fix(rest)!: /import reads a date, datetime or time cell only in ISO 8601, the export shape or a year-first date, on a real day, with a four-digit year (#20534)

[objectstack-fleet]

Fixes #20534
Clause-②: no

What changes

parseDateCell in packages/rest/src/import-coerce.ts is the reader behind POST /api/v1/data/:object/import for date, datetime and time cells. It had four faults:

• it rolled an impossible day into the next month;
• it passed every cell it could not read itself to new Date(s), which reads the cell in the server process's zone and reads 07/08/2026 month-first;
• it spelled a date year below 1000 without padding;
• it read a bare day into a datetime through Date.UTC(y, …), which puts years 0..99 in the 1900s.

This PR carries out triage's answer A (5883900872). The maintainer ruling on the card (5885066497) supersedes A on one point: year-first dates stay admitted.

The set that is read. After trimming, a text cell is read only in these shapes:

• ISO 8601 and the export shape:
  • YYYY-MM-DD;
  • YYYY-MM-DDTHH:MM[:SS[.f]], then Z, ±HH:MM, ±HHMM or nothing;
  • YYYY-MM-DD HH:MM[:SS[.f]] with no zone, the export shape. xlsx date cells reach the reader in this shape.
  • These are the spellings the write door admits for a datetime string since record validator: the temporal write arms trust Date.parse — date 2026-02-30 is stored verbatim (500 on PostgreSQL), datetime 2026-02-30T10:00:00Z rolls over to March 2, and a non-ISO datetime is read in the host zone #20525.
• A year-first date, per the ruling:
  • YYYY/M/D or YYYY-M-D: a four-digit year, a one- or two-digit month and day, and the same separator in both places;
  • optionally followed by one space and H:MM or H:MM:SS, with a one- or two-digit hour;
  • no zone, no fraction and no T in this form. It is one closed grammar, YEAR_FIRST_CELL, beside ISO_TEMPORAL_CELL.
• For a time cell, also a bare HH:MM[:SS].

The rules every admitted cell keeps:

• Real day. The day must exist (namesRealCalendarDay, arithmetic, never a Date round trip). 2026-02-30 and 2026/2/30 are refused and never rolled over.
• Clock range. On a zone-naive clock the hour runs 0..23 and the minute and second 00..59, so 24:00 is refused. T24:00Z names its instant and reads as before.
• Refusals. Everything else is refused per row as invalid_date, with the existing import_invalid_date / import_invalid_datetime / import_invalid_time sentences. There is no new error code and no date-format option. Nothing is read in the host zone, and no field order is guessed: 07/15/2026, 15/07/2026 and 26/7/15 stay refused.
• Four-digit year on every date branch.
  • A text cell keeps the four digits it was written with, and a year-first day is stored padded (2026/7/15 → 2026-07-15, 0500/1/1 → 0500-01-01).
  • An instant (a Date, or a zone-bearing cell) takes core's temporalStorageForm date rule, imported from @objectstack/core.
• Bare day into a datetime. It is spelled from the day itself (…T00:00:00.000Z), for ISO and year-first alike, so 0001-01-01 is stored in year 1, not 1901.
• Year-first clocks. A clock is a wall clock read exactly as the export shape's is: through core's zonedWallClockToUtcMs in the business zone for a datetime, verbatim for a time or a date.
• Unchanged. A zone-naive ISO or export-shape cell is still read in the business timezone (Bulk import reads a naive datetime cell in the process-local timezone, so an export/edit/re-import round trip shifts the instant #8485), and an offset-bearing cell is still honoured as written.

One source file changes: parseDateCell, its docblock, and the private helpers beside it: ISO_TEMPORAL_CELL, YEAR_FIRST_CELL, namesRealCalendarDay, readIsoTemporalCell, readYearFirstCell and utcClock. NAIVE_DATE_TIME and parseNaiveWallClock are replaced.

PM hypotheses, measured

H0 holds

Measured through the real /import route, JSON rows, no business timezone. The runs used InMemoryDriver and SqlDriver (better-sqlite3) under TZ=America/New_York and TZ=Asia/Shanghai, at base f11b5f20a2; the reader is byte-identical on today's main (3a89d459af). Memory and SQLite gave the same answer on every cell, at base and at head.

cell	kind	base, New York	base, Shanghai	head, both zones, both drivers
2026-02-30	datetime	2026-03-02T00:00:00.000Z	same	refused invalid_date
2026-02-30 10:00	datetime	2026-03-02T10:00:00.000Z	same	refused
2026-02-30T10:00:00Z	datetime	2026-03-02T10:00:00.000Z	same	refused
2026-02-30T10:00:00Z	date	2026-03-02	same	refused
07/15/2026 10:00	datetime	2026-07-15T14:00:00.000Z	2026-07-15T02:00:00.000Z	refused
07/08/2026	datetime	2026-07-08T04:00:00.000Z	2026-07-07T16:00:00.000Z	refused
07/15/2026, 15 July 2026	date	2026-07-15	2026-07-14	refused
07/15/2026 10:00	time	14:00:00	02:00:00	refused
2026-07-15 24:00	datetime	2026-07-16T04:00:00.000Z	2026-07-15T16:00:00.000Z	refused
0500-01-01, 0001-01-01, 0999-12-31	date	refused (500-01-01 reached the write door)	same	stored 0500-01-01, 0001-01-01, 0999-12-31
2026/7/15, 2026/07/15, 2026-7-15	date	2026-07-15	same	2026-07-15 (unchanged)
2026/7/15 9:00	datetime	2026-07-15T09:00:00.000Z	same	unchanged, and equal to what 2026-07-15 09:00:00 stores
2026/2/30	date	refused by the write door (2026-02-30 reached it)	same	refused by the reader
2026-07-15, 2026-07-15T10:00:00Z, 2026-07-15 10:00:00, 2026-07-15T10:00:00+08:00	both	unchanged	unchanged	unchanged

The write door takes 0500-01-01: POST /api/v1/data/:object answers 201 and stores it as written. The import now stores the same value, and a pin asserts they agree.

