fix(formula): refuse == / != against the bare current_user root at the CEL lowering

[objectstack-fleet]

Fixes #19959

Clause-②: no (narrowing)

A row-level or sharing CEL predicate that compares with == / != against the bare current_user root is now refused at the CEL lowering (unsupported). It used to lower against the whole caller context object, so a check written record.owner_id != current_user admitted every write it was written to refuse.

Inherits #19886 ruling A (5805254639) with its reason: the published $eq / $ne contract admits a literal or a { $field } reference, and ADR-0058 D2 declares the operand opposite a field as a literal, a current_user scalar or a pre-resolved current_user set. The whole context object is none of them, so the refusal pulls back to the declared contract.

What changed

• packages/formula/src/cel-to-filter.ts: two guards under == / !=, applied wherever an operand is resolved (opposite a field, and on either side of a constant comparison):
  • the variable ROOT alone (a one-segment path) is refused BEFORE resolution, in both compile modes. So the shape check (isPushdownableCel, isSupportedRlsExpression) reports it at authoring time, and every compile gives the same unsupported whatever it binds, the sharing seeder's variables: {} included;
  • a variable that RESOLVES to an object (not an array, not a Date) is refused per request, like a resolved array.
  • The message names the path the author wrote, never a value, and prescribes a key: record.owner_id != current_user.id.
• The constant branch is covered because current_user != 'guest' folded to "no restriction" (an object is never strictly equal to a literal). That is the same whole-object comparison one branch over, in the same function, so it is fixed in place (bounded-fix exemption: same defect class, mechanical, no other claim on the file, same gate family).
• Tests: formula face (new file, 25 cases); plugin-security through the real SecurityPlugin + ObjectQL on driver-sql (new file, 15 cases); lint (5 RLS cases plus 1 control, 3 sharing cases).
• ADR-0087 semantic entry cel-predicate-variable-root-comparand-refused under protocol major 18, plus the regenerated registry. BREAKING changeset at minor for formula, plugin-security, plugin-sharing and lint, and patch for spec.
• No lint source changed: both rules now report the shape through the shape verdict (measured below). No plugin-security source changed: explain follows the compile refusal by itself.

The refusal's target, and the census behind it

Is there a legitimate non-array object comparand under == / !=? None was found at 9347c1f23:

• { $field } references never reach comparandOf: the field-to-field branch emits them itself.
• A CEL map literal is refused by classify. A bytes literal is refused by coerceLiteral. A function call is unsupported.
• The RLS context (rls-compiler.ts compileFilter) binds id, organization_id and email as strings, and positions, org_user_ids and accessible_org_ids as arrays. It merges only array-valued rlsMembership keys. The sharing seeder binds {}. The lint reference pass binds scalars and arrays.
• Custom variableRoots: one in-tree use, a formula test that reads the scalar key ctx.department. No caller binds a root to a scalar.

The rule is therefore: refuse the bare root statically, in every mode, and refuse any resolved object except a Date, which the $eq / $ne contract admits as a literal.

Regression census at 9347c1f23, over the whole objectstack tree (tests, examples, content, skills, apps and docs included): a regex for ==, !=, = or any ordering operator against current_user with no key after it, on either side, returns 0 hits. Positive control: 2 of 2 on a synthetic file. The keyed form (current_user. after an operator) returns 406 lines. hotcrm at 2f7b232 returns 2 hits, both prose (a URL query string), and 0 predicates. No shipped policy, sharing condition, formula example or docs example changes verdict.

Pre-fix and post-fix, measured

The pre-fix readings come from an ablation of both guards: the anchor replaced through scripts/ablation-replace.mjs, formula rebuilt, and ablation-dist-preflight.mjs confirming the marker in 2 built files. Restore: blob equal to HEAD, git diff HEAD empty, formula rebuilt, marker absent from all 6 built files, tree clean, then all green again.

