[objectstack-fleet]

Fixes #21242

Clause-②: no (narrowing)

This deletes @objectstack/formula's own copy of the whole-day upper bound (lteBound in matches-filter.ts). Ruling 5933322270 (letter A, on #21109) decided the deletion once the RLS write check judged the stored form (PR #21235). Its precondition, #21255, landed as c2cd65154, as the seat's answer B (5942310644) sequenced. The deletion opened one fail-closed write/read split, a number column against a day string. The engine's where door already refuses that comparand, so the RLS compile seam in plugin-security now runs the same spec verdict. That surface was declared on the services seat post (5945507305) and in claim amendment 5945512244 before the edit.

Base 5f7d84769a (the fast-forward of the branch to origin/main). Head f6a9373da4 (the contract review 5946309118 judged be721ef6fb; the review round added dd75c24d11 and f6a9373da4, see below).

#20822 is closed by the seat at landing. This PR does not close it.

What changes

• packages/formula/src/matches-filter.ts. lteBound, its docblock, the addWholeDays bullet that named it, and the nextUtcCalendarDay / isUnboundedAbove imports are deleted. $lte and a $between maximum now compare as written, with the same order() every other ordering operator uses. A docblock on the $lte arm records where the whole day is applied now and gives the remedy for a caller that passes no seam: lowerFilterCondition(filter, { isDatetimeColumn }).
• packages/plugins/plugin-security/src/rls-compiler.ts.
  • RlsFieldGuard gains number: each declared column's type, and a formula's returnType.
  • judgeCompiledComparands runs narrowPolicyNumberComparands after the shape door and before the comparand-type door, the engine's where order.
  • The walk only routes the spec's answers: numberComparandFieldVerdict / numberComparandDoorVerdict decide, NUMBER_COMPARAND_DOOR_SCALAR_OPERATORS / NUMBER_COMPARAND_DOOR_LIST_OPERATORS name the positions, and numberComparandRefusalMessage gives the words. No rule is restated.
  • A refusal leaves through the existing refused-comparand route: the read gets the deny sentinel and the write a 403. A numeric string is narrowed copy-on-write, and the provenance mark is carried.
• packages/plugins/plugin-security/src/security-plugin.ts. numberComparandFieldsCache is filled in the same loadObjectFieldNames pass as the datetime cache and cleared with it. Both guard construction sites pass it.
• Tests and changesets. The formula direct-call cases move (H5 below). The objectql aggregate pins are updated and extended, and plugin-security gains a new pin file. There are two changesets: formula and plugin-security, each minor, BREAKING, Clause-②: no (narrowing).

Caller table (H1), re-run at 5f7d84769a

lteBound was at matches-filter.ts:902, $lte used it at :688 and $between at :693, as H1 said. The three commits between c2cd65154 and the base touch none of these files. There are 4 production call sites in 2 packages (objectql, plugin-security), not 3: formula is the definer. Every other non-test hit is a re-export, a type or prose.

package	call site (head)	does a non-storage bound reach it?	evidence
objectql	having-filter.ts:1657 compareWithReference (having and aggregations[i].filter, every { $field } comparison)	yes: a per-row referent holding a bare day. No seam can lower a referent, and literal bounds are lowered by the engine seam before the walker	probes A1-A6 below
plugin-security	rls-check-stored-form.ts:316 storedFormCheckJudge (the RLS write check)	yes, on columns that are not datetime. The compile seam lowers datetime only, and the stored-form step covers date / datetime / time	R1-R4 below
plugin-security	explain-engine.ts:972 matchUnderDeclaredColumns (the explain row verdict)	yes: the same compiled using filter, on stored rows	the explain column of R1-R4
plugin-security	security-plugin.ts:3622 (:3611 at base) clearsWall (the tenant wall)	no. tenantLayer0FilterOf (tenant-layer.ts:173-179) emits only { organization_id: X }, { organization_id: { $in } } or the deny-id equality	source read

The two registry-less pins (H2)

H2 said the deletion moves both pins by design. Measured, it moves neither as written: no row of their fixtures closes on its due day, so the as-written comparison gives the same answer. Each pin is kept, and each is extended with one boundary row so that it now records the move. The reverse check reddens both.

