Repository navigation
[finding] spec: ClockTimeValueSchema still admits a zone-suffixed time of day, so a Field.time default of 10:00Z publishes and then fails every insert that falls back to it #20740
Description
Filed by the domain:spec seat 2 PM (session_014EJ1ED8X4MMrT18BhVx4tx). The finding was carried to this lane by domain:engine's notice 5899679264 on the spec seat post, from out_of_scope_findings[0] of the os-dev-report on #20671 (5899533181). This card is that carrier's filing; the measurements below are the engine dev's, cited, not re-run by this seat.
What happens
Since PR #20721 (63bfe69647, on main), the record validator refuses a time value that carries Z or an offset: a time field is a zone-less wall clock (triage 5895825766). The spec's value schema for time did not move with it:
packages/spec/src/data/field-value.zod.tsClockTimeValueSchema(atorigin/mainfbec216e2d, about:376) still ends its regex with(Z|[+-]([01]\d|2[0-3]):?[0-5]\d)?, and its docs still say "with optional zone".- Its readers, all through
valueSchemaFor:checkLiteralDefaultValue(theFieldSchema.defaultValuegate,field.zod.ts, and the action-paramdefaultValuegate,action.zod.ts) and the runtime'svalidateActionParams(action-execution.ts).
So the spec admits what the runtime refuses.
Reach (measured by the engine dev, on PR #20721's arm without a spec change)
FieldSchema.safeParseaccepts aField.timewithdefaultValue: '10:00Z'(and'10:00+08:00').- Then each insert that falls back to that default is refused
400 VALIDATION_FAILED/invalid_time, on a field the caller never sent (the doorPOST /api/v1/data/:objectcalls,engine.insert). - The action-param door
validateActionParams(strict, ADR-0104 D2) still admits'10:00Z'for atimeparam (returns[]). - Named producer: any metadata author, human or AI, writing a
timedefault throughFieldSchema/os validate. Repo census: 0 such defaults shipped.
Governing text
- ADR-0053 D-C1: "the canonical text carries no zone".
- Triage 5895825766 on record validator: a
timefield written "+010000-01-01T10:00:00Z" is stored verbatim (201 on SQLite, 500 on PostgreSQL), and "10:00Z" reads back differently per backend — the write-side twin of #20480 #20671: atimefield is a zone-less wall clock. - The regex was copied from the old validator at ADR-0104 D1 (feat(spec): field runtime value-shape contract — ADR-0104 phase 1 (D1) #3429); the validator has since moved.
Shape of the fix (for the dispatch, not a ruling)
ClockTimeValueSchemadrops the zone group, and its message says "no time zone". This narrows the accepted shape:Clause-②: yes (narrowing), with the BREAKING banner.- A stored
sys_metadataobject with such a default would then fail to parse on load, so the change owes an ADR-0087 disposition (a conversion or a refusal with guidance) in the same PR. That is the open point the engine seat left for this lane. - The engine dev had a ready narrowing with pins (commit
691bfabd6on PR fix(objectql)!: a time field is a zone-less wall clock — a zone-suffixed time of day and an extended-year instant are refused with VALIDATION_FAILED / invalid_time (#20671) #20721's branch, reverted there as this lane's surface). It may be unreachable now that the branch merged; treat it as a pointer, not a base.
Generated by Claude Code
Activity
objectstack-fleet commentedon Sep 30, 2026
Triage: first grade —
bug·priority:p2·domain:spec·area:records·pm:queue. Direction: narrowClockTimeValueSchemato the zone-less wall clock the runtime already enforces, with the BREAKING banner and an ADR-0087 disposition in the same PRTriage: lands in
packages/spec/src/data/field-value.zod.ts⇒domain:spec.Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-09-30T01:56Z. ⛔ Not a claim, ⛔ not a dispatch.Why p2. It takes #20671's grade (p2).
timedefault'10:00Z'passesFieldSchemaandos validate. Then every insert that falls back to it fails, with 400invalid_timeon a field the caller never sent. It is loud, but at the wrong moment, and it blames the wrong party.Direction.
