[leowilkin]

Problem

Admin datetime-local fields submit a zone-less string like 2026-07-12T09:30, and Rails casts it in the app zone, UTC. Event schedule times and scheduled messages already re-read that string on the event's clock, each with its own copy of the code. Scan point windows, incident times and train/bus/car travel times did not. A 09:30 check-in window at a Boston event was stored as 09:30 UTC (05:30 local), and readers that treat the value as an instant (the scanner API, the incident API) were off by the event's offset.

Inputs also show 12- or 24-hour time depending on the browser.

Changes

• EventLocalTimes concern: a model declares event_local_times :attr, .... A typed wall-clock string is re-parsed in the event's zone at validation, after an event or timezone submitted in the same form has been assigned. A value with its own offset is left alone. Views use local_time(:attr), local_time_field_value(:attr) and time_display_zone. Event and Message now use the concern instead of their own copies.
• Legacy rows: existing rows on scan_contexts, incidents and travels hold the typed wall-clock as UTC. A new times_in_event_zone column marks them (false for existing rows; the model defaults new rows to true, so writes from an older deploy mid-rollout still read as legacy). They keep rendering on UTC exactly as before. The first time a legacy row's times are retyped through a form, all of its times are re-read as event-local and the flag flips, so a row never mixes the two readings. An unchanged instant echoed back by an API client does not flip it.
• 24-hour time: every admin datetime-local input gets lang="en-GB". Admin travel fields, flight legs and the JS-built leg and export filter inputs are included. Chrome and Safari take the format from the OS locale and ignore lang, so admins on a 12-hour system still see 12-hour inputs there.
• Zone notes: each admin time field says which zone it's in. Bans have no event, so ban expiry stays UTC and the form says so.
• Scan points: typed, prefilled and listed on the event's clock.
• Scan history and counts: the date filter and the "today" counts use the event's calendar day. Scan.today (UTC day) had no callers left and is removed.
• Exports: filters read typed dates and times in the event's zone, for ad hoc exports and saved templates.
• Incidents: the time is typed, prefilled and shown on the event's clock in admin, the Slack thread and the HQ escalation.
• Travel (train/bus/car): times are read on the event's clock for every form that writes them, so the columns keep one meaning: the admin travel page, onboarding, the dashboard and the guardian portal. Only the admin forms get lang and the zone note. These times show on the clock they were typed on wherever they appear, including the ticket PDF and the CSV export. Flight legs keep their per-airport zones.
• Incident Slack updates:
  • The diff is read from saved_changes after saving. Read before validation, an untouched time would count as an edit.
  • SendIncidentUpdateToSlackJob skips the post when no change is one it describes. Before, it sent Slack an empty message and raised. That already happened on a time-only edit; re-saving a legacy incident made it easier to hit.

Not changed

• API, Airtable and MCP output: these still serialise the stored instants. New rows are now correct; legacy rows are still off by the event's offset, as before.
• Travel calendar: legacy rows land where they always have.
• Scan time displays: scanned-at times on the scans index, the scanner and the participant page show UTC with no label.
• Audit log filters: the date filters use UTC days.
• Other CSV columns: datetime columns other than typed travel times still export in UTC.
• Inbound bus departure time on participant forms: it is now read in the event's zone, even if the participant leaves from another zone.

Testing

• New specs:
  • the concern itself, covering new rows, legacy rows, the flag flip, an echoed instant and a timezone submitted with the times;
  • the incident, scan point and travel models;
  • admin request specs for both view variants, covering prefill, lang, the zone note, saving and legacy rows;
  • the participant travel paths;
  • the export filter and the CSV output;
  • both incident Slack jobs.
• bundle exec rspec excluding spec/system: 3731 examples, 5 failures. All 5 are Passkit specs failing on a missing PASSKIT_APPLE_TEAM_IDENTIFIER in the test environment, and they fail the same way without these changes.
• bin/rubocop on the changed Ruby files: no offenses.

---

---

Generated by Claude Code