@@ -85,6 +85,35 @@ All notable changes to AgentFlow are documented in this file.
   `.git` — is refused instead of emptied. The mutated module never leaves the
   temp workspace: the working tree is clean after a run.
 
+* **`sql_builder.py` is off the threshold line, and its residue is honest.**
+  It cleared 90% by a single mutant (90.8%, 128 killed of 141), which is not a
+  margin worth keeping: the next covered line added to the module would have
+  put the gate back in the red for reasons unrelated to the change. Nine of the
+  thirteen survivors could never have been killed. Eight mutated a
+  `typing.cast` type argument — a cast returns its second argument untouched
+  and never evaluates the first — so both casts are plain annotations now and
+  the mutants stop existing; the ninth turned `rows = []` into `rows = None` in
+  a branch whose next statement is `bool(rows)`, and carries a
+  `# pragma: no mutate` with the reason above it. The remaining four were the
+  `dialect="duckdb"` argument, and two of them are now dead: DuckDB list
+  indexing is 1-based where sqlglot's default dialect is not, so
+  `list_value(1, 2)[1]` read without the dialect comes back out of the scoper
+  as `[2]` — the tenant scoper would have changed which element the query asked
+  for while it added a WHERE clause. The module measures 98.4% (124 killed of
+  126) with `scripts/mutation_local.py` on py3.13.
+* **The two mutants still alive are named in the test file, not suppressed.**
+  `_scope_sql__mutmut_41` and `_43` drop the dialect from the parse of the
+  relation `_qualify_table` generated itself, and that string has one fixed
+  shape which — parsed with the dialect or without it — renders identically
+  under the `sql(dialect="duckdb")` `_scope_sql` applies on the way out, so no
+  input reaches them with a difference to observe. Not the same as neutral: the
+  *default-dialect render* of that shape rewrites `EXCLUDE` to `EXCEPT`, which
+  is why the mutants on the render itself stay killable and dead.
+  They are not equivalent — a `_qualify_table` that ever emitted
+  DuckDB-specific syntax would make them killable — so they get a written
+  record of what was tried and came out identical rather than a pragma that
+  would outlive its reason.
+
 ### Terraform — an exact core pin took the provider update channel down with it
 
 * **`required_version = "= 1.15.4"` broke Dependabot's terraform ecosystem the
 
@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import re
-from typing import cast
 
 import sqlglot
 from sqlglot import exp
@@ -97,7 +96,14 @@ def _holds_foreign_tenant_rows(self: SQLBuilderHost, physical: str) -> bool:
         One probe per table per process (cached), like the ``_table_columns``
         probe the old guard used.
         """
-        cache = cast("dict[str, bool] | None", getattr(self, "_foreign_tenant_cache", None))
+        # Declared rather than `cast(...)`. `typing.cast` returns its second
+        # argument untouched and never evaluates the first, so every mutant of a
+        # cast's type argument is equivalent by construction: no test can tell
+        # `cast("dict[str, bool] | None", x)` from `cast(None, x)`. Eight such
+        # mutants — four here, four in `_qualify_table` — sat in the mutation
+        # gate's denominator (CI run 34266462154) pretending to be gaps. An
+        # annotation says the same thing to mypy and leaves nothing to mutate.
+        cache: dict[str, bool] | None = getattr(self, "_foreign_tenant_cache", None)
         if cache is not None and physical in cache:
             return cache[physical]
 
@@ -112,7 +118,13 @@ def _holds_foreign_tenant_rows(self: SQLBuilderHost, physical: str) -> bool:
             )
         except BackendExecutionError:
             # Not materialized yet, or no tenant column: nothing to leak.
-            rows = []
+            #
+            # `rows = None` is the only mutant of this line and it is equivalent:
+            # `rows` is read exactly once, by the `bool(rows)` below, and
+            # `bool([]) == bool(None) == False`. Marked so it stops being
+            # generated — the gate's denominator should hold only mutants a test
+            # could kill.
+            rows = []  # pragma: no mutate
         found = bool(rows)
         if cache is not None:
             cache[physical] = found
@@ -141,9 +153,11 @@ def _qualify_table(self: SQLBuilderHost, table_name: str, tenant_id: str | None)
         promises and the two stores stay column-identical.
         """
         predicate = self._tenant_predicate(tenant_id)
-        cache = cast(
-            "dict[tuple[str, str | None], str] | None",
-            getattr(self, "_qualified_table_cache", None),
+        # Declared, not `cast(...)`, for the reason spelled out in
+        # `_holds_foreign_tenant_rows`: a cast's type argument is erased at
+        # runtime, so its mutants are unkillable by construction.
+        cache: dict[tuple[str, str | None], str] | None = getattr(
+            self, "_qualified_table_cache", None
         )
         cache_key = (table_name, predicate)
         if cache is not None and cache_key in cache:
 
@@ -60,10 +60,37 @@
 describing a mutant population that no longer existed, and it read as
 reassurance while a tenant-isolation guard sat unpinned.
 