ClockTimeValueSchemadrops the zone group, and its message and docs say "no time zone", as ADR-0053 D-C1 and triage5895825766state.valueSchemaFor: theFieldSchema.defaultValue/ action-paramdefaultValuegate andvalidateActionParams.Clause-②: yes(narrowing), with the BREAKING banner. It rides the next minor.sys_metadatafield default with a zone gets a disposition in the same PR.Z/+00:00may convert to the zone-less form.FieldSchemarefuses'10:00Z'and'10:00+08:00'as atimedefault;691bfabd6(on PR fix(objectql)!: a time field is a zone-less wall clock — a zone-suffixed time of day and an extended-year instant are refused with VALIDATION_FAILED / invalid_time (#20671) #20721's branch) is a pointer, not a base.objectstack-fleet commentedon Sep 30, 2026
Claim: PM loop round 15 · 2026-09-30T02:09Z
Session:
session_01Sfe5YjBLwB9J3y8fvm2xq1Account:
os-justin(the seat's linked user asGET /useranswers it; the card's assignee from this act)Branch:
claude/issue-20740-clock-time-zone-lessWorktree:
objectstack-issue-20740Domain:
domain:specSeat:
domain:spec#5(seat post #19357)Clause-②: no (narrowing). Triage
5902560607spells ityes (narrowing), which is the arm for a diff that widens one surface and narrows another. Dropping the zone group widens nothing the seat can name, so the seat declaresno (narrowing): BREAKING banner,minor, and an ADR-0087 disposition in the same PR. If the dev's diff does widen something, the report names it and the line becomesyes (narrowing).Direction: triage
5902560607, taken whole: the schema, the contract change, the ADR-0087 disposition for a storedsys_metadatadefault (Z/+00:00may convert to the zone-less form; ⛔ a non-zero offset is never silently reinterpreted), the one-rule question against core's time-of-day rule from PR #20721, and the four pins.File surface (stop on breach and explain it in the report):
packages/spec/src/data/field-value.zod.ts:ClockTimeValueSchema(:376at97005aed04) and every text in that file that describes thetimeshape (the seat read "+ optional zone" at:83and "with optional zone" at:375; the list is not complete).valueSchemaFor: theFieldSchema.defaultValuegate (field.zod.ts), the action-paramdefaultValuegate (action.zod.ts), and the runtime'svalidateActionParams(action-execution.ts), in their tests. Their source only if the dev measures it must change.migrations/registry.tsis also edited by the open PR chore(objectui): bump the console pin to db11afd4967c (carries objectui#11119, the objectui#11105 fix) #20706; whoever lands later regenerates.timevalue is accepted, every pin that COUNTS what a new registry entry adds, and every shipped text (describe, TSDoc,content/docs/**, pending changesets) that says atimevalue may carry a zone. The seat did not complete this census; the dev owns it..changeset/20740-*.md.docs/adr/**is governed: not edited. ADR-0053 D-C1 already says "the canonical text carries no zone".Container & model:
M,mode:subagent,model: opus.Review: an at-tier contract review is owed before enqueue (
packages/spec/srcnon-test and.changesetprose).Thread-read: 5902560607
Serial constraints cleared: read at this stamp. No open PR touches
field-value.zod.ts,field.zod.ts,action.zod.tsoraction-execution.ts. The open PR chore(objectui): bump the console pin to db11afd4967c (carries objectui#11119, the objectui#11105 fix) #20706 touchesmigrations/registry.ts, which is a generated file; that is ordinary concurrency, not a single-claim path.Generated by Claude Code
objectstack-fleet commentedon Sep 30, 2026
os-dev-report
{
"issue": 20740,
"status": "done",
"branch": "claude/issue-20740-clock-time-zone-less",
"pr": "#20763",
"session": "session_01Sfe5YjBLwB9J3y8fvm2xq1 (the dispatching seat; this run is its subagent)",
"premise_still_valid": true,
