formula: retire F7's whole-day copy (lteBound in matches-filter.ts) now that the RLS write check judges the stored form (#21109, PR #21235); its direct-call cases move to the storage-form lowering

[objectstack-fleet]

立卡门 ③:维护者直派的任务。
动手的读者:分诊定级并定车道。packages/formula 属 domain:engine(按 lanes 职责表),由该车道席位认领。
查重:mcp__github__search_issues 查 "delete lteBound formula matches-filter whole-day copy F7 retirement",0 条命中;查 "formula whole-day upper bound copy retire after RLS check stored form",1 条命中,即父卡 #21109(已 closed)。

维护者原话与裁决

#21109 的裁决 5933322270(batch #261 item 5,字母 A),维护者原话「其他四张同意」,2026-10-01T14:16Z。裁决原文:

"A: the RLS write check judges the row as it will be stored. … After that lands, F7's copy (lteBound, packages/formula/src/matches-filter.ts:867) is deleted mechanically. Until then it stays exactly as it is."

卡片里被裁选项 A 的描述(中文原文):「随后另开一张删除卡删掉 lteBound,它的 24 个直调用例改走 lowering。」

条件已满足

• PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235([Decision] #20822 F7: retiring formula's whole-day copy — the RLS write check judges the raw post-image, so deleting the copy refuses writes the same policy's read shows #21109)已合并为 ef96c9ed:RLS 写检查在判定前,把声明为 date / datetime / time 的列(写入映像与检查的比较值两侧)都转成 @objectstack/core 的 temporalStorageForm。
• 该 PR 的 pin 在 F7 不可达的条件下也通过:测试把 @objectstack/formula 的 matchesFilterCondition 包了一层,使 $lte 以 $lt-或-$eq 的形式到达,$between 以 $gte 加上同样的方式到达(dev 报告 5939908710,H5)。

本卡要做的

• 删除 packages/formula/src/matches-filter.ts 的 lteBound(现在约在 :902,$lte 用在 :688,$between 用在 :693),以及只为它存在的说明(约 :1008)。
• 它的直调用例改走存储形的转换(lowering)。
• 先测再删: PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235 的 dev 记录 RLS 的 CEL 下沉不产生 { $field, addDays } 比较值(cel-to-filter.ts:addDays 0 处命中,$field 5 处作为对照)。所以 F7 的 { $field, addDays } 那一半要在 lteBound 的其他调用方上实测:列出 matchesFilterCondition 的每一个生产调用方,确认删掉后没有任何调用方再依赖整日上界。
• Pins: 每个仍然存在的调用方在删除前后给出同一答案,或者给出经过记录的、由存储形决定的答案;RLS 写检查与读的一致性(PR fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235 的 pin)保持全绿。

不在本卡

多值字段的标量包裹(#21238)不在本卡范围。

---

Generated by Claude Code · domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

Triage: first grade — tech-debt · priority:p2 · domain:engine · area:api · pm:queue. Delete F7's whole-day copy, measuring every caller first

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T21:59Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2. It is the parent's grade (#21109, p2). This is the deletion the maintainer's ruling A scheduled, verbatim 「其他四张同意」, ruling 5933322270. Its condition is met: PR #21235 merged as ef96c9ede7, and #21109 is closed completed (read at this write).

Routing. packages/formula is domain:engine. area:api follows the parent.

Direction (the card's own, accepted):

• Measure first. List every production caller of matchesFilterCondition. Confirm that none still needs the whole-day upper bound, including the { $field, addDays } half on the callers other than the RLS check.
• A caller that does need it stops the deletion: the claim reports it here, and the copy stays.
• Then lteBound (matches-filter.ts:902 on main) and its explanatory comment go. The $lte / $between arms and the direct-call cases move to the storage-form lowering. ⛔ No replacement copy elsewhere.

Pins: each surviving caller answers the same before and after, or gives a recorded, storage-form-decided answer. PR #21235's read/write-consistency pins stay green.

Not this card: #21238 (the multi-valued wrap).

