The shared canonical-ISO normaliser turns an Invalid `Date` from a driver into a 500, where `String()` served text

[zhuangjianguo]

Found while implementing #13994 (the import-job DTO's four timestamps). Not addressed there, and this card does not close it.

The shape

The repo now has one canonical spelling for "a driver handed me a timestamp column, the contract declares a string" — three landed copies, all with the same Date arm:

• packages/metadata-protocol/src/protocol.ts — auditMetaItem's occurredAt (the model form)
• packages/metadata-protocol/src/sys-metadata-repository.ts — canonicalIsoInstant (MetadataItem.authoredAt is declared z.string() but receives a JS Date on Postgres/MySQL — a silent declared-contract violation, because the schema is parsed only in its own test #13997 / Canonicalise driver-materialised timestamps at the metadata adapter boundaries #14040)
• packages/rest/src/rest-server.ts — canonicalIsoStamp (rest-server: the import-job DTO serves "Sun Aug 30 2026 … GMT+0800 (China Standard Time)" for four timestamp fields on Postgres/MySQL — String() over a Date #13994)

All three reach value.toISOString() for any value instanceof Date. For an Invalid Date — a Date object whose time value is NaN — that call raises RangeError: Invalid time value.

The spelling each of them replaced was String(value), which for the same input produces the string "Invalid Date".

So for that one input shape the repair trades a wrong-looking-but-served string for an uncaught exception at a serialisation seam — a 500 on a read path, rather than a visibly-wrong field the caller can see and report.

What is NOT claimed

Reachability is unmeasured. The measured input domain these normalisers were written against — enumerated in canonicalVersionInstant's docblock in protocol.ts — is Date (Postgres/MySQL/Mongo), canonical ISO text (SQLite and friends), epoch-ms number, and nullish. An Invalid Date is in none of them, which is exactly why no copy guards it and why #13994 deliberately did not invent a fourth variant to add a guard unilaterally.

The reason to look rather than close this on the enumeration alone: a driver constructs these Dates from stored bytes, and a legacy or zero-valued datetime is the classic way a driver produces new Date(NaN) rather than throwing at the driver. Whether any dialect and driver version in use actually does that here is the question — it wants a measurement against a real MySQL/Postgres with a legacy row, not a reading of the docblock.

Why it is one card and not three

The three copies are deliberately one spelling; a guard added to one and not the others re-opens the drift the single spelling closed. So the decision is about the shared spelling:

• A — leave it. The input shape is outside the measured domain; a throw at the seam is arguably better than serving "Invalid Date" to a client, because it is loud. Cost: the loudness lands as a 500 on a read endpoint, on a row the operator cannot see from the error.
• B — give the shared spelling a total Date arm, e.g. falling back to the previous rendering (or to '') when Number.isNaN(value.getTime()). There is in-repo precedent for exactly that guard on the same call: packages/rest/src/export-format.ts:291 and packages/rest/src/import-prepare.ts:115 both test Number.isNaN(value.getTime()) before using a Date. Cost: it re-admits a silent wrong value on a path that would otherwise fail loudly.

Either way it is a change to a spelling three packages now share, so it is a maintainer call rather than an implementer's — which is why this is filed rather than folded into #13994.

A useful first step either way is the measurement, not the fix: drive a legacy/zero datetime row through a real MySQL and a real Postgres and record what the driver materialises. If no driver produces an Invalid Date, A is settled on evidence instead of on the docblock.

Backlinks: #13994 (where this was found), #13997, #13973 (the census this family came from). None are addressed here.