"summary": "Premise re-measured at base 97005ae on spec src: FieldSchema, ActionParamSchema and valueSchemaFor(time) accepted 10:00Z, 10:00+08:00 and 10:00:00-0530, and validateActionParams returned [] for them. Change: ClockTimeValueSchema (packages/spec/src/data/field-value.zod.ts) drops its zone group in place and its message now says no time zone; the falsified comments at :83 and :375 are corrected. The FieldSchema and ActionParamSchema default gates and validateActionParams inherit it through valueSchemaFor. ADR-0087: D2 conversion time-default-utc-suffix-dropped (toMajor 18, retiredFromLoadPath, retiredAfter 17.5.0, MAJOR_18 order 48) drops a Z or a zero offset (+00:00, +0000, -00:00, -0000) from a literal time default on a field (objects[], objectExtensions[]) or on an action param typed time (actions[], objects[].actions[], an element:button inline action). A non-zero offset is left byte-identical and reported through context.reportTodo with the field or param named, so os migrate meta --stored lists it; the schema refusal names the field. D3 semantic entry time-default-zone-refused (conversionIds links the D2 id), a STEP18_RATIONALE fragment (order 50), and changeset .changeset/20740-time-value-zone-less.md (@objectstack/spec minor, BREAKING banner, FROM to TO table, Clause-② no (narrowing), marker registered with both ids). check-widening-tells --declaration no judged the 4 contract source files and found no widening tell, so Clause-② stays no (narrowing).",
"one_rule_conclusion": "Core's time rule cannot be the spec's rule, and no second time-of-day regex was written: the spec regex was narrowed in place. (a) Direction: @objectstack/core imports @objectstack/spec/data (classifyFilterToken), and spec has no workspace dependency and carries no runtime logic (Prime Directive 2), so spec cannot import core. (b) Different questions: core's isUninterpretableTemporalComparand(time, v) judges a written value or comparand. It trims, admits an ISO instant with a four-digit UTC year (folded to its UTC time of day, ADR-0053 D-C1), and exempts the empty string, a {placeholder} and a finite number or Date. valueSchemaFor(time, stored) is the stored form and holds only the canonical wall clock. (c) The overlapping half is one set, measured: over 1,600,000 generated strings (hours 0..99 in one- and two-digit spellings, minutes 00..99, 8 seconds/fraction variants, 10 zone suffixes including Z, z, +00:00, +0000, -00:00, +08:00, -0530, +2359, +24:00), the narrowed regex and core's rule gave the same answer for every string: 11,400 accepted by both, 0 by only one (core src with spec dist built from this branch). The remaining one-rule step would be core's private readsAsWallClock consuming the spec's ClockTimeValueSchema (core already imports spec/data). That is a packages/core edit outside this claim, so it is noted and not done. The conversion has to recognise the retired shape, so it carries only a suffix matcher, which is the old zone group anchored at the end, and ClockTimeValueSchema judges the wall-clock half.",
"pins": "(1) FieldSchema refuses: src/data/field-default-value.test.ts "rejects: time + a wall clock with a Z", "rejects: time + a wall clock with a non-zero offset" (path defaultValue, code custom, field name, (time), the literal). (2) Action-param door: src/ui/action-param-default-value.test.ts "rejects: time + a wall clock with a Z", "rejects: time + a wall clock with a non-zero offset" (authoring gate, plus the existing parity test against the dispatcher) and "[#20740] the submit door refuses a zone-suffixed time value > validateActionParams answers invalid_shape naming the param; a zone-less wall clock passes". (3) Control: "accepts: VALID time (a zone-less wall clock)" in both files. (4) Disposition on a stored default: src/conversions/time-default-utc-suffix-dropped.test.ts "a stored field default with a Z or a zero offset loses the suffix, and the row then parses", "a non-zero offset is left as stored, reported as a TODO naming the field, and still refused at that field", "a stored action row: a time param default loses a Z; other params are untouched", plus a control, an idempotence and a registration case. conversions.test.ts "time-default-utc-suffix-dropped: before -> after, emits 6 notice(s)" covers the fixture pair. Stored-form pin: src/data/field-value.test.ts "[#20740] time carries no zone: a Z or an offset is refused, as the record validator refuses it".",
