[objectstack-fleet]

Requested by Elon · project thread

domain:server#3 · os-elon-musk · session_016WV4czs2fGS6UiDUUbdGrf

Fixes #27733
Fixes #27710

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:resolveLocalizationContext 在调用方未指明组织、且组织探针(sys_organization)因存储故障抛 AuthzStoreUnavailableError 时,也返回 readFailed: true(与 fix(core, service-messaging): a failed settings read is retried, not dead-lettered as TEMPLATE_INVALID #27730 的设置读失败同义),且这种结果两种缓存都不写,下一次请求重新探。plugin-auth 的认证邮件币种读取在 readFailed 时拒绝;若渲染因此只缺默认币种而被拒,先以 XXX 试渲染一次(不发送),能过就抛一条点名"币种读取失败、读成功后可再发"的瞬时错误,不再是 TEMPLATE_INVALID 加"去设置 localization.currency"的误导性补救。
• 为什么改:探针故障时原先读成"没有组织 → 没有默认",消息投递被判永久进死信;认证邮件把一切读失败都当"没有默认币种"。分诊 6509207804、6506866652:读失败是瞬时的,只有读成功且无默认才是永久的。
• 风险与回滚:不改任何公开类型(readFailed 已存在,只多一个触发条件;新函数不在包入口导出),Clause-②: no。探针故障时不再缓存,故障期间每次请求多一次探针查询。无法解析的 posture(配置错误)不算存储故障,行为不变。回滚即 revert。
• 先看:packages/core/src/security/resolve-authz-context.ts 的 localizationFallbackReach 与 resolveLocalizationContext 中 probeFailed 分支;packages/plugins/plugin-auth/src/mail-tenant-currency.ts 的 refusalAfterCurrencyReadFault。
• 两分钟验证:pnpm --filter @objectstack/plugin-auth exec vitest run src/mail-tenant-currency.test.ts,预期 17 条全过(其中 10 条为本 PR 新增:读失败两条腿判瞬时、读成功无默认原样拒绝、无法用默认治愈的拒绝原样保留)。
• 需要你做的:无。i18n: plugin-auth and service-automation read a failed tenant-settings read as "no default", like #27257; adopt readFailed once it lands (automation fails the notify run) #27710 的 service-automation 一腿需要动热文件 engine.ts 的解析器契约,已移交 service-automation: a failed tenant-settings read fails the notify run as a permanent guard refusal; the resolver contract and run setup cannot carry readFailed #28056,本 PR 不含。

What changes

Core: the organization probe is a read too (#27733). For a caller that names no organization where no wall stands, the direct sys_setting fallback first asks sys_organization (through resolveGuestOrganization) whose rows it may read. localizationFallbackReach turned a throw there into unowned, so no sys_setting read ran and the answer had no readFailed. It now returns { reach, probeFailed }, where probeFailed is isAuthzStoreUnavailableError(err), and resolveLocalizationContext sets readFailed: true on it. Per triage 6509207804, such an answer writes no failure memo; it is not stored in the success cache either (it holds no value to keep), and the dead entry it supersedes is dropped, so the next request probes again. Any other throw (an OS_TENANCY_POSTURE that cannot be read, a configuration error, not transient) still answers unowned with no readFailed. The settings-read memo and the settings-service legs are unchanged. The readFailed doc comment now names both triggers.

plugin-auth: the auth mails' tenant currency (#27710). withMailTenantCurrency (mail-tenant-currency.ts) wraps the email service the plugin hands the AuthManager. Its resolver used to return .currency for every answer, so a failed read added no currency and the render refused a no-argument {{ amount | currency }} hole TEMPLATE_INVALID with the "set localization.currency" remedy. Now:

• The resolver moved from an inline closure in auth-plugin.ts to localizationMailCurrencyResolver (same file as the wrapper, not exported from the package entry). It rejects when readFailed is set, as messaging's getTenantCurrency does since fix(core, service-messaging): a failed settings read is retried, not dead-lettered as TEMPLATE_INVALID #27730.
• On a rejected read the wrapper sends without a currency. When that send throws TEMPLATE_INVALID, it renders the template once more without sending (renderTemplate, with the ISO no-currency code XXX). If that still refuses TEMPLATE_INVALID, a default cannot cure the template (an @path value that is not a code) and that refusal stands. If it renders, or the service has no renderTemplate, the mail fails with the mail '<template>' was not rendered: the organization's default currency could not be read (<cause>); it can be sent once that read succeeds, which carries no TEMPLATE_* code. The auth mail has no retry ladder of its own: the caller (a resend endpoint, a background send) sees a transient error it can retry, instead of a permanent one.
• Every other failure, a successful read with no default, and a template with no such hole are unchanged.

service-automation: not in this PR. #27710's notify-run leg moved to #28056 (seat 3). plugin.ts alone cannot express it: the resolver's rejection and its undefined are swallowed alike in run-resume.ts (run setup and withTenantCurrency); the resolver contract FlowTenantCurrencyResolver that says "throws, tolerated" is documented in engine.ts, a held hot file (#27951); and the missing-default refusal is a FlowTextTemplateError branded a guard refusal in builtin/template.ts, with no AutomationContext member (a packages/spec contract) to carry "the read failed" to it.

Why

Triage 6509207804 (#27733) and 6506866652 (#27257 retriage, which graded readFailed and filed #27710): a failed read learned nothing and is transient; only a read that succeeded and found no default is permanent. #27730 covered the sys_setting leg and messaging; this covers the probe leg one step earlier and the plugin-auth caller.

Tests

• packages/core/src/security/resolve-localization-read-failed.test.ts (5 new): a store fault on the probe answers the built-ins with readFailed: true and reads no sys_setting; no memo of either kind (an engine with the write-epoch and middleware seams, so a success entry would be kept if written): the next request probes again, and once the store answers it reads CNY with no readFailed; a probe that succeeds and finds no organization has no readFailed; an unreadable posture has none; a caller naming its organization is not probed.
• packages/services/service-messaging/src/template-tenant-currency.test.ts (1 new, the email channel through MessagingServicePlugin's own wiring): a delivery with no organization whose probe fails renders without currency, trial-renders with XXX, sends nothing, and is graded retryable with no TEMPLATE_ text; once the probe answers, the next delivery formats in CNY.
• packages/plugins/plugin-auth/src/mail-tenant-currency.test.ts (10 new): with a failed read, a missing-default refusal becomes the transient error (exact text, no TEMPLATE_, one XXX trial, nothing sent); a service with no renderTemplate gets it too; an @path refusal, alone or behind the missing default, stands; TEMPLATE_NOT_FOUND stands with no trial; a template needing no default is sent; a successful read with no default keeps the render's refusal with no trial. Through localizationMailCurrencyResolver over the real resolveLocalizationContext: a failed sys_setting read and a failed sys_organization probe (identity mail) both reach the mail as the transient error; a read with no default reaches it as the refusal; a read that finds CNY formats in it.

Acceptance notes

• Re-measured on main @ bc496bf7: localizationFallbackReach still mapped the probe's throw to UNOWNED_ORGANIZATION_REACH with no readFailed; auth-plugin.ts and service-automation/src/plugin.ts still returned .currency without reading readFailed. Both premises held.
• Clause-②: no, confirmed from the diff: no exported type changes (readFailed?: true already exists); localizationMailCurrencyResolver lives in plugin-auth/src/mail-tenant-currency.ts, which no package entry re-exports. The contract review is therefore not expected, as the dispatch said.
• Changeset: @objectstack/core and @objectstack/plugin-auth, patch. service-messaging moved no code (one new test), so it has none; service-automation has no change here.
• Skills-docs: none. git grep -n "readFailed\|no tenant default\|could not be read" -- skills docs content names no text about this resolver or these mails. content/docs/automation/email-templates.mdx and content/docs/kernel/runtime-services/email-service.mdx describe only the "no default currency reaches the render" case, which is unchanged.
• Branch name: the card thread's harness-pinned branch claude/project-thread-abzzym names no issue; claims 6520779833 / 6520770423 (amended) are the identity record.
• Open PRs: none of the 20 open PRs touches these files. Setup: changing a member's role silently auto-grants a permission set; the result never says a set was granted (#27521 row 14) #27862 (seat 3) edits other hunks of plugin-auth/src.

