Insert Date & Time and date fields use local time, not UTC (#1782)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Cargo.toml

@@ -92,6 +92,8 @@ zeroize = "1"
 # dependency of other crates.
 libc = "0.2"
 
+# time
+
 # ui
 egui = "0.37"
 egui_extras = { version = "0.37", default-features = false }

ROADMAP.md

@@ -304,6 +304,7 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-29 | A NUL in a document title no longer reaches the native window title, which panicked on X11 (#3634): displayed titles and suggested file names drop NUL characters and fall back to the untitled name when empty; the stored title is unchanged |
 | 2026-10-28 | The Traditional Chinese interface draws hanzi to the Taiwan standard: on the desktop an installed Traditional Chinese font (PingFang TC on macOS, Microsoft JhengHei on Windows, Noto Sans CJK TC on Linux) comes before the embedded Noto Sans CJK SC, which drew 說, 這, 為, 戶 in mainland shapes; without one, and on the web, nothing changes. |
 | 2026-10-17 | macOS launch arguments (`-psn_*`, `-NS*`, `-Apple*`) are no longer opened as files, and a file that fails to open names the file and the real cause on the status bar and in the log (#1103). The reported "corrupt" error could not be reproduced. |
+| 2026-10-14 | Insert › Date & Time and DATE, TIME and other date fields show the computer's local date, time and weekday, daylight saving included, as Word does (#1707); they showed UTC, so a user in New Zealand at noon on 31 October got 30 October 23:00. Timestamps saved in files (revisions, comments, document properties) stay UTC. Backstage's greeting follows the local hour too |
 | 2026-10-23 | File > Print: N-up physical sheets and left/right-bound booklets, shared preview/PDF geometry and padded copies (#641); printer jobs keep upstream’s link-annotation fix. |
 | 2026-10-17 | Password-protected Word files from Word 2007 (Standard encryption: AES-128/192/256, SHA-1) open with their password, also when named `.doc` or `.dot`; a wrong or missing password is reported as for newer files. Word 97-2003 files with an AES header, which the public spec doesn't define, are refused with a clear message (gap 9) |
 | 2026-10-27 | Connector rerouting indexes laid-out object positions once per batch, preserving page hints, first-match order and same-page glue; synthetic equivalence, geometry and scaling regressions (#3631); routing policy and readiness estimates unchanged |
@@ -821,6 +822,7 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-29 | trivial | Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880). Filtered/sorted order, product geometry and single-label mode retained; readiness estimates unchanged. |
 | 2026-10-27 | trivial | Progress log: Return on File › Print prints, as Word's default Print button does |
 | 2026-10-26 | minor | Word-observed Proofing task pane uses shared review commands; clicking a suggestion corrects and advances; context, suggestion cards and ignore/dictionary links follow the Windows reference; inspected previews prompted a full-width context and scrollable three-card list; exact selected spelling takes priority over overlapping grammar, with command/pane regressions and integration workflow paths; readiness estimates unchanged |
+| 2026-10-14 | trivial | Progress log: Insert Date and Time and DATE/TIME fields use local time (#1707) |
 | 2026-10-22 | trivial | Progress log: one native window per open document |
 | 2026-10-22 | trivial | Progress log: every open document keeps its own recovery copy |
 | 2026-10-22 | trivial | Progress log: several open documents in the desktop window |

crates/engine/Cargo.toml

@@ -44,6 +44,8 @@ getrandom = { workspace = true }
 # Language packs (CP4.3): downloaded, verified and unpacked by the suite's font store.
 craft-font-store = { workspace = true }
 craft-font-catalog = { workspace = true }
+# The local time zone's offset for Insert ▸ Date & Time and date fields (#1707); the web asks the browser's Date.
+chrono = { workspace = true, features = ["clock"] }
 
 [target.'cfg(unix)'.dependencies]
 # O_NONBLOCK, so a path swapped for a named pipe can't block `open` (#3666).

crates/engine/src/cmd.rs

@@ -548,6 +548,59 @@ pub fn now_iso() -> String {
     iso_from_unix_secs(now_unix())
 }
 
