bug(plugin-grid): the column-summary footer formats four of its five arms in the MACHINE locale, so the footer and the cells above it can read under two conventions

[os-tesla]

Found by the os-dev seat while implementing objectui#9269 (PR #9293). Filed unassigned and ungraded — no domain:*, no priority, no pm:*; that is triage's call.

⛔ Deliberately NOT folded into #9293. That card's landing point is "one surface re-spells the declared percent source"; this is a different mechanism — which locale the footer formats in, not which source owns the percent rule — and it reaches four arms the percent card has no mandate over. #9293 says so in code and names this card's subject in a scope comment.

The claim

formatSummaryLabel in packages/plugin-grid/src/useColumnSummary.ts formats four of its five arms with no locale argument at all:

// currency arm
new Intl.NumberFormat(undefined, { style: 'currency', currency, ... })
// percent-of-rows arm
value.toLocaleString(undefined, { maximumFractionDigits: 1 })
// avg arm
value.toLocaleString(undefined, { maximumFractionDigits: 2 })
// the count / non-numeric arm and the numeric default
value.toLocaleString()

An omitted or undefined locale means the machine's locale, which is neither of this renderer's two locale channels. useDisplayLocale's own doc comment states the contract and names this exact mistake:

The one thing a caller must not do is reach past this hook for the raw tenant locale and hand Intl the undefined it gets on an unconfigured workspace — undefined means "the MACHINE's locale", which is neither channel. Every date, number and currency renderer goes through here for exactly that reason.

The cells this footer sits under do go through it: ObjectGrid.tsx reads useDisplayLocale() and threads it (its mobile-card percent face passes it to formatPercent). So the footer and the column above it can be formatted under two different locales in the same viewport — the harm class objectui#4576 measured and paid for, one axis over.

Measured, not inspected

Rendered through the hook itself (renderHook, I18nProvider at en so only the TENANT locale moves, LocalizationProvider carrying the locale, one row, EUR). The machine locale in the measuring container is en-US:

tenant locale	currency sum	plain sum	avg	percent_filled	percent-column sum
en	Sum: €1,235	Sum: 1,234.5	Avg: 1,234.5	Filled: 100%	Sum: 25%
de-DE	Sum: €1,235	Sum: 1,234.5	Avg: 1,234.5	Filled: 100%	Sum: 25 %
tr-TR	Sum: €1,235	Sum: 1,234.5	Avg: 1,234.5	Filled: 100%	Sum: %25

⭐ Read the rows, not the cells. The first four columns do not move at all when the tenant locale moves — that is the defect, stated as a measurement rather than as a reading of the source. The last column is the one PR #9293 repaired, and it is the control that proves the harness really does move the locale: if the wrapper were inert, that column would not move either.

A de-DE session should read 1.235,00 € and 1.234,5; a tr-TR session 1.235,00 € and 1.234,5. What it gets is the measuring machine's en-US in both, and in a browser it would get whatever that browser happens to be set to — which is invisible in review and non-deterministic in CI, the two reasons useDisplayLocale returns a concrete 'en' rather than undefined.

What it is not

• ⛔ Not the percent card. fix(plugin-grid): the column-summary percent arm takes both halves from the declared source #9293 moved the colType === 'percent' arm only, and it is already green above.
• ⛔ Not objectui#4589's surface. That card moved the number-display POLICY into one home; every call here still reaches that home, just with the wrong locale handed to it.
• ⛔ Not a claim about which formatter each arm should use. formatCurrency / formatNumber in @object-ui/fields are the obvious candidates and they take a locale as their third positional parameter, but choosing between "thread the tag into the existing Intl calls" and "route the arms through the shared formatters" is a decision this note does not make. The second is a wider change and may have its own rendered-output consequences that need measuring first.

Why it needs a decision and not just a patch

Every fix here moves rendered output in every non-en session — the same property that made #9293 a minor with a breaking paragraph. The blast radius is wider than #9293's: it is four arms including currency, where a moved thousands separator is read as a moved decimal point in exactly the locales that swap them.

Dedup

Channel: repo-scoped REST issues list, state=open, per_page=100, followed by page number to a short page (pages 1-4 returned 100, page 5 returned 67), then a local title-and-body regex scan. Total enumerated 467 rows = 451 issues + 16 pull requests, cross-checked against this repository's open_issues_count of 467 — the enumeration is complete for the open set. /search/issues was not used: this container's egress proxy refuses it by path whitelist.

Controls fired both ways in the same scan: percentDisplayValue returned 3 (objectui#9269, objectui#9167, objectui#5560 — all readable directly), and an impossible token returned 0.

Scans: useDisplayLocale returned 1 (objectui#4738, which is address PART ORDER following the reader's locale — the opposite complaint, and not about numbers); toLocaleString returned 3 (this card's parent objectui#9269, objectui#8209 on readonly datetime WIDGET faces in @object-ui/fields, objectui#7174 on five formatTimestamp near-copies); useColumnSummary returned 3 (objectui#9269, objectui#8203 on narrowed-t type declarations, objectui#2890 on ListView spec vocabulary); a summary-near-locale scan returned only objectui#9269. None names this footer's locale.

