@@ -0,0 +1,31 @@
+---
+"@objectstack/formula": minor
+---
+
+fix(formula)!: `matchesFilterCondition` compares a bare-day upper bound as written; its own whole-day copy is deleted (ADR-0053 D-D1 items 5 and 9)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) a change of how one runtime evaluator answers an ordering comparison, not of anything an author writes: no spec key, spelling, export or stored shape moves. FilterConditionSchema, every RLS policy, object and query definition parse and save as before, @objectstack/formula exports the same names with the same types, and no stored row is read or rewritten. What moves is the answer for a bare-day upper bound that reaches the evaluator without the shared lowering, which the seams already apply, so there is nothing for objectstack migrate meta to rewrite. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers a filter's bound semantics and this diff adds none (not registered / already-registered); and the change is runtime behaviour, not a declaration (not runtime-interface-only / type-surface-only). -->
+
+**BREAKING**: this narrows what the RLS write check admits on columns that are not `datetime`, and moves a few `engine.aggregate` answers that no seam lowers. It ships as `minor` under the launch-window convention for accept-set narrowings. No export or published type changes.
+
+**What is deleted.** `matchesFilterCondition` no longer reads a bare `YYYY-MM-DD` `$lte`, or a `$between` maximum, as "through that whole day", and no longer drops the bound on `9999-12-31`. It compares the value as written, as every other ordering operator here does, and as `driver-sql` compares it on the read. The whole day is applied once, at the seams that feed this evaluator, by the shared `lowerFilterCondition` (`@objectstack/spec/data`): the RLS compile seam lowers every policy filter on the object's declared `datetime` columns, the engine lowers `having` and `aggregations[i].filter` the same way, and the RLS write check judges a declared `date`, `datetime` or `time` column in its stored form. So a `check` on a `date` or `datetime` column answers exactly as before.
+
+**The RLS write check now agrees with the read on other columns.** Measured through `ObjectQL.insert` and `SecurityPlugin` on `SqlDriver` (better-sqlite3), as a member whose policy has the same `using` and `check`:
+
+- a `text` column under `record.title <= '2026-01-05'`, written as `'2026-01-05T15:00:00Z'` or `'2026-01-05 noon'`: the write was admitted while the read hid the stored row. It is now refused `PERMISSION_DENIED` / 403, and the read still hides it;
+- two `text` columns, `record.title <= record.code`, with `code` holding `'2026-01-05'`: the same, admitted before and 403 now, with the read hiding the row;
+- a `number` column under `record.amount <= '9999-12-31'`: the write was admitted because an epoch number read as an instant on the last supported day. A number is not less than a day string, so it is now 403. The engine refuses the same comparison in a `where` (`INVALID_FILTER` / 400: a day string is not a number).
+
+The access explanation (`explain`) judges a stored row with this evaluator, so its row verdict moves the same way: for the two `text` cells it now says hidden, as the read does.
+
+**`engine.aggregate` answers that no seam lowers.** A `{ $field }` referent is per row, so no seam can lower it. These positions are now compared as written:
+
+- two declared `text` columns of one class, at a per-aggregation `filter` or between two `having` group columns: `'2026-01-05 noon'` against `'2026-01-05'` is no longer counted or kept, which is what the same comparison answers in a `where`;
+- the pairs the class rule cannot judge because a side has no declaration: an object the registry does not declare, and an audit-opt-out object's row-carried `created_at` / `updated_at` against a `date`. An instant on the due day is no longer counted against that bare day;
+- a direct `applyInMemoryAggregation` call, which applies no class rule.
+
+**The remedy.** Compare a `datetime` with a `datetime` and a `date` with a `date`. A `datetime` against a calendar day has no single answer across SQL and memory, and a declared pair of the two is already refused. A number compared with a day string has no answer at all: compare a number with a number. A caller that evaluates a filter on a `datetime` column without passing a seam lowers it first with `lowerFilterCondition(filter, { isDatetimeColumn })` to get the whole-day reading.
+
+**Unchanged.** A `check` on a declared `date`, `datetime` or `time` column, a `{ $field }` pair of two `date` or two `datetime` columns (with or without `addDays`), a full-ISO bound, `$gte` / `$gt` / `$lt` and `$eq`.
@@ -0,0 +1,21 @@
+---
+"@objectstack/plugin-security": minor
+---
+
+fix(plugin-security)!: a row-level policy that compares a numeric column with a comparand that is not a number is refused at the RLS compile seam, read and write alike, as the engine's `where` refuses the same comparison