H1 holds: the census, main against head

The census called parseDateCell directly. The old reader is main's import-coerce.ts at 3a89d459af, byte-identical to the base. The new reader is this head's src. It covered 111 shapes, the 3 kinds, 2 host zones and 2 business-zone settings (none, and Asia/Shanghai), 666 rows. That is the first round's 98 shapes (588 rows) plus 13 year-first edges.

	all 666 rows	the original 588 rows
refused → admitted	0	0
admitted → refused	240	198
admitted, value changed	42	36
rows whose answer differs by host zone: main → head	114 → 0	100 → 0

• Admitted → refused. Each is one of these: an impossible day, a locale or prose spelling, a reduced or expanded form, a zone after a space, lower-case t/z, a zone-naive 24:00, a number, or a year-first date outside its one form.
  • The year-first forms main admitted that are now refused, each by the ruling:
    • 2026/2/30 (impossible day);
    • 2026/7-15 (mixed separator);
    • 2026/7/15 24:00;
    • 2026/7/15T9:00 (T);
    • 2026/7/15 9:00Z (zone);
    • 2026/7/15 9:00:00.5 and 2026/07/15 10:00:00.123 (fraction).
• Value changes, 42.
  • 30 are the four-digit year on a date (500-01-01 → 0500-01-01, including 0500/1/1 and a Date of year 500), or the 1900s fix for a bare day into a datetime (0050-01-01 was 1950-01-01T00:00:00.000Z).
  • 12 are one named exception: a year-first date with no clock, given to a time field. The cells are 2026/7/15, 2026/07/15, 2026-7-15, 2026-07-5, 2028/2/29 and 0500/1/1, under both business-zone settings.
    • main read these through new Date(s) in the host zone: 04:00:00 in New York, 16:00:00 in Shanghai, and 04:56:02 / 15:54:17 for year 500. No host-independent reading can equal a value that differs by host.
    • Head reads them as a bare ISO day into a time field is read on main and on head alike: 00:00:00.
• Year-first forms main admits. Every one stores the same value at head, apart from the padding, the real-day refusals, the ruled refusals above and the time exception.

H2: the year pad, and where each rule comes from

• Year pad: imported. Instant-derived date branches call @objectstack/core's temporalStorageForm(…, 'date'). ISO text branches never turn the year into a number; the grammar requires four digits and the cell's own digits are kept. The year-first branch pads month and day and keeps the four-digit year.
• Calendar check: mirrored. The write door's namesRealCalendarDay is private to record-validator.ts, and packages/objectql is read-only for this claim. It is copied here, word for word in its arithmetic, as one private helper that both readers share.

H3 holds, in the direction expected, in both rounds

Round 1: removing the refusals. The ablation restored the new Date(s) fallback for every cell the reader refuses, at head 9b31e7bc76.

• The mutation landed: anchor 1 → 0, blob 5d87c0ac825f → f4cfe0c42335.
• Result: 64 failed | 171 passed (235).
• Red: exactly the refusal assertions. Green: every control.
• Restored: blob equals HEAD, and git diff HEAD is empty.

Round 2: removing the year-first branch. The anchor readIsoTemporalCell(s) ?? readYearFirstCell(s); became readIsoTemporalCell(s);, via scripts/ablation-replace.mjs in wrap mode at head 279ca425fa.

• The mutation landed. Anchor 1 → 0, and blob 4d5fb1969259 → d8a032952d0a.
• Result. Tests 22 failed | 237 passed (259).
• Red: exactly the year-first admissions, 22 tests.
  • The unit table's 11 year-first rows.
  • The 5 restored fixtures and assertions:
    • the 2026/6/3 line;
    • the coerceRow fixture;
    • the business-timezone 2026/08/01 06:00:00 line;
    • the integration CSV cell;
    • the integration xlsx text cell.
  • The route file's 2 year-first admission pins and its same-instant pin, under each host zone.
• Green: every refusal and every other control.
  • All 42 unit refusals, including the 10 year-first edges.
  • The route file's 2026/2/30 refusal pins.
• Restore proven. The blob after restore equals HEAD (4d5fb1969259), and git diff HEAD is empty.
• No build needed. The pins reach import-coerce.ts through relative imports, never a dist/.

Tests

• packages/rest/src/import-date-cell-iso-real-day.test.ts (new). It uses the real /import route over SqlDriver (better-sqlite3 :memory:), under TZ=America/New_York and TZ=Asia/Shanghai. The zone switch is asserted with Intl and with the July offset. There are 28 cases per zone:
  • each of 12 refused rows is refused as its own row's invalid_date, a sibling row is still written, and nothing is stored for the refused row. The rows are the card's 11 plus 2026/2/30.
  • 10 admitted cells store their value:
    • 0500-01-01, 0001-01-01, and a datetime 0001-01-01;
    • the 2026 ISO, offset and export-shape controls;
    • a date 2026/7/15 stored as 2026-07-15;
    • a datetime 2026/7/15 9:00.
  • a year-first 2026/7/15 9:00 stores the same instant as 2026-07-15 09:00:00;
  • an imported padded year agrees with what the create door stores;
  • a real export → import round trip through GET /export;
  • an xlsx date cell reads as before;
  • quoted CSV cells get the same verdicts;
  • the dry run predicts the refusals and persists nothing.
• packages/rest/src/import-coerce.test.ts. The [#20534] table has 42 refused and 36 admitted cases, each asserted equal under both host zones.
  • The year-first rows are admission rows.
  • The refused edges are 2026/2/30, 2026/7-15, 2026/7/15 24:00, 2026/7/15 9:60, 2026/7/15T9:00, 2026/7/15 9:00Z, 2026/7/15 9:00:00.5, 26/7/15 and 07/15/2026.
• Fixtures restored to main's spelling.
  • The coerceRow fixture due: '2026/07/01'.
  • The import-integration.test.ts CSV cell 2026/06/30 and xlsx text cell '2026/07/01'. The xlsx row now also asserts its stored due, 2026-07-01.
  • The assertions parseDateCell('2026/6/3', 'date') → 2026-06-03, and the business-timezone 2026/08/01 06:00:00 → CROSS_MONTH_UTC. import-business-timezone.test.ts is byte-identical to main again.
• Package tests. At 3b2e47349e, pnpm --filter @objectstack/rest test --maxWorkers=2 gave Test Files 227 passed (227) and Tests 4382 passed | 50 skipped (4432). test:repo gave 1 passed (1), 8 passed (8).
• Typecheck. pnpm --filter @objectstack/rest typecheck exits 0: tsc --noEmit, then check:test-typecheck: OK.
• Memory leg. It is measured on base and head, not pinned (see Acceptance notes). Year-first cells were added: 2026/7/15, 2026/7/15 9:00, 2026/2/30, 2026/7-15 and 2026-07-15 09:00:00. Memory and SQLite agree on all 46 cells under both zones, and 0 cells differ between zones.

