Flow
How the date check and repair work now
1Compare by what I sent
Only a date: compare the date. A full time: it must match exactly.
2Keep the failing cases
A day-late date and a time a minute off still fail.
3Keep the error code
Failures now save the code, not only the error text.
4Gate the repair
The task list must match the saved records, and each failure must be this date problem.
The nightly audit handoff had a check that could call a correct handoff a failure. The task would be with the right person, in the right state, due on the right day, and still get flagged. My check was wrong, but only for part of the year.
The handoff and the read-back
After the stores do a count, a nightly job adds a comment to each store's task in an outside task tool. Then it hands the task to the next person and sets the due date to tomorrow. It doesn't just trust the tool's "OK". It reads the task back and checks that the due date stuck.
Where it went wrong
I send the due date as a plain date with no time. The tool has to store a time, so it picks an early-morning hour in its own local zone. It sends that back as a UTC time. My check guessed one fixed UTC hour and wanted an exact match.
The tool's local hour stays put. But when daylight saving starts or ends, that hour moves by one in UTC. So my guess was right in winter and an hour off in summer. Every good summer handoff got flagged as a mismatch.
My test didn't catch it, because the fake tool in the test returned exactly the hour I'd guessed. I was testing my own guess. The test now uses the real summer value.
Comparing by day when I only sent a day
If I sent only a date, I compare only the date. If I sent a full time, it still has to match exactly.
return sent.kind === "day" ? sameDay(stored, sent.day) : stored === sent.at
The test checks that summer and winter dates pass, a day-late date fails, and a time that's a minute off fails. The failing cases matter most. Catching the wrong day is the whole reason to read the date back.
This works because my zone is behind UTC, so early morning there is the same day in UTC. A zone ahead of UTC would break it.
Fixing the ones already marked failed
For a task hit by this, the comment would have gone through and only the handoff would be marked failed. The normal job only runs for today, and I didn't want to go near the comments again, so I added a command that redoes just the handoff. It refuses to run unless the task list matches the saved records exactly, each task has a good comment record and a handoff record for the same due date, and any failed handoff was this date problem and nothing else. It checks everything before writing anything.
I also found the job was throwing away the error code on failures. It keeps it now. The repair always requires the exact error text, and checks the code only when one was saved. Older records have no code, so for them the text match is the only check, which is fragile.
Still open: the zone assumption, and the exact text match on old records.