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) a refusal of a compiled policy comparand at the RLS compile seam, the same comparand the engine's where door already refuses: no authorable key, spelling, export or stored shape moves. RowLevelSecurityPolicySchema and every permission set parse and save as before, the predicate's text is untouched, @objectstack/plugin-security exports the same names, and no stored row is read or rewritten. Which number the author meant is not something a ledger entry can decide, so there is nothing for objectstack migrate meta to rewrite. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers a filter comparand's type and this diff adds none (not registered / already-registered); and the change is runtime behaviour plus one ADDITIVE optional member (number) on the published RlsFieldGuard type, with no published interface or type narrowed or removed (not runtime-interface-only / type-surface-only). -->
+
+**BREAKING**: this narrows which row-level policies the RLS compile seam hands to its two consumers, the read and the write check. It ships as `minor` under the launch-window convention for accept-set narrowings. No export is added or removed. One published type gains a member: `RlsFieldGuard`, the type of the optional `fieldGuard` argument of the root-exported `RLSCompiler.compileFilter`, gains the optional `number` member (each declared column's `type`, and a formula's `returnType`). It is an additive optional member, not a change of what is accepted.
+
+**What was accepted before.** A policy such as `record.amount <= '9999-12-31'` on a `number` column compiled, and its `using` and `check` both reached their consumers unjudged. Measured through `ObjectQL.insert` and `SecurityPlugin` on `SqlDriver` (better-sqlite3), as a member: the write of `amount: 5` was admitted (`@objectstack/formula`'s deleted whole-day copy read the number as an instant), and the read showed the stored row, because SQLite orders an integer before any text. That read was measured on SQLite only; PostgreSQL was not run for this change. The same comparison in a caller's `where` is refused `INVALID_FILTER` / 400 by the engine's number-comparand door.
+
+**What is refused now.** The seam runs the spec's number-comparand verdict (`numberComparandDoorVerdict`, `@objectstack/spec/data`), the one the engine's `where` door consults, on every compiled policy filter, after the shape door and before the comparand-type door. On a column the object declares numeric, a comparand that is not a number (a string the platform's numeric grammar does not read, such as `'9999-12-31'` or `'abc'`, a boolean, a `Date` or a list) drops the policy through the existing fail-closed route: the read is filtered by the deny sentinel and returns no rows, the write is refused `PERMISSION_DENIED` / 403, and a WARN line names the policy, the clause and the comparand. The line's detail is written for the clause it refused: for `check`, which the write check evaluates in-process, it names no driver bind. A granting sibling policy still grants.
+
+**Narrowed, as in `where`.** A numeric string (`'10'`, `'1e3'`) is replaced by the number it names before either consumer runs. So `record.amount == '10'` now matches a stored `10` on the write check, which compared the text with the number and refused it, while the read showed the row.
+
+**The remedy.** Compare a numeric column with a number: `record.amount <= 9999`, not `record.amount <= '9999-12-31'`.
+
+**Unchanged.** A numeric literal, a column that is not numeric, a `{ $field }` reference, and an object whose declaration cannot be read (nothing is judged without one).
@@ -358,7 +358,7 @@ A ruling that adds a new predicate *kind* or a dialect construct still costs one
 | F4 reference matcher | — (no production caller) | no | keep as test oracle, or retire (D6) | 20 test files | — |
 | F5 cube face | the new `normalizeFilters` door | **yes**: doors + lowering, and widen `$or` / `$not` / `$null` | whole-day calls (5 sites) | its own suites; not in `check:driver-conformance` | an accept-set widening, so a changeset with its Clause-② line |
 | F6 `driver-mongodb` | the engine seam | no | whole-day calls (4 sites) | mongodb filter-logic, text, temporal, comparand-type | the server answer was NOT MEASURED here |
-| F7 `formula` | the RLS compile seam (policies); the engine (via F8) | no | `lteBound` (2 sites), only under D4 (b): F7 is also a public evaluator (explain engine, test doubles) | matches-filter not-null-safe, or-semantics, temporal | — |
+| F7 `formula` | the RLS compile seam (policies); the engine (via F8) | no | **retired** (#21242): `lteBound` and its 2 sites are deleted; a bound that reaches F7 unlowered is compared as written (D-D1 item 5) | matches-filter not-null-safe, or-semantics, temporal | — |
 | F8 `having` | the engine seam | no | whole-day calls (4 sites) | having filter-logic, text, temporal | — |
 | F9 read scope | the new call at its entry | **yes**: the lowering call | polarity quartet (67 lines), `assertDefinedComparands` | read-scope-sql conformance, read-scope not-null-safe | fixes §2.5 item 1, which changes the rows a scope returns, so it needs a changeset |
 | F10 `where` → tree | the analytics `where` door | no | polarity quartet (90 lines), `assertDefinedComparands`, the `$between` lowering | native-sql filter-logic, text, temporal | echo fidelity (R6) |
 