leg (real plugin, driver-sql)	pre-fix	post-fix
sole using: !=, == and !(==) against the root	400 from driver-sql (the object comparand cannot be bound)	[], ground truth intact
sole check: != and !(==), insert and by-id update	admitted and stored	PERMISSION_DENIED / 403, nothing lands
sole check: == against the root	403 (strict equality to an object matches nothing)	403
USING-only != policy, insert (write pass)	admitted and stored	403, nothing stored
OR-sibling read (== current_user.id beside the root)	400	the sibling's rows only
OR-sibling write (status != 'archived' beside the root)	archived admitted	open admitted, archived 403
explain (read, recordId)	narrows	denies, allowed: false, record.visible: false, readFilter is RLS_DENY_FILTER, no membership id echoed
delegator leg (agent with no RLS, acting for a real sys_user whose set carries the root check)	admitted and stored	403, nothing stored

Each leg has a control spelled the way the refusal points (current_user.id, or a scalar check on the delegator's set). Every control stays green under the ablation, so each leg discriminates.

Lint, on the same stack, using and check:

• RLS rule: pre-fix SILENT on every root spelling. Post-fix rls-predicate-unenforceable on both clauses.
• Sharing rule: pre-fix sharing-rule-runtime-variable-condition. Post-fix sharing-rule-unlowerable-condition. The review record said both lints were silent; that holds for the RLS rule only.

Ablation counts: formula 20 of 49 red (the new file's 20 refusal pins; its 5 neighbours and the 24 list-comparand pins stay green). plugin-security 10 of 15 red (the 4 controls and the already-fail-closed == check stay green). lint 8 of 149 red.

Compile surfaces (lowering semantics changed, so one line each)

The refusal sits upstream of every compile surface. The CEL RLS / sharing path now hands a driver only RLS_DENY_FILTER, a scalar id equality, or seeds nothing.

• driver-sql applyFilterCondition (sql-driver.ts:16077; sqlite-wasm and turso local inherit it): out of scope, refused before any compile surface. Measured: a sole using read returns [] (pre-fix 400).
• turso RemoteTransport buildWhereSQL (remote-transport.ts): out of scope, refused upstream; it receives the sentinel only. Not run.
• service-analytics compileScopedFilterToSql (read-scope-sql.ts:658): out of scope. Its scope is ctx.getReadScope, the RLS read filter, which is the sentinel after the refusal. Not run.
• service-analytics lowerAnalyticsWhere (strategies/filter-normalizer.ts:2171): out of scope. It lowers an analytics where, never a CEL predicate (service-analytics does not call compileCelToFilter).
• formula matchesFilterCondition (matches-filter.ts:209 on this tree): out of scope. The check it evaluates is now the sentinel. Measured 403 through the real plugin; pre-fix, $ne with the object answered true.
• objectql having-filter applyHaving / matchesHaving (having-filter.ts:905 / :918): out of scope. A HAVING filter comes from the query, never from the CEL RLS / sharing lowering.
• driver-memory checkCondition (memory-matcher.ts:361): out of scope, refused upstream. Not run.
• driver-mongodb translateFieldOperators (mongodb-filter.ts:875 on this tree): out of scope, refused upstream. A raw $ne with an object from a raw filter stays outside this card. No live producer bypasses the compile: the core {token} resolver yields strings only.

Verification (every reading at 60da27e66 unless named)

• @objectstack/formula: pnpm test 1027 of 1027 passed across 37 files. pnpm typecheck exit 0; test layer OK.
• @objectstack/lint: vitest run 4160 of 4160 passed across 108 files. pnpm typecheck exit 0; test layer OK.
• @objectstack/plugin-security: vitest run 2755 of 2755 passed across 137 files. pnpm typecheck exit 0; test layer 0 errors.
• @objectstack/plugin-sharing: vitest run 913 of 913 passed across 37 files.
• tsc --listFiles on each package's tsconfig.test.json lists every new or edited test file (1 each).
• node scripts/pm/dispatch-gates.mjs --commands: 91 families derived. 88 exit 0. 3 exit 3, PREREQUISITE NOT MET, so NOT MEASURED: check:dual-build-cjs-loads, check:i18n and check:type-check-debt each need the full ./packages/* build, which CI runs. --ran reconciliation: 91 accounted, 0 UNRUN.
• ESLint, narrowed to the 7 changed .ts files with --no-inline-config --format json: 7 files, 0 errors, 0 warnings. The population is the diff's .ts files; the changeset is not linted, and no file was reported as ignored. Invariance: eslint.config.mjs never enables type-aware linting (no parserOptions.project, no typed rules, stated at its line 326), so this diff cannot move the verdict of an untouched file.
• Driver-less git merge-tree of this branch against origin/main 9e7824a44: clean.