Generated by Claude Code

[zhuangjianguo]

路由 —— pm:queue · domain:engine · bug · priority:p2。⚠️ 附一条会立刻改判 p1 的条件，和一处计数更正

domain:engine 车道 PM，session session_01F3jdziLbAPGeceVNmSox5L。本卡由 #13994 的席位在实现中测得后不带标签、不带指派交回分诊，⭐ 并且明确拒绝主张可达性 —— 那是正确的立卡纪律，本席原样保留。

⛔ 更正：不是三个副本，是四个（至少）

卡列了三处（protocol.ts 的 auditMetaItem、sys-metadata-repository.ts 的 canonicalIsoInstant、rest-server.ts 的 canonicalIsoStamp）。在 origin/main 上跑同一个表达式，落地的无守卫 value.toISOString() 是：

packages/metadata-protocol/src/sys-metadata-repository.ts:120 ← #13997
packages/metadata/src/loaders/database-loader.ts:63 ← #13997，卡漏了这一个
packages/rest/src/rest-server.ts:570 ← #13994
packages/metadata-protocol/src/protocol.ts:7748 ← auditMetaItem，模型形状
（另 protocol.ts:1515 是 canonicalVersionInstant 的 Date 臂，形状相邻，需一并核）

⇒ #13997 一张卡就落了两份 helper（两个不同的包），席位只数到了自己两个包里的那些。⭐ 这不削弱本卡，反而加强它：分母越大，「一个副本加守卫、其它不加就重开漂移」这条理由越硬 ⇒ 必须一次决定，⛔ 不能逐处修。

⭐ 卡最有价值的一点：它给出的补救方案在本仓已有落地拼法

packages/rest/src/export-format.ts:291 与 packages/rest/src/import-prepare.ts:115 都在使用 Date 前测 Number.isNaN(value.getTime())。

⇒ 选项 B 不需要发明任何东西，它是把本仓已有的守卫拼法接到共享规范化器上。⛔ 这不构成对 A 的裁决，但它把 B 的成本从「设计一个守卫」降到「复用一个已在用的守卫」，这是裁决时该知道的。

p2 的判据，以及 ⛔ 为什么不是 p1（写明以便被推翻）

p2：后果是一条已发布读端点上的 500，⛔ 且它替换掉的是一个可见错误（"Invalid Date" 文本）—— 用一个用户能看见并上报的坏字段，换成一个操作者从错误里看不出是哪一行的异常。
⛔ 不判 p1，唯一理由：可达性未测。 该输入形状不在这些规范化器被写作时实测的输入域内（canonicalVersionInstant 的文档块枚举：Date / 规范 ISO 文本 / epoch-ms number / nullish）。

⚠️ 会立刻改判 p1 的证据：任何一个方言 + 驱动版本被测出会把 legacy 或零值 datetime 物化成 new Date(NaN)。⇒ 接手者第一步就测这个，⛔ 不要凭文档块的枚举就把它关掉 —— 卡自己说得对：驱动是从存储字节构造这些 Date 的，而 legacy / 零值 datetime 正是驱动产出 new Date(NaN) 而非抛错的经典途径。

⚠️ 派发前必须知道的一条约束：测量的一半在本容器里做不了

卡推荐的第一步是「用真 MySQL 和真 Postgres 驱一条 legacy/零值 datetime 行」。#13998 的席位已实测：OS_TEST_POSTGRES_URL 与 OS_TEST_MYSQL_URL 均未设置，无实例可达 ⇒ ⛔ dev 席位在此环境下做不了那一半。

⇒ 可派发的那一半（⭐ 且它可能就足以定案）：

1. 读驱动源码，看零值 / legacy datetime 在各方言下如何被物化 —— 这条不需要服务器；
2. 补上上面的副本普查，把分母钉死（含 protocol.ts:1515 是否同形）；
3. 若测得某条代码路径确实能产出 new Date(NaN) ⇒ 停手报 fork，改判 p1，A/B 交维护者。

⛔ A 与 B 之间的选择本身仍是维护者的 —— 它改的是四个包共享的一个拼法。⇒ 本卡不是要 dev 去改那个拼法，是要 dev 把「该不该改」变成一个有证据的问题。

查重

席位做了定向查重返回零，并用同会话的正对照验证（一个对照查询返回了 #13994）⇒ ⭐ 那个零是读数，不是死通道。 分诊侧确认：#13973（普查父卡）· #13994 / #13997（两处出处）均非同题。⛔ 无重复。

---

Generated by Claude Code

[os-musk]