@@ -141,15 +141,39 @@ describe.each(PAIRS)('[#14104] addDays on the $label pair', ({ target, base }) =
 });
 
 describe('[#14104] the shape of the shifted value', () => {
-  it('a calendar day stays a calendar day, so a `$lte` still covers the whole shifted day', () => {
-    // A `date` deadline shifted by one day is 03-02 (the whole day), so a
-    // datetime completion at 23:59 on 03-02 is still on time — the #3777
-    // half-open rule the bare bound already has.
-    const rec = { done: '2026-03-02T23:59:00.000Z', due: '2026-03-01' };
+  it('a calendar day stays a calendar day, so a stored day on the shifted day is on time', () => {
+    // A `date` deadline shifted by one day is 03-02, a calendar day. A `date`
+    // completion is stored as its calendar day (the RLS write check judges the
+    // stored form), so completing on 03-02 is on time under `$lte`, and the
+    // unshifted deadline 03-01 is missed.
+    const rec = { done: '2026-03-02', due: '2026-03-01' };
     expect(m(rec, { done: { $lte: { $field: 'due', addDays: 1 } } })).toBe(true);
     expect(m(rec, { done: { $lte: { $field: 'due', addDays: 0 } } })).toBe(false);
   });
 
+  it('[#21242] an instant against a shifted calendar day is compared as written, and refused once the columns are declared', () => {
+    // A `datetime` completion against a `date` deadline is a cross-class pair.
+    // This face kept a whole-day copy that read the shifted day 03-02 as
+    // "through 03-02" here; it is deleted (ADR-0053 D-D1 items 5 and 9), so
+    // the pair is compared as written: the instant's text sorts above the bare
+    // day it falls on.
+    const rec = { done: '2026-03-02T23:59:00.000Z', due: '2026-03-01' };
+    expect(m(rec, { done: { $lte: { $field: 'due', addDays: 1 } } })).toBe(false);
+    expect(m(rec, { done: { $lte: { $field: 'due', addDays: 2 } } })).toBe(true);
+    // Handed the declaration, as the RLS write check hands it, the pair is
+    // refused before any comparison, as driver-sql's read refuses it.
+    let err: { code?: unknown; status?: unknown } | undefined;
+    try {
+      m(rec, { done: { $lte: { $field: 'due', addDays: 1 } } }, {
+        fields: { done: { type: 'datetime' }, due: { type: 'date' } },
+      });
+    } catch (e) {
+      err = e as { code?: unknown; status?: unknown };
+    }
+    expect(err?.code).toBe('INVALID_FILTER');
+    expect(err?.status).toBe(400);
+  });
+
   it('an instant keeps its time of day', () => {
     const rec = { done: '2026-03-03T12:00:00.000Z', due: '2026-03-01T12:00:00.000Z' };
     expect(m(rec, { done: { $eq: { $field: 'due', addDays: 2 } } })).toBe(true);
 
@@ -9,13 +9,22 @@
  * prevent. Adding a case there adds it here.
  *
  * This evaluator is type-blind: it sees a bare record with no schema, so both
- * the `datetime` and `date` cases run against the raw string values. That both
- * kinds pass unmodified is itself the assertion — it is what lets the rule be
- * applied without a field-type lookup on this surface.
+ * the `datetime` and `date` cases run against the raw string values.
+ *
+ * [#21242 · ADR-0053 D-D1 items 5 and 9] It keeps no whole-day copy of the
+ * bare-day upper bound any more. What reaches it is what a TYPED seam hands
+ * it: the RLS compile seam lowers every policy filter with the shared
+ * `lowerFilterCondition`, reading the object's declared `datetime` columns, so
+ * each case's filter runs through that lowering here, against the declared
+ * field map below. The expected rows are the shared table's, unchanged: the
+ * whole-day cells are answered by the lowered filter, as on every seam-fed
+ * face, and the `date` column is not lowered, because its stored calendar-day
+ * text orders exactly as the day.
  */
 
 import { describe, it, expect } from 'vitest';
 import {
+  lowerFilterCondition,
   TEMPORAL_CASES,
   TEMPORAL_ROWS,
   TEMPORAL_TIME_CASES,
@@ -24,10 +33,20 @@ import {
 
 import { matchesFilterCondition } from './matches-filter';
 
+/** The declared field map a typed seam reads for the shared rows. */
+const CONFORMANCE_FIELDS: Readonly<Record<string, { type: string }>> = { at: { type: 'datetime' }, on: { type: 'date' } };
+
+/** What the RLS compile seam hands this face: the case's filter, lowered on the declared `datetime` columns. */
+const lowered = <T,>(filter: T): T =>
+  lowerFilterCondition(filter, {
+    isDatetimeColumn: (column) =>
+      Object.prototype.hasOwnProperty.call(CONFORMANCE_FIELDS, column) && CONFORMANCE_FIELDS[column]!.type === 'datetime',
+  });
+
 describe('matchesFilterCondition — temporal conformance', () => {
   for (const c of TEMPORAL_CASES) {
     it(c.name, () => {
-      const got = TEMPORAL_ROWS.filter((r) => matchesFilterCondition(r, c.filter)).map((r) => r.id);
+      const got = TEMPORAL_ROWS.filter((r) => matchesFilterCondition(r, lowered(c.filter))).map((r) => r.id);
       expect(got, c.note).toEqual(c.expected);
     });
   }
@@ -64,7 +83,7 @@ describe('matchesFilterCondition — temporal conformance on a native-writer pos
 
   for (const c of TEMPORAL_CASES) {
     it(c.name, () => {
-      const got = nativeRows.filter((r) => matchesFilterCondition(r as any, c.filter)).map((r) => r.id);
+      const got = nativeRows.filter((r) => matchesFilterCondition(r as any, lowered(c.filter))).map((r) => r.id);
       expect(got, c.note).toEqual(c.expected);
     });
   }