@@ -0,0 +1,22 @@
+---
+'@objectstack/core': minor
+---
+
+fix(core)!: a date macro whose offset lands past every instant a JavaScript `Date` can hold is refused `INVALID_FILTER` / 400, naming the placeholder, instead of resolving to the text `Invalid Date` or throwing an uncoded `RangeError`
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) a refusal of a VALUE in @objectstack/core's filter-placeholder resolver: a date macro (such as {300000_years_ago} or {99999999999999999999_minutes_ago}) whose offset lands past every instant a JavaScript Date can hold, refused INVALID_FILTER / 400 by resolveFilterToken and resolveFilterTokens. No authorable key, spelling, export or stored metadata shape moves: every filter, view, dataset and query shape parses as before, the date-macro vocabulary is unchanged, and @objectstack/core exports nothing new and nothing less (resolveFilterToken and resolveFilterTokens keep their signatures; the error class is module-private). The categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers a value range or a resolved value and this diff adds none (not registered / already-registered); and the change is runtime behaviour, not a declaration (not runtime-interface-only / type-surface-only). -->
+
+**BREAKING**: this narrows what `resolveFilterToken` and `resolveFilterTokens` answer for one class of inputs, and so what every door that resolves filter placeholders answers. It ships as `minor` under the launch-window convention for accept-set narrowings. No export or published type changes.
+
+**What is refused now.** A relative-date placeholder whose offset lands past the instants a JavaScript `Date` can hold names no day and no time. The resolver used to answer a day-or-coarser one (`{300000_years_ago}`) with the text `Invalid Date`, which compares as text, and to throw an uncoded `RangeError: Invalid time value` for a sub-day one (`{99999999999999999999_minutes_ago}`). Measured before this through `engine.find` on InMemoryDriver and `POST /api/v1/data/:object/query` on SqlDriver over SQLite, over a `datetime` field with a row in 2026 and a row in 1500:
+
+- `$lt {300000_years_ago}` answered both rows, and `judgeFilter` answered `{ ok: true }`;
+- `$lt {99999999999999999999_minutes_ago}` threw the uncoded `RangeError` from `engine.find` and `judgeFilter`, and the REST door answered `500 INTERNAL_ERROR`.
+
+Both are refused now with `INVALID_FILTER` / 400 at every position the engine resolves (`where` on `find`, `findOne`, `count`, `aggregate`, a multi-row `update` and `delete`, a per-aggregation `filter`, `having`) and through `judgeFilter`, before any driver read. Every other caller of `resolveFilterToken` / `resolveFilterTokens` receives the same coded error in place of the text or the `RangeError`. The refusal is the same on every column, because the resolver does not know the column: such a placeholder names no value at all.
+
+**What an author sees.** `Relative-date placeholder "{300000_years_ago}" names no instant: its offset lands past every instant a JavaScript Date can hold, so it resolves to no day and no time, and it is refused rather than compared. A date value names a year from 0001 to 9999, and a datetime value a year from 1000 to 9999: use a relative-date placeholder whose offset lands inside those years.` The thrown error carries `code: 'INVALID_FILTER'`, `status: 400` and `token` (the placeholder's name), the code the engine already answers for a placeholder that resolves outside its column's years.
+
+**Unchanged.** A placeholder that names an instant resolves as before, including one past the years 0001..9999 that a `Date` still holds (`{273847_years_ago}` resolves to `-271821-09-30`); the engine's per-column year range judges that one, as before. Context placeholders and an unknown placeholder answer as before.
@@ -0,0 +1,90 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#21068] A date macro whose offset lands past every instant a JavaScript
+// `Date` can hold names no day and no time. Measured on the base
+// (`fed0db8f6`), off 2026-09-30T12:00Z: `{300000_years_ago}` resolved to the
+// text `Invalid Date`, and `{99999999999999999999_minutes_ago}` threw an
+// uncoded `RangeError: Invalid time value` from `toISOString`. Both are
+// refused now, `INVALID_FILTER` / 400, naming the placeholder.