Claim: PM loop round R13 (domain:engine execution seat, wave 2, slot 4) — a MEASUREMENT-FIRST card: the deliverable is the reading the card asks for, ⛔ not a change to the shared spelling (A vs B stays the maintainer's).
Session: session_0112hMx9hjJ9BgB28X97DS68
Branch: claude/issue-14078-invalid-date-materialisation-measurement
Worktree: objectstack-issue-14078
Domain: domain:engine
File surface: packages/drivers/driver-sql/src/ — one measurement test beside sql-driver-13567-audit-stamp-materialisation.test.ts (or a case inside the live-dialect matrix) that drives a zero-valued / legacy datetime row through the real Postgres and MySQL legs the CI job Temporal Conformance (live PG + MySQL) provides, and records what each driver materialises · a census comment on this card. ⛔ The four shared-spelling copies (sys-metadata-repository.ts:120, database-loader.ts:63, rest-server.ts:570, protocol.ts canonicalVersionInstant / auditMetaItem) are read-only in this card. Stop on breach.
Container & model: M, mode:subagent, model: opus — --tier on the driver-sql test path: "no path-derived mandate"; deciding what a legacy datetime does in two dialect drivers is a judgment measurement ⇒ opus.
Clause-②: no — no contract, accept set or public surface moves; a test and a reading.
Serial constraints cleared: no open PR touches packages/drivers/driver-sql/src/* measurement files (open-PR list 03:18Z; no claude/issue-14078* branch); #13564 (queued) only reads sql-driver.ts; #13438 (queued, ruled option 2) is not in flight. The four copies re-verified on origin/main 1dcb995f: if (value instanceof Date) return value.toISOString(); at sys-metadata-repository.ts:120, database-loader.ts:63, rest-server.ts:570 (+ a sibling arm at :626), plus protocol.ts:1523 canonicalVersionInstant — the triage's "four, not three" correction holds and the dev completes the census. The NaN-guard precedent the card names is on the tree: export-format.ts:291, import-prepare.ts:115. Live PG/MySQL are NOT reachable from the dev container (OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL unset) — the measurement runs in CI's live-dialect job, which is why it ships as a test.

---

Generated by Claude Code

[os-musk]

Claim (dev seat): implementing the MEASUREMENT half of this card — ⛔ no change to the shared canonical-ISO spelling (A vs B stays the maintainer's).

Session: session_0112hMx9hjJ9BgB28X97DS68
Branch: claude/issue-14078-invalid-date-materialisation-measurement (pushed empty, then implemented)
Worktree: objectstack-issue-14078, base origin/main 1dcb995f

Deliverable per the triage's dispatchable half (comment 5488392045): (1) read the driver sources and record how a zero / legacy datetime is materialised per dialect; (2) complete the copies census and pin the denominator (including whether protocol.ts canonicalVersionInstant is the same shape); (3) ship the live-dialect measurement as a test gated exactly like its siblings so CI's Temporal Conformance (live PG + MySQL) job produces the reading — live PG/MySQL are unreachable from this container (OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL unset), so the local run is reported as NOT MEASURED. If the reading shows a real new Date(NaN) path I stop and report needs_decision with the p1 re-grade and the A/B four-axis analysis, ⛔ not a fix.

Assignee stays as the PM set it. The four copies are read-only in this card.

Generated by Claude Code

---

Generated by Claude Code

[os-musk]

Measurement complete — ⚠️ the p1 re-grade condition is MET, on both live dialects

Dev seat, session session_0112hMx9hjJ9BgB28X97DS68. Draft PR #14409 (measurement only — ⛔ the shared spelling is untouched). The triage set the condition explicitly:

⚠️ 会立刻改判 p1 的证据:任何一个方言 + 驱动版本被测出会把 legacy 或零值 datetime 物化成 new Date(NaN)。⇒ 接手者第一步就测这个

Two independent driver paths do exactly that, and one of them returns a constant literally named INVALID_DATE. So I am stopping at the fork as instructed, rather than writing a fix. Evidence first, then A vs B on the four axes.

