@objectstack/core 17.1.0 → 17.2.0

package/dist/index.d.cts

@@ -320,12 +320,14 @@ declare class ObjectKernel {
      * as well: if the hook never settles and nothing else keeps the loop alive,
      * Node exits before the timer can fire and the timeout is never reported.
      * The guard has to stay ref'd exactly as long as the race is undecided,
-     * which is what `clearTimeout` in a `finally` expresses.
+     * which is what clearing on settle expresses.
      *
-     * `operation` is widened to `T | PromiseLike<T>` because the Plugin
-     * contract permits a synchronous hook (`init`/`start` return
-     * `void | Promise<void>`); such a hook wins the race immediately and the
-     * guard is reclaimed on the same turn.
+     * Clearing the timer was only half of it, though (#10604): the promise the
+     * race still holds a reaction on has to SETTLE, or it and that reaction are
+     * retained past the end of the run — two leaking promises per boot, which
+     * is what `vitest --detectAsyncLeaks` names here. Both halves now live in
+     * `TimeoutGuard.reclaim()`, shared with `shutdown()`, so the two sites
+     * cannot drift into doing one half each again.
      */
     private raceStartupTimeout;
     /**
@@ -2021,17 +2023,27 @@ interface ResolveLocalizationInput {
     tenantId?: string;
     userId?: string;
 }
+type LocalizationResult = {
+    timezone: string;
+    locale: string;
+    currency?: string;
+};
 /**
  * Resolve workspace localization defaults (reference `timezone` / `locale` /
  * `currency`). Canonical path is the `localization` SettingsManifest (cascade:
  * platform default → global → tenant); falls back to direct tenant-scoped
  * `sys_setting` rows, then the built-ins `UTC` / `en-US`. Never throws.
+ *
+ * A read that fails outright (backend fault — table missing, connection
+ * refused, etc.) is memoized for {@link LOCALIZATION_FAILURE_CACHE_TTL_MS}
+ * per `(ql, tenantId, userId)` so the failing query — and the driver's log
+ * line for it — does not repeat every request (#10221). A successful read,
+ * including a legitimate "no settings configured yet" empty result, is NEVER
+ * cached: the next call always re-reads, so a settings write takes effect
+ * immediately (see the cache doc above for why — the dogfood analytics
+ * bucketing test pins this).
  */
-declare function resolveLocalizationContext(input: ResolveLocalizationInput): Promise<{
-    timezone: string;
-    locale: string;
-    currency?: string;
-}>;
+declare function resolveLocalizationContext(input: ResolveLocalizationInput): Promise<LocalizationResult>;
 
 /**
  * ADR-0069 — authentication-policy session gate.
@@ -3510,11 +3522,15 @@ declare function createMemoryQueue(): {
 };
 
 /**
- * In-memory job scheduler fallback.
+ * In-memory job registry — schedule/cancel/trigger bookkeeping with NO timer.
  *
- * Implements the IJobService contract with basic schedule/cancel/trigger
- * operations.  Used by ObjectKernel as an automatic fallback when no real
- * job plugin (e.g. Agenda / BullMQ) is registered.
+ * [#10746] NOT pre-injected by ObjectKernel any more (it used to be, via
+ * `CORE_FALLBACK_FACTORIES`): a fallback must not fake capability (maintainer
+ * ruling 2026-08-22). Advertising a `schedule()` that records and never fires
+ * made every "prefer the platform job service, else own a timer" consumer
+ * take the job-service branch and then silently never run. The export remains
+ * for embedders who deliberately want a manual-trigger job registry — e.g. in
+ * tests that drive handlers via `trigger()` — and have read this docblock.
  *
  * [#4058] `degraded` (ADR-0076 D12), with the missing half named in the
  * message rather than left for a deployer to discover: `trigger()` really runs
@@ -3666,8 +3682,26 @@ declare function wireAuthoredTranslationSync(ctx: MinimalCtx): void;
 
