docs: rfc3339 wire timestamps convention + audit-log field notes

docs/conventions.md

@@ -237,8 +237,9 @@ Per-variant fields:
   `target = None` = operator-routed (dashboard); `Some(agent)` =
   peer-to-peer thread.
 - `Reminder { id, owner, message, due_at, age_seconds }` —
-  `due_at` is the absolute unix timestamp the scheduler is
-  targeting; clients compute time-until-fire as `due_at - now`.
+  `due_at` is the absolute time the scheduler is targeting (RFC
+  3339 on the wire, see *Timestamps on the wire* below); clients
+  compute time-until-fire against it.
 - `PendingMessages { count }` — undelivered inbox messages the
   agent still owes itself a `recv` for. Informational + not
   cancellable (drain with `recv`); only emitted when `count > 0`,
@@ -296,6 +297,21 @@ status_text, status_set_at, hive_name, swarm_name }`:
   `services.hyperhive.hiveName` / `services.hyperhive.swarmName`).
   Both `None` when the options aren't configured.
 
+### Timestamps on the wire
+
+Timestamp fields that cross a JSON boundary (dashboard API + SSE,
+the wire structs in hive-sh4re) serialize as **RFC 3339 UTC strings**
+(`2026-07-02T18:30:00Z`) via `hive_sh4re::wire_time` — Rust keeps the
+fields as `i64` unix seconds internally, only the JSON representation
+changes, and deserialization leniently accepts both the string form
+and the legacy bare integer (rolling-deploy skew, persisted blobs).
+**Input-direction** fields agents compute as epoch (`first_fire_at_unix`,
+schedule-edit `next_fire_at_unix`, `Wakeup::At`) stay integers. The
+`*_unix` field *names* are kept for now — renaming is the wire-types
+refactor's concern. The dashboard frontend parses via
+`util.js::epochSec` wherever it needs arithmetic and feeds the string
+straight to `new Date(s)` for display.
+
 ## Tool groups
 
 The MCP tool surface an agent receives is derived from a set of named