Gates, at 3b2e47349e

• Merges. origin/main was merged twice this round: at 7a1faf1a5d, then at 3a89d459af (a version-packages commit and four others landed in between).
• Build. turbo run build over all of ./packages/* and ./packages/*/*: 71/71 tasks. The tree was clean afterwards.
• Derived gates. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 61 commands. All 61 ran with exit 0, after the last commit.
  • Reconciled with --ran: 61 derived, 61 run, 0 NOT-MEASURED, 0 UNRUN.
• Roster rows that could apply, all exit 0:
  • check-changeset-fixed;
  • check:authz-resolver, check:filter-alias-parity, check:error-status-conformance;
  • check:route-ledger-census, check:tenant-chokepoint;
  • check-published-list-mirrors, check:published-readme-exports;
  • check:select-shard-packages, check:select-gate-families.
  • check-single-claim-paths ran as a read with PR_NUMBER=20601: PR #20601 modifies none of the 1 declared at-most-one-writer path(s). It read the PR's file list from GitHub.
• Other gates, exit 0.
  • pnpm lint: the whole repository, no narrowing.
  • node scripts/check-issue-citations.mjs --base origin/main: 7 citations, all resolve.
• Changeset gates. check-adr-0087-registration names the changeset [BREAKING+clause-②-narrowing] not-required (no-migration-prescription). check-changeset-no-major reports no major. check-empty-changeset passes.

Declared narrowing — verification ran UNLOCKED. scripts/pm/os-verify-lock.sh
could not take the shared verify lock on this host: no usable flock. The shared
verify lock is declared Linux-only (flock is util-linux, and a stock macOS does
not ship it), so the command below was run directly, without the lock —
a declared narrowing, not a silent one. No serialization guarantee held for this
run, nor for any sibling agent in this container while it ran.

pnpm --workspace-concurrency=2 --filter '@objectstack/rest^...' build
pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2 --output-logs=errors-only
pnpm --filter @objectstack/rest test --maxWorkers=2
pnpm --filter @objectstack/rest test:repo --maxWorkers=2
pnpm --filter @objectstack/rest typecheck
pnpm --filter @objectstack/rest exec vitest run --project local --maxWorkers=2 (the touched test files; both ablations' wrapped runs; the base run)

(The entry point printed this wording once for each command above. It is pasted once here, with every command it covered.)

Changeset

.changeset/20534-import-date-cell-iso-real-day.md is @objectstack/rest minor, with a line-initial Clause-②: no (narrowing).

• BREAKING paragraph. Each refused shape gets a FROM spelling and an admitted TO spelling. The year-first edges are listed: a mixed separator, a T or a zone, a fraction, and 2026/7/15 24:00.
• Kept. A "Kept: year-first dates" paragraph says that 2026/7/15, Excel's default in zh-CN and ja-JP, stays admitted, now with the real-day check and stored padded. It also names the time exception.
• ADR-0087 disposition. not-required (no-migration-prescription).

The shape follows PR #20517. The exported coerceRow narrows with the door, and the changeset says so.

Acceptance notes

• The InMemoryDriver leg is measured, not pinned. This departs from triage's pin list, as PR fix(rest)!: /import reads a comma in a number cell only as a thousands group, refusing the rest (#20497) #20517 did.
  • @objectstack/driver-memory's test consumers are a ruled, ledgered set (pnpm check:driver-memory-census), so the census is not widened here.
  • The cell is judged by the import's own reader before any driver is reached, and memory and SQLite agree on every measured cell (H0, and the Tests section).
• Year-first dates stay admitted, by the maintainer ruling (5885066497). They are Excel's default in zh-CN and ja-JP. They now keep the rules every other admitted cell keeps, and they read the same as on main except for the ruled refusals and the time exception in the census.
• The time branch is covered too. Its fallback was the same new Date(s): 07/15/2026 10:00 into a time field was stored as 14:00:00 on a New York host and 02:00:00 on a Shanghai host. It is in parseDateCell, inside the claim's file surface, and it is the same host-zone reading triage ruled out.
• A zone-naive 24:00 is now refused, in both the ISO and the year-first form. It used to fall through to new Date(s), in the host zone. 2026-07-15T24:00:00Z names its instant and reads as before.
• objectui's Import Wizard preview disagrees with the server on non-ISO, non-year-first dates.
  • The preview judges a date or datetime cell with a bare Date.parse (packages/plugin-grid/src/ImportWizard.tsx validateValue in objectui), so it marks 07/15/2026 valid while the server refuses it.
  • The wizard's server-side "Validate data" dry run gives the server's verdict.
  • I read this in objectui's source and did not measure it through the UI. There is no carrier, so it is noted here only.
• The import-mappings doc could name the accepted spellings. content/docs/data-modeling/import-mappings.mdx says date cells are "parsed to storage form" and lists no spellings. There is no carrier, so it is noted here only.
• Two year-below-1000 defects outside this claim's surface are filed, not fixed here.
  • [finding] /export writes a date / datetime cell with a year below 1000 unpadded (0500-01-01 → 500-01-01), so the export does not re-import #20602: /export writes a year-500 row unpadded (500-01-01), so the export does not re-import.
  • [finding] outside calendar-day.ts, a year from 0001 to 0099 is still read as 1900..1999: Date.UTC's two-digit-year remap in core's datetime and bucket helpers, filter-tokens and the REST import's datetime cell #20599: core's zonedWallClockToUtcMs stores a zone-naive 0050-01-01 10:00:00 as 1950-01-01T10:00:00.000Z. This PR leaves that reading as it was, for ISO and year-first cells alike: packages/core/** is read-only for this claim.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

11 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c96beb2707e9d12fbc8abcf985c6dc93f957ef2c → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 4766625cdaea351988c0e3d20f4f01cb0cd1a72a — the merge of head 3b2e47349e98346c72d3f3cf9dfda3ed1c6eb8bf into base c96beb2707e9d12fbc8abcf985c6dc93f957ef2c, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4766625cdaea351988c0e3d20f4f01cb0cd1a72a && git checkout 4766625cdaea351988c0e3d20f4f01cb0cd1a72a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c96beb2707e9d12fbc8abcf985c6dc93f957ef2c 3b2e47349e98346c72d3f3cf9dfda3ed1c6eb8bf && git checkout -B drift-repro c96beb2707e9d12fbc8abcf985c6dc93f957ef2c && git merge --no-ff 3b2e47349e98346c72d3f3cf9dfda3ed1c6eb8bf

node scripts/docs-audit/affected-docs.mjs --json c96beb2707e9d12fbc8abcf985c6dc93f957ef2c

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 76e7fb3379a45e0a6feb8559e7099d63a6a1f52a
Local-runs: none

PR #20601 for card #20534, judged against triage's binding answer A (5883900872): a text cell that is neither ISO 8601 nor the export shape is refused per row, an impossible day is refused, no rollover, no host-zone reading, no month-first guess, xlsx Date cells unaffected, the year padded on every date branch. Inputs: the card body and all 7 comments, the PR body, its 6-file list, the net diff against main at this head, and the check-runs on this head (read 2026-09-29T06:13Z). Repository sources cited below were read at the checkout, not run.

