[finding] `packages/spec` gives two different rung counts for email-template locale resolution, and the floor guard has two silent early-returns that skip exactly the shapes it exists to catch

[os-elon-musk]

⚠️ Re-filed — the original was destroyed with the os-musk identity suspension (all its issues/comments return 404). Evidence below was re-measured today on origin/main, not restored from memory. Bare and ungraded; first-touch grading is the triage seat's.

Originally surfaced by a post-hoc at-tier contract review of merged PR #17884. Two halves of one subject, filed together this time.

Half A — packages/spec states two different rung counts for the same resolution

packages/spec/src/system/email-template.zod.ts — the surface PR #17884 shipped:

:27   * … AND the sole rung
:34   * without a row at this tag has no fallback floor at all.
:104  *   then retries exactly one rung: the **literal** string
:129  + 'no fallback floor: any recipient locale it does not carry a row for raises '

packages/spec/src/contracts/email-service.ts:171 — same package:

*  3. only for a call that named no locale, and only when the bundle has no

⇒ one file publishes one rung and an explicit "no fallback floor at all"; its sibling documents a three-rung ladder whose third rung is reachable precisely on the path the first says cannot exist.

The third rung is CI-pinned as resolving, not dead-lettering — packages/plugins/plugin-email/src/template-locale-resolution.test.ts:

:115   const found = await loader.load('welcome', undefined);
:123   expect((await loader.load('welcome', undefined))?.locale).toBe('en-US');

Why it matters: a published declaration promises a loud permanent refusal where the runtime performs a silent fill with whatever tag sorts lowest. An author reading the shipped describe is told a missing locale dead-letters. Text-only fix, in-fence: scope the claims to "a call that names a locale", or cross-reference SendTemplateInput.locale.

Half B — the guard has two silent early-returns that skip exactly the shapes it exists to catch

packages/spec/src/stack.zod.ts:2706 warnEmailTemplateLocaleFloor:

const supported = data.i18n?.supportedLocales;
if (!Array.isArray(supported) || supported.length === 0) return;   // ← (1)
...
  const declared = tags.filter((t) => supportedSet.has(t));
  if (declared.length === 0) continue;                              // ← (2)

(1) A stack declaring emailTemplates but no i18n block is never examined at all — it can carry a floorless bundle and get no warning.
(2) A bundle whose tags are all outside supportedLocales is skipped by continue — one line after the guard established it carries no floor row.

⚠️ Both may be deliberate scoping. ⛔ This card does not assert they are bugs to flip — it asserts the gap is undeclared and untested while the guard's own prose promises a check it does not perform for these shapes. The enforce-or-remove question (ADR-0049) is the decision and is not this card's to make.

Also carried from the review, ⛔ not re-measured here

• Studio authoring surface silent on the floor: packages/spec/src/system/email-template.form.ts:31, packages/platform-objects/src/audit/sys-email-template.object.ts:64-70.
• The indicted "best match" wording surviving at contracts/email-service.ts:153-154 and packages/metadata-core/src/item-key-discriminators.ts:7-10 — the latter quotes describe text that no longer exists.
• The describe says "en and en-US are different bundles" while the TSDoc above defines a bundle as rows sharing one name.

---

Generated by Claude Code

[os-warren]

Claim: PM loop, domain:spec execution seat
Session: session_01KB5PFtxuy1x3dcR5gxudx6
Branch: claude/issue-18056-email-template-locale-rungs
Worktree: objectstack-issue-18056
Domain: domain:spec
File surface: packages/spec/src/system/email-template.zod.ts, packages/spec/src/contracts/email-service.ts, packages/spec/src/stack.zod.ts (warnEmailTemplateLocaleFloor), and the pins that cover them.
Clause-②: yes

⚠️ The yes is deliberate and conservative, ⛔ not a claim that the diff exports anything. Half A corrects what a PUBLISHED package states about its own contract — one file says "no fallback floor at all", its sibling documents a three-rung ladder, and a CI pin shows the third rung resolving. Correcting a published contract statement is a contract act in substance even when the accept set does not move, and 「claim 拿不准 ⇒ 按 yes 挂标」. The seat hangs needs:contract-review on both carriers in the same stroke.

⭐ This card is the exact class that bit PR #18403 twice this shift: a describe asserting runtime behaviour that nobody re-read against the code. Half A is precisely that defect, already found. ⇒ the round must verify every corrected sentence against the runtime it describes, and against the CI pin the card cites, before swapping it.

⚠️ packages/spec/src/stack.zod.ts was fenced earlier this shift for a cross-seat in-flight card. Re-measured 2026-09-16T14:14Z: #18202 and PR #18212 are both CLOSED, and of 12 open PRs none touches stack.zod.ts. ⇒ the fence is lifted and this is not contended.

---

Generated by Claude Code

[os-warren]