NOT MEASURED: live mongod, PG and MySQL. The three gates above. bootstrapDeclaredSharingRules end to end: the seeder's own call (compileCelToFilter(source, { variables: {} })) is pinned at the formula face and through the sharing lint.

Acceptance notes

• Ordering operators against the root. record.f > current_user still lowers to $gt with the whole object, and matchesFilterCondition answers true for a string that sorts after the object's string coercion. This is outside the == / != letter of ruling A. It belongs to the non-scalar-comparand-under-ordering family, which is [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage 2d (c). Carrier: [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 2d. Measured on the formula face only.
• The constant branch with a membership array. current_user.org_user_ids != 'x' still folds to "no restriction", because an array is never strictly equal to a literal. This is the list family ([finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886), the constant-branch sibling of 2c, and is not folded in here. Measured on the formula face.
• The root in the other positions. record.f in current_user and record.f.startsWith(current_user) pass the shape check and are refused per request (fail closed), and the RLS lint stays silent on them because its reference pass stops on a refused probe. That is the class of lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951.
• lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951 (membership-key == / !=, same lint file) is not moved: the root guard fires only on a one-segment path, and no lint source changed.
• The branch is based on 9347c1f23. origin/main (9e7824a44) is 48 files ahead. The overlap is registry.ts (a different, non-adjacent entry) and packages/lint (a different rule file). The driver-less merge-tree is clean; not merged.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

6 anchor(s) derived from 2 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 207 client-bound route-ledger rows — the other 153 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 153: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 98 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e7824a445b1f7e33c91ada4b4f591db84ff76cc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32bc79d4c391c1ab9ace724cf6dc0213755ba5ee — the merge of head 60da27e665f8b15aa74609b5a83e72f5c35197d2 into base 9e7824a445b1f7e33c91ada4b4f591db84ff76cc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32bc79d4c391c1ab9ace724cf6dc0213755ba5ee && git checkout 32bc79d4c391c1ab9ace724cf6dc0213755ba5ee
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e7824a445b1f7e33c91ada4b4f591db84ff76cc 60da27e665f8b15aa74609b5a83e72f5c35197d2 && git checkout -B drift-repro 9e7824a445b1f7e33c91ada4b4f591db84ff76cc && git merge --no-ff 60da27e665f8b15aa74609b5a83e72f5c35197d2

node scripts/docs-audit/affected-docs.mjs --json 9e7824a445b1f7e33c91ada4b4f591db84ff76cc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 60da27e665f8b15aa74609b5a83e72f5c35197d2

_{Read: card #19959 with all 5 comments; #19886 ruling A (5805254639); PR #19947 record 5810400326; PR #20189 object, body, 8-file list, full diff (+714/-9), 5 commits, check-runs at the head (de-duplicated by name on latest started_at); at the head ref: cel-to-filter.ts whole, matches-filter.ts, rls-compiler.ts (context binding 453-513, shape gate 540-596, compile 680-730), security-plugin.ts (3140-3185, 7070-7095, 7315-7360), explain-engine.ts (1571-1624), bootstrap-declared-sharing-rules.ts (140-300), both lint rules (RLS 370-545, 740-800; sharing 425-525), rls-predicate.ts, rls.zod.ts, the new entry, registry.ts 6256-6346, the changeset, the 2c precedent changeset and entry on main, the headers and rule text of check-adr-0087-registration.mjs / check-changeset-no-major.mjs / check-empty-changeset.mjs and the workflow's WHICH LEVEL prose, .changeset/config.json; AGENTS.md whole. Ran (detached worktree at the head, pnpm install --frozen-lockfile, turbo build of the plugin-security/lint/plugin-sharing closures, all under os-verify-lock, VERDICT command-exit 0 each): a 70-source matrix on the built formula dist in value, bare (variables: {}) and shape modes; the PR's three new test files plus the #19886 list-comparand and cel-to-filter suites (formula 113/113), the two lint rule suites (149/149), and the PR's 15 plugin-security legs plus 16 legs of my own through the real SecurityPlugin + ObjectQL on driver-sql (31/31); the real bootstrapDeclaredSharingRules (source at head, via tsx) on 32 declared rules; a repo-wide census of bare-root comparands at the head and in hotcrm at 2f7b232. NOT MEASURED: live mongod, PG and MySQL; driver-mongodb translateFilter with an object comparand; the objectui sibling (no checkout here; Console Pin Gate path-skipped); the derived gate families (read from CI only); a merge with origin/main (the PR did not merge it; GitHub reports mergeable).}