+/// The local time zone's offset from UTC in seconds (east positive) at `unix`, daylight saving
+/// included: the system's zone, or the browser's on the web. 0 (UTC) when it can't be found.
+pub fn local_offset_secs(unix: u64) -> i64 {
+    system_offset_secs(unix).clamp(-26 * 3600, 26 * 3600)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn system_offset_secs(unix: u64) -> i64 {
+    use chrono::Offset;
+    let Some(utc) = i64::try_from(unix).ok().and_then(|secs| chrono::DateTime::from_timestamp(secs, 0)) else {
+        return 0;
+    };
+    // chrono's `Local` has internal `expect`s (unreadable zone data, an unmapped Windows year), so
+    // fence it: a failure means UTC, never a crash. A caught panic is still reported by the app's
+    // panic hook (logged, no abort); the document is untouched.
+    std::panic::catch_unwind(|| i64::from(utc.with_timezone(&chrono::Local).offset().fix().local_minus_utc())).unwrap_or(0)
+}
+
+/// On the web the browser's `Date` gives the offset directly (chrono isn't used there).
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
+fn system_offset_secs(unix: u64) -> i64 {
+    let ms = (unix as f64) * 1000.0;
+    if !ms.is_finite() {
+        return 0;
+    }
+    // `getTimezoneOffset` is minutes *west* of UTC (UTC+13 gives -780); NaN for an invalid date.
+    let west_min = js_sys::Date::new(&js_sys::wasm_bindgen::JsValue::from_f64(ms)).get_timezone_offset();
+    if west_min.is_finite() && west_min.abs() <= 26.0 * 60.0 { -(west_min as i64) * 60 } else { 0 }
+}
+
+/// Other wasm targets (WASI) have neither chrono's clock nor a browser: UTC.
+#[cfg(all(target_arch = "wasm32", not(target_os = "unknown")))]
+fn system_offset_secs(_unix: u64) -> i64 {
+    0
+}
+
+/// The local civil date and time now: see [`local_civil`].
+pub fn local_now() -> (i64, u32, u32, (u32, u32, u32), i64) {
+    let now = now_unix();
+    local_civil(now, local_offset_secs(now))
+}
+
+/// Local civil date and time for an instant: (year, month, day, (hour, minute, second), days since
+/// 1970-01-01 of that local day, for the weekday). `offset_secs` is the local zone's offset from
+/// UTC (east positive). Saturating, so a hostile offset or clock never overflows.
+pub fn local_civil(unix: u64, offset_secs: i64) -> (i64, u32, u32, (u32, u32, u32), i64) {
+    let local = i64::try_from(unix).unwrap_or(i64::MAX).saturating_add(offset_secs);
+    let days = local.div_euclid(86_400);
+    let t = local.rem_euclid(86_400) as u32;
+    let (y, m, d) = civil_from_days(days);
+    (y, m, d, (t / 3600, t / 60 % 60, t % 60), days)
+}
+
 /// Days since 1970-01-01 → (year, month, day).
 ///
 /// `NaiveDate` only covers about ±262143 years, but this is reached by the system clock (and by

crates/engine/src/cmd/insert.rs

@@ -15,7 +15,7 @@ mod objects;
 
 pub(crate) use header_footer::saved_copy;
 use header_footer::{create_hf, edit_hf, header_footer, new_empty_headers, strip_headers};
-pub use items::{DropCapState, drop_cap_state, format_date, format_date_parts};
+pub use items::{DropCapState, drop_cap_state, format_date, format_date_at, format_date_parts};
 use items::{cover_page, date_time, drop_cap, drop_cap_off, field, page_number, symbol};
 use links::{bookmark, delete_bookmark, link, link_targets};
 pub use links::{bookmark_name_ok, bookmark_range, bookmark_span};

crates/engine/src/cmd/insert/items.rs

@@ -61,14 +61,16 @@ pub(super) fn date_time(s: &mut Session, v: &Value) -> CmdResult {
 
 /// Format today's date with a Word picture (`M/d/yyyy`, `MMMM d, yyyy`, `yyyy-MM-dd`, `dddd`…).
 pub fn format_date(fmt: &str) -> String {
-    let iso = crate::cmd::now_iso();
-    let y: i64 = iso.get(0..4).and_then(|x| x.parse().ok()).unwrap_or(2026);
-    let m: usize = iso.get(5..7).and_then(|x| x.parse().ok()).unwrap_or(1);
-    let d: u32 = iso.get(8..10).and_then(|x| x.parse().ok()).unwrap_or(1);
-    let hh: u32 = iso.get(11..13).and_then(|x| x.parse().ok()).unwrap_or(0);
-    let mm: u32 = iso.get(14..16).and_then(|x| x.parse().ok()).unwrap_or(0);
-    let ss: u32 = iso.get(17..19).and_then(|x| x.parse().ok()).unwrap_or(0);
-    format_date_parts(fmt, y, m, d, (hh, mm, ss), (crate::cmd::now_unix() / 86_400) as i64)
+    // Word shows the computer's local date and time (#1707), not UTC's.
+    let now = crate::cmd::now_unix();
+    format_date_at(fmt, now, crate::cmd::local_offset_secs(now))
+}
+
+/// Format the instant `unix` (seconds since the epoch, UTC) with a Word picture, in the zone
+/// `offset_secs` east of UTC.
+pub fn format_date_at(fmt: &str, unix: u64, offset_secs: i64) -> String {
+    let (y, m, d, hms, days) = crate::cmd::local_civil(unix, offset_secs);
+    format_date_parts(fmt, y, m as usize, d, hms, days)
 }
 
