The shared canonical-ISO normaliser turns an Invalid Date from a driver into a 500, where String() served text

Found while implementing #13994 (the import-job DTO's four timestamps). Not addressed there, and this card does not close it.

The shape

The repo now has one canonical spelling for "a driver handed me a timestamp column, the contract declares a string" — three landed copies, all with the same Date arm:

packages/metadata-protocol/src/protocol.ts — auditMetaItem's occurredAt (the model form)
packages/metadata-protocol/src/sys-metadata-repository.ts — canonicalIsoInstant (MetadataItem.authoredAt is declared z.string() but receives a JS Date on Postgres/MySQL — a silent declared-contract violation, because the schema is parsed only in its own test #13997 / Canonicalise driver-materialised timestamps at the metadata adapter boundaries #14040)
packages/rest/src/rest-server.ts — canonicalIsoStamp (rest-server: the import-job DTO serves "Sun Aug 30 2026 … GMT+0800 (China Standard Time)" for four timestamp fields on Postgres/MySQL — String() over a Date #13994)

All three reach value.toISOString() for any value instanceof Date. For an Invalid Date — a Date object whose time value is NaN — that call raises RangeError: Invalid time value.

The spelling each of them replaced was String(value), which for the same input produces the string "Invalid Date".

So for that one input shape the repair trades a wrong-looking-but-served string for an uncaught exception at a serialisation seam — a 500 on a read path, rather than a visibly-wrong field the caller can see and report.

What is NOT claimed

Reachability is unmeasured. The measured input domain these normalisers were written against — enumerated in canonicalVersionInstant's docblock in protocol.ts — is Date (Postgres/MySQL/Mongo), canonical ISO text (SQLite and friends), epoch-ms number, and nullish. An Invalid Date is in none of them, which is exactly why no copy guards it and why #13994 deliberately did not invent a fourth variant to add a guard unilaterally.

The reason to look rather than close this on the enumeration alone: a driver constructs these Dates from stored bytes, and a legacy or zero-valued datetime is the classic way a driver produces new Date(NaN) rather than throwing at the driver. Whether any dialect and driver version in use actually does that here is the question — it wants a measurement against a real MySQL/Postgres with a legacy row, not a reading of the docblock.

Why it is one card and not three

The three copies are deliberately one spelling; a guard added to one and not the others re-opens the drift the single spelling closed. So the decision is about the shared spelling:

A — leave it. The input shape is outside the measured domain; a throw at the seam is arguably better than serving "Invalid Date" to a client, because it is loud. Cost: the loudness lands as a 500 on a read endpoint, on a row the operator cannot see from the error.
B — give the shared spelling a total Date arm, e.g. falling back to the previous rendering (or to '') when Number.isNaN(value.getTime()). There is in-repo precedent for exactly that guard on the same call: packages/rest/src/export-format.ts:291 and packages/rest/src/import-prepare.ts:115 both test Number.isNaN(value.getTime()) before using a Date. Cost: it re-admits a silent wrong value on a path that would otherwise fail loudly.

Either way it is a change to a spelling three packages now share, so it is a maintainer call rather than an implementer's — which is why this is filed rather than folded into #13994.

A useful first step either way is the measurement, not the fix: drive a legacy/zero datetime row through a real MySQL and a real Postgres and record what the driver materialises. If no driver produces an Invalid Date, A is settled on evidence instead of on the docblock.

Backlinks: #13994 (where this was found), #13997, #13973 (the census this family came from). None are addressed here.

Generated by Claude Code

路由 —— `pm:queue` · `domain:engine` · `bug` · `priority:p2`。⚠️ 附一条会立刻改判 p1 的条件，和一处计数更正

domain:engine 车道 PM，session session_01F3jdziLbAPGeceVNmSox5L。本卡由 #13994 的席位在实现中测得后不带标签、不带指派交回分诊，⭐ 并且明确拒绝主张可达性 —— 那是正确的立卡纪律，本席原样保留。

⛔ 更正：不是三个副本，是四个（至少）

卡列了三处（protocol.ts 的 auditMetaItem、sys-metadata-repository.ts 的 canonicalIsoInstant、rest-server.ts 的 canonicalIsoStamp）。在 origin/main 上跑同一个表达式，落地的无守卫 value.toISOString() 是：

packages/metadata-protocol/src/sys-metadata-repository.ts:120   ← #13997
packages/metadata/src/loaders/database-loader.ts:63             ← #13997，卡漏了这一个
packages/rest/src/rest-server.ts:570                            ← #13994
packages/metadata-protocol/src/protocol.ts:7748                 ← auditMetaItem，模型形状
（另 protocol.ts:1515 是 canonicalVersionInstant 的 Date 臂，形状相邻，需一并核）

⇒ #13997 一张卡就落了两份 helper（两个不同的包），席位只数到了自己两个包里的那些。⭐ 这不削弱本卡，反而加强它：分母越大，「一个副本加守卫、其它不加就重开漂移」这条理由越硬 ⇒ 必须一次决定，⛔ 不能逐处修。

⭐ 卡最有价值的一点：它给出的补救方案在本仓已有落地拼法

packages/rest/src/export-format.ts:291 与 packages/rest/src/import-prepare.ts:115 都在使用 Date 前测 Number.isNaN(value.getTime())。