pin	before	after	why
engine-aggregate-filter.test.ts, registry-less closed_at $lte { $field: 'due_on' } over ORDERS	picked: 3	picked: 3	o1, o2 and o5 close days before their due day, so both readings count them
…the same, with o7 closed on its due day at 15:00 (added)	picked: 4 of 7	picked: 3 of 7	as written, '2026-01-05T15:00:00.000Z' sorts above '2026-01-05', which is ADR-0053 D-D1 item 5 for a caller that passes no seam
engine-aggregate-having-comparand-shape.test.ts, registry-less last_closed $lte { $field: 'first_due' } over DT_ROWS	['c1']	['c1']	no group closes on its first due day
…the same, with group c4 closed on its due day at 15:00 (added)	['c1', 'c4']	['c1']	the same reason

Residual rows (H3, #21299) and one more mainline row

Measured through engine.aggregate, which REST POST /api/v1/data/:object/query calls, on both driver doors, with the before and after formula dists swapped in turn. Every changed answer is pinned.

row	door	before	after	the where twin
audit-opt-out object (systemFields: { audit: false }): row-carried created_at / updated_at $lte { $field: 'due_on' }, per-aggregation filter	engine.aggregate	3 of 4	1 of 4	refused 400 on an audit-on object, both at this position (INVALID_FILTER / 400) and in SqlDriver's where (measured on an audit-on object; the audit-opt-out where was not driven)
…the same pair at having	engine.aggregate	unreachable: max(created_at) on an undeclared field is INVALID_FIELD / 400	the same	(n/a)
direct applyInMemoryAggregation, closed_at $lte { $field: 'due_on' }, with or without a field map	the published @objectstack/objectql export	3 of 4	1 of 4	(no seam; the class rule belongs to engine.aggregate)
not anticipated: two declared text columns of one class, code $lte { $field: 'label' } with '2026-01-05 noon' against '2026-01-05'	engine.aggregate per-aggregation filter, and having over two groupBy columns	counted / kept	not counted / dropped	SqlDriver where keeps b2 only; SqlDriver engine.aggregate went from picked: 2 to 1, now matching the twin

The last row moves toward where. It is the aggregate twin of the RLS text-to-text cell (R3), and it is pinned in both test files.

The RLS write check (H4)

Measured through ObjectQL.insert + SecurityPlugin + SqlDriver (better-sqlite3), as a member, with the policy's using equal to its check:

cell	before (base)	after the deletion	after the seam step (head)
R1 title text $lte '2026-01-05', '2026-01-05T15:00:00Z'	admitted / read hidden / explain visible	403 / hidden / hidden	403 / hidden / hidden
R2 the same, '2026-01-05 noon'	admitted / hidden / visible	403 / hidden / hidden	403 / hidden / hidden
R3 title $lte { $field: 'code' }, code = '2026-01-05'	admitted / hidden / visible	403 / hidden / hidden	403 / hidden / hidden
R4 amount number $lte '9999-12-31', 5	admitted / shown / visible	403 / shown / hidden	403 / hidden / hidden; policy dropped refused-comparand on both clauses
controls: date / datetime on the boundary day, datetime $lte '9999-12-31', text earlier day, number vs number, date vs date reference, text vs '9999-12-31'	all admitted / shown / visible	unchanged	unchanged

The where door question, measured: engine.find with where { amount: { $lte: '9999-12-31' } } returns INVALID_FILTER / 400 ("compares a declared number field against "9999-12-31" … which is not a number"). The same holds for 'abc', while '10' is narrowed (1 row). So the seam refuses the same comparand, per answer B.

Direct-call cases (H5)

H5 said "the storage-form lowering" means @objectstack/core's temporalStorageForm. Measured: formula depends on @objectstack/spec alone (package.json), so its tests cannot reach core without a new dependency edge, a vitest alias and a lockfile change. The lowering the seams apply to a bound is spec's lowerFilterCondition (ADR-0053 D-D1 item 4), and temporalStorageForm is what the write check applies to the image, pinned in rls-check-stored-form.test.ts (green). So the cases move to the seam's lowering, or to storage-form literal inputs. None is deleted:

• matches-filter.test.ts, calendar-day block. These 8 assertions changed answer: the instants at 00:00, 09:15 and 23:59:59.999 under $lte '2026-07-28', $between at 21:40, the last day at 23:59:59.999, a Date at 10:00, the same-day $between, and '9999-12-30T10:00Z'. Each is now asserted as written (false), and its whole-day answer is asserted through lowerFilterCondition(…, { isDatetimeColumn }) (true), together with the lowered shape ($lt the next day; { $null: false } on the last day). The other assertions are kept, and run through the lowering where that is meaningful. One case is new: a number against a day string is false.
• matches-filter-field-reference-offset.test.ts. "A calendar day stays a calendar day" moves to the stored date form (done: '2026-03-02'). The old instant-against-day pair is now pinned as written (false at addDays: 1, true at 2), and handed the declared columns it is refused INVALID_FILTER / 400.
• matches-filter-temporal-conformance.test.ts. Every TEMPORAL_CASES filter runs through lowerFilterCondition with the declared { at: datetime, on: date } map, the RLS compile seam's input, as the driver-mongodb and driver-memory conformance suites already do. The expected rows are unchanged.

Filter-semantics faces (compile-surfaces.md)

• 1 driver-sql: already conformant. It compiles a bare-day bound as written on a column that is not datetime. Measured: where { title: { $lte: '2026-01-05' } } hides the instant text, and title $lte { $field: 'code' } keeps b2 only. There is no whole-day arm in sql-driver.ts (one comment hit).
• 2 turso RemoteTransport: already conformant by source (0 nextUtcCalendarDay hits in remote-transport.ts). The transport tests that import the matcher pass (103).
• 3 analytics read-scope-sql: not touched; 0 hits in read-scope-sql.ts. read-scope-sql-conformance (which imports the matcher) is green.
• 4 analytics filter-normalizer: out of scope. That face's interim copies (native-sql-strategy.ts:1761, objectql-strategy.ts:566, preview-evaluator.ts:106) are removed by its own deletion (ADR-0053 D-D1 item 9), not by this card. native-sql-filter-logic-conformance is green.
• 5 formula: changed (this PR).
• Half-face objectql having-filter: answers changed, source untouched. { $field } pairs that no seam lowers are compared as written, and both aggregate test files pin the change.
• Unfrozen driver-memory / driver-mongodb: already conformant. Their filter compilers carry no copy (0 hits in memory-matcher.ts / mongodb-filter.ts). The cube face's dateRange window (memory-analytics.ts:1236) is D-D1 item 8 and out of scope.

Review round (head f6a9373da4, after contract review PASS 5946309118)

Section added by the seat (domain:engine#1), from the dev's review-round report:

• The plugin-security changeset. Two sentences are corrected:
  • one published type gains a member: RlsFieldGuard, the optional fieldGuard argument of the root-exported RLSCompiler.compileFilter, gains the optional number member. It is additive and not an accept-set change;
  • the read leg is stated as measured on SQLite only.
• The WARN detail names its clause, and names PostgreSQL's server error only for using. Both clauses are pinned.
• An end-to-end text-column cell at the plugin-security door: a bare-day $lte on a text column now refuses the write (403) and hides the row on read, with the controls admitted. It goes red with the old formula dist swapped in.
• The design doc's F7 row reads retired. No other row moved.
• check:dispatcher-error-vocabulary (red on dd75c24d11) is fixed by spelling the one call site's code and status as literals (INVALID_FILTER, 400), the gate's preferred remedy.
• Verification at f6a9373da4: the plugin-security full suite passes (3,423); the whole Lint & Repo Gates job, run locally from lint.yml, is 185 of 185 steps green; dispatch-gates is 67 derived, 67 run, 0 not measured.

Verification (head be721ef6fb, through scripts/pm/os-verify-lock.sh)

