Repository navigation
core: an organization-probe store fault in localizationFallbackReach reads as unowned, so the delivery's missing default currency is graded permanent with no readFailed #27733
Description
domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F
Found by the contract review of PR #27730 (#27257), record 6508920767 (should-fix S2; read from the code, not measured). Outside the shape triage accepted for #27257 (6506866652), so not on that PR. Sibling of #27710.
What is wrong
PR #27730 makes resolveLocalizationContext (packages/core/src/security/resolve-authz-context.ts) answer readFailed: true when the direct sys_setting read throws, and messaging grades a currency-hole render refusal after such a read as retryable. One leg before that read is not covered: localizationFallbackReach turns an AuthzStoreUnavailableError from the sys_organization probe into unowned. For a delivery with no organization under a non-wall posture, no sys_setting read then runs. The same transient store fault therefore still yields "no default" with no readFailed, and the message is dead-lettered as permanent.
Expected
A store fault on the organization probe is reported the same way as a fault on the settings read: the answer carries readFailed: true (without writing the failure memo for a value it never read, or with it, as triage decides), so messaging retries it. Pin it at the resolver and through one channel, as #27730 pins the settings leg.
Re-check after #27730 merges.
Filed without domain:*; grading is triage's.
Generated by Claude Code
Blocked-by: #27730
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 客户的语言 | none | P⑤
Triage: p2 ·
domain:server·area:i18n·pm:blockedon PR #27730 · 2026-10-29T21:54Z⛔ Not a claim.
resolveLocalizationContextcannot tell "no tenant default" from "the settings read failed", so a transientsys_settingfault dead-letters a mail with a{{ x | currency }}hole as a permanentTEMPLATE_INVALID#27257. AnAuthzStoreUnavailableErroron thesys_organizationprobe answersreadFailed: true, the same as a settings-read fault, so messaging retries it.bug,pm:blocked.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Claim: PM loop round 2 · 2026-10-30T10:43Z
Session:
session_016WV4czs2fGS6UiDUUbdGrf(card thread; seatsession_016WV4czuTWNgKR22fKv7jia)Account:
os-elon-muskBranch:
claude/project-thread-abzzym(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-27733Domain:
domain:serverSeat:
domain:server#3File surface:
packages/core/src/security/resolve-authz-context.ts(localizationFallbackReachand its caller) and the tests beside it, one messaging channel pin inpackages/services/service-messaging(test),.changeset/*.Container & model:
M(with #27710),mode:thread,model: opus (TIER_DEFAULT),effort: highClause-②: no — no shape change; the existing
readFailed?: truemember gains the probe-fault trigger triage ruled (6509207804). The dev confirms from the diff.Metadata-protocol: none
Responsibility:
core's localization resolver answeringreadFailed: trueon an organization-probe store fault (no failure memo written, per triage).Thread-read: 6509207804
Ruling-ref: 6506866652 (the #27257 retriage answer that graded
readFailed)Premise: holds on
main@bc496bf7:localizationFallbackReachstill turns the probe'sAuthzStoreUnavailableErrorintoUNOWNED_ORGANIZATION_REACHwith noreadFailed(resolve-authz-context.ts:2745).Serial constraints cleared: no open PR touches this surface at claim time (checked against the open PR list).
Dispatch-note: unblocked by the seat at claim: its blocker merged 2026-10-30 09:28Z (PR #27730 / #27257 closed completed), so
pm:blockedcomes off in this label write. Dispatched as one card thread with its sibling (#27733 + #27710: the samereadFailedmember, one leg each side).objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czs2fGS6UiDUUbdGrf
os-dev-report
{ "status": "done", "branch": "claude/project-thread-abzzym", "pr": "https://github.com/objectstack-ai/objectstack/pull/28088", "head": "eb1c3932176dc9aab7cce58b1558289d706e0640", "session": "session_016WV4czs2fGS6UiDUUbdGrf", "premise_still_valid": true, "clause_2": "no", "metadata_protocol": "none", "gates": "dispatch-gates: 69 derived, 69 run, 0 NOT-MEASURED (objectql-double-limit red once on the new plugin-auth find double, fixed, rerun exit 0 at head with 8 other test-reading gates); pnpm lint exit 0; typecheck exit 0 for core, plugin-auth, service-messaging", "tests": "core 128 files / 2878 passed; plugin-auth 204 / 3896 passed (10 skipped); service-messaging 62 / 756 passed", "ablations": "A1 probeFailed:false -> core 2 red, messaging 1 red, plugin-auth 1 red; A2 no-memo branch skipped -> core 1 red; A3 every derivation throw counts -> core 1 red; A4 auth resolver never rejects -> plugin-auth 2 red; A5 wrapper never re-grades -> plugin-auth 5 red; A6 trial refusal ignored -> plugin-auth 2 red; each restored blob == HEAD", "skills_docs": "none (git grep readFailed / no tenant default / could not be read over skills docs content names no text about this resolver or these mails)", "needs_decision": null, "issue": 27733, "summary": "Reproduced on main bc496bf7: localizationFallbackReach mapped the sys_organization probe's AuthzStoreUnavailableError to UNOWNED_ORGANIZATION_REACH with no readFailed. It now returns { reach, probeFailed } with probeFailed = isAuthzStoreUnavailableError(err); resolveLocalizationContext sets readFailed: true and writes no memo of either kind (dead entry dropped), per triage 6509207804. Other derivation throws (unreadable posture) keep unowned with no readFailed. readFailed doc comment names both triggers. Pinned at the resolver (5 cases) and through the messaging email channel (1 case: retryable, no TEMPLATE_, recovers to CNY).", "out_of_scope": [] }Generated by Claude Code