 /// Format a date and time with a Word picture; `days_since` (days since 1970-01-01) gives the weekday.

crates/engine/src/cmd/insert/tests.rs

@@ -381,3 +381,38 @@ fn date_pictures() {
     assert_eq!(date_picture(r#"TIME \@ HH:mm"#).as_deref(), Some("HH:mm"));
     assert_eq!(date_picture("DATE"), None);
 }
+
+/// #1707: Insert ▸ Date & Time and DATE/TIME fields use the local civil date, time and
+/// weekday, not UTC's.
+#[test]
+fn format_date_uses_the_local_offset() {
+    // Noon on Saturday 31 October in New Zealand (UTC+13) is 2026-10-30T23:00:00Z.
+    assert_eq!(format_date_at("dddd, MMMM d, yyyy h:mm am/pm", 1_793_401_200, 13 * 3600), "Saturday, October 31, 2026 12:00 PM");
+    assert_eq!(format_date_at("M/d/yyyy H:mm", 1_793_498_400, -5 * 3600), "10/31/2026 21:00");
+    assert_eq!(format_date_at("M/d/yyyy H:mm", 1_793_401_200, 0), "10/30/2026 23:00");
+}
+
+#[test]
+fn local_civil_date_follows_the_utc_offset() {
+    let pic = "dddd d MMMM yyyy HH:mm";
+    let show = |unix: u64, off: i64| {
+        let (y, m, d, hms, days) = crate::cmd::local_civil(unix, off);
+        format_date_parts(pic, y, m as usize, d, hms, days)
+    };
+    // 2026-10-30T23:00:00Z in New Zealand (UTC+13) is Saturday 31 October, noon.
+    assert_eq!(show(1_793_401_200, 13 * 3600), "Saturday 31 October 2026 12:00");
+    // 2026-11-01T02:00:00Z at UTC-5 is still Saturday 31 October, 21:00.
+    assert_eq!(show(1_793_498_400, -5 * 3600), "Saturday 31 October 2026 21:00");
+    // Offset 0 is UTC.
+    assert_eq!(show(1_793_401_200, 0), "Friday 30 October 2026 23:00");
+    // Near the epoch with a negative offset: the day before 1970, no overflow.
+    assert_eq!(show(0, -3600), "Wednesday 31 December 1969 23:00");
+    // Hostile values never panic.
+    let _ = crate::cmd::local_civil(u64::MAX, i64::MAX);
+    let _ = crate::cmd::local_civil(u64::MAX, i64::MIN);
+    let _ = crate::cmd::local_civil(0, i64::MIN);
+    // The machine's zone is a real offset (within ±26 h) and asking never panics.
+    for unix in [0, 1_793_401_200, u64::MAX] {
+        assert!(crate::cmd::local_offset_secs(unix).abs() <= 26 * 3600);
+    }
+}

crates/ui-egui/src/backstage.rs

@@ -366,7 +366,7 @@ fn matching_templates(query: &str) -> Vec<(&'static str, &'static str)> {
 /// Home: a greeting, Blank plus a short row of templates with a link to New, then Recent.
 fn home_page(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
-    let hour = wordcraft_engine::cmd::now_iso().get(11..13).and_then(|h| h.parse::<u32>().ok()).unwrap_or(9);
+    let hour = wordcraft_engine::cmd::local_now().3.0;
     heading(
         ui,
         if hour < 12 {

crates/ui-egui/src/content_controls.rs

@@ -155,7 +155,8 @@ fn date_of(app: &WordApp, at: &Pos) -> Option<(i64, u32, u32)> {
 }
 
 fn today() -> (i64, u32, u32) {
-    let (y, m, d) = wordcraft_engine::cmd::civil_from_days((wordcraft_engine::cmd::now_unix() / 86_400) as i64);
+    // The local day, as Word's date picker shows it (#1707).
+    let (y, m, d, ..) = wordcraft_engine::cmd::local_now();
     (y, m, d)
 }