• Build. turbo run build --filter='@objectstack/dogfood^...' (63 of 63) on the base tree. After the change, formula and plugin-security were rebuilt. The formula dist has 0 lteBound hits (3 before).
• Full suites:
  • @objectstack/formula: 43 files, 1257 passed;
  • @objectstack/plugin-security: 158 files, 3418 passed and 23 skipped, including PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235's rls-check-stored-form pins;
  • @objectstack/objectql: test 360 files, 7113 passed, and test:repo 1 file, 5 passed;
  • @objectstack/dogfood, against the rebuilt formula / plugin-security dists (0 lteBound hits in the formula dist, 4 narrowPolicyNumberComparands hits in the plugin-security dist): 164 files passed and 1 skipped, 1354 tests passed and 3 skipped, exit 0.
• Typecheck formula, plugin-security and objectql: exit 0, check:test-typecheck OK.
• Test-only consumers of the matcher:
  • driver-sql: 8 files, 481 passed and 4 skipped;
  • driver-sqlite-wasm: 6 files, 217 passed;
  • driver-turso: 2 files, 103 passed;
  • driver-memory: 18 passed;
  • driver-mongodb: 37 skipped (no mongod here);
  • platform-objects: 18 passed;
  • service-analytics: 2 files, 72 passed;
  • rest aggregation-filter-where-doors: 20 passed.
• Gates. dispatch-gates --commands derived 66 commands. All 66 were run and all exited 0. dispatch-gates --ran reports "66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN". Two gates first hit my own 280 s wrapper timeout (check:query-options-erasure, check:type-check-debt) and were re-run to exit 0. check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3) because 8 unrelated packages had no dist/. They were built (41 of 41 tasks from cache), and the gate then exited 0. Lint is narrowed, not the full pnpm lint. The checked population is the 9 .ts files of the diff, linted with eslint --no-inline-config --format json: 9 files, 0 errors, 0 warnings. eslint.config.mjs enables no type-aware linting (no parserOptions.project, header at :327) and no import plugin, so this diff cannot move the verdict on any file it does not touch. The full pnpm lint is left to CI.
• Reverse check 1, the seam. ablation-replace turned the number door off at its one call site (judgeCompiledComparands(…, fieldGuard?.number) without the third argument), on-disk anchor 1 to 0. rls-number-comparand-door.test.ts then went 4 failed / 7 passed: the three refusal pins and the == '10' narrowing pin. The restore was proven by blob equal to HEAD and an empty git diff HEAD.
• Reverse check 2, the deletion.
  • The whole-day reading was put back into $lte with a 'ablation-21242' marker (on disk 1; anchor 1 to 0). The formula suites went 9 failed. 4 of those are the as-written pins: the bare-day block, the last-day as-written case, the 9999-12-30 control's as-written leg, and the instant-against-shifted-day pair. The other 5 come from the ablation's simpler day arithmetic on an impossible day and on 9999-12-31 (two temporal-conformance date cases, the impossible-day case, and one leg each of the seam and no-instant cases), which lteBound handled with its calendar check and UNBOUNDED_ABOVE.
  • Rebuilt, ablation-dist-preflight found the marker in dist/. The objectql pins went 6 failed of 286: both registry-less boundary pins, the text/text, audit-opt-out and applyInMemoryAggregation pins, and the having text/text pin.
  • The restore leg was proven: --restore, a rebuild, --absent preflight exit 0, blob f963059621 equal to HEAD, and an empty git diff HEAD.

Acceptance notes (out of the claim's surface; nothing filed)

• plugin-security/src/rls-check-stored-form.test.ts:32-41, :233. The header "formula's whole-day copy is out of reach here" and the withoutWholeDayCopy matcher wrapper are now redundant: the wrapper changes no answer at head, and the pins stay green. Carrier: the services seat when it next touches the file (otherwise 承接者:无).
• docs/design/predicate-compilation-convergence.md:361: the F7 row still lists lteBound (2 sites). Stale prose, 承接者:无.
• driver-sql/src/cross-field-conformance-cases.ts:145: the note names "memory lteBound". It was already stale before this PR, 承接者:无.
• The RLS seam's number-refusal WARN detail is written for the clause it refused: the path is rooted at the clause (check.amount.$lte / using.amount.$lte), and it names PostgreSQL's server error only for using, the clause a driver binds; check is evaluated in-process. Both clauses' wording is pinned in rls-number-comparand-door.test.ts.
• The plugin-security changeset names one facet that admits more: after narrowing, record.amount == '10' admits a write of 10. The check used to refuse that write, compared as text, while the read showed the row. That facet is read/write agreement, and it ships under the no (narrowing) line.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/formula, @objectstack/plugin-security, touching 21 documentable anchor(s).