1. The reading — measured, not inferred

The client libraries materialise datetimes in pure JavaScript, so the arithmetic that decides Date vs Invalid Date was reproduced and executed in-container. Versions as installed: pg@8.22.0 (via pg-types@2.2.0 / postgres-date@1.0.7), mysql2@3.23.1, knex@3.3.0. The live half — whether the server accepts such a value into a column — ships as the gated test in #14409 and is answered by the Temporal Conformance (live PG + MySQL) job; it is NOT MEASURED in the dev container (OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL unset, as the triage recorded).

dialect	stored value	materialised	shared spelling's Date arm	String(value), the spelling it replaced
MySQL	0000-00-00 00:00:00	Invalid Date (getTime() = NaN)	throws RangeError: Invalid time value	"Invalid Date"
Postgres	294276-01-01 00:00:00+00	Invalid Date (getTime() = NaN)	throws RangeError: Invalid time value	"Invalid Date"
Postgres	infinity	number (Infinity)	not reached	"Infinity" — served
Postgres	0001-01-01 00:00:00+00	Date, finite	serves ISO text	(n/a)
MySQL	1000-01-01 00:00:00.000	Date, finite	serves ISO text	(n/a)
SQLite	any	string	not reached — the string arm returns first	(n/a)

MySQL — two paths, both landing on new Date(NaN). In mysql2/lib/packets/packet.js, line 13 is const INVALID_DATE = new Date(NaN);. The binary-protocol reader Packet#readDateTime short-circuits if (y + m + d + H + M + S + ms === 0) return INVALID_DATE; — the library returns an Invalid Date by name, deliberately, for a zero datetime. The text-protocol path (the one knex's .query() takes) is Packet#parseDateTime(timezone) = new Date(str + timezone); under the timezone: 'Z' that SqlDriver.withUtcSession pins, a zero datetime composes new Date('0000-00-00 00:00:00Z') — measured to be an Invalid Date. A zero datetime is storable whenever strict / NO_ZERO_DATE is not in force: the classic legacy-import and shared-database shape. driver-sql sets neither dateStrings nor typeCast anywhere, so mysql2's default Date materialisation is what runs.

Postgres — a range gap, and it is not about zero dates at all. postgres-date builds every instant as new Date(Date.UTC(year, ...)); Date.UTC answers NaN outside ±8.64e15 ms and new Date(NaN) is an Invalid Date — no throw and no null anywhere on that path. Measured boundary: 275760-09-13 is exactly 8640000000000000, 275760-09-14 is NaN. Postgres' own documented timestamp / timestamptz ceiling is 294276-12-31 AD, so every year from 275760 to 294276 is a value the server stores and the client hands back as an Invalid Date. The low end is safe: 4713 BC and year 0001 both sit inside JS's range, measured.

One assumption falsified, in the safe direction. infinity / -infinity is not a candidate: postgres-date matches those tokens first and returns Number('Infinity') — a JS number. It never reaches the instanceof Date arm; it falls to the copies' terminal String(value) and is served as the text Infinity.

Why the read door hands it through unchanged. withPostgresCalendarDayAsText overrides the type parser for date / date[] only and says in as many words that the instant types are left alone; formatOutput's audit-column repair (repairNaiveUtcAuditTimestamp) sits inside if (this.isSqlite). So on both live dialects nothing between the client library and the shared spelling converts the value.

2. The census — denominator pinned, and one card claim corrected

Method: scan every instanceof Date arm in non-test source under packages/, classify by whether a NaN/finite guard is in scope, and separately by whether the arm reaches toISOString(). Stable at window sizes 6, 8 and 14. Positive control on the two guarded sites the card names — and it earned its keep: a first predicate that required toISOString() in-window failed the control, so the predicate was widened. Full table in #14409.

Population at 1dcb995f: 92 arms in 54 files; 11 unguarded and reaching toISOString().

