[chriscoveries]

ledger_search filters senders but cannot restrict a query to one recipient or time interval. Callers must fetch broad pages and discard unrelated events themselves.

The operation now accepts to, since_ts and until_ts. to matches an exact stored member of event.data.to, without expanding selectors. Time bounds are inclusive RFC3339 instants; equivalent offsets compare correctly. The fields combine with existing filters before the limit in both cursor directions. Omitted or null fields preserve current behavior. Invalid types, blank values and reversed intervals return invalid_args. The HTTP search endpoint forwards the same fields.

How we built it. The existing search query validates the three arguments and applies them beside the sender filter. Pagination order and event-ID cursor semantics remain unchanged. The IPC contract describes the parameters and HTTP behavior. This removes caller-side filtering loops; it does not replace the existing ledger index or change server retention.

How we tested it.

• Three added daemon/HTTP tests replay a contiguous 102-event recorded ledger window. Event IDs, timestamps, kinds and order are retained; actor/group identities use consistent aliases and message bodies are omitted. Tests cover recipient/interval intersection before limits, backward and forward pages, independent bounds, sender intersection, offset-equivalent exact boundaries, no-match queries, invalid filters and HTTP forwarding.
• GitHub Actions CI on the fork at exact PR head c1f5062166f764916c256ecde84e9a16b7ade884 passed all six jobs, including rust-linux: run 39774146102. The test-only reference run 39763094446, based on upstream main a212cb04 before it advanced to f1d27838, fails exactly the three added tests while the other 2,715 pass; it is historical baseline evidence, not a test of current main.
• Real-daemon CI probes replay the recorded window through each daemon's Unix socket in fresh private homes. Stock 0.4.44 and upstream main each fail all eight recipient/time-filter checks; the candidate passes all eight. Raw requests/responses, source/binary/fixture hashes and daemon cleanup are retained. Setup failures cannot count as a negative reference.
• Non-author source review passes the feature head. The separate evidence branch is not part of this PR.

Tested on: GitHub-hosted Ubuntu 24.04 x86_64 runners, 4 vCPUs, Rust 1.88.0 (daemon probes); fork CI also passes Windows smoke.