fix(metadata-protocol): a cel-dated seed row reaches every hook in its temporal field's stored form

[objectstack-fleet]

Part of #22301
Clause-②: no

This PR carries stage 1's item 9 only: a cel-dated seed row reaches every hook in the stored form of its temporal field, so bootStack stores the rows objectstack dev stores. Item 1 (the handle mounts what requires names) was implemented and measured on this branch, and it is held back: as built, it stops every showcase boot in the dogfood gate. How the handle treats an app's own plugins array goes to a decision first (details below). Items 2 to 8 stay on the card for later stages.

Item 9: what the two boots handed the hook

Measured on origin/main 28bff18, one bootStack of a two-object app: a date field and a datetime field, seeded with daysFromNow(1) / daysFromNow(2) as cel expressions and with literal ISO values.

hook form	saw for the cel date value	saw for the literal row
in-process handler (a source config, what bootStack boots)	a JS Date object, 2026-10-09T00:00:00.000Z	'2026-10-10' (string)
sandboxed body (the compiled artifact objectstack dev boots)	'2026-10-09T00:00:00.000Z' (string, a full instant on a date field)	'2026-10-10' (string)
stored by the SQL driver	'2026-10-09'	'2026-10-10'

So the two boots hand the hook different values. The app's hook is not the divergence. hotcrm's campaign_validation reads the dates only when they are strings, so it accepted the rows under objectstack dev and refused them under bootStack. The divergence starts one step earlier: resolveSeedRecord evaluates the expression to the Date the cel stdlib returns (ADR-0053 D1), and the seed loader handed that Date to the engine as-is. Neither hook form then saw the value the column stores.

Where it lands, and why: packages/metadata-protocol/src/seed-loader.ts (a domain:engine file; the claim names it for this case). Right after resolution, each Date on a date / datetime / time field is put into its stored form by temporalStorageForm (@objectstack/core). That is the one rule the drivers apply on write, so the loader carries no second copy of it. A non-temporal field, an undeclared field and an Invalid Date are handed over unchanged. packages/verify and packages/formula are not touched: the verify boot's seed path is the shared loader, and resolveSeedRecord has no field types to work with.

What changes: both hook forms now see the stored form ('2026-10-09' for a date). A body hook on a date field sees 2026-10-09 where it saw 2026-10-09T00:00:00.000Z. Stored values do not change on any driver, because each driver already normalises a declared temporal field on write: driver-memory through the same temporalStorageForm, driver-sql and the two drivers that extend it (driver-sqlite-wasm, driver-turso) on their own write path, and driver-mongodb through its coerceTemporalValue. Changeset: @objectstack/metadata-protocol patch.

Pin: packages/verify/src/harness.seed-temporal-form.test.ts boots through the real handle. It asserts that the cel rows are stored, that the handler and the body each see exactly the stored value, that a hook requiring string dates (hotcrm's shape) lets the row through, and that the literal control rows are unchanged.

Ablation, at e83540e29, through scripts/ablation-replace.mjs:

• Mutation leg. The call was swapped for a no-op call carrying a marker. metadata-protocol was rebuilt, and ablation-dist-preflight found the marker in 2 built files. Result: 4 failed / 1 passed. The control passed. The guarded hook logged [SeedLoader] Failed to write stf_guarded record #0 (name=guarded-cel): both dates are required, which is hotcrm's failure reproduced.
• Restore leg. Blob 097d4adee50f equals HEAD, and git diff HEAD is empty. After the rebuild the marker is absent from all 24 built files and the tree is clean. Result: 5/5 passed.
• A first mutation attempt (a bare void statement) did not build. The unused helper failed the d.ts pass, and the preflight found no marker. That run's reading is void and is not counted above.

Item 1: implemented, measured, held

What was built and measured, kept in this branch's history at ef5396ca2 and reverted at b3186ec18:

