feat(i18n): render instants in the served display zone (objectui#11693)

[objectstack-fleet]

Part of #11693

Clause-②: yes

The console's localization fetch dropped the timezone that GET /api/v1/auth/me/localization answers. It now carries it, and every date and datetime face built on @object-ui/core's date-display functions renders an instant in that zone. A date-only value keeps the day it names, and with no zone every face renders in the viewer's zone, as before.

Gate: this PR merges only after #11758 closes. That is the director's ruling 6030273339 on #11693: letter B with gate B2, on the maintainer's delegation 「总监决裁」. The server answers UTC for a workspace that configured no zone, so this PR alone would move those workspaces' datetimes from the viewer's zone to UTC. #11758 first asks an administrator, once, to set the workspace timezone (pre-filled with the browser's zone, confirm to write). The PR stays draft until #11758 closes. Then the domain:ui seat re-checks it (Unlock-action: re-check PR #11729 on #11693), runs the at-tier contract review, and queues it. Nothing in this PR changes for the ruling. (Gate line added by domain:ui seat 3, session_01CGZy1BGCjdN5cXqL9cnvB8.)

Measured first, on origin/main 7300fca, before the change

1. Does any renderer already take a zone from elsewhere? Search: git grep -n -i -E 'time_?zone' -- 'packages/*/src/**' 'apps/console/src/**' without tests and locale packs, 60 lines in 19 files. No renderer reads a session zone or a per-field zone. The hits that carry a zone are plugin-gantt's per-view GanttConfig.timeZone (its chart frame, makeTzShift), the report schedule's timezone, job and flow previews in metadata-admin, and the settings page's iana_time_zone domain. The rest are comments. Control: the same search hits the console's own MeLocalizationResponse.timezone, the declaration the card says is dropped, so it reaches the file in question.
2. Which formatters render the console's datetimes? formatDate, formatDateTime, formatDateTimeCompactParts and formatRelativeDate in @object-ui/core (utils/date-display.ts). The field cells and widgets, the data-table cell, gantt tooltips, grid and dashboard dates and the dataset measures all call them, threading { locale } from useDisplayLocale() and no zone. The i18n formatters the card names (utils/formatting.ts, and formatDateSpec, which already takes a timeZone) have no caller outside @object-ui/i18n in source: git grep -n -E '\b(formatDateTime|formatDateTimeCompactParts|formatDateSpec|applyLocaleConfig)\(' over non-test source. So the zone is implemented where the faces are, in core. Handing it to formatDateSpec would reach no renderer.
3. What does the server answer? objectstack resolveCurrentUserLocalization (plugin-hono-server, current-user-endpoints.ts):
   • timezone is the workspace's localization.timezone (platform default, then global, then tenant), typed "Always a string — the cascade's floor is UTC".
   • That floor is pinned by the test "with nothing configured: the time-zone floor answers, and currency is the one value that stays null".
   • The settings row is Default timezone, default: 'UTC', described as the "IANA zone used to resolve today()/daysFromNow, analytics date buckets, and rendered datetimes".
   • There is no per-user zone: sys_user declares none, and the manifest puts per-user overrides out of scope for v1.

The change

• @object-ui/core date-display.ts. A display zone: setDisplayTimeZone, getDisplayTimeZone, subscribeDisplayTimeZone.
  • Every face renders an instant in it: both datetime faces, the date faces' day and current-year test, and the relative face's day count and "today". With none set, each face builds the same Intl options as before.
  • A date-only value never takes the zone. toDisplayDate and toInclusiveEndDay register the calendar-day Dates they build (a WeakSet), so the exemption holds when a caller hands that Date on, as GridField's date cell does.
  • A name the runtime's Intl does not know clears the zone with a warning, rather than making every face throw.
• @object-ui/i18n LocalizationContext.tsx. LocalizationValue.timezone. LocalizationProvider hands it to core in a layout effect and reads the applied zone back with useSyncExternalStore. Its context therefore changes only after the faces have the zone, and every consumer re-renders in it before paint.
• Console LocalizationFetchProvider.tsx. Keeps timezone from the answer.
• No renderer changed: the zone enters through the shared faces only.
• Docs: the core and i18n READMEs, and the datetime field guide. Changeset: minor for core, i18n and the console.

