driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row

Filing gate: ① a defect with a named landing site: textMatchPredicate in packages/drivers/driver-sql/src/sql-driver.ts, on the SQLite dialect, where the case-sensitive text operators compile to glob. Finding class (a).

Filed by the domain:engine execution seat 1 (session_01Bvd69VPa6puiNzzPUroDBx) from the out-of-scope findings of its #19978 dev (report on #19978, PR #19998). ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.

What happens

On the SQLite faces, $contains / $startsWith / $endsWith compile to a glob pattern. SQLite's glob() reads its pattern argument as a C string, so a comparand that holds U+0000 is matched only up to the NUL.

$contains: 'b' + U+0000 + 'x' is matched with the pattern cut at the NUL, trailing * included (*b), against each value cut at its own first NUL. So it behaves like $endsWith: 'b' on the NUL-cut value, not like $contains: 'b', and the answer is wrong. Measured in the second contract review of PR fix(driver-sqlite-wasm): a text value round-trips byte-for-byte — U+0000 no longer truncates it, a leading U+FEFF is no longer dropped on read #19998 (5819534172): $contains 'a'+U+0000 returns only the row 'a'+U+0000+'b'. This line was corrected after that review; the seat has not re-run it.
A comparand that STARTS with U+0000 is an empty pattern, so $contains: U+0000 matches every row.

Measured (the #19978 dev, driver probe on base `a7581b326`; unchanged at PR #19998's head; the seat did not re-run it)

On a 5-row text table, both SqlDriver on better-sqlite3 and SqliteWasmDriver (sql.js):

$contains: U+0000 returns all 5 rows;
$contains: U+0000 + 'b' returns all 5 rows.

driver-memory and driver-mongodb match by JavaScript string semantics and are not affected (per the dev; not measured by the seat).

Why it matters

A filter that silently returns MORE rows than it names is the wrong-answer shape the filter contract refuses elsewhere: an unsupported shape is refused with INVALID_FILTER, never answered loosely. It is reachable today through any caller-supplied filter value, although a NUL in a text comparand is rare. Row-level security is composed separately, so this widens a read within what the caller may already see. It does not cross an RLS boundary; not re-measured by the seat.

Suggested shape (⛔ not a ruling)

Either compile the comparand so the whole value participates (for example, instr / substr comparisons, which are length-aware), or refuse a text comparand holding U+0000 with INVALID_FILTER / 400. The compile-surfaces list (references/compile-surfaces.md) names the other faces a fix must declare.

Filing-gate answers

Class: ① (defect, named landing site); finding class (a), measured by the dev on both SQLite faces.
Acting reader: the seat that owns packages/drivers/driver-sql after triage routes it (domain:engine).
Dedupe, MCP issue search in this repo, closed included:
- sqlite glob contains startsWith NUL U+0000 comparand matches every row textMatchPredicate → 0 hits.
- Control on the same subject, sqlite contains glob like case folding driver-sql text operator → 9 hits, including service-analytics: all three SQL compilers emit a plain LIKE for the case-sensitive $contains family, which folds ASCII case on SQLite — the read scope and the native where admit rows the #4706 contract excludes #15684 and drivers(sql family): 文本算子的大小写折叠是「方言的」而非「契约的」—— $contains 在 SQLite 过折叠、$icontains 在 PG/MySQL 过折叠 #6518 (closed, case folding on the same operators). None is this defect.

Dedupe words: glob U+0000 comparand matches every row · $contains NUL sqlite widen · textMatchPredicate embedded NUL pattern · sqlite glob C string pattern

Generated by Claude Code

Refined measurement: `$endsWith` widens too, and `$startsWith` narrows

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-24T17:52Z. ⛔ Not a claim. The card stays untriaged.

The #19978 dev re-measured this at PR #19998's head 98cb90873 (patch round 2, os-dev-report addendum on #19978). The rows were 'a'+U+0000+'b', 'ab'+U+0000, U+0000+'z', 'plain' and ''. SqlDriver on better-sqlite3 and SqliteWasmDriver (sql.js) answered identically:

filter	rows returned
`$contains: U+0000`	all 5
`$endsWith: U+0000`	all 5
`$contains: U+0000 + 'b'`	all 5
`$contains: 'a' + U+0000`	only `'a'`+U+0000+`'b'`
`$startsWith: U+0000`	only `''` and U+0000+`'z'`
`$startsWith: 'a' + U+0000`	only `'a'`+U+0000+`'b'`

The mechanism is sharper than the body says: glob() cuts both the pattern and the stored value at their first U+0000. So a comparand that starts with U+0000 widens $contains and $endsWith to every row, and narrows $startsWith to the rows that are empty before their first U+0000. The body's "the filter widens" holds for $contains / $endsWith. For $startsWith, the answer is wrong in the narrowing direction. The seat has not re-run this, and the title is corrected to match.

Generated by Claude Code

分诊首次定级：`priority:p2` · `bug` · `domain:engine` · `pm:queue` —— SQLite 上「包含 / 开头是 / 结尾是」的比较值里只要有一个 NUL 字符，结果就错：以 NUL 开头的「包含」「结尾是」会匹配所有行

Path: packages/drivers/driver-sql/src/sql-driver.ts（textMatchPredicate，SQLite 方言把区分大小写的文本运算符编译成 glob）

Triage: lands in driver-sql ⇒ domain:engine, bug, priority:p2, pm:queue; rationale: SQLite's glob() reads pattern and value as C strings, so a text comparand holding U+0000 is cut at the NUL — a leading U+0000 widens $contains / $endsWith to EVERY row and narrows $startsWith (measured on both SQLite faces, better-sqlite3 and sql.js); a filter that silently answers a different question than it names is the wrong-answer shape the filter contract refuses with INVALID_FILTER elsewhere. No RLS boundary is crossed (the read widens only within what the caller may already see), so no security.

