@@ -0,0 +1,14 @@
+---
+"@objectstack/service-messaging": patch
+---
+
+fix(service-messaging): a notification delivery's title names the person it is for, not their raw user id (#25194)
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+The record title of a `sys_notification_delivery` row (Setup → Notification Deliveries) read `channel → recipient_id`, so a delivery to a user showed their raw user id. It now reads `channel → Person`: the user's name, or their email where the name is blank. A delivery to an address no user holds — an email kept as given, a phone number — is titled by that address, as before.
+
+The delivery object gains one optional field, `recipient_user_id` (Recipient User), a `sys_user` reference the title reads through. `emit()` sets it when the recipient is a user's id, from one `sys_user` read per emit, and leaves it empty for an address. Deleting the user empties it; the delivery stays, titled by the raw recipient. `recipient_id` keeps its type and meaning (the address: a user id, an email or a phone number), and is now labelled **Recipient**.
+
+Rows written before this change carry no `recipient_user_id` and keep their old title until the 90-day window ages them out. Nothing is migrated, and no delivery is routed by the new field.
@@ -0,0 +1,228 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#25194] A notification delivery's record title names the PERSON it is for,
+ * and the address itself where the recipient is not a user.
+ *
+ * `recipient_id` stays a text column: a recipient is a `sys_user` id, or an
+ * address kept verbatim — an email no user holds (`RecipientResolver`), a
+ * phone number the SMS channel texts directly — and the outbox writes past the
+ * engine's reference check, so a lookup there would store each address as a
+ * dangling reference. The person rides in `recipient_user_id`, a `sys_user`
+ * reference the enqueue stamps from one `sys_user` read per emit; the title
+ * reads it one hop, the shape `sys_notification_preference` takes (PR #25178).
+ *
+ * Pinned on a real `ObjectQL` over `SqlDriver` (better-sqlite3) with the real
+ * `sys_user`, through `MessagingService.emit` and `SqlNotificationOutbox`:
+ *
+ *  1. the declaration: `recipient_id` text, `recipient_user_id` an optional
+ *     `sys_user` reference that nulls when the user goes;
+ *  2. the enqueue stamps `recipient_user_id` for a recipient a user holds, and
+ *     only for one: an unmatched email, a phone number and an id nobody holds
+ *     stay empty;
+ *  3. the title: the name; the email where the name is blank; the address for
+ *     an address recipient; the raw recipient once the user is deleted;
+ *  4. a failed `sys_user` read stamps nothing and fails no emit — the rows
+ *     land titled by the raw recipient, and the failure is said once;
+ *  5. the title still never has a NULL part, and adds no stored column.
+ */
+
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { ObjectQL } from '@objectstack/objectql';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { SysNotification, SysUser } from '@objectstack/platform-objects';
+import { MessagingService } from './messaging-service.js';
+import { SqlNotificationOutbox, DELIVERY_OBJECT } from './sql-outbox.js';
+import type { MessagingChannel } from './channel.js';
+import { NotificationDelivery, NotificationPreference } from './objects/index.js';
+import { DEFAULT_ORGANIZATION_ID, installDefaultOrganization } from './default-organization.testkit.js';
+
+const SYS = { context: { isSystem: true, tenantId: DEFAULT_ORGANIZATION_ID } } as any;
+
+const silent: any = { debug() {}, info() {}, warn() {}, error() {}, fatal() {}, child() { return silent; } };
+
+let engine: ObjectQL | undefined;
+
+afterEach(async () => {
+    try { await engine?.destroy(); } catch { /* noop */ }
+    engine = undefined;
+});
+
+async function boot(): Promise<{ ql: ObjectQL; driver: SqlDriver }> {
+    const driver = new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true });
+    const ql = new ObjectQL({ logger: silent });
+    ql.registerDriver(driver, true);
+    await ql.init();
+    for (const def of [SysUser, SysNotification, NotificationDelivery, NotificationPreference]) {
+        ql.registry.registerObject(def as any, '@objectstack/service-messaging');
+    }
+    await ql.syncSchemas();
+    await installDefaultOrganization(ql as any);
+    engine = ql;
+    return { ql, driver };
+}
+
+async function user(ql: ObjectQL, name: string, email: string): Promise<string> {
