fix(core): refuse ISO points finer than a microsecond

`_INSTANT_BOUND` caps a fractional second at six digits and refuses a longer
one rather than truncating it, because dropping digits would store a different
instant than the author wrote. That refusal only ever governed the strict path.

An over-precise point never matches `_INSTANT_BOUND`, so `_read_iso_day` fell
through to the flexible reader, which truncated the fraction and answered with
a time of day on the very day the ISO head names. Every check that path makes
then passed: `@occurred:2026-01-01T10:00:00.1234567` and its quoted form both
indexed as `2026-01-01T10:00:00.123456Z`, re-derived identically on every
reindex, with nothing said to the author. The day check is what guards the
flexible reading, and a truncated fraction sails straight through it -- the
digits it drops were never in the answer to be checked.

Judged on the author's text in `_classify_authored_point` instead, so both
readers refuse the same token for the same reason, and for the same reason the
calendar width rule already exists: a digit run wider than the syntax allows is
a typo, not a shorthand. Six digits and fewer are untouched, so `14:00:00.5` and
`.123456` still read; the range-literal path already refused these correctly.

This also corrects an overstated claim in the classifier's own comment. It said
none of the three ISO variants can reach the flexible reader, which is false: an
`_IsoDay`'s trailing text is deliberately read by it, and that is what reads
`2026-06-10 10:00 AM`. What the classifier actually settles for good is the
calendar -- a head naming no date dies there and is never re-guessed. The
trailing is fenced by two rules, one on what the reader returned and one on what
the author wrote, and the comment now says so.

A sweep of 216 ISO-time spellings (T/t/space separators, minute and second
precision, Z/z and offset zones with and without a colon, fractions of 0/1/6/7/9
and 30 digits) reported 54 tokens whose stored instant disagreed with a literal
reading of the text. All 54 were this one defect; after the fix the sweep
reports none.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014pmKq6bqCi6Zp6BTHuZjrp
Signed-off-by: phernandez <paul@basicmachines.co>

Author: phernandez

src/basic_memory/temporal.py

@@ -580,8 +580,20 @@ def _calendar_span(lower: date, upper: date | None) -> TemporalRange:
 # *once* is the whole design. Four review rounds went the other way: each added a shape test
 # whose failure meant "not my business", so a token that failed the test fell through to the
 # flexible reader and the next round found another shape that failed it. Here the classifier
-# is total -- a token that opens with ISO syntax is an `_IsoDay`, an `_IsoMonth` or a
-# `_MalformedIso`, and none of the three can reach the flexible reader.
+# is total: a token that opens with ISO syntax is an `_IsoDay`, an `_IsoMonth` or a
+# `_MalformedIso`, and there is no fourth answer to fall through on.
+#
+# What that buys is narrower than "ISO-shaped text never reaches the flexible reader", and
+# stating it precisely matters, because the loose version is false. An `_IsoDay`'s *trailing*
+# text is still read by the flexible reader -- that is what reads `2026-06-10 10:00 AM`, and
+# no grammar of clock spellings could. What the classifier settles for good is the *calendar*:
+# a head that names no date dies here, and a real one is carried on the variant so the reading
+# below can be held to it. The trailing is fenced by two rules instead, and dateparser's answer
+# is believed only when both hold. It must come back as a time of day on the day the head names
+# -- checked in `_read_iso_day`, against what it *returned*, since a suffix's looks do not say
+# what it will do with it. And the text must not spell precision a canonical instant cannot
+# carry -- checked here, on the text, because that is the one defect the returned-value check
+# cannot see: a truncated fraction still lands on the right day.
 
 # The ISO calendar components a point *opens* with: `YYYY-MM` and an optional `-DD`. A date
 # carrying a time (`2026-06-10T14:00`, `2026-06-10 10:00 AM`) is matched on its date part
@@ -595,6 +607,18 @@ def _calendar_span(lower: date, upper: date | None) -> TemporalRange:
 # reader, which is the one outcome ISO syntax must never have.
 _ISO_CALENDAR_HEAD = re.compile(r"^(\d{4})-(\d+)(?:-(\d+))?")
 
+# A fractional-second run too wide for a canonical instant to carry. `_INSTANT_BOUND` caps the
+# fraction at six digits and *refuses* a longer one rather than truncating it, because dropping
+# digits would store a different instant than the author wrote -- but that refusal only ever
+# governed the strict path. The flexible reader has no such scruple: it truncates
+# `2026-01-01T10:00:00.1234567` to `...123456Z` and reports a time on the right day, so every
+# check `_read_iso_day` makes passes and the authored instant is quietly rewritten on each
+# reindex. Judged on the text so both paths refuse the same token for the same reason, and it
+# is the same reason the calendar width rule exists: a digit run wider than the syntax allows
+# is a typo, not a shorthand. Six digits and fewer are untouched -- `14:00:00.5` is precision
+# a canonical instant holds exactly, so it still reads.
+_OVER_PRECISE_FRACTION = re.compile(r"\.\d{7,}")
+
 
 def _named_calendar_date(year: str, month: str, day: str | None) -> date | None:
     """The date ISO-shaped calendar components name, or None when they name none.
@@ -645,11 +669,12 @@ class _IsoMonth:
 
 @dataclass(frozen=True, slots=True)
 class _MalformedIso:
-    """A point written in ISO syntax that names nothing on the calendar.
+    """A point written in ISO syntax that cannot be read as written.
 