Why one ambient zone rather than a timeZone option at each call site. About twenty call sites in seven packages thread { locale } today. Threading a zone the same way would leave any forgotten call site rendering the same instant in a second zone beside the first, which is objectui#4272's shape for the locale. It would also edit packages/fields/src/widgets/*, which objectui#11689 is editing in parallel.

Tests, at 229db2b

• New pins: date-display.displayZone-11693.test.ts (core, 16), LocalizationContext.timezone-11693.test.tsx (i18n, 5), and two cases in the console's LocalizationFetchProvider.test.tsx. The suite runs in UTC, so UTC stands in for the browser's zone.
  • With America/Los_Angeles set, 2026-09-02T03:00Z renders Sep 1, 2026, 08:00 PM. With none set, it renders Sep 2, 2026, 03:00 AM.
  • A date-only 2026-09-01 renders Sep 1 under the west zone on every face, including the Date from toDisplayDate and the inclusive end day. Control: the same instant as a plain Date renders Aug 31.
• Core, i18n and the console fetch tests: pnpm exec vitest run packages/core/ packages/i18n/ apps/console/src/LocalizationFetchProvider.test.tsx apps/console/src/__tests__/localizationBootDedup.test.tsx gives Test Files 281 passed (281), Tests 5257 passed | 40 skipped. This includes date-display.dateOnlyZone-10110, which spawns real TZ=America/Los_Angeles and TZ=Asia/Shanghai children over this module, so the relative face's rewritten day arithmetic is measured unchanged outside UTC.
• Consumers: 168 files in two runs, 82 passed | 2 skipped and 83 passed | 1 skipped (1116 and 1180 tests, 0 failed). They are every test that mounts LocalizationProvider or LocalizationFetchProvider, plus the date and datetime suites of the packages that call the faces (fields, components, plugin-grid, plugin-gantt, plugin-dashboard and others).
• Type-check: pnpm --filter @object-ui/core type-check and the same for @object-ui/i18n exit 0. The console's is narrowed (below).
• Gates, all exit 0: check:control-bytes, check:test-path-roots, check:changeset-claims (corpus: 1 changeset), check:pending-changeset-literals, check:new-line-citations (0 new), check:doc-fences, check:doc-example-ids, check:doc-example-readers, check:doc-types, check:phantom-deps, check:self-import, check-changeset-presence, and check-governed-queue-guard --test (NOT GOVERNED).
• Lint: eslint on the six touched source and test files gives 0 errors. Its 2 warnings are on lines that predate this branch.
• Declared narrowing, so NOT MEASURED here (CI builds what they need): the console type-check, check:readme-exports, check:doc-snippets and check:doc-examples read every package's built dist/, and 32 packages are unbuilt here (the three gates exit "could not run"). In their place:
  • The two console files and the two new README snippets, copied verbatim, compile with the console's own tsconfig against built core, i18n and auth: exit 0. Reverse check: a misspelt timezone key reds as TS2353, so the compile reads the rebuilt LocalizationValue.
  • check:readme-exports --json, filtered to the core and i18n READMEs: 0 findings, with 96 self-imports judged real and 0 fabricated. Control: the same filter finds 22 entries for app-shell's unbuilt README.

Ablations

One-time proofs, run through ablation-replace.mjs (the mutation must land on disk). Each was restored to HEAD, proved by blob hash and an empty git diff HEAD.

mutation	expected	observed
console drops timezone	the served-zone pin reds	1 failed / 13 passed
toDisplayDate stops registering its calendar day	the date-only pins read Aug 31 or Yesterday; the inclusive-end pin and the control stay green	4 failed / 12 passed, exactly those
toInclusiveEndDay stops registering	its pin alone reds	1 failed / 15 passed
the default datetime face takes no zone	its two core pins and the two provider pins that render it red	4 failed / 17 passed
the provider does not hand the zone to core	three provider pins and the console pin red	4 failed / 15 passed
the context keyed on the prop zone, not the applied one	consumers render before core has the zone and are never re-rendered: the context says America/Los_Angeles while the face still renders 03:00 AM	3 failed / 2 passed
i18n hands setDisplayTimeZone a number	i18n type-check reds from core's rebuilt declarations	TS2345

The first attempt at the fourth row was refused by the tool and ran nothing, because its replacement text was a substring of its anchor. It was rerun with a distinct marker.

