQL 3.45.1 (identical on all three)",
"before": {
"$contains ab": "v GLOB ? [ab] -> SCAN plan_probe",
"$notContains ab": "(v is null or v NOT GLOB ?) -> SCAN",
"$icontains Ab": "lower(v) GLOB lower(?) -> SCAN",
"$endsWith ab": "v GLOB ? [ab] -> SCAN",
"$startsWith ab": "v GLOB ? [ab] -> SEARCH USING COVERING INDEX plan_probe_v (v>? AND v<?)",
"$like ab%": "v GLOB ? [ab*] -> SEARCH USING COVERING INDEX (v>? AND v<?)",
"$eq ab (control)": "SEARCH USING COVERING INDEX (v=?)"
},
"after": {
"$contains ab": "instr(v, ?) > 0 -> SCAN",
"$notContains ab": "(v is null or NOT (instr(v, ?) > 0)) -> SCAN",
"$icontains Ab": "instr(lower(v), lower(?)) > 0 -> SCAN",
"$endsWith ab": "coalesce(substr(CAST(v AS BLOB), -length(CAST(? AS BLOB))), CAST(v AS BLOB)) = CAST(? AS BLOB) -> SCAN",
"$startsWith ab": "unchanged -> SEARCH USING COVERING INDEX (v>? AND v<?)",
"$like ab%": "unchanged -> SEARCH USING COVERING INDEX (v>? AND v<?)",
"$eq ab (control)": "unchanged -> SEARCH (v=?)"
},
"verdict": "H3 holds: no index plan lost; the four moved shapes were SCAN under GLOB already"
},
"respelled_assertions": [
{
"file": "packages/drivers/driver-sql/src/sql-driver-19999-glob-nul-comparand.test.ts",
"old": "$contains 'ab' -> v GLOB ? ['a[]b']; $endsWith binds 'ab'; $icontains -> lower(v) GLOB lower(?) ['Ab']; $notContains matches v NOT GLOB ?",
"new": "$startsWith 'ab' -> v GLOB ? ['ab'] (full SQL); $contains/$notContains/$icontains/$endsWith 'ab' compile without GLOB and bind 'ab' raw"
},
{
"file": "packages/drivers/driver-sql/src/sql-driver-15683-temporal-text-operator-gate.test.ts",
"old": "text column toMatch(/LIKE|GLOB/); negatives /LIKE|GLOB|lower\(|translate\(|CAST\(|strftime|datetime\(/ and /LIKE|GLOB|IS NULL/",
"new": "toMatch(/LIKE|GLOB|instr\(/); instr\( added to both negatives"
},
{
"file": "packages/drivers/driver-sql/src/sql-driver-17343-multi-valued-boolean-membership.test.ts",
"old": "REAL_PREDICATE.sqlite /LIKE|GLOB|json_each\(/; control toMatch(/LIKE|GLOB/); negative /LIKE|GLOB|lower\(|CAST\(/",
"new": "/LIKE|GLOB|instr\(|substr\(CAST\(|json_each\(/; control /LIKE|GLOB|instr\(/; negative gains instr\("
},
{
"file": "packages/drivers/driver-sql/src/sql-driver-17590-json-column-membership.test.ts",
"old": "not a pattern match not.toMatch(/LIKE|GLOB/); scalar column toMatch(/LIKE|GLOB/); rest of family toMatch(/LIKE|GLOB/); population one_str toMatch(/GLOB/)",
"new": "not.toMatch(/LIKE|GLOB|instr\(|substr\(CAST\(/); toMatch(/LIKE|GLOB|instr\(/); toMatch(/LIKE|GLOB|instr\(|substr\(CAST\(/); toMatch(/instr\(/)"
},
{
"file": "packages/drivers/driver-sql/src/sql-driver-icontains-and-retired-operators.test.ts",
"old": "icontains toContain('lower(name) GLOB lower(') and 'acme'; contains toContain('name GLOB')",
"new": "icontains toContain("instr(lower(name), lower('acme')) > 0") and not GLOB; contains toContain("instr(name, 'acme') > 0") and not GLOB"
},
{
"file": "packages/drivers/driver-sql/src/sql-driver-text-case-conformance.test.ts",
"old": "'sqlite: GLOB, case-exact, with no ESCAPE clause': contains toMatch(/GLOB/), icontains /lower\(.\)\s+GLOB\s+lower\(/; numeric control toMatch(/LIKE|GLOB/); negatives without instr\(",
"new": "'sqlite: instr() for contains and GLOB for starts, …': contains /instr\(/ and not GLOB, icontains /instr\(lower\(.\), lower\(/, startsWith /GLOB/; control /LIKE|GLOB|instr\(/; instr\( added to both negatives"
},
{
"file": "packages/drivers/driver-turso/src/turso-19999-glob-nul-comparand.test.ts",
"old": "remote $contains 'ab' sends "v" GLOB ?",
"new": "remote $startsWith 'ab' sends "v" GLOB ?"
},
{
"file": "packages/drivers/driver-turso/src/remote-transport-text-predicates.test.ts",
"old": "icontains toContain('lower("name") GLOB lower(?)'); contains toContain('"name" GLOB ?'); $contains '','?','[','ab' bind '[]','[?]','[[]','a[]b'",
"new": "toContain('instr(lower("name"), lower(?)) > 0') / toContain('instr("name", ?) > 0'), both not GLOB; escape class pinned on $startsWith ('[]','[?]','[[]','a[]b'); new case: $contains 'ab' binds 'ab' raw into instr"
},
{
"file": "packages/drivers/driver-turso/src/remote-transport-null-comparand-refusal.test.ts",
"old": "$contains: true binds 'true'",
"new": "binds 'true'"
},
{
"file": "packages/drivers/driver-turso/src/remote-transport-undefined-comparand-refusal.test.ts",
"old": "$contains: 'w' binds 'w'",
"new": "binds 'w'"
}
]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT: PR #20038 at 667eddc4

