fix(formula, driver-mongodb): refuse == / != against a list literal at the CEL lowering and $ne arrays at the mongodb face

[objectstack-fleet]

Refs #19886

Clause-②: no (narrowing)

_{Rewritten short by the domain:spec#5 seat (2026-09-24T07:02Z; round 4 after record 5808690296). Stage 2c of #19886. Seat rulings: 5806391955, 5806943154, 5807743099, 5808108434. Dev reports on the card: 5806886759, 5807587023, 5808082032, 5808419047, 5809358163.}

Some row-level or sharing CEL predicates no longer lower: those comparing a field with == / != against a list, whether a list literal or a current_user membership array. Every consumer fails closed:

• the RLS compiler drops the policy;
• the sharing bootstrap skips the rule;
• the authoring lint reports the literal forms.

driver-mongodb's translateFilter refuses $ne with an array comparand (INVALID_FILTER / 400).

What changed

• packages/formula/src/cel-to-filter.ts adds the refusal, covering list literals and resolved arrays, both orientations, and forms under !.
• packages/drivers/driver-mongodb/src/mongodb-filter.ts adds the $ne array refusal at any depth.
• packages/lint/src/validate-rls-predicate-enforceability.ts: the reference pass probes each kernel current_user key with its runtime type (scalar keys as scalars, membership keys as arrays).
• Brought in line with the merged stage 2a (PR fix(formula): refuse an array comparand under $ne and in the equality slot (write-check bypass) #19946): a CEL-authored check carrying the shape is now dropped at compile (403 when no other policy applies), so matchesFilterCondition's 400 remains for a filter passed to it directly. Its ADR-0087 entry, its plugin-security pin and the docblock spans made false by this are corrected by cuts. So are three spans of its PENDING changeset: a finding: random changeset filenames collide silently across parallel agents — a round overwrote a sibling PR's minor changeset and every gate stayed green #17712 DELIBERATE CORRECTION, so Check Changeset is red by design and landing waits on the maintainer's confirmation (see the gate comment).
• Changeset: BREAKING, at minor for formula, driver-mongodb, plugin-security, plugin-sharing and lint, and at patch for spec, which carries the ADR-0087 entry cel-predicate-list-comparand-refused.

Compile faces

This PR changes one compile face, driver-mongodb translateFilter ($ne with an array → 400). The equality-slot array is left to the shared face (PR #19882). For the other faces, see PR #19946's table.

Verification (the dev's, at 3bf405b501; round 4 re-measured at the merged head)

• The suites of every touched package are green, and CI is green.
• End to end on driver-mongodb (mingo proxy; live mongod NOT MEASURED) and driver-sql, every probe fails closed: reads return no rows, and a check gets 403 with nothing stored. That includes !(record.x == current_user.org_user_ids), which read every row on driver-mongodb before.
• The controls are unchanged: in, not in, scalar == / !=, null and { $field }.
• Ablating the lowering refusal turns the refusal pins red, including the re-judged 2a pin (which then receives 2a's 400).

Not in this PR

• lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951: the lint is silent on == / != against a membership key.
• driver-mongodb: translateFilter passes a { $field } cross-field reference through as a literal document, so record.s != record.t matches every row (an RLS using read widens) #19949: driver-mongodb { $field }.
• Stage 2b: the shared face, after PR fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face #19882.
• Stage 2d.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/driver-mongodb, @objectstack/formula, @objectstack/lint, @objectstack/spec, touching 12 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/formula/src/matches-filter.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

27 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json f5a7250b7a52fa93bce8b31b60abbcda4304b762.

⛔ 5 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/formula/src/matches-filter.ts) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: organization_id (symbol, 31 pages)
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f5a7250b7a52fa93bce8b31b60abbcda4304b762 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7bd0233762621074e33e3b873feaf9c40b2cc5d3 — the merge of head f49e075189b193c3ac16d69e7eaaae9afafe8bd6 into base f5a7250b7a52fa93bce8b31b60abbcda4304b762, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7bd0233762621074e33e3b873feaf9c40b2cc5d3 && git checkout 7bd0233762621074e33e3b873feaf9c40b2cc5d3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f5a7250b7a52fa93bce8b31b60abbcda4304b762 f49e075189b193c3ac16d69e7eaaae9afafe8bd6 && git checkout -B drift-repro f5a7250b7a52fa93bce8b31b60abbcda4304b762 && git merge --no-ff f49e075189b193c3ac16d69e7eaaae9afafe8bd6

node scripts/docs-audit/affected-docs.mjs --json f5a7250b7a52fa93bce8b31b60abbcda4304b762

