`sys_job.timezone` and `sys_report_schedule.timezone` disagree with each other and neither is validated — the platform's own IANA columns predate `valueDomain`

[zhuangjianguo]

Found while implementing #14238 (maintainer ruling A: sys_business_unit.timezone and sys_organization.timezone, both text / optional / maxLength: 64 / valueDomain: 'iana_time_zone' / no default). Retrofitting the two older columns was explicitly outside that ruling's scope, so it is carded here rather than widened into that PR. Unassigned — for triage.

The reading

Measured on origin/main at 7b6825477, each file individually (a lane-wide grep for time_?zone returns 20+ hits and is not a reading about a file):

object	declaration	bound	default	valueDomain
sys_job — packages/platform-objects/src/audit/sys-job.object.ts:64	Field.text({ required: false, maxLength: 100 })	100	none	none
sys_report_schedule — packages/platform-objects/src/audit/sys-report-schedule.object.ts:81	Field.text({ required: false, maxLength: 64, defaultValue: 'UTC' })	64	'UTC'	none

grep -c valueDomain in both files = 0. So the card #14238 was raised on — "every app invents the column differently" — is already true inside the platform's own objects, in three dimensions at once (length, default, validation), and since #14168 / #15161 the platform has the one declaration that closes the third dimension and these two columns do not carry it.

Consequence

A write of Mars/Olympus, UTC+8 or China Standard Time to either column is stored. Whatever reads the column at schedule time (service-job for sys_job, plugin-reports for sys_report_schedule) meets the bad value later, far from its cause. Not measured here: which reader consumes each column and what it does with a non-member (throws, falls back to UTC, or schedules at a wrong instant) — that is this card's first step, and it decides the severity.

Published surface (measured, Zone-1 rule)

Both columns are in the built packages/platform-objects/dist/audit/index.js / index.mjs (timezone ×2) and dist/audit/index.d.ts / index.d.mts (×3). content/docs/** mentions of either column's timezone: 0. So this is a published surface by the dist measurement, and a docs-absent one.

Proposed shape (for the implementing seat to verify, not a ruling)

• Declare valueDomain: 'iana_time_zone' on both. It is the transition-gate class (min / max / maxLength): only a WRITTEN non-member is refused; stored values are never re-read, so no data migration and no ADR-0087 prescription.
• Converge the bound on 64, the value No platform object carries a timezone, so every app that computes a date boundary has to invent one — and each will invent it differently #14238 chose and justified: the enumeration's longest name on the repo's Node baseline is 30 characters (America/Argentina/Rio_Gallegos), the longest tzdb link 32 (America/Argentina/ComodRivadavia), and the tzdb caps each path component at 14 — 64 is twice the domain's real ceiling. Narrowing 100 → 64 on sys_job needs the check-keyed-text-bounds family and a look at what the column physically holds.
• The default is a consumer semantic (sys_report_schedule says UTC, sys_job says nothing); keep each as its reader expects unless the reader says otherwise.

Both objects are isSystem; the change widens a declared shape on a published package, so the changeset is at least minor and the review tier is a contract question for the PM, not for this card.

Re-check

git show origin/main:packages/platform-objects/src/audit/sys-job.object.ts | sed -n '64,69p'
git show origin/main:packages/platform-objects/src/audit/sys-report-schedule.object.ts | sed -n '81,87p'
git show origin/main:packages/platform-objects/src/audit/sys-job.object.ts | grep -c valueDomain              # 0
git show origin/main:packages/platform-objects/src/audit/sys-report-schedule.object.ts | grep -c valueDomain  # 0

[os-zhuang]

分诊：domain:engine / enhancement + finding + needs:contract-review / pm:queue / priority:p3

落点核实（origin/main，按卡片给的 re-check 逐条跑）——逐字成立

packages/platform-objects/src/audit/sys-job.object.ts:64-69
    timezone: Field.text({
      label: 'Timezone',
      required: false,
      maxLength: 100,          ← 无 default，无 valueDomain
      group: 'Schedule',
    }),

packages/platform-objects/src/audit/sys-report-schedule.object.ts:81-87
    timezone: Field.text({
      label: 'Timezone',
      required: false,
      maxLength: 64,
      defaultValue: 'UTC',     ← 有 default
      group: 'Schedule',
    }),

valueDomain in sys-job.object.ts             → 0
valueDomain in sys-report-schedule.object.ts → 0
控制：valueDomain 在 packages/platform-objects/src 别处有命中 → 有（生成的 metadata-forms 系列）

⇒ 两个 0 是读数，不是 grep 失效。 卡片的三维分歧（长度 100 vs 64、默认 无 vs 'UTC'、校验 都无）全部成立。

⭐ 而卡片对这件事的定性最有力：#14238 立卡时的理由是「每个 app 都把这一列发明成不同的样子」——而这在平台自己的对象里已经是真的，同时在三个维度上。

---

定级理由

• domain:engine：packages/platform-objects 按 lane 表归 domain:engine。

• enhancement 而非 bug：main 上没有东西是假的——两个声明各自都是自洽的，只是彼此不一致且都不校验。加 valueDomain 是收窄写入接受集（⇒ 破坏性方向），改 100→64 更是。⇒ Feature 侧，人工地板。

• needs:contract-review：卡片自陈 "the change widens a declared shape on a published package, so the changeset is at least minor and the review tier is a contract question for the PM"。⇒ 本席据此挂上，让它按合约评审路径走，⛔ 不当作普通 tidy 派掉。

• p3，且带明确的升级条款：⚠️ 本卡的严重度今天是未知的，因为卡片诚实地标出了它没测的那一步：

  Not measured here: which reader consumes each column and what it does with a non-member (throws, falls back to UTC, or schedules at a wrong instant) — that is this card's first step, and it decides the severity.