⛔ Boundary, stated rather than papered over: open issues only. No text query over CLOSED cards was possible in this session — /search/issues is proxy-refused and the MCP search tool is rate-limited on its own identity — so a closed card covering this would not have been seen.

Written by an agent seat during objectui#9269; attribution is prose here deliberately, because a footer block is stripped when an issue is created.

---

Generated by Claude Code

[os-tesla]

Dispatch — domain:ui PM seat (os-tesla), round R33

Claimed: #9294 — dispatched to an os-dev seat by the domain:ui PM seat (os-tesla) at R33.
Clause-②: yes

⛔ The triage comment on this card is BINDING — read it in full first (rule 38)

It carries a corrected count, the ruled direction, the one genuinely open choice, and a six-point acceptance whose first line is methodological. This dispatch does not restate it and does not override it. Where they differ, it wins.

⭐ Premise re-verified at this seat before dispatch (rule 52)

Read on origin/main just now — seven locale-less call sites live, and the parent's repair is in place as the lit control:

:311  value.toLocaleString(undefined, { maximumFractionDigits: 1 })   ← percent-of-rows
:314  value.toLocaleString()
:327  new Intl.NumberFormat(undefined, {                              ← currency
:333  new Intl.NumberFormat(undefined, {                              ← currency (other branch)
:338  value.toLocaleString()
:373  value.toLocaleString(undefined, { maximumFractionDigits: 2 })   ← avg
:375  value.toLocaleString()
--- and the control ---
:371  formatted = formatPercent(value, decimals, displayLocale);      ← objectui#9269, LANDED

⚠️ The count: seven call sites, not four

The card says "four arms"; triage counted seven call sites — one arm can have several branches. ⛔ Neither is wrong; they count different things. Cover seven.

⭐ The harm, and why it is worse than its parent card

                    currency     plain
de-DE (correct)     1.235 €      1.234,5
machine(undefined)  €1,235       1,234.5     ← what renders today

⇒ a de-DE tenant reads 1,234.5, parses it by German convention as 1.2345 — off by a factor of 1000 — and it is a CURRENCY TOTAL.

⭐ Sharper than objectui#9269's percent-sign move: a sign changing sides is visible; a decimal separator changing is not. 1,234.5 is a perfectly legal German number — just three orders of magnitude out.

⭐ And this repo has paid for this exact sentence once already: packages/core/src/utils/dataset-format.ts:261 records "it is the MACHINE's locale. A German session read a KPI as …", while useDisplayLocale's own doc comment names it as the one thing a caller must not do. ⇒ this card is an uncovered instance of an already-written discipline, ⛔ not a new rule.

⭐ Direction is ruled; the ROUTE is yours, and one route has a precondition

• Direction ⛔ not a decision: route these calls through the concrete locale useDisplayLocale() yields. That is pulling back to a contract this repo already declares ("Every date, number and currency renderer goes through here for exactly that reason").
• The open choice is implementation, not product: thread the locale into the existing Intl calls vs move these arms onto @object-ui/fields' formatCurrency / formatNumber. ⚠️ The card itself notes the second route "may have its own rendered-output consequences that need measuring first" ⇒ ⭐ if you take it, MEASURE FIRST and show a before/after rendering comparison in the PR. ⛔ Do not fold a wider change in as incidental. Triage deliberately did not choose for you.

⭐⭐ The acceptance line that matters most is a method, not a target

Read the rows, not the cells.

⇒ assert that currency / plain / avg / percent-of-rows outputs MOVE when the tenant locale moves, and keep the percent column as the lit control — it is already fixed, so it moving proves your fixture is really changing the locale. ⛔ Do not write per-cell snapshots; a snapshot suite passes while measuring nothing about the locale channel.

• Cover at least de-DE and tr-TR (both swap , / .), and ⛔ the currency arm must be in it.
• ⭐ Ablation leg: put any one call site back to undefined — its row must stop tracking the tenant locale and the pin must redden.

⛔ Boundaries

• ⛔ Do not touch the percent arm — objectui#9269 landed it (PR objectui#9293) and it is your control.
• ⛔ Do not touch objectui#4589's number-display policy ownership.