+    return String((await ql.insert('sys_user', { name, email }, SYS)).id);
+}
+
+/** A mounted channel that is never reached: the outbox path only enqueues. */
+function channel(id: string): MessagingChannel {
+    return { id, send: async () => { throw new Error(`${id}: the enqueue path never sends`); } } as MessagingChannel;
+}
+
+function messaging(data: unknown, logger: any = silent): MessagingService {
+    const outbox = new SqlNotificationOutbox(data as any, { partitionCount: 1 });
+    const service = new MessagingService({ logger, getData: () => data as any, outbox });
+    service.registerChannel(channel('email'));
+    service.registerChannel(channel('sms'));
+    return service;
+}
+
+interface Delivery { recipient_id: string; recipient_user_id: string | null; channel: string; display_title: string | null }
+
+async function deliveries(ql: ObjectQL): Promise<Delivery[]> {
+    const rows = (await ql.find(DELIVERY_OBJECT, { fields: ['recipient_id', 'recipient_user_id', 'channel', 'display_title'] }, SYS)) ?? [];
+    return rows
+        .map((r: any) => ({
+            recipient_id: r.recipient_id,
+            recipient_user_id: r.recipient_user_id ?? null,
+            channel: r.channel,
+            display_title: r.display_title ?? null,
+        }))
+        .sort((a: Delivery, b: Delivery) => `${a.channel}|${a.recipient_id}`.localeCompare(`${b.channel}|${b.recipient_id}`));
+}
+
+describe('the declaration', () => {
+    it('recipient_id stays text; recipient_user_id is an optional sys_user reference that nulls when the user goes', () => {
+        const fields = (NotificationDelivery as any).fields;
+        expect(fields.recipient_id.type).toBe('text');
+        expect(fields.recipient_id.required).toBe(true);
+        const ref = fields.recipient_user_id;
+        expect(ref.type).toBe('lookup');
+        expect(ref.reference).toBe('sys_user');
+        expect(ref.required).toBe(false);
+        // The lookup default: the delivery is history and outlives the user.
+        expect(ref.deleteBehavior ?? 'set_null').toBe('set_null');
+        expect(ref.maxLength).toBeUndefined();
+    });
+});
+
+describe('the enqueue stamps recipient_user_id for a recipient a user holds, and only for one', () => {
+    it('a user (bare id and email-resolved) is stamped; an unmatched email, a phone number and an unheld id are not', async () => {
+        const { ql } = await boot();
+        const bea = await user(ql, 'Bea Person', 'bea@example.com');
+        const cal = await user(ql, 'Cal Person', 'cal@example.com');
+
+        const result = await messaging(ql).emit({
+            topic: 'deal.won',
+            audience: [bea, 'cal@example.com', 'outside@example.org', '+15550100', 'usr_nobody'],
+            channels: ['email'],
+            payload: { title: 'Won', body: 'A deal was won.' },
+        });
+        expect(result.enqueued).toBe(5);
+
+        expect((await deliveries(ql)).map((d) => [d.recipient_id, d.recipient_user_id])).toEqual([
+            ['+15550100', null],
+            [bea, bea],
+            [cal, cal],
+            ['outside@example.org', null],
+            ['usr_nobody', null],
+        ].sort((a, b) => `email|${a[0]}`.localeCompare(`email|${b[0]}`)));
+    });
+});
+
+describe('the record title names the person, and the address where there is none', () => {
+    it('name; email where the name is blank; the address for an address recipient', async () => {
+        const { ql, driver } = await boot();
+        const bea = await user(ql, 'Bea Person', 'bea@example.com');
+        const blank = await user(ql, 'Placeholder', 'no-name@example.com');
+        await driver.getKnex()('sys_user').where({ id: blank }).update({ name: '  ' });
+
+        await messaging(ql).emit({ topic: 'deal.won', audience: [bea, blank, 'outside@example.org'], channels: ['email'], title: 't', body: 'b' } as any);
+        await messaging(ql).emit({ topic: 'deal.won', audience: ['+15550100'], channels: ['sms'], title: 't', body: 'b' } as any);
+
+        const titles = Object.fromEntries((await deliveries(ql)).map((d) => [d.recipient_id, d.display_title]));
+        expect(titles).toEqual({
+            [bea]: 'email → Bea Person',
+            [blank]: 'email → no-name@example.com',
+            'outside@example.org': 'email → outside@example.org',
+            '+15550100': 'sms → +15550100',
+        });
+        // Reversed: the raw user id was the title before.