-    `2026-13-01`, `2026-01-0100`, `2026-06 10:00`. The author reached for a machine date
-    and missed, so there is no reading to fall back on -- only a guess, which is what this
-    variant exists to make unreachable.
+    `2026-13-01`, `2026-01-0100`, `2026-06 10:00`, `2026-01-01T10:00:00.1234567`. Either the
+    components name nothing on the calendar, or they name a moment finer than a canonical
+    instant records. The author reached for a machine date and missed, so there is no reading
+    to fall back on -- only a guess, which is what this variant exists to make unreachable.
     """
 
 
@@ -690,6 +715,16 @@ def _classify_authored_point(point: str) -> _AuthoredPoint:
         # Outcome: a bare month denotes its own period; a month with anything after it is
         #   malformed.
         return _MALFORMED_ISO if trailing else _IsoMonth(int(year), int(month))
+
+    # Trigger: the text after the date spells a fraction of a second wider than six digits.
+    # Why: no reader here can store it, and the two that try disagree -- `_canonical_instant`
+    #   refuses it, while the flexible reader truncates it and still answers with a time on
+    #   the head's day, which is precisely what `_read_iso_day`'s returned-value check cannot
+    #   catch. A guard that asks what came back cannot see digits that never made it in.
+    # Outcome: refused as malformed, so the strict and flexible paths give the same answer to
+    #   the same text and the token stays observation content rather than a rounded instant.
+    if _OVER_PRECISE_FRACTION.search(trailing):
+        return _MALFORMED_ISO
     return _IsoDay(named, trailing)
 
 
@@ -794,8 +829,10 @@ def parse_authored_point(
     Non-ISO spellings are read leniently, because guessing at `June 10, 2026` is the
     whole point of this reader. A token that *is* ISO-shaped is held to its own text
     instead: its calendar components must name a real date, and anything trailing them
-    must be a time of day on that date. `2026-06-10 10:00 AM` reads; `2026-01-01T` does
-    not, because the author reached for an instant and no instant is there.
+    must be a time of day on that date, written to a precision this module can store.
+    `2026-06-10 10:00 AM` reads; `2026-01-01T` does not, because the author reached for an
+    instant and no instant is there; `2026-01-01T10:00:00.1234567` does not either,
+    because storing it would mean dropping the digits that made it worth writing.
 
     Returns None when the text names no date. That is not an error -- the caller leaves
     such a token as ordinary observation content.

tests/markdown/test_temporal_qualifier.py

@@ -437,6 +437,54 @@ def test_quoted_point_reads_a_multi_word_date(qualifier: str, literal: str, kind
     assert str(observation) == line
 
 
+@pytest.mark.parametrize(
+    "point",
+    [
+        "2026-01-01T10:00:00.1234567",
+        "2026-01-01T10:00:00.1234567Z",
+        "2026-01-01T10:00:00.1234567+02:00",
+        "2026-01-01T10:00:00." + "1" * 30,
+    ],
+)
+def test_a_point_finer_than_a_microsecond_stays_content_in_both_forms(point: str):
+    """An over-precise instant is refused whichever form carries it to the reader.
+
+    Both forms filed `[2026-01-01T10:00:00.123456Z,)` -- the authored instant with its
+    last digits dropped, and no sign to the author that anything was lost. The quoted form
+    reached it by a different route than the bare one: quoting suppresses the truncation
+    guards, on the reasoning that a delimited value cannot be a truncated *token*. That is
+    still true, and beside the point here -- the loss is inside the value, so only refusing
+    the point itself covers both. Pinned together so a fix to one form cannot miss the
+    other.
+    """
+    for qualifier in (f"@occurred:{point}", f'@occurred:"{point}"'):
+        line = f"- [decision] {qualifier} The cutover ran."
+
+        observation = _observation(line)
+
+        assert observation.temporal == []
+        # Refused, not reported: how someone spelled a date is not a diagnostic this
+        # feature issues. The line keeps every character and stays full-text searchable.
+        assert observation.temporal_error is None
+        assert observation.content == f"{qualifier} The cutover ran."
+        assert str(observation) == line
+
+
+def test_a_point_at_exactly_microsecond_precision_is_still_filed():
+    """The boundary the refusal above stops at, end to end through the parser."""
+    for qualifier in (
+        "@occurred:2026-01-01T10:00:00.123456",
+        '@occurred:"2026-01-01T10:00:00.123456"',
+    ):
+        observation = _observation(f"- [decision] {qualifier} The cutover ran.")
+
+        [assertion] = observation.temporal
+        assert assertion.time_kind is TimeKind.OCCURRED
+        assert str(assertion.valid_during) == "[2026-01-01T10:00:00.123456Z,)"
+        assert assertion.valid_during.axis is TemporalRangeAxis.INSTANT
+        assert observation.content == "The cutover ran."
+
+
 def test_a_quoted_relative_date_is_read_where_its_unquoted_form_is_not():
     """`2 days ago` always read fine; only the token rule kept it out."""
     quoted = _observation('- [decision] @occurred:"2 days ago" The cutover ran.')