 /**
  * Map of core-criticality service names to their in-memory fallback factories.
- * Used by ObjectKernel.validateSystemRequirements() to auto-inject fallbacks
- * when no real plugin provides the service.
+ * This IS the kernel's pre-injection list: `ObjectKernel.preInjectCoreFallbacks()`
+ * registers an entry for every unprovided `core` service before Phase 2, and
+ * `validateSystemRequirements()` consults the same map as its final check.
+ *
+ * [#10746] `job` is deliberately ABSENT — a fallback must not fake capability
+ * (maintainer ruling 2026-08-22). `createMemoryJob()`'s `schedule()` records a
+ * job and never fires it, so pre-injecting it made every "prefer the platform
+ * job service, else own a timer" consumer take the job-service branch and then
+ * silently never run: `plugin-reports` logged `dispatcher registered with job
+ * service` and dispatched nothing, ever (measured: 0 reads of
+ * `sys_report_schedule` in 5600 ms with the success line present). With no
+ * entry here, `getService('job')` throws when no job plugin is installed,
+ * every consumer's documented no-job-service path becomes reachable (they all
+ * already run on `LiteKernel`, which injects no fallbacks), and the kernel
+ * says the absence out loud at boot: `validateSystemRequirements()` warns
+ * "Core service missing, functionality may be degraded: job". Do NOT re-add
+ * the entry to quiet that warning — install `@objectstack/service-job`, or
+ * register a real scheduler, instead. `createMemoryJob` stays exported below
+ * for embedders who deliberately want a manual-trigger job registry and have
+ * read its docblock.
  */
 declare const CORE_FALLBACK_FACTORIES: Record<string, () => Record<string, any>>;
 

package/dist/index.d.ts

@@ -320,12 +320,14 @@ declare class ObjectKernel {
      * as well: if the hook never settles and nothing else keeps the loop alive,
      * Node exits before the timer can fire and the timeout is never reported.
      * The guard has to stay ref'd exactly as long as the race is undecided,
-     * which is what `clearTimeout` in a `finally` expresses.
+     * which is what clearing on settle expresses.
      *
-     * `operation` is widened to `T | PromiseLike<T>` because the Plugin
-     * contract permits a synchronous hook (`init`/`start` return
-     * `void | Promise<void>`); such a hook wins the race immediately and the
-     * guard is reclaimed on the same turn.
+     * Clearing the timer was only half of it, though (#10604): the promise the
+     * race still holds a reaction on has to SETTLE, or it and that reaction are
+     * retained past the end of the run — two leaking promises per boot, which
+     * is what `vitest --detectAsyncLeaks` names here. Both halves now live in
+     * `TimeoutGuard.reclaim()`, shared with `shutdown()`, so the two sites
+     * cannot drift into doing one half each again.
      */
     private raceStartupTimeout;
     /**
@@ -2021,17 +2023,27 @@ interface ResolveLocalizationInput {
     tenantId?: string;
     userId?: string;
 }
+type LocalizationResult = {
+    timezone: string;
+    locale: string;
+    currency?: string;
+};
 /**
  * Resolve workspace localization defaults (reference `timezone` / `locale` /
  * `currency`). Canonical path is the `localization` SettingsManifest (cascade:
  * platform default → global → tenant); falls back to direct tenant-scoped
  * `sys_setting` rows, then the built-ins `UTC` / `en-US`. Never throws.
+ *
+ * A read that fails outright (backend fault — table missing, connection
+ * refused, etc.) is memoized for {@link LOCALIZATION_FAILURE_CACHE_TTL_MS}
+ * per `(ql, tenantId, userId)` so the failing query — and the driver's log
+ * line for it — does not repeat every request (#10221). A successful read,
+ * including a legitimate "no settings configured yet" empty result, is NEVER
+ * cached: the next call always re-reads, so a settings write takes effect
+ * immediately (see the cache doc above for why — the dogfood analytics
+ * bucketing test pins this).
  */
-declare function resolveLocalizationContext(input: ResolveLocalizationInput): Promise<{
-    timezone: string;
-    locale: string;
-    currency?: string;
-}>;
+declare function resolveLocalizationContext(input: ResolveLocalizationInput): Promise<LocalizationResult>;
 
 /**
  * ADR-0069 — authentication-policy session gate.
@@ -3510,11 +3522,15 @@ declare function createMemoryQueue(): {
 };
 