+        expect(titles[bea]).not.toContain(bea);
+    });
+
+    it('deleting the user empties the reference, and the row is titled by the raw recipient again', async () => {
+        const { ql } = await boot();
+        const eve = await user(ql, 'Eve Person', 'eve@example.com');
+        await messaging(ql).emit({ topic: 'deal.won', audience: [eve], channels: ['email'], title: 't', body: 'b' } as any);
+        expect((await deliveries(ql))[0]).toMatchObject({ recipient_user_id: eve, display_title: 'email → Eve Person' });
+
+        await ql.delete('sys_user', { where: { id: eve }, context: { isSystem: true } });
+
+        // The delivery history stays; only the person leaves the title.
+        expect(await deliveries(ql)).toEqual([
+            { recipient_id: eve, recipient_user_id: null, channel: 'email', display_title: `email → ${eve}` },
+        ]);
+    });
+});
+
+describe('a failed sys_user read stamps nothing and fails no emit', () => {
+    it('the rows land titled by the raw recipient, and the failure is said once at warn', async () => {
+        const { ql } = await boot();
+        const bea = await user(ql, 'Bea Person', 'bea@example.com');
+        // The real engine, with its sys_user list read failing.
+        const failing = new Proxy(ql, {
+            get(target, prop, receiver) {
+                if (prop === 'find') {
+                    return (object: string, ...rest: unknown[]) => object === 'sys_user'
+                        ? Promise.reject(new Error('directory unavailable'))
+                        : (target.find as any)(object, ...rest);
+                }
+                const value = Reflect.get(target, prop, receiver);
+                return typeof value === 'function' ? value.bind(target) : value;
+            },
+        });
+        const logger = { ...silent, warn: vi.fn() };
+
+        const result = await messaging(failing, logger).emit({ topic: 'deal.won', audience: [bea, 'outside@example.org'], channels: ['email'], title: 't', body: 'b' } as any);
+
+        expect(result.enqueued).toBe(2);
+        expect((await deliveries(ql)).map((d) => [d.recipient_user_id, d.display_title])).toEqual([
+            [null, `email → ${bea}`],
+            [null, 'email → outside@example.org'],
+        ].sort((a, b) => String(a[1]).localeCompare(String(b[1]))));
+        const said = logger.warn.mock.calls.map((c: unknown[]) => String(c[0])).filter((m: string) => m.includes("'sys_user' read"));
+        expect(said).toHaveLength(1);
+        expect(said[0]).toContain('directory unavailable');
+    });
+});
+
+describe('the title keeps the guarantees it had', () => {
+    it('a row missing channel or recipient_id is refused, so the title never has a NULL part', async () => {
+        const { ql } = await boot();
+        const NOW = new Date('2026-10-22T00:00:00Z');
+        for (const omit of ['channel', 'recipient_id']) {
+            const row: Record<string, unknown> = {
+                notification_id: `ntf_${omit}`, recipient_id: 'usr_alice', channel: 'email',
+                status: 'pending', created_at: NOW, updated_at: NOW,
+            };
+            delete row[omit];
+            await expect(ql.insert(DELIVERY_OBJECT, row, SYS)).rejects.toMatchObject({
+                code: 'VALIDATION_FAILED',
+                fields: expect.arrayContaining([expect.objectContaining({ field: omit, code: 'required' })]),
+            });
+        }
+    });
+
+    it('the registered body points at display_title, which adds no stored column', async () => {
+        const { ql, driver } = await boot();
+        const registered = ql.registry.getObject(DELIVERY_OBJECT) as any;
+        expect(registered.nameField).toBe('display_title');
+        expect(registered.fields.display_title?.type).toBe('formula');
+        const columns = Object.keys(await driver.getKnex()(DELIVERY_OBJECT).columnInfo());
+        expect(columns).toContain('recipient_user_id');
+        expect(columns).not.toContain('display_title');
+    });
+});
@@ -22,6 +22,10 @@
  * locale alone), the read that picks the language a keyed notification text is
  * rendered in, at delivery, for that recipient.