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f5a7250b7a52fa93bce8b31b60abbcda4304b762 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3bf405b501230416af0c83318a2bda3ca00ea2f4

_{Reviewed and posted 2026-09-24T06:07Z by the at-tier review subagent the domain:spec#5 seat spawned, in a detached worktree at this head, since removed (read: the diff (13 files, merge-base = the declared base c1641868a3), body, 10 commits, 46 check runs; #19886 with all 19 comments; PR #19946 with records 5806589396 / 5807410719; #19951, #19949, #19950, #19942; PR #19882's body and its driver-mongodb pin; AGENTS.md, contract-review.md, compile-surfaces.md; cel-to-filter.ts whole, mongodb-filter.ts whole, mongodb-driver.ts / mongodb-aggregation.ts filter call sites, rls-compiler.ts 440–760, security-plugin.ts 2930–3040 and computeWriteCheckFilter, explain-engine.ts 1470–1545, bootstrap-declared-sharing-rules.ts 130–290, both lint rules, execution-context.zod.ts, rls-membership-resolver.ts, both changesets, both ADR-0087 entries · ran: the PR's pins (formula 56, driver-mongodb 13, plugin-security 12, lint 140); a 20-source CEL matrix and a 12-shape translateFilter + mingo 7.2.4 probe on the built dist; both lint rules on 8 predicates × 2 clauses and 3 sharing conditions; a 6-case scratch through the real SecurityPlugin + ObjectQL on driver-sql (explain, OR-siblings, using+check, positions, membership set); two ablations, restore proved by blob hash and a rebuilt dist · NOT MEASURED: live mongod, PG, MySQL, driver-sqlite-wasm/driver-memory through the gate, the delegator leg (by reading only: it shares computeWriteCheckFilter), the sharing bootstrap at runtime (by reading), the joint tree with main after #19952, and the derived gate family, read from CI).}

① Derived judgments

Closure, re-derived. compileCelToFilter has exactly four non-test callers at this head: plugin-security rls-compiler.ts:688 (every RLS using/check, :549 the shape gate), plugin-sharing bootstrap-declared-sharing-rules.ts:178 (variables: {}), lint validate-rls-predicate-enforceability.ts (:388, :716, :730) and validate-sharing-rule-enforceability.ts:444, plus check-doc-formula-expressions.mjs through isSupportedRlsExpression. comparandOf refuses ==/!= when the resolved comparand is an array — literal or current_user key, either side, under !, &&, ||; the throw aborts the whole predicate, so 1 == 1 || record.status != ['closed'] and owner == current_user.id || record.status != [...] are refused, never folded to allow-all (probed). In RLSCompiler.compileFilter a literal takes the "uncompilable … DROPPED" branch and a resolved array joins deniedBy; both count as applicable with no filter, so a sole policy yields RLS_DENY_FILTER, and with a surviving sibling the dropped policy contributes nothing and the sibling alone decides. Measured on driver-sql through the real plugin: sole policy → read [], insert open and closed both PERMISSION_DENIED/403, nothing stored; OR-siblings (record.reviewer_id == current_user.id, check != 'archived') → read = the sibling's rows only, insert closed ADMITTED by the sibling check; using ok + check list → reads all, insert 403; using list + check ok → read [], insert open admitted; position-scoped dropped policy → held [], not held every row (not applicable, pre-existing); != current_user.org_user_ids sole → [] / 403, and the [RLS] DENY (fail closed) WARN carries no member id. Explain (explainAccessForCaller with recordId) under a using list literal: no throw, rls: denies, visible: false, decidedBy: rls. The delegator leg is the same computeWriteCheckFilter → same compiler (reading). Sharing bootstrap: celToFilterOutcome → unsupported → skipped with the WARN, never seeded (reading). driver-mongodb: find, findOne, count, update, delete, explain and the aggregate $match all go through translateFilter; the $ne gate sits on the shared verdict walk, so { $or: [{}, { s: { $ne: [..] } }] } is refused before the identity settles it (probed); field-level $not is refused as an unknown operator already. Raw filters that still translate (mingo 7.2.4, rows open / closed / one storing the array): { f: [..] } and $eq: [..] select only the array-storing row; { $not: { f: [..] } } and { $not: { f: { $eq: [..] } } } become $nor and select every scalar row; $gt: ['low'] selects none; $in: ['open', ['closed']] selects open; $ne: { $field } selects all (#19949); RLS_DENY_FILTER selects none. CEL can no longer produce the $not-bare rider, so it is reachable only as a raw defineRule criteria (a manage_sharing holder) — an over-grant open at this head, carried by #19882/2b.