-The CI gate (mutation.yml on py3.11) is the only source of truth for this score;
-mutant *counts* differ per interpreter, because ``mutate_only_covered_lines``
-makes the population depend on coverage attribution. Do not restate a number
-here that was not read off a mutation.yml run, and record the run id with it.
+The CI gate (mutation.yml on py3.11) is the source of truth for the score CI
+enforces, but since ``25769d7`` the same population is measurable here too:
+``python scripts/mutation_local.py --module
+serving/semantic_layer/query/sql_builder.py``, about two minutes. Mutant
+*counts* still differ per interpreter, because ``mutate_only_covered_lines``
+makes the population depend on coverage attribution, so a number written down
+here has to carry where it was measured.
+
+Two measurements, both py3.13 in ``.venv`` on 2026-09-09. At ``25769d7``: 141
+mutants, 128 killed, 13 survived, 90.8% -- the same population CI run
+34266462154 generated, down to the surviving mutant names. After this file and
+``sql_builder.py`` were changed to take the module off the threshold line: 126
+mutants, 124 killed, 2 survived, 98.4%.
+
+Fifteen mutants left the denominator, and which ones matters more than the
+count. Eight were mutants of a ``typing.cast`` type argument -- a cast returns
+its second argument untouched and never evaluates the first, so no test can
+ever tell them from the original. Six more were mutants of the ``cast(...)``
+*call itself* (its argument count, its second argument); they were killable,
+and they stopped existing along with the two casts, which are now plain
+annotations. The last one is the equivalent ``rows = []`` -> ``rows = None`` in
+``_holds_foreign_tenant_rows``, marked ``# pragma: no mutate`` in place. The
+casts were not pragma'd instead, because mutmut's pragma is recorded against a
+whole *statement*, at its first line. On the one-line cast it would have taken
+the eleven killable mutants on that line (the ``getattr``'s own seven, the
+assignment, and the cast call's argument mutants) out of the denominator as
+well -- the opposite of the point -- and on the four-line one in
+``_qualify_table`` it would not have reached the type string at all, only the
+``cache = ...`` on the opening line. Two further mutants were killed rather
+than removed, by
+``test_scope_sql_does_not_change_which_list_element_the_query_asks_for``.
 """
 
 from __future__ import annotations
@@ -770,3 +797,62 @@ def test_scope_sql_forwards_the_tenant_id_to_qualify_table():
     )
     host._scope_sql("SELECT * FROM widgets JOIN orders ON widgets.id = orders.id", "acme")
     assert calls == [("orders", "acme")]
+
+
+# --------------------------------------------------------------------------- #
+# The dialect the incoming SQL is read in. Scoping a query must not change what
+# the query means.
+# --------------------------------------------------------------------------- #
+
+
+def test_scope_sql_does_not_change_which_list_element_the_query_asks_for():
+    # `dialect="duckdb"` on the parse of the *incoming* SQL is not decoration.
+    # DuckDB's list indexing is 1-based; sqlglot's default dialect reads the
+    # same `[1]` as 0-based and re-renders it as `[2]` on the way out. So a
+    # caller that asked for the first element of `list_value(1, 2)` would get a
+    # scoped query asking for the second one -- the tenant scoper would have
+    # silently changed the answer while adding a WHERE clause. Kills the
+    # `dialect=None` and dropped-`dialect` mutants on the parse of the incoming
+    # SQL (`_scope_sql__mutmut_8` and `_10`).
+    host = _host(catalog=_Catalog("orders"), tenant_router=_TenantRouter(has_config=True))
+    out = host._scope_sql("SELECT list_value(1, 2)[1] AS x FROM orders", "acme")
+    assert out == f"SELECT [1, 2][1] AS x FROM {SCOPED_ORDERS_ACME}"
+
+
+# --------------------------------------------------------------------------- #
+# Two mutants of this module are left alive on purpose. This is the record of
+# why, so the next reader does not mistake them for a gap (measured 2026-09-09
+# with `python scripts/mutation_local.py --module
+# serving/semantic_layer/query/sql_builder.py`, sqlglot 30.12.0):
+#
+#     _scope_sql__mutmut_41   parse_one(scoped, dialect=None)
+#     _scope_sql__mutmut_43   parse_one(scoped)
+#
+# Both mutate the *second* parse in `_scope_sql` -- the one that reads `scoped`,
+# the relation `_qualify_table` built a line earlier, not anything a caller
+# supplied. That string has one fixed shape,
+#
+#     (SELECT * EXCLUDE (tenant_id) FROM <table> WHERE tenant_id = '<id>')
+#         AS "<table>"
+#
+# and whichever dialect parses it -- `duckdb` or sqlglot's default -- the AST
+# that comes back renders identically under the `sql(dialect="duckdb")`
+# `_scope_sql` always applies on the way out. That is the invariant that makes
+# the two mutants unreachable, and it is narrower than "dialect-neutral": the
+# *default-dialect render* of that same AST is not identical, it rewrites
+# `EXCLUDE (tenant_id)` to `EXCEPT (tenant_id)`. Which is exactly why the
+# mutants on the render (`parsed.sql(dialect="duckdb")`, line 240) are dead and
+# pinned -- do not weaken that argument on the strength of this note. Tried on
+# the parse side, and identical under the duckdb render either way: that exact
+# sub-select, a bare `SELECT * EXCLUDE (col)`, a struct literal, and FROM-first
+# syntax. The one construct that does differ is the list indexing the test
+# above uses, and it cannot appear here -- this module writes the string
+# itself, and never writes that.
+#
+# They are deliberately NOT marked `# pragma: no mutate`, unlike the `rows = []`
+# mutant in sql_builder.py. That one is unkillable by construction; these two are
+# merely unreachable through the generator as it stands today, and a
+# `_qualify_table` that ever emitted DuckDB-specific syntax would make them
+# killable again. A suppression would outlive the reason for it; this note does
+# not.
+# --------------------------------------------------------------------------- #