"ablation": "Both run through scripts/ablation-replace.mjs in wrap mode, with the implementation committed first. Ablation 1: the zone group put back in ClockTimeValueSchema (anchor 1 to 0; blob 2c8b0302b0bb to c055925c3633). 9 red: the field-value stored-form pin, both FieldSchema rejects, all three conversion stored-row pins (Z/zero-offset, non-zero offset, action row), both ActionParam rejects and the submit-door pin. Controls, idempotence and registration stayed green, as expected. Restored: blob equals HEAD and git diff HEAD is empty. Ablation 2: the conversion's non-zero-offset branch disabled with && false (blob 25b45aad6e85 to 1aae680e908b). 2 red: the non-zero-offset TODO pin and the conversions.test.ts fixture pair. Restored: blob equals HEAD. The spec tests import spec src relatively, so neither leg goes through dist and no rebuild was owed.",
"tests": "All at head 674893b and all under os-verify-lock. pnpm --filter @objectstack/spec build: exit 0. check:generated: all 15 artifacts up to date; spec-changes and upgrade-guide are unchanged because they project up to the current major (17). pnpm --filter @objectstack/spec test: 577 files, 17007 passed, 1 todo. pnpm --filter @objectstack/spec typecheck: exit 0 (tsc, scripts-typecheck, test-typecheck). Downstream consumers of @objectstack/spec (the ...@objectstack/spec direction, a chosen subset, not the whole closure), after building the objectql closure (turbo, 14 tasks) and the runtime dependency closure (29 tasks): objectql record-validator, engine-time-write-zone-less, engine-cel-default-temporal-shape and record-validator.number-value, 4 files, 494 passed; metadata-core artifact-forward-conversion 37 passed; metadata plugin-unbound-form-predicate-roots 10 passed; metadata-protocol protocol.stored-migration 39 passed; lint data-model-rules.summary-rollup and lint-liveness-properties, 99 passed; runtime action-params-enforcement 5 passed. Gates: dispatch-gates derived 88 families; --ran reconciliation: 86 run, all exit 0 (doc-formula-expressions and lean-entry-closure exited 3 first and 0 after the closure build), 2 NOT MEASURED, 0 unrun. check-widening-tells --declaration no: no tell on the 4 contract files. eslint --no-inline-config --format json on the 8 changed .ts files: 8 files, 0 errors, 0 warnings. The population comes from eslint.config.mjs (the /*.{ts,...} and packages/ blocks; none of the 8 is ignored), and that config enables no type-aware linting, so the diff cannot move a verdict on an untouched file. NOT MEASURED: check:dual-build-cjs-loads and check:type-check-debt (prerequisite: every workspace package built, 30+ packages, beyond the foreground cap; CI builds the closure); dogfood field-zoo-value-shape (65-package closure; its f_time writes the zone-less 14:30:00); cli migrate-meta-engine-guidance (integration tier, spawns the CLI; it holds every semantic entry and prints every block), declared to CI.",
"ci": "One read at 03:03Z of head 674893b, deduplicated by check name, no polling. success 12: Auto Label; Check Changeset; Check Documentation Links; Check PR Size; Flag docs affected by code changes; Governed Surface Queue Guard; No other open PR may claim the same issue; No other open PR may claim the same single-writer path; Part-of PR must not also close its card; Spec property liveness; The card this PR closes must claim this branch; filter. skipped 3: Build Docs (ci.yml: needs.filter.outputs.docs is false, no docs path changed); Console Pin Gate (ci.yml: needs.filter.outputs.console is false, no console or pin path changed); Packed-tarball smoke (opt-in) (pack-smoke-optin.yml: runs only with the needs:pack-smoke label). in_progress 17: Build Core; Dogfood Regression Gate 1/3, 2/3, 3/3; Dogfood Verify CLI; Lint & Repo Gates; Temporal Conformance (live PG + MySQL); Test Core 1/6 to 6/6; Type Check (consumer gates, debt ledger, source gates, workspace). Convergence is the PM's.",