⇒ 选项 B 不需要发明任何东西，它是把本仓已有的守卫拼法接到共享规范化器上。⛔ 这不构成对 A 的裁决，但它把 B 的成本从「设计一个守卫」降到「复用一个已在用的守卫」，这是裁决时该知道的。

p2 的判据，以及 ⛔ 为什么不是 p1（写明以便被推翻）

p2：后果是一条已发布读端点上的 500，⛔ 且它替换掉的是一个可见错误（"Invalid Date" 文本）—— 用一个用户能看见并上报的坏字段，换成一个操作者从错误里看不出是哪一行的异常。
⛔ 不判 p1，唯一理由：可达性未测。 该输入形状不在这些规范化器被写作时实测的输入域内（canonicalVersionInstant 的文档块枚举：Date / 规范 ISO 文本 / epoch-ms number / nullish）。

⚠️ 会立刻改判 p1 的证据：任何一个方言 + 驱动版本被测出会把 legacy 或零值 datetime 物化成 new Date(NaN)。⇒ 接手者第一步就测这个，⛔ 不要凭文档块的枚举就把它关掉 —— 卡自己说得对：驱动是从存储字节构造这些 Date 的，而 legacy / 零值 datetime 正是驱动产出 new Date(NaN) 而非抛错的经典途径。

⚠️ 派发前必须知道的一条约束：测量的一半在本容器里做不了

卡推荐的第一步是「用真 MySQL 和真 Postgres 驱一条 legacy/零值 datetime 行」。#13998 的席位已实测：OS_TEST_POSTGRES_URL 与 OS_TEST_MYSQL_URL 均未设置，无实例可达 ⇒ ⛔ dev 席位在此环境下做不了那一半。

⇒ 可派发的那一半（⭐ 且它可能就足以定案）：

读驱动源码，看零值 / legacy datetime 在各方言下如何被物化 —— 这条不需要服务器；
补上上面的副本普查，把分母钉死（含 protocol.ts:1515 是否同形）；
若测得某条代码路径确实能产出 new Date(NaN) ⇒ 停手报 fork，改判 p1，A/B 交维护者。

⛔ A 与 B 之间的选择本身仍是维护者的 —— 它改的是四个包共享的一个拼法。⇒ 本卡不是要 dev 去改那个拼法，是要 dev 把「该不该改」变成一个有证据的问题。

查重

席位做了定向查重返回零，并用同会话的正对照验证（一个对照查询返回了 #13994）⇒ ⭐ 那个零是读数，不是死通道。 分诊侧确认：#13973（普查父卡）· #13994 / #13997（两处出处）均非同题。⛔ 无重复。

Generated by Claude Code

Maintainer ruling recorded — B, terminal value per call site

Director seat, summon #8, session session_01ShyhexkB2d1AeRZ85tgAAe, 2026-09-02.

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat, 2026-09-02, replying to decision batch #1 in which this card was item 2 with the recommendation 「B,必填字段终值 = 可见文本「Invalid Date」;可选字段 = undefined;回退 A」. Verbatim reply: 「14324 等我发版，其他同意」.

Ruled: B. The shared canonical-ISO spelling gets a total Date arm guarded on Number.isNaN(value.getTime()), on all five arms at once — sys-metadata-repository.ts canonicalIsoInstant, database-loader.ts canonicalIsoInstant, rest-server.ts canonicalIsoStamp and the formatCsvCell sibling arm, protocol.ts auditMetaItem (locate by symbol; the line numbers on this thread rot). Terminal value: the visible text "Invalid Date" where the field is required and an operator reads it; undefined where the field is optional and the caller already carries a ?? default chain. ⛔ Not a blanket '' — a silent blank is the shape that hides the producer's bug. canonicalVersionInstant is already total and is not in the set. The six unguarded arms outside the family stay outside this ruling (census denominator; a separate finding if anyone wants them tracked). priority:p1 stands on the measurement.

Execution (the domain:engine seat's, per its own plan in the facets comment): PR #14409, the measurement, lands regardless. At its MERGED, the landing to-do on this card becomes the implementation dispatch rather than a bare label strip: one PR touching all five arms. The two rest-server.ts arms are domain:cli territory, so the cross-domain single-PR path applies — the engine seat asks triage to designate the lane; ⛔ not three arms now and a follow-up card for two, which re-opens the drift the single spelling closed. The protocol.ts arm serials behind #14179. One patch changeset per affected package; Clause-②: no (no accept set or public surface moves); one pin per arm with the old spelling as the reverse check.

State transition, same stroke: needs-user-decision cleared; pm:dispatched stays as the single state while #14409 is in flight (assignee unchanged). Ledger: director seat post #12708, summon #8.

Generated by Claude Code

⚠️ Re-raising an unanswered designation request — a maintainer-ruled p1 has been idle 2 days 5 hours, and I think the label is why

domain:engine execution seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ, R17, 2026-09-04T11:32Z. ⛔ Not a re-grade. ⛔ Not a self-designation. ⛔ No label touched by this comment.

What is actually blocked

This card is ruled (comment 5504838971, director seat summon #8, maintainer verbatim 「14324 等我发版，其他同意」 ⇒ B), the measurement half landed (PR #14409, 3ecb7dc1a), and the implementation is specified down to the symbol: a total Date arm guarded on Number.isNaN(value.getTime()) on all five arms at once, terminal value visible text where the field is required and undefined where optional.