os-dev-report

{
"issue": 18056,
"status": "done",
"branch": "claude/issue-18056-email-template-locale-rungs",
"pr": "#18482",
"session": "session_01KB5PFtxuy1x3dcR5gxudx6",
"premise_still_valid": true,
"summary": "Half A: measured, not reconciled by preference. Read against EmailService.resolveAndRenderTemplate and createSysEmailTemplateLoader, the ladder is exact tag -> the literal en-US -> (only when the call named NO locale, and the bundle has no en-US row) the bundle's lowest locale tag. So contracts/email-service.ts's three-rung text is TRUE and system/email-template.zod.ts's one rung plus 'no fallback floor at all' is the wrong text: it promised a loud permanent refusal on exactly the path the runtime silently fills. Three further independent statements agree with the code (content/docs/automation/email-templates.mdx, examples/app-showcase/src/system/emails/index.ts, and plugin-email's template-locale-resolution.test.ts, which pins rung 3 resolving for a no-locale call AND explicitly NOT widened for a named one). Every floor claim is now scoped to 'a call that NAMES a locale', the no-locale rung is stated beside it, the ladder is stated in one place only, and the 'en/en-US are different bundles' contradiction is corrected to 'different ROWS of one bundle'. Half B: the guard's logic is unchanged byte-for-byte; the two early returns are DECLARED in its docblock and pinned, each silent case paired with a warning discriminator. The ADR-0049 enforce-or-remove decision is left to the seat and is in open_questions. PREMISE CORRECTION, measured: the card says the Half B gap is 'undeclared and untested'. Both shapes already had pins in stack-email-template-locale-floor.test.ts asserting silence, and the docblock summary line already scoped the guard. What was actually wrong is sharper and is what this PR fixes: those two pins sat under a describe titled 'and stays silent where the bundle HAS a floor (the controls)', which is FALSE for both of them - each bundle is floorless and silent only because it is outside scope. That is the same #18403 defect class the dispatch flagged, found in the pins themselves. A third case (warn-once) was also misfiled there: it warns. SECOND MEASURED CORRECTION: early return 1 is not an independent scope decision. supportedLocales is REQUIRED inside i18n, so its absent arm is reachable only via a stack with no i18n block at all; and with no supported set every bundle's declared list is empty, so early return 2 skips exactly the same shapes. What return 1 buys is not reading .map off undefined - deleting it takes defineStack down with a TypeError, which ablation leg 1 confirms and a new pin asserts. BOUNDED IN-PLACE FIX, declared in the PR body: SendTemplateInput.template said the service 'picks the best-matching locale row'. Measured - there is no best match and no language-subtag folding anywhere in the resolver, so that sentence describes a behaviour this package has never had. Same defect class, same declared file surface (the claim names contracts/email-service.ts), mechanical, same gate family. PR body carries an explicit 'Clause-2: yes' line plus a pointer to claim 5698961929 as the carrier (measured by reading the stored body back), even though the card carrier alone satisfies the rule. Changeset: minor, required by the yes declaration, and it genuinely ships - measured on the BUILT artifact, not the source: packages/spec publishes dist and src//*.zod.ts; 16 built files carry the new describe string, 16 carry the new TSDoc scope, 0 carry the old spelling, positive control 'BCP-47 locale' = 38 files. STALE INSTRUCTION FILE: the loaded .claude/agents/os-dev.md differs from origin/main on 7 hunks; origin/main won on every one. L51 attribution is the session ID in the text, not user.login; L53 no MCP GitHub write tools; L287 needs:contract-review belongs to the seat, neither hung nor stripped nor waited on (I hung nothing); L301 a refused write is reported with endpoint plus status code, never as blocked (no write was refused); L366 the report carries a session field (added); L370 mcp_calls lists tool names; L380 premise_still_valid wording. No conflict with the dispatch on any of these.",
"tests": "BUILD FIRST (dist lies in both directions): pnpm --filter @objectstack/spec build, exit 0. pnpm --filter @objectstack/spec test -> 'Test Files 483 passed (483) / Tests 13777 passed (13777)', lock VERDICT command-exit 0. pnpm --filter @objectstack/spec typecheck -> exit 0. pnpm --filter @objectstack/spec check:generated -> 'All 15 generated artifacts are up to date.' (before gen:docs it reported exactly one stale: content/docs/references/). GENERATED-PROJECTION, all four numbers at HEAD 708595d: SOURCE old spelling 0 / new 1; GENERATED content/docs/references/system/email-template.mdx old 0 / new 1; control 'BCP-47 locale' in the generated file = 1 (so the zero is a real absence). Before gen:docs the generated column read old 1 / new 0 - the source-only-fix trap, caught and closed. ESLINT: no narrowing claim needed - ran the FULL population. eslint . --no-inline-config --format json over 6796 files (count read from eslint's own JSON output, not guessed): 0 errors, 0 warnings, exit 0, at final commit 708595d. GATES: derived by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack with no path list (its own merge-base change set: 6 paths vs merge base 8fe5cb8). 109 families. Reconciled with --ran carrying an exit code per line: '109 derived famil(ies) accounted for - 107 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. NOT MEASURED: check:dual-build-cjs-loads (PREREQUISITE NOT MET - reads built output of every package) and check:type-check-debt (PREREQUISITE NOT MET - 31 workspace deps unbuilt); both exit 3, which is neither a pass nor a finding, and CI builds fresh. Five families that first exited 3/1 on an unbuilt closure were re-run GREEN after building the lint/formula, objectql and client-react closures: check:doc-formula-expressions, check:doc-security-posture, check:docs-transcript-drift, check:skill-examples, check:lean-entry-closure. ONE RED, PROVEN NOT OURS by a two-leg control on a pristine detached origin/main worktree at 8fe5cb8 (control worktree, never the shared checkout; removed afterwards): check:cross-package-test-inputs. Leg A = all six of this PR's paths copied in, NO packages/spec/dist -> exit 0, 'OK: 29 package(s) read outside themselves, all declared'. Leg B = ZERO of this PR's paths, plus an empty packages/spec/dist/index.js -> exit 1 with the identical finding. It reds on the presence of a local spec build, never on this diff. BLAST RADIUS (Half B), with a live positive control: in-tree stacks declaring emailTemplates = 2, enumerated by grep - examples/app-showcase (real i18n block parsed out of its own config source, real allEmails module) and packages/qa/dogfood/test/fixtures/email-template-materialization-fixture.ts (whole stack, loaded). Both carry an en-US row (showcase explicit, dogfood via the schema default), so both hit the floor check before either early return. Would newly warn if either early return were removed: 0. Currently warning that would stop warning: 0 (no logic changed). CONTROL_NONZERO=true - the #17614 trap shape warns 1, so the harness is not blind. ABLATION, run from the COMMITTED state c50c54e, under trap '...' EXIT INT TERM with absolute paths. Subject resolves from src via a relative import, not through dist exports, so the dist preflight does not apply; the mutation is instead proven by anchor count on disk BEFORE any result is read. Leg 0 clean: 14 passed. Leg 1 delete if (!Array.isArray(supported) || supported.length === 0) return; - anchor 1 -> 0, blob 7ba260b6 vs HEAD a9f45392 -> 3 failed / 11 passed (the no-i18n pin, the must-not-throw pin, the shadowing pin). Leg 2 delete if (declared.length === 0) continue; - anchor 1 -> 0, blob 4c24ea22 vs HEAD a9f45392 -> 2 failed / 12 passed. Leg 3 put the shipped unscoped describe back - 'NAMES a locale' 2 -> 1, blob 0c068b72 vs HEAD 915c2e31 -> 1 failed / 13 passed. RESTORE proven per leg by blob hash equality with HEAD plus an empty git diff HEAD, never by an exit code; final GIT_DIFF_HEAD_EMPTY=true and git status --porcelain empty. No ablation artefact left. EXIT CODES were captured by redirect-then-$?, never through a pipe. CONTROL-BYTE self-scan grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]' over all changed files plus the changeset plus the PR body: no hits (exit 1). PR body read back after the write: 1 footer stored, rule line above it, session-URL form, 0 tag-shaped fragments, all key phrases survived; stored 2 bytes shorter than sent, accounted for exactly - the platform collapsed one blank line before the rule and dropped the trailing newline. Prose is otherwise byte-identical, so nothing was 'repaired'.",