Check-runs on this head at the read: 34 runs, one per name. 30 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 1 in_progress: Lint & Repo Gates (ESLint, doc anchors, ADR anchors, migration registry, slot-lookup ratchet). No verdict is inferred for the running one. Green includes Check Changeset (which carries check-adr-0087-registration and check-changeset-no-major; its only skip condition is a skip-changeset label, which this PR does not carry), Test Core 1/6 to 6/6, Temporal Conformance (live PG + MySQL), all four Type Check jobs, Dogfood Regression Gate 1/3 to 3/3, Dogfood Verify CLI, and the three claim guards (same issue, same single-writer path, card claims this branch).

① Derived judgments

Every accept-set and public-surface change the diff implies, each judged:

1. The text grammar of parseDateCell narrows to ISO 8601 or the export shape — right. ISO_TEMPORAL_CELL admits YYYY-MM-DD; YYYY-MM-DDTHH:MM[:SS[.f]] with Z, +HH:MM/-HH:MM, +HHMM/-HHMM or nothing; YYYY-MM-DD HH:MM[:SS[.f]] zone-naive; plus a bare HH:MM[:SS] for a time cell. The regex admits a space-plus-zone spelling syntactically, but readIsoTemporalCell refuses it (sep must be T when a zone is present), so the admitted set is exactly the write door's ISO_DATETIME_WRITE_FORM (packages/objectql/src/validation/record-validator.ts, record validator: the temporal write arms trust Date.parse — date 2026-02-30 is stored verbatim (500 on PostgreSQL), datetime 2026-02-30T10:00:00Z rolls over to March 2, and a non-ISO datetime is read in the host zone #20525). Every other text cell returns undefined. This is the ruled set, one grammar with the write door.

2. An impossible day is refused on every branch, by arithmetic — right. namesRealCalendarDay (month 01..12, day to the month's length, Feb 29 only in a leap year; the write door's private rule copied) runs before any Date call. The only Date.parse left is on a zone-bearing ISO cell whose day already passed that check, and a bare day into a datetime is built from ${day}T00:00:00.000Z, not Date.UTC(y, mo-1, d). Nothing rolls over.

3. No host-zone reading — right. The new Date(s) fallback is deleted on all three kinds. A zone-naive wall clock still goes through core's zonedWallClockToUtcMs(wall, timezone) (business zone, else UTC; Bulk import reads a naive datetime cell in the process-local timezone, so an export/edit/re-import round trip shifts the instant #8485 unchanged); a zone-bearing cell is Date.parse of an ISO string, the same instant on every host. The time branch is included: its fallback was the same new Date(s), it sits in the claimed function, and the changeset names time fields. Right, and a declared deviation (③.1).

4. No month-first guess — right. No locale, prose, RFC 1123 or slash spelling matches the grammar; none is read at all.

5. Year padded on every date branch — right. A text cell keeps its own four digits (the grammar requires \d{4} and cell.day is the cell's text); a Date and a zone-bearing instant take core's temporalStorageForm(…, 'date'), imported from @objectstack/core (read-only for the claim; it pads 0001..0999 per its docblock). Year 0000 passes the grammar and is left to the write door's 0001..9999 range (temporal values outside the years a four-digit text or a backend holds: a datetime comparand for year 10000 or −1 misorders on memory/SQLite and 500s on PostgreSQL; a date in year 0000 500s on PostgreSQL; a date write stores +010000-… verbatim #20264), a refusal there as it was at base (0-01-01), never a stored value.

6. A bare day into a datetime for years 0001..0099 moves from the 1900s to its own year — right. 0001-01-01 was 1901-01-01T00:00:00.000Z via Date.UTC; it is 0001-01-01T00:00:00.000Z now. A value change beyond the padding, and the old value was silently wrong; the changeset names it.

7. Seat question (1): does any previously admitted form move to a different stored value, other than the year padding and the 1900s fix? No. Checked branch by branch against the removed code: ISO T forms and space wall-clock forms take the same wall path (fraction truncation identical: the old regex captured three digits, the new slices three); a zone-bearing cell is the same Date.parse instant; a date from an instant is the same UTC calendar day; a time from a wall clock is the typed clock and from an instant the UTC clock; T24:00:00Z is the next midnight as before; a Date argument reads as before save the padding. The dev's 588-row census (0 refused-to-admitted, 246 admitted-to-refused, 28 value changes all padding or 1900s) is consistent with this reading.

8. Seat question (2): do the export shape and xlsx Date cells round-trip unchanged? Yes. The export writes YYYY-MM-DD, YYYY-MM-DD HH:mm:ss and HH:MM:SS; all three are in the admitted set, and the route pin drives GET /export into POST /import over SqlDriver under both host zones. An xlsx Date cell is rendered by import-prepare.ts's untouched xlsxDateToNaiveCell as YYYY-MM-DD HH:mm:ss, admitted and read in the business zone as before; pinned.

9. Seat question (3): do the refusals reuse import_invalid_date / import_invalid_datetime / import_invalid_time with no new code? Yes. parseDateCell returns undefined and the untouched caller in coerceRow emits invalid_date with the existing three keys. The diff adds no error code, no message key, no date-format option.

10. Public surface — right. @objectstack/rest exports coerceRow (not parseDateCell); coerceRow narrows with the door and the changeset says so. No export is added, removed or renamed; packages/core, packages/objectql, packages/spec and packages/drivers are untouched (file list).

11. File surface — right. One source file: parseDateCell, its docblock, the private helpers beside it (ISO_TEMPORAL_CELL, namesRealCalendarDay, readIsoTemporalCell, utcClock), NAIVE_DATE_TIME and parseNaiveWallClock removed (module-private; Type Check green). Tests in packages/rest/src/. One changeset for @objectstack/rest.