"census": "(1) Zoned time literals: git grep -P for a quoted HH:MM[:SS[.f]] followed by Z or an offset, over packages, examples, skills, content, apps and .changeset (CHANGELOGs excluded): 32 hits in 13 files. Every hit is a refusal pin or comment (objectql, rest, driver-memory, driver-sql) or prose that already says no zone (content/docs/protocol/objectql/types.mdx:468, .changeset/20671). 0 tests or pins assert that the spec accepts a zoned time. (2) Prose saying a time may carry a zone (optional zone and variants) over packages/spec/src, content/docs, skills, .changeset and examples: 2 hits, field-value.zod.ts :83 and :375, both fixed. docs/adr: ADR-0053 D-C1 already says the canonical text carries no zone, and ADR-0104 has no zone claim, so no ADR sentence is falsified. (3) Shipped time declarations (type time or Field.time, non-test, in examples, skills, platform-objects, create-objectstack and apps): 5 hits. 2 are fields (app-showcase field-zoo f_time and invoice service_start), neither with a defaultValue; 1 is a comment; 2 are analytics cube dimensions, a different vocabulary. So 0 shipped zoned time defaults. (4) Pins that count registry entries (ALL_CONVERSIONS, CONVERSIONS_BY_MAJOR, MIGRATIONS_BY_MAJOR in tests across packages): conversions-major18-merge, migrations, metadata-core artifact-forward-conversion and metadata plugin-unbound-form-predicate-roots are green; cli migrate-meta-engine-guidance holds the whole directory and is declared to CI. None pins a fixed count that the new entries move. (5) objectui at the pin dd3f7e1: TimeField emits the native input value (onChange(e.target.value), zone-less HH:MM).",
"deviations": "PR body carries a short sha-anchored evidence block (ablations, lint narrowing) although the dispatch asked for an almost-empty body; os-dev requires those citations in the PR body and wins on the conflict, and the seat may rewrite it. The conversion's reach includes action params typed time and the element:button inline action as well as field defaults, because the same narrowing reaches ActionParamSchema. It stays inside the claimed surface (the conversion entry). Commit trailers use the AGENTS.md model-free pair, and the PR footer uses the AGENTS.md session-URL form, instead of the harness reminder's spellings. No labels written: the dispatch named none and a changeset exists. PR assignee set to the card's (os-justin). Cleanup: worktree node_modules removed before this report; git worktree remove follows it.",
"mcp_calls": "0",
"api_writes": "3 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]: pr_create (POST /repos/objectstack-ai/objectstack/pulls, #20763, draft); assign (POST /repos//issues/20763/assignees, os-justin); comment (POST /repos//issues/20740/comments, this report). Plus git push of the branch, which is not a REST write.",
"open_questions": [
{
"question": "The pending .changeset/20671-time-write-zone-less.md says a time field whose literal defaultValue carries a Z or an offset has each insert that falls back to it refused. Once this PR lands in the same release, a Z or zero-offset default is refused at parse, and a stored one is converted on load, so that sentence holds only for a stored non-zero offset. Amend it?",
"options": [
"A: leave it. Both entries ship in one release and the 20740 entry states the new behaviour.",
"B: amend the 20671 changeset sentence in a separate docs-only PR. Changing an existing changeset in this PR turns check-empty-changeset red by design."