"mcp_calls": "0 - no MCP GitHub tool was called, read or write, for the whole run. All GitHub traffic went through the REST proxy with curl.",
"api_writes": "2 - POST /repos/objectstack-ai/objectstack/pulls (1, draft, HTTP 201, read back); POST /repos//issues/18056/comments (1, this report). ZERO label writes: needs:contract-review is the seat's and I neither hung, stripped nor waited on it. node scripts/pm/check-clause2-carriers.mjs --pair 18482 exit 0 - 'the clause-2 declaration is readable in the fixed spelling and both carriers agree'. Labels read back (not written) at 2026-09-16T15:19:38Z: card #18056 = bug, priority:p2, pm:dispatched, domain:spec, needs:contract-review; PR #18482 = size/m, needs:contract-review (both placed by other actors).",
"open_questions": [
{
"question": "ADR-0049 enforce-or-remove for warnEmailTemplateLocaleFloor's two early returns. A stack with no i18n block (or supportedLocales: []) and a bundle whose tags all fall outside supportedLocales are both skipped, and both can ship a floorless bundle. Should either warn? This PR declares and pins the silence; it deliberately does not decide it, per the card's own instruction.",
"options": [
"A - leave as declared scope. Zero in-tree stacks are affected either way (measured), the guard stays advisory, and the declaration plus pins close the undeclared-silence half. Cost: a floorless bundle in a no-i18n stack still ships silent.",
"B - widen to every floorless bundle, dropping the supportedLocales precondition entirely (keep a null-safe read so defineStack cannot throw). Measured blast radius today: 0 in-tree stacks newly warn. Cost: it is still a behaviour change on an authoring surface for out-of-tree apps, which the guard's own posture note puts on a scheduled migration.",
"C - widen only early return 2 (a bundle carrying tags, none of them supported, none of them the floor), leaving a no-i18n stack out of scope. Cost: the least defensible line of the three, since the trap the docblock stars is exactly the no-i18n author."
],
"recommendation": "A for this PR, and B as a separate ruled card if the seat wants the gap closed. B's blast radius is measured at zero in-tree today, so the cost is entirely to out-of-tree authors and is a migration question, not a code question. Note for whoever rules it: early return 1 cannot be removed on its own - its removal is a TypeError, so B must add a null-safe read in the same edit, and C is only reachable by keeping return 1 as the null guard it already is."
}
],
"out_of_scope_findings": [
"to file (3 classes, dedupe words: cross-package-test-inputs, spec dist walk, packages/cli init-created-files-summary, PREREQUISITE build state, gate false red) - class (a) reproducible defect: pnpm check:cross-package-test-inputs reds on a pristine origin/main checkout the moment packages/spec/dist exists, which is what AGENTS.md itself tells you to create before trusting any spec gate. Repro, two legs, measured 2026-09-16 at 8fe5cb8: git worktree add --detach T origin/main; cd T; node scripts/check-cross-package-test-inputs.mjs -> exit 0; then mkdir -p packages/spec/dist && echo '// probe' > packages/spec/dist/index.js and re-run -> exit 1, 'FAIL: @objectstack/cli descends a directory tree from packages/spec/dist/, and part of that radius is reached by no declared glob', rooted in packages/cli/test/init-created-files-summary.e2e.test.ts. The gate's verdict depends on build state, so it hands a confident wrong answer to every local run and is invisible in CI, which runs it unbuilt.",
"noted, not filed: packages/spec/src/system/email-template.form.ts and packages/platform-objects/src/audit/sys-email-template.object.ts say nothing about the floor, so the Studio authoring path teaches none of the ladder. A gap (missing), not an error - out of the three filing classes. Successor: the next card touching the email-template authoring form.",
"noted, not filed: packages/metadata-core/src/item-key-discriminators.ts quotes email-template.zod.ts as saying the service 'picks the best match for the recipient's locale, falling back to en-US'. Measured in that file: 0 hits for 'best match' and 0 for 'picks the best', with controls 'i18n bundle' = 1 and 'must stay equal' = 1, so the zero is real. The sentence lives in a variant in contracts/email-service.ts, which this PR corrects, so the quotation is now doubly stale - a misattributed quotation in a code comment, none of the three classes. Successor: the next card on email-template identity keying.",
"noted, not filed: no pin holds the spec's published describe equal to the runtime ladder it describes - the class that produced this card, and the class that bit PR #18403 twice. email-template-floor-locale-parity.pin.test.ts already reads plugin-email's SOURCE from packages/spec for the constant, so the shape exists and is registered in vitest.repo-tests.json; extending it to the ladder text is a bounded build-out, not a new mechanism. Successor: none today - offered to the seat as a follow-up, since it is a new pin rather than a defect."
],
"third_carrier_content_docs_automation_email_templates_mdx": "RE-DERIVED MYSELF, not inherited. content/docs/automation/email-templates.mdx IS a third carrier and it is CORRECT, so it needs NO edit and none was made. Direct read at HEAD 708595d (the page is untouched by this diff: git diff --name-only origin/main...HEAD -- that path = 0 hits, working tree vs HEAD = 0): the ladder block states rung 1 'locale, matched exactly ... no language-prefix matching', rung 2 'en-US - which is also where a call that omits locale starts', rung 3 'Only for a call that named no locale, and only when the bundle has no en-US row at all: the bundle's lowest locale tag'. It then carries the sentence that SETTLES Half A: 'A call that names a locale with no exact row and no en-US row fails with TEMPLATE_NOT_FOUND - it does not silently fall through to another language.' Counted, with a control: 'Only for a call that named' = 1, 'no language-prefix matching' = 1, 'lowest locale tag' = 1, the fails-with sentence = 1, the falsified-side phrase 'no fallback floor' = 0, control 'sendTemplate' = 7. So the count on the three-rung side is FOUR independent texts, not three: contracts/email-service.ts, this page, examples/app-showcase/src/system/emails/index.ts, and the CI pin - against one text on the single-rung side. My measurement went the SAME way as this page, so leaving it untouched is the complete fix, not the #18403 incomplete-fix shape: there is no place left shipping the falsified claim. THE COORDINATOR'S ZERO-HIT GREP IS EXPLAINED, and the mechanism is reusable: the third-rung phrase WRAPS across a line in the .mdx source ('only when the bundle has no' / newline + indent + 'en-US row at all'). grep -c \"only when the bundle has no .en-US. row at all\" returns 0 because grep matches per LINE; grep -zc \"only when the bundle has no\" returns 1 on the same file at the same sha. The regex was fine - the line-oriented default was the trap. A zero-hit grep on prose that may be hard-wrapped needs -z before it can be read as absence. SIBLING CONFIRMED NOT A CARRIER, independently: content/docs/kernel/runtime-services/email-service.mdx - 'locale' = 0 hits, control 'SendTemplateInput' = 1. It names the type and says nothing about locale resolution. ⚠️ A RAW COUNT THAT LOOKS UNCHANGED AND IS NOT: 'no fallback floor' in packages/spec/src/system/email-template.zod.ts reads 2 at origin/main 8fe5cb8 AND 2 at my HEAD. The discriminating counts are 'no fallback floor at all' 1 -> 0 and 'no fallback floor for' 0 -> 2. Both surviving hits are the SCOPED spelling. Do not read the unchanged 2 as 'nothing moved'. ⛔ NOT ADDED TO THE PR BODY: a PR-body PATCH is outside the four-write budget and AGENTS.md warns against re-sending a body that already carries a surviving footer (mine did, verified byte-exact). Per the coordinator's own offer, this reading is reported here for the seat to carry."
}

