Fix specification review findings

[rasuvaeff]

Summary

• close security, composition, validation, and DateTime findings F-1 through F-7
• update rasuvaeff/property-testing-testo from ^0.4 to ^0.10
• strengthen property coverage for generated DateTime OR values and BETWEEN edge examples
• correct comparative benchmark baselines and document the callback/modifier contracts

Fixes

• allow-list direct OrConditionSpecification operators
• preserve ORDER BY, LIMIT, and OFFSET across orWhere() and nested callback builders
• require zero-based two-element lists for BETWEEN
• normalize DateTime values through yiisoft/db DateTimeValue (including OR and is/is not)

Verification

• composer build passed
• composer release-check passed
• composer test: 322 tests, 4168 assertions
• composer bench: 2 benchmarks passed
• both examples executed successfully
• PHP lint passed for all examples and benchmarks
• Psalm, CS fixer, Rector, require-checker, and BC check passed
• mutation testing could not start because the composer:2 image has no pcov/phpdbg/xdebug coverage generator

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 24de54d4-dd31-43a7-ac54-cca8ae164ac8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}