Verification

Head eb1c3932 (one commit on main @ bc496bf7).

• Ablations (scripts/ablation-replace.mjs; each leg red, then restored with blob == HEAD):
  • A1, the probe fault sets no kind (probeFailed: false): core 2 of 10 red; with core rebuilt, messaging 1 red (the probe pin) and plugin-auth 1 red (the end-to-end probe pin).
  • A2, the no-memo branch skipped (the answer falls into the success cache): core 1 red (the no-memo pin).
  • A3, every derivation throw counts (probeFailed: true): core 1 red (the unreadable-posture pin).
  • A4, the auth resolver never rejects: plugin-auth 2 red (both end-to-end read-fault pins); rerun after the last fixture change, still 2 red.
  • A5, the wrapper never re-grades (throw err): plugin-auth 5 red.
  • A6, the trial render's standing refusal ignored: plugin-auth 2 red (both @path pins).
• Tests: @objectstack/core 128 files / 2878 passed; @objectstack/plugin-auth 204 / 3896 passed (10 skipped); @objectstack/service-messaging 62 / 756 passed.
• Types: typecheck exit 0 for core, plugin-auth, service-messaging (the first messaging run caught an ES2022 Array.prototype.at in the new pin; replaced by an index).
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 69 families, after a whole-tree turbo run build. 68 exited 0 on the first run; check:objectql-double-limit flagged the new plugin-auth find double as unjudged, and after rewriting it on the generic where-matcher it exits 0. That gate and the eight others that read test files (where-matcher, engine-double-contract, cross-package-test-inputs, test-source-alias, nul-bytes, issue-citations, undeclared-dep-imports, query-options-erasure) were rerun at eb1c3932, all exit 0; the derived list at eb1c3932 is the same 69. --ran: 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN.
• Lint: pnpm lint exit 0; ESLint on the two test files changed afterwards, 0 errors.
• Dogfood battery: not run; the title has no ! and there is no (narrowing) arm.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (packages/spec untouched.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request. (Two sibling cards, one dispatch.)
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (Not touched.)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4czs2fGS6UiDUUbdGrf

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/core, @objectstack/plugin-auth, touching 12 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/email-templates.mdx (via sendTemplate (literal, a string literal on a changed line))
• content/docs/kernel/index.mdx (via sendTemplate (literal, a string literal on a changed line))
• content/docs/kernel/runtime-services/email-service.mdx (via sendTemplate (literal, a string literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v18/18-2.mdx (via resolveLocalizationContext (symbol, a top-level function), sendTemplate (literal, a string literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 49 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ec7e15abcb66afd638932b68e0ce4bc1b17bb313 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9274bc7f848902c588b1d8bcf7f3c7632d7c9145 — the merge of head eb1c3932176dc9aab7cce58b1558289d706e0640 into base ec7e15abcb66afd638932b68e0ce4bc1b17bb313, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9274bc7f848902c588b1d8bcf7f3c7632d7c9145 && git checkout 9274bc7f848902c588b1d8bcf7f3c7632d7c9145
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ec7e15abcb66afd638932b68e0ce4bc1b17bb313 eb1c3932176dc9aab7cce58b1558289d706e0640 && git checkout -B drift-repro ec7e15abcb66afd638932b68e0ce4bc1b17bb313 && git merge --no-ff eb1c3932176dc9aab7cce58b1558289d706e0640

node scripts/docs-audit/affected-docs.mjs --json ec7e15abcb66afd638932b68e0ce4bc1b17bb313

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ec7e15abcb66afd638932b68e0ce4bc1b17bb313 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

Seat ACCEPT · PR #28088 · head eb1c3932176dc9aab7cce58b1558289d706e0640 · 2026-10-30T12:38Z