  *
+ * [#25194] And by `MessagingService.userRecipients` (`sys_user`, the id alone),
+ * the one read per emit that tells which recipients are a user, for the
+ * delivery rows' `recipient_user_id`.
+ *
  * `emit()` takes no caller context. The door in front of an emitting caller
  * has already decided whether it may notify, and every row these calls read or
  * write belongs to a RECIPIENT, not to the emitter — so no caller's grants
 
@@ -25,6 +25,7 @@ import { type InboxCaller, resolveInboxRecipient } from './inbox-caller.js';
 import { FAN_OUT_SYSTEM_CONTEXT } from './fan-out-system-context.js';
 import { INBOX_SYSTEM_CONTEXT } from './inbox-system-context.js';
 import { assertActorReferenceResolves } from './actor-reference.js';
+import { USER_OBJECT } from './recipient-locale.js';
 import {
     assertNotificationTextKeys,
     type NotificationTextKeys,
@@ -1368,6 +1369,9 @@ export class MessagingService {
         // report a channel as both refused and enqueued — which is exactly the
         // ambiguity the once-per-channel refusal count below exists to remove.
         const mounted = new Map<string, boolean>();
+        // [#25194] Which recipients are a user's id, read once per emit: the
+        // row's `recipient_user_id`, which titles it by the person.
+        const users = await this.userRecipients(targets.map((t) => t.recipient));
         const isMounted = (id: string): boolean => {
             let answer = mounted.get(id);
             if (answer === undefined) {
@@ -1392,6 +1396,7 @@ export class MessagingService {
                     const id = await outbox.enqueue({
                         notificationId,
                         recipientId: recipient,
+                        recipientUserId: users.has(recipient) ? recipient : undefined,
                         channel,
                         topic: input.topic,
                         payload: deliveryPayload,
@@ -1419,6 +1424,43 @@ export class MessagingService {
         return deliveries;
     }
 
+    /**
+     * [#25194] The recipients that are a `sys_user` id, in ONE read per emit.
+     *
+     * A resolved recipient is a user id or an address kept verbatim (an email
+     * no user holds, a phone number), and only the store can tell which: a
+     * bare spec passes through `RecipientResolver` unchecked. The answer stamps
+     * the delivery row's `recipient_user_id`, which the outbox writes past the
+     * engine's reference check (system context), so it is stamped only for an
+     * id this read found.
+     *
+     * The read is display-only: the row's title falls back to `recipient_id`
+     * without it, and no delivery is routed by it. So a failed read is a
+     * `warn` and an empty answer, never a failed emit.
+     */
+    private async userRecipients(recipients: readonly string[]): Promise<ReadonlySet<string>> {
+        const data = this.ctx.getData?.();
+        const ids = [...new Set(recipients)];
+        if (!data || ids.length === 0) return new Set();
+        try {
+            // The explicit system opt-in — see FAN_OUT_SYSTEM_CONTEXT: a
+            // directory read on the recipients' behalf whose only use is the id.