12. Fixture triage — right. Three fixtures re-spelled from year-first slash to ISO; the two assertions that pinned the slash branch itself replaced by refusal assertions. Consistent with the ruled set (③.7).

13. Tests against triage's pin list (5883900872) — met on SQLite under both host zones, memory measured not pinned (③.2). Per zone: the fold's 11 rows refused as their own row's invalid_date with the sibling row written and nothing stored; 0500-01-01 and 0001-01-01 stored padded and equal to what the create door stores; the 2026 ISO, offset and export-shape controls unchanged; the export round trip; an xlsx Date cell; quoted CSV cells; the dry run. The zone switch is asserted by Intl and the July offset. The unit table (37 refused, 25 admitted) asserts equality under both hosts.

② Semver level

.changeset/20534-import-date-cell-iso-real-day.md: '@objectstack/rest': minor, line-initial Clause-②: no (narrowing), a BREAKING banner for callers of the import door, a FROM/TO pair for every refused class, and the adr-0087 marker not-required (no-migration-prescription) with its why.

• Level minor — right. The accept set of a published door and of the exported coerceRow narrows, so patch is wrong; AGENTS.md §3 makes (narrowing) BREAKING, ADR-0087's amended level half ships a pre-GA break as minor carrying the banner and the disposition, and check-changeset-no-major refuses major until GA and grades a declared narrowing at minor as clean. Check Changeset is green on this head.
• Clause-②: line — right. The changeset carries no (narrowing), where check-adr-0087-registration reads the arm (the dev's run reported [BREAKING+clause-②-narrowing]). The PR body carries the claim's bare Clause-②: no, a truthful answer to the widening question; nothing widens.
• Seat question (4), ADR-0087 disposition — right. Nothing authorable is removed, renamed or reshaped: no spec key, no export, no stored row; objectstack migrate meta has nothing to reach. The FROM/TO lines prescribe the edit of a cell in a user's file (data), not a metadata rewrite, and the mechanical gate is green. The wording is the same disposition PR fix(rest)!: /import reads a comma in a number cell only as a thousands group, refusing the rest (#20497) #20517 landed with for the number reader (.changeset/20497-import-number-thousands-group.md), and the write-door siblings record validator: a date field written as a non-ISO string ("2026/07/15") answers 201 and is stored verbatim as "2026/07/15", a non-day, on memory and SQLite, because the date arm admits any Date.parse-readable string #20481 and record validator: the temporal write arms trust Date.parse — date 2026-02-30 is stored verbatim (500 on PostgreSQL), datetime 2026-02-30T10:00:00Z rolls over to March 2, and a non-ISO datetime is read in the host zone #20525 carry the same category for the same reason.
• Coverage of the 246 moved forms — right. The changeset names each class with its FROM and ISO TO: impossible day; locale or prose spelling; year-first non-ISO including a one-digit hour; a zone after a space and lower-case t/z; a zone-naive 24:00; a number, reduced and expanded forms. The 28 value changes (four-digit year, 1900s fix) are named under "The year keeps four digits". time fields are named in the banner.

③ Boundary flags

Every dev flag (deviations, acceptance notes, out-of-scope findings) and the open question, answered:

1. time branch included (deviation). Answered: right. The claim's parenthetical named the date and datetime branches, but the ruling is "no host-zone reading" on parseDateCell, the time fallback was the same new Date(s) (07/15/2026 10:00 stored as 14:00:00 in New York and 02:00:00 in Shanghai), and the branch is inside the claimed function and file. Declared in the PR body and the changeset.
2. InMemoryDriver leg measured, not pinned (departs from triage's "memory and SQLite"). Answered: accepted, not escalated. The verdict is the reader's, before any driver is reached; @objectstack/rest has no @objectstack/driver-memory dependency and scripts/driver-memory-census.ledger.json lists no packages/rest consumer, so a pin would widen the package's dependencies and the census ledger, outside the claimed file surface. PR fix(rest)!: /import reads a comma in a number cell only as a thousands group, refusing the rest (#20497) #20517 landed with the same shape for the same door. The memory readings are in the H0 table: memory and SQLite agree on all 41 cells under both zones, at base and at head. The seat may carry it as an acceptance note, as the dev did.
3. A zone-naive 24:00 is now refused. Answered: right. It went to new Date(s) in the host zone at base (the old wall path already refused hour 24); refusing it loudly with a FROM/TO to 2026-07-16 00:00 is the ruled direction, 2026-07-15T24:00:00Z names its instant and reads as before, and reading hour 24 on the wall path would need core's zonedWallClockToUtcMs, read-only for this claim.
4. objectui Import Wizard preview disagrees with the server on non-ISO dates (noted, no carrier). Answered: outside this repository; the server dry run gives the verdict, and objectui's xlsx reader sends ISO. The seat's Acceptance notes handling stands.
5. import-mappings.mdx names no accepted spellings (noted, no carrier). Answered: a docs follow-up, not a defect of the ruled set; "Flag docs affected by code changes" is green. The seat's Acceptance notes handling stands.
6. Two year-below-1000 defects outside the surface — /export writes 500-01-01 unpadded (landing export-format.ts), and core's zonedWallClockToUtcMs stores 0050-01-01 10:00:00 in 1950. Answered: rightly not fixed here (export-format.ts is outside the claimed file surface; packages/core is read-only). The seat filed [finding] /export writes a date / datetime cell with a year below 1000 unpadded (0500-01-01 → 500-01-01), so the export does not re-import #20602 for the export and pointed [finding] outside calendar-day.ts, a year from 0001 to 0099 is still read as 1900..1999: Date.UTC's two-digit-year remap in core's datetime and bucket helpers, filter-tokens and the REST import's datetime cell #20599 at the core reading (5884709824). Neither is made worse by this diff.
7. Open question (year-first slash dates 2026/7/15, Excel's zh-CN/ja-JP default) — answered A by the seat (5884709824), as ruled. Judged only on execution: the diff refuses 2026/6/3, 2026/07/15, 2026-7-15, 2026/08/01 06:00:00 and 2026-07-15 9:00 (unit table), re-spells the three fixtures, and the changeset carries FROM 2026/7/15 TO 2026-07-15 with the Excel cell-format fix. The ruled set is executed; nothing to escalate. The declared date-format option stays outside the card per triage.
8. Mechanics deviations — label-write under with-fleet.sh --read; two pushes against the order's one (probe push plus final); origin/main merged at c876a7426d with main since moved by e666636fd9 (a create-objectstack test only; the PR is mergeable: true); the AGENTS.md model-free trailer used instead of the harness reminder. None touches the diff's contract.
9. check-single-claim-paths NOT MEASURED locally (needs a PR context). Answered by the head's check-run "No other open PR may claim the same single-writer path": success.
10. Verification ran UNLOCKED (no flock on the host; declared). Answered by the check-runs above; the one still running is recorded as running.