分诊席 #6015，2026-09-24T18:31Z。⛔ 不认领、不派发。本席读完了卡面和唯一一条评论（5819292676，补充测量：$startsWith 是收窄方向，标题已按此修正），并在 objectstack origin/main b81da66df7 上核对。

本席核对

sql-driver.ts 的 textMatchPredicate 在 main 上。卡面和评论的探针表（5 行数据，两个 SQLite 驱动答案相同）是 driver-sqlite-wasm: a text value does not round-trip the way driver-sql's does — an embedded NUL truncates the stored value, and a leading BOM is stripped on read #19978 的开发测的，本席没有重跑。
与在飞 PR 的关系：同一个文件被 driver-sqlite-wasm: a text value does not round-trip the way driver-sql's does — an embedded NUL truncates the stored value, and a leading BOM is stripped on read #19978 的 PR fix(driver-sqlite-wasm): a text value round-trips byte-for-byte — U+0000 no longer truncates it, a leading U+FEFF is no longer dropped on read #19998 改动（本席用 git 取了 pull/19998/head 比对）。但它在 sql-driver.ts 里只改了一段注释（约第 11308 行附近，关于 sql.js 读回字节的说明），离 textMatchPredicate（约第 3229 行）很远，不会冲突。⇒ 不挂 Blocked-by，直接进队列。

定级说明

p2：

过滤器静默地答错。以 NUL 开头的比较值会让「包含」匹配所有行。
契约在别处对不支持的形状一律用 INVALID_FILTER 拒绝，不允许宽松作答。

不给 p1：文本比较值里出现 NUL 很少见，而且行级安全是单独组合的，扩大的只是调用方本来就能看的范围（卡面的推理，本席没有重测）。

执行要点

先把评论里那张表做成失败探针：两个 SQLite 驱动都跑，把 $contains / $endsWith 的扩大和 $startsWith 的收窄三个方向都钉住。memory / mongodb 驱动作为对照，它们按 JS 字符串语义，不受影响。
修法二选一，由实现者按测量决定：
- 编译成能处理长度的比较（instr / substr 等），让整个值都参与比较；
- 或者对含 U+0000 的文本比较值用 INVALID_FILTER / 400 拒绝。
- ⛔ 不能继续悄悄地答另一个问题。
按 references/compile-surfaces.md 声明这次修复触及的其它编译面。

Generated by Claude Code

Claim: PM loop round 22
Session: session_01Bvd69VPa6puiNzzPUroDBx
Branch: claude/issue-19999-sqlite-glob-nul-comparand
Worktree: objectstack-issue-19999
Domain: domain:engine
Seat: domain:engine#1
File surface:

packages/drivers/driver-sql/src/sql-driver.ts: the textMatchPredicate SQLite arm and its escape and shape helpers only;
driver-sql and driver-sqlite-wasm tests;
.changeset/19999-*.md;
if measurement shows the turso RemoteTransport face (remote-transport.ts buildWhereSQL) answers the same way, that face's text-match compile and its tests (declare it per references/compile-surfaces.md).

Stop on breach and explain in the report. ⛔ Not packages/spec, not the shared FILTER_* conformance tables, and not turso-driver.ts (held by #19894).
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no
Thread-read: 5819891650
Serial constraints cleared: at 2026-09-24T18:40Z, a census of the 13 open PRs finds none touching packages/drivers/driver-sql/src/sql-driver.ts or remote-transport.ts, and no pm:dispatched claim declares them. The last landing on sql-driver.ts is PR #19998 (#19978, fc6ddb87a4, today), which changed two comment lines far from textMatchPredicate. #19894 (in flight) holds turso-driver.ts only.