维护者速读

• 改了什么： 两处把「设置读失败」误当成「组织没设默认币种」的地方改正：① 核心本地化解析里，组织探测因存储故障失败时，答案也带 readFailed，消息通道据此重试，不再永久丢信（core: an organization-probe store fault in localizationFallbackReach reads as unowned, so the delivery's missing default currency is graded permanent with no readFailed #27733）；② 认证类邮件（验证、重置密码、邀请等）读币种失败时，若模板因此缺默认币种而拒绝，改为抛可重试的错误，不再报 TEMPLATE_INVALID 和「请设置 localization.currency」（i18n: plugin-auth and service-automation read a failed tenant-settings read as "no default", like #27257; adopt readFailed once it lands (automation fails the notify run) #27710）。
• 为什么改： 一次瞬时存储故障会让邮件被判为永久失败，并给出错误的修复建议。
• 风险与回滚： 读成功且确实没有默认值的情形完全不变；探测失败的答案不进任何缓存，下次请求重新读。回滚即还原 core 与 plugin-auth 的改动。自动化 notify 的同类问题需要改 engine.ts，已拆到 service-automation: a failed tenant-settings read fails the notify run as a permanent guard refusal; the resolver contract and run setup cannot carry readFailed #28056。
• 先看： packages/core/src/security/resolve-authz-context.ts 的 localizationFallbackReach，和 packages/plugins/plugin-auth/src/mail-tenant-currency.ts。
• 两分钟验证： 跑 resolve-localization-read-failed.test.ts 与 mail-tenant-currency.test.ts。
• 需要你做的： 无（Tier S，按本期落地授权由席位落地）。

席位核对

• Shape: draft → main, Fixes #27733, Fixes #27710. 7 files (+487/−40): core resolver + a new test; plugin-auth mail-tenant-currency.ts, its wiring in auth-plugin.ts, two test files; one changeset. check-governed-merges --pr 28088: NOT governed.
• Premises: both re-measured on main @ bc496bf7 by the thread (the probe leg mapped AuthzStoreUnavailableError to unowned with no readFailed; the mail resolver returned .currency and ignored readFailed).
• Graded rules: core: an organization-probe store fault in localizationFallbackReach reads as unowned, so the delivery's missing default currency is graded permanent with no readFailed #27733 per triage 6509207804 — a probe store fault answers readFailed: true and writes no memo (the entry it superseded is dropped; a non-store throw still says nothing more); pinned at the resolver and through one messaging channel. i18n: plugin-auth and service-automation read a failed tenant-settings read as "no default", like #27257; adopt readFailed once it lands (automation fails the notify run) #27710 per triage 6506866652 for the plugin-auth caller — a failed read is transient, never "no default"; a read that succeeds and finds none keeps today's refusal. The XXX trial render (never sent) keeps a template refusal a default cannot cure standing.
• Scope split: i18n: plugin-auth and service-automation read a failed tenant-settings read as "no default", like #27257; adopt readFailed once it lands (automation fails the notify run) #27710's service-automation leg needs the held engine.ts resolver contract, run-resume.ts and builtin/template.ts; moved to service-automation: a failed tenant-settings read fails the notify run as a permanent guard refusal; the resolver contract and run setup cannot carry readFailed #28056 (body says so, with the three measured reasons). Fixes #27710 is right: service-automation: a failed tenant-settings read fails the notify run as a permanent guard refusal; the resolver contract and run setup cannot carry readFailed #28056 owns that row.
• Declarations: Clause-②: no (no shape change: readFailed gains a trigger; the new resolver helper is not on plugin-auth's entry), Metadata-protocol: none; @objectstack/core, @objectstack/plugin-auth patch.
• Local (card thread): six ablations red then restored; core 2878, plugin-auth 3896, service-messaging 756 passing; typecheck and pnpm lint exit 0; dispatch-gates --ran 69/69.
• Gate check-runs on this head: 48 total, 38 success, 10 skipped by the path filter, 0 failed. mergeable_state: clean.
• Landing: Tier S, under the maintainer's landing grant for this term (2026-10-29 22:05Z, seat thread). Ready + auto-merge through the relay.

ACCEPT