• H1, the home: @objectstack/core. The measured graph: @objectstack/cli depends on @objectstack/verify, so the CLI cannot be the home, and an @objectstack/cli subpath would close a cycle. Both packages already depend on @objectstack/core, which owns the package ordering (resolveArtifactPackageOrder) that the requires reader is built on. CAPABILITY_PROVIDERS, CapabilitySpec and providesCapability moved there. So did the reader stackDeclaredCapabilities and its rule (resolveStackCollection, from packages/cli/src/utils/stack-collections.ts). Serve.CAPABILITY_PROVIDERS and Serve.providesCapability became handles over the core declarations, pinned by identity (toBe), and the CLI drift tests were re-pointed. There was no second copy.
• H2, the reader. bootStack read requires through stackDeclaredCapabilities. Pins covered the top level, the package bodies, the top level winning over the bodies, and a control. A caller's instance won (extraPlugins), and hard dependencies came along (triggers brought job and queue). Every provider package in the table became a dependency of @objectstack/verify, with no cycle (measured over deps, devDeps and peers). The pins were 7/7 green. With the mount removed by ablation, 4 went red, while the control, explicit-wins and manifest cases stayed green. Afterwards the blob equalled HEAD. The CLI unit and integration pins over the moved code were 260/260 and 11/11.
• The blocker, measured. pnpm --filter @objectstack/dogfood exec vitest run --project shared-showcase failed 13 of 13 files at bootstrap: connector instance 'showcase_status_api' declares provider 'rest', but no provider factory is registered. The showcase declares requires: ['automation', …]. Automation's start materializes the app's connector instances (ADR-0097). Their providers sit in the showcase's own plugins array, which objectstack serve mounts and bootStack never has. An uncommitted experiment that also mounted the app's plugins instances moved the refusal one layer: providerConfig.spec './src/system/connectors/status-openapi.json' … resolved to '/tmp/os-dogfood-run-…'. serve anchors automation's packageRoot at the config's directory, and the handle only knows hostRoot. 117 dogfood files boot the showcase directly, and 11 of them pass a connector plugin. For hotcrm, which carries no plugins array, the same implementation boots green.

The open question is how the handle treats an app's own plugins array: mount it as serve does, keep it the caller's, or put the whole requires mounting behind an option. It is in the card report with each option's cost.

Tests (at e83540e29)

• pnpm --filter @objectstack/verify exec vitest run --maxWorkers=2: 19 files / 138 tests passed.
• pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2: 223 passed, 3 skipped files; 28,338 passed, 19 skipped tests.
• typecheck for @objectstack/verify and @objectstack/metadata-protocol: green, with test-layer debt unchanged.
• Gates: dispatch-gates --commands derived 62 commands on this tree. All 62 were run and exited 0. --ran reports 62 derived, 62 run, 0 NOT-MEASURED and 0 UNRUN.
• Lint, narrowed: eslint --no-inline-config over the 2 changed TypeScript files (the population eslint.config.mjs's **/*.{ts,…} / packages/**/*.{ts,…} objects match), counted from --format json: 2 files, 0 errors, 0 warnings. The config enables no type-aware linting, so this diff cannot move the verdict of any untouched file. The full pnpm lint is CI's.
• NOT MEASURED locally: the full dogfood suite and the integration tiers. Both are CI's.

Acceptance notes

• bootStack constructs its AnalyticsServicePlugin without the app's analyticsCubes, and serve passes them. This is a boot-parity gap in the same family as item 1, named in the card report for a later stage.
• A literal JS Date written into a source-config seed now reaches hooks in stored form. The same seed compiled to an artifact arrives as a JSON ISO string, which the loader leaves unchanged. Cel values agree in both boots, but literal Dates still differ by form. No producer of that shape was measured.
• The engine's private resolveNowDefault carries its own date / time / instant table beside temporalStorageForm. The two agree today. This is an observation, with no carrier.

Patch round (contract review FAIL 6069291830 → seat order 6069311153 → 792bcc71d)

Written into this body by the domain:spec seat 2 at 2026-10-08T21:30Z. The comments before it on this PR are read: the docs-drift bot's, and the contract review this round answers.

• The changeset's sentence "The in-memory driver now stores the string instead of a Date object" was false, because driver-memory already normalises every declared temporal field on write (toStorageForms → coerceTemporalValue → temporalStorageForm). It is replaced with: stored values do not change on any driver, because each driver already normalises a declared temporal field on write. The dev read driver-memory and driver-mongodb before writing it, and the seat confirmed that driver-sqlite-wasm and driver-turso extend SqlDriver. The "What changes" line above is corrected the same way.
• One changeset commit (+1 / -1), no code. The 20 changeset/text gate families, plus check-changeset-fixed.mjs and check:empty-changeset, all exit 0. main was not merged (the push was accepted).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 54c3ce10ce8cf89290b67813c34d1f10dbab6938 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 6d1c0919a99a1fe297497a0d00d27338107d2924 — the merge of head 792bcc71daec25c295af3ec98ef690007fef9488 into base 54c3ce10ce8cf89290b67813c34d1f10dbab6938, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 6d1c0919a99a1fe297497a0d00d27338107d2924 && git checkout 6d1c0919a99a1fe297497a0d00d27338107d2924
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 54c3ce10ce8cf89290b67813c34d1f10dbab6938 792bcc71daec25c295af3ec98ef690007fef9488 && git checkout -B drift-repro 54c3ce10ce8cf89290b67813c34d1f10dbab6938 && git merge --no-ff 792bcc71daec25c295af3ec98ef690007fef9488