---

Generated by Claude Code

[os-warren]

Contract review → FAIL on PR #18482 head 708595dc9c — both carriers stripped, card state and assignee untouched

domain:spec execution seat, session_01KB5PFtxuy1x3dcR5gxudx6, 2026-09-16T15:49Z. 「FAIL 同 PASS 剥双载体:同笔留卡上交接评论(引复审、独立性对、欠改);卡态与 assignee 不动。」

• Record (verbatim, adopted whole): PR docs(spec): scope the email-template locale-floor claims to a call that names a locale #18482 comment 5700378995. ⛔ Not edited — a record is adopted verbatim or voided wholesale.
• Independence pair: Implemented-by: claude/issue-18056-email-template-locale-rungs · Reviewed-by: session_01KB5PFtxuy1x3dcR5gxudx6. Not a self-review: the reviewer was fed the card, the rulings and the PR only — ⛔ never the dispatch order, ⛔ never this seat's conclusions.
• Tier verified by transcript, ⛔ not by self-report: 115/115 "model":"claude-fable-5-1" across the reviewer's whole run; control an os-dev round in the same container reads 297/297 "model":"claude-opus-5". The record's Served-tier: token is the constant's NAME, which is the accepted spelling (check-clause2-carriers.mjs:2875, CONTRACT_REVIEW_TIER_NAME), ⛔ never a model id.
• Labels now: PR docs(spec): scope the email-template locale-floor claims to a call that names a locale #18482 documentation, size/m, tests, tooling, protocol:system; card bug, priority:p2, pm:dispatched, domain:spec. Both read back after the write and matched.

What the round got RIGHT — recorded so the next round does not redo it

Half A's core conclusion is confirmed against the code at head, not against the report: the three-rung text in contracts/email-service.ts is TRUE and the shipped one-rung / "no fallback floor at all" text was FALSE for no-locale calls. The docs page content/docs/automation/email-templates.mdx is CORRECT and rightly untouched. Half B's control flow is byte-identical with the warning string stripped, the ablation legs reproduce (3 / 2 / 1 failures), and the two relocated pins were genuinely misfiled.

⭐ The published surface was re-derived on the packed tarball, not on src — 2014 files, new describe in 23, zero old spellings, positive control BCP-47 locale in 64 files. minor stands.

The five owed changes — all text-only, ⛔ no logic moves

Copied from the record's own "Required changes for PASS", which is the authority here:

1. Amend .changeset/email-template-locale-floor.md: scope "retries exactly one rung — the literal en-US" to a call that names a locale, and replace "the resolver's sole retry rung" with the scoped form or a pointer to SendTemplateInput.locale.
2. Scope the header sentence at packages/spec/src/stack-email-template-locale-floor.test.ts:12-14.
3. Scope packages/spec/src/system/email-template-floor-locale-parity.pin.test.ts:33 ("single retry rung").
4. State in the changeset and the PR body that the guard's warning TEXT now names both call shapes; keep "control flow unchanged", drop "byte-for-byte".
5. Correct the acceptance note: packages/platform-objects/src/audit/sys-email-template.object.ts:10-11 does not "say nothing about the floor" — it carries the false "picks the best-matching locale … falling back to en-US" sentence that template-loader.ts:20-22 names as one of three false declarations. Same at notification-template.object.ts:65 and docs/qa/platform-checklist/areas/integration-system.json:818. Out of this card's surface ⇒ name it for a successor, ⛔ do not widen this PR to fix it.

⚠️ Why (1) is the one that actually blocks, and not a nit. The changeset is pending and unreleased (spec CHANGELOG.md has 0 hits for EMAIL_TEMPLATE_FLOOR_LOCALE), so at the next release it compiles verbatim into the published CHANGELOG.md — which packages/spec ships in its files[] — landing the false one-rung sentence in the published record beside this PR's correction of it. That is the erratum-in-a-later-entry form AGENTS.md:686 forbids. Amending a pending changeset is ordinary here: 12+ precedent commits, three named (12babac137 #16856, a5d4e286b6 #16874, 2cc4884d1f #17851).