+//
+// Pins: every unit of the parameterised grammar in both directions, through
+// `resolveFilterToken` and through `resolveFilterTokens` on a filter tree;
+// the `Date`'s own edges on both sides, resolved (the year is then the
+// engine's to judge); and in-range controls for a day and an instant.
+
+import { describe, it, expect } from 'vitest';
+import { resolveFilterToken, resolveFilterTokens } from './filter-tokens.js';
+
+// Wed 2026-09-30 12:00 UTC: every value below is read off this instant.
+const NOW = new Date('2026-09-30T12:00:00.000Z');
+
+const refusalOf = (run: () => unknown) => {
+  try {
+    run();
+  } catch (e) {
+    return e as Error & { code?: unknown; status?: unknown; token?: unknown };
+  }
+  return null;
+};
+
+/** Every unit, both directions: each offset lands past the instants a `Date` holds. */
+const PAST_THE_DATE_RANGE: readonly string[] = [
+  '300000_years_ago',
+  '99999999999999999999_minutes_ago',
+  '300000_years_from_now',
+  '9999999_months_ago',
+  '99999999_weeks_from_now',
+  '100020727_days_ago',
+  '99999999999_hours_from_now',
+  '144029846161_minutes_ago',
+];
+
+describe('[#21068] a date macro past the instants a Date holds is refused, naming the placeholder', () => {
+  it.each(PAST_THE_DATE_RANGE)('{%s}: INVALID_FILTER / 400, the token named, never the text "Invalid Date"', (token) => {
+    const refusal = refusalOf(() => resolveFilterToken(token, { now: NOW }));
+    expect(refusal, `{${token}} resolved instead of refusing`).not.toBeNull();
+    expect(refusal!.code).toBe('INVALID_FILTER');
+    expect(refusal!.status).toBe(400);
+    expect(refusal!.token).toBe(token);
+    expect(refusal!.message).toContain(`"{${token}}"`);
+    expect(refusal!.message).toContain('past every instant a JavaScript Date can hold');
+    expect(refusal!.message).toContain('a datetime value a year from 1000 to 9999');
+    expect(refusal!.message).not.toContain('Invalid Date');
+    expect(refusal!.message).not.toContain('Invalid time value');
+  });
+
+  it('resolveFilterTokens refuses the same in a filter tree, in the timezone path too, and leaves the tree unmutated', () => {
+    for (const token of ['300000_years_ago', '99999999999999999999_minutes_ago']) {
+      for (const timezone of [undefined, 'Asia/Shanghai']) {
+        const filter = { $and: [{ opened_at: { $lt: `{${token}}` } }, { note: 'x' }] };
+        const refusal = refusalOf(() => resolveFilterTokens(filter, { now: NOW, timezone }));
+        expect(refusal?.code, `{${token}} in ${timezone ?? 'UTC'}`).toBe('INVALID_FILTER');
+        expect(refusal?.status).toBe(400);
+        expect(refusal?.message).toContain(`"{${token}}"`);
+        expect(filter.$and[0]).toEqual({ opened_at: { $lt: `{${token}}` } });
+      }
+    }
+  });
+
+  it('the Date\'s own edges resolve: the last day and the last minute it holds, on both sides', () => {
+    // The refusal is the `Date`'s validity, not a copy of its range: one step
+    // inside the edge resolves, spelled as the day or instant it names, and its
+    // year is the engine's to judge against its column.
+    expect(resolveFilterToken('273847_years_ago', { now: NOW })).toBe('-271821-09-30');
+    expect(refusalOf(() => resolveFilterToken('273848_years_ago', { now: NOW }))?.code).toBe('INVALID_FILTER');
+    expect(resolveFilterToken('273733_years_from_now', { now: NOW })).toBe('+275759-09-30');
+    expect(refusalOf(() => resolveFilterToken('273734_years_from_now', { now: NOW }))?.code).toBe('INVALID_FILTER');
+    // 144029846160 minutes before NOW is exactly -8.64e15 ms, the first instant a Date holds.
