fix(objectql)!: having takes the temporal-comparand door where and the per-aggregation filter take (#20263)

[objectstack-fleet]

Fixes #20263
Clause-②: no (narrowing)

What this does

engine.aggregate evaluates having itself, so no driver reads it, and none of the doors in front of it judged a temporal comparand. A comparand the aggregated column's storage rule cannot read was compared as written: having { last_placed: { $lt: "not-a-date" } } on max(placed_on) kept every group with a 200, while its where twin answered 400.

having now takes the temporal-comparand door that where (#8690) and the per-aggregation filter (#20148) take: the same walk and the same @objectstack/core predicate (isUninterpretableTemporalComparand). When #20264 moves the year range in that predicate, having follows with no second edit (pinned: see "one predicate" below).

• packages/objectql/src/temporal-comparand-door.ts: the walk is factored into one walkCondition with a per-position scope (the kind of the column a key names, and which operators are judged). findUninterpretableTemporalComparand (the where entry) keeps its signature and behaviour. New assertHavingTemporalComparandsInterpretable(object, having, classes, query).
• packages/objectql/src/engine.ts, ObjectQL.aggregate: one call, after assertHavingIsEvaluable and before getDriver, so it covers both applyHaving doors (native driver.aggregate() and the rows fallback) with zero driver reads on a refusal.
• packages/objectql/src/having-filter.ts: temporalKindOf is exported (one keyword and a doc line), so the door and the storage rule read one kind.
• Tests in objectql and rest, and .changeset/20263-having-temporal-comparand-door.md (minor, BREAKING narrowing, ADR-0087 not-required (no-migration-prescription)).

How the kind is read (H3)

From the class #20127 already derives, aggregatedRowColumnClasses, which engine.aggregate computes once and now hands to this door too; nothing is derived again. min / max of a date / datetime / time field keeps that kind, a groupBy projection of such a field takes its kind, a day bucket is a date. count / count_distinct / sum / avg, a week / month / quarter / year bucket, and every other column are not judged. An alias that names no column is still refused by #20123's words, first.

Two deliberate differences from where, each measured

1. Order: last among the having doors. On a clause another having door refuses (an unknown operator, a key naming no column, a comparand of no comparable type, an addDays pair, an array in the equality slot), that door answers in its own words. So every cell refused at the base keeps its words byte for byte (H4), and only cells that answered 200 move.
2. The text operators are not judged. On where a text operator on a temporal field never reaches this door: [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's declared-type door refuses it one step earlier, because "not a date value" is the wrong sentence for an operator no comparand could make runnable. That door does not front having, and [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's ruling keeps the row beneath it answered there (pinned in engine-text-operator-declared-type-door.test.ts). Judging them here would revive the retired wording, so $contains: "2026" and $startsWith: "not-a-date" on max(placed_on) answer exactly as before.

It judges the caller's own clause before the bigint narrowing, which is what where's object form judges (see Acceptance notes for the bigint consequence).

Measured: base 89f87f2344 and head, three drivers, both doors, both paths

InMemoryDriver, SqlDriver on SQLite, SqlDriver on PostgreSQL 16 (private cluster). Through engine.aggregate and POST /api/v1/data/:object/query, native path and rows path, groupBy customer over four groups. 1650 cells per run; 162 moved, all of them having cells that went from 200 with one read to 400 INVALID_FILTER with zero reads. Within each row below the three drivers, both doors and both paths agree.

having column · comparand	$gt base → head	$lt base → head	where twin
max(date) · "not-a-date"	no group → 400	c1–c4 → 400	400
max(date) · "+010000-01-01T00:00:00.000Z"	c1–c4 → 400	no group → 400	400
max(date) · the number (REST and engine) or Date (engine) for 10000-01-01	c1–c4 → 400	no group → 400	400
max(date) · "2026-02-01" (control)	c2 → c2	c1, c3 → c1, c3	200
min(datetime) · "not-a-date"	no group → 400	c1–c4 → 400	400
min(datetime) · the extended-year ISO, number or Date	unchanged	unchanged	not refused by the door (the datetime rule reads it; PostgreSQL answers 500, #20264's range)
min(datetime) · 2026 instant (control)	c2–c4 → same	c1 → same	200
max(time) · "not-a-date"	no group → 400	c1–c4 → 400	400
max(time) · extended-year ISO, number, Date	unchanged	unchanged	not refused by the door
max(time) · "12:00" (control)	c3, c4 → same	c1 → same	200
count / sum / avg · a string	unchanged	unchanged	not judged (not temporal)

H3 cells: "not-a-date" on a placed_on or opened_at groupBy key, "noon" on a slot key, "not-a-date" and the number for 10000-01-01 on a day bucket: 200 → 400 on all three drivers and both doors. A month bucket and a text key: unchanged.

