fix: correlated NOT IN with a non-equality correlation returns wrong results

benchmarks/sql_benchmarks/null_aware_join/benchmarks/q05.benchmark

@@ -3,6 +3,20 @@ group null_aware_join
 
 load sql_benchmarks/null_aware_join/init/load.sql
 
+# Correctness canary: the NOT IN result must match a reference count
+# that does not use NOT IN. It holds for every NAJ_ROWS / NAJ_LARGE_ROWS.
+# As Q04, with NULL outer keys excluded unless the subquery is empty.
+assert I
+SELECT count(*) = (
+  SELECT count(*) FROM small_outer o
+  WHERE o.z <= (SELECT min(z) FROM small_inner)
+     OR (o.id_n1 IS NOT NULL AND NOT (o.id % 2 = 0 AND (o.id / 2) % 1000 < o.z))
+)
+FROM small_outer o
+WHERE o.id_n1 NOT IN (SELECT i.id_n0 FROM small_inner i WHERE i.z < o.z);
+----
+true
+
 expect_plan HashJoinExec
 expect_plan null_aware: true
 

benchmarks/sql_benchmarks/null_aware_join/benchmarks/q06.benchmark

@@ -3,6 +3,20 @@ group null_aware_join
 
 load sql_benchmarks/null_aware_join/init/load.sql
 
+# Correctness canary: the NOT IN result must match a reference count
+# that does not use NOT IN. It holds for every NAJ_ROWS / NAJ_LARGE_ROWS.
+# As Q04, with NULL outer keys excluded unless the subquery is empty.
+assert I
+SELECT count(*) = (
+  SELECT count(*) FROM small_outer o
+  WHERE o.z <= (SELECT min(z) FROM small_inner)
+     OR (o.id_n50 IS NOT NULL AND NOT (o.id % 2 = 0 AND (o.id / 2) % 1000 < o.z))
+)
+FROM small_outer o
+WHERE o.id_n50 NOT IN (SELECT i.id_n0 FROM small_inner i WHERE i.z < o.z);
+----
+true
+
 expect_plan HashJoinExec
 expect_plan null_aware: true
 

benchmarks/sql_benchmarks/null_aware_join/benchmarks/q07.benchmark

@@ -3,6 +3,22 @@ group null_aware_join
 
 load sql_benchmarks/null_aware_join/init/load.sql
 
+# Correctness canary: the NOT IN result must match a reference count
+# that does not use NOT IN. It holds for every NAJ_ROWS / NAJ_LARGE_ROWS.
+# A row is TRUE when the subquery is empty, or when the subquery holds no NULL
+# and the key is not in it. A NULL is in scope when its z is below o.z.
+assert I
+SELECT count(*) = (
+  SELECT count(*) FROM small_outer o
+  WHERE o.z <= (SELECT min(z) FROM small_inner)
+     OR (o.z <= (SELECT min(z) FROM small_inner WHERE id_n50 IS NULL)
+         AND NOT (o.id % 2 = 0 AND (o.id / 2) % 1000 < o.z))
+)
+FROM small_outer o
+WHERE o.id_n0 NOT IN (SELECT i.id_n50 FROM small_inner i WHERE i.z < o.z);
+----
+true
+
 expect_plan HashJoinExec
 expect_plan null_aware: true
 

benchmarks/sql_benchmarks/null_aware_join/benchmarks/q08.benchmark

@@ -3,7 +3,30 @@ group null_aware_join
 
 load sql_benchmarks/null_aware_join/init/load.sql
 
+# Correctness canary: the NOT IN result must match a reference count
+# that does not use NOT IN. It holds for every NAJ_ROWS / NAJ_LARGE_ROWS.
+# A row is TRUE when o.z > 900, when the subquery for its k is empty, or when
+# its key is not NULL and not in that subquery.
+assert I
+SELECT count(*) = (
+  SELECT count(*)
+  FROM small_outer o
+  JOIN (SELECT k, min(z) AS min_z FROM small_inner GROUP BY k) m ON m.k = o.k
+  WHERE o.z > 900
+     OR o.z <= m.min_z
+     OR (o.id_n50 IS NOT NULL
+         AND NOT (o.id % 2 = 0 AND (o.id / 2) % 16 = o.k AND (o.id / 2) % 1000 < o.z))
+)
+FROM small_outer o
+WHERE o.z > 900
+   OR o.id_n50 NOT IN (
+        SELECT i.id_n0 FROM small_inner i WHERE i.k = o.k AND i.z < o.z
+      );
+----
+true
+
 expect_plan HashJoinExec
+expect_plan null_aware: true
 
 run
 -- Q8: NOT IN correlated by both an equality and a non-equality, 50% NULL on