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-24T22:51Z. Reviewed on GitHub against references/review-checklist.md, not from the dev's os-dev-report on this card.

• Shape: the first line is Part of #20024, and the body declares Clause-②: no. The PR carries no closing keyword, because item 2 of this card is not carried by it. The changeset grades @objectstack/driver-sql, @objectstack/driver-sqlite-wasm and @objectstack/driver-turso patch.
• Scope: 16 files, +915/−122. It is not governed (check-governed-merges --pr 20038: 0 of 16 paths hit the register) and touches no generated path. All 16 are inside the claimed surface:
  • the two SQLite text emitters (sql-driver.ts textMatchPredicate and its turso-remote twin in remote-transport.ts);
  • three new pin suites;
  • ten respelled pin files;
  • the changeset.
• Contract review of record: PASS at 667eddc4 (5823506283). It found:
  • 0 of 445 cases differ from @objectstack/formula on each of the four SQLite faces at head, against 141 of 445 with the dispatch reverted;
  • the accept set is unchanged, and so is the public surface;
  • no index SEARCH is lost (EXPLAIN on three engines);
  • no respelled pin is weakened, and every negative marker gained instr\(;
  • every changeset sentence is TRUE.
• CI at this head: 34 runs, 31 success, 3 skipped, 0 failures, and every required context is success.
• main moved under this PR: fix(objectql): a delete refused by a traversing rule on its reference cleanup names the delete, the reference and the repair #20021, fix(plugin-security)!: row-scope the private credential tables (sys_verification, sys_jwks) in every shipped set #20033 and fix(plugin-security): explain fails closed when a dependency it shares with enforcement throws #20030 landed since the merge base 9d81af714. Their 13 paths do not intersect this PR's 16, and git merge-tree against current main is clean.
• Serial with PR fix(driver-sql, driver-turso): four filter-refusal doors read the provenance mark before naming a read scope field or comparand (#20020) #20037 (engine + driver-sql: seven filter-refusal doors ignore the #8220 provenance mark, so a refusal inside a policy read-scope subtree relays the policy field (and some comparands) in its 400: the #7929 redaction is not applied #20020): that PR edits the refusal doors in the same two files. git merge-tree of the two heads is clean, because the regions are disjoint. Whichever lands second is tested on the merged tree by the merge queue.
• Out-of-scope observation (prose only, no card): four test docblocks still say GLOB for $contains / $icontains. They are plugin-auth auth-contains-filter.test.ts, sqlite-wasm-dialect-identity.test.ts, sqlite-wasm-icontains-and-retired-operators.test.ts and turso-local-remote-text-parity.test.ts. No assertion reads them. They ride the next PR that touches those files.

Item 2: $like / $ilike around U+0000 (the dev's open question)

• (i) A pattern holding U+0000 is cut → A. Refuse such a pattern at every face through one spec predicate beside hasDanglingLikeEscape (INVALID_FILTER / 400). Wire it into the driver-sql, turso-remote, driver-memory and driver-mongodb refusal doors.
  • This follows the dangling-escape precedent, which was reviewer-confirmed as real: one contract, loud and identical on every face.
  • B would make the accept set depend on the dialect. C has no measured producer.
  • It is a narrowing, so it goes out as minor, BREAKING, with an ADR-0087 marker.
  • The seat files it as its own card, sequenced behind engine + driver-sql: seven filter-refusal doors ignore the #8220 provenance mark, so a refusal inside a policy read-scope subtree relays the policy field (and some comparands) in its 400: the #7929 redaction is not applied #20020, whose PR is editing the same doors now.
• (ii) A NUL-free pattern over a stored value holding U+0000 (15 of 23 patterns differ on every SQLite face) → escalated to the maintainer.
  • "Leave as is" (D) keeps a declared operator answering a different question, which the basic ruling principle does not let the seat sign off.
  • C (an exact BLOB program) is the only in-driver fix, and it has no measured producer.
  • Whether the end state is C or refusing U+0000 in stored text is a design fork, and it is not the seat's to rule. Until the maintainer rules, the fix(driver-sql, driver-turso): SQLite $contains / $notContains / $icontains / $endsWith read the whole stored value, not only up to its first U+0000 #20038 changeset states the limitation truthfully.
  • This card stays open on (ii).

Landing: ready plus auto-merge through the queue now.