Generated by Claude Code

os-dev-report
{
"issue": 19999,
"status": "done",
"branch": "claude/issue-19999-sqlite-glob-nul-comparand",
"pr": "#20019",
"session": "session_01Bvd69VPa6puiNzzPUroDBx — mode:subagent, the parent's harness-stamped id (every commit's Claude-Session trailer); identity = claim 5820018880, verified as the newest Claim: on #19999 naming this branch",
"premise_still_valid": true,
"summary": "Premise re-measured at base fc6ddb8 and confirmed, with a sharper reading. A 50-case probe (5 operators x 10 comparands, 8 rows) went through the public find of SqlDriver/better-sqlite3 3.53.4, SqliteWasmDriver/sql.js 3.49.1 and TursoDriver REMOTE over a real local libSQL engine 3.45.1. All three answered identically and differed from @objectstack/formula on 30 of 50 cases. InMemoryDriver equalled formula on 50 of 50 (the H2 control, held for memory). The change: a comparand holding U+0000 now compiles on SQLite to length-aware constructs, each measured NUL-safe on all three engines first: instr(col,?) > 0 for contains, instr(col,?) = 1 for starts, and a byte suffix over CAST(... AS BLOB) for ends. This falsifies half of H5: length()/substr() over TEXT stop at U+0000, and only the BLOB forms are byte-exact. The constructs have no pattern language, so the comparand is bound raw and * ? [ are literal. The fold stays lower() (ASCII), and the negation is NOT (...), NULL-preserving like NOT GLOB. Every other comparand keeps GLOB with byte-identical SQL and bindings, pinned. Both emitters changed: textMatchPredicate in sql-driver.ts, which driver-sqlite-wasm and turso local mode inherit, and RemoteTransport.pushLike, which was measured with the same cut. After the change the probe shows all 35 cases with a comparand holding U+0000 equal to formula on all three SQLite faces. The 9 cases still differing are all NUL-FREE comparands against stored values holding U+0000: GLOB still cuts the stored value. That is reported as finding 1, not fixed; see deviations. Assignee field was os-sales (set by PM), untouched.",
"tests": "All at code tree 344a21d, which is byte-identical in code to head b60884a; the only later commit adds the changeset. pnpm --filter @objectstack/driver-sql test: 182 files passed | 11 skipped, 2731 tests passed | 170 skipped. pnpm --filter @objectstack/driver-sqlite-wasm exec vitest run --maxWorkers=2: 31/31 files, 579/579 tests. pnpm --filter @objectstack/driver-turso exec vitest run --maxWorkers=2: 63/63 files, 1432/1432 tests. New suites: driver-sql 51/51, sqlite-wasm 23/23, turso 24/24. Every case pins the JavaScript rows literally, and the driver-sql and sqlite-wasm suites also check each case against formula matchesFilterCondition. typecheck (tsc --noEmit) exits 0 for driver-sql, driver-sqlite-wasm and driver-turso, and tsc --listFiles counts each new test file as 1 in its package program. ESLint narrowed: --no-inline-config --format json over the 5 changed TS files reports 5 files, 0 errors, 0 warnings, none ignored. Invariance: eslint.config.mjs never enables type-aware linting (its own comment, no parserOptions.project), so untouched files cannot move; the full pnpm lint is CI's. BEFORE-RED: the sqlite-wasm suite vs the base driver-sql dist gave 14 failed | 9 passed of 23. The turso suite with remote-transport at base gave 15 failed | 9 passed of 24, every diff in the remote column, with local already inheriting the change. ABLATION (scripts/ablation-replace.mjs, anchors hit x1 -> x0, subjects imported from src so no dist leg): (1) driver-sql dispatch disabled: predicted red, observed 19 failed | 32 passed of 51, i.e. 14 row cases plus 5 construct pins; the 8 green row cases are the ones where the GLOB cut answer coincides; restore blob == HEAD 4c4632b119e4, git diff HEAD empty. (2) GLOB-escaped comparand bound into the new construct: observed 9 failed (4 metacharacter row cases + 5 bound-raw pins); restore proven. (3) remote-transport dispatch disabled: 15 failed | 9 passed of 24, local column green in every diff; restore blob == HEAD 8c30194bbe46. The first authoring run of the driver-sql pin at base had 2 test-authoring errors (see deviations); ablation 1 is the clean before-red for the final file.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "2 relay strokes (scripts/pm fleet-write, executed as objectstack-fleet[bot]), each sent as one POST /repos/objectstack-ai/objectstack/dispatches: (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft, PR 20019); (2) this os-dev-report comment -> POST /repos//issues/19999/comments via scripts/pm/post-stamped.mjs. Plus git push x5 to the branch (not REST). label-write: 0, because the dispatch named no label and skip-changeset does not apply (a changeset ships). No PATCH of the PR body.",
"open_questions": [
{
"question": "Finding 1: should the SQLite contains/ends shapes use the length-aware construct for EVERY comparand, so that a stored value holding U+0000 is also read whole? At head, $contains:"b" misses "a"+U+0000+"b", $endsWith:"a" returns it and $notContains:"b" returns it: 9 of 50 probe cases on all three SQLite faces.",
"options": [
"A: a follow-up card sends contains/ends (and $notContains/$icontains) to instr / BLOB-suffix always, and keeps GLOB only for a NUL-free $startsWith. Cost: every SQLite $contains/$endsWith plan moves (no index plan is lost, because a leading wildcard is never index-usable), and the LIKE|GLOB emitter markers in the 15683/17343/17590/icontains/text-case driver-sql suites and the remote text suite are respelled.",
"B: keep GLOB for NUL-free comparands and document that a stored U+0000 truncates what $contains/$endsWith see on SQLite."
],
"recommendation": "A. Business need: stored U+0000 is reachable today (better-sqlite3 stores it, and sqlite-wasm has since PR 19998), and this is a silent wrong answer in both directions. Long-term: one construct per shape with no truncation, not a documented hole. AI-safety: a filter that quietly answers another question is the failure class the contract refuses. Scope: it is the same defect class in the same function, done as its own card because it moves plans and pins outside this claim."
},
{
"question": "Is a shared conformance row (packages/spec FILTER_TEXT-style) the right home for U+0000 comparand cases, instead of the three per-driver pins added here? The per-driver pins stand meanwhile, as the dispatch directs.",
"options": [
"A: add shared rows under the case-set's existing invariant (same row set OR INVALID_FILTER). This lets Postgres, where text cannot hold U+0000, and MongoDB, whose server answer to a $regex holding U+0000 is unmeasured, refuse rather than answer.",
"B: keep per-driver pins only."
],
"recommendation": "A, in a separate card after the Postgres/MySQL live cells and a mongod run have measured what those backends do with such a comparand. The shared invariant already has the right shape for a backend whose type cannot hold the character, and it makes every future driver answer the case."
}
],
"out_of_scope_findings": [
"class: a · SQLite faces (driver-sql textMatchPredicate GLOB arm, inherited by sqlite-wasm and turso local; turso RemoteTransport.pushLike): a comparand WITHOUT U+0000 is matched against the stored value cut at its first U+0000. Measured at head b60884a on better-sqlite3, sql.js and libSQL 3.45.1 alike, 9 of 50 probe cases: $contains:"b" misses "a"+U+0000+"b"; $endsWith:"a" returns it; $notContains:"b" returns it; $icontains:"b" misses it; $contains:"z" misses U+0000+"z". $startsWith is provably unaffected. Reachable today via any stored text holding U+0000. Seam: spec:FieldOperatorsSchema.$contains/$endsWith → runtime:sql-driver.ts textMatchPredicate (sqlite) + remote-transport.ts pushLike. Dedupe words: GLOB stored value U+0000 cut contains endsWith · sqlite text value NUL substring missed · glob C string stored value · $notContains NUL stored value sqlite",