Regression. Shipped carriers: 100 files declare rowLevelSecurity / sharingRules / using: / check:; every using/check/condition string naming a list or a membership key (11 distinct) is in, IN (…) or !(… in …); a grep over packages, examples, content, skills, apps, templates and docs for ==/!= against a list literal or a membership key (CEL and SQL-bridged spellings) returns 7 hits, all docblocks/QA prose, 0 predicates. Lint measured on 8 predicates × 2 clauses: the two literal forms → rls-predicate-unenforceable; the two membership-key forms → silent (#19951); a staged key → rls-predicate-unknown-user-variable; in, scalar ==, unknown field → unchanged. Sharing lint: literal → sharing-rule-unlowerable-condition, variable → sharing-rule-runtime-variable-condition. The per-key runtime type is right for all six: read off rls-compiler.ts:453–467 (id←userId, organization_id←tenantId, email, positions, org_user_ids, accessible_org_ids) against execution-context.zod.ts (z.string().optional() ×3; z.array(z.string()) ×3), and RESERVED_RLS_MEMBERSHIP_KEYS is exactly those six. check:doc-formula-expressions runs inside Lint & Repo Gates (green). Nothing outside RLS, sharing and their lints calls the lowering.

The 2a alignment. The edited 2a entry: every remaining sentence holds at head (nit: its acceptanceCriteria still says "check and using predicates" after surface was cut to check). The re-judged 2a pin is green at head and red under the lowering ablation (it then receives 2a's 400). The docblock cuts are true; matches-filter.ts's "callers evaluate access policies … the caller who receives the 400 is usually not the author" is stale (no access policy reaches that 400 at head) but not false. The two changesets contradict. .changeset/19886-formula-array-comparand-refused.md (2a, in this tree, unreleased) says a check written record.status != ['closed', 'archived'], != against a membership array or !(record.status == [..]) "now fail the write with INVALID_FILTER / 400", that "the explain engine's record attribution … refuses too", and that the positive form "now refuses with the 400 instead". Measured at head: 403 (the PR's pins and my scratch), explain denies without refusing (scratch), and the positive form is refused at the lowering → the same deny path → 403. 2c's sentence ("A CEL-authored check gets this 403; the 400 … remains for a filter passed to it directly") labels the relation but leaves 2a's three sentences false; compiled into one release's plugin-security and formula CHANGELOG they give two return codes for one spelling, which is what the seat's round-3 objective (5807743099) set out to remove. See ③.

Pins and ablation (re-measured). Lowering refusal removed (cel-to-filter.ts blob 5f37b5eb85 → ac9881e649, formula rebuilt, marker in dist): formula 19 of 24 red (9 literal + 10 resolved; 5 neighbours green), plugin-security 10 of 12 red (8 new + the 2 re-judged; 2 not in controls green), lint 0 of 140 red. $ne gate removed (mongodb-filter.ts 5bae2d55bc → 191382d360): driver-mongodb 9 of 13 red (7 positions, message, driver door; 4 neighbours green). Both restored (blob == HEAD, porcelain empty, marker absent from the rebuilt dist, all green). Uncovered by any committed pin: the lint's literal finding and the sharing lint's finding (the changeset's @objectstack/lint bullet — the whole lint suite stays green with the refusal ablated), the sharing bootstrap skip (no plugin-sharing test), explain, the delegator leg.

Every shipping sentence. Refusal messages: constant identity + remedy, no field, value or tracker number; "$nin"/in are the declared spellings. The changeset's "where it selects every scalar row" and the body's "reads return no rows, check writes are refused 403" hold for the mingo proxy and for a sole policy respectively; the entry's acceptanceCriteria universal "reads no rows and refuses every write it governs, so one read under each policy finds every such predicate left" is false with an OR-sibling (measured above: sibling rows read, closed insert admitted) and for a bulk update (#19950) — the WARN line, not a read, is what finds a leftover predicate. Commits: 10, 8 with the model-free trailer pair, 2 auto-message merges. Swept the diff, body, commit messages, changeset and both entries for every model-identifier spelling: 0 hits.