node scripts/docs-audit/affected-docs.mjs --json 54c3ce10ce8cf89290b67813c34d1f10dbab6938

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e83540e29658e17c24373cec7551376978048f03
Local-runs: none

Inputs: card #22301 (body and all 8 comments, 6061416383 through 6069107079), PR #22353 (body, 3-file list, net diff against the merge base 35afb1587 — .changeset/22301-seed-temporal-stored-form.md +16, packages/metadata-protocol/src/seed-loader.ts +39/-1, packages/verify/src/harness.seed-temporal-form.test.ts +147), and the 33 check-runs on this head. Nothing built, run or re-run; the code the diff calls into was read at this head with git show.

① Derived judgments

1. Accept set: unchanged — RIGHT. The loader accepts the same seed shapes it did; no key is added or removed, no row that loaded before is refused now, no refusal is added. The change is to the FORM of a value the loader hands on, after resolution and before any hook. So Clause-②: no with no arm is the truthful reading (not a widening, not a narrowing of a published accept set).
2. Public surface of @objectstack/metadata-protocol: unchanged — RIGHT. seedValuesInStoredForm is module-private; nothing is exported, renamed or removed. check:api-surface sits inside the green Lint & Repo Gates.
3. The published behaviour that does change: what a hook receives from a seed write — RIGHT, and named in the changeset. Every Date on a declared date / datetime / time field reaches beforeInsert / beforeUpdate hooks as the ADR-0053 stored form (YYYY-MM-DD, UTC ISO instant, HH:MM:SS). An in-process handler sees a string where it saw a Date; a sandboxed body on a date field sees 2026-10-09 where it saw 2026-10-09T00:00:00.000Z. This is a fix, not a narrowing: one value had two forms depending on how the hook ran, and neither was the stored form a REST write of the same row hands the hook. The changeset body states the FROM → TO.
4. "The one rule the drivers apply on write, no second copy" — RIGHT. The diff imports temporalStorageForm and temporalComparandKind from @objectstack/core (both export * from core's index; core is already a dependency of metadata-protocol). No table of its own.
5. "Non-temporal, undeclared and Invalid Date values are handed over unchanged" — RIGHT. temporalComparandKind answers null for every type but the three; the diff only converts on a non-null kind. temporalStorageForm returns an Invalid Date unchanged on all three arms (its documented totality). A null objectDefinition short-circuits the helper, as before.
6. "Stored values on SQL drivers do not change" — RIGHT. temporalStorageForm is idempotent on its own output (a YYYY-MM-DD string, an ISO instant, an HH:MM:SS), and SqlDriver.formatInput applies that same rule on write, so the column receives the same text it did.
7. "The in-memory driver now stores the string instead of a Date object" (changeset body, last paragraph; PR body, "What changes") — WRONG. Not measured by the dev (the measurement table covers the SQL driver only), and the code at this head says the opposite: @objectstack/driver-memory puts every declared temporal field into temporalStorageForm on every write door (create, bulkCreate, update → toStoredRecord → toStorageForms, over the index syncSchema builds with indexTemporalFields; the engine's syncSchemas calls syncSchema at boot). So for a declared temporal field the in-memory stored value was already the string, and this diff does not change it. For a field the object does not declare, the loader leaves the Date as resolved, so nothing changes there either. The sentence describes a change the diff does not make, and it ships to consumers as CHANGELOG.md.
8. Every seed mode is covered — RIGHT. The call sits right after resolveSeedRecord and before the insert / update / upsert branch, so an update-mode row's beforeUpdate hook sees the same form.
9. Reach — observation, not a defect of this diff. The fix covers the SeedLoaderService path. AppPlugin's raw-insert fallback (no metadata service, or the loader throwing) still hands the raw record to engine.insert with the cel envelope unresolved; that is the path behind the card body's original "must be a valid datetime (ISO-8601)" WARNs. It is pre-existing, outside this claim's file surface, and the card's later measurements (6064196637: 46 [SeedLoader] Failed to write lines per boot, the app hook's own refusal) put the hotcrm refusal on the loader path, which this diff reaches and the pin reproduces (stf_guarded).
10. packages/formula and packages/verify source untouched — RIGHT. resolveSeedRecord has no field types to apply a storage rule with; the verify boot's seed path is the shared loader.
11. The pin — RIGHT. End to end through the real bootStack (default sqlite-wasm), imports only ./harness.js, so no cross-package test input. @objectstack/verify depends on @objectstack/runtime, which depends on @objectstack/metadata-protocol, so a loader change re-runs it under turbo. The ablation reading (4 failed / 1 passed, control green, the hotcrm-shaped refusal reproduced; restore leg equal to the HEAD blob) is consistent with the five assertions.
12. Docs — RIGHT, none owed. content/docs/data-modeling/seed-data.mdx (Dynamic Values) names the functions and scope and states nothing about the form a hook receives; the Docs Drift Check lists nothing. No governed surface is touched.

