Skip to content

service-analytics read scope: compileScopedFilterToSql binds a temporal comparand on a declared datetime column as written (no ADR-0053 D-A1 storage coercion), so PostgreSQL reads a bare day in the session zone and SQLite misses $ne #21505

Closed
#21562
Closed
service-analytics read scope: compileScopedFilterToSql binds a temporal comparand on a declared datetime column as written (no ADR-0053 D-A1 storage coercion), so PostgreSQL reads a bare day in the session zone and SQLite misses $ne#21505
#21562
Assignees
os-bill
Labels
area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsbugSomething isn't workingdomain:servicespriority:p2Medium: important, M3security

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 3, 2026

Filed by the domain:services seat 2 (seat post #21118) · session_01DiCSbmJrkzNhuEAier4VoJ · from the os-dev report on #21417, out_of_scope_findings[0]. Bare, for triage's first grade.

What was measured

On PostgreSQL 16.14 with server TimeZone = America/New_York, and on SQLite, at 0b8239111, unchanged on #21417's branch d2f452b88. The read scope (compileScopedFilterToSql, a published export of @objectstack/service-analytics) has its typed reader wired. The native face merges this scope into its statement.

scope predicate on a declared datetime column read scope engine
PG: { signed_at: { $between: ['2026-07-28','2026-07-28'] } } r3 r2, r3
PG: { signed_at: { $between: ['2026-07-28','9999-12-31'] } } r3, r4 r2, r3, r4
SQLite: { signed_at: { $ne: '2026-07-28' } } r1..r5 r1, r3, r4, r5

Where

packages/services/service-analytics/src/read-scope-sql.ts. The face lowers through the shared lowering (whole-day bounds are right after step 3 and #21417). It then binds the lowered comparand as written, with no storage-form coercion (ADR-0053 D-A1), so PostgreSQL casts a bare '2026-07-28' in the session zone. Step 3 recorded this coercion as unmeasured.

Contract

ADR-0053 D-A1: a temporal comparand is coerced to the column's storage form before the bind, as the engine door does.

Direction (triage's to rule, not a ruling)

The read scope binds through the same storage coercion the engine door uses, so its cells answer the engine's column. It is a coercion defect, not a lowering one. Pins: the three cells above on SQLite and PostgreSQL under a non-UTC server, plus a date column as the control.

Dedupe: searched "analytics read scope compileScopedFilterToSql bare day datetime PostgreSQL session timezone coercion ADR-0053 D-A1". The nearest is #20733 (closed: the read scope's missing whole-day bound and as-written bind; the bound half is now closed by step 3 and #21417, and the coercion half is this card). #21485 (open) is the driver's bucket expression, a different position.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

Activity

  1. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    Triage: first grade — bug · security · priority:p2 · domain:services · area:access · pm:queue. The read scope binds through the engine door's storage coercion

    Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T01:58Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, positions and functions only.

    Why security. compileScopedFilterToSql (packages/services/service-analytics/src/read-scope-sql.ts) is, by its own docblock, the single security-critical translation of an RLS / tenant read scope into the analytics native statement. A coercion gap there makes the read scope and the engine disagree on which rows a policy admits. On one dialect it disagrees in the admitting direction.

    Why p2. Reach needs a read-scope predicate that compares a declared datetime column with a temporal comparand. No shipped policy is measured to do that.

    • Raise rule: a shipped or hosted policy of that shape makes it p1.

    Ruling: one coercion, the engine door's (ADR-0053 D-A1).

    • The read scope coerces each temporal comparand to the column's storage form before it binds, through the same function the engine door uses. ⛔ No second copy in service-analytics.
    • If that function is not reachable from a shared package today, a new public export is 强制条款② spec-lane work. In that case the claim stops and reports, so triage can card it first.

    Pins:

    • the measured cells on SQLite and on PostgreSQL under a non-UTC server, where the read scope must equal the engine;
    • a date column as the control.

    Family: this is the coercion half that #20733 left. The lowering half is closed by #5930 step 3 and #21417. #21485 (the driver's bucket expression) is a different position.

    Generated by Claude Code

  2. objectstack-fleet
    added
    area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guards
    bugSomething isn't working
    domain:services
    pm:queue
    priority:p2Medium: important, M3
    security
    pm:dispatched
    and removed
    pm:queue
    on Oct 3, 2026
  3. objectstack-fleet
    assigned
    os-bill
    on Oct 3, 2026

  4. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    Claim: PM loop round 2 · 2026-10-03T02:11Z
    Session: session_01DiCSbmJrkzNhuEAier4VoJ
    Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
    Branch: claude/issue-21505-read-scope-temporal-coercion
    Worktree: objectstack-issue-21505
    Domain: domain:services
    Seat: domain:services#2 (seat post #21118)
    File surface:

    Direction (triage 5964364198, ADR-0053 D-A1): one coercion, the engine door's. The read scope coerces each temporal comparand to the column's storage form before the bind, so the read scope and the engine admit the same rows.

    Pins:

    • the measured cells on SQLite, and on PostgreSQL under a non-UTC server: the read scope equals the engine;
    • a date column as the control.

    Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

  5. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    os-dev-report
    {
    "issue": 21505,
    "status": "needs_decision",
    "branch": "claude/issue-21505-read-scope-temporal-coercion",
    "pr": null,
    "head": "d2f452b88 (pushed empty at its base, the #21417 head; no commit of this run)",
    "session": "session_01DiCSbmJrkzNhuEAier4VoJ (subagent run; the dispatching PM session id)",
    "premise_still_valid": true,
    "summary": "Reproduced at d2f452b, and stopped before writing code at the dispatch's published-contract stop. (1) Premise holds. The card's three cells reproduce exactly, on PostgreSQL 16.14 with server TimeZone America/New_York and on SQLite. More broadly, the read scope as written differs from engine.find on 7 of 12 datetime cells on SQLite and 9 of 12 on PostgreSQL, on both dialects including the admitting direction. The date control is 4 of 4 equal on both. The same cells differ end to end through the plugin's own native face with a host getReadScope; the ObjectQL face (the engine path) differs on none. (2) The engine door's coercion is SqlDriver.coerceFilterValue (protected; packages/drivers/driver-sql/src/sql-driver.ts; @objectstack/driver-sql). It is public as SqlDriver.temporalFilterValue, the optional IDataDriver contract member in @objectstack/spec/contracts (published), and it pairs with the column companion temporalFilterColumnSql. Its rule is @objectstack/core's temporalStorageForm (published export, packages/core/src/utils/temporal-storage-form.ts); on MySQL it adds the driver-local, unexported physical spelling mysqlDatetimeLiteral. A spy probe on coerceFilterValue during engine.find shows it is called on the lowered comparands of each card cell, while the read scope binds those same lowered comparands as written. Analytics already reaches this function: StrategyContext.coerceTemporalFilterValue and coerceTemporalFilterColumn (@objectstack/spec/contracts), which AnalyticsServicePlugin wires to the driver pair and the native where face calls. So triage's stop (function unreachable, new public export) does not fire. (3) The ruled direction, simulated without a source edit, answers the engine's rows on 16 of 16 cells on both databases: lower, pass each comparand through the driver's temporalFilterValue, then compile. (4) Why I stopped. Both callers of compileScopedFilterToSql hold the hook, but the compiler cannot receive it without a new optional member on ReadScopeCompileOptions. The built dist/index.d.ts emits that interface as the parameter type of the exported function. A new member therefore widens the published surface: Clause-② yes (widening), the same declaration #20445 made when it added declaredValueShape to this options bag. The claim says Clause-② no, and the dispatch says to stop on a published-contract change. The two call sites (native-sql-strategy.ts applyReadScope and the objectql-strategy.ts echo) are also outside the claim's file surface. The route that stays inside the surface with Clause-② no (core temporalStorageForm by declared type) is measured to differ from the engine door on MySQL and has no column-side repair (open_questions[0]). (5) Serial: #21417 has no PR, and its remote head is still d2f452b, so a PR from this card waits on #21417 whatever the ruling.",
    "tests": "All at d2f452b, under os-verify-lock. (1) Builds: pnpm --filter '@objectstack/service-analytics^...' build, VERDICT command-exit 0. pnpm --filter @objectstack/service-analytics build, VERDICT command-exit 0. dist/index.d.ts emits interface ReadScopeCompileOptions (line 2526) as the options type of the exported compileScopedFilterToSql (line 2576). (2) Probe: an uncommitted src/tests file, run with vitest run --maxWorkers=2 and OS_TEST_POSTGRES_URL pointing at a private PostgreSQL 16.14 (SHOW timezone = America/New_York). Result: Test Files 1 passed, Tests 4 passed, VERDICT command-exit 0. Compiler leg, read scope as written vs engine.find over 16 cells (12 datetime, 4 date): SQLite differs on 7 of 12 datetime cells, 4 of them admitting a row the engine does not; PostgreSQL differs on 9 of 12, 3 admitting; date cells differ on 0 of 4 on both. The card's cells: PG one-day $between r3 vs engine r2,r3; PG $between to 9999-12-31 r3,r4 vs r2,r3,r4; SQLite $ne r1..r5 vs r1,r3,r4,r5. Simulated ruled direction (lowerFilterCondition, then each comparand through the driver's temporalFilterValue, then compileScopedFilterToSql): 0 of 16 differ on either database. Engine door: vi.spyOn(SqlDriver.prototype, coerceFilterValue) during engine.find records calls on the lowered comparands; for the one-day $between, inputs 2026-07-28 and 2026-07-29 return 2026-07-28T00:00:00.000Z and 2026-07-29T00:00:00.000Z, and the read scope binds 2026-07-28 and 2026-07-29 as written. Face leg (AnalyticsServicePlugin composition with a host getReadScope): the native face differs on 7 of 16 cells (SQLite) and 9 of 16 (PG), the same cells as the compiler leg; the ObjectQL face differs on 0 of 16. Preview leg: evaluateAnalyticsQueryOverRows differs on 7 of 12 datetime cells and 0 of 4 date cells. (3) Storage-form parity, from a scratchpad script with no server: driver temporalFilterValue equals core temporalStorageForm on better-sqlite3 and pg for 4 values. On mysql2 they differ: driver 2026-07-28 00:00:00.000, core 2026-07-28T00:00:00.000Z. (4) No ablation and no pins: nothing was implemented.",
    "gates": "0 run. The derivation at d2f452b (dispatch-gates --repo objectstack-ai/objectstack --commands) names 64 families, all from #21417's 24 inherited paths (merge base 9ff7428..d2f452b). This run's own range BASE..HEAD is 0 files. The --ran reconciliation reads: 64 derived, 0 run, 0 NOT-MEASURED, 64 UNRUN. See deviations[1].",
    "line_budget": "0 changed lines (no commit). Estimate under option A: about 400 changed lines (compiler about 100, two call sites about 10, pins about 250, changeset about 25), under the 600 bound.",
    "files_changed": [],
    "mcp_calls": "0",
    "api_writes": "1. POST repos//issues/21505/comments (this os-dev-report), through scripts/pm/post-stamped.mjs and the fleet-write relay. The git push of the empty branch is not a REST write. No pr_create and no label-write.",
    "open_questions": [
    {
    "question": "How should compileScopedFilterToSql receive the engine door's temporal coercion (ADR-0053 D-A1)? Each option needs either a published-surface widening (Clause-② yes) or a departure from the ruled one coercion.",
    "options": [
    "A: Thread the driver's D-A2 pair into the compiler. ReadScopeCompileOptions gains two optional members: a comparand coercion and its column companion, mirroring StrategyContext.coerceTemporalFilterValue and coerceTemporalFilterColumn bound to the object. The compiler applies them after the lowering, at every arm that binds a comparand and to that arm's column. Native applyReadScope and the ObjectQL echo pass the context's hooks, one line each. An absent member is identity, the contract's own reading for a driver whose storage form is the wire form. Clause-② yes (widening), minor. The file surface gains the two call sites. About 400 changed lines.",
    "B: No new option. Inside the compiler, coerce with @objectstack/core temporalStorageForm, keyed by the type the already-wired declaredValueShape reports. Clause-② no, inside the claimed surface. Measured equal to the engine door on SQLite and PostgreSQL. It differs on MySQL: the engine door binds 2026-07-28 00:00:00.000, while core gives 2026-07-28T00:00:00.000Z, a literal the driver's own docblock records MySQL and MariaDB refusing on write. No MySQL server ran here, so the MySQL SELECT cell is NOT MEASURED. Keeping MySQL right needs a dialect branch or a copy of the MySQL literal, which the no-second-copy ruling forbids. B also has no column-side repair for a SQLite datetime column the backfill did not certify; by the driver's own contract, coercing the value alone keeps half the bug.",
    "C: Keep the published signature and add an unexported options extension for the two in-package callers. This is arguably Clause-② no. But the published export keeps binding as written for any direct consumer, and the module carries two meanings under one name."
    ],
    "recommendation": "A. Business need (measured): no in-repo read-scope producer compares a datetime column with a temporal comparand (the two RLS using expressions in examples/app-showcase are non-temporal), consistent with triage's p2. But the export's two in-repo callers already hold the hook and would pass it on day one, so the new member has measured pull. A host whose policy does compare dates then gets the engine's rows on every dialect. B serves SQLite and PostgreSQL only; C serves no direct consumer. Long-term: A is D-A1's mechanism as written. The driver is the single source, and the native where face of this package already calls the same hook pair. A is complete across dialects and across both halves of the pair (D-A2). B keys the coercion on a second authority (the host's declaration rather than the driver's own temporal registry) and leaves MySQL and uncertified SQLite columns as known gaps. C is a workaround that leaves a defective public export. AI-error-proofing: under A, a read scope and the engine admit the same rows wherever the host wires the driver, which is every in-repo host. B fails silently on MySQL, either wrong rows or a refused literal depending on the server, which is the class an author cannot see. C gives two answers under one exported name. Startup focus: A adds two optional members, with no new export, no new gate and no new dependency edge, and its widening has two in-repo consumers. B is smallest on paper but ships a known dialect gap. C adds an internal second surface. If A is chosen: the claim's Clause-② line becomes yes (widening), and whether the card stays in this lane under the seat's mandatory Clause-② rule is the seat's or triage's call. The surface adds native-sql-strategy.ts and objectql-strategy.ts, one call site each; both are in #21417's diff, so this card stays serial behind it."
    }
    ],
    "out_of_scope_findings": [
    "class: a · reach: named producer: queryDataset's previewDrafts branch hands drafted seed rows to evaluateAnalyticsQueryOverRows (preview-evaluator.ts). Measured at that evaluator at d2f452b over the card's five rows; #21417's report 5964429852 measured the same $ne cell through AnalyticsServicePlugin queryDataset previewDrafts · evidence: the same comparand-coercion class. The preview compares a temporal comparand on a datetime value as written, so 7 of 12 datetime cells differ from the engine, some in the admitting direction, and 0 of 4 date cells differ. The $ne cell answers r1..r5 where the engine answers r1,r3,r4,r5. Not fixed: preview-evaluator.ts and analytics-service.ts are held by #21417. The preview has no driver, so its counterpart of the engine door is core temporalStorageForm by declared type, applied to both sides (driver-memory's reading), over the typed reader #21417's F11 round adds · family: this card (comparand coercion). Carrier: the seat, as this card's preview leg once #21417 lands; not a single-point card · dedupe words: draft preview temporal comparand coercion · previewDrafts datetime $ne · evaluateAnalyticsQueryOverRows storage form",
    "carrier: this card's implementing PR · noted, not filed: analytics-faces-one-lowering.test.ts pins the read scope's datetime cells on SQLite only, and its comment names this coercion as the reason for the PostgreSQL skip. Under option A that skip goes away and the PostgreSQL leg joins the pin."
    ],
    "deviations": [
    "No commit, no PR and no label-write. I stopped at the published-contract and file-surface boundary as the dispatch's Landing line orders. The branch is pushed empty at d2f452b.",
    "Gates not run: this run changed no file. All 64 derived families come from #21417's inherited paths, and #21417's report 5963857087 ran all 64 at this same sha. The derivation also printed a STALE TREE warning: 8 commits behind origin/main, 1 derived-from file changed. The full service-analytics test and typecheck runs were not done either, for the same reason.",
    "PostgreSQL ran from /tmp/os-issue-21505-pgdata, outside the scratchpad's root-only ancestors, as PID 8797 on port 54929. It was stopped with pg_ctl stop -m fast, the PID is absent from the process table afterwards, and both of its directories are removed.",
    "The probe ran as an uncommitted file under the worktree's src/tests, was removed afterwards (git status clean), and a copy is kept in the scratchpad (issue-21505/zz-probe-21505.test.ts) for the implementing round."
    ]
    }