H2, paths. The call sits before getDriver, the middleware chain and both applyHaving doors. Driver reads of the object on a refusal: 0 on every refused cell (was 1), on both paths, on an empty and a populated object.

H4, collateral. Byte-identical base → head on all three drivers, both paths, both doors: every where and per-aggregation filter cell (11 shapes, each at both doors), and 41 having shapes: a day, an ISO instant, an epoch-ms number or string, in-range Date, zone-naive instant, wall clock, extended-year instant on datetime, {today} / {30_days_ago} / {not_a_token}, the empty and whitespace string, null, $exists, $in / $nin / $between, $not / $or / $and, { $field }, $contains / $startsWith, a string on sum, and the ten existing refusals (#20099 x3, #20123 x3, #20127, #19974, the type door, $icontains), in their words.

H5, the words. Envelope INVALID_FILTER / 400, the where door's wording class, naming the having path, the column, what it aggregates and its kind:

aggregate('ledger_20263'): `having` on 'col' (max(placed_on), a date column) compares against "not-a-date" at having.col.$lt, which is not a date value this platform can interpret. Compared with each group as written, it would keep no group or every group, a 200 indistinguishable from a real answer. The `having` was NOT applied. Write a "YYYY-MM-DD" calendar day.

The year class (a number or Date outside 0..9999 on a date column) keeps #20240's sentence. Disclosure: like where, the column's declared kind, and otherwise only what the query carries (alias, function, field, comparand, path). The remedy names no {placeholder}, unlike where's: having resolves none, so naming one would send the author to a literal.

Tests and evidence (head a2ff967202)

• pnpm --filter @objectstack/objectql exec vitest run --project local --project repo --maxWorkers=2: 321 files, 5828 tests passed, at 438014d26c, before merging main (the merge touched no objectql file; the objectql source is byte-identical at head, and the one objectql test file changed since was re-run at head).
• pnpm --filter @objectstack/rest exec vitest run --project local --project repo --maxWorkers=2, at 49d218bf7a (after merging main, closure rebuilt): 204 files, 3681 passed, 1 skipped.
• pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2, at 438014d26c, with OS_TEST_POSTGRES_URL (server Asia/Shanghai, process TZ=America/New_York): 199 files passed, 3 skipped; 3888 tests passed, 88 skipped. The suite's own summary: live postgres RAN, live mysql NOT RUN (no MySQL here; CI's Temporal Conformance job runs it).
• pnpm --filter @objectstack/driver-memory exec vitest run --maxWorkers=2, at 49d218bf7a: 57 files, 1374 tests passed.
• New: engine-aggregate-having-temporal-door.test.ts 51 passed; data-query-having-temporal-door.test.ts 11 passed (re-run at head).
• pnpm --filter @objectstack/objectql run typecheck and pnpm --filter @objectstack/rest run typecheck: exit 0, test layers included (objectql debt held at 40 files / 234 errors, unchanged; rest 0).
• ESLint, narrowed and proven: eslint --no-inline-config --format json over the 6 changed .ts files, 6 files counted in the JSON, 0 errors, 0 warnings. Population read from eslint.config.mjs (packages/**/*.{ts,tsx,mts,cts}); invariance: that config enables no type-aware linting (its own note), so this diff cannot move a verdict on an untouched file.

Ablation 1 (the door call), at 438014d26c, through scripts/ablation-replace.mjs with restore proven. The call in engine.ts was replaced by a marker; objectql rebuilt (exit 0); ablation-dist-preflight found the marker in 4 built files. objectql test: 20 failed / 31 passed (every refused, one-predicate and H3 case red; every unchanged and earlier-door case green). REST test: 6 failed / 5 passed. Restore leg: blob equals HEAD, rebuilt, marker absent from all 14 built files, tree clean, 51/51 and 11/11 green.

Ablation 2 (the text-operator skip). judgesOperator forced to judge every operator: exactly the two text-operator cells went red (2 failed / 49 passed); restored byte-identical.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at head: 64 commands. All run at a2ff967202; --ran reconciliation: 64 derived, 62 run, 2 NOT MEASURED, 0 unrun.

• NOT MEASURED: check:dual-build-cjs-loads and check:type-check-debt, reason: PREREQUISITE NOT MET (exit 3), both read a whole-workspace dist/ this worktree does not hold. CI builds it.
• Red by design: node scripts/check-empty-changeset.mjs --base origin/main exits 1 on the two DELIBERATE CORRECTIONS below. Its own text: say so on the PR and get it confirmed; it stays red either way.
• check:query-options-erasure went red on the first run (test surface 236 → 238, two as any option bags in the new tests); the options are typed now and it holds at 236.
• node scripts/check-issue-citations.mjs --base 2dccb7d494: exit 0, 16 citations resolve.
• Also run, as the derivation flagged their rosters under packages/: check:authz-resolver, check:error-code-casing, check:filter-alias-parity, all exit 0.