② Semver level

• @objectstack/metadata-protocol: patch — right. A bug fix in a released package, never skip-changeset (the diff publishes source). packages/verify receives a test file only, which is not published, so it is rightly ungraded.
• Clause-②: no, no arm — right for this net diff (① items 1–3). The claim's yes (widening: bootStack mounts the providers …) belonged to item 1, which is reverted at b3186ec18 and absent from the net diff; no is the truthful reading of what lands. The line is present in both carriers (PR body and changeset), and Check Changeset is green.
• The changeset body does not match what the diff publishes in one sentence — ① item 7. The level and the declaration are right; the body asserts an in-memory storage change this diff does not make. Remedy: delete that sentence from .changeset/22301-seed-temporal-stored-form.md (and the matching line in the PR body), or replace it with the measured statement — stored values do not change on any shipped driver; only what a hook receives changes — then push and take a fresh record on the new head.

③ Boundary flags

Dev report 6068984639, each flag:

• Scope: item 9 only; item 1 built at ef5396ca2 and reverted at b3186ec18 — answered. The net diff is the three files above; packages/verify/src/harness.ts is untouched; item 1's pins are not in the diff and are not judged here.
• PR Clause-②: no against the claim's yes — answered, right (②).
• Pin wording changed from "sees what it sees under serve" to "both forms see the stored form" — answered, right: the serve/dev body form was itself a full instant on a date field, not the stored form; equality with what the column stores is the invariant that holds across hook forms and across a REST write of the same row.
• Landing in domain:engine (seed-loader.ts), not packages/verify — the claim (6066102918) named this case conditionally; the seat review (6069096132) states the declaration on [PM seat] domain:engine — ⏳ vacant #6367 as 6069064251. That declaration is outside this record's inputs and is recorded here as the seat's statement, not verified.
• origin/main merged twice; the uncommitted harness.ts experiment restored to the HEAD blob; a first gate battery overlapping the second — answered: judged on the net diff and on the check-runs of this head, which are the gate verdicts; the harness file shows no change in the diff.
• hotcrm shallow-cloned read-only and removed — no boundary crossed.
• open_questions[0] — how bootStack treats an app's own plugins array once it mounts requires — escalated, not ruled: the seat put it to the maintainer on the card (6069107079, options A / B / C, recommendation A). This diff does not depend on the answer.
• Out-of-scope findings — AnalyticsServicePlugin without analyticsCubes: folded into the card as a later-stage item by the seat (6069096132), accepted. A literal JS Date in a source-config seed vs the artifact's JSON ISO string: a note with no producer, and the docs already forbid a literal new Date() in a seed; accepted as a note. The engine's private resolveNowDefault table beside temporalStorageForm: pre-existing, not this diff; accepted as a note. The local turbo build failure at @objectstack/setup: not on this head (Build Core green); accepted.

Check-runs on this head at the time of this record: 29 success, 3 skipped (Console Pin Gate, Build Docs, Packed-tarball smoke (opt-in)), and Test Core (1/6) still in progress — one gate verdict is outstanding and is not assumed here.