tests/test_temporal.py

@@ -533,6 +533,73 @@ def test_an_iso_date_whose_suffix_re_guesses_it_is_unread(written: str):
     assert parse_authored_point(written) is None
 
 
+@pytest.mark.parametrize(
+    "written",
+    [
+        # The reported shape: one digit more than a canonical instant carries. The lenient
+        # reader truncated it to `...123456Z`, on the very day the head names, so every
+        # check the reading makes passed and the index recorded an instant 100ns off the
+        # one the author wrote -- re-derived identically by every reindex.
+        "2026-01-01T10:00:00.1234567",
+        # The same defect wearing every spelling of the syntax around it. None of these is
+        # distinguishable by what the reader *returned* -- each truncates and each lands on
+        # the right day -- which is why this one is judged on the text instead.
+        "2026-01-01t10:00:00.1234567",
+        "2026-01-01 10:00:00.1234567",
+        "2026-01-01T10:00:00.1234567Z",
+        "2026-01-01T10:00:00.1234567z",
+        "2026-01-01T10:00:00.1234567+02:00",
+        "2026-01-01T10:00:00.1234567-05:00",
+        "2026-01-01T10:00:00.1234567+0200",
+        # Precision far past anything a clock emits, truncated just as quietly: a 20- and a
+        # 30-digit fraction both stored six digits and discarded the rest without a word.
+        "2026-01-01T10:00:00.12345678901234567890",
+        "2026-01-01T10:00:00." + "1" * 30,
+    ],
+)
+def test_an_iso_point_finer_than_a_microsecond_is_unread(written: str):
+    """Over-precision is refused on the lenient path too, not silently rounded.
+
+    `canonical_bound` has always refused these -- dropping digits would store a different
+    instant than the author wrote -- but that refusal only governed the strict path. A
+    point one digit too precise never matched `_INSTANT_BOUND`, so it fell to the lenient
+    reader, which truncated it and answered with a time on the correct day. The day check
+    is what guards that path, and a truncated fraction sails straight through it: the
+    digits it drops were never in the answer to be checked. Judged on the author's text
+    instead, so both readers refuse the same token for the same reason.
+    """
+    assert parse_authored_point(written) is None
+
+
+@pytest.mark.parametrize(
+    ("written", "lower"),
+    [
+        # Exactly six digits: the widest fraction a canonical instant carries, so it is
+        # stored whole and nothing is dropped. The refusal above must stop precisely here.
+        ("2026-01-01T10:00:00.123456", "2026-01-01T10:00:00.123456Z"),
+        ("2026-01-01 10:00:00.123456", "2026-01-01T10:00:00.123456Z"),
+        ("2026-01-01T10:00:00.123456Z", "2026-01-01T10:00:00.123456Z"),
+        ("2026-01-01T10:00:00.123456+02:00", "2026-01-01T08:00:00.123456Z"),
+        # Narrower fractions were never in question, and are pinned so a future widening
+        # of the rule cannot quietly take them.
+        ("2026-01-01T10:00:00.1", "2026-01-01T10:00:00.100000Z"),
+        ("2026-06-10 14:00:00.5", "2026-06-10T14:00:00.500000Z"),
+    ],
+)
+def test_a_fraction_a_canonical_instant_can_hold_still_reads(written: str, lower: str):
+    """Refusing over-precision must cost nothing that stores losslessly.
+
+    Six digits is the boundary, not "any fraction is suspicious": these name a moment the
+    canonical form records exactly, so there is no truncation to prevent and no reason to
+    withhold the assertion.
+    """
+    span = parse_authored_point(written)
+
+    assert span is not None
+    assert span.axis is INSTANT
+    assert span.lower == lower
+
+
 @pytest.mark.parametrize("today", ["2026-03-07", "2026-09-01"])
 def test_a_clock_reading_on_a_month_is_not_completed_from_the_indexing_date(today: str):
     """`2026-13`'s disease in the suffix: a time of day needs a day to fall on.