Deviations

• DELIBERATE CORRECTION, .changeset/20240-date-year-four-digits.md, one clause. It said "having does not reach the temporal-comparand door for any comparand, so a number or Date outside 0..9999 there is still compared as written." Now: "having reaches the same door in the same release (objectql having: a comparand on an aggregated date column never meets the temporal-comparand door — over REST having { last_placed: { $lt: "not-a-date" } } on max(placed_on) keeps every group (200) while its where twin answers 400 #20263), so a number or Date outside 0..9999 is refused there too."
• DELIBERATE CORRECTION, .changeset/19974-having-comparand-shape-face.md, one clause. It said neither the type door nor the declared-type gates "are run on having; this change adds the comparand-shape face only". Now it scopes that to "by this change" and adds that the comparand-TYPE door (objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099) and the temporal-comparand door (objectql having: a comparand on an aggregated date column never meets the temporal-comparand door — over REST having { last_placed: { $lt: "not-a-date" } } on max(placed_on) keeps every group (200) while its where twin answers 400 #20263) reach having in the same release. The type-door half was already false since objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099; this corrects both halves in one clause.
• A test-file header in packages/rest/src/data-query-date-year-range.test.ts said having does not reach the door; corrected to point at the new pin.
• "Pin on the three drivers": the refusal precedes any driver, so it is pinned where CI can boot the engine: both having paths with counting drivers (objectql) and the REST door over a real SqlDriver on SQLite (rest). InMemoryDriver and PostgreSQL were measured (the table above), not pinned: no package in the claim's surface has both the engine and those drivers (rest has no driver-memory dependency, and no CI job hands the REST suite a PostgreSQL URL). Adding either is outside the claimed file surface.

Acceptance notes (observations, not filed)

• A bigint comparand is judged by neither having nor where's object form (the door runs before the type door narrows it); where's array form narrows first and refuses it. In-process only, as JSON carries no bigint. Reported to the seat below.
• On PostgreSQL, where with a non-numeric string on a number field answers 500 DATABASE_ERROR where memory and SQLite answer 200. Outside the temporal family; noted, not measured further.

Out-of-scope findings for the seat (not filed by this PR)

1. having resolves no {placeholder}: { lp: { $gt: "{current_year_start}" } } on max(placed_on) keeps no group (both groups are after 2026-01-01), and {not_a_token} answers 200 where where answers FILTER_TOKEN_UNKNOWN / 400. resolveWhereTokens reads ast.where only.
2. The per-aggregation filter's temporal refusal names the wrong position: a bad date in aggregations[1].filter is reported "at where.placed_on.$gt".
3. On PostgreSQL, SqlDriver's native aggregate returns count / sum / avg as strings ("n":"1", "total":"20.000000000000000000000000000000", also over REST), so having { n: { $in: [2] } } keeps no group there while memory and SQLite keep c1, c2, and a string comparand on those columns answers differently on the native and the rows path.
4. The bigint hole in the first Acceptance note, if the seat grades it a defect.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 13 documentable anchor(s).

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via data.query (sdk, the route ledger binds it to POST /api/v1/data/:object/query, selected by route anchor /data/:object/query; the route ledger binds it to POST /data/:object/query))
• content/docs/api/data-api.mdx (via /data/:object/query (route, a path literal in a comment on a changed line))
• content/docs/api/wire-format.mdx (via /data/:object/query (route, a path literal in a comment on a changed line))
• content/docs/data-modeling/queries.mdx (via /data/:object/query (route, a path literal in a comment on a changed line))
• content/docs/kernel/runtime-services/data-service.mdx (via data.query (sdk, the route ledger binds it to POST /api/v1/data/:object/query, selected by route anchor /data/:object/query; the route ledger binds it to POST /data/:object/query), /data/:object/query (route, a path literal in a comment on a changed line))