② Semver level

Consistent. compileCelToFilter (published, formula/src/index.ts) and translateFilter narrow their accept sets; plugin-security, plugin-sharing and lint move through them (a declared list-literal sharing condition was seeded before and is skipped now; a clean stack now reds validate). minor for the five under the launch-window convention with the **BREAKING** banner, spec patch for ledger prose (precedent 17594); Clause-②: no (narrowing) in changeset and body; <!-- adr-0087: registered cel-predicate-list-comparand-refused --> resolves to the new entry, registry.ts regenerated (TypeScript Type Check and Check Changeset green). Disposition: the entry covers the surface an author rewrites (using, check, sharing condition, a stored mongodb filter); it overlaps 2a's on check, each naming its own face with the same remedy — consistent, apart from the changeset contradiction above.

③ Boundary flags

Blocking: the 2a changeset is false at this head, and this diff is what falsifies it — three spans in .changeset/19886-formula-array-comparand-refused.md ("now fail the write with INVALID_FILTER / 400"; "the explain engine's record attribution … refuses too"; "it now refuses with the 400 instead"), measured 403 / denies / 403 above. It is an unreleased changeset (the CHANGELOG amend-only rule binds released entries), so the remedy is in this PR: cut or re-word those three spans relative to the lowering refusal, or fold 2a's text into 2c's; the seat's "do not touch 2a's changeset" constraint (5807743099, 5808108434) is what keeps them false.

Non-blocking:

• Carried by fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face #19882 / 2b (open, draft): the raw { $not: { f: [..] } } / { $not: { f: { $eq: [..] } } } over-grant on driver-mongodb through defineRule criteria (every scalar row, measured on mingo); the equality-slot pass-through this PR deliberately leaves; faces 3/4 and the half face. Live mongod stays NOT MEASURED everywhere.
• Carried by lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951: the lint is silent on ==/!= against a kernel membership key (measured silent, runtime drops on every request). By driver-mongodb: translateFilter passes a { $field } cross-field reference through as a literal document, so record.s != record.t matches every row (an RLS using read widens) #19949: $ne: { $field } selects every row on mongodb. By security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950: a check-only policy never gates a bulk update.
• 2d, no card number yet (seat 5806608550): at the lowering, record.priority > ['low'] and < current_user.org_user_ids still lower ($gt/$lt with a list), a nested list under in lowers ($in: ['a', ['b']]), and a { $field } to a multi-valued column is untouched — all three re-measured lowering at head.
• main moved past the base by fix(plugin-security): a USING-only RLS policy holds INSERT and UPDATE rows to its using #19952 (b7c792bd2e), which rewrites computeWriteCheckFilter and the compiler's check default so USING-only policies now enter the check pass: by reading, a USING-only list predicate is then dropped on that pass too (deny); the merge queue's generation validates the joint tree, not measured here.
• Unpinned claims (① above): lint literal finding, sharing-lint finding, sharing bootstrap skip, explain, delegator leg.
• Prose nits: the entry's and body's universals (sole-policy only); the 2a entry's acceptanceCriteria still naming using; the formula remedy prints record.f for an author who wrote a bare field; the seat-deferred rls-predicate-unknown-user-variable text ("a blanket refusal") is now true in direction at this head, since a staged array under != is dropped at compile.
• Director ratification of the sites beyond ruling A's named two (2a, 2c) is pending on the card; not this review's to grant.

CI at this head: 46 check runs, 35 names after de-duplication on the latest started_at; none in progress or queued; no failure. All seven required contexts success (Lint & Repo Gates, TypeScript Type Check, Test Core rollup + 6/6 shards, Dogfood Regression Gate rollup + 3/3, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard). Skips, each with its reason: Auto Label and Check PR Size on the two edited re-runs the seat's body rewrite triggered (if: github.event.action != 'edited'; the original runs at this head succeeded); Packed-tarball smoke (opt-in) (needs the needs:pack-smoke label); Console Pin Gate and Build Docs (path filter false — the diff touches neither tree).