Open question that gates the merge

The card asks: "with none set, it renders in the browser's". The wire never says "none": a workspace that configured no zone is answered UTC, the cascade floor above. Merged alone, this PR moves every such workspace's datetimes from the viewer's zone to UTC. The client code here is the same under A, B and D; D adds one line in the fetch provider.

• A, the server says "none". The endpoint answers timezone: null when only the default answered (the settings service reports source: 'default'). Server-side TODAY() and buckets keep their UTC floor, and unconfigured workspaces keep the viewer's zone. This reverses the endpoint's pinned "never null" for timezone.
• B, keep the floor. The configured-or-default zone governs rendered datetimes, as the settings row's description already states. Unconfigured workspaces render in UTC, and display, TODAY() and analytics buckets share one zone. No further change.
• C, the client reads UTC as unset. Not offered: a workspace that really chose UTC would render in the viewer's zone, and it is the consumer-side tolerance AGENTS.md #0.1 forbids.
• D, a separate wire signal (for example timezoneSource). Additive, at the cost of one more field on the wire.

Recommendation: B. It honours the zone the settings contract already declares for rendered datetimes. It leaves one zone for display, TODAY() and buckets, with no client-only rule that "null means the browser". It needs no further change. The cost is that unconfigured workspaces show UTC until an admin sets the zone. If that is unacceptable, the lever is the default (provisioning, or the manifest's default), not a client fallback. A is the choice if the unconfigured workspace's experience outweighs one shared zone.

Acceptance notes

• Datetime renderers outside the shared faces do not take the zone. Per the card, they are reported here, not special-cased.
  • Instrument: git grep -n -E '\.toLocaleString\(|\.toLocaleTimeString\(|new Intl\.DateTimeFormat\(|\.toLocaleDateString\(' over non-test packages/*/src and apps/console/src, excluding date-display.ts and i18n's utils. It over-counts, because toLocaleString also matches numbers.
  • Examples: the record meta footer, comments, history and activity timelines, the audit log, gantt's chart frame and the calendar views.
  • In a workspace with a configured zone, these show browser-zone times beside zone-rendered cells; in gantt, that means a tooltip beside its bar.
• i18n's own date helpers (formatDate, formatDateTime, formatRelativeTime, formatDateSpec) do not read the display zone. They have no renderer caller in this repository, and the i18n README now says so.
• The core formula TODAY() still answers the UTC day. Its docblock names "a later card" for when the zone reaches the client; it now does (getDisplayTimeZone()).
• vitest.config.mts' header says the one zone-aware surface takes its zone from metadata. It is no longer the only one; that is comment text, not edited here.
• Pre-existing and order-dependent: scripts/__tests__/date-only-zone-pins-10183.test.ts reds on its FormulaFunctions.dateOnlyZone-10866 file (expected '2026-09-01 11:00' to be '2026-09-01 03:00').
  • Cause: the unit project runs with isolate: false. When vitest's results cache puts a file that leaves TZ east of UTC before it in a shared fork, the leaked TZ reaches it.
  • Two legs at 7300fca: with a fresh cache it passes 27/27; with the cache this branch had, it fails identically. This branch's runs fail the same way, so this diff is not the cause.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 331 chunks)	3326.0 KB	3330.4 KB
Main entry chunk (gzip)	154.1 KB	350 KB
Entry file	index-hJuQmyTF.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	17.82KB	6.58KB
app-shell (runtime-config.js)	22.52KB	7.86KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.11KB	3.87KB