 /**
- * In-memory job scheduler fallback.
+ * In-memory job registry — schedule/cancel/trigger bookkeeping with NO timer.
  *
- * Implements the IJobService contract with basic schedule/cancel/trigger
- * operations.  Used by ObjectKernel as an automatic fallback when no real
- * job plugin (e.g. Agenda / BullMQ) is registered.
+ * [#10746] NOT pre-injected by ObjectKernel any more (it used to be, via
+ * `CORE_FALLBACK_FACTORIES`): a fallback must not fake capability (maintainer
+ * ruling 2026-08-22). Advertising a `schedule()` that records and never fires
+ * made every "prefer the platform job service, else own a timer" consumer
+ * take the job-service branch and then silently never run. The export remains
+ * for embedders who deliberately want a manual-trigger job registry — e.g. in
+ * tests that drive handlers via `trigger()` — and have read this docblock.
  *
  * [#4058] `degraded` (ADR-0076 D12), with the missing half named in the
  * message rather than left for a deployer to discover: `trigger()` really runs
@@ -3666,8 +3682,26 @@ declare function wireAuthoredTranslationSync(ctx: MinimalCtx): void;
 
 /**
  * Map of core-criticality service names to their in-memory fallback factories.
- * Used by ObjectKernel.validateSystemRequirements() to auto-inject fallbacks
- * when no real plugin provides the service.
+ * This IS the kernel's pre-injection list: `ObjectKernel.preInjectCoreFallbacks()`
+ * registers an entry for every unprovided `core` service before Phase 2, and
+ * `validateSystemRequirements()` consults the same map as its final check.
+ *
+ * [#10746] `job` is deliberately ABSENT — a fallback must not fake capability
+ * (maintainer ruling 2026-08-22). `createMemoryJob()`'s `schedule()` records a
+ * job and never fires it, so pre-injecting it made every "prefer the platform
+ * job service, else own a timer" consumer take the job-service branch and then
+ * silently never run: `plugin-reports` logged `dispatcher registered with job
+ * service` and dispatched nothing, ever (measured: 0 reads of
+ * `sys_report_schedule` in 5600 ms with the success line present). With no
+ * entry here, `getService('job')` throws when no job plugin is installed,
+ * every consumer's documented no-job-service path becomes reachable (they all
+ * already run on `LiteKernel`, which injects no fallbacks), and the kernel
+ * says the absence out loud at boot: `validateSystemRequirements()` warns
+ * "Core service missing, functionality may be degraded: job". Do NOT re-add
+ * the entry to quiet that warning — install `@objectstack/service-job`, or
+ * register a real scheduler, instead. `createMemoryJob` stays exported below
+ * for embedders who deliberately want a manual-trigger job registry and have
+ * read its docblock.
  */
 declare const CORE_FALLBACK_FACTORIES: Record<string, () => Record<string, any>>;
 

package/dist/index.js

@@ -1355,35 +1355,6 @@ function createMemoryQueue() {
   };
 }
 
-// src/fallbacks/memory-job.ts
-function createMemoryJob() {
-  const jobs = /* @__PURE__ */ new Map();
-  return {
-    __serviceInfo: {
-      status: "degraded",
-      handlerReady: false,
-      message: "In-process job registry \u2014 trigger() runs handlers, but scheduled jobs never fire on their own (no timer). Register a job plugin (e.g. Agenda) for real scheduling."
-    },
-    _serviceName: "job",
-    async schedule(name, schedule, handler) {
-      jobs.set(name, { schedule, handler });
-    },
-    async cancel(name) {
-      jobs.delete(name);
-    },
-    async trigger(name, data) {
-      const job = jobs.get(name);
-      if (job?.handler) await job.handler({ jobId: name, data });
-    },
-    async getExecutions() {
-      return [];
-    },
-    async listJobs() {
-      return [...jobs.keys()];
-    }
-  };
-}
-
 // src/fallbacks/memory-i18n.ts
 import { normalizeSupportedLocales } from "@objectstack/spec/system";
 function deepMerge(target, source) {
@@ -1611,6 +1582,35 @@ function createMemoryMetadata() {
   };
 }
 
