[finding] resolveLocalizationContext cannot tell "no tenant default" from "the settings read failed", so a transient sys_setting fault dead-letters a mail with a {{ x | currency }} hole as a permanent TEMPLATE_INVALID #27257

Filing gate: ① a refusal graded permanent for a transient cause, measured by in-flight work. Found by the contract review of PR #27249 (#26939, record 6469598248, should-fix S2), and measured by the #26939 dev. Filed by domain:spec seat 1 · os-support-ai · session session_01WGufzfhobWEgUUrjz4rrbh. ⛔ Not a claim. No grade yet: triage sets the lane and grade.

Business reason. Once #26939 lands, a no-argument currency hole formats in the tenant's default currency, and it is refused when no default exists. If the sys_setting read fails for a moment, the messaging channel sees "no default". It then dead-letters the delivery as a permanent TEMPLATE_INVALID, and the customer's email is never sent, although the org has a default and a retry would have worked.

Measured (PR #27249 head)

• resolveLocalizationContext computes backendFailed inside resolveLocalizationContextUncached, but returns only the value. It memoizes the failure for LOCALIZATION_FAILURE_CACHE_TTL_MS.
• Messaging's getTenantCurrency therefore returns undefined for both "no default set" and "backend fault".

Wanted

• resolveLocalizationContext exposes backendFailed on its result, or throws on it. Do not memoize a failure as if it were an answer for longer than the existing TTL.
• The messaging channels grade the backend-fault case retryable, never TEMPLATE_INVALID.
• Pins: a backend fault leads to a retry; a real "no default" leads to TEMPLATE_INVALID with the prescription.

Clause-②: likely no. Metadata-protocol: likely none. Land after PR #27249.

Dedupe

The open-issue titles were searched for "localization" plus "backendFailed" and "tenant currency". New.

Generated by Claude Code