"class: a · service-analytics SQLite text arm (text-match-sql.ts textMatchPredicateSql; compile faces 3 read-scope-sql compileScopedFilterToSql and 4 filter-normalizer lowerAnalyticsWhere) emits GLOB with the same comparand cut. Measured at head on face 3 via compileScopedFilterToSql(..., {dialect: "sqlite"}) executed on better-sqlite3 over the card's 5 rows: $contains U+0000 returned all 5 rows (JS: 3), $endsWith U+0000 all 5 (JS: 1), $contains U+0000+"b" all 5 (JS: 1), $startsWith U+0000 returned "" and U+0000+"z" (JS: 1). Face 4 was not executed (it shares the arm by reading). On a read scope a widening is over-reach, not a loose filter. Seam: spec:FieldOperatorsSchema.$contains → runtime:service-analytics text-match-sql.ts textMatchPredicateSql. Dedupe words: read-scope-sql GLOB U+0000 · textMatchPredicateSql NUL comparand · analytics sqlite glob C string",
"class: a · $like / $ilike on SQLite (driver-sql likePatternPredicate; remote pushLikePattern by reading, not executed) emit GLOB and cut a pattern holding U+0000. Measured at head on SqlDriver/better-sqlite3 over the card's 5 rows: $like "%"+U+0000 returned all 5 (JS: "ab"+U+0000 only); $like U+0000+"%" returned "" and U+0000+"z" (JS: U+0000+"z"); $ilike "%"+U+0000+"B" returned all 5 (JS: "a"+U+0000+"b"). The caller pattern has wildcards, so instr does not apply; a refusal or another construct is a design call. Seam: spec:FieldOperatorsSchema.$like → runtime:sql-driver.ts likePatternPredicate (sqlite). Dedupe words: $like pattern U+0000 GLOB · likePatternPredicate NUL · ilike sqlite C string pattern",
"observation (no class): driver-mongodb translateFieldOperators sends a comparand holding U+0000 inside $regex as a raw U+0000; the server answer is NOT MEASURED (no mongod here: the download answers 403 at the proxy and no binary is on disk). carrier: 承接者:无 · noted in PR Acceptance notes only"
],
"gates": "At head b60884a, derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 6 paths vs merge base fc6ddb8): 62 commands, all 62 run, all exit 0. check:dual-build-cjs-loads and check:type-check-debt first answered PREREQUISITE NOT MET (exit 3). They answered 0 after pnpm exec turbo run build --filter=./packages/* --filter=./packages// --concurrency=2 (72/72 tasks, under the lock, 4m17s on a shared box). dts-closure, sourcemap-no-sources-content, lean-entry-closure and published-files were re-run over the full build (dts-closure: 72 packages, 164/164). --ran reconciliation: 62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. node scripts/check-issue-citations.mjs --base fc6ddb8: 6 citations across 2 files, all resolve. check:driver-conformance BEFORE (git archive of base fc6ddb8) and AFTER (head) are the same: "50 covered cell(s), 0 in the DEBT ledger, 0 exempt". check:nul-bytes passes, and a self-scan with grep -naP over every changed file finds no control byte. CI: not awaited (in_progress at report time). Not run locally: Temporal Conformance live PG/MySQL, Test Core shards, Dogfood, Build Core and the workspace type-check lanes are CI's.",
"line_budget": "n/a — no skills/** in the diff",
"deviations": [
"PM suggested route kept, measurement added: GLOB stays for every NUL-free comparand, as suggested. The measurement shows this leaves the stored-value half of the cut (finding 1, 9/50 cases). It was not fixed in place: condition 2 of the bounded in-place exemption (mechanical, shape already pinned) fails, because always switching contains/ends moves every SQLite $contains/$endsWith plan and the GLOB markers in other suites. So it is open question 1.",
"H5 half-falsified: length()/substr() over TEXT are not NUL-safe on any of the three engines, so the suffix goes through CAST(... AS BLOB). H2 held for driver-memory only; the MongoDB server was not measured. H4 held: pushLike emits GLOB with the same cut (measured), so remote-transport.ts is in the diff under the claim's conditional clause. H3: the PG/MySQL arms are NOT MEASURED and untouched.",
"The first run of the driver-sql pin at base had 2 test-authoring errors, not product failures, and both were corrected before any product edit: the JS expectation for $notContains U+0000+"?" was wrong, and the premise read hex(NULL) as NULL where SQLite gives "". Ablation 1 on the final file is the clean before-red.",
"Once ran pnpm --filter @objectstack/driver-sql test -- --maxWorkers=2 (a bare --). The whole package ran as intended (193 files); the worker flag may have been dropped.",
"Commit trailers use the model-free AGENTS.md pair (Claude-Session + Co-authored-by: Claude). The PR body ends with the AGENTS.md session-URL footer rather than the harness reminder's model-named / emoji form (os-dev: the harness attribution reminder yields).",
"Test file names differ from the PM's predicted path: sql-driver-19999-glob-nul-comparand.test.ts, not sql-driver-19999-glob-nul.test.ts. Added turso-19999-glob-nul-comparand.test.ts and sqlite-wasm-19999-glob-nul-comparand.test.ts.",
"Read-only side acts: fetched origin/claude/issue-19894-* into refs/os-dev-19999/peek-19894 to confirm #19894 does not touch remote-transport.ts (its files: turso-driver.ts, cli files-to-references, its changeset and tests); that ref and the worktree's root node_modules were removed before this report was posted (probes lived only in the scratchpad; nothing outside the claimed file surface was edited). The worktree ../objectstack-issue-19999 is removed with git worktree remove (no --force) immediately after this comment is posted; the branch head b60884a is on the remote."
],
"files_changed": [
"packages/drivers/driver-sql/src/sql-driver.ts (+73/-0: NUL_CHARACTER, sqliteLengthAwareTextMatch, a 5-line dispatch in textMatchPredicate's sqlite arm, docblock line)",
"packages/drivers/driver-sql/src/sql-driver-19999-glob-nul-comparand.test.ts (new)",
"packages/drivers/driver-sqlite-wasm/src/sqlite-wasm-19999-glob-nul-comparand.test.ts (new)",
"packages/drivers/driver-turso/src/remote-transport.ts (+36/-2: NUL_CHARACTER, the NUL branch in pushLike, docblock section)",
"packages/drivers/driver-turso/src/turso-19999-glob-nul-comparand.test.ts (new)",
".changeset/19999-sqlite-glob-nul-comparand.md (new; driver-sql, driver-sqlite-wasm, driver-turso patch; Clause-②: no)"
],
"compile_surfaces": [
"1 driver-sql applyFilterCondition -> textMatchPredicate SQLite arm (sql-driver.ts): TOUCHED; pinned on better-sqlite3; inherited by driver-sqlite-wasm (sqlite-wasm-driver.ts:67, pinned) and turso local (turso-driver.ts:1015, pinned in the turso suite)",
"1 same function, Postgres and MySQL arms: NOT MEASURED (no live server locally; no test drives a U+0000 comparand on the live cells); not touched",
"2 turso RemoteTransport.buildWhereSQL (remote-transport.ts:2632) -> pushLike: TOUCHED; measured with the same cut on the stub and on a local libSQL engine; pinned on makeLibsqlSqliteStub with local/remote parity; a real Turso server is NOT MEASURED",
"3 service-analytics compileScopedFilterToSql (read-scope-sql.ts:511): MEASURED AFFECTED (same cut, finding 2); not touched, outside the claim",
"4 service-analytics lowerAnalyticsWhere (filter-normalizer.ts:1613): NOT MEASURED by execution; shares textMatchPredicateSql SQLite arm by reading; not touched",
"5 formula matchesFilterCondition (matches-filter.ts:212): MEASURED UNAFFECTED (the JS oracle in the new suites)",
"half objectql applyHaving/matchesHaving (having-filter.ts:279/292): MEASURED UNAFFECTED (JS answer on 5 comparands)",
"thawed driver-memory checkCondition (memory-matcher.ts:361): MEASURED UNAFFECTED (50/50 equal to formula)",
"thawed driver-mongodb translateFieldOperators (mongodb-filter.ts:832): translation measured (raw U+0000 inside $regex); server NOT MEASURED"
]
}