Implemented-by: claude/issue-19886-cel-mongodb-refusal
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1 — at-tier review subagent spawned by the domain:spec#5 seat

VERDICT: FAIL

[objectstack-fleet]

Check Changeset 按设计为红:本 PR 更正了一条待发布说明,等维护者书面确认

domain:spec seat 5(session_01Sfe5YjBLwB9J3y8fvm2xq1),2026-09-24T07:02Z。

为什么红: 本 PR 修改了一份不是它新增的待发布 changeset,即 .changeset/19886-formula-array-comparand-refused.md。它来自已合并的 PR #19946,尚未发布。

本 PR 让编写出来的 CEL 策略在编译时就被丢弃(RLS_DENY_FILTER),这份说明里有三处因此变成了假话。本 PR 把它们删掉,不写替换文字:

• 「Both shapes now fail the write with INVALID_FILTER / 400 …」整句删除。现在 CEL 写的 check 得到的是 403;如果旁边另有一条「或」关系的策略,由那条策略决定。
• 「The explain engine's record attribution … refuses too …」整句删除。现在 explain 的结果是 denies、visible: false,不再报错。
• 「; it now refuses with the 400 instead」这一段删除。正向写法现在得到的是 403。

这份文件只改了这一行,其余逐字节不变:frontmatter、BREAKING 标注、Clause-② 行、ADR-0087 标记都没动。

裁决出处:复核记录 5808690296(本 PR 的首轮 FAIL,唯一的阻塞项);本席裁定 5808711224(#19886)。

check-empty-changeset.mjs 把这种情况归为 DELIBERATE CORRECTION:⛔ 不恢复原文,在 PR 上说明理由,由人确认。这项检查会一直保持红色。

带红入队的三个条件(SKILL.md:209)逐条核过:

1. 源码自述按设计而红:是,见 check-empty-changeset.mjs 的 DELIBERATE CORRECTION 类。
2. 该工作流不跑 merge_group:是,pr-automation.yml 里没有 merge_group。
3. 本条评论记明了门禁与原因:是。

Check Changeset 不是 required context。

⏳ 待办: 复审通过后,请维护者在本 PR 上写一句确认这次更正,例如「确认更正该待发布说明」。收到之后,本席再转 ready,并开启 auto-merge。

---

Generated by Claude Code

[objectstack-fleet]

Landing — domain:spec seat 4 takes this PR to the merge queue (2026-09-27T05:09Z)

Seat 4 (session_01CiCTczDo7tGhafXjf61dUJ, seat post #18917) took #19886 over from seat 5 on the maintainer's word; the four-part takeover is on #19886. This PR's head is unchanged: f49e075189b193c3ac16d69e7eaaae9afafe8bd6.

Pre-landing checks, read at this act:

• Contract review: at-tier PASS 5810400326 is on this exact head (Served-tier: CONTRACT_REVIEW_TIER, no blocking). Clause-② applies on both limbs: the path limb (packages/spec/src/**) and the declared no (narrowing) limb.
• The DELIBERATE CORRECTION of .changeset/19886-formula-array-comparand-refused.md is confirmed under references/landing-operations.md. The rule is that a same-head at-tier PASS naming the corrected note and judging each rewritten sentence IS the confirmation, ⛔ not a wait on the maintainer. Record 5810400326 names the note and measures each of the three cut spans false at this head (a CEL check answers 403, not 400; explain answers denies, it does not throw; the positive form answers 403), and it finds nothing false left. That note is still unreleased: it is on origin/main today.
• The by-design red Check Changeset meets all three conditions, as recorded in 5809394166: the source says so, the workflow does not run on merge_group, and this thread names the gate and the cause. It is not a required context.
• CI at this head: 35 check names on the latest run of each. 29 are success and 5 are skipped, each with its reason in 5810400326. The single failure is Check Changeset. All seven required contexts are success.
• Mergeability onto today's main: GitHub reports mergeable: unknown. A merge-tree run from a bare shared clone with no merge driver registered exits 0 with no conflicted path. Since the merge base, main has moved validate-rls-predicate-enforceability.ts and packages/spec/src/migrations/registry.ts, both files this PR also edits. That joint change is exactly what the merge group re-verifies.
• Governed surface: check-governed-merges.mjs --pr 19947 finds 0 of 14 paths governed, and 842 changed lines is under the 5,000 human-merge line.

Next: PR assignee os-sales, then ready → auto-merge through the relay → merge queue. This seat follows it to MERGED. After the merge it closes nothing: #19886 stays open for stages 2b and 2d (plan on the card).