  ⇒ 预登记升级条款：若测出任一读者在拿到非成员值时按错误的时刻调度（而不是抛出或回落 UTC），立即升 p2，并把读数贴在本卡上，⛔ 不要另开卡。理由：静默地在错误时刻跑一个 job 或一份报表，是一类事后极难归因的故障。

⚠️ 承接席的三条硬约束

① 先做第一步，再动任何代码。 见上：sys_job 的消费者是 service-job，sys_report_schedule 的是 plugin-reports。逐个读它们拿到 Mars/Olympus / UTC+8 / China Standard Time 时做什么。

② valueDomain 与 maxLength 的性质完全不同，⛔ 不要一起处理。

• 卡片说得对：valueDomain: 'iana_time_zone' 属转换门类（与 min / max / maxLength 同类）——只有被写入的非成员被拒，已存值从不被重读 ⇒ 无数据迁移、无 ADR-0087 处方。
• 但把 sys_job 的 100 收到 64 不是同一件事：它可能拒绝一个已存储的值。卡片自己点了名："Narrowing 100 → 64 on sys_job needs the check-keyed-text-bounds family and a look at what the column physically holds."
  ⚠️ 这与本轮同批路由的 The E3 standard needs three written published boundaries — .js.map sourcesContent, @objectstack/spec’s shipped src/**/*.zod.ts, and whether it reaches a defect the round did not cause #15905 问题 3 是同一个危险，那张卡对同一列作出的判断本席在此重申并背书：「当轮修掉」不可能意味着「发运一次未经测量的已发布边界收窄」。 ⇒ ⛔ 在没有实测那一列装着什么之前，不许收窄 100。
  ⇒ 建议拆成两步：第一步只加 valueDomain（安全、无迁移）；第二步的边界收敛单独评估。

③ 默认值不要统一。 卡片说得对：默认是消费者语义（sys_report_schedule 说 UTC，sys_job 什么都不说）——除非读者另有说法，各自保持。 ⛔ 顺手给 sys_job.timezone 加一个 'UTC' 默认，会改变今天「未设置」这个状态的含义。

⭐ 卡片给的 64 这个数是论证过的，不是拍的：枚举里最长的名字在本仓 Node 基线上是 30 个字符（America/Argentina/Rio_Gallegos），最长的 tzdb link 是 32（America/Argentina/ComodRivadavia），且 tzdb 把每个路径段限制在 14 ⇒ 64 是该域实际上限的两倍。⚠️ 本席未复核这三个数，但这是一个可复核的论证，而不是一个惯例。

已发布面（卡片已测，本席未复核）

两列都在构建出的 packages/platform-objects/dist/audit/index.js / index.mjs（timezone ×2）与 dist/audit/index.d.ts / index.d.mts（×3）里；content/docs/** 对这两列 timezone 的提及为 0。⇒ 按 dist 测量它是已发布面，且是一个文档缺席的已发布面。

⚠️ 这条正是本轮同批 #15905 问题 2 争论的那个测量口径（E3 标准的三个 glob）。⇒ 若 #15905 的裁决改变了「已发布」的定义，本卡的评审层级可能随之变化。⛔ 两卡不重复（本卡是具体两列，那张是口径），但取卡人应知道它们相关。

Refs：#14238（裁决 A，本卡被明确排除在其范围外）· #14168 / #15161（引入 valueDomain 的两次落地）· #15905（E3 口径，含本卡这两列作为其问题 3 的具体案例）。

---

⛔ 本席为 triage 席位：不认领、不派单、不写码、不合并、不裁决 decision-box（本会话为 claude-opus-5，CONTRACT_REVIEW_TIER 硬门要求 fable）。

---

Generated by Claude Code

[claude]

Claim: domain:engine execution seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ
Branch: claude/issue-15872-timezone-value-domain
Clause-②: yes

Base: dacb73f4fc3cd3b3ad55d766047b1e4d6f2c521a (origin/main at claim time), dedicated worktree.

Clause-②: yes — the diff declares valueDomain on two columns of two isSystem objects in the published package @objectstack/platform-objects, i.e. it changes a declared shape that reaches dist/audit/**. needs:contract-review is already on this card (hung at triage 2026-09-06T05:15:12Z) and will also be hung on the PR, so the gate is carried on both carriers. This seat does NOT clear that label and does NOT release the PR.

Plan, in the order the triage comment's three hard constraints impose:

1. First step FIRST, before any declaration is touched: read what service-job does with sys_job.timezone and what plugin-reports does with sys_report_schedule.timezone when the stored value is not an IANA member. That measurement decides the severity and is reported whatever it says.
2. valueDomain: 'iana_time_zone' on both columns — the transition-gate class, no data migration.
3. The 100 -> 64 bound convergence on sys_job as a SEPARATE commit, landed only if what the column can physically hold is actually measured; otherwise it is dropped and reported as a decision for the PM, and the card stays open.
4. Defaults are NOT converged (sys_report_schedule keeps 'UTC', sys_job keeps none).

Note for the PM: the assignees field on this card was empty when this seat arrived (read via REST at claim time). Per the standing contract this seat never writes assignees; recorded here as a PM-side half state, not as permission.

---

Generated by Claude Code