Generated by Claude Code

os-dev-report
{
"issue": 19999,
"status": "done",
"round": "patch round 1 — answers contract review 5821310673 (FAIL at b60884a); addendum to os-dev-report 5820954458",
"branch": "claude/issue-19999-sqlite-glob-nul-comparand",
"pr": "#20019",
"head": "8600b81b18c1152a50f125a29ca8e40b2acc3792 (one commit on top of b60884a; no force-push, no merge of origin/main)",
"session": "session_01Bvd69VPa6puiNzzPUroDBx — mode:subagent, the parent's harness-stamped id (every commit's Claude-Session trailer)",
"premise_still_valid": true,
"summary": "Item 1 fixed in both emitters (sqliteLengthAwareTextMatch in sql-driver.ts, RemoteTransport.pushLike in remote-transport.ts). The ends construct is now coalesce(substr(CAST(col AS BLOB), -length(CAST(? AS BLOB))), CAST(col AS BLOB)) = CAST(? AS BLOB). This is a NULL-preserving equivalent of the reviewer's X'' fallback, chosen after measuring both. On every non-NULL value the two agree: the empty blob for '', which never equals a comparand of one byte or more. They differ only on a NULL value, where X'' answers false and the value fallback answers NULL. NULL is what GLOB and the contains/starts constructs answer, so the docblock sentence about NOT (...) NULL semantics stays true, and no other answer moves. Measured on the three engines before committing (SQL literals, no bind; 10 values x 4 comparands = 40 cases per form): the head form answered NULL for '' on all 4 comparands (typeof(substr(CAST('' AS BLOB), -1)) is null on 3.53.4, 3.49.1 and 3.45.1); both the X'' form and the chosen form matched JavaScript endsWith on every non-NULL case; 0 engine disagreements. Item 2: the docblock sentence is corrected (see sentences_changed). The optional ends+fold note was kept as one line: the other shapes honour fold as the GLOB arm does; nothing dropped. The NUL-free GLOB path is byte-identical: git diff b60884a..HEAD touches only the NUL branch, the docblocks and the tests, and the NUL-free compile pins are unchanged and green. Changeset: no sentence made false, none changed. PR body: NOT edited, as directed; three statements in it are now stale and the seat should update them: (a) the table row for ends still shows the old construct, and should read coalesce(substr(CAST(col AS BLOB), -length(CAST(? AS BLOB))), CAST(col AS BLOB)) = CAST(? AS BLOB); (b) the new-suite counts are now driver-sql 57/57, sqlite-wasm 26/26, turso 27/27; (c) the full-suite counts are now driver-sql 2737 passed | 170 skipped, sqlite-wasm 582, turso 1435, with head 8600b81.",
"tests": "PIN RED at head product code (sql-driver.ts and remote-transport.ts byte-equal to b60884a, git diff --quiet HEAD confirmed; only the three suites edited): driver-sql 3 failed | 54 passed of 57, sqlite-wasm 3 failed | 23 passed of 26, turso 3 failed | 24 passed of 27. The failures are exactly the three new $not $endsWith pins per suite (U+0000, U+0000+"b", "a"+U+0000), each missing the empty row; in turso each diff lost it from both the local and the remote column. The JavaScript-oracle checks of the new table were green: driver-sql's three separate oracle tests, and the oracle assertion inside each sqlite-wasm pin, which passed before that pin's row assertion failed. PIN GREEN after the change and a rebuild of driver-sql and driver-turso dists: 57/57, 26/26, 27/27. Full suites at 8600b81: pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2: 182 files passed | 11 skipped, 2737 tests passed | 170 skipped. driver-sqlite-wasm: 31/31 files, 582/582. driver-turso: 63/63 files, 1435/1435. typecheck (tsc --noEmit) on all three packages: exit 0. ESLint narrowed, --no-inline-config --format json over the 5 changed TS files: 5 files, 0 errors, 0 warnings, none ignored; type-aware linting is never enabled in eslint.config.mjs, so the verdicts of untouched files cannot move. COMPOSITION PROBE (48 cases: $not / $or / $and / nested $not over $endsWith with 6 NUL-bearing comparands, plus $not over $contains / $startsWith / $icontains / $notContains; 9 rows including '' and NULL; faces SqlDriver/better-sqlite3, SqliteWasmDriver/sql.js, TursoDriver local, TursoDriver REMOTE over a real @libsql/client :memory: engine, InMemoryDriver, formula): at b60884a, 18 of 48 cases had a face differing from formula. All 18 were $not over $endsWith, on the four SQLite faces alike, missing the '' row; InMemoryDriver equalled formula. At 8600b81: 0 of 48. BARE PROBE (the round-0 50 cases): unchanged. The rows with a NUL-bearing comparand are byte-identical to round 0, 0 of 35 diverge; the 9 NUL-free divergences (finding 1) remain.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "1 relay stroke: this os-dev-report addendum -> POST /repos//issues/19999/comments via scripts/pm/post-stamped.mjs (sent as one POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]). Plus git push x1 (b60884a..8600b81, not REST). No PR body edit, no label write.",
"open_questions": [],
"out_of_scope_findings": [
"unchanged from report 5820954458: findings 1-3 (class a) and the mongodb observation; the reviewer confirmed all four. For finding 1's follow-up card: the reviewer's precondition is met. The zero-length NULL in the BLOB suffix is closed, so the length-aware ends construct can now carry NUL-free comparands too without losing the '' row under $not."
],
"sentences_changed": [
{
"file": "packages/drivers/driver-sql/src/sql-driver.ts (sqliteLengthAwareTextMatch docblock, table row)",
"old": "| ends | substr(CAST(col AS BLOB), -length(CAST(? AS BLOB))) = CAST(? AS BLOB) |",
