feat(lint): field-typed equality/membership arm for filter-preset-comparand on declared date/datetime fields - #16347

Fixes #16106

Clause-②: yes

Ruling executed, not re-opened: comment 5557019138 on the card (director seat, summon #16, batch #52 item 5; maintainer verbatim 「其他同意」 adopting recommendation 1′). Clause-②: yes — constructed at CONTRACT_REVIEW_TIER, no quota exemption taken. Authored by a Claude Code dev seat under PM dispatch, session session_01T6HeZvT9wdSJD1ZxJb5Eno (the Claim: on the card, comment 5559619826, is the identity record). The standalone Clause-②: yes line above is the durable declaration: it keeps the clause-② signal readable by Check Changeset after the review seat clears the needs:contract-review carrier.

⚠️ Carrier discipline: needs:contract-review is hung on this PR and on #16106 together. This PR stays a draft until an at-tier review clears it — it is not flipped ready and not enqueued by its author; that is the review's outcome to decide. The at-tier review (card comment 5560322399) returned FAIL on one blocking finding, B1; the repair commit below closes it and a narrow re-review of that delta is pending.

What changed

packages/lint/src/validate-preset-comparands.ts gains arm 2 — the FIELD-TYPED refusal (ruling item 1):

• On a declared date / datetime field, one of the 13 declared preset names is refused in EVERY comparand position: bare (implicit equality), $eq / $ne, $in / $nin (every member of the list), the view-rule spellings equals / not_equals / in / not_in (with every alias normalizeFilterOperator folds — eq, ne, neq, notIn, …), and the triple spellings = / != / in / nin (with every alias canonicalAstOperator folds — ==, equals, not_in, …).
• Message and prescription reused verbatim: bareDateRangePresetComparandMessage(preset, operator) — one condition, one wording (the { field: {} }(零个操作符的字段约束)在同仓有三个答案:driver-sql 组合子内 TRUE、顶层抛 INVALID_FILTER、formula/driver-memory FALSE #5240 convention). The implicit-equality position is reported under the operator it lowers to, $eq, at the field's own path (…filter.close_date, no operator segment).
• Binding — which object a filter is judged against. The shared walk finds the subtrees; arm 2 re-walks each subtree's config path to the NEAREST ancestor that declares an object, in the carriers' own spellings, each the same read a sibling rule already makes at that position: object / objectName (datasets, a summary field's child object, optionsFrom, page data sources, record:related_list properties, element:record_picker, time-relative triggers); dataset → that dataset's object (dashboard widgets A dashboard widget's OWN filter keys and options.sortBy are not resolved at author time — validate/build exit 0, widget renders empty #14148, reports, report blocks); data.object on the object provider (views and list views No field reference on a list view is checked at author time — columns, filter, sort, grouping and every binding block accept a misspelt field name through both os validate and os build #14107, any other provider unjudged); config.objectName / config.object (flow CRUD nodes, a templated value skipped); dataSource.object then properties.object / properties.objectName (page components); a form field's publicPicker → picker.object, else the field's reference resolved on the view's object, else unjudged (repair commit, below); and under objects, the object itself (its list views, tabs, relatedListFilter). A bare or dotted field key then resolves through resolveFieldPath, and only an author-declared date / datetime leaf is judged.
• Arm 1 (ordering, field-agnostic) is the same judgement as before, byte for byte in behaviour; the existing eight tests are the regression pin.
• Follow-up commit 23443ce169 (PM-authorized, comment-only): authoring-rules.ts's registration comment now describes both arms — arm 1 needs no resolution context, arm 2 reads objects / datasets when present and stays silent where absent, so RUNTIME_NEEDS_FULL_SNAPSHOT still does not apply; date-range-presets.ts:101's TSDoc names both moments the shared wording is reported at. The message text itself is unchanged.
• Changeset-level commit e05cb18796 (no source change): the @objectstack/spec changeset raised from patch to minor — see Changesets below for why.
• Repair commit 3b6ba7b409 (review finding B1, card comment 5560322399): views[].sections[].fields[].publicPicker.filter is a static pre-filter the public-lookup route runs on the REFERENCED object (picker.object, else the field definition's reference), never on the form's own object. boundObjectOf did not recognise a publicPicker ancestor and fell through to the view's data.object — the parent form object — so a parent date column and a referenced select column sharing a name (with a preset-named option value) produced a FALSE refusal on a legitimate publish. The picker is now a claiming reader: picker.object when written, else the enclosing form field's field resolved on the view's object through resolveFieldPath and its meta.reference, else undefined — unjudged, never the parent. Mechanically: ancestorsOf now records the property name each ancestor was reached under, and the reader loop became bindAncestors(collection, chain, from, …) so the picker branch can bind the enclosing form's object by recursing outward from the section. No other binding path changed. element:record_picker is not the same class — it declares its own object, which the direct-object reader already binds.

