JSON times carry their zone (ISO 8601 Z) on the API edge (#542)

ddiff --git a/server/app.js b/server/app.js
iindex 5e51106..aff1a2d 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -68,6 +68,8 @@ function getAllowedOrigins() {
  function createApp({ chatServer, relay, events = null, callServer = null, settings = null, chatAppSettings = null }) {
      const allowedOrigins = getAllowedOrigins();
      const app = express();
++    // Times leave with their zone (openvibe.design rule 148): the SQLite-era text columns are UTC.
++    app.use(require('./iso-times').isoJsonTimes);
      // GET /openapi.json (SEO-3): this service's public API as OpenAPI 3.1, generated from the contracts
      // (openvibe-contracts); the operations they mark internal-only are left out.
      app.get('/openapi.json', (_req, res) => {
ddiff --git a/server/iso-times.js b/server/iso-times.js
nnew file mode 100644
iindex 0000000..9c16da7
---- /dev/null
++++ b/server/iso-times.js
@@@ -0,0 +1,46 @@
++'use strict';
++/**
++ * Times leave with their zone (openvibe.design rule 148).
++ *
++ * The tables created from SQLite (migrations/0001_initial.sql) keep timestamps as text in the
++ * SQLite shape `YYYY-MM-DD HH:MM:SS`, which ov_now() writes in UTC. A browser reads that string as
++ * local time, so west of UTC every event looked hours in the future. This is the edge: JSON fields
++ * whose name says they are a time are rendered as ISO 8601 with Z, and nothing else changes — the
++ * stored text, cursors built from it and every query that compares it stay exactly as they are.
++ *
++ * Already-ISO values (with Z or an offset), dates (`YYYY-MM-DD`) and non-strings pass through.
++ * `POST /api/v1/...` cursors echo their own stored text, not one of these fields, so pagination is
++ * unaffected.
++ */
++const SQL_TEXT_TIME = /^\d{4}-\d\d-\d\d[ T]\d\d:\d\d(?::\d\d(?:\.\d+)?)?$/;
++// created_at, updated_at, started_at, ended_at, expires_at, last_message_at, timestamp, …
++// and the bare `created` / `updated` / `started` / `ended` / `expires` some responses use.
++const TIME_KEY = /(^|_)(at|created|updated|started|ended|expires|timestamp)$|^last_|^(since|until)$/;
++
++/** One stored time as ISO 8601 with Z; anything not in the SQLite shape is returned untouched. */
++function isoTime(value) {
++    return typeof value === 'string' && SQL_TEXT_TIME.test(value) ? `${value.replace(' ', 'T')}Z` : value;
++}
++
++/** Copy `value`, rendering time-named fields; arrays and plain objects are walked, a Date is not. */
++function normalizeTimes(value, depth = 0) {
++    if (depth > 8 || value === null || typeof value !== 'object') return value;
++    if (Array.isArray(value)) return value.map((item) => normalizeTimes(item, depth + 1));
++    const proto = Object.getPrototypeOf(value);
++    if (proto !== Object.prototype && proto !== null) return value;
++    const out = {};
++    for (const [key, item] of Object.entries(value)) {
++        out[key] = TIME_KEY.test(key) ? isoTime(item) : normalizeTimes(item, depth + 1);
++    }
++    return out;
++}
++
++/** Express middleware: JSON answers carry ISO times. Internal service routes keep their SQL shape. */
++function isoJsonTimes(req, res, next) {
++    if (req.path.startsWith('/internal/')) return next();
++    const json = res.json.bind(res);
++    res.json = (body) => json(normalizeTimes(body));
++    next();
++}
++
++module.exports = { TIME_KEY, SQL_TEXT_TIME, isoTime, normalizeTimes, isoJsonTimes };
ddiff --git a/test/iso-times.test.js b/test/iso-times.test.js
nnew file mode 100644
iindex 0000000..730421f
---- /dev/null
++++ b/test/iso-times.test.js
@@@ -0,0 +1,48 @@
++'use strict';
++/**
++ * Times leave with their zone (openvibe.design rule 148): Chat's SQLite-era text timestamps are UTC
++ * but a browser reads `YYYY-MM-DD HH:MM:SS` as local time. The JSON edge renders time fields as ISO
++ * 8601 with Z; stored text, cursors and every query that compares it stay unchanged. Internal service
++ * routes (Live's reads) keep their documented SQL shape.
++ */
++const assert = require('assert');
++const { boot, suite } = require('./helpers');
++const { isoTime, normalizeTimes } = require('../server/iso-times');
++
++assert.strictEqual(isoTime('2026-11-12 05:01:02'), '2026-11-12T05:01:02Z');
++assert.strictEqual(isoTime('2026-11-12T05:01:02.123Z'), '2026-11-12T05:01:02.123Z', 'ISO with Z is left alone');
++assert.strictEqual(isoTime('2026-11-12T05:01:02+02:00'), '2026-11-12T05:01:02+02:00', 'ISO with an offset is left alone');
++assert.strictEqual(isoTime('2026-11-12'), '2026-11-12', 'a date is not a time');
++assert.strictEqual(isoTime(null), null);
++assert.deepStrictEqual(
++    normalizeTimes({ id: 1, created_at: '2026-11-12 05:01:02', updated_at: null, when: '2026-11-12 05:01:02', meta: { last_seen: '2026-11-12 05:01:02' }, tags: [{ expires_at: '2026-11-12 05:01:02' }] }),
++    { id: 1, created_at: '2026-11-12T05:01:02Z', updated_at: null, when: '2026-11-12 05:01:02', meta: { last_seen: '2026-11-12T05:01:02Z' }, tags: [{ expires_at: '2026-11-12T05:01:02Z' }] },
++    'time-named fields are rendered; body text that looks like a time is not',
++);
++
++const t = suite('iso-times');
++let h;
++
++t('boot', async () => { h = await boot(); });
++
++t('a public room\'s created_at is ISO 8601 with Z in the JSON API', async () => {
++    await h.db.run("INSERT INTO rooms (id, slug, name, kind, visibility, owner_id, created_at) OVERRIDING SYSTEM VALUE VALUES (901, 'zone-room', 'Zoned room', 'community', 'public', 1, '2026-10-01 10:00:00')");
++    const r = await h.http('GET', '/api/chat/rooms');
++    assert.strictEqual(r.status, 200, r.text);
++    const room = (r.body.public || []).find((x) => x.slug === 'zone-room');
++    assert.ok(room, 'the room is listed');
++    assert.strictEqual(room.created_at, '2026-10-01T10:00:00Z');
++    assert.match(room.created_at, /Z$/);
++    const stored = await h.db.get("SELECT created_at FROM rooms WHERE slug = 'zone-room'");
++    assert.strictEqual(stored.created_at, '2026-10-01 10:00:00', 'the stored text is untouched');
++});
++
++t('an internal service route keeps its SQL shape', async () => {
++    await h.db.run("INSERT INTO chat_messages (id, stream_id, user_id, username, message, timestamp) OVERRIDING SYSTEM VALUE VALUES (902, 77, 1, 'zoner', 'hello', '2026-10-01 10:00:00')");
++    const token = h.serviceToken(['chat.messages.read'], { sub: 'svc:live' });
++    const r = await h.http('GET', '/internal/chat/messages?stream_id=77', { token });
++    assert.strictEqual(r.status, 200, r.text);
++    assert.strictEqual(r.body.messages[0].timestamp, '2026-10-01 10:00:00', "Live's internal contract still gets SQL text");
++});
++
++t.run(async () => { if (h) await h.close(); });