① Derived judgments

(a) Refusal completeness. On the built dist at the head, 24 root spellings all answer unsupported in value mode, with nothing bound, and in shape mode, and isSupportedRlsExpression is false for each: record.owner_id != current_user, == current_user, both flipped orientations, !(…==…), !(…!=…), !!(…), the root under && on either side, under || on either side, 1 == 1 || <root> and <root> || 1 == 1 (refused whole, never folded to {}), the bare-identifier RLS spelling owner_id != current_user, and the constant branch (current_user != 'guest', 'guest' != current_user, current_user != null, null != current_user, current_user == null, current_user == current_user, !(current_user != null), record.status == 'open' || current_user != 'guest'). The legacy owner_id = current_user bridges to == and is refused; owner_id <> current_user is parse-error (pre-existing, also fail closed). The detail names the written path and prescribes <root>.id; none of six bound values leaks into it (the PR's 25 pins plus my sweep). By reading, the guard sits in variableOperandOf before resolveValue, reached from comparandOf (opposite a field) and from both operands of the constant branch, so no ==/!= operand resolves without it; !, &&, || lower their children through lowerCondition, and a CompileError thrown anywhere aborts lowerCelAst whole. One nuance: current_user.id != current_user with variables: {} answers unresolved-variable (the keyed left operand faults first) rather than unsupported; still refused, shape mode says unsupported.

(b) What newly refuses or changes answer. Three classes: (1) the bare root under ==/!= in every mode, which includes a custom root a caller binds to a SCALAR (variables: { ctx: 'sales' }, row.dept != ctx used to lower to { dept: { $ne: 'sales' } }, now refused as the root) — wider than "an object"; no non-test caller in the tree uses variableRoots at all (census 0), so nothing in-tree meets it; (2) a variable that resolves to a non-array, non-Date object (current_user.profile), per request, shape passing; a Date (current_user.since) and a nested scalar (current_user.nested.deep) lower as before; (3) the constant branch with a root operand, which folded to {} (allow-all) whenever the root was bound and was unresolved-variable when it was not. Hunt for a legitimate casualty: a whole-tree grep at the head for current_user with no key after it beside ==, !=, =, <> or an ordering operator, either side, hits only the PR's own eight files (42 lines; positive control); hotcrm at 2f7b232: 0. Producers cannot supply an object: RLSCompiler.compileFilter binds id/organization_id/email as strings and positions/org_user_ids/accessible_org_ids as arrays and merges only array-valued rlsMembership keys (rls-compiler.ts 453-513); the lint probe binds PROBE_SCALAR/PROBE_ARRAY per key; the seeder binds {}. rowLevelSecurity[].using and .check are z.string() (rls.zod.ts 391/440), so no filter object bypasses the compiler. 15 neighbours lower byte-identically (current_user.id all forms, current_user.?id, email, organization_id, field-to-field $eq/$ne { $field }, $null both ways, 1 == 1, literals, $gt 3, in literal and membership, !(… in …), current_user.id != 'guest' → {}); the #19886 list refusals are intact. No legitimate in-tree predicate changes verdict.