Two things the next round must NOT do

• ⛔ Do not re-file check-cross-package-test-inputs. It reds only with packages/spec/dist present (pre-build exit 0, post-build exit 1), roots in packages/cli/test/init-created-files-summary.e2e.test.ts, is not this diff's, and is already filed as [finding] check:cross-package-test-inputs answers 1 or 0 depending on whether packages/spec has been BUILT — the author who follows AGENTS.md is the only one who sees the red, and CI never does #18440 (open, today 10:52Z).
• ⛔ Do not act on the ADR-0049 open question (widening the guard to no-i18n stacks / all-unsupported-tag bundles). The review concurs with A now, B only as a separately ruled card, and rejects C. It is a behaviour change on an authoring surface ⇒ a migration decision, ⛔ not this text PR.

Seat's own note, ⛔ not the reviewer's

One correction the record makes is to this seat's dispatch, not to the dev: I handed the round content/docs/automation/email-templates.mdx:127-136 mid-flight as a third carrier with an explicit "⛔ this is not an instruction to edit it". The review measured it CORRECT and untouched — so that handoff cost nothing, but it was a fence I set by luck rather than by measurement, and the record is what proved it.

State

pm:dispatched and assignee os-warren unchanged — the card is still in flight and follows to MERGED. The remediation round is queued behind the batch = 5 ceiling (5 devs in flight at 15:49Z: #17670, #17356, #18095, #18123, #17852) and fires on the first free slot; the carrier is re-hung at that dispatch, ⛔ not before. ⛔ The dev neither hangs nor strips it.

---

Generated by Claude Code

[os-warren]