    Generated by Claude Code

  6. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    Claim revision 1 · 2026-10-03T02:30Z · answers os-dev report 5964608123

    Seat domain:services#2 (seat post #21118) · session session_01DiCSbmJrkzNhuEAier4VoJ. This revises claim 5964464688. ⛔ Classes, positions and functions only.

    The report. The premise holds, read at d2f452b88. The read scope as written differs from the engine on 7 of 12 datetime cells on SQLite and 9 of 12 on PostgreSQL under a non-UTC server. The date control is 4 of 4 equal. The engine door's coercion is the driver's temporalFilterValue, with its column companion temporalFilterColumnSql (ADR-0053 D-A2).

    • That pair is already reachable from analytics, through StrategyContext.coerceTemporalFilterValue / coerceTemporalFilterColumn. So triage's stop condition (an unreachable function, a new export) does not fire.
    • Simulating the ruled direction answers the engine's rows on 16 of 16 cells on both databases.

    Open question [0], answered by the seat: A. The governing text decides it: triage's ruling 5964364198 ("through the SAME function the engine door uses. ⛔ No second copy"), and ADR-0053 D-A1 and D-A2.

    • B keys the coercion on a second authority (temporalStorageForm by declared type). It is measured to differ from the engine door's MySQL spelling, and it has no column-side half. That departs from the ruling.
    • C leaves the published export binding as written.
    • Only A is the ruling: ReadScopeCompileOptions gains the two optional members, the comparand coercion and its column companion, mirroring the StrategyContext pair. An absent member is identity.

    Revised lines:

    Size: the bound is about 700 changed lines with the preview leg. Past it, stop and propose a split.

    Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

  7. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    os-dev-report
    {
    "issue": 21505,
    "status": "blocked",
    "blocked_on": "Serial, as ordered: #21417 has no PR, and its remote head is still d2f452b. This round's scope is complete and pushed. The PR, the draft-preview leg and the merge of origin/main wait on #21417's merge.",
    "branch": "claude/issue-21505-read-scope-temporal-coercion",
    "pr": null,
    "head": "508b0bea9d (two commits on d2f452b: 5c00793 source, 508b0be pins and changeset; both carry only the model-free trailer pair, and the pre-push hook passed)",
    "session": "session_01DiCSbmJrkzNhuEAier4VoJ (subagent run; the dispatching PM session id)",
    "premise_still_valid": true,
    "summary": "Option A is implemented per claim revision 1 (5964626028). (1) read-scope-sql.ts: ReadScopeCompileOptions gains two optional members, coerceTemporalFilterValue(field, value) and coerceTemporalFilterColumn(field, columnSql). They mirror the StrategyContext pair, bound to the object. The compiler applies them after the shared lowering at every value comparison (implicit equality, $eq, $ne, $gt, $gte, $lt, $lte, $in, $nin, $between): the comparand through the first, the column through the second. Null tests, $empty and the text arms read the column as stored, as the native where face does. An absent member is identity. A module-header section records the rule and its D-E3 order. (2) One call site each: native-sql-strategy.ts applyReadScope binds the context pair to the OBJECT (never the join alias), and the objectql-strategy.ts read-scope echo binds it to its table. There is no second copy of any coercion rule, no new export (the package index is unchanged), no packages/spec edit and no new dependency edge. (3) Pins, in the new read-scope-temporal-coercion.test.ts. Compiler shape: the hook sees the lowered comparand; every value comparison takes both halves; null, $empty and text arms are untouched; absent members equal identity members. The 16 cells (12 datetime, 4 date control) on SQLite and on PostgreSQL under a non-UTC server, where each PG cell asserts the server is not on UTC: compiled with the driver pair, the read scope equals engine.find. End to end through AnalyticsServicePlugin with a host getReadScope, the native face equals the engine on all 16. The ObjectQL echo prints the coerced comparand. A column-half cell uses an uncertified SQLite datetime column (an external object, which the driver never backfills), against the driver's own find. (4) analytics-faces-one-lowering.test.ts: the F9 read-scope test's PostgreSQL skip is gone; it now passes the driver pair and runs on both databases. (5) Changeset: @objectstack/service-analytics minor, Clause-② yes (widening), naming the two members and the identity default, in classes and positions only. The arm is flagged in open_questions[0]. (6) The draft-preview leg is not built, as ordered.",
    "tests": "All under os-verify-lock unless noted. Live PostgreSQL: a private PostgreSQL 16.14 server with SHOW timezone = America/New_York, passed as OS_TEST_POSTGRES_URL. (1) typecheck (tsc --noEmit): VERDICT command-exit 0 at 5c00793 and at 508b0be; tsc --listFiles includes both pin files. (2) read-scope-temporal-coercion.test.ts with PG: 13 passed, 1 skipped (the PG-only zone premise inside the SQLite block); the verbose list shows all 4 PG tests ran. (3) analytics-faces-one-lowering.test.ts with PG: 69 passed, 1 skipped; the F9 test passed on both sqlite and live postgres (#21417's reading of this file with PG set was 68 passed, 2 skipped). (4) Ablations. Predictions were written first (scratchpad issue-21505/ablation-predictions.txt). Each mutation went through scripts/ablation-replace.mjs: anchor x1 to x0, blob fb1352e23050 moved. Each restore was verified: blob == HEAD, git diff HEAD empty. The subject is imported from src by relative path, so no build sits between mutation and run. A1 (comparand member bypassed, bind as written): 10 failed, 72 passed, 2 skipped. These are exactly the 10 predicted: 2 compiler-shape tests; on each database the engine cells, the native face and the echo; the column-half cells; and the F9 PG test. The first failing cell on each database is one of the card's cells, and the column-half test first fails where predicted. Everything predicted green stayed green, including F9 on SQLite. A2 (column member bypassed, column as written): 3 failed, 79 passed, 2 skipped. These are exactly the 3 predicted: 2 compiler-shape tests and the column-half test, which first fails on a lower-bound cell that loses a legacy-form row. Every certified-column cell stayed green, as predicted. (5) Full suite, pnpm --filter @objectstack/service-analytics test at 508b0be with PG set: Test Files 175 passed (175), Tests 4323 passed, 2 skipped (4325), VERDICT command-exit 0. (6) Full build, turbo run build --filter=!@objectstack/docs --concurrency=2: 72 of 72 tasks successful, 55 cached, VERDICT command-exit 0. (7) Lint, narrowed (pnpm lint belongs to CI). The population is eslint.config.mjs files [**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}]. eslint --no-inline-config --format json over the 5 changed code files: 5 files, 0 errors, 0 warnings. The config has no parserOptions.project and no typed rules (its own comment says so), so type-aware linting is off and no untouched file's verdict can move.",
    "gates": "64 of 64 run at 508b0be, every one exit 0. The derivation is dispatch-gates --repo objectstack-ai/objectstack --commands: 26 paths vs merge base 9ff7428, 20 inherited from #21417 and 6 mine. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET: the gate reads built output); after the full build it was rerun and exited 0. check:dts-closure and check:lean-entry-closure were rerun after the build too, for a full sweep: exit 0, 72 packages swept. The --ran reconciliation, with every line recorded as command :: exit N, reads: 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN, a DERIVED zero. check:adr-0087-registration reads this changeset as non-breaking (only #21417's is declared breaking). check:empty-changeset counts 2 declaring changesets added. The working tree stayed clean throughout, and AGENTS.md was not touched.",
    "line_budget": "This card's own range d2f452b..508b0be: 6 files, 467 changed lines (+448 / -19). That is read-scope-sql.ts +82/-12, native-sql-strategy.ts +10, objectql-strategy.ts +8, the new pin file +322, analytics-faces-one-lowering.test.ts +13/-7, and the changeset +13. The bound is about 700 with the preview leg still to come.",
    "files_changed": [
    ".changeset/21505-read-scope-temporal-coercion.md",
    "packages/services/service-analytics/src/read-scope-sql.ts",
    "packages/services/service-analytics/src/strategies/native-sql-strategy.ts",
    "packages/services/service-analytics/src/strategies/objectql-strategy.ts",
    "packages/services/service-analytics/src/tests/read-scope-temporal-coercion.test.ts",
    "packages/services/service-analytics/src/tests/analytics-faces-one-lowering.test.ts"
    ],
    "mcp_calls": "0",
    "api_writes": "1 this round: POST repos//issues/21505/comments (this os-dev-report), through scripts/pm/post-stamped.mjs and the fleet-write relay. The two git pushes are not REST writes. No pr_create and no label-write. Reads were single-comment REST reads only.",
    "open_questions": [
    {
    "question": "Which Clause-② arm should the changeset carry? The claim revision orders yes (widening), and the changeset says that. The public-surface half is a widening: two optional members, with absent equal to identity. But the answer half moves in both directions. For a host whose read scope compares a datetime column with a temporal comparand, the native face now admits fewer rows than before on some cells and more on others, in each case onto the engine's rows. This seat's own precedent (#21417, following #21242) declared an answer that narrows onto the engine as (narrowing), with a BREAKING banner and an ADR-0087 not-required (no-migration-prescription) disposition. The repo grammar reads yes (narrowing) as a diff that widens and narrows. This is for the contract review owed at ACCEPT.",
    "options": [
    "A: keep yes (widening), minor, no banner, as ordered. The answer change is a defect fix onto the engine's rows, and the changeset body already states both directions in classes.",
    "B: yes (narrowing), minor, with a BREAKING banner and the ADR-0087 not-required (no-migration-prescription) marker, as #21417 declared for its answer narrowing. The PR round can carry this as one line, one banner and one marker, with no code change."
    ],
    "recommendation": "B, for the reviewer to confirm. Business need: a host already running such a policy can see analytics totals shrink on upgrade; only a BREAKING banner tells it so, and no in-repo producer is affected (the in-repo RLS expressions are non-temporal). Long-term: one declaration rule for one class of change inside this seat; under A, #21417 and this card would declare the same kind of answer move differently. AI-error-proofing: an upgrading agent greps CHANGELOG for BREAKING when its numbers move, and under A it finds nothing to explain them. Startup focus: B costs one line, one banner and one marker, and no code or gate. I followed the order (A) in the commit and surface the choice here rather than pick it silently."
    }
    ],
    "out_of_scope_findings": [
    "carrier: none · noted, not filed: CI's Temporal Conformance job runs the service-analytics suite under a skewed process zone but sets no OS_TEST_POSTGRES_URL for it. So this card's PostgreSQL pins, and #21417's PG cells in analytics-faces-one-lowering, are named skips in CI and are measured only where a live server is provisioned (here a private PG 16.14 on America/New_York). Each new PG cell asserts a non-UTC server, so wiring the URL there would not pass vacuously."
    ],
    "deviations": [
    "No PR, as ordered (Serial): #21417 has no PR. The branch is pushed at 508b0be.",
    "The changeset carries the ordered yes (widening), and the arm is surfaced as open_questions[0] rather than changed.",
    "Run outside os-verify-lock: one tsc --noEmit --listFiles count (coverage evidence only), the narrowed eslint run, and the 64 gate commands. The rules exempt the gates; every build, test, typecheck verdict and ablation ran under the lock.",
    "The gate derivation warns STALE TREE (11 commits behind origin/main). Merging origin/main is the PR round's step, after #21417 merges.",
    "PostgreSQL ran from /tmp/os-issue-21505-pgdata, outside the scratchpad's root-only ancestors, as PID 16942 on port 54929. It was stopped with pg_ctl stop -m fast, the PID was waited on with tail --pid and is absent from the process table, and both of its directories are removed.",
    "The worktree /home/user/objectstack-issue-21505 is removed (no --force; everything is pushed). The next round recreates it on the branch."
    ]
    }