(c) Fail-closed through the real plugin (driver-sql, better-sqlite3, real ObjectQL + SecurityPlugin with the guard set as fallback). The PR's 15 legs are green here, and my own 16 legs beside them: sole check for !=, !(==), == and !(!=) refuses the insert for BOTH reviewer values (self and other) with PERMISSION_DENIED / 403, nothing stored, a loud drop WARN present, and no usr_peer in any WARN; the control record.reviewer_id != current_user.id admits the other owner and refuses the caller. The root inside && (status == 'open' && reviewer_id != current_user), inside || (status != 'archived' || …) and beside 1 == 1 || refuses every insert — never reduced to the compiling arm. OR-sibling check (root beside == current_user.id): self admitted, other 403; OR-sibling using: the sibling's rows only. USING-only current_user != null (the old allow-all): read [], insert 403. Constant check "current_user != 'guest'": 403. Legacy reviewer_id <> current_user: 403. By-id update under a sole root check: 403, row unchanged. record.reviewer_id in current_user as check: 403. The PR's explain pin (denies, allowed: false, record.visible: false, readFilter = RLS_DENY_FILTER, no membership id echoed) and delegator pin (agent for a real sys_user whose set carries the root check: 403, nothing stored) pass here with their controls. Mechanism by reading: the refused shape takes compileFilter's !isSupportedRlsExpression WARN branch and, with applicable > 0 and filters.length === 0, the clause returns RLS_DENY_FILTER (rls-compiler.ts 582-596); the write gate evaluates matchesFilterCondition(image, RLS_DENY_FILTER) (security-plugin.ts 3166-3167), which no image satisfies; a compiling sibling leaves filters.length === 1 and decides alone; explain maps the sentinel to denies (explain-engine.ts 1579-1582). Envelope on every write leg: ADR-0112 PERMISSION_DENIED, status 403.

(d) Lints and skip reasons. Both rule suites green at the head (149). RLS rule: the shape verdict isSupportedRlsExpression is now false, so the explanation branch reads isPushdownableCel → unsupported → rls-predicate-unenforceable on using and on check (5 spellings; the keyed control stays clean). Sharing rule: the seeder's exact call now answers unsupported, which takes the non-unresolved-variable branch → sharing-rule-unlowerable-condition (3 spellings). The seeder itself, measured end to end (real bootstrapDeclaredSharingRules, source at head): for every mappable recipient (user, position, team) the !=, !(==) and current_user != 'guest' rules are skipped with reason=unsupported and defineRule is never called for them; the three controls seed. Intended: both new ids carry the right prescription (a respelling, not a runtime variable). Harmless: no in-tree test pins the old reading (0 unresolved-variable strings in plugin-sharing tests; 0 bare-root predicates in any test outside the PR's), and no lint or plugin-sharing source changed. Nit: current_user.id != current_user under the seeder still reads unresolved-variable (so sharing-rule-runtime-variable-condition), because the keyed operand faults first; the body's "every compile gives the same unsupported whatever it binds" holds only when the root is the first operand faulted. Still skipped, still reported.

(e) Anything else in the published surface. No export added, removed or renamed (formula/src/index.ts untouched; check:api-surface green inside TypeScript Type Check). compileCelToFilter, lowerCelAst, isPushdownableCel and isSupportedRlsExpression narrow exactly as in (b). matchesFilterCondition is unchanged: measured on the dist, a filter passed DIRECTLY with { f: { $ne: <object> } }, { $not: { f: <object> } } or { f: { $gt: <object> } } still answers true (the pre-existing evaluator face the 2c record already noted for the 400 arm); unreachable from a CEL using/check after this PR and not this card's seam. No other package's source changed.