+            const rows = await data.find(
+                USER_OBJECT,
+                { where: { id: { $in: ids } }, fields: ['id'], limit: ids.length },
+                { context: FAN_OUT_SYSTEM_CONTEXT },
+            );
+            return new Set((rows ?? []).map((r: any) => String(r?.id ?? '')).filter(Boolean));
+        } catch (err) {
+            this.ctx.logger.warn(
+                `[messaging] emit: the '${USER_OBJECT}' read for ${ids.length} recipient(s) failed ` +
+                `(${(err as Error)?.message ?? String(err)}); their delivery rows name no recipient user ` +
+                `and are titled by the raw recipient`,
+            );
+            return new Set();
+        }
+    }
+
     /** Find an existing event id by its dedup key, tolerating lookup failure. */
     private async findEventByDedupKey(data: IDataEngine, dedupKey: string): Promise<string | undefined> {
         try {
 
@@ -2,8 +2,8 @@
 
 /**
  * The record title of the notification objects that declared a
- * `titleFormat` and no title pointer (#20044): `sys_notification_delivery`
- * and `sys_notification_receipt` (`sys_notification_subscription` is retired).
+ * `titleFormat` and no title pointer (#20044): `sys_notification_receipt`
+ * (`sys_notification_subscription` is retired).
  *
  * `sys_notification_preference` left this table when its `user_id` became a
  * `sys_user` reference (ADR-0118 D1): its title now names the PERSON one hop
@@ -12,6 +12,11 @@
  * others to. Its case — the raw-id title 'usr_alice · billing.invoice · email'
  * — is reversed in `../preference-user-reference.integration.test.ts`.
  *
+ * `sys_notification_delivery` left it the same way (#25194): its title names
+ * the person one hop through `recipient_user_id`, and the address itself where
+ * the recipient is not a user. Its case — the raw-id title 'email → usr_alice'
+ * — is reversed in `../delivery-recipient-user.integration.test.ts`.
+ *
  * ADR-0079 resolves a record's title as `nameField ?? displayNameField ??
  * derivation`, and an explicit `nameField` takes precedence over the
  * render-only `titleFormat`. With no pointer declared, the registry's
@@ -21,8 +26,9 @@
  * A renderer honouring the order therefore drew the raw id as the record
  * page's H1.
  *
- * The composite title points at `display_title`, a text formula over the
- * columns `titleFormat` names. `sys_notification_receipt`'s title is one
+ * A composite title points at `display_title`, a text formula over the
+ * columns `titleFormat` names; the `display_title` legs below hold any such
+ * object to that. `sys_notification_receipt`'s title is one
  * column (`{state}`), so its `nameField` names that column directly — the
  * describe's own migration for a single-field title. An explicit pointer is
  * honoured whatever the field's type (ADR-0079 D4); `select` is only kept out
@@ -52,7 +58,6 @@ import {
 } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { resolveDisplayField } from '@objectstack/spec/data';
-import { NotificationDelivery } from './notification-delivery.object.js';
 import { NotificationReceipt } from './notification-receipt.object.js';
 import { installDefaultOrganization } from '../default-organization.testkit.js';
 
@@ -78,17 +83,6 @@ let seq = 0;
 const unique = (prefix: string) => `${prefix}_${++seq}`;
 
 const CASES: Case[] = [
-  {
-    schema: NotificationDelivery,
-    pointer: 'display_title',
-    row: () => ({
-      notification_id: unique('ntf'), recipient_id: 'usr_alice', channel: 'email',
-      status: 'pending', created_at: NOW, updated_at: NOW,
-    }),
-    title: 'email → usr_alice',
-    refused: ['channel', 'recipient_id'],
-    defaulted: {},
-  },
   {
     schema: NotificationReceipt,
     pointer: 'state',