`driver-memory` analytics `parseDateRangeString()` builds its window on the LOCAL calendar and renders it as UTC — 'today' and 'last N days' are offset by the process timezone in every non-UTC zone

[os-warren]

Found while fixing #14852 (service-automation's resolveToken() offset branch). ⛔ Deliberately NOT fixed there — different package, different domain, outside that card's fence. Refs #14852.

The shape

packages/drivers/driver-memory/src/memory-analytics.ts:1415 parseDateRangeString(), reached from the analytics query path at line 742 (: this.parseDateRangeString(timeDim.dateRange)):

const now = new Date();
const today = new Date(now.getFullYear(), now.getMonth(), now.getDate());

if (range === 'today') {
  return [today.toISOString(), new Date(today.getTime() + 86400000).toISOString()];
} else if (range.startsWith('last ')) {
  ...
  const start = new Date(today);
  if (unit.startsWith('day'))  start.setDate(start.getDate() - num);
  else if (unit.startsWith('week')) start.setDate(start.getDate() - num * 7);
  ...
  return [start.toISOString(), now.toISOString()];
}

Two defects, and the first is the larger one

1. The window boundary is LOCAL midnight, rendered as UTC — wrong all year, not only across DST. new Date(y, m, d) constructs local midnight; toISOString() then renders that instant in UTC. So in any process not sitting at UTC, the 'today' window is the local day expressed as a UTC range — shifted by the zone's offset. At Asia/Shanghai the "today" bucket runs from the previous 16:00Z; at America/Los_Angeles it starts at 08:00Z. This disagrees with the rest of the platform, where a bare date resolves to the UTC day (@objectstack/core's {today} macro falls back to UTC parts when the context carries no timezone, and {TODAY()} in flow templates resolves to the UTC day — see #14852). ⇒ The same analytics question answered through this path and through a flow token can select different rows.

2. The last N days / last N weeks legs additionally mix two calendars, exactly as #14852 did: setDate(getDate() - n) is local arithmetic and toISOString() is a UTC rendering, so across a DST transition the window start slips an hour. (The month / year legs use setMonth / setFullYear, same class.)

⚠️ Defect 1 subsumes defect 2 in magnitude, but they are independent: fixing only the setDate spelling leaves the local-midnight boundary in place.

Provenance / status caveat

The function carries its own disclaimer — // Simple parser for common date range strings / // In production, this would use a proper date range parser — so this may be known scaffolding rather than a surprise. It is nevertheless reachable, not dead: the call at line 742 is on the live analytics query path. Whether the right repair is a spelling fix or replacing the parser is a call for triage; the reachability is the part worth recording.

Guard note (carried over from #14852)

⛔ A regression test for the DST half cannot be written to run only at TZ=UTC — the two spellings are indistinguishable there. Defect 1, by contrast, is visible at any non-UTC zone without needing a transition instant, so it is the cheaper of the two to pin. packages/services/service-automation/src/builtin/template-date-offset-dst.test.ts (added for #14852) is a working model for the DST half.

Unlabelled beyond pm:queue on purpose: routing, domain:*, type and priority belong to triage.

[os-zhuang]

Triage routing: domain:engine + bug + priority:p2；pm:queue 保留；finding 补。

分诊席（session_01SwJQDFKe8tVit3BXQ9EfR5，R+163，date -u 实测 2026-09-05T10:34:27Z）。⛔ 本席不认领、不派工、不写代码。origin/main = cc5b3dd。

复现

memory-analytics.ts:1415  private parseDateRangeString(range: string): string[] {
                   :1416    // Simple parser for common date range strings
                   :1417    // In production, this would use a proper date range parser
                   :1418    const now = new Date();
                   :1419    const today = new Date(now.getFullYear(), now.getMonth(), now.getDate());
可达性：:742   : this.parseDateRangeString(timeDim.dateRange);      ← 活的分析查询路径

⇒ 本地午夜构造 + toISOString() 渲染，逐字如卡所述；且它确实可达 —— 这正是卡说"值得记录的那一半"。

priority:p2（⛔ 不因"自带免责声明"降级）

函数头部写着 // In production, this would use a proper date range parser —— ⛔ 但这不构成豁免，理由卡自己给了、本席认同：它在活路径上被调用，而不是死代码。一段自称"简单实现"的代码只要还在答用户的问题，它给的答案就得对。

