finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path

[huangyiirene]

Observation-class finding, filed unassigned with no pm:queue — for triage to grade and route. Raised by the dev on #7598 / PR #7916 as "one place the ruling is slightly awkward, stated rather than papered over", and graded by the services PM as not a blocker for that PR (reasoning below). Carries a second, smaller observation from the same report.

Observation 1 — the attribution seam

The 2026-08-12 maintainer ruling on #7598 (Q1 = B) has NativeSQLStrategy.canHandle decline a query whose where or read scope carries { $field: … }, so it routes to the ObjectQL/engine path and the driver enforces the four #5222 rulings with metadata it owns. That is working as ruled.

The consequence: a read scope carrying a reference the driver refuses — an undeclared column, or the tenant-isolation column — now surfaces as INVALID_FILTER / 400 from the driver, where before the ruling the analytics path answered READ_SCOPE_COMPILE_FAILED / 500 with a withheld message. The refusal moved to the driver along with the compilation.

Why this is not a violation of Q2 = A. Q2 = A governs read-scope-sql's own envelope, and PR #7916 leaves it untouched: same code, same status, same withheld message, and the "Deliberately NOT a 4xx of any flavour, including a 422" module-header paragraph is not rewritten. Verified on the diff. The 400 comes from a different component that the ruling deliberately routed to.

Why it is still worth recording. #5367's adjudication rests on an attribution argument — a caller must not be billed a 4xx for a document they cannot author, and policy field names must not be echoed to the tenant. On this one path, the ruling's routing produces exactly the 4xx that argument was written to prevent. Two independent decisions, each correct on its own terms, meeting at a seam neither anticipated.

Open question for whoever grades this: does the driver's INVALID_FILTER on a read-scope-originated filter need the same withhold treatment #5367 gave the analytics path — and if so, does that belong at the driver, or at the boundary that hands a read scope to it? Note the driver cannot currently distinguish "this filter came from an author's query" from "this filter came from a read scope the caller never saw", which is likely the crux.

⚠️ This may deserve needs-user-decision rather than a dispatch: it is a consequence of a ruling the maintainer made hours ago, and re-deciding it is not a dev-seat or PM-seat call. Filed as finding so triage grades it; the services seat is not pre-empting that.

Observation 2 — an unreachable-today configuration, named rather than hidden

The decline creates one configuration that could not previously occur: a host advertising nativeSql without an aggregate bridge now reaches resolveStrategy's dead end for a $field filter (native declines, and there is nothing to fall back to).

Measured on PR #7916: not reachable from AnalyticsServicePlugin, whose defaults derive both capability flags from the bridges it actually wired. Only a hand-overridden queryCapabilities can construct it. The PR adds a diagnostic for it anyway, with a narrowness control. Recorded here so the reasoning survives the session; no action is claimed to be needed today.

Explicitly NOT claimed

• No regression is asserted. PR feat(service-analytics): serve a $field RLS rule by declining native SQL (#7598) #7916's 26 CI checks are green, including the #5367 end-to-end pin analytics-query-read-scope-withhold.test.ts in runtime (2096/2096). The withhold behaviour on the path analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 actually adjudicated is intact.
• The ruling is not being re-litigated here. Q1 = B and Q2 = A stand. This card records a downstream consequence, not an objection.

Evidence

Measured 2026-08-12 by the dev on PR #7916 (packages/services/service-analytics, head 94c5580). Full measurement in the <!-- os-dev-report --> comment on #7598 (comment 5262307982); the PM's acceptance reasoning is in comment 5262400038.

Source

Split out of #7598 (PR #7916) — the dev's named residuals, deliberately not decided inside that card.

Refs: #5367 (the withhold adjudication), #5222 (the four cross-field rulings), #7596, #7597.

[hotlong]

Triage: graded needs-user-decision (deliberately left without domain:* — the ruling itself picks the landing: driver-side withhold vs boundary-side, the #7497 leave-blank shape). The filer's instinct is confirmed: this is two maintainer rulings (#7598 Q1=B routing, #5367 withhold/attribution) meeting at a seam neither anticipated, and harmonizing rulings is not a PM or dev call. Not auto-adjudicable: it sits inside hours-old maintainer decisions and touches the information-withhold posture (security-adjacent).

Four-lens block (①–④ per #7498):

• ① Platform long-term coherence — analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367's principle ("a caller is never billed a 4xx for, nor shown field names from, a document they cannot author") is either a property of the read-scope path as a whole or a property of one component's envelope. Today it is the latter, which means every future routing decision can re-open the hole. Stating it path-wide closes the class.
• ② Measured business pull — narrow but real: the driver's INVALID_FILTER on a read-scope-originated reference can echo policy field names (including the tenant-isolation column) to a tenant who never wrote them. No customer report; the exposure is measured on PR feat(service-analytics): serve a $field RLS rule by declining native SQL (#7598) #7916's routing.
• ③ AI-agent error-resistance — the crux the card names is structural: the driver cannot distinguish "author's filter" from "read-scope filter". Any fix requiring the driver to guess provenance is the error-prone shape; tagging provenance at the boundary that merges the read scope in (so the withhold decision is mechanical) is the resistant one.
• ④ Startup scope discipline — smallest coherent fix is at the seam (mark scope-originated predicates where they are merged; withhold on that mark), not a driver-wide error-envelope rework. Observation 2 (the unreachable-today capability configuration) needs no action and should not be bundled.

Recommendation: rule that #5367's withhold follows the read scope wherever it is enforced — implemented as provenance-tagging at the boundary, with the driver's refusal unchanged for genuine author filters. Alternative (accept the 400 as the new honest behavior on this path and amend #5367's scope) is coherent but should be said explicitly if chosen.

---

Generated by Claude Code

[hotlong]

Maintainer ruling — 2026-08-12

Ruled: provenance marker — #5367's withhold follows the read scope wherever it is enforced. Scope-originated predicates are tagged at the boundary that merges them into the query; a driver refusal on a tagged predicate gets the withhold treatment (no policy field names echoed to the caller, #5367 envelope semantics); refusals of genuine author-written filters are unchanged.

Provenance: maintainer, triage PM session chat (session_01NKGoRBFZELVKivDkiAswdz), 2026-08-12, verbatim: 「7918 A,7917 ②,7900 收敛两扇门,7929 来源标记」. Recorded by the triage seat; needs-user-decision → pm:queue swapped in the same write, and the ruling picks the lane: domain:engine-core (the merge boundary lives in packages/objectql; drivers consume the mark).

Implementation boundaries:

• Neither [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 Q1=B nor analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 is reopened — this ruling composes them: routing stands, withhold becomes a property of the read-scope path as a whole rather than of one component's envelope.
• The tag must survive the path the [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 routing actually takes (analytics decline → ObjectQL/engine → driver). The cross-lane touch on driver-sql's refusal envelope is expected — declare the full file surface in the claim; the driver-memory freeze does not apply (this is the shared refusal seam, not driver-memory investment).
• Pin both directions: (a) a read scope carrying a driver-refused reference answers the withheld envelope with no field-name echo — extend the analytics-query-read-scope-withhold pin family to this path; (b) an author-written filter with the same bad reference still gets the descriptive 400. The distinction IS the deliverable.
• Observation 2 on the card (hand-overridden capability configuration) stays no-action, per the card.

---

Generated by Claude Code