Execution-level test coverage: jsonb temporal wire form, date-mode filtering, pre-publish migrate gate

[dmealing]

Four independent units, all originating from the same lesson: a test that inspects the shape of generated code cannot tell you the code is wrong.

1. Execution pins for the Zod validator matrix (test, no product change)

zod-validators.test.ts is ~390 lines of toContain. Three defects shipped or nearly shipped through that gap — z.string().ip() (removed in Zod 4), timestampMode: "date" emitting Date-typed columns against string-producing validators, and the fix for that reintroducing the same class on SQLite. The last one stayed text-green precisely because the goldens were regenerated to match the new output.

17 new tests render the real output, write it to a temp module, dynamically import() it, and call the real safeParse — asserting ACCEPT/REJECT of concrete values. Same technique as timestamp-mode-execution.test.ts.

Verified non-vacuous by mutation: three seeded regressions are each caught. One of them — FR-036 A3 degrading from strictest-wins to last-writer-wins, so a @maxLength: 200 field with validator.length @max: 50 starts accepting 200-char values — leaves the existing text suite entirely green. That path had no behavioral coverage at all.

Every current emission was already correct; nothing needed fixing.

2. OMDB jsonb temporal — closes the last #275 carry-forward (fix, Java)

The OMDB jsonb temporal path was the motivating blast radius for the whole #275 fix and had no test at any level. The reason was concrete: the jsonbtest fixture's value objects carried only string and int, so no temporal value had ever crossed that codec.

Writing the test surfaced a live defect on the adjacent branch. MetaObjectGsonInitializer registers the metadata-driven serializers against each MetaObject's declared @object class, so a value object bound to a POJO via ObjectClassRegistry is serialized by Gson's default reflection and its Date properties never reach TemporalWireFormat. A @storage: jsonb column holding one stored:

"Jun 3, 2026, 10:30:00 AM"

— the JVM's local zone rather than UTC, varying with default locale, silently dropping milliseconds (so even a Java-only round-trip lost the instant), @localTime ignored, and unreadable by the other four ports, which expect the ISO form in normalization.md. Same defect class as #275, on the one path #275 did not reach.

TemporalGsonAdapter now handles java.util.Date on that builder: writes the canonical instant, reads TemporalWireFormat.parse first with a fallback to the former localized default so existing rows still load. The metadata-driven path is provably untouched — MetaObjectSerializer's DATE branch formats and addPropertys directly instead of delegating to context.serialize.

Bounded narrowing, deliberate: without an owning MetaField the field.date and @localTime shapes are unknowable, so a POJO-bound temporal writes as a full instant. Lossless and portable, where the previous behavior was neither.

Tests assert the stored column text, not just instant equality — Gson round-trips its own format inside Java, so an equality-only assertion would have passed against the bug. Mutation-verified (dropping the Z; dropping the millisecond fraction).

3. Date-mode timestamp filtering now works (feat, npm)

Filtering a @filterable field.timestamp under timestampMode: "date" threw at request time: the Drizzle pg column binds a JS Date and calls .toISOString() on whatever it gets, while the parser passed the raw query-string value through. Every op except isNull died with TypeError: value.toISOString is not a function.

The generated allowlist now carries dateValues: true for exactly those columns and the parser coerces with new Date(...); a malformed value is rejected as filter.invalid_value rather than bound as an Invalid Date. The flag is optional, so an allowlist generated before this existed keeps its exact previous behavior. Only field.timestamp is marked — Drizzle types field.date/field.time as strings under every dialect — and sqlite/D1 normalizes the mode away upstream, so the emitter needs no dialect branching.

The gen-time warning that announced this limitation is removed rather than left to cry wolf; its test now pins the warning's absence in all four mode/dialect combinations.

Tests drive PgDialect.sqlToQuery (which applies mapToDriverValue) rather than asserting on the expression tree — the failure lived inside that binding step. Includes a control that binds a raw string and asserts it still throws the original TypeError.

4. migrate-ts real-Postgres gated before publish, not after (ci)

The migrate-ts PG suites ran only on the v* tag push. Tags are pushed after bun publish, so red arrived strictly after four immutable registries were updated — which is why the lane sat red for eight consecutive releases (v0.20.11 → v0.21.1, repaired in #280) with nobody acting on it. Worse, the suites describe.skip silently without MIGRATE_TS_PG_URL, including inside conformance.yml's own migrate-ts step — so the repo's CI looked covered while the real-engine half executed nowhere except post-publish.

ADR-0015 makes migrate-ts the only migrate engine, so this is the only real-engine gate on migration correctness.

local-ci.yml's ts-slow lane now arms the suites from its existing Postgres sidecar on every push to main — no new container, no hosted minutes (the job is ~50s; the "EXPENSIVE" label belongs to the 5-port Testcontainers matrix, not this). Ordered before the docker integration step so a container-readiness flake can't mask the migrate verdict.

A sentinel test makes the silent skip loud where it matters: a lane that intends real PG sets MIGRATE_TS_PG_EXPECT=1 beside the URL, and the sentinel fails if the URL ever stops being set. A workflow-level test -n check cannot do this — it inspects the workflow's env, not what the test process reads, so a rename inside the tests is exactly the drift it would miss.

The tag job is kept as the cold-environment backstop, its comment rewritten so red there reads as a broken release already live. RELEASING.md gains a wait-for-local-ci-green step before publish, plus a step 0 (git branch -a --no-merged) — 0.21.1 shipped without a fix that already existed on an unmerged branch and needed 0.21.2 within the hour.

Residual risk, stated plainly: red is post-merge rather than pre-merge; a publish cut minutes after a merge can still beat the verdict; a cold-only failure still surfaces first on the tag; and if the self-hosted runner is down, nothing goes red at all.

---

Verification

• metadata (1347) and omdb (51) Java suites green.
• Full server/typescript suite: 4 failures, all pre-existing. Confirmed by running the same suite at pristine origin/main, which shows 7 — this branch's 4 are a strict subset (the extra 3 upstream are fresh-worktree artifacts: unbuilt dist/, un-run bundle script). All 4 pass in isolation on both sides; migrate-ts depends on neither package changed here.
• Workspace build + typecheck clean (the pre-push gate caught two casts the earlier typecheck missed).

🤖 Generated with Claude Code

https://claude.ai/code/session_01KTGT5ksntpcJDZVJ5VyXHS