fix(query): fix arrow reversal tagging the subrelation incorrectly

pkg/query/arrow.go

@@ -142,12 +142,14 @@ func (a *ArrowIterator) checkRightToLeft(ctx *Context, resources []Object, subje
 			}
 			rightPathCount++
 
-			// rightPath.Resource is an intermediate object from the right side
-			// Now check if any of our input resources connect to this intermediate via left
+			// rightPath.Resource is an intermediate object from the right side.
+			// Now check if any of our input resources connect to this intermediate via left.
+			// Use tuple.Ellipsis as the relation since the left side stores subjects with "..."
+			// (the canonical relation for direct membership with no subrelation).
 			intermediateAsSubject := ObjectAndRelation{
 				ObjectType: rightPath.Resource.ObjectType,
 				ObjectID:   rightPath.Resource.ObjectID,
-				Relation:   "",
+				Relation:   tuple.Ellipsis,
 			}
 
 			leftSeq, err := ctx.Check(a.left, resources, intermediateAsSubject)

pkg/query/datastore.go

@@ -449,9 +449,15 @@
 		return r.iterResourcesWildcardImpl(ctx, subject)
 	}
 
+	// An empty Relation is always a bug in the caller: it must be either tuple.Ellipsis
+	// for direct membership or a specific subrelation string.
+	if subject.Relation == "" {
+		return nil, spiceerrors.MustBugf("IterResources called with empty subject.Relation for %s:%s; caller must use tuple.Ellipsis or a specific subrelation", subject.ObjectType, subject.ObjectID)
+	}
+
 	// Check if subject relation matches what this iterator expects.
-	// Both the schema's expected subrelation and the query's subject relation must match exactly.
-	// Ellipsis is a specific relation value, not a wildcard.
+	// When the schema uses ellipsis ("..."), callers should pass tuple.Ellipsis — the
+	// MustBugf above ensures "" never reaches here — but we match on the schema value directly.
 	if r.base.Subrelation() != subject.Relation {
 		return EmptyPathSeq(), nil
 	}
@@ -712,12 +718,12 @@
 		}}, nil
 	}
 
-	// For ellipsis, return the base type with empty subrelation
-	// Ellipsis means "any relation on this type"
+	// For ellipsis, preserve the ellipsis subrelation so callers that construct
+	// ObjectAndRelation values from SubjectTypes get the correct relation to query with.
 	if r.base.Subrelation() == tuple.Ellipsis {
 		return []ObjectType{{
 			Type:        r.base.Type(),
-			Subrelation: "",
+			Subrelation: tuple.Ellipsis,
 		}}, nil
 	}
 

pkg/query/datastore_test.go

@@ -414,6 +414,6 @@ func TestDatastoreIterator_Types(t *testing.T) {
 		require.NoError(err)
 		require.Len(subjectTypes, 1)
 		require.Equal("user", subjectTypes[0].Type)
-		require.Empty(subjectTypes[0].Subrelation) // Ellipsis returns empty subrelation
+		require.Equal(tuple.Ellipsis, subjectTypes[0].Subrelation) // Ellipsis is preserved as-is
 	})
 }