---

Generated by Claude Code

[objectstack-fleet]

Landing note from triage · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T22:05Z. This card is #20822's last group (F7). #20822 is now pm:blocked on this card (Blocked-by: #21242). The act that lands this card also closes #20822 completed, citing the landing. #20822 has no other open group.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21242-retire-ltebound
Worktree: objectstack-issue-21242
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
Ruling-ref: 5933322270
File surface: packages/formula/src/matches-filter.ts (lteBound at :902, its $lte / $between uses at :688 / :693, and its explanatory comment near :1008 at 4b59a381) and the direct-call cases in packages/formula's tests, plus a formula changeset. The measure-first step comes before any edit: every production caller of matchesFilterCondition, about 48 non-test references outside the module. A caller that still needs the whole-day bound stops the deletion, and the claim reports it here. ⛔ No replacement copy elsewhere, ⛔ not #21238 (the multi-valued wrap).
Container & model: M (measurement-heavy, small deletion), mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no
Thread-read: 5941587176
Serial constraints cleared: read at 2026-10-01T22:26Z against origin/main 4b59a381. PR #21235 (#21109) landed as ef96c9ede7, which is the ruling's condition. In flight in this lane, none touches packages/formula: #21226 (PR #21245, queued), #21241 (driver-sql) and #20595 stage 3 (objectql comments). At landing, this seat closes #20822 completed, citing the landing, per triage's note 5941587176. #20822 is pm:blocked on this card; #5930 is blocked on #20822.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21242,
"status": "needs_decision",
"branch": "claude/issue-21242-retire-ltebound",
"pr": null,
"session": "session_017xfMoEjKUuSh2xYB8sCozp (this run is a subagent; the id is the dispatching session's, as the claim carries it)",
"premise_still_valid": true,
"summary": "STOPPED at the measure-first step, before any deletion, per H3 and H5: two production callers of matchesFilterCondition answer differently at a public door once lteBound is gone. Nothing is committed: the branch is the empty-branch probe at 4b59a38, the worktree is clean (matches-filter.ts blob 31f963a2 == HEAD blob, git diff HEAD 0 bytes, git status --porcelain empty), and formula's dist is restored byte-identical (diff -r against the saved pre-change build: no output). The deletion itself is mechanical and was built only to measure: lteBound, its docblock and the addWholeDays bullet naming it went, $lte and the $between max became order(actual, v, a LTE b), and the nextUtcCalendarDay / isUnboundedAbove imports went (+10 / -40 in one file; the patch is in scratch, never pushed). The premise holds: lteBound is at matches-filter.ts:902, $lte uses it at :688 and $between at :693, and the addWholeDays comment at :1008 names it, at 4b59a38. CALLER TABLE (4 production call sites in 3 packages; every other non-test hit of the identifier is a re-export, a type or prose): (1) plugin-security rls-check-stored-form.ts:260, the RLS write check. It is fed by the RLS compile seam (judgeCompiledComparands, then lowerFilterCondition with a typed guard whose datetime set is fields with type datetime), so a bare-day $lte reaches the matcher unlowered on every NON-datetime column. A non-storage bound DOES reach it. ANSWER CHANGES, all at ObjectQL.insert as a member. A text column under { title: { $lte: '2026-01-05' } } written as '2026-01-05T15:00:00Z' or '2026-01-05 noon' goes from admitted to PERMISSION_DENIED/403, while the read under the same predicate hides the row in both runs. Text-to-text { title: { $lte: { $field: 'code' } } }, with code holding a bare day, likewise goes from admitted to 403 with the read hiding the row. A number column under { amount: { $lte: '9999-12-31' } } with amount 5 goes from admitted to 403 while the read SHOWS the row: a NEW fail-closed read/write split. So the write accept set NARROWS, which the claim's Clause-② no does not declare. (2) objectql having-filter.ts:1494 compareWithReference, serving having and aggregations[i].filter. It is reached through engine.aggregate, which REST POST /data/:object/query calls (protocol.ts:11728); I drove engine.aggregate, not HTTP. It does receive { $field, addDays } comparands, and also plain { $field } comparands that the class rule never judges: that rule runs only on an addDays pair (having-filter.ts:1425 and assertAggregationFilterReferencesAreDeclared). ANSWER CHANGES. Aggregation filter { closed_at(datetime): { $lte: { $field: 'due_on'(date) } } }: count 3 becomes 1, because the rows closed on the due day at 15:00 and at 00:00 drop out; its where twin answers INVALID_FILTER/400 in both runs. Having