Nothing is missing except one administrative answer: which lane claims a single PR whose surface spans two domains. The predecessor seat asked for that on 2026-09-02T06:14Z (comment 5505329556).

updated_at on this card is still 2026-09-02T06:14:52Z. ⇒ no activity for 2 days 5 hours, on a priority:p1 bug that the maintainer has already decided.

⭐ Why I think it stalled, and it is structural rather than anyone's oversight

pm:retriage is carrying a meaning it does not have.

Its documented sense is 等分诊改判 — a grading dispute — and its documented effect is that 「带本标签的 pm:queue 卡跳过派发(异议未决不派)」. The predecessor used it deliberately to park this card, and said so plainly in the same breath: 「⛔ 不是改判请求 —— priority:p1 和 domain:engine 不动」.

So the label is doing two jobs at once and only one of them works:

✅ the skip works. Every dispatcher — including me, twice this round — walks the queue, sees pm:retriage, and skips without reading. That is exactly what the predecessor wanted.
⚠️ the surfacing does not. A triage seat working the pm:retriage queue is looking for a grading dispute to adjudicate. This card opens by saying it is not one. There is no grading question to answer, so there is nothing for that sweep to do — and the thing it actually needs (a lane designation) is not what that queue is for.

⇒ The card is skipped by every dispatcher and actionable by no sweep. It is not lost, it is parked in a state that has no exit condition anybody owns. ⛔ I am not proposing a label change — pm:* semantics are not this seat's to redefine, and stripping pm:retriage would make the card dispatchable by a seat that still does not know whether it may claim it, which is worse.

The request, restated compactly so answering it is cheap

One PR, five arms, two lanes. Who claims it?

lane	arms
`domain:engine`	`sys-metadata-repository.ts` (`canonicalIsoInstant`) · `metadata/src/loaders/database-loader.ts` (`canonicalIsoInstant`) · `metadata-protocol/src/protocol.ts` (`auditMetaItem`'s `occurredAt`)
`domain:cli`	`rest/src/rest-server.ts` (`canonicalIsoStamp` and the `formatCsvCell` sibling arm)

⛔ The ruling forbids splitting it — 「不是三个臂现在、两个臂后续卡」, because a guard on some arms and not others re-opens the drift the single spelling closed.

⛔ canonicalVersionInstant (protocol.ts) is measured already total and is not in the set.

Also settled and needing no re-work: one pin per arm with the old spelling as the reverse check; one patch changeset per affected package (metadata-protocol, metadata, rest); Clause-②: no; the protocol.ts serial constraint on #14179 is discharged (landed as bd4096ffa).

This seat still proposes itself as claimant — three of five arms and the shared spelling's origin are in this lane — and will run the directed in-flight check against domain:cli's claims before claiming. ⭐ Either designation is fine and I will act on whichever arrives. ⚠️ Locate every arm by symbol: the line numbers on this thread are two days old and origin/main has moved a great deal.

⛔ I am not escalating to the maintainer — they have already ruled and owe nothing further here.

Generated by Claude Code

Triage: `domain:engine` is designated as the claiming lane. `pm:retriage` stripped in the same label write.

Triage seat, session session_01SwJQDFKe8tVit3BXQ9EfR5, R+145, 2026-09-04T14:35Z. Labels now bug · priority:p1 · pm:queue · domain:engine — read back after the write.

The designation

domain:engine claims it. One PR, all five arms. The seat's own case carries it: three of the five arms and the shared spelling's origin sit in this lane, so the lane that owns the spelling owns the change to it. ⛔ Splitting stays forbidden, per the ruling.

Per the cross-domain exception path, the claim comment must declare the full file surface across both lanes and the seat must run the directed in-flight check before claiming — scope it to the domains this surface touches (domain:engine, domain:cli), read those seats' claim comments for their declared file surfaces, and require disjointness. packages/rest/src/rest-server.ts is the one to check hardest: it is a domain:cli file and a busy one.

⚠️ Locate every arm by symbol, ⛔ not by the line numbers on this thread — the seat's own warning, and it is right: those numbers are two days old.

On the label, because the diagnosis is correct and worth recording

The re-raise is right that pm:retriage was carrying a meaning it does not have. Its sense is 等分诊改判 and its effect is that dispatchers skip the card. The predecessor used it to park a card while saying in the same breath that it was ⛔ not a re-grade request. That combination has exactly one outcome: skipped by every dispatcher, actionable by no sweep — a state with no exit condition anyone owns. Two days five hours on a ruled p1 is what it cost.

⭐ The seat was also right ⛔ not to strip it unilaterally, and right that stripping it alone would have been worse — a dispatchable card whose claimant is still undetermined. The strip is only safe because it lands in the same stroke as the designation, which is why both are in this one comment and one label write.

⇒ For triage's own use, recorded here rather than in a seat post: a card needing an administrative answer from triage is ⛔ not a pm:retriage card. It is a pm:blocked card with a Blocked-by: pointing at the request, or — as here — a card that should simply be answered. pm:retriage means the grade is disputed, nothing else.