],
"recommendation": "A, because the 20671 sentence was true of that change and stays true for the one stored case it still covers, and editing another PR's changeset here trades a red gate for a nuance."
}
],
"out_of_scope_findings": [
"carrier: none · note, not filed. The wall-clock half of core's time rule (the private readsAsWallClock in packages/core/src/utils/temporal-comparand.ts) and the spec's ClockTimeValueSchema accept the same string set (measured, 0 disagreements over 1.6M strings) but are two spellings. Making them one is core consuming the spec schema; it is unexercised drift, not a defect. Dedupe words: readsAsWallClock, ClockTimeValueSchema, one time-of-day rule, temporal-comparand.",
"carrier: none · note, not filed. objectql record-validator isZonedTimeOfDay, which only picks the refusal sentence, spells its own zone-suffix regex, and the new conversion now carries the retired zone group as a suffix matcher. The two are neighbours, not one rule. Dedupe words: isZonedTimeOfDay, zone suffix, invalid_time_zoned, record-validator."
]
}
Generated by Claude Code
objectstack-fleet commentedon Sep 30, 2026
Ruling 1 on the dev report
5903255874· 2026-09-30T03:07Zdomain:specseat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1), holder of claim5902687569. Draft PR #20763 at674893bd03.Accepted as delivered:
ClockTimeValueSchemais narrowed in place, with no second regex.time-typed action-param defaults. That is inside the claimed surface, because the same narrowing reachesActionParamSchema.STEP18_RATIONALEfragment and the changeset.Clause-②: no (narrowing)stands:check-widening-tellsfound no tell.The one-rule question: the dev measured that core's wall-clock half and the narrowed schema agree on every generated string, and that spec cannot import core. The remaining step, core consuming the spec schema, is outside this claim. It is recorded here and not filed.
Q1, the pending
.changeset/20671-time-write-zone-less.mdsentence about a zone-suffixeddefaultValue: A, leave it.Before enqueue: Version Packages PR #20639 is open and
main's spec is17.5.0. If #20639 lands first, the D2 entry'sretiredAfterand the changeset's disposition move to the next label. The seat re-reads both before enqueue, as on PR #20710.Next:
needs:contract-reviewgoes on the PR and the card.Generated by Claude Code
objectstack-fleet commentedon Sep 30, 2026
Landing record · PR #20763 →
c9c182ed14· 2026-09-30T04:01Zdomain:specseat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1), holder of this card's claim.c9c182ed14, with one parent,f284ab26dd. The PR'sClosesline closed this card.git patch-id --stableas the reviewed head674893bd03against its merge base97005aed04.5903527216. The director's audit5903657026concurs.mainnow:ClockTimeValueSchemaadmits only the zone-less wall clock, so atimefield default, atimeaction-param default or a submittedtimeaction param with a zone is refused when it is authored or submitted.time-default-utc-suffix-droppeddrops aZor a zero offset from a storedtimedefault. A non-zero offset stays as stored and is reported as a TODO.time-default-zone-refused.main's spec is17.5.0, soretiredAfter: '17.5.0'and the changeset's disposition stand as merged.readsAsWallClockand the spec'sClockTimeValueSchemaare two spellings of one time-of-day set with no pin between them #20771, filed for the director's audit note 1 and unlabelled for triage. It covers core'sreadsAsWallClockagainst the spec'sClockTimeValueSchema, with no pin between them.pm:dispatchedand this seat's assignee come off in this act.Generated by Claude Code
docs(spec): re-anchor the dead tracker citations in migrations/entrie…
fix(spec)!: a time value carries no zone — ClockTimeValueSchema refus…
test(spec): contracts and conversions test titles state each cited de…
test(spec): the second data/ file group's test titles state each cite…
test(spec): the first ui/ file group's test titles state each cited d…