Store and serve a maintenance date as a date

The machine maintenance panel showed every date one calendar day early on this
site, and would show it a day late east of UTC.

lastmaintenancedate and nextmaintenancedate were DATETIME columns holding
midnight, and BaseModel.to_dict serialises a datetime as isoformat + 'Z', so
2026-12-15 00:00:00 went out as "2026-12-15T00:00:00Z" and the browser
converted it into local time. There is no time in a maintenance date: the form
offers a date picker, the CSV importer takes '2026-06-01', and the value is only
ever compared against other dates. Every sibling already models it correctly -
measuringtools.lastcalibrationdate, warranties.startdate and enddate are all
db.Date - so machines were the odd one out.

Migration 7d40 converts both columns; MySQL truncates a midnight time so no
data moves, and SQLite neither enforces nor needs it.

That exposed two more things. The route was assigning the raw request string to
the column, which a DATE column rejects outright - it now goes through the
strict parser from wave 2, so a mistyped maintenance date is refused with a 400
rather than stored or nulled. And BaseModel.to_dict had no branch for a plain
date, so one reached Flask's encoder and came out as an HTTP-date
("Thu, 15 Jan 2026 00:00:00 GMT") - which a browser parses back into a moment
and can still render as the day before. Dates now serialise as "2026-01-15",
with datetime checked first because it is a subclass of date.

Verified against MySQL on a live instance: the column is DATE, the API serves
2026-01-15, a mistyped date is refused with 400, and a rename on a machine that
has maintenance dates saves - the 500 from the audit-log fix in 5d81f50c, now
confirmed end to end rather than only in tests.

Scope: product

plugins/machines/api/routes.py

@@ -7,7 +7,8 @@ from shopdb.api import db, Asset, AssetType, AuditLog, Vendor, success_response,
 
 from ..models import Machine, MachineType
 
-from shopdb.api import require_permission, apply_import_timestamps, intarg
+from shopdb.api import (require_permission, apply_import_timestamps, intarg,
+                        DateValueError, parse_date_fields)
 
 machines_bp = Blueprint('machines', __name__)
 
@@ -336,6 +337,14 @@ def create_machine():
     - mapx, mapy, notes
     """
     data = request.get_json()
+    # Refused rather than stored raw or nulled: these are db.Date columns
+    # (migration 7d40), so a string would be rejected by the engine and a
+    # mistyped one used to become NULL further down the stack.
+    try:
+        maintenancedates = parse_date_fields(
+            data, ('lastmaintenancedate', 'nextmaintenancedate'))
+    except DateValueError as bad:
+        return error_response(ErrorCodes.VALIDATION_ERROR, str(bad))
 
     if not data:
         return error_response(ErrorCodes.VALIDATION_ERROR, 'No data provided')
@@ -388,8 +397,8 @@ def create_machine():
         modelnumberid=data.get('modelnumberid'),
         requiresmanualconfig=data.get('requiresmanualconfig', False),
         islocationonly=data.get('islocationonly', False),
-        lastmaintenancedate=data.get('lastmaintenancedate'),
-        nextmaintenancedate=data.get('nextmaintenancedate'),
+        lastmaintenancedate=maintenancedates.get('lastmaintenancedate'),
+        nextmaintenancedate=maintenancedates.get('nextmaintenancedate'),
         maintenanceintervaldays=data.get('maintenanceintervaldays'),
         controllervendorid=data.get('controllervendorid'),
         controllermodelid=data.get('controllermodelid')
@@ -427,6 +436,14 @@ def update_machine(machine_id: int):
         )
 
     data = request.get_json()
+    # Refused rather than stored raw or nulled: these are db.Date columns
+    # (migration 7d40), so a string would be rejected by the engine and a
+    # mistyped one used to become NULL further down the stack.
+    try:
+        maintenancedates = parse_date_fields(
+            data, ('lastmaintenancedate', 'nextmaintenancedate'))
+    except DateValueError as bad:
+        return error_response(ErrorCodes.VALIDATION_ERROR, str(bad))
     if not data:
         return error_response(ErrorCodes.VALIDATION_ERROR, 'No data provided')
 
@@ -471,7 +488,7 @@ def update_machine(machine_id: int):
     # Update machine fields
     machine_fields = ['machinetypeid', 'vendorid', 'modelnumberid',
                       'requiresmanualconfig', 'islocationonly',
-                      'lastmaintenancedate', 'nextmaintenancedate', 'maintenanceintervaldays',
+                      'maintenanceintervaldays',
                       'controllervendorid', 'controllermodelid']
     for key in machine_fields:
         if key in data:
@@ -481,6 +498,14 @@ def update_machine(machine_id: int):
                 changes[key] = {'old': old_val, 'new': new_val}
             setattr(mach, key, data[key])
 
+    # The maintenance dates are real dates now (migration 7d40), so they are
+    # parsed rather than assigned as whatever string arrived - and a mistyped
+    # one is refused instead of stored or nulled, like every other date.
+    for key, parsed in maintenancedates.items():
+        if getattr(mach, key) != parsed:
+            changes[key] = {'old': getattr(mach, key), 'new': parsed}
+        setattr(mach, key, parsed)
+
     # Audit log if there were changes
     if changes:
         AuditLog.log('updated', 'Machine', entityid=mach.machineid,

plugins/machines/models/machine.py

@@ -73,8 +73,12 @@ class Machine(BaseModel):
     )
 
     # Maintenance tracking
-    lastmaintenancedate = db.Column(db.DateTime, nullable=True)
-    nextmaintenancedate = db.Column(db.DateTime, nullable=True)
+    # Dates, not datetimes: there is no time in a maintenance date, and a
+    # DATETIME went out of to_dict as "...T00:00:00Z", which a browser west of
+    # UTC rendered as the previous day. measuringtools and warranties already
+    # model theirs as db.Date. See migration 7d40.
+    lastmaintenancedate = db.Column(db.Date, nullable=True)
+    nextmaintenancedate = db.Column(db.Date, nullable=True)
     maintenanceintervaldays = db.Column(db.Integer, nullable=True)
 
     # Controller info (for CNC machines)