fix(queue): genesis owner-not-reviewer check, assign wording, queue-commit HEAD-moved message, calendar dates (row 33, #1508)

Built by filbert, approved by darkwing in round 1 (#1508 comment 26651).
Manifest fe7da3ef, 10 paths. Suites green on an index export.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/queue/tests/data.test.mjs

@@ -20,8 +20,7 @@ function brief(path = "docs/plans/brief-b.md", anchor = "Queue", blob = BLOB) {
 }
 
 // A genesis document built the way store.mjs builds one.
-function genesisDoc(rows = MAP_ROWS, op = "genesis-op-0001") {
-  const map = parseMigrationMap(mapText(rows));
+function genesisDoc(rows = MAP_ROWS, op = "genesis-op-0001", map = parseMigrationMap(mapText(rows))) {
   const blobs = new Map(map.rows.filter((r) => r.brief).map((r) => [r.id, BLOB]));
   const t = at();
   const grows = genesisRows(map, blobs, op, t, "sage");
@@ -507,6 +506,44 @@ test("every accepted text renders to nine cells on every row (N8)", () => {
   for (const t of ["a\\| done | x", "x<y", "x\\y"]) assert.ok(!accepted.has(t), t);
 });
 
+test("genesis: the map refuses an owner among its row's reviewers; replay doesn't (2026-10-04)", () => {
+  const self = MAP_ROWS.map((m) => (m.id === 9 ? { ...m, reviewers: ["darkwing", "filbert"] } : m));
+  refused(() => parseMigrationMap(mapText(self)), /migration map row 9 owner darkwing can't be a listed reviewer/);
+  // A log from before the rule still loads: the check is on the map, not in replay.
+  const old = genesisDoc(self, "genesis-op-0001", { rows: self, retired: [7], highWater: 11 });
+  assert.deepEqual(row(loadDoc(Buffer.from(serialize(old))).doc, 9).reviewers, ["darkwing", "filbert"]);
+});
+
+test("times and dates must be calendar values, not just the shape (2026-10-04)", () => {
+  // Row 9 is required, so requiredSince is checked; it allows a date, as createdAt does.
+  const r = row(genesisDoc(), 9);
+  for (const v of ["2028-02-29", "2026-12-31", "2026-04-30"]) {
+    validateRow({ ...r, requiredSince: v });
+    validateRow({ ...r, createdAt: v });
+  }
+  for (const v of ["2026-13-01", "2026-00-10", "2026-01-32", "2026-02-30", "2027-02-29", "2026-04-31"]) {
+    refused(() => validateRow({ ...r, requiredSince: v }), new RegExp(`row 9 requiredSince is not a calendar date: "${v}"`));
+    refused(() => validateRow({ ...r, createdAt: v }), new RegExp(`row 9 createdAt is not a calendar date: "${v}"`));
+  }
+  // ISO times: the same days, and times past the clock. V8 reads 2026-02-30
+  // as March 2 and 24:00 as the next day; only the round trip catches those.
+  for (const v of ["2028-02-29T00:00:00.000Z", "2026-12-31T23:59:59.999Z"]) {
+    validateRow({ ...r, updatedAt: v });
+    validateRow({ ...r, requiredSince: v });
+  }
+  const T = "T12:00:00.000Z";
+  for (const v of [`2026-13-01${T}`, `2026-01-32${T}`, `2026-02-30${T}`, `2027-02-29${T}`, "2026-01-01T24:00:00.000Z", "2026-01-01T23:60:00.000Z", "2026-01-01T23:59:60.000Z"]) {
+    refused(() => validateRow({ ...r, updatedAt: v }), new RegExp(`row 9 updatedAt is not a calendar time: "${v}"`));
+    refused(() => validateRow({ ...r, requiredSince: v }), new RegExp(`row 9 requiredSince is not a calendar time: "${v}"`));
+  }
+  // A shape error keeps its own message.
+  refused(() => validateRow({ ...r, updatedAt: "2026-01-01" }), /row 9 updatedAt must be an ISO time: "2026-01-01"/);
+  // A log entry's time goes through the same check on replay.
+  const d = step(genesisDoc(), "note", { id: 9, text: "x" }, "darkwing");
+  d.log[1].at = `2026-02-30${T}`;
+  refused(() => loadDoc(Buffer.from(serialize(d))), /log entry 1 at is not a calendar time: "2026-02-30T12:00:00.000Z"/);
+});
+
 test("replay holds every op id to the caller's rule (N11)", () => {
   const load = (d) => loadDoc(Buffer.from(serialize(d)));
   const d = genesisDoc();
@@ -549,7 +586,7 @@ test("note: owner, listed reviewer or privileged; empty clears", () => {
 test("assign moves the claim with the owner; done clears it", () => {
   let d = row9Started();
   refused(() => step(d, "assign", { id: 9, seat: "dewey" }, "darkwing"), /privileged/);
-  refused(() => step(d, "assign", { id: 9, seat: "filbert" }, "sage"), /row 9 owner filbert can't be a listed reviewer/);
+  refused(() => step(d, "assign", { id: 9, seat: "filbert" }, "sage"), /can't assign row 9 to filbert: filbert is one of its reviewers/);
   d = step(d, "assign", { id: 9, seat: "dewey" }, "sage", {}, "assign-row-9-dewey");
   assert.deepEqual(row(d, 9).claim, { seat: "dewey", op: "assign-row-9-dewey" });
   assert.match(d.log.at(-1).result.receipt, /owner: darkwing→dewey$/);