• The card's shared-spelling family is 5 arms in 4 files — sys-metadata-repository.ts:120, database-loader.ts:63, rest-server.ts:570, rest-server.ts:626 (the formatCsvCell sibling arm), protocol.ts:8082 (auditMetaItem's occurredAt). The triage's "four, not three" correction holds.
• ⛔ canonicalVersionInstant (protocol.ts:1523) is NOT the same shape — the triage flagged it for checking, and the answer is no. It routes through ms = value.getTime() and then if (!Number.isFinite(ms) || Math.abs(ms) > MAX_TIME_VALUE) return null;, so an Invalid Date returns null rather than throwing. It is already total and is not part of the decision.
• Six further unguarded arms carry the same hazard in other families (record-title.ts:102, template-engine.ts:160, filter-normalizer.ts:1678, migrate-sys-notification-to-event.ts:219, memory-analytics.ts:1225, remote-transport.ts:3662). Reported as denominator; ⛔ not folded into this decision and not touched.
• ⭐ A third guard precedent, beyond the two the card names. service-storage/src/stranded-orphan-inventory.ts:211 is the same three-arm function shape as the four copies and already carries the guard, with a comment naming this exact hazard and this exact cost: "An Invalid Date IS instanceof Date, and toISOString() THROWS on it (RangeError) ... One unparseable stamp must not take down a read-only inventory of the whole sys_file table."

So the repo already contains three totalisations of this arm, and — importantly for the ruling — they do not agree on the terminal value: null (canonicalVersionInstant), '' (export-format.ts's caller), undefined (usableCreatedAt, which argues in its own docblock against String() because it would spell "Invalid Date" into an operator's report where a timestamp is read from).

3. The decision — A vs B, on the four axes

⛔ Not mine to make: it changes a spelling four packages share. Laid out for the ruling.

• A — leave it. The throw is loud.
• B — give the shared spelling a total Date arm, Number.isNaN(value.getTime()) guarded, as three in-repo siblings already do. Sub-decision if B: which terminal value, and it is probably per-call-site — undefined where the field is optional (each caller's ?? default chain already handles it), the visible "Invalid Date" text where the field is required and an operator reads it.

Long-term soundness for this project (weight ≥50%, and it leads). Each of the four copies states in its own docblock that it is not a tolerant fallback but a producer-boundary adapter converting "the one per-dialect materialisation the driver genuinely produces" into the declared string. That framing is what decides this: the measurement has just added a member to the input domain those docblocks enumerate. A producer-boundary function declared to return string, which throws on part of the input domain it actually receives, is a partial function at a totality boundary — that is the defect, and B is not tolerance, it is the function doing its declared job. Contract-first cuts the same way: there is no producer upstream to fix here, because the producer is a third-party client library materialising bytes that a foreign writer put on disk, and packages/spec has nothing to tighten. ⇒ B.

Real business need. Measured, not speculative. A zero datetime arrives from legacy imports, hand-run migrations, and other applications sharing a MySQL database — and the four copies sit on metadata and audit read paths (GET /api/v1/meta/:type/:name/audit, the metadata loaders, the import-job DTO, CSV export), which is to say the surfaces an operator reaches for precisely when something is wrong. A 500 on one bad row takes the whole listing down and names no row. The Postgres range gap is rarer but is reachable by any writer on the same database. ⇒ B, with the caveat that the frequency is unquantified — nobody has counted such rows in a real deployment.

Making AI-written code hard to get wrong. The axis that most complicates B, and the reason the sub-decision matters. "Declared = enforced" argues for failing loudly on data that violates the declaration. But the loudness A buys is not diagnostic: an uncaught RangeError at a serialisation seam names neither the row nor the column, so it does not teach anyone anything — whereas a visible "Invalid Date" in a timestamp field is a defect a human or an agent can see, report and trace. Conversely a silent '' or a dropped field is the shape that does hide the producer's bug. ⇒ B only with a terminal value that stays visible where the field is required; a blanket '' would make this axis favour A.

Startup scope discipline. Near-neutral. B is a few lines across four files reusing an existing in-repo spelling; it declares no new capability, adds no surface, and creates no new authorable key. A adds nothing at all. Neither is scope expansion, so this axis does not carry the ruling either way — a slight nod to A for "no change", nothing more.

Recommendation: B, led by long-term soundness — with the terminal value ruled per call site rather than uniformly, and (whichever way A/B goes) the priority re-graded to p1 on the measurement above, per the condition the triage wrote. If A is chosen, the measurement makes it a decision taken on evidence rather than on the docblock enumeration, which was the card's own stated goal.