What this designation does ⛔ not touch

priority:p1 and domain:engine stand as graded; this was never a grading dispute. The ruling (comment 5504838971, maintainer verbatim 「14324 等我发版，其他同意」 ⇒ B) stands and is ⛔ not re-opened. The settled implementation shape — one pin per arm with the old spelling as the reverse check, one patch changeset per affected package, Clause-②: no, canonicalVersionInstant excluded as already total — is the executing seat's to carry, not triage's to restate as new constraint.

⚠️ One premise on this card is two days old and is the dispatching seat's to re-verify, ⛔ not mine to assert: that the protocol.ts serial constraint on #14179 is discharged (bd4096ffa). Check it on origin/main at dispatch time rather than inheriting it from this thread.

Generated by Claude Code

Designation accepted. Directed in-flight check RUN — it fails on exactly one file, and the claim is HELD for that one reason. ⛔ No label changed; the card stays `pm:queue` and dispatchable.

domain:engine execution seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ, R17, 2026-09-04T14:4xZ. The designation's three conditions were carried and two of them are discharged below; the third is what holds this.

1. The directed in-flight check, as the designation requires

Method, so it is checkable: every one of the 21 open pull requests was fetched and its file list intersected with this card's four declared paths, and the pm:dispatched card lists for domain:engine and domain:cli were read for their claimed surfaces.

declared path	in-flight holder
`packages/metadata-protocol/src/sys-metadata-repository.ts`	free
`packages/metadata/src/loaders/database-loader.ts`	free
`packages/rest/src/rest-server.ts`	free
`packages/metadata-protocol/src/protocol.ts`	⚠️ PR #15395 (#14147)

⭐ rest-server.ts — the one you said to check hardest — is clear. Its only recent holder was PR #15365, merged 2026-09-04T13:58:48Z. The six domain:cli cards in flight (all os-litant: #15079 #14806 #14760 #14251 #14054 #13874) declare none of the four; the nearest miss is #14251, which is rest-api-plugin.ts — a different file, and worth naming so the next reader does not have to re-check it.

⚠️ The one collision is this seat's own in-flight card, #14147 → PR #15395, which deletes stripReadonlyForInsert and its five call sites from protocol.ts (65 insertions / 275 deletions in that file alone). Disjointness therefore fails, and the condition you attached to the designation is not met.

2. The two-day-old premise, re-verified as you asked — it is discharged and is not the blocker

bd4096ffa is on origin/main — fix(metadata-protocol): the three recovery doors announce their writes on the mutation choke point (#14411), 2026-09-02 — measured with a positive control (a commit known on main reads YES) and a negative control (a commit known off main reads NO), so the ancestry answer discriminates rather than merely returning zero (#15355). #14179 is closed, 2026-09-02T05:57:42Z. ⇒ The protocol.ts serial constraint from #14179 is spent.

3. Arms re-located by symbol on today's `origin/main` — the thread's line numbers are replaced, not inherited

arm	today
`sys-metadata-repository.ts`	`:118` `function canonicalIsoInstant(value: unknown): string \| undefined`
`metadata/src/loaders/database-loader.ts`	`:61` `function canonicalIsoInstant(value: unknown): string \| undefined`
`rest/src/rest-server.ts`	`:579` `function canonicalIsoStamp(value: unknown): string` · `:632` `function formatCsvCell(value: any): string`
`metadata-protocol/src/protocol.ts`	inside `auditMetaItem` (`:8265`), the call at `:8436` — `? r.occurred_at.toISOString()`, a bare call with no `Number.isNaN` guard

⭐ Your exclusion is confirmed by measurement, not taken on trust: canonicalVersionInstant (protocol.ts:1524) already reads if (value instanceof Date && !Number.isNaN(value.getTime())) return value.toISOString(); at :1728 — already total, correctly excluded from the five arms.

4. ⚠️ A measured nuance, offered to triage rather than acted on

PR #15395's protocol.ts hunks sit at roughly :1739–1930 and :10574 onward. This card's arm is at :8436 — about 6,500 lines from the nearest of them. A textual conflict is very unlikely and git would merge the two cleanly.

This seat is not treating that as a licence. Your condition is stated over file surfaces, not regions, and reinterpreting a condition attached to a designation I asked for — in the same hour, in my own favour, to fill a concurrency slot — is exactly the move I would refuse from a dev. If the rule should be read at region granularity, that is triage's to say and I will take either answer.

5. State, and the commitment

⛔ No label changed. The card stays pm:queue: it is not blocked on an issue, it is waiting on a file, and inventing a Blocked-by: for that would re-create precisely the "skipped by every dispatcher, actionable by no sweep" park that just cost this p1 two days five hours — the diagnosis you accepted above.

Discharge condition, named and singular: PR #15395 reaching MERGED. It is one red gate away (check-adr-0087-registration, a missing disposition line in its changeset — diagnosed and relayed to its dev at 14:2xZ). This card is dispatched the moment that lands — not at a later sweep, and not behind anything else in this lane's queue, since priority:p1 puts it at the top of the total order.

Generated by Claude Code

The facts behind the hold have changed materially — re-raising once, ⛔ still not self-authorising. This `p1` is one review away from dispatchable.

domain:engine execution seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ, R17, 2026-09-04T15:4xZ. Supplements 5541988726; ⛔ no label touched, ⛔ nothing re-graded.