Implemented-by: claude/issue-20534-parse-date-cell-family
Reviewed-by: local_1d2a197c-c20e-4e90-9be8-413d4d432289

VERDICT: PASS

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3b2e47349e98346c72d3f3cf9dfda3ed1c6eb8bf
Local-runs: none

Delta review of PR #20601 for card #20534 at the patch-round head, after the full PASS at 76e7fb3379a45e0a6feb8559e7099d63a6a1f52a (5885068376). Binding direction: triage's answer A (5883900872) as amended by the maintainer ruling 5885066497, which re-admits year-first dates on one closed grammar and changes nothing else. Inputs: the card body and all 9 comments; the PR body (rewritten by the seat), its 5-file list and its 2 comments; the net diff against main at this head; the compare 76e7fb3379...3b2e47349e (13 commits: 8 brought in by two merges of main, the two merge commits, and the PR's own three, 46f80262 the reader, 279ca425 the tests, 1d82ef6e the changeset); the check-runs on this head, read 2026-09-29T07:11:58Z. The PR's own five files were judged; the compare's file listing (capped at 300 by the API) is main's movement. Blob shas of the touched files at main, at the PR base 3a89d459af, at the previous head and at this head were read through the contents API. Nothing was built, run or re-run.

Check-runs on this head at the read: 39 runs over 32 names (7 names ran twice: a suite at 07:03Z on the push and a suite at 07:09Z after the body edit; no completed duplicate disagrees). Newest per name: 21 success, 5 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in), and the newer Auto Label and Check PR Size runs, whose 07:03Z runs are success), 6 in_progress: Lint and Repo Gates, Test Core (1/6), (2/6), (4/6), (5/6), Type Check · workspace. No verdict is inferred for a running check. Green includes Check Changeset (07:10:21Z), Build Core, Temporal Conformance (live PG + MySQL), Test Core (3/6) and (6/6), Type Check · source gates / consumer gates / debt ledger, Dogfood Regression Gate 1/3 to 3/3 and its rollup, Dogfood Verify CLI, Flag docs affected by code changes, Governed Surface Queue Guard, Check Documentation Links, and the three claim guards. main has moved 3 commits past the PR base since the last merge; none touches packages/rest/src/import*, packages/core's datetime utils or the write door's validator; the PR is mergeable: true.

① Derived judgments

The brief's six questions, answered on the diff:

Q1. The admitted year-first set equals the ruled set exactly — yes. YEAR_FIRST_CELL is ^(\d{4})([/-])(\d{1,2})\2(\d{1,2})(?: (\d{1,2}):(\d{2})(?::(\d{2}))?)?$, and readYearFirstCell runs namesRealCalendarDay and the clock-range check on the match. Item by item against 5885066497: a four-digit year (\d{4}); a one- or two-digit month and day (\d{1,2}); the same separator in both places (the \2 back-reference, so 2026/7-15 does not match); exactly one space before the clock (the literal space inside the optional group; the cell is trimmed first, so surrounding whitespace is fine and a second inner space is not); a one- or two-digit hour (\d{1,2}) with two-digit minutes and optional two-digit seconds; hour 0..23 and minutes and seconds 00..59, enforced by the check that refuses an hour above 23 or a minute or second above 59, so 2026/7/15 24:00 and 2026/7/15 9:60 are refused; no T (the space is the only separator the group admits), no zone and no fraction (the pattern is anchored at $ right after the seconds); the day must exist (namesRealCalendarDay, so 2026/2/30 is refused and 2028/2/29 admitted); the stored day is padded (${y}-${pad2(month)}-${pad2(date)}). All six ruled examples are admitted and pinned: 2026/7/15, 2026/07/15, 2026-7-15, 2026/7/15 9:00, 2026/08/01 06:00:00, 2026-07-15 9:00 (unit ADMITTED rows; route pins for 2026/7/15 and 2026/7/15 9:00). Every "still refused" class is refused and pinned: 07/15/2026 (as date and as datetime), 26/7/15, 2026/7-15; 15/07/2026 cannot match a four-digit first field. No form is admitted that the ruling does not admit, and none the ruling admits is refused. The reader tries readIsoTemporalCell(s) ?? readYearFirstCell(s), and the fall-through leaks nothing: every ISO refusal (an impossible day, a zone after a space, an out-of-range clock, lower-case t / z, a T with a one-digit hour, an unparseable offset) is refused by the year-first grammar for the same or a stricter reason, checked shape by shape.

Q2. Beyond the padding, the 1900s fix and the named time exception, no form main admits moves to a different stored value — confirmed against main's reader (blob afaf602da1, identical at the base and at today's main), branch by branch. A Date argument: datetime and time unchanged, date padded only. A bare day (ISO or year-first, either separator, one- or two-digit fields) into date: the same padded day; into datetime: main's Date.UTC(y, mo - 1, d) and the head's Date.parse of ${day}T00:00:00.000Z name the same midnight for every year 0100..9999 and differ only for 0000..0099 (the 1900s fix). A clock cell that main's NAIVE_DATE_TIME read, in its one ruled form on a real day, takes the same zonedWallClockToUtcMs(wall, timezone) call with the same parts (the ISO fraction is truncated to three digits on both sides; the year-first form has no fraction, so millisecond: 0 where main also had 0); into date the same day, into time the same typed clock. A zone-bearing ISO cell: Date.parse on both sides, the same instant; date the same UTC day (padded), time the same UTC clock. T24:00:00Z unchanged. Everything else main admitted went to new Date(s) and is now refused, not re-valued. The one value change outside those classes is the named exception: a year-first bare day into a time field, which main read through new Date('2026/7/15') in the host zone (04:00:00 in New York, 16:00:00 in Shanghai) and the head reads as 00:00:00. The exception is right under the ruling. The ruling holds a year-first cell to "the same rules as every other admitted cell"; the admitted cell of the same kind is a bare ISO day into a time field, which main and the head alike read as 00:00:00 (ECMAScript reads a date-only form as UTC), and no host-independent value can equal a reading that differed by host. The changeset's Kept paragraph names it. The dev's 666-row census (0 refused → admitted, 240 admitted → refused, 42 value changes of which 30 are padding or the 1900s fix and 12 this exception) is the dev's measurement, not re-run here; it is consistent with this reading.