② Semver level

Consistent with the gates' stated rules and the precedent. check-changeset-no-major: no major in the frontmatter (minor ×4, patch ×1; all five in the fixed group); level axis: the body carries Clause-②: no (narrowing) bare at the start of a line → the axis is carried by the arm; moved packages formula, plugin-security and lint graded minor, spec patch → the discharged row, exit 0. check-adr-0087-registration: the changeset declares breaking twice (the **BREAKING** banner and the narrowing arm) and carries exactly one marker, <!-- adr-0087: registered cel-predicate-variable-root-comparand-refused -->; the id resolves at HEAD (registry.ts:6303) and is absent at the merge base 9347c1f23 (0 hits), so it is NEW in the diff — the registered rule's both halves hold; the registry block is byte-equal to entries/semantic/18.cel-predicate-variable-root-comparand-refused.ts with comments stripped, and check:migration-registry / check:spec-changes / check:upgrade-guide ride green in TypeScript Type Check (the 2c landing likewise touched only registry.ts and the entry). check-empty-changeset: one A with a five-line non-empty frontmatter; no M or D of a changeset on the base. Precedent cel-predicate-list-comparand-refused (.changeset/19886-cel-list-comparand-and-mongodb-ne-array-refused.md): same banner sentence, same minor for formula/plugin-security/plugin-sharing/lint and patch for spec, same marker form; the new entry sits beside it under protocol major 18 with the same field set and states no D2 conversion, with the reason (the platform cannot know which key was meant). plugin-sharing has no source in the diff, but its boot-time skip reason changes through its @objectstack/formula dependency, which is the precedent's treatment too; no gate refuses an un-moved bump. Check Changeset is success at this head.

③ Boundary flags

Blocking: none.

Non-blocking:

• Ordering operators against the root — measured through the real plugin, not only the formula face: a check written record.reviewer_id > current_user ADMITTED and stored every insert (usr_other and aaa); $gt/$lt/$gte with the whole context object lower in value mode and the shape check passes. Outside ruling A's ==/!= letter and this card's; the PR names [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage 2d (c) as the carrier, which has no card number yet. It is p1-grade by this card's own criterion and needs a card before [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 closes; not this PR's to fix.
• Membership array on the constant branch: current_user.org_user_ids != 'x' folds to {} (no restriction) — measured on the formula face; the list family ([finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886), declared, not folded in here.
• The root in other positions: record.f in current_user, .startsWith(current_user), .contains(current_user) are refused per request (fail closed; my plugin leg for in current_user as check → 403) while the shape check passes and the RLS lint stays silent — lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951's class, declared.
• Bounded in-place fix (constant branch): same file, same function, same whole-object comparison one branch over, pinned at the formula face (4 forms) and through the plugin (current_user != 'guest' check → 403; USING-only current_user != null → [] / 403). Does not block.
• Correction to record 5810400326: the sharing lint was sharing-rule-runtime-variable-condition (not silent) pre-fix — consistent with that rule's unresolved-variable branch and with the seeder's {} compile pre-fix; only the RLS lint was silent. Accepted.
• A root bound to a scalar by a custom caller is now refused too (wider than the entry's "resolves to an object" sentence); 0 in-tree callers of variableRoots, loud with a prescription. A one-sentence addendum to the entry's surface would make the ledger exact; not blocking.
• The branch is based on 9347c1f23; origin/main 9e7824a44 is ahead (the PR did not merge it). GitHub reports mergeable: true; the overlap is registry.ts (disjoint entries). The queue's rebuilt generation decides.
• The PR is a draft; landing is the owning seat's act, not this record's.

CI at this head: 35 check runs, 35 names after de-duplication on the latest started_at; none in progress or queued; 32 success, 3 skipped, 0 failure. All seven required contexts success (Lint & Repo Gates, TypeScript Type Check rollup with its four Type Check · jobs, Test Core rollup + 6/6 shards, Dogfood Regression Gate rollup + 3/3, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard); also success: Check Changeset, Check PR Size, Auto Label, Check Documentation Links, Dogfood Verify CLI, Spec property liveness, Flag docs affected by code changes, filter, and the four card/branch guards (The card this PR closes must claim this branch, Part-of PR must not also close its card, No other open PR may claim the same issue, No other open PR may claim the same single-writer path). Skipped, each with its reason: Console Pin Gate and Build Docs (path filter false — the diff touches neither tree), Packed-tarball smoke (opt-in) (needs its opt-in label). No non-success conclusion other than those three skips.

PR body closing keywords: only Fixes #19959; #19886 and #19951 appear without a closing keyword. Commits: 5, each ending with the model-free Claude-Session / Co-authored-by: Claude pair; 0 model identifiers in the diff, body, changeset or commit messages.

Implemented-by: claude/issue-19959-cel-root-comparand-refused
Reviewed-by: session_01CiCTczDo7tGhafXjf61dUJ

VERDICT: PASS