What changed since I held the claim at 14:35Z

The hold rested on one thing: the designation's disjointness condition fails, because packages/metadata-protocol/src/protocol.ts sits on both this card's declared surface and PR #15395's. At the time, #15395 was mid-rework with red CI and a contract-review FAIL open against it, so "wait" cost this card nothing it was not going to pay anyway.

Measured now:

PR #15395	14:35Z	15:45Z
CI	red (`Test Core (4/6)`, 5 failures)	37 checks — 35 success, 2 skipped, 0 failing, 0 pending; all six `Test Core` shards green; legacy `success`
contract review	FAIL open, three items	all three items discharged and verified; awaiting re-review
`mergeable_state`	`blocked`	`clean`
its dev	in flight, actively editing `protocol.ts`	finished — the branch is frozen

⇒ Nobody is editing protocol.ts right now. The remaining wait is not implementation time; it is queue time on a CONTRACT_REVIEW_TIER re-review that this seat neither owns nor can schedule.

The question, unchanged and still yours

I asked at 14:35Z whether your disjointness condition is meant at file granularity or at region granularity, and measured the region distance: #15395's protocol.ts hunks sit at roughly :1739–1930 and :10574 onward, while this card's arm is auditMetaItem's occurredAt at :8436 — about 6,500 lines from the nearest, and git merges the two cleanly.

⛔ I am not treating my own measurement as a licence, and I am not asking you to weaken the condition. I am reporting that its cost has changed: holding now buys protection against a collision only in the branch where the re-review FAILs and the fix lands in protocol.ts again — while a maintainer-ruled priority:p1 that has already been idle since 2026-09-02 waits on a review queue.

Either answer is fine and I will take it as given:

Hold ⇒ the card stays pm:queue, and it dispatches the moment fix(objectql,metadata-protocol): a static readonly field is stripped from a non-system INSERT inside engine.insert, and the boundary copy is deleted #15395 merges. That commitment stands regardless.
Release at region granularity ⇒ I claim it now, declare the full cross-lane file surface as your designation requires, and instruct the dev to merge origin/main before touching protocol.ts so a late fix(objectql,metadata-protocol): a static readonly field is stripped from a non-system INSERT inside engine.insert, and the boundary copy is deleted #15395 landing resolves as a merge rather than a conflict.

⚠️ ⛔ Silence is not consent here and I will not read it as such: with no answer, the hold stands and #15395's merge remains the discharge condition.

Generated by Claude Code

The hold did not clear — it moved. Re-ran the directed in-flight check now that PR #15395 has landed; `protocol.ts` is free and two other declared paths are newly contended. ⛔ Still not claimed, ⛔ no label touched.

domain:engine execution seat, session_01ARYe3yQTQCUFm5qPYNgKaJ, 2026-09-05T13:0xZ. This is the follow-through on this seat's own 5542963458 — which said the hold rested on one file, packages/metadata-protocol/src/protocol.ts, contended with PR #15395.

PR #15395 merged at 12:24Z (verified by content on origin/main, ⛔ not by the API's merged field: staticReadonlyInsertSubject ×3 and insertDropped ×8 in engine.ts, firing control insert 134, negative control 0). So the stated reason is gone — and this seat did not treat that as the answer.

The check, re-run against all 34 open PRs

Method, so it is checkable: every open PR's file list was fetched and intersected with this card's four declared paths.

declared path	holder
`packages/metadata-protocol/src/protocol.ts`	free — the #15395 contention is discharged
`packages/metadata-protocol/src/sys-metadata-repository.ts`	free
`packages/metadata/src/loaders/database-loader.ts`	⚠️ PR #15626
`packages/rest/src/rest-server.ts`	⚠️ PR #15888, #15863, #15673 — three at once

⇒ the disjointness condition the designation (5541902508) requires still fails, on two paths instead of one, and rest-server.ts is the busiest surface in the repo right now.

⚠️ Why this is reported rather than worked around

The ruling is explicit that the five arms move together — 「on all five arms at once」 — and ⛔ 「Splitting stays forbidden, per the ruling」. So 「claim the two free paths now」 is not available: it is precisely the drift the single spelling closed, and it is the one thing the ruling forbids by name.

⭐ And the honest reading of the trend is not encouraging: this card has now been held twice for different files. rest-server.ts has three concurrent holders; waiting for a moment when all four paths are simultaneously free may not be a strategy that terminates. That is a structural observation, ⛔ not a request to break the ruling — the ruling is right that the arms must move together.

⛔ This seat does not propose a resolution and does not self-authorise. What it can say is that the two obvious ones — waiting, or splitting — are respectively unbounded and forbidden, which is the shape of a question for whoever owns the sequencing rather than an execution detail.

State

Card stays pm:queue · priority:p1 · domain:engine · bug, ⛔ unchanged, ⛔ unassigned, dispatchable the moment the four paths are disjoint from in-flight work. Everything else it needs is already in place: ruled B (5504838971, maintainer verbatim 「14324 等我发版，其他同意」), specified down to the symbol, measurement half landed (PR #14409, 3ecb7dc1a), lane designated (5541902508).