Q3. A year-first date-time is read through the same business-zone wall-clock path as the export shape — yes. Both readers return the one IsoTemporalCell shape, and parseDateCell has a single if (cell.wall) arm: date takes cell.day, time the typed clock, datetime zonedWallClockToUtcMs(cell.wall, timezone). Pinned three ways: the route pin "stores a year-first date-time as the same instant the export shape stores" asserts 2026/7/15 9:00 equals what 2026-07-15 09:00:00 stores under TZ=America/New_York and TZ=Asia/Shanghai, and equals 2026-07-15T09:00:00.000Z; the unit rows assert 2026/7/15 9:00 and 2026-07-15 9:00 equal under both hosts; and import-business-timezone.test.ts (byte-identical to main, its line 116) asserts 2026/08/01 06:00:00 in the Shanghai business zone under a Los Angeles host is CROSS_MONTH_UTC (2026-07-31T22:00:00.000Z), beside the export-shape line that gives the same instant.

Q4. The refusals reuse the existing keys, with no new code and no date-format option — yes. parseDateCell returns undefined; the caller in coerceRow is untouched by the diff and at the head still reads key = t === 'datetime' ? 'import_invalid_datetime' : t === 'time' ? 'import_invalid_time' : 'import_invalid_date' with coerceError(meta, field, 'invalid_date', key, raw, ctx). The diff adds no error code, no message key, no option, and touches no packages/core, objectql, spec or drivers file (file list).

Q5. The changeset is right, and the FROM 2026/7/15 line is gone — yes. '@objectstack/rest': minor; line-initial Clause-②: no (narrowing); the BREAKING paragraph's admitted list now carries the year-first form in the ruling's words; the FROM/TO pairs cover every class that moves admitted → refused, including the year-first edges the ruling refuses (mixed separator, T or zone, fraction, 24:00, two-digit year); the new Kept: year-first dates paragraph names the five ruled spellings, the real-day check, the hour range, the padded storage and the time exception; the four-digit-year and 1900s paragraphs stand; the adr-0087 marker is still not-required (no-migration-prescription), its why now ending "in ISO 8601 or as a year-first date". 2026/7/15 appears only as a TO (from 2026/7-15) and in Kept, never as a FROM. Judged in ② below.

Q6. The restored fixtures and assertions match main's spelling, and import-business-timezone.test.ts is byte-identical to main — yes. The net diff against main touches import-coerce.test.ts only by the afterEach import and the appended [#20534] block, and import-integration.test.ts only by two added lines (the two.due assertion), so main's parseDateCell('2026/6/3', 'date') line (main line 87), the coerceRow fixture due: '2026/07/01' (line 142), the CSV cell 2026/06/30 (line 193) and the xlsx text cell '2026/07/01' (line 350) are main's bytes at the head. import-business-timezone.test.ts is not in the PR's file list; its blob is 7780a08ce320 at this head, at the base 3a89d459af, at f11b5f20a2 and at today's main (it was dd2f60b77fd8 at the previous head).

Every accept-set and public-surface change the diff implies:

1. Text grammar: ISO 8601, the export shape, or the ruled year-first form — right (re-judged). ISO_TEMPORAL_CELL and readIsoTemporalCell are unchanged from the previous head (carried from 5885068376 ①.1: the write door's ISO_DATETIME_WRITE_FORM, a space-plus-zone spelling refused); YEAR_FIRST_CELL is the ruling's grammar (Q1). The union is the ruled set.
2. Impossible day refused on every branch, by arithmetic — right (re-judged for the new branch). readYearFirstCell calls namesRealCalendarDay before building anything; 2026/2/30 is pinned refused as date and datetime in the unit table and as a date row through the route. Nothing on the year-first branch reaches Date.UTC with the typed parts except through zonedWallClockToUtcMs after the day is checked.
3. No host-zone reading — right (re-judged). The year-first branch yields a bare day (UTC midnight for datetime, the day itself for date, 00:00:00 for time) or a wall clock read in the business zone; no new Date(s) remains in the reader (main had three). Every unit row is asserted equal under America/New_York and Asia/Shanghai.
4. No month-first guess — right (re-judged). The year-first form's first field is four digits, so the month and day positions are fixed, the ruling's own reason. 07/15/2026, 15/07/2026 and 26/7/15 are outside the grammar and pinned refused.
5. Four-digit year on every date branch — right (re-judged). The year-first branch keeps the captured four digits and pads only month and day (0500/1/1 → 0500-01-01, pinned). The ISO and instant branches are unchanged (carried, 5885068376 ①.5); year 0000 in either text form is left to the write door's 0001..9999 range as before.
6. 1900s fix — right (re-judged). A year-first bare day into a datetime takes the same ${day}T00:00:00.000Z spelling as an ISO bare day; 0050-01-01 and 0001-01-01 are pinned in their own year, and 0050/1/1 follows the same line.
7. time branch — right (re-judged). A year-first cell with a clock gives its typed clock (2026/7/15 9:00 → 09:00:00, pinned); without a clock, 00:00:00 (Q2).
8. Export shape and xlsx Date cells unchanged — carried (5885068376 ①.8). The patch touched neither path; both pins stay in the route file.
9. Refusal keys — carried (5885068376 ①.9), re-read at the head (Q4).
10. Public surface — carried (5885068376 ①.10). coerceRow narrows with the door; no export added, removed or renamed; the read-only packages are untouched (file list), and main's movement since the base touches none of them.
11. File surface — right (re-judged). The patch adds two module-private helpers (YEAR_FIRST_CELL, readYearFirstCell) beside the existing ones and edits the docblocks; still one source file, tests in packages/rest/src/, one changeset. The claim's surface holds.
12. Fixture triage — right (re-judged; reverses 5885068376 ①.12 as the ruling requires). The three fixtures and two assertions the first round re-spelled or replaced are main's bytes again (Q6), and the year-first edges the ruling refuses are pinned in their place.
13. Tests against the pin list — met (re-judged). Triage's pins (5883900872) stand as in 5885068376 ①.13, now with 12 refused rows and 10 admitted cells per host zone through the route over SqlDriver, plus the same-instant pin, the padded-year parity with the create door, the export round trip, the xlsx cell, the quoted CSV verdicts and the dry run; the ruling's own examples are pinned per Q1 and Q3; the unit table is 42 refused and 36 admitted rows, counted. The memory leg stays measured, not pinned (③.4).