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 6a6a17b62e8b58d0ee31cbfabf5fc7322032ba94 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from eb49dfd60c99af6fff6b489a23a50e5b823471cd — the merge of head a2ff967202602a677d8d4e5ac6d4b99cbc4bf0a4 into base 6a6a17b62e8b58d0ee31cbfabf5fc7322032ba94, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin eb49dfd60c99af6fff6b489a23a50e5b823471cd && git checkout eb49dfd60c99af6fff6b489a23a50e5b823471cd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6a6a17b62e8b58d0ee31cbfabf5fc7322032ba94 a2ff967202602a677d8d4e5ac6d4b99cbc4bf0a4 && git checkout -B drift-repro 6a6a17b62e8b58d0ee31cbfabf5fc7322032ba94 && git merge --no-ff a2ff967202602a677d8d4e5ac6d4b99cbc4bf0a4

node scripts/docs-audit/affected-docs.mjs --json 6a6a17b62e8b58d0ee31cbfabf5fc7322032ba94

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6a6a17b62e8b58d0ee31cbfabf5fc7322032ba94 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a2ff967202602a677d8d4e5ac6d4b99cbc4bf0a4

Scope: PR #20307 (card #20263, priority:p2, area:api), 9 files, +776/−15: packages/objectql/src/{engine.ts, having-filter.ts, temporal-comparand-door.ts}, two new pins (objectql/src/engine-aggregate-having-temporal-door.test.ts, rest/src/data-query-having-temporal-door.test.ts), one edited test header (rest/src/data-query-date-year-range.test.ts), .changeset/20263-having-temporal-comparand-door.md (new) and one-clause DELIBERATE CORRECTIONS to .changeset/20240-date-year-four-digits.md and .changeset/19974-having-comparand-shape-face.md (each git diff --numstat 1/1). packages/core, packages/spec and every driver src/ untouched. Merge base with origin/main = 2dccb7d494 (my base tree); the branch merged main at 49d218bf7a (parents 438014d26c, 2dccb7d494); the 6 main commits it brought in (89f87f2344..2dccb7d494) touch none of the 9 files (git diff --stat empty), and the three objectql source blobs are identical from 438014d26c to head (9bb4a1fd1720, a0e3b8508591, 05c2b337ccef); the two later commits typed test option bags only. git merge-tree against origin/main de091b50e6: clean (exit 0). Against PR #20306's head 93af6580d2: CONFLICT on .changeset/20240-date-year-four-digits.md alone, as the seat expects (not mine to resolve). Measured, not inferred: both trees built from source (turbo --force, cache confined to scratch, OS_SKIP_DTS=1), a scratch harness over InMemoryDriver, SqlDriver/SQLite and SqlDriver/PostgreSQL 16.13 (own role/db, TZ=America/New_York, server Asia/Shanghai), through engine.aggregate / engine.find and REST POST /api/v1/data/:object/query (JSON round-tripped), both having paths (native driver.aggregate + applyHaving; rows = a filtered aggregation forcing find + in-memory aggregation), a populated (6 rows, c1–c4) and an empty object, driver reads counted. 2670 cells per tree.