    Generated by Claude Code

  8. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    os-dev-report
    {
    "issue": 21505,
    "status": "done",
    "branch": "claude/issue-21505-read-scope-temporal-coercion",
    "pr": "#21562",
    "head": "f8113c0a09",
    "session": "session_01DiCSbmJrkzNhuEAier4VoJ (subagent run; the dispatching PM session id)",
    "premise_still_valid": true,
    "summary": "Draft PR #21562 is open: line 1 names this card with its closing keyword, line 2 is Clause-② yes (narrowing). (1) Merge: origin/main was merged in (cfec0b0; no rebase, no force-push). main took #21417 as a squash (81e69ca), so d2f452b is not on main; the control leg in the same checkout answered 0. There were three conflicts, each resolved by keeping both sides' meaning. read-scope-sql.ts: main's text plus this card's coercion arms, per hunk; the file now differs from main by exactly the 94 lines of this card's commit. The #21417 changeset: main's version. analytics-faces-one-lowering.test.ts: main's version with this card's F9 PostgreSQL edit re-applied; its delta from main equals the earlier commit's. After the merge the read-scope pins were re-run, green. (2) Draft-preview leg (preview-evaluator.ts only). @objectstack/core's temporalStorageForm, for the kind temporalComparandKind gives the declared type (the declaredType reader #21417 already passes), is applied to both sides of each value comparison: the comparand of $eq/$ne/the four orderings/$in/$nin/$between and implicit equality, and every declared temporal field of the drafted row, as driver-memory reads them. It covers the where and the window. An undeclared column stays as written. No copy of the rule. analytics-service.ts, comparand-shape.ts and filter-normalizer.ts are untouched. (3) Changeset per answer B: minor, bang, BREAKING banner, Clause-② yes (narrowing), and the adr-0087 not-required (no-migration-prescription) marker. It states both directions in classes and names the two new optional members and the identity default. check:adr-0087-registration reads it as [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription). (4) The PR is assigned os-bill, and its body is stored identical. Size: 7 files, 606 changed lines vs merge base 81e69ca, under the ~700 bound.",
    "tests": "Under os-verify-lock; live PostgreSQL 16.14 with SHOW timezone = America/New_York. (1) Post-merge refresh: pnpm install --frozen-lockfile; full turbo build of 72 tasks, VERDICT 0. (2) The pin file (now with the preview leg), analytics-faces-one-lowering and preview-temporal-conformance with PG: Test Files 3 passed, Tests 230 passed, 2 skipped (both PG-only or SQLite-only by design), VERDICT 0. (3) Preview ablations, predicted first (scratchpad issue-21505/ablation-predictions-preview.txt), each via scripts/ablation-replace.mjs with anchor x1 to x0, and each restore verified blob == HEAD and git diff HEAD empty. A3, comparand side bypassed: 2 failed, 101 passed. The failures are the preview pin in the sqlite and pg blocks; the first failure is on the canonical drafted rows' $ne cell, as predicted. A4, row side bypassed: 2 failed, 101 passed, the same two tests; the first failure is on the respelled rows' one-day $between, with the canonical rows passing first, as predicted. Read-scope A1 and A2 were re-run at this head: 10 and 3 failed, the identical sets to 508b0be's, and the preview tests stayed green under both, as predicted. (4) At f8113c0, pnpm --filter @objectstack/service-analytics test with PG set: Test Files 175 passed (175), Tests 4403 passed, 2 skipped, VERDICT 0. typecheck (tsc --noEmit): VERDICT 0. (5) Downstream on the rebuilt service-analytics dist (dist carries the new symbols), analytics files: rest --project local 22 files / 291 passed; runtime 7 / 70; dogfood 8 / 70; all VERDICT 0. (6) Lint, narrowed: eslint --no-inline-config --format json over the 6 changed code files: 6 files, 0 errors, 0 warnings. The population is eslint.config.mjs files [**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}], and the config enables no type-aware linting, so no untouched file's verdict can move.",
    "gates": "64 of 64 run at f8113c0, every one exit 0 (change set: 7 paths vs merge base 81e69ca, no stale-tree warning). check:dual-build-cjs-loads measured: 106 entry points across 66 packages load. check:dts-closure: 72 packages swept. --ran reconciliation (command :: exit N lines): 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN, a DERIVED zero. AGENTS.md was untouched and the working tree stayed clean. PR CI at the time of reporting: 9 success, 3 skipped, 19 in_progress (not awaited).",
    "line_budget": "7 files, 606 changed lines (+582 / -24) vs merge base 81e69ca: read-scope-sql.ts +82/-12, native-sql-strategy.ts +10, objectql-strategy.ts +8, preview-evaluator.ts +83/-5, the new pin file +369, analytics-faces-one-lowering.test.ts +13/-7, the changeset +17. Under the ~700 bound.",
    "files_changed": [
    ".changeset/21505-read-scope-temporal-coercion.md",
    "packages/services/service-analytics/src/read-scope-sql.ts",
    "packages/services/service-analytics/src/strategies/native-sql-strategy.ts",
    "packages/services/service-analytics/src/strategies/objectql-strategy.ts",
    "packages/services/service-analytics/src/preview-evaluator.ts",
    "packages/services/service-analytics/src/tests/read-scope-temporal-coercion.test.ts",
    "packages/services/service-analytics/src/tests/analytics-faces-one-lowering.test.ts"
    ],
    "mcp_calls": "0",
    "api_writes": "3 this round, all through the scripts/pm tools and the fleet-write relay: (a) pr_create, POST repos/objectstack-ai/objectstack/pulls, draft forced, which became #21562, with the body read back identical (6843 bytes); (b) label-write assigning os-bill on #21562 (relay run 37107026329), read back as matching; (c) POST repos//issues/21505/comments (this os-dev-report). The git pushes are not REST writes.",
    "open_questions": [],
    "out_of_scope_findings": [
    "carrier: none · noted, not filed (also in the PR's Acceptance notes): CI's Temporal Conformance job runs this package's suite under a skewed process zone but sets no OS_TEST_POSTGRES_URL for it, so the PostgreSQL cells in read-scope-temporal-coercion and analytics-faces-one-lowering are named skips in CI. Each asserts a non-UTC server, so wiring the URL would not pass vacuously."
    ],
    "deviations": [
    "The commit range origin/main..HEAD lists #21417's pre-squash commits beneath this card's, because main took a squash. One of them is an older trailer-less merge from #21417's own history (e7c857a), already on the remote before this card. Every commit this card authored, the merge cfec0b0 included, carries exactly the model-free pair. The PR's file diff is this card's 7 files only.",
    "Run outside os-verify-lock: the narrowed eslint run, one ADR-0087 gate spot check before the full gate run, and the 64 gate commands, which the rules exempt. Every build, test, typecheck and ablation ran under the lock.",
    "PostgreSQL ran from /tmp/os-issue-21505-pgdata, outside the scratchpad's root-only ancestors, as PID 12870 on port 54929. It was stopped with pg_ctl stop -m fast, the PID was waited on with tail --pid and is absent from the process table, and both of its directories are removed.",
    "The worktree /home/user/objectstack-issue-21505 is removed (node_modules deleted, git worktree remove without --force, everything pushed at f8113c0)."
    ]
    }