② Semver level

.changeset/20534-import-date-cell-iso-real-day.md: '@objectstack/rest': minor, line-initial Clause-②: no (narrowing), a BREAKING paragraph for callers of the import door, and the adr-0087 marker not-required (no-migration-prescription).

• Level minor — still right. The patch round re-admits a form main already admitted, so it adds no accept set against main; the net change is still a narrowing (the census: 0 refused → admitted, 240 admitted → refused), and the reasons of 5885068376 ② hold: a narrowing on a published door and the exported coerceRow is BREAKING under AGENTS.md §3, ships pre-GA as minor with the banner under ADR-0087's amended level, and check-changeset-no-major refuses major. Check Changeset is success on this head (07:10:21Z).
• Clause-②: line — right. The changeset carries no (narrowing), the arm check-adr-0087-registration reads (the dev's run: [BREAKING+clause-②-narrowing] not-required); the PR body carries the claim's Clause-②: no. Nothing widens against main.
• FROM/TO coverage — right. Each newly refused class has a FROM and an admitted TO, including the year-first edges the ruling refuses: a mixed separator (2026/7-15 TO 2026/7/15 or 2026-07-15), a T or a zone (2026/7/15T9:00, 2026/7/15 9:00Z TO 2026/7/15 9:00 or the ISO instant), a fraction (2026/07/15 10:00:00.123 TO 2026-07-15 10:00:00.123), and 2026/7/15 24:00 TO 2026/7/16 0:00. 2026-07-15T9:00 (an ISO day, a T, a one-digit hour), which main admitted, is refused by both grammars (two-digit hour after T; space only in the year-first form) and falls under the "a T on the year-first form" line by class, though the example there is spelled with slashes. The TO wording moved from "the ISO one" to "an admitted one", matching the wider set.
• Kept paragraph — right. It states what an upgrader keeps (2026/7/15, Excel's zh-CN / ja-JP default), the rules now applied to it, and the time exception with its old host-dependent value.
• ADR-0087 disposition — still right. Nothing authorable is removed, renamed or reshaped; the FROM/TO lines prescribe edits to cells in a user's file, not metadata; objectstack migrate meta has nothing to reach. The same disposition as PR fix(rest)!: /import reads a comma in a number cell only as a thousands group, refusing the rest (#20497) #20517 and the write-door siblings.

③ Boundary flags

The newest os-dev-report (5885398033) has open_questions: []. Every deviation and out-of-scope entry, and the earlier flags the ruling touched:

1. The PR body was not updated by the dev; the seat rewrote it (deviation). Answered: done. The live body cites 5885066497, states the ruled grammar in the ruling's words, carries the 666-row census, both H3 rounds and the updated Acceptance notes, and every count in it that this record could check matches the diff (42 / 36 unit rows, 28 route cases per zone, 22 red in the round-2 ablation as 11 + 5 + 6). One seat correction remains, outside the diff: the PR title still reads "only in ISO 8601 or the export shape". That is the first round's set; the head admits the year-first form too, and the changeset heading already says so. The adopting seat should retitle the PR to match the changeset heading before merge, since the title becomes the commit subject on main. Not a defect of the diff; the verdict below is on the diff and the changeset.
2. origin/main merged twice (deviation). Answered: the compare's two merge commits bring in main only (its file listing is main's movement, mostly the version-packages commit consuming changesets); the PR's own files are the five in the file list, judged above. main has moved 3 commits past the base since, none on this surface.
3. The xlsx fixture restore added one assertion (deviation). Answered: right. two.due was unasserted on main; the added line pins the year-first text cell through the real xlsx path at no cost to main's spelling.
4. Memory leg measured, not pinned — carried from 5885068376 ③.2, unchanged by the patch (the dev re-measured 46 cells at the new head; memory equals SQLite under both zones, 0 cells differ between zones).
5. Census value changes beyond padding and the 1900s fix (deviation). Answered in ① Q2: the 12 rows are the one time exception, right under the ruling and named in the changeset.
6. Census at 666 rows (deviation). Reporting mechanics; the original 588-row subset is reported beside it. Nothing to escalate.
7. Commit trailer (deviation). The commits carry the AGENTS.md model-free pair; mechanics, not contract.
8. Out of scope, already filed: [finding] /export writes a date / datetime cell with a year below 1000 unpadded (0500-01-01 → 500-01-01), so the export does not re-import #20602 (/export unpadded year) and [finding] outside calendar-day.ts, a year from 0001 to 0099 is still read as 1900..1999: Date.UTC's two-digit-year remap in core's datetime and bucket helpers, filter-tokens and the REST import's datetime cell #20599 (core zonedWallClockToUtcMs reads 0..99 as the 1900s). Answered: rightly not re-filed. The year-first clock reaches [finding] outside calendar-day.ts, a year from 0001 to 0099 is still read as 1900..1999: Date.UTC's two-digit-year remap in core's datetime and bucket helpers, filter-tokens and the REST import's datetime cell #20599 through the same call main used for it (0050/1/1 10:00 was 1950 on main and is 1950 at the head), so nothing is made worse; packages/core is read-only for the claim.
9. objectui Import Wizard preview (noted, no carrier). Answered: outside this repository; with year-first admitted the preview and the server now agree on the Excel default, and the server dry run remains the verdict for 07/15/2026. The Acceptance-notes handling stands.
10. import-mappings.mdx names no accepted spellings (noted, no carrier). Answered: a docs follow-up; the drift check on this head lists nothing and says that is not a clean bill. The Acceptance-notes handling stands.
11. check-single-claim-paths — measured this round with PR_NUMBER=20601 (exit 0), and the head's check-run "No other open PR may claim the same single-writer path" is success in both suites.
12. Verification ran UNLOCKED; CI not awaited (declared). Answered by the check-runs at the read: 21 green, 5 skipped, 6 still running, recorded as running.
13. 5885068376 ③.7 (year-first refused, answered A) — superseded by the ruling, as 5885066497 says; re-judged as ① Q1 to Q3. The declined locale guess (07/08/2026) stays refused, pinned.

Implemented-by: claude/issue-20534-parse-date-cell-family
Reviewed-by: local_1d2a197c-c20e-4e90-9be8-413d4d432289

VERDICT: PASS