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/data-api.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/api/error-catalog.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/deployment/validating-metadata.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/kernel/contracts/data-engine.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/permissions/field-level-security.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/index.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/permissions-matrix.mdx (via computeLayeredRlsFilter (symbol, a method of class SecurityPlugin))
• content/docs/permissions/sharing-rules.mdx (via computeLayeredRlsFilter (symbol, a method of class SecurityPlugin))
• content/docs/plugins/packages.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/protocol/objectql/query-syntax.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/ui/forms.mdx (via SecurityPlugin (symbol, a top-level class))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/releases/v17/17-1.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/releases/v17/17-4.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/releases/v17/17-5.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))
• content/docs/releases/v17/17-6.mdx (via INVALID_FILTER (literal, a string literal in a comment in judgedNumberComparand; a string literal in judgedNumberComparand))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 23365eaedf5bd07795b3c3a47ff6f113469e5432 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 13f8e49843428b24665e3154a48324e0222b0dd6 — the merge of head f6a9373da41384d11a45a095372965154643cce8 into base 23365eaedf5bd07795b3c3a47ff6f113469e5432, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 13f8e49843428b24665e3154a48324e0222b0dd6 && git checkout 13f8e49843428b24665e3154a48324e0222b0dd6
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 23365eaedf5bd07795b3c3a47ff6f113469e5432 f6a9373da41384d11a45a095372965154643cce8 && git checkout -B drift-repro 23365eaedf5bd07795b3c3a47ff6f113469e5432 && git merge --no-ff f6a9373da41384d11a45a095372965154643cce8

node scripts/docs-audit/affected-docs.mjs --json 23365eaedf5bd07795b3c3a47ff6f113469e5432

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 23365eaedf5bd07795b3c3a47ff6f113469e5432 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: be721ef6fbed24fca447774a5e13e1ae95eb7cf6
Local-runs: none

Read-only and adversarial, on PR #21336 at the head above; merge base 5f7d84769a, two commits (e4d85c50b0, be721ef6fb); the API diff and git diff 5f7d8476..be721ef6 agree hunk for hunk (11 files, +737 / −96). Inputs: card #21242 (body and all ten comments), ruling 5933322270 on #21109 (letter A), the services declaration 5945507305 on #21118, the #21299 pointer 5944816815, the PR body, file list and diff, and the head's check-runs, read last. One caution for the seat: the shared checkout's FETCH_HEAD was moved by another fetch between my fetch and my first grep, so every reading below was re-taken against the literal sha.

① Derived judgments

1. The deletion — right. At the head packages/formula/src/matches-filter.ts has no lteBound: the function, its docblock, the addWholeDays bullet naming it, and the nextUtcCalendarDay / isUnboundedAbove imports are gone; $lte and the $between maximum use the same order() the other ordering arms use, with an inclusive at-most test; the 9999-12-31 no-bound special case went with it and now lives only in lowerFilterCondition (a lone $lte on that day lowers to { $null: false }, pinned). No replacement copy: repo-wide lteBound hits at the head are the F11 preview copy in service-analytics/src/preview-evaluator.ts (another face, ADR-0053 D-D1 item 9, its own deletion card, untouched), two rows of docs/design/predicate-compilation-convergence.md, the stale driver-sql conformance note and one service-analytics test docblock — all pre-existing. This is the ruling's "deleted mechanically".

2. The caller table — right, re-derived. git grep matchesFilterCondition at the head, tests, dist and prose excluded: 4 production call sites in 2 packages — objectql/src/having-filter.ts:1657, plugin-security/src/rls-check-stored-form.ts:316, plugin-security/src/explain-engine.ts:972, plugin-security/src/security-plugin.ts:3622; formula/src/index.ts:118 is the re-export and matches-filter.ts:331 the definer, which is what the first count's "3 packages" counted. Tenant wall: tenantLayer0FilterOf (tenant-layer.ts:170-180) emits only organization_id equality, $in or the deny filter, so no bound reaches it — unchanged by construction. Explain: explain-engine.ts compiles nothing itself (it imports RLS_DENY_FILTER and compiledPolicyNameOf only); it judges the using filter the plugin compiled at the guard site, so its row verdict moves with the read. A non-storage bound still reaches three callers (a per-row { $field } referent at having-filter; non-datetime columns at the write check and at explain); each changed answer is recorded in the PR body and the changesets and pinned at the evaluator (formula) and at engine.aggregate (objectql). The write-check cells on text columns (R1–R3) and explain's verdicts are recorded, not pinned end to end in plugin-security — see ③.