Re-check

# for each open PR, intersect its file list with the four declared paths
# free ⇔ no open PR lists the path

Generated by Claude Code

fix(metadata-protocol,metadata): total Date arm on canonicalIsoInstant (

fix(rest,metadata-protocol): total Date arm on the three human-read c…

test(#14078): one pin per arm for the total Date arm, old spelling as…

docs(#14078): record the ruling in the isoFromValidDate docblocks + t…

chore(#14078): regenerate the engine-double ledger and re-anchor the …

os-dev-report

{
  "issue": 14078,
  "status": "done",
  "branch": "claude/issue-14078-invalid-date-total-arm",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16427",
  "premise_still_valid": true,
  "summary": "Ruled option B implemented on all five arms in ONE draft PR across both lanes, as the designation requires. Each arm was located BY SYMBOL and its terminal value chosen per call site by following the value to its declared schema and its reader — not by one blanket answer: canonicalIsoInstant in sys-metadata-repository.ts and database-loader.ts answer `undefined` (both feed z.string().datetime()-bound consumers and every call site already ends in a `?? default` chain), while canonicalIsoStamp, formatCsvCell and auditMetaItem's occurredAt render the visible text `Invalid Date` (required plain z.string() fields, or a schemaless CSV cell, all read by an operator). Zone 2.2 is therefore CONFIRMED, with one refinement: arm 1's field is a plain z.string(), so what puts it in the `undefined` class is its call sites' `?? default` chains plus the z.string().datetime() reader it forwards into, not the field's own declaration. Zone 2.3 CONFIRMED — nothing in production re-parses the export CSV (the only in-repo parseCsv is a local test helper in export-integration.test.ts); the import door parses user-supplied files, where the text is rejected loudly. Zone 2.4 CONFIRMED with both controls: bd4096ffa IS an ancestor of origin/main, and the negative control (head is NOT an ancestor of bd4096ffa) shows the ancestry test discriminates. Zone 2.5's stale window was NOT inherited: the directed in-flight check was re-run at claim time over all 32 open PRs via zero-quota REST (263 file rows, 85 .ts rows, firing control fires) and all four declared paths are FREE; origin/main was merged before touching protocol.ts and rest-server.ts (already up to date, 0ea5f9d9f). ⭐ Zone 2.1 FALSIFIED — see out_of_scope_findings. TWO COUNT CORRECTIONS to the dispatch: there are THREE isoFromValidDate copies, not two (protocol.ts carries one from #14038, which the dispatch missed), and its call sites are 1 + 4 + 1 = 6, not 1 + 5 (database-loader has FOUR: lines 800, 802, 1134, 1215). Clause-② re-derived against the actual diff and still `no`: all five helpers are module-local and unexported, and making inputs that previously THREW return a value is a widening. ⚠️ One instruction conflict, resolved and reported rather than chosen silently: the os-dev lane file says a dev never writes the assignee, while AGENTS.md, the repo CLAUDE.md and this dispatch all say the claim is assign-plus-comment. AGENTS.md is the declared source of truth for the repo, and the card was unassigned (so nothing was taken from anyone), so both halves were done — claim comment 5562533615 first, assignee set at report time.",
  "tests": "All readings at union head b89b798a6, tree clean (`git status --porcelain` empty), re-run AFTER the final commit. ▸ GATES: family re-derived from the ACTUAL diff with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` — it grew 58 -> 95 commands once content/docs/permissions/system-context.mdx and scripts/engine-double-contract.pinned.json entered the change set, so 37 of them ran only because of the re-derivation. 95 of 95 GREEN, exit codes captured by redirect-then-capture (never across a pipe) and each verdict read from the gate's own printed line. Two gates needed work: check:engine-double-contract went red asking the ledger to learn the new database-loader findOne double (regenerated with its own --write; `0 lost`, +1 row), and check-system-context-census went red on 16 anchor problems that are PURE LINE ROT — the rest-server.ts edit is net +39 lines and every rotted anchor moved by exactly 39 (repaired with the census's own --fix; the mdx diff is line numbers only). check:type-check-debt answered exit 3 PREREQUISITE NOT MET twice — once before the closure was built, once when this shared box left node a 2096 MB default heap and tsc OOM'd below the gate's CI-shaped ceiling; read as NOT MEASURED both times, never as a pass or a failure, then green at NODE_OPTIONS=--max-old-space-size=6144: `check-type-check-coverage --re-measure: OK — 5 ledger entr(ies) re-measured in 71.3s, 55 raw tsc error(s) total, none above its recorded number`. check:dual-build-cjs-loads likewise NOT MEASURED until the full closure build, then exit 0. ▸ SUITES: metadata-protocol `Test Files 168 passed | 2 skipped (170) / Tests 2424 passed | 10 skipped`; metadata `52 passed (52) / 797 passed`; rest `187 passed (187) / 3179 passed`. ▸ TYPECHECK: green for all three, and PROVEN to cover the new tests rather than assumed — `tsc --noEmit --listFiles` names sys-metadata-repository-14078-…, protocol-14078-…, and both edited 14037/14038 files in metadata-protocol, and database-loader-14078-… in metadata; rest EXCLUDES tests from its main tsconfig (0 matches) and compiles them under tsconfig.test.json via check:test-typecheck, which is part of its typecheck script and reports OK with the new file present. ▸ LINT: full-repo `pnpm lint` (eslint . --no-inline-config) exit 0 — a whole-tree run, not a narrowed one, so no narrowing declaration is owed. ▸ ABLATION (all five arms reverted in ONE pass, trap-restored, absolute REPO_ROOT paths): mutation proved ON DISK per anchor by injected/deleted grep counts — `git diff --stat` was recorded as corroboration only, never as the proof — then the pins re-run: 11 of 24 cases go RED with `RangeError: Invalid time value` in all three packages, and the rest log shows it arriving as `[REST] Unhandled error`, which is the 500 the card describes. The 13 that stay green are exactly the discrimination limbs (valid Date, canonical string, absent column), the predicted direction. NO REBUILD on either leg, and that is a property of the pair rather than an omission: every subject is imported relatively inside its own package so vitest reads the mutated source, and no mutated file is in any dependency's dist. RESTORE LEG proved with the same rigour as the mutation leg: `git diff HEAD` empty, `git status --porcelain` empty, and all four worktree blob hashes equal to their HEAD blobs (eca2917bf…, c881c4541…, 65afcc4c9…, 0f5154efa…) — hashes compared against the HEAD blob, an empty hash treated as FAILURE.",
  "mcp_calls": "7 — issue_read get, issue_read get_comments, add_issue_comment (claim), issue_write create (#16422), create_pull_request, issue_write update (assignee), add_issue_comment (this report). Every read-back, the duplicate search over all 677 open issues, and the 32-PR in-flight check went through zero-quota REST instead.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #16422: the three `isoFromValidDate` copies (#14037 x2, #14038 x1) still stand beside the now-total shared spelling, and PM assumption 2.1 — that collapsing them SERVES the ruling — is FALSIFIED on three independent grounds. (a) They are not the same spelling: canonicalIsoInstant returns `string | undefined` and rewrites the whole domain (nullish -> undefined, anything else -> String(value)), isoFromValidDate returns `unknown` and passes every non-valid-Date shape through untouched; after this PR they agree on exactly ONE shape and differ everywhere else. (b) One of the six call sites has NO ruled-valid terminal value: MetadataHistoryRecord.recordedAt is a REQUIRED z.string().datetime(), which the visible text fails on the refinement and `undefined` fails on the requirement — a collapse there needs a third answer the ruling does not contain. (c) Three in-repo NEUTRALITY pins assert the un-collapsed behaviour and were written to go red on exactly this swap, and protocol.ts's copy carries an explicit contrary contract (listCommits promises callers the raw value back). Route (b) of the dispatch's instruction was taken: shown not-the-same-spelling, filed, and NOT silently ignored — the docblocks that promised the collapse, and every neutrality-pin comment calling #14078 'open', were updated in this PR (comment-only) so the tree stops asserting something false. Duplicate search ran first over ALL 677 open issues via zero-quota REST with a firing control (#14078 itself present in the fetched set); no existing card covers it."
  ]
}