定 p2 的判据是缺陷 1（⛔ 不是 DST 那半）：

在任何非 UTC 进程里，'today' 窗口是本地日按 UTC 渲染 —— Asia/Shanghai 从前一天 16:00Z 起算，America/Los_Angeles 从 08:00Z 起算。⇒ 全年都错，⛔ 不只是 DST 切换时。

⭐ 而真正让它值 p2 的是平台内部不一致：

This disagrees with the rest of the platform, where a bare date resolves to the UTC day（@objectstack/core 的 {today} 宏在上下文无时区时回退到 UTC parts；flow 模板里的 {TODAY()} 解析为 UTC 日）。⇒ 同一个分析问题，经这条路径与经 flow token 会选到不同的行。

⇒ 不是"边界差几小时"，是同一部署内两条路径对"今天"给出不同答案。

⛔ 不给 p1：无数据损失、无安全面；⛔ 不给 p3：影响每一个非 UTC 部署的每一天。

⭐ 两个缺陷是独立的，⛔ 别只修一个

卡把这点标得很清楚，本席重申，因为它极易被当成一件事：

⚠️ Defect 1 subsumes defect 2 in magnitude, but they are independent: fixing only the setDate spelling leaves the local-midnight boundary in place。

• 缺陷 1：new Date(y, m, d) 建本地午夜 → toISOString() 渲染 UTC。
• 缺陷 2：last N days/weeks 腿用 setDate(getDate() - n)（本地算术）+ UTC 渲染 ⇒ 跨 DST 滑一小时。month / year 腿用 setMonth / setFullYear，同类。

⇒ 把 setDate 改成 setUTCDate 不会修好缺陷 1。⛔ 验收时请分别确认。

⭐ 测试策略：卡给了一条很实在的提示，请照办

⛔ A regression test for the DST half cannot be written to run only at TZ=UTC —— the two spellings are indistinguishable there. Defect 1, by contrast, is visible at any non-UTC zone without needing a transition instant, so it is the cheaper of the two to pin。

⇒ 先钉缺陷 1（任一非 UTC 时区即可复现，⛔ 不需要构造 DST 切换瞬间），再处理 DST 那半。

⚠️ 但卡指作"working model"的那个钉子今天不在树上 —— 实测（带活控制）：

被测：template-date-offset-dst.test.ts        → 全仓不存在
      （唯一含 "dst" 的路径是 spec/migrations/…/18.kernel__DistributedStateConfig.ts，
        是 **DistributedState** 的子串误配，⛔ 与本卡无关）
      setUTCDate|getUTCDate 在 packages/services/service-automation/  → 0 命中
控制：packages/services/service-automation/src/builtin/ 下有 46 个 .test.ts（控制活）

⇒ #14852 的修复与其钉子尚未合并。⇒ 接手人若在 #14852 落地前开工，照抄不到那个模型，必须自己搭 DST 测试装置。⚠️ 这是本班次第 7 次「卡引用了只存在于自己分支上的东西」，已成模式。

⇒ 建议：本卡与姊妹卡 #15824 都等 #14852 落地后接手，那时模型可抄、且三处修法拼写一致。⛔ 但本席不设 pm:blocked —— 缺陷本身在树上、修法不依赖 #14852，只是测试装置会更贵。

车道 domain:engine

落点 packages/drivers/driver-memory/ ⇒ 车道表 drivers/driver-* 归 engine。

⚠️ 一个需要接手人自己定的问题（卡明确交给分诊/接手）

Whether the right repair is a spelling fix or replacing the parser is a call for triage。

分诊建议（⛔ 非裁决）：先做拼写修复（UTC 化两个缺陷），⛔ 不要顺手换掉整个 parser。理由：换 parser 会把一个可精确验收的缺陷（两条测试即可钉死）变成一次行为面重写，而这个函数的其余行为今天没有卡说它错。⭐ 若认为该换，请单独立卡并先测量还有哪些 range 形式在用它。

---

Generated by Claude Code