3. The objectql pins — right. H2 falsified as stated: no ORDERS row and no DT_ROWS group closes on its due day, so both registry-less pins keep picked: 3 and ['c1']; each is kept and extended with one boundary row (o7 / c4, closed at 15:00 on the due day) whose answer records the move (4 of 7 becomes 3 of 7; ['c1', 'c4'] becomes ['c1']). The residual rows of objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299 are pinned: audit-opt-out created_at / updated_at against due_on at the per-aggregation filter (3 of 4 becomes 1 of 4, both drivers, the audit-on object refused INVALID_FILTER / 400 as the control) and direct applyInMemoryAggregation (3 of 4 becomes 1 of 4, with and without a field map). The unanticipated mainline row — two declared text columns of one class, code $lte { $field: 'label' } with '2026-01-05 noon' against '2026-01-05' — is a correct change at a public door: one class, so the objectql having and the per-aggregation filter judge a cross-field reference's comparison class only on an addDays pair, so a plain datetime-vs-date { $field } answers by formula's whole-day reading where the where twin refuses it 400 #21255 rule does not refuse it; a per-row referent, so no seam lowers it; the old count read a text label as a calendar day, and the new one is the where twin's (driver-sql keeps b2 only). It is pinned at the per-aggregation filter (2 of 4) and at having over two groupBy columns (['2026-01-04']), and it is named in the formula changeset's engine.aggregate list. No objectql changeset is owed: objectql source is untouched.

4. The formula test moves — right; nothing deleted or weakened. The 8 assertions whose answer changed (the three instants under $lte '2026-07-28', the $between at 21:40, 9999-12-31T23:59:59.999Z, the Date at 10:00 on that day, the same-day $between on 9999-12-31, and 9999-12-30T10:00Z) each keep a whole-day leg through lowerFilterCondition(…, { isDatetimeColumn }) and gain an as-written leg; the lowered shapes are pinned ($lt the next day, { $null: false }, the split $between). Every unchanged assertion is kept (the next-day stop, the plain calendar day, the full-ISO bound, $gte / $gt / $lt, the impossible day, the null bound, the no-instant text value), and one case is new (a number against a day string is false). matches-filter-field-reference-offset.test.ts: the calendar-day case moves to a stored date input with both assertions intact; the old instant-against-day input is re-pinned as written (false at addDays: 1, true at 2) and refused INVALID_FILTER / 400 once the columns are declared (MatchesFilterOptions.fields is the right shape). matches-filter-temporal-conformance.test.ts: every TEMPORAL_CASES filter runs through the lowering with { at: datetime, on: date }, expected rows unchanged. One leg (the 9999-12-30 control's negative) now runs through the seam only; as written it is false too, so nothing is weakened.

5. The RLS compile seam — right, and one rule. Guard: RlsFieldGuard.number, filled by noteNumberMeta in loadObjectFieldNames on both fields shapes, set beside datetimeFieldNamesCache (security-plugin.ts:9315-9316) and cleared beside it in the metadata watch (:1433); fieldNamesCache has one setter (:9227) in the same pass, so declared and number cannot diverge, and both guard sites (:7463, :7735) pass it. Verdict imported, not copied: numberComparandFieldVerdict, numberComparandDoorVerdict, numberComparandRefusalMessage, NUMBER_COMPARAND_DOOR_SCALAR_OPERATORS and NUMBER_COMPARAND_DOOR_LIST_OPERATORS from @objectstack/spec/data — the same five names objectql/src/number-comparand-declared-type-door.ts imports; no grammar is restated. Order: assertListComparandShapes, then narrowPolicyNumberComparands, then normalizeFilterComparandTypes, then lowerFilterCondition — the engine's relative order (engine.ts:1027, :1075, :1085, :1251). Refusal: the thrown INVALID_FILTER / 400 is caught by the existing catch and returned as refused-comparand, so the policy is dropped for the clause being compiled; the new pin file records check:refused-comparand and using:refused-comparand on each of three predicates, 403 on the write and the deny sentinel on the read. Numeric string: narrows replaces the comparand copy-on-write (out ??= { ...spec }), provenance carried by withProvenanceOf. Guard absent: nothing judged, the shape datetime already takes. The walk itself is the seam's own: objectql's narrowNumberComparands is not a package export and objectql is a devDependency of plugin-security, so a shared walker cannot be imported; the positions walked are the spec's operator lists, and $field references and dotted keys are skipped as the engine skips them. PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235's pins: rls-check-stored-form.ts and its test are byte-identical between base and head; their verdict is the Test Core rollup (③).