auth (ActiveOrganizationStorage.js)	27.95KB	10.04KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.22KB	10.61KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.40KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.72KB	2.24KB
auth (SocialSignInButtons.js)	9.70KB	3.93KB
auth (UserMenu.js)	3.39KB	1.21KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.70KB	10.94KB
auth (createAuthenticatedFetch.js)	8.54KB	3.46KB
auth (index.js)	3.63KB	1.64KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	27.11KB	7.97KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.28KB	2.60KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.50KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	578.98KB	139.21KB
core (index.js)	10.00KB	3.96KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	233.72KB	64.83KB
fields (index.js)	262.75KB	66.62KB
i18n (LocalizationContext.js)	2.92KB	1.42KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	2.59KB	1.22KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.52KB	2.39KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	39.35KB	12.88KB
i18n (translateFn.js)	0.20KB	0.18KB
i18n (useDisplayLocale.js)	3.52KB	1.76KB
i18n (useObjectLabel.js)	35.66KB	9.49KB
i18n (useSafeTranslation.js)	7.14KB	2.92KB
layout (index.js)	41.18KB	11.71KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	6.62KB	2.45KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	5.52KB	2.10KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	13.86KB	5.00KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.52KB	2.26KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.33KB	3.07KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	16.04KB	3.92KB
plugin-calendar (index.js)	53.39KB	15.52KB
plugin-charts (index.js)	84.26KB	23.05KB
plugin-chatbot (index.js)	198.81KB	47.14KB
plugin-dashboard (index.js)	143.75KB	38.87KB
plugin-designer (index.js)	231.46KB	48.87KB
plugin-detail (index.js)	247.25KB	65.05KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	177.09KB	45.89KB
plugin-gantt (index.js)	179.16KB	45.06KB
plugin-grid (index.js)	238.48KB	65.51KB
plugin-kanban (index.js)	52.17KB	16.37KB
plugin-list (index.js)	116.72KB	29.10KB
plugin-map (index.js)	25.60KB	8.62KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	44.12KB	12.29KB
plugin-timeline (index.js)	38.90KB	11.74KB
plugin-tree (index.js)	15.07KB	5.33KB
plugin-view (index.js)	90.23KB	22.73KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.81KB	3.58KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	120.63KB	39.56KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.50KB	2.06KB
react (schema-input.js)	4.31KB	2.07KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (body-dialect.js)	4.50KB	1.99KB
sdui-parser (codegen.js)	9.45KB	3.76KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	7.30KB	3.12KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	25.28KB	7.80KB
sdui-parser (provenance.js)	3.84KB	1.90KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	23.87KB	7.83KB
types (ai.js)	4.39KB	2.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	4.12KB	1.61KB
types (authoring-nodes.js)	0.20KB	0.19KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (cloud.js)	0.20KB	0.18KB
types (complex.js)	4.44KB	2.07KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (dashboard-widget-layout.js)	2.06KB	0.96KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	1.13KB	0.65KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	5.78KB	2.70KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	5.00KB	2.39KB
types (navigation.js)	0.20KB	0.18KB
types (node-slots.js)	7.18KB	2.34KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	2.52KB	1.31KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	4.99KB	1.96KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	19.93KB	7.25KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.11KB	3.32KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[objectstack-fleet]