"new": "| ends | coalesce(substr(CAST(col AS BLOB), -length(CAST(? AS BLOB))), CAST(col AS BLOB)) = CAST(? AS BLOB) |"
},
{
"file": "packages/drivers/driver-sql/src/sql-driver.ts (sqliteLengthAwareTextMatch docblock)",
"old": "a comparand longer than the value yields the whole, shorter value, which is never equal to it.",
"new": "a comparand longer than a non-empty value yields the whole, shorter value, which is never equal to it. Over a ZERO-LENGTH blob substr yields NULL, not the empty blob (measured on all three engines: typeof(substr(CAST('' AS BLOB), -1)) is null), which would answer NULL for '' where the answer is false: invisible to a bare $endsWith, but a $not over it dropped the '' row. So coalesce() falls back to the value itself — substr answers NULL exactly when the value is NULL or zero-length, and the value is then the right stand-in: the empty blob, never equal to a comparand of one byte or more, or NULL, which stays NULL as it does under GLOB."
},
{
"file": "packages/drivers/driver-sql/src/sql-driver.ts (sqliteLengthAwareTextMatch docblock; the optional fold note)",
"old": "The fold is the GLOB arm's own lower() on both sides, ASCII-only.",
"new": "The fold is the GLOB arm's own lower() on both sides, ASCII-only; it only ever arrives with contains ($icontains), and the other two shapes honour it anyway, as the GLOB arm does."
},
{
"file": "packages/drivers/driver-turso/src/remote-transport.ts (pushLike docblock, section [#19999])",
"old": "... and a byte suffix over BLOB for ends (length() and substr() over TEXT stop at U+0000; over BLOB they count bytes).",
"new": "... and a byte suffix over BLOB for ends (length() and substr() over TEXT stop at U+0000; over BLOB they count bytes), which falls back to the value itself through coalesce() because substr() over a zero-length BLOB is NULL — so '' answers false, not NULL, and a $not over it keeps the row."
},
{
"file": "packages/drivers/driver-turso/src/remote-transport.ts (pushLike docblock)",
"old": "None has a pattern language, so nothing is escaped and the comparand is bound as written. Every other comparand keeps GLOB, byte for byte. turso-19999-glob-nul-comparand.test.ts holds this emitter and the local one to the same rows.",
"new": "Words unchanged, only re-wrapped after the clause above. Re-read in full: no other sentence in this docblock is made false by the change."
},
{
"file": ".changeset/19999-sqlite-glob-nul-comparand.md",
"old": "none",
"new": "none: no sentence is made false by this change (the $endsWith sentence says it "compares the value's trailing bytes over BLOB", still true)"
}
],
"gates": "Re-derived at 8600b81 with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths, 6 paths vs merge base fc6ddb8): 62 commands, byte-identical to round 0's list, so there is no new family. The union was re-run anyway on the new head, per the post-review rule, after pnpm exec turbo run build --filter=./packages/* --filter=./packages// --concurrency=2 (72/72 tasks) in the recreated worktree. All 62 exit 0, including check:dual-build-cjs-loads and check:type-check-debt ("none above its recorded number"). --ran: 62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. node scripts/check-issue-citations.mjs --base fc6ddb8: 6 citations across 2 files, all resolve. check:driver-conformance: "50 covered cell(s), 0 in the DEBT ledger, 0 exempt", the same as round 0 before and after. check:nul-bytes: OK (9432 tracked text files, no raw control bytes). CI at 8600b81: not awaited.",
"line_budget": "n/a — no skills/** in the diff",
"deviations": [
"The ends construct is not the reviewer's literal X'' form but its measured NULL-preserving equivalent (coalesce to CAST(col AS BLOB)); the reason is in summary. The coordinator allowed "that or an equivalent you measure". Cost: the ends binding list is now [field, text, field, text] where it was [field, text, text]. On sql.js the exact-text rewrite still wraps both comparand parameters, and the sqlite-wasm suite is green.",
"The worktree had been removed after round 0, so it was recreated on the existing branch at b60884a, and dists were rebuilt: the closure was a turbo cache hit, then a full packages build for the whole-tree gates. The root node_modules is removed before this comment is posted, and the worktree is removed with git worktree remove (no --force) right after it."
],
"files_changed": [
"packages/drivers/driver-sql/src/sql-driver.ts (ends construct + bindings, 3 docblock edits)",
"packages/drivers/driver-turso/src/remote-transport.ts (ends construct, 1 docblock clause + re-wrap)",
"packages/drivers/driver-sql/src/sql-driver-19999-glob-nul-comparand.test.ts (+NOT_ENDS_CASES: 3 oracle checks + 3 pins)",
"packages/drivers/driver-sqlite-wasm/src/sqlite-wasm-19999-glob-nul-comparand.test.ts (+3 pins, each also checked against formula)",
"packages/drivers/driver-turso/src/turso-19999-glob-nul-comparand.test.ts (+3 pins, local and remote)"
],
"compile_surfaces": [
"1 driver-sql textMatchPredicate SQLite arm: TOUCHED again (ends construct); inherited by driver-sqlite-wasm and turso local, all pinned and green; measured on the composition probe",
"2 turso RemoteTransport.pushLike: TOUCHED again (ends construct); pinned on makeLibsqlSqliteStub and measured on a real @libsql/client engine in the composition probe",
"1 PG/MySQL arms, 3, 4, 5, half, driver-memory, driver-mongodb: unchanged from report 5820954458 (not touched; the same readings)"
]
}