① Derived judgments

• The rows (item 1) — HOLD. 2286 of 2670 cells byte-identical base→head (status, code, kept groups, message, reads); 384 moved, every one a having cell going 200 with 1 read → 400 INVALID_FILTER with 0 reads, on all three drivers, both doors, both paths, populated and empty. None moved in the where, per-aggregation filter, or collateral sections.
  • max(date) last_placed: "not-a-date" $gt (base: no group) / $lt (base: c1–c4) → 400; "+010000-01-01T00:00:00.000Z" $gt (c1–c4) / $lt (none) → 400; number 253402300800000 $gt (c1–c4) / $lt (none) → 400; Date for 10000-01-01 (engine; over REST it is its ISO string) $gt/$lt → 400. where twins on placed_on: 400 INVALID_FILTER, 0 reads, byte-identical base→head. Control "2026-02-01": $gt c2, $lt c1,c3, unchanged; twin 200 (o3 / o1,o2,o5).
  • min(datetime) first_opened: "not-a-date" $gt (none) / $lt (c1–c4) → 400, twin 400. Extended-year ISO, number and Date for 10000: unchanged ($gt c1–c4, $lt none); twin: memory/SQLite 200 (six rows / none), PostgreSQL 500 DATABASE_ERROR — not the door's class, temporal values outside the years a four-digit text or a backend holds: a datetime comparand for year 10000 or −1 misorders on memory/SQLite and 500s on PostgreSQL; a date in year 0000 500s on PostgreSQL; a date write stores +010000-… verbatim #20264's. Control 2026-02-01T00:00:00.000Z: $gt c2,c3,c4 / $lt c1 unchanged; twin o3–o6 / o1,o2.
  • max(time) last_slot: "not-a-date" $gt (none) / $lt (c1–c4) → 400, twin 400. Extended-year ISO / number / Date: unchanged (200); twin memory 200 none, SQLite 200 six rows (number/Date $gt), PostgreSQL 500 — a pre-existing driver disagreement, unchanged. Control "12:00": $gt c3,c4 / $lt c1 unchanged; twin o5,o6 / o1,o2,o3.
  • Controls count / sum / avg with the same five comparands: every cell unchanged (200) on both trees. Their where twins on amount: memory 200 none, SQLite 200 (six rows under $lt), PostgreSQL 500 — unchanged.
  • Bar: every uninterpretable comparand on a temporal having column answers INVALID_FILTER / 400 with 0 driver reads on both paths and both populations, matching its where twin's class (400 INVALID_FILTER); every interpretable cell and every non-temporal aggregate cell byte-identical. Held.
  • Messages: native path == rows path on every refused cell; engine == REST except 36 cells where REST truncates at its 500-char bound (the year-class sentence is longer) — the existing truncateClientMessage; populated == empty modulo the object name. The measured words: aggregate('ledger_20307'): `having` on 'last_placed' (max(placed_on), a date column) compares against "not-a-date" at having.last_placed.$lt, which is not a date value this platform can interpret. Compared with each group as written, it would keep no group or every group, a 200 indistinguishable from a real answer. The `having` was NOT applied. Write a "YYYY-MM-DD" calendar day. — matches the PR's H5 quote; the number class gets core temporalStorageForm: the date arm leaves a year outside 1000..9999 unpadded — over REST the epoch-ms number for 0999-06-15 counts $gt 0 / $lt 7 on InMemoryDriver and SQLite (correct 6 / 0); its ISO string counts 6 / 0 #20240's sentence (…outside the years 0000 to 9999…keep the wrong groups…); the remedy names no {placeholder}.
• groupBy temporal key and day bucket (item 1) — RIGHT. groupBy ['placed_on'] + { placed_on: { $gt: 'not-a-date' } }, groupBy ['opened_at'] same, groupBy ['slot'] + 'noon', a day bucket d of opened_at with 'not-a-date' and with the number for 10000-01-01 (base kept every day bucket): 200 → 400 on all three drivers, both doors, both paths, 0 reads; words name the source (the groupBy field placed_on, a date column, the day bucket of opened_at, a date column). A month bucket ('2026-02', a text label) and a text key stay 200 none; the day-bucket control '2026-02-01' keeps the same three days. Judged: a projection of a temporal field carries that field's storage rule and a day bucket's label is a YYYY-MM-DD day, so the kind is right; a coarser bucket is text and must not be judged, and is not.
• One predicate, no second rule (item 2) — HOLD. assertHavingTemporalComparandsInterpretable(object, having, classes, query) → walkCondition → judgeFieldComparands → judgeComparand → core's isUninterpretableTemporalComparand(kind, value); the kind is temporalKindOf(classes.get(key)) over aggregatedRowColumnClasses (objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127's map), computed once in engine.aggregate and handed in. No driver, no copy.
  • temporalKindOf's export is package-internal: having-filter.ts is imported only by engine.ts, in-memory-aggregation.ts and temporal-comparand-door.ts; src/index.ts and src/core.ts re-export nothing from it; on the built head, temporalKindOf, assertHavingTemporalComparandsInterpretable, findUninterpretableTemporalComparand and aggregatedRowColumnClasses are absent from both dist/index.mjs and dist/core.mjs (ObjectQL present, as the control). Not on the PUBLISHED index; not a surface widening.
  • walkCondition refactor: findUninterpretableTemporalComparand(schema, where, path = 'where', depth = 0) keeps its signature; the registry-less early return precedes the walk as before; the where scope is kindOf = temporalComparandKind(fields[key].type), judgesOperator = () => true, so the walk is the old walk. Measured: 19 where shapes and the same 19 as aggregations[1].filter, × 3 drivers × 2 doors, byte-identical base→head including message text and path (at where.placed_on.$gt, at where.placed_on.$in[1], $between[1], $or[1].placed_on.$gt), and the refusing codes (INVALID_FILTER; FILTER_TOKEN_UNKNOWN for {not_a_token}; REST-ingress VALIDATION_FAILED for the preset name — identical on both trees).
