fix(service-automation): a currency hole refused after a failed tenant-settings read is a runtime failure, not a guard refusal - #28110

Requested by Elon · project thread

domain:server#4 · os-elon-musk · session_016WV4czcfiRnuFCuLdmegYt

Fixes #28056

Clause-②: no (a refusal that followed a failed read of the organization's default currency is now an ordinary runtime failure, which a fault edge routes; every run that succeeded still succeeds, and a refusal after a read that succeeded stays the guard refusal it was)
Metadata-protocol: none

维护者速读

• 改了什么：flow 文本里 {{ amount | currency }} 缺租户默认币种时，若是因为读 sys_setting 失败（而不是组织真没设），现在判为普通运行时失败：fault 边能接住，errorHandling: retry 读恢复后就成功；报错说“设置读不出来”，不再叫人去设币种。
• 为什么改：自动化插件的币种解析器忽略 readFailed，运行准备又把拒绝和“没有”一样吞掉，于是一次瞬时读故障被当成 guard 拒绝（不可路由），原因还写错。messaging 通道在 [finding] resolveLocalizationContext cannot tell "no tenant default" from "the settings read failed", so a transient sys_setting fault dead-letters a mail with a {{ x | currency }} hole as a permanent TEMPLATE_INVALID #27257 已按同样规则分级。
• 风险与回滚：只在“本次读失败 + 用占位币种重渲染能成功”时改判；真没设币种、或模板别处本身有错，仍是原 guard 拒绝。无新错误码，不动 packages/spec 与 AutomationContext，读失败标记放在本包 WeakMap，不持久化。回滚即 revert。
• 先看：packages/services/service-automation/src/builtin/template.ts（gradeAfterTenantCurrencyReadFault）、src/dag-traversal.ts（executeNode 的 throw 分支）、src/run-resume.ts（两处 catch）、src/plugin.ts（readFailed 时拒绝）。
• 两分钟验证：pnpm --filter @objectstack/service-automation exec vitest run --maxWorkers=2 src/builtin/notify-currency-read-fault.test.ts src/builtin/notify-currency-tenant-default.test.ts，预期全绿：读失败被 fault 边接住、retry 后发出 CN¥ 标题；真没设币种仍不路由。
• 需要你做的：无，席位落地。

What changes

FlowTenantCurrencyResolver gives a rejection its own meaning: the read FAILED. undefined still means the read succeeded and found no default.

• plugin.ts. The automation plugin's tenant-currency resolver rejects when resolveLocalizationContext answers readFailed ([finding] resolveLocalizationContext cannot tell "no tenant default" from "the settings read failed", so a transient sys_setting fault dead-letters a mail with a {{ x | currency }} hole as a permanent TEMPLATE_INVALID #27257), as the messaging channels' getTenantCurrency does. It used to return localization.currency and drop readFailed.
• run-resume.ts. Run setup (resolveRunContext) and a resumed segment's re-read (withTenantCurrency) still leave AutomationContext.currency unset on a rejection, and now note the failed read beside that context (noteTenantCurrencyReadFault). The resumed segment notes a copy, so the persisted context never carries one segment's fault into a later resume. Nothing is added to AutomationContext (packages/spec) or the persisted run.
• builtin/template.ts. gradeAfterTenantCurrencyReadFault(err, variables, context): a FlowTextTemplateError thrown for a context whose read failed is rendered once more with the placeholder currency XXX (ISO 4217's "no currency"). If that renders, the only refusal was the missing default, and a plain Error without the guard brand is returned, saying the localization.currency setting could not be read. If it still refuses, the guard refusal is returned as it stands. Any other failure, and every refusal after a successful read, is returned unchanged. Same probe as service-messaging's templateRefusalAfterCurrencyReadFault ([finding] resolveLocalizationContext cannot tell "no tenant default" from "the settings read failed", so a transient sys_setting fault dead-letters a mail with a {{ x | currency }} hole as a permanent TEMPLATE_INVALID #27257).
• dag-traversal.ts. executeNode's throw arm grades the thrown failure first, so the failure step, $error and the isGuardRefusal routing decision all read the graded failure. This is the engine's existing classification (Node-level error branches: let a flow handle a failed node instead of aborting the run #3863): a non-guard failure is routable by a fault edge; errorHandling.strategy: 'retry' re-runs a failed run either way. No new code.
• engine.ts. The FlowTenantCurrencyResolver docblock states the rejection meaning.

The seam is shared by every text slot a node renders, so http and screen slots are graded the same way as notify.

Why

A transient sys_setting read failure failed a notify run as a permanent guard refusal: a declared fault edge could not route it, and the error told the operator to set a default currency the organization may already have.

Verification

Measured on main 5448585d before the change (a scratch test, not committed): a notify flow with a fault edge, the resolver throwing:

Pins, src/builtin/notify-currency-read-fault.test.ts (3 red on main, 10/10 green on this head):

• engine: a failed read is routed by the fault edge and $error names the failed read; retry succeeds once the read does; a successful read with no default keeps the guard refusal (not routed); a successful read with a default is unchanged.
• resume: a resumed segment whose read fails is routed by its fault edge, and the persisted context stays as it parked.
• unit: the probe regrades only a refusal a default would cure; with no failed read noted, every refusal is returned as it stands.
• plugin: booted over an ObjectQL whose sys_setting read throws, the refusal is routed; over one that finds no default, the guard refusal stands.

The existing notify-currency-tenant-default.test.ts row "refuses the node by name when the read fails" still holds (no fault edge there, so the run still fails, naming the hole and localization.currency).

Ablations (each restored through scripts/ablation-replace.mjs, blob == HEAD after):

• A1 the throw arm does not grade → 3 red (engine, resume, plugin).
• A2 the plugin resolver ignores readFailed → 1 red (plugin).
• A3 the resumed segment does not note the failure → 1 red (resume).
• A4 no probe (always regrade) → 1 red (a refusal a default would not cure).
• A5 run setup does not note the failure → 2 red (engine, plugin).

Suites: @objectstack/service-automation full vitest 228 files / 2886 tests pass; pnpm --filter @objectstack/service-automation typecheck (incl. check:test-typecheck) passes. dispatch-gates --commands derived 62 families at head e62036b8: all exit 0 (check:dual-build-cjs-loads after the dogfood^... + runtime^... dist build), --ran reconcile 62/62, 0 NOT MEASURED; pnpm lint exit 0. main merged at 549203d0; nothing on main since touches service-automation.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: not touched.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4czcfiRnuFCuLdmegYt