⛔ Whichever way it lands, it must land on all five arms at once — a guard on one and not the others re-opens exactly the drift the single spelling closed.

Generated by Claude Code

---

Generated by Claude Code

[os-musk]

os-dev-report

{
 "issue": 14078,
 "status": "needs_decision",
 "branch": "claude/issue-14078-invalid-date-materialisation-measurement",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14409",
 "premise_still_valid": true,
 "summary": "MEASUREMENT-FIRST card, delivered as a measurement: the shared canonical-ISO spelling is untouched (A vs B stays the maintainer's). All three of the triage's dispatchable items are done, and item 3 is a STOP that fired. (1) Driver-source reading: the client libraries materialise datetimes in pure JS, so the deciding arithmetic was reproduced and executed in-container rather than inferred. TWO independent paths produce a real `new Date(NaN)` — mysql2 3.23.1 returns a module-level constant literally named INVALID_DATE for a zero DATETIME on the binary path, and composes `new Date('0000-00-00 00:00:00Z')` on the text path knex uses under the `timezone: 'Z'` that withUtcSession pins; and postgres-date 1.0.7 (pg 8.22.0) builds every instant as `new Date(Date.UTC(year, ...))`, which is NaN past 275760-09-13 while Postgres' own timestamp ceiling is 294276-12-31 AD — ~18,500 years the server stores and the client hands back as an Invalid Date. PM assumption 2.1 falsified in the safe direction: `infinity` leaves postgres-date as the NUMBER Infinity, never reaches the `instanceof Date` arm, and is served as the text 'Infinity'. PM assumption 2.2 confirmed in full, including that driver-sql sets neither dateStrings nor typeCast anywhere. PM assumption 2.4 confirmed: SQLite's read door hands back a string, so the Date arm is never entered. (2) Census re-derived mechanically with the card's two guard sites as a positive control — the control FAILED a first predicate and forced it to be widened, which is reported rather than hidden. 92 `instanceof Date` arms in 54 non-test source files; 11 unguarded and reaching toISOString(); the card's family is 5 arms in 4 files (the triage's 'four not three' holds, plus rest-server.ts:626). PM assumption 2.3 corrected: `canonicalVersionInstant` (protocol.ts:1523) is NOT the same shape — it is already total, returning null for an Invalid Date via Number.isFinite — so it is not one of the copies needing a decision. A THIRD in-repo guard precedent was found beyond the two the card names: stranded-orphan-inventory.ts:211, the same three-arm function shape, already guarded, with a comment naming this exact hazard. (3) The live half ships as one gated test file in the live-dialect family, a named skip without the URLs and a named RED under OS_EXPECT_LIVE_DIALECT_MATRIX=1, so the `Temporal Conformance (live PG + MySQL)` job produces the server-side reading. Reachability is now MEASURED rather than merely admitted by the type system, which is the triage's stated p1 re-grade condition — so this returns needs_decision with the four-axis A/B analysis, and NO fix.",
 "tests": "All commands run in worktree ../objectstack-issue-14078, branch point origin/main 1dcb995f; union re-run at HEAD `4f6f64254` (`git rev-parse --short HEAD`), which is the branch's final commit. Every exit code captured after redirecting to a file, never through a pipe; every verdict below quotes the gate's own printed line. GATE FAMILY: re-derived with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands`, no paths passed, after `git fetch origin main` — 27 families, identical on two derivations. The dispatch's hint named 26; the addition is `node scripts/check-system-context-census.mjs`. 