[stacknil]

Summary

Reject day integers outside 1..31 before constructing std::chrono::day, then retain the existing month/leap-year validation. Add a normal CTest regression, a focused optional fuzz target with three synthetic seeds, and the parser contract/evidence reports.

Why

At baseline e2937e8, the existing seven CTest entries passed, but Mar 257 ... was accepted after integer narrowing produced an apparently valid date. The new regression fails immediately against that original library. Sanitizers alone do not detect this semantic contract violation.

Behavior change

Out-of-domain day integers now produce the existing unknown_timestamp / invalid calendar date warning and do not contribute parsed events. Integer overflow and malformed tokens retain invalid day token. Valid dates, diagnostics, stream accounting, and recovery are covered by 2,927 deterministic cases and one three-line recovery stream. The month-length oracle is independent of the adversarial calendar conversion.

Validation

Independent local validation completed on this exact diff:

• Exported original baseline: Release build and existing CTest suite passed 7/7; the new test linked to that original library failed on day 257.
• Fresh optimized build with warnings-as-errors: CTest passed 8/8. The build and full Release suite were rerun before the signed commit and passed 8/8 again.
• Fully instrumented ASan/UBSan build: CTest passed 8/8, with no sanitizer findings; the boundary executable reported 2,927 cases plus the recovery stream.
• Clang 18.1.3/libFuzzer: fuzz_timestamp_day -runs=10000 -seed=20261015 -max_len=4096 -timeout=2 -print_final_stats=1 completed with no crash or oracle failure.
• Final diff/whitespace and privacy checks passed. The signed commit verifies locally, and its diff matches the independently reviewed patch.

See FUZZING-OR-BOUNDARY-TEST-REPORT.md for complete build/run commands. The fuzz oracle shares from_chars with production: its independent property is checking the numeric domain before narrowing, rather than independent lexical validation. Finite clean sanitizer/fuzz runs do not establish exhaustive memory safety. Local execution used Linux/libstdc++; Windows/MSVC is left to remote CI.

Compatibility

The five-line production guard preserves valid-input parsing, detector behavior, report schema, and existing golden fixtures. Consumers relying on invalid-day acceptance will observe fewer parsed events and an existing timestamp warning. The main remaining limitation is platform/coverage breadth, not a new parser grammar or dependency.

Rollback: revert this commit; no migration is required, and the invalid-day acceptance would return.

This PR starts as draft because its test corpus and evidence package span 11 files. Remote CI on 92ad73d passed all 11 visible checks across push and PR runs: Linux/Windows CTest, parser fuzz smoke, Repo Sentinel, and CodeQL. Final remote diff review matched the independently reviewed content.

GitHub now verifies this signed commit (verified: true, reason: valid) using the account's public noreply identity and the original GPG key. The identity metadata correction preserves the reviewed source tree, parent, and commit message.