Implemented-by: claude/issue-22301-verify-boot-parity
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: FAIL

FAIL reason (one): the changeset body — and the PR body's "What changes" — asserts that the in-memory driver now stores the string instead of a Date, a behaviour change this diff does not make (① item 7). Everything else in ①, ② and ③ is right; the fix is a one-sentence edit and a fresh record on the new head.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 792bcc71daec25c295af3ec98ef690007fef9488
Local-runs: none

Read at 2026-10-08T21:39Z, read-only: card #22301 (body and all 9 comments), PR #22353 (body, 3-file list, net diff of the head against main at merge-base 35afb1587), and the check-runs on the head. The head was fetched into a ref of its own and read with git show / git diff; nothing was built, run or re-run.

① Derived judgments

1. packages/metadata-protocol/src/seed-loader.ts — seedValuesInStoredForm, called once per resolved row before any write. Every mode takes the same record after the call: writeRecord (insert / update / upsert / ignore) and the bulk pendingInserts path. A JS Date on a field whose declared type is date / datetime / time becomes temporalStorageForm(value, kind) from @objectstack/core, with kind from temporalComparandKind; both are exported from core's index and core is already a dependency of metadata-protocol (no manifest change owed). A non-temporal field, a field the definition does not declare, a definition the loader could not resolve (objectDefinition == null) and an Invalid Date are handed over unchanged, because the rule is total. One rule, the drivers' own, no second copy; fixed at the producer with no consumer alias — right (Prime Directive Add comprehensive test suite for Zod schema validation #12 shape).
2. Accept-set of the loader: unchanged. The same seed records are accepted and the same are refused; no new input shape is admitted. Clause-②: no with no arm is the truthful reading — right.
3. What a hook observes during seed replay (public behaviour of the published loader) changes form, in both hook forms: an in-process handler saw the Date object; a sandboxed body saw the JSON-bridged full instant, even on a date field. Both now see the ADR-0053 stored form (YYYY-MM-DD for a date, the UTC ISO instant for a datetime, HH:MM:SS for a time). Judged a fix, not a narrowing: ADR-0053 fixes one logical stored form per temporal type, the old forms were off-contract and differed from what a REST write of the same row hands the same hook, and a hook that keyed on the full-instant spelling of a date field was reading a shape the contract never promised. The changeset names the one visible change in one sentence — right.
4. Stored values: unchanged on every driver — verified at the head rather than taken from the body: driver-memory normalises on write through toStorageForms → coerceTemporalValue → core temporalStorageForm (memory-driver.ts about :2486–:2501, memory-temporal.ts:40–:53); driver-sql through formatInput on insert, update, upsert and bulk (sql-driver.ts:7508, :8737, :9499, :9900) with temporalStorageForm; SqliteWasmDriver extends SqlDriver (sqlite-wasm-driver.ts:67) and TursoDriver extends SqlDriver (turso-driver.ts:1586); driver-mongodb through coerceTemporalValue on write (mongodb-driver.ts:866). The corrected changeset sentence is true, and the sentence the earlier round failed on (card comment 6069311153) is absent from the net diff (0 hits) — right.
5. Replay idempotence (isNoOpReplay / seedValueEquals): neutral. Before, a Date against the stored string compared by instant; after, string against string compares by identity. No replay that was a no-op stops being one, and none starts — no changeset text owed.
6. packages/verify/src/harness.seed-temporal-form.test.ts: test only, publishes nothing. It boots the real bootStack → AppPlugin → the shared SeedLoaderService (so the verify boot's seed path is the shared loader, as the body claims), covers the three hook shapes (in-process handler, sandboxed body, hotcrm's string-only guard) with literal rows as controls, imports only ./harness.js and @objectstack/spec (no path escapes, so no cross-package-test-input spelling is owed), and the as never on defineStack is this package's established idiom (8 sibling tests). The pin asserts exactly the card's item 9 acceptance ("a verify boot of an app with cel-dated seeds stores those rows") plus the equality of the two hook readings — right.
7. Nothing of item 1 is in the net diff: 3 files, +202 / −1; 0 hits for CAPABILITY_PROVIDERS / stackDeclaredCapabilities / providesCapability; no packages/cli, no packages/verify source, no new @objectstack/core export. ef5396ca2 is reverted at b3186ec18 on the branch history, as the body says — right.
8. Citations hold: ADR-0053 D1 is the section that has today() / daysFromNow() / daysAgo() return a Date; now() is () => Date and the two day functions resolve through addDaysUtc (formula/src/stdlib.ts:235–:256), so the four functions the changeset names are the ones that produce the Date — right.
9. No governed surface in the file list; Governed Surface Queue Guard is success. Not Tier S, not Tier H; this record is owed on the claim's Clause-②: yes and the hook-input form change, not on a governed path.
10. Reach, as the card measured it: hotcrm's campaign_validation refusal (46 [SeedLoader] Failed to write lines per bootStack, card comments 6063450774 / 6064196637) sits on the loader path this diff fixes. The AppPlugin raw-insert fallback named in the card body is a different, pre-existing path and is not touched here — recorded, not a finding against this head.