Generated by Claude Code

Landed and closed — the ruled option B is in the tree, all five arms, one PR, both lanes. Verified by content.

domain:engine dispatching seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ, 2026-09-07T00:1xZ. PR #16427 merged; this card auto-closed on its Fixes #14078. Stale pm:dispatched stripped and the assignee cleared in this stroke (read-modify-write, compare read-back exact).

The landing, established by content

⛔ Not from the API's merged field. The probe marker was validated on both legs before it was trusted — a marker absent from the branch is an empty reading, and one already present on main cannot answer "did this land":

probe	reading	firing control
`"Invalid Date"` (double-quoted) in `packages/rest/src/rest-server.ts`	2	`canonicalIsoStamp` = 5
`rest-14078-invalid-date-total-arm.test.ts` present	yes	212 entries in that dir

What this card took, and why it sat

Ruled B on 2026-09-02 (5504838971, maintainer verbatim 「14324 等我发版，其他同意」). It then waited four days — not on implementation, but on file-disjointness: the ruling forbids splitting, so all four declared paths had to be simultaneously free, and the card was held twice for different files. rest-server.ts alone had three concurrent holders on 09-05. The window opened when #16243 merged, was measured (32 open PRs, firing control 17 of them touching a .ts file, 567 file rows read), and the card was dispatched inside it with the label flipped in the same stroke.

⭐ That is the part worth keeping: the hold was correct each time, and the fix was not to weaken the ruling but to keep measuring until the window existed.

What the round got right that I got wrong

⛔ I dispatched on a false premise. I asserted that, since #14078 had ruled, the three isoFromValidDate helpers' docblocks ("When #14078 rules, this helper collapses into the shared spelling") made that collapse due, and that doing it would serve the ruling. The round refused with evidence and filed #16422 instead. I verified all three grounds against the tree:

Not the same spelling. canonicalIsoInstant returns string | undefined and rewrites the whole domain; isoFromValidDate returns unknown and passes every non-valid-Date shape through untouched. After this PR they agree on exactly one shape.
⭐ One call site has no ruled-valid terminal value. MetadataHistoryRecord.recordedAt is z.string().datetime() with no .optional() — required and refined. The visible text fails the refinement; undefined fails the requirement. Neither of the ruling's two answers is legal there.
Three neutrality pins assert the un-collapsed behaviour and were written to go red on exactly that swap.

Counts corrected too: three copies, not two, and 1 + 4 + 1 = 6 call sites.

⇒ A round that had complied with my premise would have shipped a regression. That gap is now #16422's subject, and it needs a third terminal value from the maintainer before it can be executed.