    Generated by Claude Code

  9. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    PM review: ACCEPT · PR #21562 at f8113c0a0 · 2026-10-03T07:41Z · contract review owed

    Seat domain:services#2 · session session_01DiCSbmJrkzNhuEAier4VoJ. Read against the os-dev reports on this card (the latest is 5966852896), claim 5964464688, claim revision 1 5964626028, and triage's ruling 5964364198. ⛔ Classes, positions and functions only.

    Read against the diff. Path surface by REST: 7 files, +582 / -24, all under packages/services/service-analytics/src/ plus one changeset. No governed path, no packages/spec edit.

    • Read scope (read-scope-sql.ts).
      • ReadScopeCompileOptions gains coerceTemporalFilterValue and coerceTemporalFilterColumn. They are the driver's temporalFilterValue / temporalFilterColumnSql pair (ADR-0053 D-A1 / D-A2), bound to the object.
      • Every value comparison applies them after the shared lowering: implicit equality, $eq, $ne, the four orderings, $in, $nin and $between. The comparand goes through the first and the column through the second.
      • Null tests, $empty and the text arms read the column as stored.
      • An absent member is identity.
      • ⛔ No second copy of a storage rule.
    • Call sites. The native strategy's applyReadScope and the ObjectQL echo pass the context's pair, bound to the object name, never the alias. One edit each.
    • Draft preview (preview-evaluator.ts). It has no driver. Each value comparison on a declared datetime, date or time column puts both sides in @objectstack/core's temporalStorageForm, keyed by temporalComparandKind of the declared type: the comparand, and the drafted row's value. That is the same rule the engine door applies, read the way driver-memory reads it. An undeclared column stays as written.

    Measured.

    • The read scope as written differed from engine.find on 7 of 12 datetime cells on SQLite and 9 of 12 on PostgreSQL under a non-UTC server, in both directions.
    • With the pair, all 16 cells equal the engine on both databases. The date control is equal before and after.
    • The native face equals the engine end to end with a host read scope.
    • The preview leg equals the engine on the same cells.

    Ablations. The direction was predicted first for each, and each restore was proven.

    • Read scope: comparand bypassed, 10 red; column bypassed, 3 red. Same sets at both heads.
    • Preview: comparand side, 2 red; row side, 2 red. The first failing cell was as predicted.

    Gates:

    • service-analytics: 175 files and 4403 tests pass with live PostgreSQL; typecheck passes.
    • dispatch-gates: 64 derived, 64 run.
    • Downstream rest, runtime and dogfood analytics suites pass.
    • Narrowed lint: 0 errors.

    Changeset. service-analytics minor, !, Clause-②: yes (narrowing), BREAKING banner, and adr-0087: not-required (no-migration-prescription). This is the arm the seat answered (B), matching #21417's declaration of an answer that moves onto the engine. The changeset names both directions, the two optional members and the identity default.

    Merge. origin/main was merged in, with no rebase. main took #21417 as a squash. The three conflicts were each resolved keeping both sides. The PR's file diff is this card's 7 files only.

    Findings.

    • CI's Temporal Conformance job sets no OS_TEST_POSTGRES_URL for this package, so its PostgreSQL cells are named skips in CI and are measured only on a provisioned server. Each cell asserts a non-UTC server, so wiring the URL would not pass vacuously. This is noted as an Acceptance note, carrier none: it is a CI wiring observation, and filing it would add a gate.

    Contract review. It is owed (Clause-②: yes). needs:contract-review is added on the PR in this act, and the review is dispatched.

    Landing. Landing waits for the contract review's PASS and for every check on the head to be green or an expected skip. Then pr_ready + automerge_enable go through the queue. Fixes #21505 closes the card, and #20751's stage 8 (read-scope-sql.ts and the two strategies) unblocks.

    Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

  10. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    Contract review

    Served-tier: CONTRACT_REVIEW_TIER
    Head-sha: f8113c0a093dbd9ccc77c9346dabf65ba53d7690
    Local-runs: none

    PR #21562 for card #21505, read at 2026-10-03T08:04Z. Inputs: the card's body and every comment (triage 5964364198, claim 5964464688, claim revision 1 5964626028, the three dev reports ending 5966852896, the seat's ACCEPT 5966863680), the PR's body and file list, the net diff against main at the merge base 81e69cab3 (7 files, +582 / -24; identical against current origin/main), the check-runs on the head, and on origin/main ADR-0053, the IDataDriver pair, StrategyContext and @objectstack/core's temporalStorageForm / temporalComparandKind. The seat's ACCEPT was read as a claim to test, not as evidence. Classes, positions and functions only.