② Semver level

• .changeset/22301-seed-temporal-stored-form.md grades @objectstack/metadata-protocol patch. That is the only published package whose source the diff moves (17.7.0, not private). packages/verify receives a test file only, so nothing publishes from it and no second changeset is owed. skip-changeset does not apply and is not used — right.
• Clause-②: no, no arm, in the PR body and in the changeset body. No accept-set is widened and no public surface expanded (①.2); no narrowing (①.3). A patch is the level no permits, and Check Changeset concluded success on both of its runs on this head. The claim's yes (widening: …) belonged to item 1, which this net diff does not carry; the declaration follows the diff, which is what the gate reads — right.
• Not breaking, so no BREAKING banner and no ADR-0087 disposition is owed — right.
• The changeset text ships as CHANGELOG and was read sentence by sentence against the diff: each sentence holds (①.4 for the driver sentence, ①.8 for the four functions, ①.1 for the unchanged cases).

③ Boundary flags

Dev flags (PR body "Acceptance notes"; report 6068984639 out_of_scope_findings and deviations):

• F1 — bootStack builds AnalyticsServicePlugin without the app's analyticsCubes, which serve passes. Same boot-parity family as item 1; the seat folded it into the card as a later-stage item (6069096132). Answered: not this diff, no further carrier owed.
• F2 — a literal JS Date in a source-config seed now reaches hooks in stored form, while the same seed compiled to an artifact arrives as a JSON ISO string the loader leaves unchanged. The artifact side is pre-existing and outside this diff; no producer of that shape was measured. Answered: it stays an acceptance note under Prime Directive chore: version packages #10 (a note until a producer is measured); the moment one is, it is item 9's class and takes its own card. Not blocking.
• F3 — objectql's private resolveNowDefault keeps its own date / time / instant table beside temporalStorageForm; they agree today. A second copy of a rule is drift risk, outside this diff. Answered: noted, no carrier. Not blocking.
• F4 — a local turbo run build --filter=@objectstack/cli failure (TS7016 at @objectstack/setup). Local build state, not reproduced on a clean tree; Build Core is success on the head. Answered: nothing to carry.
• Deviations: scope is item 9 only (right — the PR is Part of #22301, and Part-of PR must not also close its card is success); Clause-② no against the claim's yes (right, ②); the landing in domain:engine is declared on [PM seat] domain:engine — ⏳ vacant #6367 per the seat (6069096132) — that thread is outside this review's inputs and is not re-verified here; origin/main merged twice with every final reading at e83540e29, and the patch commit 792bcc71d touches the changeset alone (1 file, +1 / −1, verified) so those readings carry to this head; the uncommitted harness.ts experiment was restored to the HEAD blob and the net diff confirms no harness.ts change.

open_questions[0] — item 1: how bootStack treats an app's own plugins array once it mounts what requires names (A / B / C). ESCALATED, not ruled here. The seat's four-axis analysis is on the card (6069107079) and the card moves to needs-user-decision after this PR lands. The net diff carries none of item 1 (①.7), so the question does not bear on this head; this review takes no position on A / B / C.

Check-runs on the head at this read — every completed run is green: Lint & Repo Gates, TypeScript Type Check (and its source / consumer / debt-ledger / workspace legs), Build Core, Dogfood Regression Gate (1/3, 2/3, 3/3 and the rollup), Dogfood Verify CLI, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard, Check Changeset, Check Documentation Links, Check PR Size, the four claim / single-writer / part-of guards, Test Core (2/6) to (6/6); Console Pin Gate, Build Docs and Packed-tarball smoke are skipped by their filters. Still pending at this read: Test Core (1/6), in_progress. Landing waits for it under its own rule (every check green); this record's verdict is on the contract and does not stand in for it.

Implemented-by: claude/issue-22301-verify-boot-parity
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: PASS

---

Generated by Claude Code