Deliberately unjudged — a missed catch is the only failure direction this arm may have (the at-tier review found exactly one position where that did not hold, B1 above, closed by the repair commit), and the engine door still refuses each of these at query time with the registry's field map in hand: a position no ancestor binds; an unknown dataset or object, an object with no field map, a non-object view provider; a publicPicker whose field the form object does not declare or whose field carries no reference; a registry-injected column (created_at / updated_at — the graph carries their names, not their types; filed as #16340); a time field (the ruling names date / datetime); a field the object does not declare (the *-filter-field-unknown rules' finding); and every select / text column — stage: 'this_quarter' stays a working filter, which is the whole reason the schema door cannot do this blind.

Ruling item 2: packages/spec/src/data/filter.zod.ts is untouched (read only); the field-agnostic door keeps its ordering-only boundary and its header's reason.
Item 1's conditional ("and, if stack-level publish validation resolves field types, defineStack too"): measured no — stack.zod.ts carries zero filter-walking code (grep -c 'FilterCondition|walkFilter|runtimeFilter' packages/spec/src/stack.zod.ts → 0), so defineStack keeps accepting these positions and the refusal lives at objectstack lint and at the runtime publish gate (validatePresetComparands is registered CLI_AND_RUNTIME; the per-write snapshot carries objects and datasets, so a dashboard / view / object / page / flow write is judged with the field types present).
Item 4: with objects in the stack, filter-preset-comparand now fires on a filter defineStack accepts — the rule id becomes countable as live coverage on a defineStack app for the first time.

First premise (ruling item 3) — measured before any edit

Written onto the card: #16106 (comment). Real engine, two real drivers (@objectstack/driver-memory, @objectstack/driver-sqlite-wasm), declared date + datetime fields, 30 rows seeded: bare, $eq, $in, $ne, $nin are ALL refused at the engine door with INVALID_FILTER / 400 before any driver read, identically on both drivers; positive controls pass ({ $gte: '{30_days_ago}' } → 20 rows, a bare ISO day → 1, $in of ISO days → 2); stage: 'this_quarter' on a select column → 10 rows. The at-tier review reproduced this independently.

Correction to the card, stated plainly: its sentence "the surface answers 200 with zero rows and no diagnostic" was inherited from the pre-door #8690 measurement and is not true today for the residue positions on a declared date / datetime field — the runtime answers a loud 400 on first render. The gap was purely at authoring time (objectstack lint passed, defineStack accepted), which is what this PR shuts. The ruling stands either way.

Changesets

• @objectstack/lint: minor (new refusal arm) — the package whose public surface this PR widens; the review confirmed the level.
• @objectstack/spec: minor — gate-required, not semantically earned. The spec diff is a TSDoc comment only (no schema, no export, no runtime behaviour). It owes a changeset at all because the TSDoc publishes — measured, not assumed: after the edit, 2 non-map dist files carry the new text (dist/date-range-presets-BQj1X-Id.d.ts and .d.mts, the chunk dist/data/index.d.ts re-exports from; dist is in package.json files), 0 non-map files still carry the old phrase; baseline: before the edit the old phrase sat in exactly those two files, and a known .describe() string (Presentation-scope filter (runtimeFilter)) reached 18 non-map files. Semantically that is a patch. It is graded minor because the Check Changeset gate reads clause-② at PR level, not per package, and requires at least minor on every package the PR grows (maintainer ruling 2026-09-04, batch [WIP] Add query enhancements and advanced validation features #35, on finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294); the surface widening that earns clause-② lives in @objectstack/lint. This reading is recorded here rather than in the changeset prose, which ships to consumers as CHANGELOG text. check:generated after the rebuild: "All 15 generated artifacts are up to date" (no docs / api-surface artifact moved).