Gate pointer: this PR waits on #11758 · director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (via the relay) 2026-10-07T03:27Z

The ruling on #11693 (batch #283 item 3, letter B with gate B2, on the maintainer's delegation 「总监决裁」) lands this PR as built, after #11758 closes: the one-time administrator prompt that sets a defaulted workspace timezone from the browser's zone on confirm, so that merging this PR does not switch every unconfigured workspace's display to UTC. #11693 is pm:blocked with Blocked-by: #11758 and Unlock-action: re-check PR #11729. Nothing in this PR changes for the ruling. The state machine asks that a parked PR's body name its gate card; the domain:ui seat adds that line at its next edit.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 229db2b023402bf18cac0bfd06b8810d45c86895
Local-runs: none

Inputs: card #11693 (body and its five comments: claim 6018498275, dev report 6020328604, decision request 6020424601, ruling 6030273339, unlock 6031680930); PR #11729 (body, 10 files, net diff against merge-base 7300fca); the 43 check-runs on the head (40 success, 3 skipped: dependabot and the two coverage jobs, 0 failure); the main delta 7300fca...3bf8894 (30 commits). The one-mount reading under ③ item 3 is a grep over the main tree fetched as a zipball through REST: nothing cloned, built, run or re-run.

① Derived judgments

1. Console accept-set. LocalizationFetchProvider.tsx now keeps timezone: json.timezone ?? undefined beside currency and locale; MeLocalizationResponse.timezone?: string | null was already declared, so the fetch now carries every key of the answer and null falls to the viewer's zone. RIGHT; pinned by the two new console cases.
2. Public type. LocalizationValue.timezone?: string, optional, on the @object-ui/i18n barrel (index.ts:156). RIGHT, additive.
3. Provider semantics. LocalizationProvider hands value.timezone to core in a layout effect whose cleanup clears it, and the context's timezone is the APPLIED zone read back through useSyncExternalStore, so consumers re-render only after the faces hold the zone and an unknown name reads back undefined. RIGHT; the dev's ablation row 6 (context keyed on the prop) is the proof that the applied-zone keying is load-bearing, and the "zone arrives after first render" pin is the console's own case.
4. Core public surface. setDisplayTimeZone, getDisplayTimeZone, subscribeDisplayTimeZone reach the barrel through the existing export * from './utils/date-display.js' (core/src/index.ts:116). RIGHT, additive. Dependency direction: @object-ui/i18n already depends on @object-ui/core (workspace:*), core depends on neither i18n nor React, so no new edge and no cycle. RIGHT.
5. Faces with no zone. inZone(undefined) is {} and dayIn(d, undefined) reads local getters, so every face's Intl options bag is the one it had; formatRelativeDate's count moved from local-midnight millisecond rounding to UTC day numbers of local y/m/d, which is the same whole-day distance across a DST step. RIGHT; all 8 test shards and Test (dist pins) are green on the head, including dateOnlyZone-10110's real-TZ children.
6. Faces with a zone. Both datetime faces, both halves of the compact face, formatDate default and short and its current-year test, and the relative face's today and day all take ONE zone. RIGHT; 16 core pins, with America/Los_Angeles and Asia/Shanghai on either side of the suite's UTC.
7. Date-only exemption. A WeakSet registered in toDisplayDate on its date-only branch only (head date-display.ts:368-392; the instant branch returns parsed unchanged, so a registered Date handed back keeps its membership) and in toInclusiveEndDay. RIGHT; the GridField hand-off and the inclusive end day are pinned, with the plain-Date control reading Aug 31. toInclusiveEndDay builds its day with local setHours, so marking it a calendar day renders it where it was computed; its two callers (GanttView.endDayOf, ObjectGantt's write-back) are unchanged. RIGHT.
8. Unknown IANA name. Clears the zone with one console.warn instead of letting every face throw RangeError. RIGHT: the viewer's zone is the floor every face already had.
9. No per-component special case (the card's ⛔). On main no setDisplayTimeZone caller exists; in the PR the only production caller is LocalizationProvider; no renderer file changed. RIGHT.
10. Landing point. Core's date-display.ts, not the i18n formatting.ts / spec-formatters.ts the dispatch named: the dev measured that those have no renderer caller, and the card's letter is "the central date formatters". RIGHT; the claim's "stop on breach; explain in the report" was honoured (deviations[0]), and the dispatch's file surface named the wrong family.
11. Server-contract reading. The changeset and PR body say the zone is whatever the endpoint answers, the UTC floor included. RIGHT under ruling 6030273339 (B).
12. Docs. Core README section and snippet, i18n README section and snippet (made to compile alone in 229db2b), content/docs/fields/datetime.mdx "Time Zone". RIGHT; README Export Check, Doc Snippet Type Check and Build Docs are success on the head.

Nothing in the diff is judged WRONG.

② Semver level

• .changeset/11693-served-timezone.md: @object-ui/core minor, @object-ui/i18n minor, @object-ui/console minor.
• core: three new exports; the existing faces change only when the new setter is called. minor, RIGHT.
• i18n: an optional field on an exported interface and a provider side effect that is inert without it. minor, RIGHT.
• console: apps/console/package.json is @object-ui/console 17.7.0, not private; behaviour widened, nothing removed. minor, RIGHT.
• Changeset Declaration, Changeset Bump Policy, Changeset Fixed Group Check and Changeset Claim Re-read are success on the head; the dev's check-changeset-presence read 6 source files of 3 released packages against 1 changeset.

Clause-②: yes — matches the claim (6018498275) and the PR body: a published type (LocalizationValue) is widened and three symbols join @object-ui/core's surface; this record is the at-tier review that line owes.