+// src/fallbacks/memory-job.ts
+function createMemoryJob() {
+  const jobs = /* @__PURE__ */ new Map();
+  return {
+    __serviceInfo: {
+      status: "degraded",
+      handlerReady: false,
+      message: "In-process job registry \u2014 trigger() runs handlers, but scheduled jobs never fire on their own (no timer). Register a job plugin (e.g. Agenda) for real scheduling."
+    },
+    _serviceName: "job",
+    async schedule(name, schedule, handler) {
+      jobs.set(name, { schedule, handler });
+    },
+    async cancel(name) {
+      jobs.delete(name);
+    },
+    async trigger(name, data) {
+      const job = jobs.get(name);
+      if (job?.handler) await job.handler({ jobId: name, data });
+    },
+    async getExecutions() {
+      return [];
+    },
+    async listJobs() {
+      return [...jobs.keys()];
+    }
+  };
+}
+
 // src/fallbacks/authored-translation-sync.ts
 import { LEGACY_OBJECT_FIRST_KEYS } from "@objectstack/spec/system";
 var OWNER_PROP = "__authoredTranslationSyncOwner";
@@ -1743,7 +1743,6 @@ var CORE_FALLBACK_FACTORIES = {
   metadata: createMemoryMetadata,
   cache: createMemoryCache,
   queue: createMemoryQueue,
-  job: createMemoryJob,
   i18n: createMemoryI18n
 };
 
@@ -1767,6 +1766,48 @@ function registerPluginByName(registry, plugin, logger) {
   return previous;
 }
 