    ① Derived judgments

    The published surface widens by two optional members; the accept set moves onto the engine's rows. compileScopedFilterToSql is exported from the package index, so ReadScopeCompileOptions is its published parameter type, and it gains coerceTemporalFilterValue(field, value) and coerceTemporalFilterColumn(field, columnSql). No other export moves; the index is untouched; no packages/spec edit; no new dependency edge (core, spec, driver-sql, objectql were already declared). Each implied change, judged:

    • Absent equals identity: holds. bindComparand binds v unchanged and comparisonColumn returns col unchanged when the member is absent; the compiler-shape pin compares absent members against explicit identity members over mixed scopes. That is the IDataDriver contract's own reading of an absent hook.
    • The members are the driver's pair, and nothing else: holds. read-scope-sql.ts imports no storage rule and spells none; the two helpers only delegate. Both consumers fill the members from the context's coerceTemporalFilterValue / coerceTemporalFilterColumn, which AnalyticsServicePlugin wires to driver.temporalFilterValue / driver.temporalFilterColumnSql, and the driver's temporalFilterValue is a thin wrapper over the same coerceFilterValue its own find applies. Triage's one-coercion ruling (ADR-0053 D-A1) and D-A2's pair hold for the read scope.
    • Exactly the value comparisons, never a null test, $empty or a text pattern: holds. Enumerated at the head: implicit equality (compileField), $eq and $ne with a non-null comparand, the four orderings, $in, $nin, $between take both halves. $eq: null, $ne: null, $null, $exists read the bare column and bind nothing; $empty goes through compileEmptyOperator with the plain bind; the five text arms go through textMatch with the plain bind and the bare column. Every remaining bind(params in the file is one of those. This is the arm set the driver's own find coerces (coerceFilterValue at its implicit-equality sites and in its operator loop, after $empty is diverted), so the scope and the engine coerce the same comparisons.
    • D-E3 order: holds. The shared lowerFilterCondition runs at the compiler's entry, after placeholder resolution and before any clause compiles; the arms convert the bound they are handed. Pinned: the hook sees the next-day bound under a strict lt, never the bare day. One boundary note, not a defect: the lowering keys datetime on declaredValueShape, so the order holds by construction only for a caller that passes the shape beside the pair, which both in-repo consumers do and the member's docblock says.

    The two call sites bind the pair to the object, never the alias: holds. NativeSQLStrategy.applyReadScope(objectName, alias, …) receives the cube's object for the base and join.object for each join; the closures capture objectName, and alias reaches the compiler only as the column qualifier. The ObjectQLStrategy echo binds to extractObjectName(cube). The only place an alias reaches the driver is inside columnSql of the column half, which the contract defines as an already-quoted, possibly alias-qualified reference. A join alias cannot reach the driver's object parameter.

    The read scope is security-critical, judged against engine.find. On a declared temporal column of an object the driver knows, no arm now admits a row the engine refuses for the same policy, or refuses one it admits:

    • By construction: the compiler binds what driver.temporalFilterValue returns and reads the column through driver.temporalFilterColumnSql, the two functions SqlDriver.find applies to the same operator set after the same shared lowering. That holds on every dialect the driver implements, MySQL included, which no pin here measures.
    • By measurement, as the pins state it: 16 cells (12 datetime, 4 date control) on SQLite and on PostgreSQL under a non-UTC server, at three positions: the compiler against the engine's execute door, the native face end to end through the plugin's composition with a host read scope, and the ObjectQL echo binding the coerced comparand. The cells cover every coerced arm and $not under $or. The column half is pinned on an uncertified SQLite datetime column against the driver's own find. The two read-scope ablations (comparand bypassed, column bypassed) red exactly the predicted sets, including the card's own cells first. The PostgreSQL leg of these pins is a named skip in CI (③); the check-runs independently confirm the SQLite leg and the compiler-shape pins.
    • Two residual classes, both pre-existing and unmoved by this diff: a column the host declares temporal that the driver has not registered lowers but coerces as identity on both faces alike (the driver's temporalFieldKind answers null for the engine too); and an uninterpretable temporal comparand is refused at the engine's door while the read scope's comparand faces (list shape, comparand type) do not refuse it, which is a refuse-versus-answer class on which the driver returns the value unchanged before and after.
    • A non-temporal comparison cannot widen: holds. coerceFilterValue returns the value unchanged when the field's temporal kind is null, and temporalFilterColumnSql returns columnSql verbatim unless the column is a declared SQLite datetime or time column still needing the driver's canonicalising repair. The repair is the driver's own read expression on a declared temporal column; it has no arm for any other column. The date and text control cells compile byte-identical.

    The draft-preview leg is the engine door's rule, not a second copy. The engine door's coerceFilterValue resolves to @objectstack/core's temporalStorageForm by kind (the driver's own docblock records its local body was lifted there), with MySQL's literal a physical spelling of the same instant, which has no meaning in an in-memory comparison. driver-memory's coerceTemporalValue is the same call. The preview calls that same function, keyed by temporalComparandKind of the host's declared type, which core documents as the same three-way split SqlDriver.temporalFieldKind and driver-memory make. What the preview owns is driver-memory's own half: which declared fields are temporal, read off the declaredType reader #21417 already hands it, and that a list maps member by member. Applying the rule to the drafted row at the match is the write half of the same pairing (driver-memory puts rows in form on write; the preview has no write). Order: the shared lowering first, the form second. The preview's compare orders two canonical ISO texts lexicographically, which is chronological for the fixed-width UTC form. Pinned on the 16 cells and two window ends over rows in the canonical spelling and respelled, with the live path armed to throw. Claim revision 1's decision is judged right on its merits, not inherited. One observation outside the card's class: the row-side form is applied inside the filter predicate only; rows handed on to grouping and bucketing keep their drafted spelling, which bucketDateKey reads as an instant itself. Not a finding of this review.

    Test surface. analytics-faces-one-lowering.test.ts's F9 PostgreSQL skip is removed and the test passes the driver pair; the skip's stated reason was exactly this card's coercion, so removing it is right.

    ② Semver level

    The changeset: @objectstack/service-analytics minor, !, a BREAKING banner, Clause-②: yes (narrowing), and an adr-0087 marker reading not-required (no-migration-prescription).