• No collateral (item 3) — HOLD. 52 having shapes on the populated object, × 3 drivers × 2 doors × 2 paths, byte-identical: ISO instant on max(date) (c2,c4), in-range number/Date (c2), the 0999 number (c1–c4), epoch-ms string / zone-naive / bare-day bound on min(datetime) (c3,c4 / c3,c4 / c1,c2), extended-year and 10000 number/Date on min(datetime) and max(time), {today} (c1–c4), {30_days_ago} (none), {not_a_token} (200 none), '' and whitespace (c1–c4), null and $eq null (none), $exists (c1–c4), $in (c2,c4), $nin (c1,c2,c3), $between days (c1,c3,c4) and instants (c1,c2), $not (c1,c3,c4), $or (c1,c2), $and (c2), implicit equality (c4), { $field } (c1–c4), $contains '2026' (c1–c4), $startsWith 'not-a-date' (none), a string on count/sum/avg. Existing refusals keep code, status and words on both trees: objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099 $median (on max(date) with 'not-a-date', and on sum), objectql: a having key that names no column of the aggregated row keeps no group silently — having: { totl: { $gt: 100 } } answers 200 [], where an unknown where field is refused 400 #20123 unknown key totl alone, beside a bad date, and dotted, objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127 addDays numeric pair alone and beside a bad date, the type door's plain-object comparand alone and beside a bad date, objectql having answers an array in the equality slot by JS coercion (having: { total: [5] } is true) — the one face ruling 乙 closes "for every driver at once" that no gate reaches #19974 array in the equality slot (bad date, and number), objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099 array having, $icontains '', { $field: 'nope' }, and a bad date under $or beside a $median arm — all 400 INVALID_FILTER at the engine (the three array shapes and $icontains '' are VALIDATION_FAILED at REST ingress, unchanged). The door runs last, as claimed.
  • Text-operator skip: judgesOperator: (op) => !isTextFilterOperator(op) steps over spec's TEXT_FILTER_OPERATORS ($contains, $notContains, $startsWith, $endsWith, $icontains, $like, $ilike). Judged deliberate and right: on where and the per-aggregation filter [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's declared-type door refuses $contains/$startsWith on a date field first (measured 400 INVALID_FILTER, both trees), and [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's ruling left having beneath no door; judging them here would answer an operator no comparand can make runnable in the "not a date value" words that door retired. Residual, pre-existing and unchanged: $startsWith: 'not-a-date' on max(date) keeps a silent no-group 200 — [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's family, not this card's. Ablation 2 shows the skip is load-bearing (below).
• The pins discriminate (item 4) — HOLD, reproduced. Ablation 1 via scripts/ablation-replace.mjs --hold on engine.ts: anchor assertHavingTemporalComparandsInterpretable(object, query.having, havingColumnClasses, query); 1 → 0, blob 9bb4a1fd1720 → b3a2f59cbf05 (replacement gates the call behind globalThis.ABL20307_DOOR_OFF, import kept referenced); objectql rebuilt exit 0; ablation-dist-preflight: marker present in 4 built files; objectql pin 20 failed / 31 passed, REST pin 6 failed / 5 passed — the dev's counts. Restore: blob == HEAD 9bb4a1fd1720, git diff HEAD empty, rebuilt, preflight --absent: marker absent from all 8 built files (8, not the dev's 14: my build emitted no .d.ts), git status --porcelain empty; pins 51/51 and 11/11 after. Ablation 2 on temporal-comparand-door.ts: anchor judgesOperator: (op) => !isTextFilterOperator(op), 1 → 0, blob 05c2b337ccef → dd51c2b0fa6c, rebuilt, marker present; objectql pin 2 failed / 49 passed, exactly $contains on max(date) and $startsWith on max(date); REST 11/11 (information). Restore: blob == HEAD 05c2b337ccef, preflight absent, tree clean; both pins green on the restored tree (51/51, 11/11). (A first ablation-1 attempt whose replacement still contained the anchor was refused by the tool — anchor count 1 → 1 — and auto-restored; only the landing run is reported.)
• Prose (item 6) — no FALSE sentence.
  • .changeset/20263-having-temporal-comparand-door.md: title, BREAKING paragraph (400 once per query, before any driver, both paths, empty and populated), the seven table rows (each base answer and each 400 measured as written: $lt every group / $gt no group on 'not-a-date'; extended-year $gt every group; number $gt every group and its Date in-process; 'not-a-date' $lt on min(datetime)/max(time) every group; 'not-a-date' on a date/datetime groupBy key or day bucket and 'noon' on a time key $gt no group; number on a day bucket $gt every group), "read the object once before … now refused with no read", the judged list (operators, list members, $between endpoints, implicit slot, under $and/$or/$not; {placeholder}, '', null, { $field } not judged; having resolves no placeholders — measured, finding 1), the text-operator sentence, the door-order sentence, the example words, "Who is affected" (every having in content/docs and skills/ compares total / order_count / total_spent, all numeric — grepped), the Fix, and the Unchanged list — each TRUE against the cells.
  • DELIBERATE CORRECTION 20240-date-year-four-digits.md — confirmed. Old: "having does not reach the temporal-comparand door for any comparand, so a number or Date outside 0..9999 there is still compared as written." New: "having reaches the same door in the same release (objectql having: a comparand on an aggregated date column never meets the temporal-comparand door — over REST having { last_placed: { $lt: "not-a-date" } } on max(placed_on) keeps every group (200) while its where twin answers 400 #20263), so a number or Date outside 0..9999 is refused there too." The new sentence is TRUE (number and Date for 10000-01-01 on max(date) → 400 on all three drivers, both doors, both paths; the old one was TRUE at base and is false at head). Every other line byte-identical (numstat 1/1).