+// src/timeout-guard.ts
+var TimeoutGuard = class {
+  constructor(timeoutMs, createTimeoutError) {
+    /**
+     * Settles `expiry` without a value. `Promise<never>` has no resolvable
+     * value in the type system, but settling it is the entire point: it is
+     * only ever called from `reclaim()`, i.e. after the race it guarded has
+     * already been decided, so the resolution is discarded by construction and
+     * can never become a race winner. The cast localises that argument here
+     * rather than pushing a lie into every caller's return type.
+     */
+    this.settleExpiry = () => {
+    };
+    this.expiry = new Promise((resolve, reject) => {
+      this.settleExpiry = resolve;
+      this.timer = setTimeout(() => reject(createTimeoutError()), timeoutMs);
+    });
+  }
+  /**
+   * Reclaim the guard once the race it protects has been decided. Both
+   * halves, always: the timer is cleared so it cannot fire against a
+   * lifecycle phase that is already over, and `expiry` is settled so neither
+   * it nor the race's reaction on it is retained.
+   *
+   * Idempotent — `clearTimeout` on a cleared handle and a second resolve on
+   * a settled promise are both no-ops.
+   */
+  reclaim() {
+    clearTimeout(this.timer);
+    this.timer = void 0;
+    this.settleExpiry();
+  }
+};
+async function raceWithTimeout(operation, timeoutMs, createTimeoutError) {
+  const guard = new TimeoutGuard(timeoutMs, createTimeoutError);
+  try {
+    return await Promise.race([operation, guard.expiry]);
+  } finally {
+    guard.reclaim();
+  }
+}
+
 // src/kernel.ts
 var ObjectKernel = class {
   constructor(config = {}) {
@@ -2037,14 +2078,11 @@ var ObjectKernel = class {
     this.logger.info("Graceful shutdown started");
     const shutdownTimeoutError = new Error("Shutdown timeout exceeded");
     try {
-      const shutdownPromise = this.performShutdown();
-      const timeoutPromise = new Promise((_, reject) => {
-        const t = setTimeout(() => {
-          reject(shutdownTimeoutError);
-        }, this.config.shutdownTimeout);
-        if (t.unref) t.unref();
-      });
-      await Promise.race([shutdownPromise, timeoutPromise]);
+      await raceWithTimeout(
+        this.performShutdown(),
+        this.config.shutdownTimeout,
+        () => shutdownTimeoutError
+      );
       this.state = "stopped";
       this.logger.info("\u2705 Graceful shutdown complete");
     } catch (error) {
@@ -2162,25 +2200,17 @@ var ObjectKernel = class {
    * as well: if the hook never settles and nothing else keeps the loop alive,
    * Node exits before the timer can fire and the timeout is never reported.
    * The guard has to stay ref'd exactly as long as the race is undecided,
-   * which is what `clearTimeout` in a `finally` expresses.
+   * which is what clearing on settle expresses.
    *
-   * `operation` is widened to `T | PromiseLike<T>` because the Plugin
-   * contract permits a synchronous hook (`init`/`start` return
-   * `void | Promise<void>`); such a hook wins the race immediately and the
-   * guard is reclaimed on the same turn.
+   * Clearing the timer was only half of it, though (#10604): the promise the
+   * race still holds a reaction on has to SETTLE, or it and that reaction are
+   * retained past the end of the run — two leaking promises per boot, which
+   * is what `vitest --detectAsyncLeaks` names here. Both halves now live in
+   * `TimeoutGuard.reclaim()`, shared with `shutdown()`, so the two sites
+   * cannot drift into doing one half each again.
    */
   async raceStartupTimeout(operation, timeout, message) {
-    let guard;
-    const timeoutPromise = new Promise((_, reject) => {
-      guard = setTimeout(() => {
-        reject(new Error(message));
-      }, timeout);
-    });
-    try {
-      return await Promise.race([operation, timeoutPromise]);
-    } finally {
-      clearTimeout(guard);
-    }
+    return raceWithTimeout(operation, timeout, () => new Error(message));
   }
   /**
    * Whether a service is resolvable on this kernel right now — direct
@@ -4396,10 +4426,11 @@ function safeJsonParse2(s, fallback) {
     return fallback;
   }
 }
-async function tryFind(ql, object, where, limit = 100) {
+async function tryFind(ql, object, where, limit = 100, organizationId) {
   if (!ql || typeof ql.find !== "function") return [];
   try {
-    let rows = await ql.find(object, { where, limit, context: { isSystem: true } });
+    const context = organizationId ? { isSystem: true, tenantId: organizationId } : { isSystem: true };
+    let rows = await ql.find(object, { where, limit, context });
     if (rows && rows.value) rows = rows.value;
     return Array.isArray(rows) ? rows : [];
   } catch {
@@ -4497,12 +4528,19 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
     return userRow;
   };
+  const needsUserRow = !grants.email || !grants.permissions.includes("ai_seat");
+  const [, members, userPositionRows, orgMembersLeg, upsRowsAll] = await Promise.all([
+    needsUserRow ? getUserRow() : Promise.resolve(void 0),
+    tryFind(ql, "sys_member", { user_id: userId }, 200),
+    tryFind(ql, "sys_user_position", { user_id: userId }, 200),
+    tenantId ? tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3) : Promise.resolve([]),
+    tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100)
+  ]);
   if (!grants.email) {
     const u = await getUserRow();
     if (u?.email) grants.email = String(u.email);
   }
   const nowMs = opts.nowMs ?? Date.now();
-  const members = await tryFind(ql, "sys_member", { user_id: userId }, 200);
   const accessibleOrgIds = /* @__PURE__ */ new Set();
   for (const m of members) {
     if (!isGrantActive(m, nowMs)) continue;
@@ -4510,7 +4548,9 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     if (typeof org === "string" && org) accessibleOrgIds.add(org);
   }