Verification — final head 3b6ba7b409 (= 34949aa1b0 + merge of origin/main at 6c546ab9d0 = 96ff8f59d7, + 23443ce169 comments, + e05cb18796 changeset level, + the B1 repair)

• pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 src/validate-preset-comparands.test.ts — Tests 17 passed (17) (8 existing + 7 arm-2 + the 2 B1 pins: the false-refusal case QUIET, the referenced-object-is-a-date POSITIVE CONTROL refused).
• pnpm --filter @objectstack/lint test on 3b6ba7b409 (lint's dist built) — Test Files 99 passed (99) / Tests 3389 passed (3389); pnpm --filter @objectstack/lint typecheck — tsc --noEmit clean, check:test-typecheck: OK.
• pnpm --filter @objectstack/spec exec vitest run src/data/date-range-presets.test.ts — Tests 6 passed (6); pnpm --filter @objectstack/spec build + check:generated green on the edited TSDoc. Spec's full test / typecheck suites are declared to CI (comment-only spec diff, compiled by the dts build).
• Consumer, against the rebuilt lint dist (on 96ff8f59d7; no consumer-visible change since): pnpm --filter @objectstack/metadata-protocol test — Test Files 166 passed | 2 skipped (168) / Tests 2414 passed | 10 skipped (2424) (pre-existing skips).
• Ablation, arm 2 (on 34949aa1b0, re-run by the review): EQUALITY_DOLLAR_OPS mutated to accept nothing → 3 failed / 12 passed; restore proven by blob 1f9c5f48fef72bcd457390fa036c751d804243b8 and empty git diff HEAD. The review added two legs in the false-refusal direction (FIELD_TYPED_TEMPORAL_TYPES + 'select' → 1 failed / 14 passed; UNBOUND = () => true → 2 failed / 13 passed), both as predicted.
• Ablation, B1 repair (on 3b6ba7b409, both directions): leg P1 — the picker reader disabled (key === 'ablated_' + PUBLIC_PICKER_KEY; on-disk proof anchor 1 / remaining 0 / injected 1, blob cd3fbe6a6e08…) → vitest exit 1, red on exactly the QUIET pin (the false refusal returns); leg P2 — every picker position forced unjudged (const override = undefined …; return override;, blob 553db859ecfe…) → exit 1, red on exactly the POSITIVE CONTROL pin (blanket silence). Each restored with git checkout HEAD -- …: on-disk blob = HEAD blob 23a8afdb33349274645cf2f54a36d364e31052e2, git diff HEAD empty, porcelain empty. A discarded reading, stated: the first P2 attempt used a replacement that CONTAINED its anchor as a substring, so the on-disk proof's "anchor remaining" count read 1 although the blob had changed (75a7be68…) — the proof refused it as not-landed and the leg was re-run with a non-superset replacement; nothing was read from the discarded attempt.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on 3b6ba7b409 derived 74 families (identical to e05cb18796's); all 74 run on that head: 72 green, 2 PREREQUISITE NOT MET (exit 3: check:dual-build-cjs-loads, check:type-check-debt — both read the whole-repo build only CI performs; NOT MEASURED locally, not red). --ran reconciliation: 74 derived / 74 run / 0 unrun. Check Changeset on e05cb18796 (CI job 101510513543): fired and passed; offline on the same head with this body: reads both the carrier and the Clause-②: yes line, passes.
• Declared narrowing: turbo ls --affected lists 54 packages (everything downstream of @objectstack/lint and @objectstack/spec). Run locally: @objectstack/lint, @objectstack/metadata-protocol, the spec file's own test. packages/cli (a 56-cache-miss closure build), spec's full suites and the rest are declared to CI.

Notes for the reviewer

• The engine door skips dotted keys (temporal-comparand-door.ts:186 — read, not measured); arm 2 does judge account.created_on-style paths through the graph's lookup hops, the one place such a path gets a verdict at all (review advisory A1: the shared message's "refuses the query at the engine" clause is not literally true there; { field: {} }(零个操作符的字段约束)在同仓有三个答案:driver-sql 组合子内 TRUE、顶层抛 INVALID_FILTER、formula/driver-memory FALSE #5240's one-wording rule wins).
• lint: a field-typed rule cannot see registry-injected temporal columns (created_at / updated_at) — the object graph carries their names, not their types #16340 is filed for the injected-column blind spot (created_at / updated_at measured refused at the engine, invisible to the lint graph). Not addressed here.