+    expect(resolveFilterToken('144029846160_minutes_ago', { now: NOW })).toBe(new Date(-8.64e15).toISOString());
+    expect(refusalOf(() => resolveFilterToken('144029846161_minutes_ago', { now: NOW }))?.code).toBe('INVALID_FILTER');
+  });
+
+  it('the controls: a day and an instant inside the range resolve as before', () => {
+    expect(resolveFilterToken('100_years_ago', { now: NOW })).toBe('1926-09-30');
+    expect(resolveFilterToken('1_hour_ago', { now: NOW })).toBe('2026-09-30T11:00:00.000Z');
+    expect(resolveFilterToken('now', { now: NOW })).toBe(NOW.toISOString());
+    expect(resolveFilterTokens({ opened_at: { $lt: '{100_years_ago}' } }, { now: NOW })).toEqual({
+      opened_at: { $lt: '1926-09-30' },
+    });
+  });
+});
@@ -37,6 +37,19 @@
  * is the engine's question, not this module's: it refuses a resolved token
  * outside its field's years.
  *
+ * # A date macro past the instants a `Date` holds refuses here
+ *
+ * [#21068] An offset can land past every instant a JavaScript `Date` can hold
+ * (ECMA-262's time values, ±8.64e15 ms around 1970): `{300000_years_ago}`,
+ * `{99999999999999999999_minutes_ago}`. Such a macro names no day and no time,
+ * so there is no year left for the engine to judge. It used to resolve to the
+ * text `Invalid Date` (a day-or-coarser macro), which compares as text and
+ * answered every row of a `$lt`, or to throw an uncoded `RangeError` from
+ * `toISOString` (a sub-day one), which the REST door answered `500`. It is
+ * refused instead, `INVALID_FILTER` / 400 naming the placeholder — see
+ * {@link DateMacroPastDateRangeError}. The test is the `Date`'s own validity,
+ * asked once, of the instant the macro computed: ⛔ never a copy of the range.
+ *
  * # Period `_end` resolves to a calendar DAY — its WIDTH is ADR-0053 D-D
  *
  * `{current_year_end}` resolves to `2026-12-31`, per the spec's own
@@ -97,8 +110,13 @@ import {
   parseDateMacroParam,
   type DateMacroUnit,
 } from '@objectstack/spec/data';
+import type { StandardErrorCode } from '@objectstack/spec/api';
 import { calendarPartsInTzOrUtc, wallClockToUtcMs } from './datetime.js';
-import { isOutsideTemporalYearRange, temporalStorageForm } from './temporal-storage-form.js';
+import {
+  isOutsideTemporalYearRange,
+  SUPPORTED_TEMPORAL_YEARS,
+  temporalStorageForm,
+} from './temporal-storage-form.js';
 
 /**
  * The slice of an execution context the resolver reads. Structural on purpose —
@@ -187,6 +205,46 @@ export class UnresolvedFilterTokenError extends Error {
   }
 }
 
+/** A year as a refusal spells it: four digits, `0001`. */
+const fourDigitYear = (year: number): string => String(year).padStart(4, '0');
+
+/**
+ * [#21068] Raised when a date macro's offset lands past every instant a
+ * JavaScript `Date` can hold, so the macro names no day and no time — see the
+ * module doc. `token` names the placeholder.
+ *
+ * `INVALID_FILTER` / 400, the code a date macro's family already answers: the
+ * engine refuses one that resolved outside its column's years with it, and the
+ * temporal-comparand door a literal of the same value. This one lands past
+ * every column's years, and the author's fix is the same (a smaller offset).
+ * ⛔ Not `FILTER_TOKEN_UNRESOLVED`: its declared meaning is a context the
+ * request does not carry ({@link UnresolvedFilterTokenError}: "the spelling is
+ * correct, the context is not"), and here the context is complete. ⛔ Not
+ * `FILTER_TOKEN_UNKNOWN` either: the token is in the vocabulary.