on max(closed_at) $lte { $field: day bucket }: 2 groups become 0. Same-class addDays pairs (date/date, datetime/datetime), a date/date plain reference and a having date/date addDays all answer the same, and a cross-class addDays pair is INVALID_FILTER/400 in both runs. This caller still relies on the whole-day reading of a bare-day REFERENT, which no seam can lower because the bound is per row. Without it, having/aggregation filters return the midnight-anchored answer #3777 removed, silently. (3) plugin-security explain-engine.ts:972. It judges stored rows under the same compiled using filter (plus tenant equality/$in and a sharing filter of owner/id equality and $in). Not driven through its door; a direct witness over both dists with the declared columns: text instant-looking under a bare-day $lte true to false, text-to-text reference true to false, number vs '9999-12-31' true to false, date and seam-lowered datetime unchanged. Its verdicts move with the read in the first two and away from it in the third. (4) plugin-security security-plugin.ts:3611, the tenant wall. tenantLayer0FilterOf emits only { organization_id: X }, { organization_id: { $in } } or the deny-id equality, so lteBound is never reached: no change by construction. The RLS CEL lowering emits no addDays comparand (cel-to-filter.ts: addDays 0 hits; $field 5 hits as the control). In-repo producers: examples at 4b59a38 carry 3 RLS predicates (all equality on current_user.email), 0 having and 0 $field; control words groupBy 9 and aggregate 64 hits. So every changed answer is reachable at a public door, and none has an in-repo producer. SendMessage to the seat (main) sent with this evidence. Options are in open_questions[0].",
"tests": "No commit, so no gate run is owed against a landed diff. Gates: NOT MEASURED, family dispatch-gates derivation and its targeted list; reason: needs_decision, empty changeset at 4b59a38 (worktree clean). Build: os-verify-lock -c 'pnpm turbo run build --concurrency=2' over plugin-security, objectql, driver-sql and driver-memory, each with its dependency closure: VERDICT command-exit 0, 19/19 tasks, held 210s. The first attempt was killed (exit 137) by the container restart and was rerun. DIFFERENTIAL PROBE: one scratch vitest file (never committed; copied into packages/plugins/plugin-security/src for each run, then removed) drives ObjectQL + SecurityPlugin + SqlDriver(better-sqlite3) at 4b59a38. formula resolves through its dist in this suite (KNOWN_UNALIASED_TEST_IMPORTS lists formula for plugin-security; objectql and driver-sql are aliased to src). Run BEFORE: the current dist; os-verify-lock VERDICT command-exit 0; 24 tests passed; witness matchesFilterCondition({d:'2026-01-05T15:00:00Z'},{d:{$lte:'2026-01-05'}}) = true. Run AFTER: pnpm --filter @objectstack/formula build with lteBound deleted, then the same file; VERDICT command-exit 0; 24 passed; witness = false; grep -c lteBound over dist/index.mjs and dist/index.js = 0 and 0, against 3 and 3 before. So the after run loaded the rebuilt dist. Of 23 cells, 17 SAME and 6 DIFF, listed in summary as R1, R3, R4 and R11 (write check) and A1 and A6 (aggregation filter / having). SAME: R2 text control, R5/R6 datetime bare-day $lte (seam-lowered), R7 date bare-day $lte, R8/R9/R10 '9999-12-31' on date/datetime/text, R12 date/date reference, R13 datetime-vs-date reference (INVALID_FILTER/400 both on the write and on the read), R14 datetime/datetime reference, A2 cross-class addDays (400), A3 date/date addDays 2 (count 2), A4 datetime/datetime addDays 1 (count 3), A5 date/date plain reference (count 4), A7 having date/date addDays 0 (1 group), and the A1 and A5 where twins (400; a,b,c,d). Explain witness: node over both saved dists, 5 cases, 3 DIFF / 2 SAME (in summary). RESTORE, proven by state and not by exit codes: git checkout HEAD -- packages/formula/src/matches-filter.ts; then git hash-object == git rev-parse HEAD:path == 31f963a2; git diff HEAD = 0 bytes; porcelain empty; probe file removed; formula dist copied back from the saved pre-change build, diff -r empty, grep -c lteBound in dist/index.mjs = 3. Reverse verification and ablation: not applicable, no fix landed. Lint, typecheck, package tests: NOT MEASURED, reason: no diff kept.",
"mcp_calls": "0 — no MCP GitHub tool was called; the card, its comments, ruling 5933322270 and dev report 5939908710 were read through gh api GETs",
"api_writes": "1 — this os-dev-report comment through scripts/pm/post-stamped.mjs --comment=21242 (POST /repos//issues/21242/comments). git push (not REST): 1, the empty-branch probe, not forced. No pr_create and no label-write: there is no PR to make.",
"open_questions": [
{
