fix(plugin-approvals): the data door serves an approval request's flow and step labels in the reader's language - #27092

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 13 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/plugins/plugin-approvals/src/reader-locale-labels.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/data-flow.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/automation/hook-bodies.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/automation/webhooks.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/kernel/contracts/data-engine.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/kernel/contracts/index.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/kernel/events.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/permissions/attachments-access.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/permissions/field-level-security.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/permissions/record-view-auditing.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/permissions/rls.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/permissions/system-context.mdx (via bindReaderLocaleLabelsMiddleware (symbol, a top-level function), current_step_label (symbol, a field of const object LABEL_KEY_COLUMNS), process_label (symbol, a field of const object LABEL_KEY_COLUMNS), findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/protocol/objectql/query-syntax.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/protocol/objectql/schema.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/ui/react-pages.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))

⛔ 7 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/releases/v16.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/releases/v17/17-0.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/releases/v17/17-5.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/releases/v17/17-6.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/releases/v17/17-7.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))
• content/docs/releases/v17/index.mdx (via findOne (literal, a string literal in bindReaderLocaleLabelsMiddleware))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d465e6f51c340381d3fb4ea0ef88f412b2cf7f57 && git checkout d465e6f51c340381d3fb4ea0ef88f412b2cf7f57
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fbc16563a65f0352527ea97aaf55c540e89ae4da ee26b793a926d341327e5d846da1eb141efb4003 && git checkout -B drift-repro fbc16563a65f0352527ea97aaf55c540e89ae4da && git merge --no-ff ee26b793a926d341327e5d846da1eb141efb4003

node scripts/docs-audit/affected-docs.mjs --json fbc16563a65f0352527ea97aaf55c540e89ae4da

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fbc16563a65f0352527ea97aaf55c540e89ae4da → pass the list as
args.docs, on the commit named under Which tree this was computed on.

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-28T05:21Z · head ee26b793 · #27041

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape:
   • A draft against main, assignee os-project-manager. The body carries Fixes #27041, Clause-②: no and Metadata-protocol: none, all line-initial.
   • The changeset is a patch on @objectstack/plugin-approvals.
   • check-governed-merges --pr 27092: 477 changed lines, under the human-merge threshold.
   • The claim names this PR's branch. The file surface was amended by 6461039298 to add system-context.mdx (the row-17 cell and the regenerated register line), and the diff stays inside it.
2. Against triage (6459448516) and the order:
   • One lookup. The new engine middleware bindReaderLocaleLabelsMiddleware takes its labels from readerLabelsFor and places them with localizeRequestLabels, the approvals door's own pair. There is no second table, no new key spelling, and the same fallback to stored text.
   • The seat's lean on the seam held. The middleware is registered on sys_approval_request beside bindSnapshotRedactionMiddleware and the read gate, not behind disableAutoHooks. It reads context.locale from the door's real ExecutionContext. There is no data-door, plugin-list or plugin-grid special case.
   • Read-time only. It overlays only the process_label and current_step_label columns the row carries, and adds no step_label or object_label column. A system read is passed through as stored, so nothing the platform writes back holds a reader's language. Storage, ui/** and packages/spec/** are untouched.
   • Projection kept. A projected read borrows process_name / current_step for the key and deletes them from every row before return, including on the per-row failure path. Ablation C shows the strip is load-bearing.
3. Red first (the dev's): the test-only commit 36c54057 on base failed 6 of 10, serving "Account Approval" / "Manager Review" to a zh-CN reader. The 4 controls passed. Live on the showcase REST data door, base served English while /approvals/requests/ID served zh-CN for the same row; the head serves zh-CN on both doors. Ablations, each restored to HEAD: A (bind removed) 6 red, B (no projection widening) 3 red, C (no borrowed-column strip) 1 red.
4. Parity pinned: one test reads the same row through svc.getRequest and through the data door (list and by-id) and asserts equal label text.
5. Tests: package 105 files, 1,331 tests passed; typecheck and build exit 0 (on f7d8e486; ee26b793 touches only the mdx).
6. Gates:
   • Locally 92 of 92 derived families exit 0, with 0 NOT-MEASURED. The first-pass reds were dist-rebuild races and a shallow-clone fixture, each exit 0 on re-run. The one real red, the system-context census, was fixed by the row-17 edit.
   • CI on head ee26b793: 37 success, 11 skipped, 0 red.
7. Overlap: git merge-tree reports no conflict against main fbc16563.
8. Noted, not filed:
   • display_title (a formula over process_label) is computed before the middleware runs, so it stays the stored text. No view shows it.
   • Filter, sort and group on the two label columns compare stored text. No shipped view groups by them.

Generated by Claude Code