+ *
+ * Not exported: a caller reads `code` and `status`, as for every door's
+ * refusal, and the module's public surface stays as it was.
+ */
+class DateMacroPastDateRangeError extends Error {
+  readonly token: string;
+  readonly status = 400;
+  readonly code = 'INVALID_FILTER' satisfies StandardErrorCode;
+
+  constructor(token: string) {
+    const { date, datetime } = SUPPORTED_TEMPORAL_YEARS;
+    super(
+      `Relative-date placeholder "{${token}}" names no instant: its offset lands past every instant ` +
+      'a JavaScript Date can hold, so it resolves to no day and no time, and it is refused rather ' +
+      `than compared. A date value names a year from ${fourDigitYear(date.first)} to ` +
+      `${fourDigitYear(date.last)}, and a datetime value a year from ${fourDigitYear(datetime.first)} ` +
+      `to ${fourDigitYear(datetime.last)}: use a relative-date placeholder whose offset lands inside ` +
+      'those years.',
+    );
+    this.name = 'DateMacroPastDateRangeError';
+    this.token = token;
+  }
+}
+
 /**
  * Calendar arithmetic is done on a UTC "proxy" date built from the reference
  * timezone's calendar parts. Working in UTC keeps the math free of DST jumps
@@ -220,7 +278,8 @@ function proxyDay(now: Date, timezone?: string): Date {
  * `toISOString` spells for its instant: every reader reads it as that UTC day,
  * on every host. The range is core's one range, asked of the day itself, never
  * re-derived here. A step past the instants a `Date` holds is not one of these:
- * it has no day at all, and keeps the rule's spelling of an invalid `Date`.
+ * it has no day at all, and [#21068] never reaches here — {@link resolveFilterToken}
+ * refuses it first.
  */
 function asYmd(d: Date): string {
   if (!isOutsideTemporalYearRange(d, 'date')) return String(temporalStorageForm(d, 'date'));
@@ -306,12 +365,12 @@ function addUnits(unit: DateMacroUnit, d: Date, n: number): Date {
 
 /**
  * `current|last|next` × `week|month|quarter|year` × `start|end`, plus the bare
- * `week_start`-style aliases (which mean `current_`). Returns `undefined` when
- * the token is not a period token.
+ * `week_start`-style aliases (which mean `current_`). Returns the period's
+ * bounding day, or `undefined` when the token is not a period token.
  */
 const PERIOD_RE = /^(?:(current|last|next)_)?(week|month|quarter|year)_(start|end)$/;
 
-function resolvePeriodToken(token: string, today: Date): string | undefined {
+function resolvePeriodToken(token: string, today: Date): Date | undefined {
   const m = PERIOD_RE.exec(token);
   if (!m) return undefined;
   const rel = (m[1] ?? 'current') as 'current' | 'last' | 'next';
@@ -324,19 +383,59 @@ function resolvePeriodToken(token: string, today: Date): string | undefined {
   // is involved at all — so the answer never depends on the clamp policy, and
   // the arithmetic reads the same for every `kind`.
   const periodStart = startOfPeriod(kind, addPeriods(kind, startOfPeriod(kind, today), offset));
-  if (bound === 'start') return asYmd(periodStart);
+  if (bound === 'start') return periodStart;
   // `_end` = the last calendar DAY of the period: the day before the next
   // period begins. See the module doc on half-open ranges.
   const next = addPeriods(kind, periodStart, 1);
   next.setUTCDate(next.getUTCDate() - 1);
-  return asYmd(next);
+  return next;
+}
+
+/**
+ * [#21068] The instant a date macro computes, and how it is spelled: an
+ * instant (`{now}`, `{N_hours_*}`, `{N_minutes_*}`) or a calendar day (every
+ * other macro). `undefined` when `token` is not a date macro. Computing it
+ * apart from spelling it lets {@link resolveFilterToken} ask the one question
+ * every macro owes before either spelling — does the instant exist? — in one
+ * place.