"question": "Measured, two production callers still depend on lteBound. (a) The objectql having / aggregations[i].filter path answers a cross-class plain { $field } reference, a datetime against a date-class referent, with the whole-day reading: count 3 becomes 1 and having groups 2 become 0 after deletion, silently. where refuses the same comparison INVALID_FILTER/400. (b) The RLS write check's accept set narrows on non-datetime columns: three fail-open splits close (admitted while the read hides, then 403), and one new fail-closed split opens (a number column against '9999-12-31' becomes 403 while the read shows the row). Ruling A says the copy is 'deleted mechanically' once the check judges the stored form. Triage says a caller that needs it stops the deletion, and the claim says Clause-② no. How should the deletion proceed?",
"options": [
"A. Delete now, as the ruling's literal words say. Clause-② becomes no (narrowing), BREAKING, with a changeset naming the write-check narrowing on non-datetime columns and the new number-vs-'9999-12-31' 403. having / aggregation filters then answer a cross-class plain reference by text order, a silent count change with no error.",
"B. Sequence it. First, one objectql card: having and the per-aggregation filter refuse a cross-class plain { $field } reference with where's INVALID_FILTER/400 and words. The class rule today runs only on an addDays pair (having-filter.ts:1425, assertAggregationFilterReferencesAreDeclared), so this removes the only input class where that caller relies on the widening. Then this card deletes lteBound under Clause-② no (narrowing), with a changeset naming the write-check narrowing as the read/write agreement it buys. The number-vs-'9999-12-31' cell is settled in that PR: the RLS seam refuses a non-numeric comparand on a numeric column as the engine's number door does for where, or the 403 is recorded as the comparison written.",
"C. Keep the copy permanently. That is option C, which ruling 5933322270 did not take (it needs an ADR-0053 D-D1 item 9 amendment), and it keeps three measured fail-open write/read splits on non-datetime columns."
],
"recommendation": "B. Business need: the changed answers are reachable at a public door (engine.aggregate behind POST /data/:object/query, and ObjectQL.insert), though no in-repo producer writes them (examples at 4b59a38: 0 having, 0 $field, 3 RLS predicates, all equality; controls groupBy 9 and aggregate 64). A silent count change on a query an API or AI client can send is the costliest kind, and B turns it into the 400 where already answers. Long-term: B ends where ADR-0053 D-D1 items 5 and 9 point, with no copy, one rule per face and the per-row referent case refused rather than read two ways; A leaves having answering a comparison where refuses; C is a permanent copy. Anti-AI-error: contract-first, so a loud refusal at having beats a silent change of meaning, and the write-check narrowing closes fail-open splits an author cannot see; the one new split (number vs a day string) is a nonsense comparand better refused at the seam. Startup scope: one small objectql card plus this deletion, no new gate and no ADR change; C needs an ADR amendment and keeps the copy forever. The Clause-② line in B (no (narrowing)) is the PM's to set."
}
],
"out_of_scope_findings": [
"class: b · Seam: spec:crossFieldComparisonVerdict (date and datetime are separate classes) → runtime:objectql having-filter.ts assertConditionIsEvaluable (:1425, the class rule is gated on target.addDays) and assertAggregationFilterReferencesAreDeclared (gated on offset !== undefined) · reach: engine.aggregate, the callee of REST POST /data/:object/query (protocol.ts:11728); measured at 4b59a38 on SqlDriver(better-sqlite3): aggregations[i].filter { closed_at(datetime): { $lte: { $field: 'due_on'(date) } } } answers count 3, and its where twin answers INVALID_FILTER/400; having on max(closed_at) $lte { $field: day bucket } keeps 2 groups · contract: packages/spec/src/data/filter-cross-field-comparison-class.ts:121-122, 'The six comparison classes. Two columns are comparable only within one of them.' driver-sql's where applies it to every { $field } comparison (#5222), not only an addDays pair; this face applies it to the addDays pair alone · this is option B's first card, so it should be filed as the precondition of this card's deletion · dedupe words: having cross-class field reference refusal · aggregation filter plain $field class rule · having datetime date field comparison",
"carrier: 承接者:无 · noted, not filed: the RLS compile seam admits a non-numeric string comparand on a numeric column ({ amount: { $lte: '9999-12-31' } } compiles, and the SQLite read shows the row by storage-class ordering, INTEGER before TEXT). On PostgreSQL the same read is presumably a type error; NOT MEASURED, family driver-sql live PG; reason: no live PG run in this measure-only round. Settled inside option B if chosen."
]
}