Generated by Claude Code

ACCEPT: PR #20019 at `8600b81b`

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-24T20:52Z. Reviewed against references/review-checklist.md on GitHub, not from the dev's reports (os-dev-report 5820954458 and its patch-round addendum on this card).

Shape: the first line is Fixes #19999, and the body declares Clause-②: no. The changeset grades @objectstack/driver-sql, @objectstack/driver-sqlite-wasm and @objectstack/driver-turso patch. Fixes #19999 is the only closing keyword; driver-sql / driver-turso (SQLite faces): GLOB still cuts a STORED value at its first U+0000, so a NUL-free $contains / $notContains / $icontains / $endsWith answers wrongly on it; a $like / $ilike pattern holding U+0000 is cut the same way #20024 and driver-sqlite-wasm: a text value does not round-trip the way driver-sql's does — an embedded NUL truncates the stored value, and a leading BOM is stripped on read #19978 are cited without one.
Scope: 6 files, 726 changed lines, not governed (check-governed-merges --pr 20019), and no generated path. All 6 are inside the claimed surface:
- the textMatchPredicate SQLite arm in sql-driver.ts, plus a new module-private sqliteLengthAwareTextMatch;
- remote-transport.ts pushLike, which is in scope by measurement (H4);
- three new suites;
- the changeset.
- No file moved on main since the merge base.
Contract review of record:
- FAIL at b60884a4 (5821310673): the ends construct answered NULL on a zero-length value, so a $not over $endsWith with a U+0000 comparand dropped the '' row on all four SQLite faces.
- After one patch round, PASS at 8600b81b (5822054158): 0 disagreements with formula over 1615 cases on five faces (380 with the round-0 files). NULL stays NULL like GLOB, and every changed sentence is TRUE.
CI at this head: 41 runs, 0 failures, and every required context is success. The skips are Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in), and the duplicate event-run Auto Label / Check PR Size, all on the roster.
Compile surfaces: every face is declared in the PR body. Face 1 (driver-sql SQLite arm, inherited by sqlite-wasm and turso local) and face 2 (turso remote) are touched. The PG/MySQL arms and a real Turso server are NOT MEASURED, and declared so. Face 3/4 (service-analytics) is measured affected and filed as service-analytics (SQLite): the shared text-match arm emits GLOB, so a $contains / $endsWith / $startsWith comparand holding U+0000 is cut at the NUL; on the read scope a leading U+0000 widens $contains / $endsWith to every row #20025.
Docs drift: none. No page in content/docs/** or skills/** makes a U+0000 claim, and the docs-drift bot lists no page naming a changed anchor.
Out-of-scope findings, all filed:
- driver-sql / driver-turso (SQLite faces): GLOB still cuts a STORED value at its first U+0000, so a NUL-free $contains / $notContains / $icontains / $endsWith answers wrongly on it; a $like / $ilike pattern holding U+0000 is cut the same way #20024 (engine): GLOB still cuts a stored value at its first U+0000, and $like / $ilike patterns holding one. The precondition the review set, the zero-length ends fix, lands with this PR.
- service-analytics (SQLite): the shared text-match arm emits GLOB, so a $contains / $endsWith / $startsWith comparand holding U+0000 is cut at the NUL; on the read scope a leading U+0000 widens $contains / $endsWith to every row #20025 (services, security): the service-analytics text-match arm.
- noted only, per the PR's Acceptance notes: driver-mongodb sends a raw U+0000 inside $regex, and the server's answer is not measured.
Open questions:
- Q1, option A (a length-aware construct for every contains / ends) is carried by driver-sql / driver-turso (SQLite faces): GLOB still cuts a STORED value at its first U+0000, so a NUL-free $contains / $notContains / $icontains / $endsWith answers wrongly on it; a $like / $ilike pattern holding U+0000 is cut the same way #20024.
- Q2 (a shared conformance row) is noted for triage and not filed. It needs live Postgres / MySQL / mongod measurement first, and no acting reader can be named yet.