6. The four RLS cells — right. R1 (text under a bare-day $lte, written as an instant), R2 ('2026-01-05 noon'), R3 (text against a text referent holding a bare day): write admitted becomes 403, read hidden throughout, explain visible becomes hidden. R4 (number under $lte '9999-12-31'): the deletion alone opened write 403 / read shown; with the seam, write 403 / read hidden / explain hidden, refused-comparand on both clauses. Every cell now gives one answer on read and write. Pinned: R4 (three refusal predicates), the numeric-string cells ('10' under $lte and == at 5, 50, 10 and 11), the controls (a numeric literal; a text column compared as written). The declared-column controls (date / datetime on the boundary day, datetime $lte '9999-12-31') are unchanged, as the stored-form check and the datetime lowering carry them.

② Semver level

• Declared: @objectstack/formula minor and @objectstack/plugin-security minor, each with a bang summary, a **BREAKING** banner, Clause-②: no (narrowing) at line start, and one ADR-0087 marker reading not-required (no-migration-prescription) with its why. breakingDeclaration reads all three signals plus the narrowing arm; Check Changeset and Lint & Repo Gates (which carries check:adr-0087-registration) are green on the head. minor is the launch-window guard's level for a breaking narrowing (check-changeset-no-major.mjs; objectql having and the per-aggregation filter judge a cross-field reference's comparison class only on an addDays pair, so a plain datetime-vs-date { $field } answers by formula's whole-day reading where the where twin refuses it 400 #21255 and the engine door 4a1df19 use the same sentence). Consistent.
• The == '10' cell. Rule applied: the Clause-② value answers one question — 「本卡放宽接受集或扩大公开面吗」 — and the arm records the breaking direction; yes (narrowing) is reserved for a diff that widens one surface and narrows another (scripts/pm/clause2-line.mjs). A numeric string naming its number is the declared contract since driver-sql on PostgreSQL answers 500 for a non-numeric string against a number field — where { amount: { $gt: "abc" } } is DATABASE_ERROR / 500 over REST, while InMemoryDriver and SQLite answer 200 with no rows #20336 (numberComparandDoorVerdict answers narrows), and the read already showed the row, so the check admitting that write is the check pulled back to the declared contract, which the lane rules say does not touch Clause ② (lanes/spec.md: 收窄仍是契约面,不触条款②; triage-duties.md: 拉回已声明契约 ⇒ 代裁车道). Precedents: the engine door 4a1df19 (objectql: refuse a non-numeric string compared against a number field at the engine's field-aware filter door (400, every driver and position) — the door half of #20336 #20351) declared no (narrowing) while its "12" to 12 narrowing admitted rows on InMemoryDriver that matched nothing before — the same shape; d2bc644 (RLS: a write check refuses a scalar written to a declared multi-valued field (tags: x under contains(x)) while the write stores [x] and the same policy reads it; the check cannot reach the write door wrap rule #21238) says in words that a write-check admission toward the read "is a security-floor behaviour change, not the declared widening" (its yes (widening) was earned by a new core export); and ruling 5933322270's execution parameter has a read/write-agreement move named in the changeset under the no value. no (narrowing) is the right line, and naming the admit in the changeset body is the precedent's form.
• Prose, before / now / remedy: accurate on every cell (they match the dev's table and the pins) and on the remedy (lowerFilterCondition(filter, { isDatetimeColumn }); compare a number with a number). One sentence is wrong in the plugin-security changeset: "No export or published type changes." RLSCompiler is a root export and compileFilter(…, fieldGuard?: RlsFieldGuard) is public, so RlsFieldGuard is reachable from the entry type graph and gains the optional number member — a published type change, additive and optional. It is not an accept-set widening (an absent guard judges nothing, exactly as datetime already works) and does not move the Clause-② value; the sentence should read "no export changes; the guard type RLSCompiler.compileFilter takes gains an optional number member". The same sentence in the formula changeset is true (lteBound was never exported). One more sentence is stated as fact without a live run: "PostgreSQL refuses to bind such text against a numeric column" — consistent with the spec door's own boundByDriver wording, and recorded by the dev as not measured on live PG. Changeset prose is the seat's sentence-by-sentence ACCEPT face, so both go to the seat as corrections owed before ACCEPT, not as grounds here.