26 of 27 GREEN (exit 0). The one exception is NOT MEASURED, not red: `node scripts/check-test-completeness.mjs` exits 3 printing `check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named`, and its own text says 'the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.' Two others started at the same prerequisite and were re-run after building the workspace closure (`pnpm exec turbo run build --concurrency=2 --filter='./packages/*' --filter='./packages/*/*'` — `Tasks: 70 successful, 70 total`): `pnpm check:dual-build-cjs-loads` then exit 0, and `pnpm check:type-check-debt` then exit 0 printing `check-type-check-coverage --re-measure: OK — 27 ledger entr(ies) re-measured in 224.6s, 1217 raw tsc error(s) total, none above its recorded number` plus `surplus: none`. PACKAGE TESTS: `pnpm --filter @objectstack/driver-sql test` (through scripts/pm/os-verify-lock.sh) — `Test Files 151 passed | 9 skipped (160)`, `Tests 2287 passed | 138 skipped (2425)`, lock VERDICT command-exit 0. NEW FILE ALONE: `Test Files 1 passed (1)`, `Tests 8 passed | 2 skipped (10)`; the 2 skips are the two live cells' named `is provisioned — set OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL` declarations, which is the designed shape — the live legs are NOT MEASURED locally and are answered by CI's `Temporal Conformance (live PG + MySQL)` job. TYPECHECK: `pnpm --filter @objectstack/driver-sql exec tsc --noEmit --listFiles` exit 0, 0 errors, and the new file confirmed PRESENT in the tsc program (1 hit in --listFiles; driver-sql's tsconfig is `include: [\"src/**/*\"]` with no test exclusion) — so the typecheck genuinely covers it, checked rather than assumed. LINT: `pnpm lint` — the FULL repo scan (`eslint . --no-inline-config`), exit 0, clean output. No narrowing claimed or needed. ABLATION: mutated the reproduced shared-spelling arm `return value.toISOString();` to `return previousSpelling(value);` (i.e. `String(value)`) — direction predicted and observed: §A1 turns RED, `Tests 1 failed | 7 passed | 2 skipped`. NO REBUILD WAS NEEDED and that is stated rather than skipped: the mutated subject is a function inside the test file itself and the driver is reached by a relative `./index.js` specifier that vitest resolves to `src/index.ts`, so no `dist/` sits between the mutation and the run; the workspace closure was nevertheless already built. MUTATION CONFIRMED ON DISK by anchored grep counts, not by an editor's exit code: anchor 1 -> 0, injected text 0 -> 1. RESTORE proven in both required ways: `git hash-object` of the file equals the HEAD blob (34d6c422ea712ce2cb94d3bffe1ae3699ba93557) AND `git diff HEAD` is empty; the script carried `trap restore EXIT INT TERM` with an absolute path derived from `git rev-parse --show-toplevel`, and restored with `git checkout HEAD -- ABSOLUTE_PATH`, never a bare `git checkout --`. DEVIATION, REPORTED: the FIRST ablation attempt exited 1 that was NOT a red test — vitest printed `No test files found, exiting with code 1` because the test path was passed repo-relative while vitest's cwd is the package. That reading was discarded as NOT MEASURED and the ablation was re-run with the package-relative path rather than reported as a red.",
 "mcp_calls": "9 — the whole run. Channel: the repo-scoped REST probe returned 403 (`GitHub access is not enabled for this session`) and `gh` is absent, so the seat's read path was git plus the zero-quota public-repo page payload (issue body and both comments read from `payload.preloadedQueries[0].result.data.repository.issue`), and MCP was reserved for writes plus the label read-back. Breakdown: 1 claim comment, 1 create_pull_request, 1 issue_read get_labels (failed — MCP refuses a PR number for that method), 1 pull_request_read get, 2 list_pull_requests (label read + compare read-back), 1 issue_write (label set), 1 findings comment, 1 report comment. No duplicate-search call was needed: this run filed no new issue.",
 "open_questions": [
 {
 "question": "The shared canonical-ISO spelling now has a MEASURED Invalid-`Date` input on both live dialects. Guard it or not? The five arms are `sys-metadata-repository.ts:120`, `database-loader.ts:63`, `rest-server.ts:570`, `rest-server.ts:626`, `protocol.ts:8082` — and whichever way it goes must land on all five at once, because a guard on one and not the others re-opens the drift the single spelling closed. (`canonicalVersionInstant` at `protocol.ts:1523` is NOT in this set: measured already total.)",
 "options": [
 "A — leave it. An Invalid `Date` reaches `toISOString()` and raises `RangeError: Invalid time value`; the throw is loud. Cost, now quantified: the loudness lands as a 500 on a metadata/audit READ path, on one row, and the error names neither the row nor the column — so the whole listing goes down and the operator learns nothing about which row did it.",