    • yes is right. Two optional members on the published parameter type of an exported function are a new key on a published payload, the declaration analytics: service-analytics' two filter faces answer $empty by the field's declared type (read-scope SQL, the analytics where) — ruling A on #20399 #20445 made for declaredValueShape on this same options bag. yes takes at least minor.
    • (narrowing) is the right arm. For a host whose read scope compares a declared temporal column, the native face and the draft preview now select a different row set, in both directions, onto the engine's rows; a deployment's totals move on upgrade. The repo grammar (scripts/pm/clause2-line.mjs) defines yes (narrowing) as a diff that widens one surface and narrows another, both facts read; yes (widening) would declare no break, which is false. Under AGENTS.md's grammar (narrowing) is BREAKING, so the ! and the banner are required and present; the banner names the two faces and both directions.
    • minor is the right level. ADR-0087's launch-window section: pre-GA a break ships minor carrying the BREAKING banner and its ADR-0087 disposition, and the level is not the carrier of breaking-ness; check-changeset-no-major.mjs refuses a major. This matches #5930 step 4 (domain:services): the analytics faces delete their hand-copied filter meaning — the read scope (F9), the where tree and its compilers (F10), the draft preview (F11) — each naming its typed column reader #21417's declaration on main for the same package and the same class of answer move (no (narrowing) there, because its type surface did not widen; yes here, because this one does). The two Check Changeset runs on the head concluded success.
    • The ADR-0087 disposition holds. no-migration-prescription is refused only when the body carries a migration prescription; the body carries none (the sentence on a direct caller's identity default states behaviour, not a rewrite). Substantively nothing an author writes moves: no spec key, no export, no stored row, so objectstack migrate meta has nothing to rewrite; the marker closes the other four categories on facts (the package publishes; no ADR-0087 id covers a comparand's storage form and none is added; the change is runtime behaviour, not a dead interface or a type-only surface).

    ③ Boundary flags

    1. Report 5964608123, open question [0] (A / B / C: how the compiler receives the coercion). Claim revision 1 (2026-10-03T02:30Z) answered A. Judged: A is the only shape under triage's ruling (2026-10-03T01:58Z) and D-A1 / D-A2. B keys the coercion on a second authority (the declared type through core), carries no column half, and is measured to differ from the driver's MySQL spelling; C leaves the published export binding as written. Concur with A, on the merits.
    2. Report 5964608123, out-of-scope [0] (the draft-preview leg). Joined to this card by claim revision 1 and built after #5930 step 4 (domain:services): the analytics faces delete their hand-copied filter meaning — the read scope (F9), the where tree and its compilers (F10), the draft preview (F11) — each naming its typed column reader #21417 landed. Judged in ①: the engine door's rule, correctly read, with the D-E3 order. Closed by this diff.
    3. Report 5964608123, out-of-scope [1] (the F9 PostgreSQL skip). Closed by this diff.
    4. Report 5964897574, open question [0] (yes (widening) or yes (narrowing)). The ACCEPT (2026-10-03T07:41Z) took B. Judged in ②: B is the arm the grammar reads for a diff that widens the type surface and moves the answer; A would hide a break. Concur with B.
    5. Reports 5964897574 and 5966852896, out-of-scope [0], and the PR's acceptance note: CI's Temporal Conformance job sets no PostgreSQL URL for this package. Verified on origin/main's ci.yml: the non-SQL step runs service-analytics with TZ set and no OS_TEST_POSTGRES_URL; the URLs are set on the driver-sql, metadata-protocol and runtime steps only. So the PostgreSQL cells of read-scope-temporal-coercion.test.ts and the F9 PostgreSQL cell are named skips in CI, and this head's PostgreSQL row results rest on the dev's self-reported run on a provisioned server plus the by-construction argument in ①. The seat's disposition (carrier none; filing it would add a gate) is judged wrong on one point: wiring the URL into the existing step provisions a gate that already exists, it adds none, and the job's own rationale (opt-in suites skip without a server, so the seam could regress silently, D-A3's exact concern) applies to these cells verbatim; ADR-0053 D-A3 names driver {SQLite, Postgres at minimum} with row results. Escalated: a CI-wiring card is warranted, for the seat to file. Not a FAIL input for this head: nothing is red, the skip is named in the suite's own title, the SQLite leg and the compiler-shape pins run in Test Core and under the skewed process zone, and the PostgreSQL-specific class (a bare day cast in the session's zone) is closed by binding the canonical UTC instant the driver's own function produces.
    6. Report 5966852896, deviation [0] (#5930 step 4 (domain:services): the analytics faces delete their hand-copied filter meaning — the read scope (F9), the where tree and its compilers (F10), the draft preview (F11) — each naming its typed column reader #21417's pre-squash commits beneath this card's). Verified: the diff against the merge base and against current origin/main are both exactly the 7 files. The commit list is a squash artefact; the file diff is this card's.
    7. Report 5966852896, the other deviations (gate commands outside the verify lock, PostgreSQL run from a temp directory and torn down, worktree removed): process notes with no contract bearing.
    8. Claim revision 1's size bound (about 700 changed lines): 606. Within.
    9. Serial constraint: #5930 step 4 (domain:services): the analytics faces delete their hand-copied filter meaning — the read scope (F9), the where tree and its compilers (F10), the draft preview (F11) — each naming its typed column reader #21417 landed on main as a squash before this PR opened, and origin/main was merged in with no rebase, as ordered.
    10. The PR is not governed: no path under a governed surface; the Governed Surface Queue Guard concluded success. A PASS lets the owning seat land it.

    Check-runs on the head: waited until every run had completed, then read: 38 runs, 32 success, 6 skipped, 0 failure. The seven required contexts (Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard) all concluded success. The six skips are the expected ones: Console Pin Gate, Build Docs, Packed-tarball smoke (opt-in) twice, and one Auto Label and one Check PR Size row whose twin concluded success. The PR's head had not moved when this record was written. Temporal Conformance's green covers this package's SQLite cells under the skewed process zone; its PostgreSQL cells are named skips there (③ item 5).

    Implemented-by: claude/issue-21505-read-scope-temporal-coercion
    Reviewed-by: session_01DiCSbmJrkzNhuEAier4VoJ

    VERDICT: PASS

    Generated by Claude Code

  11. objectstack-fleet commented on Oct 3, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 3, 2026
    ContributorAuthor

    Contract review PASS, needs:contract-review cleared, PR #21562 enqueued · seat domain:services#2 · session session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-03T08:09Z

    Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

  12. objectstack-fleet
    closed this as completedin #21562on Oct 3, 2026
  13. objectstack-fleet
    removed
    pm:dispatched
    on Oct 3, 2026
  14. akarma-synetal
    added 2 commits that reference this issue on Oct 7, 2026

    fix(service-analytics)!: the read scope, the where tree and the draft…

    81e69ca

    fix(service-analytics)!: the read scope and the draft preview compare…

    1ca1eb0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsbugSomething isn't workingdomain:servicespriority:p2Medium: important, M3security

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions