docs(services): state the notify template locale the delivery path resolves, not a per-recipient one

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#12446

Text only. No schema accepts or refuses anything it did not before, no delivery behaviour moves, and no wire value changes.

What this corrects

The notify node's template path resolves (name, locale) against sys_email_template with one locale for the whole notification: payload.locale — interpolated once, before fan-out — else the deployment default (II18nService.getDefaultLocale()). sys_user carries no locale column and no request exists at async delivery time, so there is no per-recipient source to read. A per-user locale is deferred until measured pull (maintainer ruling, 2026-08-13) and layers in as an override at that same seam when it lands.

packages/spec was corrected to say exactly that, and that correction is already on main. The same retired promise survived outside the spec file. This PR sweeps it, mirroring the honest wording that already lives at service-messaging/src/email-channel.ts:86-99 and in the corrected io-node-config.zod.ts.

The sites

#	site	what it said
1	service-automation/src/builtin/notify-node.ts — the template field's configSchema description	"resolved by (name, recipient locale) at delivery time and rendered per recipient" — the text rendered in the Studio form an author fills in, i.e. the shortest path from wording to an authoring mistake
2	content/docs/automation/email-templates.mdx	"so one node mails each person in their own language" — the only site that stated the false conclusion outright rather than merely licensing it. That sentence is gone, not softened
3	service-messaging/src/messaging-service-plugin.ts	the channel-registration log line, advertising "resolve sys_email_template per recipient locale"
4	service-automation/src/builtin/notify-node.ts — the execute-time guard comment	"resolved per recipient locale at delivery"
5	service-automation/src/builtin/notify-node.test.ts — the sibling comment	same sentence, moves with #4

A sixth site the card did not enumerate, fixed here and called out rather than slipped in:notify-node.ts (the messaging.emit payload comment) described what the outbox snapshots as "the per-recipient-locale resolution happens at delivery time". Same defect class as #4, same file, same already-claimed surface, and its correct form was pinned by the merged spec wording — so it was corrected in place instead of being filed as a separate finding. It is named here because an unnamed drive-by fix is unreviewable scope creep. The card's count of four sites is therefore low by one; the tree, not the card, was the source.

Deliberately NOT touched

• packages/spec/** — zero files. A different lane owned that half.
• content/docs/references/automation/io-node-config.mdx — auto-generated from the spec .describe(), and already carries the corrected text.
• content/docs/releases/v17.mdx:3507 — release-owned; never edited in a code PR. It is a historical record of what shipped under Flow notify nodes cannot be localized: title/message are raw strings with no template or locale channel, so a four-locale app sends English-only notifications #9205, not live guidance.
• email-channel.ts:87-99 / :125-127, inbox-channel.ts:46-51 / :118-124, messaging-service-plugin.ts:138-147 — these use "recipient locale" after defining it as the deployment default in the same block, or describe rendering happening per delivery row, which is accurate. They are the honest exemplars this PR mirrors, so changing them would be churn.

A pin, so this cannot quietly come back

notify-node.test.ts gains one test asserting the form description names payload.locale and the deployment default, states "not one per recipient", and refuses a bare "recipient locale" — the same shape the spec lane used.

Reverse-verified rather than assumed. Restoring the retired sentence on the description was proven on disk by anchored occurrence counts (injected text 1, deleted text 0 — not a bare --stat), and the pin then failed with expected 'Email template name (sys_email_templa…' to match /not one per recipient/ (1 failed | 15 passed). Restoration was proven by state, not by an exit code: the blob hash returned to the HEAD blob 3b7f6056 and git diff HEAD came back empty. The mutation is intra-package source, so no dist and no rebuild is involved on either leg.

Changeset — argued, not defaulted

Shipped: .changeset/notify-node-template-locale-is-not-per-recipient.md, patch on @objectstack/service-automation + @objectstack/service-messaging. skip-changeset would have been wrong here: site 1 is not a comment but a shipped string rendered in the Studio form, and site 3 ships in an operator-visible log line — both leave the package and reach a reader. (An empty changeset was never an option; it stalls the release.)

Verification — everything below ran at d86c9682, the final commit

Exit codes captured before any pipe, and each verdict quoted from the gate's own output line.

• Derived gate union, re-derived from the real change set rather than from the dispatch's path list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 5 paths vs merge base fe72aa5c1, 38 path-matched families plus the convention-triggered ones. 44 of 44 attempted gates green, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:doc-formula-expressions, check:doc-security-posture, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, check:published-readme-links, check:react-page-adapter-contract, spec check:docs, spec check:skill-examples, spec check:empty-state, spec check:liveness, spec check:strictness-ledger, spec check:variant-docs, the changeset family (check:changeset-gate-self-tests, check:objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, release-rehearsal-clone --self-test), the packages family (check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-comment-mask-adoption, check-plugin-teardown-shape, check:cross-package-test-inputs, check-ci-filter-parity), the docs-drift family (check-affected-docs, check-drift-comment — run rather than assumed inert, since content/docs/** is in scope), and the convention-triggered check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:i18n-stale-fill, check:type-check-coverage.
• Two gates first refused on a missing prerequisite, which reads as NOT MEASURED rather than red — check:skill-examples ("Build first, then re-run") and check:i18n ("Nothing was checked: no bundle was compared"). Both prerequisites were built (@objectstack/cli, @objectstack/client-react closures) and both then ran clean: "✅ 260 prose examples type-check across 3 surface(s)" and "check-i18n-bundles: OK (9 package(s) — all bundles in sync)".
• Tests:@objectstack/service-automation — Test Files 91 passed (91), Tests 1083 passed (1083); @objectstack/service-messaging — Test Files 29 passed (29), Tests 295 passed (295), plus its typecheck clean. The new pin was confirmed by name, not inferred from a total: ✓ notify (baseline node) > describes 'template' with the locale the delivery path actually resolves, not a per-recipient one.
• One gate honestly NOT MEASURED locally:check:type-check-debt --re-measure needs the whole workspace closure built and refuses otherwise. Its structural half, check:type-check-coverage, is green, and the ratchet's question was answered directly instead: tsc --noEmit on service-automation reports 3 diagnostics, all in nested-region-parity.test.ts — a file this diff never touches — and zero naming notify-node.ts or notify-node.test.ts, so the added test code cannot push a count up. CI runs the gate itself.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/service-messaging, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx(via MessagingServicePlugin (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 316d9ab5571ee8c80a8c6c35e67834cebc3d11db — the merge of head d86c968222b0c5377baea4ea7af71fb968bd52cc into base 76c18be8ad56400c85cde381e63c7755bbd6153a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 316d9ab5571ee8c80a8c6c35e67834cebc3d11db && git checkout 316d9ab5571ee8c80a8c6c35e67834cebc3d11db
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 76c18be8ad56400c85cde381e63c7755bbd6153a d86c968222b0c5377baea4ea7af71fb968bd52cc && git checkout -B drift-repro 76c18be8ad56400c85cde381e63c7755bbd6153a && git merge --no-ff d86c968222b0c5377baea4ea7af71fb968bd52cc
node scripts/docs-audit/affected-docs.mjs --json 76c18be8ad56400c85cde381e63c7755bbd6153a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 76c18be8ad56400c85cde381e63c7755bbd6153a → pass the list as
args.docs, on the commit named under Which tree this was computed on.