 "B — give the shared spelling a total `Date` arm guarded on `Number.isNaN(value.getTime())`, as THREE in-repo siblings already do (`export-format.ts:291`, `import-prepare.ts:115`, and the newly found `stranded-orphan-inventory.ts:211`, whose docblock names this exact hazard). Cost: it re-admits a wrong value on a path that would otherwise fail. Sub-decision, and it is real because the three precedents disagree: which terminal value — `null` / `''` / `undefined` / the visible `\"Invalid Date\"` text. Likely per call site rather than uniform: `undefined` where the field is optional and the caller already has a `?? default` chain, the visible text where the field is required and an operator reads it."
 ],
 "recommendation": "B, led by long-term soundness (the ≥50%-weight axis), with the terminal value ruled per call site rather than uniformly. LONG-TERM SOUNDNESS: each of the four copies states in its own docblock that it is NOT a tolerant fallback but a producer-boundary adapter turning 'the one per-dialect materialisation the driver genuinely produces' into the declared `string`. This measurement adds a member to the very input domain those docblocks enumerate, so a function declared to return `string` that throws on part of the domain it actually receives is a partial function at a totality boundary — B is not tolerance, it is the function doing its declared job. Contract-first does not point the other way here: there is no upstream producer to fix, because the producer is a third-party client library materialising bytes a foreign writer put on disk, and `packages/spec` has nothing to tighten. REAL BUSINESS NEED: measured, not speculative — a zero datetime arrives from legacy imports, hand-run migrations and other applications sharing a MySQL database, and these five arms sit on metadata/audit read paths, the surfaces an operator reaches for precisely when something is already wrong; caveat stated honestly, nobody has counted such rows in a real deployment, so the frequency is unquantified. AI-ERROR-PROOFING: the axis that most complicates B, and the reason the sub-decision matters — 'declared = enforced' argues for failing loudly, but A's loudness is not diagnostic (an uncaught RangeError at a serialisation seam names no row), whereas a visible `\"Invalid Date\"` in a timestamp field is a defect a human or an agent can see and trace; a silent `''` or a dropped field is the shape that DOES hide the bug, so this axis backs B only with a visible terminal value where the field is required and would back A against a blanket `''`. STARTUP SCOPE DISCIPLINE: near-neutral and does not carry the ruling — B is a few lines across four files reusing an existing in-repo spelling, declaring no capability and adding no surface; a slight nod to A for 'no change at all', nothing more. The other three axes together do not overturn the first. SEPARATELY AND INDEPENDENT OF A/B: re-grade to p1, per the condition the triage wrote — reachability is no longer unmeasured."
 }
 ],
 "out_of_scope_findings": [
 "NOT filed as issues, deliberately: the six further unguarded `instanceof Date` -> `toISOString()` arms outside the card's family (`packages/objectql/src/record-title.ts:102`, `packages/formula/src/template-engine.ts:160`, `packages/services/service-analytics/src/strategies/filter-normalizer.ts:1678`, `packages/metadata/src/migrations/migrate-sys-notification-to-event.ts:219`, `packages/drivers/driver-memory/src/memory-analytics.ts:1225`, `packages/drivers/driver-turso/src/remote-transport.ts:3662`) are the same hazard class in different families. They are reported on the card and in the PR as CENSUS DENOMINATOR rather than opened as separate cards, because #14078 is explicitly the decision about this arm and a sibling card would pre-empt the ruling it is waiting on. PM: if you want them tracked independently of the A/B outcome, they are a clean sub-issue of #14078 and I can file them — say the word rather than my filing speculatively.",
 "PM to note, and not a defect anyone should repair: the body of PR #14409 carries the signature footer TWICE — once written by me in session-URL form and once appended by the platform. Not repaired, because a PATCH to strip it would downgrade the session URL to the bare form for no gain and risks a sanitizer rewrite of a correct body."
 ]
}

Generated by Claude Code

---

Generated by Claude Code