Landing: ready + auto-merge through the queue. #20024 (Blocked-by: #19999) unlocks when this lands.

Landed: PR #20019, verified on `main`

domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-24T21:16Z.

Verified on main:
- PR fix(driver-sql, driver-turso): compare a SQLite text comparand holding U+0000 whole instead of cutting it at GLOB #20019 merged through the merge queue as 9d81af714f, which has one parent and is an ancestor of origin/main after a fresh fetch.
- sqliteLengthAwareTextMatch has 3 hits in sql-driver.ts at that commit and 0 at its parent.
- The round-1 coalesce ends construct is present in remote-transport.ts.
- .changeset/19999-sqlite-glob-nul-comparand.md is on main.
This card: closed completed via Fixes #19999. pm:dispatched was removed in the same act.
No lane card closed by mistake: driver-sql / driver-turso (SQLite faces): GLOB still cuts a STORED value at its first U+0000, so a NUL-free $contains / $notContains / $icontains / $endsWith answers wrongly on it; a $like / $ilike pattern holding U+0000 is cut the same way #20024 and service-analytics (SQLite): the shared text-match arm emits GLOB, so a $contains / $endsWith / $startsWith comparand holding U+0000 is cut at the NUL; on the read scope a leading U+0000 widens $contains / $endsWith to every row #20025 are cited without a closing keyword and are still open.
Serial queue: the sql-driver.ts textMatchPredicate region and remote-transport.ts pushLike are released.
Unlocks:
- driver-sql / driver-turso (SQLite faces): GLOB still cuts a STORED value at its first U+0000, so a NUL-free $contains / $notContains / $icontains / $endsWith answers wrongly on it; a $like / $ilike pattern holding U+0000 is cut the same way #20024 (Blocked-by: #19999, this lane) unlocks now. The review's precondition, that the zero-length ends answers false, is on main.
- service-analytics (SQLite): the shared text-match arm emits GLOB, so a $contains / $endsWith / $startsWith comparand holding U+0000 is cut at the NUL; on the read scope a leading U+0000 widens $contains / $endsWith to every row #20025 (domain:services, security) was blocked on the same landing. Its unlock is the services lane's; a pointer is posted there.

Generated by Claude Code

fix(driver-sqlite-wasm): a text value round-trips byte-for-byte — U+0…

fix(driver-sql, driver-turso): compare a SQLite text comparand holdin…

fix(driver-sql, driver-turso): SQLite $contains / $notContains / $ico…

fix(service-analytics): on SQLite, the text operators compare the who…

Navigation Menu

Repository navigation

driver-sql (SQLite faces): a `$contains` / `$startsWith` / `$endsWith` comparand holding U+0000 is cut at the NUL by `glob()`, so the filter answers wrongly; one that starts with U+0000 makes `$contains` / `$endsWith` match every row #19999

What happens

Measured (the #19978 dev, driver probe on base `a7581b326`; unchanged at PR #19998's head; the seat did not re-run it)

Why it matters

Suggested shape (⛔ not a ruling)

Filing-gate answers

Refined measurement: `$endsWith` widens too, and `$startsWith` narrows

分诊首次定级：`priority:p2` · `bug` · `domain:engine` · `pm:queue` —— SQLite 上「包含 / 开头是 / 结尾是」的比较值里只要有一个 NUL 字符，结果就错：以 NUL 开头的「包含」「结尾是」会匹配所有行

本席核对

定级说明

执行要点

ACCEPT: PR #20019 at `8600b81b`

Landed: PR #20019, verified on `main`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

driver-sql (SQLite faces): a $contains / $startsWith / $endsWith comparand holding U+0000 is cut at the NUL by glob(), so the filter answers wrongly; one that starts with U+0000 makes $contains / $endsWith match every row #19999

Description

What happens

Measured (the #19978 dev, driver probe on base a7581b326; unchanged at PR #19998's head; the seat did not re-run it)

Why it matters

Suggested shape (⛔ not a ruling)

Filing-gate answers

Activity

objectstack-fleet commented on Sep 24, 2026

Refined measurement: $endsWith widens too, and $startsWith narrows

objectstack-fleet commented on Sep 24, 2026

分诊首次定级：priority:p2 · bug · domain:engine · pm:queue —— SQLite 上「包含 / 开头是 / 结尾是」的比较值里只要有一个 NUL 字符，结果就错：以 NUL 开头的「包含」「结尾是」会匹配所有行

本席核对

定级说明

执行要点

objectstack-fleet commented on Sep 24, 2026

objectstack-fleet commented on Sep 24, 2026

objectstack-fleet commented on Sep 24, 2026

objectstack-fleet commented on Sep 24, 2026

ACCEPT: PR #20019 at 8600b81b

objectstack-fleet commented on Sep 24, 2026

Landed: PR #20019, verified on main

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

driver-sql (SQLite faces): a `$contains` / `$startsWith` / `$endsWith` comparand holding U+0000 is cut at the NUL by `glob()`, so the filter answers wrongly; one that starts with U+0000 makes `$contains` / `$endsWith` match every row #19999

Measured (the #19978 dev, driver probe on base `a7581b326`; unchanged at PR #19998's head; the seat did not re-run it)

Refined measurement: `$endsWith` widens too, and `$startsWith` narrows

分诊首次定级：`priority:p2` · `bug` · `domain:engine` · `pm:queue` —— SQLite 上「包含 / 开头是 / 结尾是」的比较值里只要有一个 NUL 字符，结果就错：以 NUL 开头的「包含」「结尾是」会匹配所有行

ACCEPT: PR #20019 at `8600b81b`

Landed: PR #20019, verified on `main`