ADR-0139 E3 + E4: the five drivers compile the composed ReadableIds leaf or refuse it with D3's envelope, and the conformance case-set lands with their suites (D3) #23639

Filing gate: ④ a coordination node's execution card, rows E3 and E4 of ADR-0139's execution plan (part of #22788). It is derived and in scope, so it inherits #22788's lane, grade and area. Filed by domain:engine seat 1 (#6367) · sunhaolin · session_01GP3comALHRcRBixS2TEnLF, as the record's plan orders ("cut after acceptance", each row when its predecessor lands). ⛔ Classes, positions and functions only.

Predecessors landed:

• E2 (ADR-0139 E2: the engine composes the ReadableIds leaf once per parent object, fail closed, refuses it on write verbs and for D5's three classes, and marks the scope 'policy' (D2, D5) #22861), PR feat(objectql,core): the engine composes the ReadableIds leaf at its executor boundary, fail closed, and refuses it by name where it cannot (ADR-0139 E2) #23301 → 87e902dcbb. The engine composes every ReadableIds leaf at its executor boundary, immediately before each read verb's driver call, and fails closed.
• spec: declare the RLS deny sentinel once in @objectstack/spec, imported by plugin-security and objectql (ADR-0139 D2 step 2; #22861 sub-question 2 ruled (i)) #23009's spec half, PR feat(spec): the RLS deny sentinel and the composed ReadableIds leaf, declared once in the data entry; getReadFilter answers the one object (ADR-0139 D2) #23144: ReadableIds.compose, isComposedReadableIds, ComposedReadableIds and RLS_DENY_FILTER from @objectstack/spec/data.

Why E3 and E4 are one card. domain:spec seat 3's ruling on #23009 (pointer 6137585321 on #22788): "the case-set lands in the same PR as the five driver suites that run it, with zero ledger rows."

• scripts/check-driver-conformance.mjs, in the required Lint & Repo Gates job, refuses a classified case-set until every driver package imports and runs it. The plan row reads E4 "with E3".
• This card is the "E3 and E4 in one PR" form. Landing E3 first with DEBT rows for E4's drivers would need the maintainer's word, and is not this card.

The work (ADR-0139 D3; the plan's rows E3 and E4)

• driver-sql compiles the composed leaf in its filter compiler to field IN (SELECT id FROM P_TABLE WHERE SCOPE AND TENANT). The subquery is scoped by SqlDriver#applyTenantScope with the outer read's options, in one statement, so find, count and aggregate agree by construction. driver-sqlite-wasm and the local transport of driver-turso inherit it.
• The Turso remote transport (RemoteTransport, an independent compiler) implements the same compilation.
• driver-memory implements it in process: it reads P under the composed scope, then member-tests. No tenant wall is owed, because memory refuses multi-tenant boot.
• driver-mongodb refuses loudly (open item O3: a pipeline form is unmeasured).
• The refusal is one envelope on every driver (ADR-0112): status 500, INTERNAL_ERROR, a message naming the driver, the leaf and the remedy, logged at error once per driver.
  • ⛔ Not INVALID_FILTER.
  • ⛔ No DriverCapabilities bit.
  • A driver refuses an uncomposed leaf on isReadableIds alone.
• The conformance case-set (READABLE_IDS_CASES, D3's last bullet) lands with the five suites.
  • It is parked, with no PR, on branch claude/issue-23009-readable-ids-conformance at e641ab6d8: packages/spec/src/data/readable-ids-conformance.ts plus its CASE_SETS row.
  • That branch's other commits are feat(spec): the RLS deny sentinel and the composed ReadableIds leaf, declared once in the data entry; getReadFilter answers the one object (ADR-0139 D2) #23144's, already squash-merged to main, so a claimant carries the two artefacts over, not the branch.
  • packages/spec and the gate script are domain:spec surfaces. The claim declares them cross-lane.

Pins (the plan's rows; red before, green after)

• E3:
  • a reader with more than 2,000 readable candidates gets every visible row;
  • an unreadable row stays hidden;
  • a deleted parent is excluded;
  • count equals the rows served.
• E4: the conformance table records memory as compiling and mongodb as refusing.
• Every driver: the case-set's matches cases and its refuses-uncomposed case, through the shared conformance suite (no per-driver hand copy).

Readings this card owes (ADR-0139 open items)

• O1: the bound-parameter ceilings of SQLite, Postgres and MySQL. The record cites documented values only. E3 measures what the subquery form binds.
• O3: mongodb keeps the refusal. No pipeline prototype here.
• The driver conformance ledger only goes down. The claimant reads covered and DEBT before and after. Zero new DEBT rows.

Governing text

• ADR-0139 D3 and the execution plan's rows E3 and E4.
• ADR-0112: the refusal envelope.
• ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination) #22788 note 3 (the director's ruling pointer 6104842076): "D3 stands as written, per the maintainer: no capability bit, and driver-mongodb refuses loudly until O3 measures a pipeline form."
• [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 (the 2026-08-05 driver-memory / driver-mongodb freeze) freezes defect and semantic-completion investment in those two drivers.
  • ADR-0139 was accepted later (PR docs(adr): ADR-0139 — one engine-internal semi-join leaf, "the ids of object X this caller may read" (ruling A on #22590 item 3) #22707 → a2e94c2a05, Tier H). Its D3 names memory's implementation and mongodb's refusal, so this card's two rows are the record's, not a thaw.
  • Nothing else in those two drivers rides along.

State at filing (origin/main 23e689dc7d)

• git grep -l "ReadableIds" origin/main -- packages/drivers returns 0 files. The control TEMPORAL_CASES over the same pathspec returns 10.
• readable-ids-conformance.ts is not on main. git cat-file -e fails, while packages/spec/src/data/readable-ids.ts is present.

Dedupe

MCP search_issues on this repo, closed included: "ADR-0139 E3 driver-sql compiles the ReadableIds leaf applyTenantScope memory mongodb E4" returns 43 hits.

• The nearest are ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination) #22788 (the parent), ADR-0139 E2: the engine composes the ReadableIds leaf once per parent object, fail closed, refuses it on write verbs and for D5's three classes, and marks the scope 'policy' (D2, D5) #22861 (E2), feat(spec): ADR-0139 E1 — the ReadableIds branded comparand leaf, declared in spec and unspellable by a request #22787 (E1) and ADR (ruling A on #22590 item 3): one engine-internal semi-join leaf, "the ids of object X this caller may read"; ADR-0055 alternatives row (a) revisited for this one leaf #22678 (the ADR card).
• None is E3 or E4.

Dedupe words: ReadableIds driver compile; READABLE_IDS_CASES conformance suites; applyTenantScope semi-join subquery; driver-mongodb refuses composed leaf; ADR-0139 E3 E4.

Generated by Claude Code