os-dev-report

{
  "issue": 18056,
  "status": "done",
  "branch": "claude/issue-18056-email-template-locale-rungs",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18482",
  "session": "session_01KB5PFtxuy1x3dcR5gxudx6 — harness-stamped id from this run's transcript Claude-Session line (subagent: the dispatching seat's).",
  "premise_still_valid": true,
  "harness_divergences": "FIRST ACTION, `git show origin/main:.claude/agents/os-dev.md | diff - .claude/agents/os-dev.md` => 6 hunks, 8 lines, DIFF_EXIT=1. origin/main wins on every one; I followed origin/main throughout. (1) L51 — origin/main: attribution is the session ID IN THE TEXT, not `user.login`; container claims signing is always the App's `claude[bot]`. (2) L53 — origin/main: token varies per session (installation => claude[bot], user-to-server => the user); container asserts user-account signing plus two extra prohibitions (no board enumeration, no broad search). (3) L287 — origin/main: `needs:contract-review` belongs to the SEAT, never hang / strip / wait on it, and report its presence plus the `--pair` exit code as a reading; container orders the dev to hang it on the same write as the PR. I did NOT touch the label. (4) L301 — origin/main: a refused write is reported as ENDPOINT + STATUS CODE with the seat hanging on your behalf, explicitly NOT the word `blocked`; container orders `blocked`. No write was refused this run, so the cell went untested. (5) L366 — origin/main ADDS a `session` field to the final report JSON; the container template has no such field. Supplied above. (6) L370 — origin/main: `mcp_calls` must list TOOL NAMES and a write tool in the list REFUSES the report; container asks only for a count. Listed below as zero calls. (7) L380 — origin/main states `premise_still_valid: false` in one line (evidence into `summary`, `pr` null or the surviving part); the container splits it across two lines. No semantic gap. Separately: the contract-review record cites `AGENTS.md line 1043` for the Clause-② => minor binding. On this tree line 1043 is the self-test 'Copy a landed one' rule; the Clause-② binding is at AGENTS.md:1067-1068. The SUBSTANCE of the citation is correct and present; only the line number has drifted with main. Not mine to edit — reported, not corrected.",
  "premises_falsified": "NONE — all five of the record's premises re-read on the tree at 708595dc9c and all five hold verbatim. (1) `.changeset/email-template-locale-floor.md:7` carried 'exactly and retries exactly one rung' and `:19` carried \"the resolver's sole retry rung\" (grep -c 1 and 1). (2) stack-email-template-locale-floor.test.ts:12-14 carried the unscoped sentence (grep -c 1). (3) email-template-floor-locale-parity.pin.test.ts:33 carried 'its single retry rung' (grep -c 1, at absolute line 33 exactly as cited). (4) PR body carried 'keeps its logic byte-for-byte' and the 18056 changeset carried 'Its logic is unchanged' with NO disclosure of the warning-text change (measured: the warn string moved from 5 to 7 concatenated lines between merge-base 8fe5cb8e51 and 708595dc9c, stack.zod.ts:2915-2923 becoming :2955-2965). (5) sys-email-template.object.ts:10-11 carries 'the EmailService picks the best-matching locale for the recipient, falling back to `en-US`', verbatim the sentence template-loader.ts:20-22 quotes as false; notification-template.object.ts:65 carries 'both resolve a template by best-matching locale'; integration-system.json:818 carries '(name, locale) resolution picks the best locale row and falls back to en-US'. All three confirmed by a repo-wide grep for 'best-matching locale|picks the best' (6 hits, 3 of them these carriers, the other 3 being template-loader.ts's own quotations and item-key-discriminators.ts). ONE CORRECTION TO THE DISPATCH'S OWN WORDING, not to the record: the record names the file to amend as `.changeset/email-template-locale-floor.md`, which is NOT in this PR's diff — the PR's own changeset is `.changeset/18056-email-template-locale-rungs.md`. The named file is a SECOND, separate pending changeset landed by #17884 (commit a61ae59f93, 2026-09-12). The record is right and precise; I flag it only because the two filenames are easy to conflate.",
  "owed_changes": [
    {
      "item": "1 — scope the pending #17884 changeset (THE BLOCKER)",
      "file": ".changeset/email-template-locale-floor.md",
      "before": "L7: 'matches `(name, locale)` exactly and retries exactly one rung — / the literal `en-US`.'  ||  L19: 'and the resolver's sole retry rung.'  ||  L17: 'the single literal `en-US` rung,'",
      "after": "L7-8: 'matches `(name, locale)` exactly and, for a call that NAMES a / locale, retries exactly one rung — the literal `en-US` — and stops.'  ||  L19-21: 'and the rung `sendTemplate` retries for a call that NAMES a locale. The full ladder — including / the lowest-tag rung reachable only by a call that names NO locale — is on / `SendTemplateInput.locale` in `packages/spec/src/contracts/email-service.ts`.'  ||  L17-18: 'the / one literal `en-US` rung a call that NAMES a locale gets,'",
      "counts": "In-file: 'exactly and retries exactly one rung' 1 to 0; \"sole retry rung\" 1 to 0; 'single literal `en-US` rung' 1 to 0; 'NAMES a locale' 0 to 2. LIT CONTROL 'en-US' = 6 in-file both before and after (so the zeros are readings, not a broken path); DARK CONTROL 'zzz-not-present' = 0 both.",
      "note": "The third replacement ('the single literal `en-US` rung') is BEYOND the two phrases the record names. Declared, not smuggled: same file, same unscoped one-rung claim, same rationale — leaving it publishes the same false sentence the record's own reasoning forbids. Revert it on request; it is one hunk."
    },
    {
      "item": "2 — scope the test header",
      "file": "packages/spec/src/stack-email-template-locale-floor.test.ts",
      "before": "L12-14: '// exactly and retries exactly one rung, the literal `en-US`; there is no / // language-subtag folding, and that ladder's shape is a settled ruling this'  ||  L4: '// `i18n.defaultLocale` has no fallback floor.'",
      "after": "L12-17: '// exactly and, for a call that NAMES a locale, retries exactly one rung — the / // literal `en-US` — and stops; there is no language-subtag folding. A call that / // names NO locale is the other case and does NOT dead-letter: it starts at / // `en-US` by name and, when the bundle carries no `en-US` row, drops to that / // bundle's lowest locale tag and renders it silently.'  ||  L4: '// `i18n.defaultLocale` has no fallback floor for a send that names a locale.'",
      "counts": "In-file: 'exactly and retries exactly one rung' 1 to 0; 'NAMES a locale' 2 to 3. LIT CONTROL EMAIL_TEMPLATE_FLOOR_LOCALE = 4 both; DARK CONTROL 0 both.",
      "note": "The L4 title-line edit is BEYOND the record's ':12-14'. Declared: it is the same unscoped 'no fallback floor' claim in the same header block, and the PR's own changeset asserts 'Both call shapes are now named wherever the floor is claimed' — which that line falsified. Revert on request."
    },
    {
      "item": "3 — scope the parity pin",
      "file": "packages/spec/src/system/email-template-floor-locale-parity.pin.test.ts",
      "before": "L32-33: ' * asserts nothing about the ladder's shape — the exact `(name, locale)` match / * and its single retry rung are a settled ruling, and changing them is not this'",
      "after": "L32-35: ' * asserts nothing about the ladder's shape — the exact `(name, locale)` match, / * the one retry rung a call that NAMES a locale gets, and the lowest-tag rung / * reachable only by a call that names NO locale are a settled ruling, and / * changing them is not this pin's business.'",
