test(dogfood): seed the tz-boundary analytics fixture through preserveAudit

The analytics timezone fixture back-dates `created_at` to a deliberate DST
boundary and was relying on the create-side `??` that #15964 removes — the
first measured LEGITIMATE consumer of that hole. It now uses the explicit
historical channel the same ruling preserved (`preserveAudit`, what REST's
`treatAsHistorical` sets), and every assertion in the file is byte-unchanged.

`isSystem` alone never preserved it: that flag exempts the engine's readonly
strip, not the audit binder's stamp. Both halves are pinned at unit level in
`plugin-audit-created-at-create-side.test.ts`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Author: claude

packages/objectql/src/plugin-audit-created-at-create-side.test.ts

@@ -170,6 +170,44 @@ describe('audit binder: create-side `created_at` (#15964)', () => {
     expect(Date.parse(row.created_at)).toBeGreaterThan(Date.parse('2020-01-01T00:00:00.000Z'));
   });
 
+  // [#15964] `isSystem` on its own is NOT a back-dating channel, and never was.
+  // It exempts the engine's readonly STRIP; the audit binder's stamp is not
+  // gated on it at all. Before this change a system-context seed kept its
+  // supplied `created_at` because of the `??`, not because of its elevation —
+  // which is how a legitimate back-dating fixture came to depend on the hole
+  // (`packages/qa/dogfood/test/analytics-timezone.dogfood.test.ts` seeds a
+  // timezone-boundary instant exactly this way). Both halves are pinned here so
+  // the next such seed is told which flag it actually needs.
+  it('`isSystem` alone does NOT preserve it, and `isSystem` + `preserveAudit` does', async () => {
+    const { objectql, captured } = await boot('repro_system_seed');
+
+    await objectql.insert('repro_system_seed', forgedPayload(), {
+      context: { isSystem: true },
+    });
+    await objectql.insert('repro_system_seed', forgedPayload(), {
+      context: { isSystem: true, preserveAudit: true },
+    });
+
+    const [elevatedOnly, historical] = captured;
+    printTable('isSystem only', elevatedOnly);
+    printTable('isSystem + preserveAudit', historical);
+
+    // The system context skips the strip, so `id` and `run_at` DO survive here —
+    // that is the control proving the elevation really took effect, and it is
+    // what makes the `created_at` row below a statement about the binder alone.
+    expect(elevatedOnly.id).toBe(FORGED_ID);
+    expect(elevatedOnly.run_at).toBe(FORGED_AT);
+    // …and the binder still stamps, because it is not gated on `isSystem`.
+    expect(elevatedOnly.created_at).not.toBe(FORGED_AT);
+    expect(elevatedOnly.updated_at).not.toBe(FORGED_AT);
+
+    // The explicit channel — `ExecutionContext.preserveAudit`, what REST's
+    // `treatAsHistorical` import sets — reaches the binder through
+    // `buildSession` independently of `isSystem`, so a back-dated seed works.
+    expect(historical.created_at).toBe(FORGED_AT);
+    expect(historical.updated_at).toBe(FORGED_AT);
+  });
+
   // The ruled control: the historical-import channel is EXPLICIT and still
   // works. `runImport({ treatAsHistorical: true })` puts `preserveAudit: true`
   // on the write context (`packages/rest/src/import-runner.ts`), which is

packages/qa/dogfood/test/analytics-timezone.dogfood.test.ts

@@ -42,14 +42,34 @@ describe('dogfood: org timezone drives analytics date bucketing (#1982/#2018)',
     stack = await bootStack(crmStack);
 
     // Deterministic fixture: N leads pinned to the tz-boundary instant, inserted
-    // as system so the write path's defaults/validation don't fight the setup.
+    // as system so the write path's defaults/validation don't fight the setup,
+    // and with `preserveAudit` because a BACK-DATED `created_at` is exactly what
+    // that flag exists to permit.
+    //
+    // [#15964] `preserveAudit` is REQUIRED here and is not decoration. The audit
+    // binder's `beforeInsert` stamp used to be `record.created_at ?? now` — a
+    // caller-supplied value won on EVERY insert, with no flag — which is the
+    // hole a plain REST `POST` reached to forge the audit anchor. It is now the
+    // same shape as `updated_at`, `preserveAudit ? (… ?? now) : now`, on the
+    // maintainer ruling of 2026-09-06 (decision batch #54, option A). This
+    // fixture is a LEGITIMATE back-dating consumer of the old behaviour — the
+    // first one measured — so it moves to the explicit channel the same ruling
+    // preserved rather than the accident it used to ride on.
+    //
+    // ⚠️ `isSystem` alone does NOT do this and never did: it exempts the engine's
+    // readonly STRIP, not the audit binder's stamp, which is why this fixture
+    // used to depend on the `??` rather than on its own elevation. Measured
+    // both ways in `@objectstack/objectql`'s
+    // `plugin-audit-created-at-create-side.test.ts`. `preserveAudit` is the flag
+    // REST's `treatAsHistorical` import sets on the write context
+    // (`packages/rest/src/import-runner.ts`), reaching this same hook.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const ql = await stack.kernel.getServiceAsync<any>('objectql');
     for (let i = 0; i < N_LEADS; i++) {
       await ql.insert(
         'crm_lead',
         { name: `tz-lead-${i}`, status: 'new', created_at: BOUNDARY },
-        { context: { isSystem: true } },
+        { context: { isSystem: true, preserveAudit: true } },
       );
     }
     // Sanity: confirm created_at actually persisted as the boundary instant