---

Generated by Claude Code

[objectstack-fleet]

Release: session session_017xfMoEjKUuSh2xYB8sCozp (domain:engine#1, huangyiirene) · cause: the measure-first step stopped the deletion (triage's direction 5941509047: "A caller that does need it stops the deletion: the claim reports it here, and the copy stays") · destination: pm:blocked on #21255. The branch claude/issue-21242-retire-ltebound is the empty probe at 4b59a381a, and nothing is committed.

Blocked-by: #21255

What the measurement found (os-dev-report 5942274528). Two production callers of matchesFilterCondition answer differently at a public door once lteBound is gone:

1. objectql having and the per-aggregation filter (having-filter.ts, through engine.aggregate behind POST /api/v1/data/:object/query). A plain cross-class { $field } reference (datetime against date) is never judged by the class rule there, which runs only on an addDays pair. Its whole-day answer comes from lteBound; without it the count changes silently (3 → 1, 2 groups → 0), the shape dashboard 的日期区间上界打在 datetime 列上丢失当天数据 —— 默认配置即命中 #3777 removed. The where twin answers INVALID_FILTER / 400. Filed as objectql having and the per-aggregation filter judge a cross-field reference's comparison class only on an addDays pair, so a plain datetime-vs-date { $field } answers by formula's whole-day reading where the where twin refuses it 400 #21255, this card's precondition.
2. The RLS write check (plugin-security rls-check-stored-form.ts). On non-datetime columns, which the compile seam leaves unlowered, the accept set narrows. Three write/read splits close: a write the read hides becomes 403. One fail-closed split opens: a number column against a day-string comparand becomes 403 while the read shows the row.

The seat's answer to the dev's open question: B (sequence it). This is technical ordering and an invariant to restore, so the seat answers it without escalation (SKILL.md 〈升级与决策〉: 具名不升级类):

• objectql having and the per-aggregation filter judge a cross-field reference's comparison class only on an addDays pair, so a plain datetime-vs-date { $field } answers by formula's whole-day reading where the where twin refuses it 400 #21255 first. The spec contract (packages/spec/src/data/filter-cross-field-comparison-class.ts: "Two columns are comparable only within one of them") is enforced by where and not by the aggregate positions. Spec outranks implementation, so that face catches up; that is a defect fix, not a choice.
• Then this card deletes lteBound, as ruling 5933322270 decided. Its Clause-② becomes no (narrowing), set by the seat at the re-claim. The write-check narrowing on non-datetime columns is the read/write agreement the ruling bought: the governed side (the RLS check) moves toward the read and fails closed. The changeset names it.
• The one new fail-closed cell (a number column against a day-string comparand) is settled in that PR. If the engine's where door already refuses a non-numeric comparand on a numeric column, the RLS compile seam refuses it the same way; otherwise the 403 is recorded as the comparison written. The dev measures which.
• Option A (delete now) is refused: it lands the silent count change at the aggregate positions. Option C (keep the copy) is refused: the ruling did not take it, and it keeps three fail-open write/read splits.

State: this card is pm:blocked on #21255 and leaves the in-flight set, with the assignee cleared. #20822 stays pm:blocked on this card. When #21255 lands, the unlock scan returns this card to pm:queue, and the re-claim carries Clause-②: no (narrowing).

---

Generated by Claude Code