③ Boundary flags

1. open_questions[0], the UTC floor. RULED: 6030273339, letter B with gate B2; gate card console: when the workspace timezone is still the default, prompt an administrator once to set it, pre-filled with the browser's zone (gate for #11693 / PR #11729) #11758 closed 2026-10-07T05:29Z when feat(console): ask an administrator once to set a still-default workspace timezone (objectui#11758) #11761 merged as 3bf8894. The dev stated the PR is identical under A, B and D, so B asks nothing of it. Answered.
2. deviations[0], landing point outside the declared surface. Within the card's letter (① item 10). Answered.
3. deviations[1], one ambient zone rather than a per-call option. The card requires the central entry; module state in core is that entry. The hazard the dev's docblock names (a second provider racing for the one zone, unmount clearing it) is measured on main 3bf8894: exactly one production mount, apps/console/src/AppContent.tsx:310 through LocalizationFetchProvider.tsx:128; the only other non-test reference, plugin-grid/src/useColumnSummary.ts, is prose, not a mount. Answered; the one-per-page rule is written in the i18n README.
4. deviations[2], Part of not Fixes. The seat closes the card after the merge (unlock note 6031680930). Answered.
5. deviations[3], narrowed gates (console type-check, readme-exports, doc-snippets, doc-examples). The head's check-runs Type Check, README Export Check, Doc Snippet Type Check, Doc Example Id Check and Build Docs are all success. Answered by CI.
6. deviations[4..7] (lock timeouts, a temporary control worktree removed, relay scratch paths, model-free trailers). Process notes with no contract bearing. Answered.
7. out_of_scope[0], datetime renderers outside the shared faces (record meta footer, comments, history and activity timelines, audit log, calendar views, gantt chart frame). Leaving them is what the card's ⛔ requires; the changeset names the limit. Not fileable without a public-door measurement. ESCALATED to the seat as a family follow-up candidate, carrier none.
8. out_of_scope[1], TODAY() still the UTC day. ADR-0053 D-G1 wants the reference zone's day, and getDisplayTimeZone() now reaches the client. ESCALATED as the later card the docblock names; not this card's.
9. out_of_scope[2], the order-dependent TZ leak in date-only-zone-pins-10183. Pre-existing; the head's cache-less shards are green. Answered, not blocking.
10. out_of_scope[3] and [4] (i18n's own helpers do not read the zone; stale vitest.config.mts header prose). Documented and trivial respectively. Answered.
11. Reviewer flag, first paint. The fetch provider renders children with {} until the answer arrives, so on every load a configured workspace's datetimes render in the viewer's zone and then move to the served zone; the locale has a seed for this gap (cacheLanguageSeed), the zone has none. Not in the card's Done-when, and pinned deliberately ("before the answer the viewer's zone renders, as it always did"). ESCALATED as a follow-up candidate (a zone seed beside the locale seed); not blocking.
12. Reviewer flag, the gate PR on main. 3bf8894 (feat(console): ask an administrator once to set a still-default workspace timezone (objectui#11758) #11761) mounts WorkspaceTimezonePrompt beside the fetch provider in AppContent.tsx. After an administrator confirms, the fetch provider does not refetch, so that session keeps the zone it was served (UTC for a still-default workspace) until the next load, and other users of such a workspace see UTC until an administrator has confirmed and they reload. Both sit inside the cost the ruling states for B2. The prompt's "one reader of the browser's zone" claim still holds: core's faces leave timeZone unset and never read resolvedOptions. Answered by the ruling.
13. main delta against the pins. None of the 30 commits touches the PR's 10 files or formatting.ts / spec-formatters.ts. Read for bearing: 055d350 (fields: a formula cell with no declared result type prints the raw number in monospace, and the datetime cell's date and time have no separator in the copied text #11683) changes the datetime cell's joiner text in packages/fields/src/index.tsx but still calls formatDateTimeCompactParts(date, { locale }), so the zone reaches it; 22b503c (i18n: read-only booleans render "Yes"/"No" in every locale, and the home greeting joins with an ASCII ", " and "." under zh-CN #11689) has the Home greeting read the viewer's local hour, a greeting and not a datetime face; a526249 (audit log: the actor column shows a truncated raw user id and the actor filter is free text, not a user lookup (split from objectui#11697) #11701) has no date-format line in its AuditLogPage.tsx patch; 77c12b9 (console(sharing): a password-protected share link sends its password in a header, not the request URL — and the landing page does not prompt for a password on a link that requires sign-in (the console half of objectstack-ai/objectstack#21839) #11649) SharedRecordPage.tsx mounts no provider and formats no date; c0862c1 (deps 17.7.0) touches core/actions, core/evaluator and locale packs; 17acfbb (delete confirmation does not name the record and confirms with a neutral "Continue" — the destructive alert-dialog variant is not used #11695) touches core/actions/recordDelete. None changes what the pins assert; the PR reads mergeable_state: clean. Answered.

Implemented-by: claude/issue-11693-served-timezone
Reviewed-by: session_01CGZy1BGCjdN5cXqL9cnvB8

VERDICT: PASS