  • DELIBERATE CORRECTION 19974-having-comparand-shape-face.md — confirmed. Old: "…are run on having; this change adds the comparand-shape face only." New: "…are run on having by this change, which adds the comparand-shape face only (the comparand-TYPE door, objectql having does not take the rest of where's filter doors: a $field reference is never resolved, the comparand-TYPE door does not run, FilterArray sugar answers no group, and its own refusals fire only on a non-empty grouped set #20099, and the temporal-comparand door, objectql having: a comparand on an aggregated date column never meets the temporal-comparand door — over REST having { last_placed: { $lt: "not-a-date" } } on max(placed_on) keeps every group (200) while its where twin answers 400 #20263, reach having in the same release)." TRUE: the type door refuses { total: { $eq: { v: 1 } } } on having (400) and the temporal door reaches having (this PR); the declared-type gate indeed does not front having ($contains on max(date) answers 200). Every other line byte-identical (numstat 1/1).
  • Edited header in data-query-date-year-range.test.ts (numstat 3/3): TRUE — the REST pin holds { last_placed: { $gt: 253402300800000 } } → 400.
  • PR body: the measured table, H2 (0 reads), H3, H4, H5, the tests (51 / 11 re-run at head), both ablation counts (re-run), the gates (below), both DELIBERATE CORRECTION quotations (literal against the diff), the acceptance notes and out-of-scope findings 1–3 and 6 (re-measured below) — no FALSE sentence; the bigint note (finding 4) is in-process only and was not measured. Its "1650 cells / 162 moved" is the dev's harness, not contradicted by my 2670 / 384.
  • Other pending changesets: 20099-*, 20122-*, 20123-*, 20127-*, 20148-* (both), 20203-*, 20176-* — each having note is scoped to its own change ("by this change", "not changed before and after" its own edit) or states a rule this PR keeps (20176's column-class derivation, 20203's in-range number reading, 20148's Date-bound reading — all measured unchanged); none now reads FALSE. 20240-* is TRUE after its correction; PR fix(driver-sql): a MySQL date reads back the day it stores, so a year below 100 no longer comes back a century late #20306 corrects a different clause of the same line — the second lander must carry both clauses.
• Out-of-scope findings re-measured at base 2dccb7d494 for the seat (not verdict items). (Base is the merge base, not origin/main de091b50e6: main gained 13 commits since, none in packages/objectql, core or the drivers — packages/formula/src/matches-filter.ts, metadata-protocol/src/protocol.ts, stored-migration.ts, rest/src/rest-server.ts, meta-item-read-gate.ts, index.ts moved.) Every cell below is identical at head.
  1. REPRODUCES at REST, all three drivers, both paths: having { last_placed: { $gt: '{current_year_start}' } } on max(placed_on) → 200 keeps no group (every group's max day is in 2026; the resolved bound would keep c1–c4); { $gte: '{not_a_token}' } → 200 no group, while the where twin answers 400 FILTER_TOKEN_UNKNOWN ("Unresolvable filter placeholder "{not_a_token}"…"); {30_days_ago} on having keeps none and {today} keeps c1–c4 by text order.
  2. REPRODUCES at REST and the engine, all three drivers: aggregations[1].filter: { placed_on: { $gt: 'not-a-date' } } → 400 INVALID_FILTER whose message reads …at where.placed_on.$gt… (the walk roots at where; assertTemporalComparandsInterpretable is called with no path).
  3. REPRODUCES on PostgreSQL alone: the native-path aggregated record over REST and engine carries "n":"1", "total":"20.000000000000000000000000000000", "mean":"20.000…" as strings (rows path: numbers); having { n: { $in: [2] } } keeps c1,c2 on memory, SQLite and PostgreSQL's rows path, none on PostgreSQL's native path; { total: { $in: [500, 20] } } c1,c4 vs none; 'not-a-date' $lt / extended-year $gt on count/sum/avg keep c1–c4 on PostgreSQL native vs none elsewhere.
  4. (finding 6) REPRODUCES: where { amount: { $gt: 'abc' } } → memory and SQLite 200 no rows; PostgreSQL 500 DATABASE_ERROR ("Internal server error") at REST and the engine. The same as a per-aggregation filter → 200 with 0 counts on all three (evaluated in memory).
• CI at head (item 9), read last, all 34 check runs completed: 30 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 1 failure: Check Changeset, by design, on exactly the two corrected changesets — its log: "This PR changes a changeset it did not add: .changeset/19974-having-comparand-shape-face.md — present on the merge base and CHANGED by this PR -- this is somebody else's release note · .changeset/20240-date-year-four-digits.md — present on the merge base and CHANGED by this PR … DELIBERATE CORRECTION -- your change may have made this PENDING release note false, and you rewrote it in the same stroke. Remedy: do NOT restore it -- say so on the PR and get it confirmed … this gate stays red either way" (exit 1; its --self-test 159 assertions and "No empty-frontmatter changeset introduced" passed first). No other failure. Success includes Build Core, Test Core (1–6 and aggregate), Dogfood Regression Gate (1–3 and aggregate), Dogfood Verify CLI, Temporal Conformance (live PG + MySQL), TypeScript Type Check with its four sub-jobs, Lint & Repo Gates, Governed Surface Queue Guard, the claim/card/single-writer guards, Check PR Size, Check Documentation Links, Flag docs affected, Auto Label, filter. The required-context set itself is not readable from this seat's tools; every non-skipped context other than Check Changeset is success.