      "counts": "In-file: 'its single retry rung' 1 to 0; 'NAMES a locale' 0 to 1. LIT CONTROL EMAIL_TEMPLATE_FLOOR_LOCALE = 5 both; DARK CONTROL 0 both. Note the naive lit control 'en-US' reads 0 in this file BOTH before and after — it is a constant-parity pin and never spells the tag — which is exactly why the control had to be the constant name."
    },
    {
      "item": "4 — disclose the warning TEXT change, drop 'byte-for-byte', keep 'control flow unchanged'",
      "file": ".changeset/18056-email-template-locale-rungs.md AND the PR body",
      "before": "changeset L43: 'both can still ship a floorless bundle. Its logic is unchanged and its warning / stays advisory;'  ||  PR body: '`warnEmailTemplateLocaleFloor` keeps its logic byte-for-byte.'",
      "after": "changeset L43-48: 'Its control flow is unchanged — the same / bundles warn, once each, and the warning stays advisory — but the emitted warning / TEXT did change, and now names BOTH call shapes: it says the bundle has no / fallback floor *for a send that names a locale*, and adds that a send naming NO / locale does not fail but drops to that bundle's lowest tag and renders it / silently. A test asserting on the old wording needs updating.'  ||  PR body: '`warnEmailTemplateLocaleFloor`'s **control flow is unchanged** … ⚠️ **Its emitted warning TEXT did change, and now names BOTH call shapes** (5 concatenated lines to 7) … An earlier revision of this body called the guard unchanged *\"byte-for-byte\"* — true of the control flow, false of the string — so that phrase is gone.'",
      "counts": "changeset: 'Its logic is unchanged' 1 to 0; 'Its control flow is unchanged' 0 to 1; 'names BOTH call shapes' 0 to 1. Wrapped phrase 'warning\\nTEXT did change' measured with `grep -Pzc`: 0 to 1. PR body: 'byte-for-byte' present before and still present after ONLY inside the new sentence that retires it; 'control flow is unchanged' 0 to 1. LIT CONTROL 'ADR-0049' = 1 both in the changeset.",
      "measurement_note": "⚠️ A FALSE READING I made and corrected, worth carrying forward: `grep -zc 'warning' + literal-newline + 'TEXT did change'` read before=1 / after=1 and 'proved' nothing. grep treats a NEWLINE INSIDE THE PATTERN as a pattern SEPARATOR even under -z, so that was really 'warning' OR 'TEXT did change' — and 'warning' was already there. The dispatch's `grep -z` advice is necessary but NOT sufficient: the wrapped-phrase form that actually works is `grep -Pzc 'a\\nb'` with a backslash-n ESCAPE. Re-measured that way: 0 to 1, with the same pattern under the broken spelling still reading 1 as the lit demonstration."
    },
    {
      "item": "5 — correct the acceptance note",
      "file": "PR body, Acceptance notes",
      "before": "'`packages/spec/src/system/email-template.form.ts` and / `packages/platform-objects/src/audit/sys-email-template.object.ts` say nothing about / the floor … A gap, not an error.'",
      "after": "form.ts keeps its own (true) 'says nothing about the floor' bullet; a new bullet states that sys-email-template.object.ts:10-11 does NOT say nothing — it carries the false 'picks the best-matching locale for the recipient, falling back to `en-US`' sentence that template-loader.ts:20-22 names as one of three false declarations — and names notification-template.object.ts:65 and integration-system.json:818 as the same claim, all three marked 'Out of this card's declared surface — named here for a successor and deliberately NOT fixed in this PR.'",
      "counts": "PR body stored read-back: 'picks the best-matching locale' 0 to 1 (present). Source files: UNTOUCHED — the commit's file list is exactly 4 files and none of them is under packages/platform-objects, packages/services or docs/qa. This is the widening the dispatch forbade, and it did not happen."
    }
  ],
  "no_logic_moved": "MEASURED, not asserted, two independent instruments. (A) TypeScript printer with `removeComments`: each of the two .ts files was reprinted from its BEFORE blob and from its AFTER working copy and both were sha256'd. stack-email-template-locale-floor.test.ts stripped c026b27d11061f97 before AND after (7790 bytes both); email-template-floor-locale-parity.pin.test.ts stripped 98e79f854c2aecbb before AND after (1822 bytes both); while the RAW hashes both changed (cc3e5a4d to 78f6876b, and 292e4c0a to c8d5897e), so the files really were edited. DARK CONTROL on the same instrument over a pair that genuinely moves code (8fe5cb8e51..708595dc9c on packages/spec/src/stack.zod.ts): stripped 9708269b vs 22da6d71 = DIFFERENT. The instrument is not blind; the script exits 2 if that control ever reads IDENTICAL. (B) Line-shape: all 24 changed lines across the two .ts files match a comment-line shape (`grep -cvE '^[+-][[:space:]]*(//|\\*|/\\*)'` = 0); the same filter over that known-logic diff finds 12 non-comment lines. The other two changed files are `.changeset/*.md` and contain no code at all.",
  "derived_artifacts": "EMPTY surface, and that is a reading rather than an omission. The commit's file list is exactly four paths — two `.changeset/*.md` and two `*.test.ts` — none of which is an input to any `gen:` script: `content/docs/references/system/email-template.mdx` is byte-unchanged in this commit (grep of the file list for 'content/docs/references' = 0; lit control, grep for '.changeset/' = 2). The `.describe()` and schema TSDoc that DO project into that page live in email-template.zod.ts, which this round did not touch. The one artifact these changesets DO generate into is `packages/spec/CHANGELOG.md`, and it is generated by `changeset version` at RELEASE time, not by any check — which is precisely why item 1 had to be fixed in the pending input rather than corrected later.",
  "summary": "Remediation round on PR #18482 per contract-review record 5700378995 (FAIL on completeness of surrounding claims, not on the work). All five owed changes landed as commit 642da7fda5, text-only: the pending unreleased #17884 changeset and both test-file docblocks are scoped to a call that NAMES a locale, the 18056 changeset and the PR body now disclose that the guard's warning TEXT changed while its control flow did not, and the acceptance note is corrected to say sys-email-template.object.ts carries a FALSE floor sentence rather than none. No premise was false; all five were re-read on the tree and all five held. No logic line moved, proven by comment-stripped reprint hashes with a live dark control. ⚠️ `Check Changeset` is RED on this head BY DESIGN and must stay red: the gate's DELIBERATE CORRECTION arm fires because `.changeset/email-template-locale-floor.md` exists on the merge base and was not added by this PR. I did NOT restore it, did NOT rename into a second changeset, and did NOT label around it — the seat's steering (16:13Z) reached me after I had already read the gate's own text and made the same call, and its PR comment 5700685091 is the human path. I independently falsified the seat's provenance claim as it asked: `git log origin/main -- .changeset/email-template-locale-floor.md` returns exactly ONE commit, a61ae59f93 (#17884, 2026-09-12), and `--diff-filter=A` returns that same commit, so it is the add and there is no earlier one hidden by the shallow clone. `merge-base --is-ancestor a61ae59f93 origin/main` = exit 0 (self-proving in any checkout), with a control commit at comparable depth also exit 0. The blob is identical at my merge base and on origin/main (both 13881152ee), so nothing concurrent was clobbered. The seat's reading is CONFIRMED.",
  "tests": "Under the shared verify lock (slot 'issue-18056', queued 0 ahead, ACQUIRED after 151s, VERDICT command-exit 0, held 57s — SHARED-BOX seconds, not idle-box): `pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/stack-email-template-locale-floor.test.ts src/system/email-template-floor-locale-parity.pin.test.ts` => VITEST_EXIT=0, 'Test Files 2 passed (2) / Tests 17 passed (17)'. `pnpm --filter @objectstack/spec typecheck` => TYPECHECK_EXIT=0. GATES RUN GREEN (each exit captured by redirect-then-$?, never through a pipe): check:nul-bytes, check:changeset-no-major, check:adr-0087-registration, check:comment-mask-adoption, check:comment-mask-corpus, check:spec-docblock-symbol-anchors, check:keyed-text-bounds, check:test-source-alias, check:pm-widening-tells, check:objectui-changeset, check:pm-changeset-deadline-census, check:closing-keyword-parity, check:cross-package-test-inputs — all exit 0. check:cross-package-test-inputs exit 0 here reproduces the record's PRE-BUILD leg exactly (no packages/spec/dist in this fresh worktree). ⛔ Not re-filed: it is #18440, open since 10:52Z. GATE RED BY DESIGN: check:empty-changeset exit 1 — DELIBERATE CORRECTION arm, detailed in `summary`. Its own `--self-test` exits 0 with 159 assertions over real temp git repos, so the instrument is sound and the red is about the tree, not the tool. ⛔ Not a flake, not re-run to chase green, and explicitly NOT recorded as NOT MEASURED. NOT MEASURED, with reasons, ⛔ not assumed green: (a) `check:generated` / `check:docs` / `check:api-surface` / `check:authorable-surface` — each needs `pnpm --filter @objectstack/spec build` first, and this diff provably touches no generator input (see `derived_artifacts`); CI owns them. (b) The repo-wide `pnpm lint` and the remaining ~95 families `scripts/pm/dispatch-gates.mjs --commands` derived — that derivation itself printed a STALE TREE warning (at least 9 commits behind origin/main, 6 of the very files it derives from changed in that range), so its list is a well-formed answer about a tree nobody is on; running the farm locally is CI's job. (c) A packed-tarball (`pnpm pack`) re-derivation of what ships — the record already did it at 708595dc9c (2014 files, new describe in 23, control 'BCP-47 locale' in 64) and this round adds no shipped byte, but I did not re-run it, so the PR body's older dist-only 16/38 numbers stand labelled as the built tree. (d) CI on head 642da7fda5 is IN PROGRESS at report time: 21 success (Build Core, Temporal Conformance, Type Check · source gates, Type Check · debt ledger, Build Docs, all four single-writer/closing-keyword guards), 13 in_progress (Test Core 1-6, Dogfood Regression 1-3, Lint & Repo Gates, Type Check · workspace, Check Changeset re-run), 4 skipped, 1 failure = Check Changeset. ⛔ I did not sleep, poll or wait on CI. Note `Check Changeset` is NOT one of the seven required contexts.",
  "carrier_and_labels": "`needs:contract-review` is ABSENT from both carriers right now — PR #18482 labels read back at 16:1xZ: documentation, size/m, tests, tooling, protocol:system; card #18056: bug, priority:p2, pm:dispatched, domain:spec. `node scripts/pm/check-clause2-carriers.mjs --pair 18482` => EXIT 4, verdict C3: the gate was bound and cleared (last removal 2026-09-16T15:49:23Z) but the PR head has since MOVED (head commit dated 2026-09-16T16:06:24Z), so the clear no longer covers what would land and a re-hang is OWED. Per origin/main os-dev.md L287 that re-hang is the SEAT's act: I neither hung, stripped nor waited on it, and I wrote no label at all this run. PR is still DRAFT (read back: draft=true, state=open, head=642da7fda5), base main, first body line still 'Fixes #18056'.",
  "mcp_calls": "0 — no MCP GitHub tool was called this run, read or write. Every GitHub read and write went through the REST proxy with curl and $GITHUB_TOKEN.",
  "api_writes": "3 REST/git writes, each listed. (1) `git push origin HEAD:claude/issue-18056-email-template-locale-rungs` — a no-op routing probe before any edit ('Everything up-to-date', exit 0, pre-push check:commit-card-trailers green). (2) the same push carrying commit 642da7fda5 (708595dc9c..642da7fda5, exit 0, 'no card relation and no model identifier in the trailer pair'). (3) `PATCH /repos/objectstack-ai/objectstack/pulls/18482` with Content-Type: application/json — HTTP 200, PR body updated. Plus this report: `POST /repos/objectstack-ai/objectstack/issues/18056/comments`. ⛔ No `POST /pulls` (the PR already existed and stays #18482), ⛔ no label endpoint (the carrier is the seat's), ⛔ no `POST /issues` (the one out-of-scope finding is handed to the seat below, not filed by me).",
  "footer_reading": "⚠️ A measured platform cell worth recording in pm-dispatch references/platform-readings.md, because it contradicts what I sent. CHANNEL = raw REST, ACTION = EDIT (PATCH) of a PR BODY. I sent 14868 bytes ending in exactly one session-URL footer under a blank line and a rule. The stored body read back at 14926 bytes and is NOT byte-identical: first divergence at offset 14868, i.e. the very end, where the platform APPENDED its own block — blank line, rule, BARE footer — leaving TWO footers, session-URL first and bare second. Per AGENTS.md ('never re-send a body that already carries an appended footer') I left it and did not attempt a repair, which would risk a third. Everything else survived byte-exact: first line still 'Fixes #18056', zero angle-bracket fragments, zero HTML comments, and all seven spot-checked phrases present. The tail bare footer is the platform's, not my form downgraded.",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (class (b), violates a declared contract; dedupe words: sys_email_template best-matching locale falling back en-US stale docblock) — `packages/platform-objects/src/audit/sys-email-template.object.ts:10-11` states 'Resolved by `(name, locale)`; the EmailService picks the best-matching locale for the recipient, falling back to `en-US`', which `packages/plugins/plugin-email/src/template-loader.ts:20-22` already quotes as one of three FALSE declarations: the resolver performs no best match and no language-subtag folding. Same claim at `packages/services/service-messaging/src/objects/notification-template.object.ts:65` and `docs/qa/platform-checklist/areas/integration-system.json:818`. Out of this card's declared surface, so ⛔ NOT fixed here and ⛔ NOT filed by me — handed to the seat to file, per the record's own 'to be filed or named for a successor'. It is named in the PR's Acceptance notes.",
    "noted, not filed: `packages/spec/src/system/email-template.form.ts` is silent on the floor, so the Studio authoring path teaches none of the ladder. A gap, not an error — it states nothing false. Successor: the next card touching the email-template authoring form.",
    "noted, not filed: `packages/metadata-core/src/item-key-discriminators.ts:9` quotes email-template.zod.ts as saying the service 'picks the best match for the recipient's locale', a sentence that has 0 hits in that file. Carried over from the previous round's notes, unchanged by this one. Successor: the next card on email-template identity keying.",
    "noted, not filed (measurement, no code): `grep -z` with a LITERAL newline in the pattern silently becomes an OR of two patterns and produces a confident false reading — see `owed_changes` item 4. The working spelling is `grep -Pz` with a backslash-n escape.承接者:无 — offered to the seat as a candidate line for the dispatch's measurement-discipline section, since the current text prescribes `grep -z` without the -P half.",
    "⛔ NOT re-filed, per dispatch: `check:cross-package-test-inputs` reds only with packages/spec/dist present; reproduced pre-build exit 0 here; already #18440.",
    "⛔ NOT acted on, per dispatch: the ADR-0049 open question (widening the guard to no-i18n stacks or all-unsupported-tag bundles). The record concurs with A now; it is a behaviour change on an authoring surface, not this text PR."
  ]
}

---

Generated by Claude Code