   grants.accessible_org_ids = Array.from(accessibleOrgIds);
-  const activeMembers = tenantId ? members.filter((m) => (m.organization_id ?? m.organizationId) === tenantId) : members;
+  const activeMembers = members.filter(
+    (m) => isGrantActive(m, nowMs) && (!tenantId || (m.organization_id ?? m.organizationId) === tenantId)
+  );
   for (const m of activeMembers) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
@@ -4519,7 +4559,6 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
       }
     }
   }
-  const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
@@ -4528,14 +4567,13 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     if (typeof r === "string" && r && !grants.positions.includes(r)) grants.positions.push(r);
   }
   if (tenantId) {
-    const orgMembers = await tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3);
+    const orgMembers = orgMembersLeg;
     const ids = new Set(
       orgMembers.map((m) => m.user_id ?? m.userId).filter((v) => typeof v === "string" && v.length > 0)
     );
     ids.add(userId);
     grants.org_user_ids = Array.from(ids);
   }
-  const upsRowsAll = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
   const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
   const psIds = new Set(
     upsRows.filter((r) => {
@@ -4549,7 +4587,7 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
   let hasPlatformAdminGrant = false;
   if (!grants.positions.includes("everyone")) grants.positions.push("everyone");
   if (grants.positions.length > 0) {
-    const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 100);
+    const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 200, tenantId);
     const deactivatedNames = new Set(
       positionRows.filter((r) => !isRowActive(r)).map((r) => r.name).filter(Boolean)
     );
@@ -4627,34 +4665,89 @@ function coerceCurrency(value) {
   const s = typeof value === "string" ? value.trim().toUpperCase() : "";
   return /^[A-Z]{3}$/.test(s) ? s : void 0;
 }
+var LOCALIZATION_FAILURE_CACHE_TTL_MS = 3e4;
+var localizationFailureCache = /* @__PURE__ */ new WeakMap();
 async function resolveLocalizationContext(input) {
+  const { ql, tenantId, userId } = input;
+  const cacheKey = `${tenantId ?? ""}|${userId ?? ""}`;
+  if (ql && typeof ql === "object") {
+    const hit = localizationFailureCache.get(ql)?.get(cacheKey);
+    if (hit && hit.expiresAt > Date.now()) return hit.value;
+  }
+  const { value, failed } = await resolveLocalizationContextUncached(input);
+  if (failed && ql && typeof ql === "object") {
+    const bucket = localizationFailureCache.get(ql) ?? /* @__PURE__ */ new Map();
+    bucket.set(cacheKey, { value, expiresAt: Date.now() + LOCALIZATION_FAILURE_CACHE_TTL_MS });
+    localizationFailureCache.set(ql, bucket);
+  }
+  return value;
+}
+async function resolveLocalizationContextUncached(input) {
   const { ql, settings, tenantId, userId } = input;
+  let failed = false;
   try {
     if (settings && typeof settings.get === "function") {
       const sctx = { tenantId, userId };
-      const [tzRes, localeRes, currencyRes] = await Promise.all([
-        settings.get("localization", "timezone", sctx).catch(() => void 0),
-        settings.get("localization", "locale", sctx).catch(() => void 0),
-        settings.get("localization", "currency", sctx).catch(() => void 0)
-      ]);
+      let tzRes;
+      let localeRes;
+      let currencyRes;
+      if (typeof settings.getMany === "function") {
+        try {
+          const many = await settings.getMany("localization", ["timezone", "locale", "currency"], sctx);
+          tzRes = many.timezone;
+          localeRes = many.locale;
+          currencyRes = many.currency;
+        } catch {
+          failed = true;
+        }
+      } else {
+        [tzRes, localeRes, currencyRes] = await Promise.all([
+          settings.get("localization", "timezone", sctx).catch(() => {
+            failed = true;
+            return void 0;
+          }),
+          settings.get("localization", "locale", sctx).catch(() => {
+            failed = true;
+            return void 0;
+          }),
+          settings.get("localization", "currency", sctx).catch(() => {
+            failed = true;
+            return void 0;
+          })
+        ]);
+      }
       const tz = coerceTimeZone(tzRes?.value);
       const locale = coerceLocale(localeRes?.value);
       const currency = coerceCurrency(currencyRes?.value);
-      if (tz || locale || currency) return { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency };
+      if (tz || locale || currency) {
+        return { value: { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency }, failed: false };
+      }
     }
   } catch {
+    failed = true;
+  }
+  let rows = [];
+  if (ql && typeof ql.find === "function") {
+    try {
+      let result = await ql.find("sys_setting", {
+        where: { namespace: "localization", key: { $in: ["timezone", "locale", "currency"] }, scope: "tenant" },
+        limit: 10,
+        context: { isSystem: true }
+      });
+      if (result && result.value) result = result.value;
+      rows = Array.isArray(result) ? result : [];
+    } catch {
+      failed = true;
+    }
   }
-  const rows = await tryFind(
-    ql,
-    "sys_setting",
-    { namespace: "localization", key: { $in: ["timezone", "locale", "currency"] }, scope: "tenant" },
-    10
-  );
   const valueOf = (k) => rows.find((r) => r.key === k)?.value;
   return {
-    timezone: coerceTimeZone(valueOf("timezone")) ?? "UTC",
-    locale: coerceLocale(valueOf("locale")) ?? "en-US",
-    currency: coerceCurrency(valueOf("currency"))
+    value: {
+      timezone: coerceTimeZone(valueOf("timezone")) ?? "UTC",
+      locale: coerceLocale(valueOf("locale")) ?? "en-US",
+      currency: coerceCurrency(valueOf("currency"))
+    },
+    failed
   };
 }