② Semver level

• Clause-②: no (narrowing) — RIGHT: the PR adds no key to a published payload and no published export (the temporalKindOf export is internal, above); it narrows having's accept set (384 measured cells 200 → 400). No widening arm is owed.
• @objectstack/objectql: minor with the BREAKING banner — RIGHT under the launch-window convention; rest changes are tests only, so no rest changeset is owed. node scripts/check-changeset-no-major.mjs --base 2dccb7d494 --event event.json (the CURRENT PR body as the pull_request payload): exit 0 — "✓ This diff introduces no major bump. ✓ LEVEL AXIS: this PR declares clause-② no (narrowing), and no package whose packages/**/src/** it moves is graded patch. · declaration line: Clause-②: no (narrowing) · direction arm: narrowing — a BREAKING change; during the launch window it ships minor".
• ADR-0087 not-required (no-migration-prescription) — RIGHT: having is a request-only key (QuerySchema.having, EngineAggregateOptions.having), no stored document, and the body prescribes no FROM → TO rewrite. node scripts/check-adr-0087-registration.mjs --base 2dccb7d494 (and --base origin/main): exit 0 — "✓ check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition. .changeset/20263-having-temporal-comparand-door.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription) reason: this change adds no transition to migrate…". Locally node scripts/check-empty-changeset.mjs --base origin/main exits 1 naming exactly 19974-having-comparand-shape-face.md and 20240-date-year-four-digits.md, the DELIBERATE CORRECTION class, confirmed above.

③ Boundary flags

• Open question 1 (pin on the three drivers) → A, as ruled: the door sits before getDriver and both applyHaving doors; the counting-driver pins prove 0 reads on both paths and the REST pin holds a real SqlDriver; InMemoryDriver and PostgreSQL re-measured here and agree on every refused cell. B would add a driver-memory dependency to rest and CI wiring outside the claim. Accepted.
• The two DELIBERATE CORRECTIONS: confirmed, old versus new literally, each one line, rewritten sentences TRUE (①).
• Landing-order conflict with PR fix(driver-sql): a MySQL date reads back the day it stores, so a year below 100 no longer comes back a century late #20306 on .changeset/20240-date-year-four-digits.md (my merge-tree reproduces it, on that file alone): the seat's; the second lander carries both clauses and re-confirms the combined sentence.
• Deviations accepted: the door runs last among the having doors (measured: every earlier refusal keeps its words, also beside a bad date); text operators not judged (measured; [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's door does not front having); the kind from objectql having: a { $field } reference with addDays against a non-temporal aggregated column answers by epoch-ms coercion, where SQL push-down refuses the same pair on where — the aggregated row declares no temporal class to judge it by #20127's classification handed in, not re-derived (code-read).
• Findings 1, 2, 3 and 6 reproduce at the REST door at base (①), for the seat's dedupe and filing; finding 4 (bigint, in-process) recorded, not measured; finding 5 is temporal values outside the years a four-digit text or a backend holds: a datetime comparand for year 10000 or −1 misorders on memory/SQLite and 500s on PostgreSQL; a date in year 0000 500s on PostgreSQL; a date write stores +010000-… verbatim #20264's.
• No packages/spec, no packages/core, no driver src/ touched; scope held.

Implemented-by: claude/issue-20263-having-temporal-door
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: PASS