③ Boundary flags

• H1 (count falsified) — confirmed: 4 sites in 2 packages; the definer is not a caller.
• H2 (the pins do not move) — confirmed: keeping both pins and adding one boundary row each is the right form; a rewritten pin would have lost the as-written reading.
• H5 (refined) — right: formula's package.json depends on @marcbachmann/cel-js and @objectstack/spec only; ADR-0053 D-D1 item 4 names that edge as the reason the lowering lives in @objectstack/spec/data, item 5 is the "comparison it wrote" reading for a caller that passes no seam, and item 9 the interim copies. The citations in the code and the changesets hold. Item 10's open question (an in-repo caller carrying a bare-day bound a deleted copy would have widened) is answered for this face by the dev's producer count (examples: 0 having, 0 $field, 3 RLS predicates, all equality).
• Out-of-scope notes, dispositions:
  • withoutWholeDayCopy wrapper and header in rls-check-stored-form.test.ts: redundant at the head; the pins still assert equivalent semantics ($lt-or-$eq equals $lte as written). A cleanup rider for the services seat when it next touches the file; no card, and not this PR (a cross-lane file outside the declared surface).
  • docs/design/predicate-compilation-convergence.md:361, the F7 row: now false. A hand-written design doc with no gate; PD chore: version packages #10 puts it in the acceptance notes. A one-row correction may ride in this PR (it is the ruling's own investigation doc) or in the F11 deletion card, which edits the same table; not blocking.
  • driver-sql/src/cross-field-conformance-cases.ts:145 ("memory lteBound"): stale before this PR; acceptance note, no card.
  • The RLS WARN wording: numberComparandRefusalMessage is called with boundByDriver defaulted (the where wording, naming PostgreSQL's server error) and a path rooted at where; true of using, not of check, WARN detail only. This one is the PR's own new sentence in its own declared file, and compileFilter knows the clause, so it owes a fix: in this PR (boundByDriver true for using only, the path rooted at the clause) or as a filed card — 承接者:无 is not a carrier for a sentence the seam itself prints. Not blocking: no author is shown it.
  • Residual rows to objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299: pinned here; the text / text row agrees with where and is not fail-open. Right; objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299's enumeration pin carries them.
• Not pinned end to end: R1–R3 and explain's verdicts are recorded in the PR body and the changesets and pinned at the evaluator, not at the plugin-security door. The card's bar ("same answer, or a recorded, storage-form-decided answer") is met; one text-column cell in rls-number-comparand-door.test.ts would close the gap cheaply. The seat's call.
• #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822: not closed by this PR (Fixes #21242 only; Part-of PR must not also close its card green); the seat closes it at landing per 5941587176.
• Governed surfaces: none of the 11 paths is governed (.changeset/, packages/formula, packages/objectql, packages/plugins/plugin-security); Governed Surface Queue Guard is green.
• Check-runs on the head, read last. First reading 2026-10-02T05:40:10Z: 32 runs, 28 complete and green or skipped, four in progress (Test Core (1/6), (5/6), (6/6), Type Check · workspace), so the required Test Core and TypeScript Type Check contexts were not yet verdicts then. Final reading 2026-10-02T05:45:30Z: 34 runs, every one complete, 31 success and 3 skipped by design (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), none red. The seven required contexts all conclude success: Lint & Repo Gates 05:38:23Z, TypeScript Type Check 05:41:09Z, Test Core 05:44:48Z, Dogfood Regression Gate 05:31:03Z, Build Core 05:28:21Z, Temporal Conformance (live PG + MySQL) 05:31:23Z, Governed Surface Queue Guard 05:23:26Z. Test Core green is the verdict on PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235's rls-check-stored-form pins and on the new rls-number-comparand-door pins. The PR is still a draft; readying, queueing and the #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 close stay the seat's acts.

Implemented-by: claude/issue-21242-retire-ltebound
Reviewed-by: session_017xfMoEjKUuSh2xYB8sCozp

VERDICT: PASS

---

Generated by Claude Code