+ */
+function dateMacroInstant(
+  token: string,
+  now: Date,
+  timezone: string | undefined,
+): { at: Date; spelled: 'instant' | 'day' } | undefined {
+  const today = proxyDay(now, timezone);
+
+  switch (token) {
+    case 'now': return { at: now, spelled: 'instant' };
+    case 'today': return { at: today, spelled: 'day' };
+    case 'yesterday': return { at: addUnits('day', today, -1), spelled: 'day' };
+    case 'tomorrow': return { at: addUnits('day', today, 1), spelled: 'day' };
+  }
+
+  const period = resolvePeriodToken(token, today);
+  if (period !== undefined) return { at: period, spelled: 'day' };
+
+  const param = parseDateMacroParam(token);
+  if (!param) return undefined;
+  const sign = param.direction === 'ago' ? -1 : 1;
+  // Sub-day units are instants — they must keep their time-of-day, so they
+  // shift `now` and render as a full ISO timestamp. Day-and-coarser units are
+  // calendar quantities and render as `YYYY-MM-DD` off the reference day.
+  if (param.unit === 'minute' || param.unit === 'hour') {
+    return { at: addUnits(param.unit, now, sign * param.n), spelled: 'instant' };
+  }
+  return { at: addUnits(param.unit, today, sign * param.n), spelled: 'day' };
 }
 
 /**
  * Resolve one token NAME (the bit inside the braces) to its concrete value.
  * Throws {@link UnresolvedFilterTokenError} for a vocabulary token the request
- * carries no value for. Returns `undefined` only when the token is outside the
- * vocabulary — callers turn that into {@link UnknownFilterTokenError}.
+ * carries no value for, and [#21068] `INVALID_FILTER` / 400 for a date macro
+ * whose offset lands past every instant a `Date` holds
+ * ({@link DateMacroPastDateRangeError}). Returns `undefined` only when the
+ * token is outside the vocabulary — callers turn that into
+ * {@link UnknownFilterTokenError}.
  */
 export function resolveFilterToken(
   token: string,
@@ -385,31 +484,14 @@ export function resolveFilterToken(
   }
 
   // ── Date macros ───────────────────────────────────────────────────────
-  const today = proxyDay(now, ctx.timezone);
-
-  switch (token) {
-    case 'now': return now.toISOString();
-    case 'today': return asYmd(today);
-    case 'yesterday': return asYmd(addUnits('day', today, -1));
-    case 'tomorrow': return asYmd(addUnits('day', today, 1));
-  }
-
-  const period = resolvePeriodToken(token, today);
-  if (period !== undefined) return period;
-
-  const param = parseDateMacroParam(token);
-  if (param) {
-    const sign = param.direction === 'ago' ? -1 : 1;
-    // Sub-day units are instants — they must keep their time-of-day, so they
-    // shift `now` and render as a full ISO timestamp. Day-and-coarser units are
-    // calendar quantities and render as `YYYY-MM-DD` off the reference day.
-    if (param.unit === 'minute' || param.unit === 'hour') {
-      return addUnits(param.unit, now, sign * param.n).toISOString();
-    }
-    return asYmd(addUnits(param.unit, today, sign * param.n));
-  }
-
-  return undefined;
+  const macro = dateMacroInstant(token, now, ctx.timezone);
+  if (macro === undefined) return undefined;
+  // [#21068] An offset past every instant a `Date` holds computes an invalid
+  // `Date`: `asYmd` would spell it as the text `Invalid Date` and
+  // `toISOString` would throw an uncoded `RangeError`. Refused here, once,
+  // before either spelling.
+  if (Number.isNaN(macro.at.getTime())) throw new DateMacroPastDateRangeError(token);
+  return macro.spelled === 'instant' ? macro.at.toISOString() : asYmd(macro.at);
 }
 
 /**