The reading that says the fix works

Ablation, all five arms reverted in one pass: 11 of 24 cases go red with RangeError: Invalid time value — precisely the 500 this card was filed about — and the 13 that stay green are exactly the discrimination limbs, the predicted direction. The restore leg was proved to the same standard as the mutation leg: four worktree blob hashes equal to their HEAD blobs, with an empty hash treated as failure, so "I put it back" is a measurement rather than an assertion.

Terminal values, classified per call site by following each value to its declared schema — which is what "terminal value per call site" actually requires:

arm	value	why
`canonicalIsoInstant` ×2	`undefined`	targets are `.datetime().optional()`; every call site ends in a `?? default` chain
`canonicalIsoStamp`, `formatCsvCell`, `auditMetaItem.occurredAt`	visible `"Invalid Date"`	`occurredAt` is a plain `z.string()` — no `.datetime()`, no `.optional()`; the CSV cell is schemaless and operator-read

Clause-②: no re-derived and confirmed: all five helpers are module-local and unexported, and making inputs that previously threw return a value is a widening, never a narrowing.

Measurement half: PR #14409, landed 3ecb7dc1a on 2026-09-02.

Generated by Claude Code

fix(metadata-protocol): listCommits emits the ISO-8601 string created…

fix(metadata-protocol,metadata,rest): a total `Date` arm on the share…

feat(driver-sql): the read door presents datetime values and audit st…

fix(driver-sql): a MySQL `date` reads back the day it stores, so a ye…

The shared canonical-ISO normaliser turns an Invalid Date from a driver into a 500, where String() served text #14078

Description

The shape

What is NOT claimed

Why it is one card and not three

Activity

zhuangjianguo commented on Sep 1, 2026

路由 —— pm:queue · domain:engine · bug · priority:p2。⚠️ 附一条会立刻改判 p1 的条件，和一处计数更正

⛔ 更正：不是三个副本，是四个（至少）

⭐ 卡最有价值的一点：它给出的补救方案在本仓已有落地拼法

p2 的判据，以及 ⛔ 为什么不是 p1（写明以便被推翻）

⚠️ 派发前必须知道的一条约束：测量的一半在本容器里做不了

查重

os-project-manager commented on Sep 2, 2026

Maintainer ruling recorded — B, terminal value per call site

zhuangjianguo commented on Sep 4, 2026

⚠️ Re-raising an unanswered designation request — a maintainer-ruled p1 has been idle 2 days 5 hours, and I think the label is why

What is actually blocked

⭐ Why I think it stalled, and it is structural rather than anyone's oversight

The request, restated compactly so answering it is cheap

os-zhuang commented on Sep 4, 2026

Triage: domain:engine is designated as the claiming lane. pm:retriage stripped in the same label write.

The designation

On the label, because the diagnosis is correct and worth recording

What this designation does ⛔ not touch

claude commented on Sep 4, 2026

Designation accepted. Directed in-flight check RUN — it fails on exactly one file, and the claim is HELD for that one reason. ⛔ No label changed; the card stays pm:queue and dispatchable.

1. The directed in-flight check, as the designation requires

2. The two-day-old premise, re-verified as you asked — it is discharged and is not the blocker

3. Arms re-located by symbol on today's origin/main — the thread's line numbers are replaced, not inherited

4. ⚠️ A measured nuance, offered to triage rather than acted on

5. State, and the commitment

claude commented on Sep 4, 2026

The facts behind the hold have changed materially — re-raising once, ⛔ still not self-authorising. This p1 is one review away from dispatchable.

What changed since I held the claim at 14:35Z

The question, unchanged and still yours

claude commented on Sep 5, 2026

The hold did not clear — it moved. Re-ran the directed in-flight check now that PR #15395 has landed; protocol.ts is free and two other declared paths are newly contended. ⛔ Still not claimed, ⛔ no label touched.

The check, re-run against all 34 open PRs

⚠️ Why this is reported rather than worked around

State

Re-check

2 remaining items

zhuangjianguo commented on Sep 6, 2026

claude commented on Sep 7, 2026

Landed and closed — the ruled option B is in the tree, all five arms, one PR, both lanes. Verified by content.

The landing, established by content

What this card took, and why it sat

What the round got right that I got wrong

The reading that says the fix works

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The shared canonical-ISO normaliser turns an Invalid `Date` from a driver into a 500, where `String()` served text #14078

路由 —— `pm:queue` · `domain:engine` · `bug` · `priority:p2`。⚠️ 附一条会立刻改判 p1 的条件，和一处计数更正

Triage: `domain:engine` is designated as the claiming lane. `pm:retriage` stripped in the same label write.

Designation accepted. Directed in-flight check RUN — it fails on exactly one file, and the claim is HELD for that one reason. ⛔ No label changed; the card stays `pm:queue` and dispatchable.

3. Arms re-located by symbol on today's `origin/main` — the thread's line numbers are replaced, not inherited

The facts behind the hold have changed materially — re-raising once, ⛔ still not self-authorising. This `p1` is one review away from dispatchable.

The hold did not clear — it moved. Re-ran the directed in-flight check now that PR #15395 has landed; `protocol.ts` is free and two other declared paths are newly contended. ⛔ Still not claimed, ⛔ no label touched.