ADR-0053 Phase 2 · Slice 1: reference-timezone resolver + ExecutionContext.timezone

[os-zhuang]

Part of ADR-0053 Phase 2 (reference-timezone model). Design: #1975 · ADR: docs/adr/0053-date-and-datetime-semantics.md · Parent: #1928 · Builds on Phase 1 #1968.

Slice 1 of 6 — foundational. Introduce the reference-timezone resolver and the single new piece of data Phase 2 adds: ExecutionContext.timezone. Pure plumbing, no behavior change (defaults to 'UTC').

Scope

• Add timezone?: string to ExecutionContextSchema — packages/spec/src/kernel/execution-context.zod.ts:21-72.
• Resolve the active timezone once per request inside resolveExecutionContext — packages/runtime/src/security/resolve-execution-context.ts:77-267 (it already queries sys_member / permission-sets there).
• Precedence: user override → org default → 'UTC'.
  • User override: sys-user-preference (key='timezone') — packages/platform-objects/src/identity/sys-user-preference.object.ts (today a generic k/v store the engine never reads).
  • Org default: a new tenant-scoped settings manifest (e.g. namespace localization, key timezone). Tenant scope is keyed by ExecutionContext.tenantId = activeOrganizationId = the org (one-org-per-env, ADR-0002) — no new scope, no schema migration. Use the settings reactive client snapshot for cheap reads — packages/services/service-settings/src/settings-service.ts:354.

Acceptance criteria

• ExecutionContext.timezone is populated on every interactive HTTP request; absent config → 'UTC'.
• No downstream consumer changes behavior yet (this slice is plumbing only).
• Unit test: resolver returns user pref over org default over 'UTC'.

Blocks

Provides the timezone value consumed by slices 3, 4, 5. Slices 2 and 6 are independent.