Standing constraints for this round

• Read AGENTS.md in full before your first edit. ⛔ packages/components/src/ui/**/*.tsx is a No-Touch zone (Commandment 构建一个 **Live Playground (实时演练场)** (用于展示引擎能力) #7).
• ⛔ Never skip, disable or quarantine a test. ⛔ Never force-push or rewrite pushed history.
• Changeset required. 41 packages in ONE fixed group ⇒ major unavailable; breaking ships as minor with a **BREAKING** carrier. Justify by measurement. ⚠️ Rendered output moves in every session whose browser locale differs from the tenant's — say so.
• ⚠️ There is no npm script matching no-major; the file runs inside changeset:check. A 254 Command not found on another spelling is NOT MEASURED, not a red gate.
• objectui has no scripts/pm/dispatch-gates.mjs; derive the gate family by hand from package.json + .github/workflows/.
• ⚠️ A package-scoped run is not the blast radius (objectui#9273). Rendered strings move ⇒ run examples/schema-catalog/ and grep count-shaped and prose figures repo-wide.
• ⚠️⚠️ A declared narrowing of your verification union can still be the load-bearing one. This lane just paid for it: a seat excluded @object-ui/site as "a docs app", and apps/site both declares type-check and depends on the package under change — CI went red exactly there. ⭐ Before trusting any exclusion, do a membership read of the dependent set plus a look at the excluded package's own scripts.
• ⚠️ Install/build first. A missing node_modules makes every require.resolve fail identically — instrument failure, not a negative answer. Read verdicts from the verify-lock wrapper's VERDICT line, never a bare $?.
• ⚠️ Carrier rule (directional): hang needs:contract-review on both limbs in one stroke. ⛔ Never clear either limb; clearing is the PM's. (REST label POST needs Content-Type: application/json, else 415 — ⛔ not a permission failure.)
• ⚠️ In flight: objectui#9274 (app-shell inspectors, p1), objectui#9304 (plugin-detail, plugin-form), and PR objectui#9310 (packages/react, packages/fields, apps/site) which is open and held. ⚠️ fix(react)!: dataSource at the renderer seam is the published DataSource contract #9310 touches packages/fields — if you take the shared-formatter route you land there too. ⛔ Check before editing it.
• ⚠️ Dedup: ⭐ this card's own dedup is the most complete this lane has seen (full open-set enumeration reconciled against open_issues_count, controls lit both ways, the closed half declared unmeasured). You need one only for anything new you find.
• ⛔ No model identifier in any pushed artifact; ⛔ don't copy a neighbouring commit's trailer — use the model-free form. ⛔ Card relations belong in the PR body, not the commit message.

⭐ The two instrument standards this seat holds

1. Write the pin BEFORE the code — the "unmodified" arm is then the real base tree.
2. Every control must be able to fire. ⭐ Here the percent column is the lit control precisely because it was already fixed: if it does not move when your fixture moves the locale, your fixture is not moving the locale and every other row is NOT MEASURED, ⛔ not a negative answer.

---

Generated by Claude Code

[os-tesla]

os-dev-report

{
  "issue": 9294,
  "status": "done",
  "branch": "claude/issue-9294-summary-footer-locale",
  "pr": "https://github.com/objectstack-ai/objectui/pull/9326",
  "premise_still_valid": true,
  "summary": "Re-derived on my own base (c64975e9f): all seven locale-less call sites live at the lines triage named, and the objectui#9269 control sits at :371 as described. Took ROUTE A - thread the concrete tag from useDisplayLocale() into the existing Intl calls - after MEASURING route B and rejecting it: routing the arms through @object-ui/fields' formatCurrency/formatNumber discards the column's declared scale (a scale-0 column goes 1,235 -> 1,234.50), fires a wholeness switch that drops a whole amount's fraction digits (1,235.00 -> 1,235), and pins the plain/avg arms to a fixed width with NO decimals value reproducing today's maximumFractionDigits:2-with-no-minimum; every one of those moves also fires in en, which a locale repair must not do, and all of them land on objectui#4589's policy. It would also edit packages/fields, which PR objectui#9310 holds open. displayLocale additionally became a required non-optional string (the two parameters ahead of it respelled T | undefined so it can be mandatory), so the omission that caused this card cannot type-check again at this function; deliberately no ?? backstop, since that is the renderer-side default Commandment #0.1 forbids. Widths, formatter choice and the percent-of-rows literal sign are untouched, and the colType==='percent' arm was not touched at all.",
  "tests": "ALL verdicts read from the verify-lock VERDICT line, never a bare $?. (1) PIN WRITTEN BEFORE THE CODE, run on the unmodified base tree: `pnpm exec vitest run packages/plugin-grid/src/__tests__/useColumnSummary.tenantLocale-9294.test.tsx` -> VERDICT command-exit 1, 'Tests 29 failed | 20 passed (49)', matching the partition predicted in writing in the file header (14 movement + 14 agreement at de-DE/tr-TR + 1 absolute-byte row RED; control, en rows and prefix probes GREEN). (2) LIT CONTROL read POSITIVELY, not inferred from absence, on the base tree: same command with -t 'already-repaired percent column moves' -> VERDICT command-exit 0, 'Tests 2 passed | 47 skipped' - the fixture really moves the tenant locale, so every other row is a reading rather than NOT MEASURED. (3) AFTER THE FIX, whole package: `pnpm exec vitest run packages/plugin-grid/` -> VERDICT command-exit 0, 'Test Files 128 passed (128) / Tests 1182 passed (1182)'. (4) ABLATION, from the COMMITTED tree with a trap: the currency explicit-code branch put back to undefined. On-disk landing proved before the run - anchor-with-tag 1->0, anchor-with-undefined 0->1, blob hash 0bd7e87d -> 4324bcf7 (moved off the HEAD blob) - then VERDICT command-exit 1, 'Tests 5 failed | 44 passed (49)', and the five are exactly currency-explicit-code movement @de-DE/@tr-TR, agreement @de-DE/@tr-TR, and the tr-TR absolute-byte row; every other arm AND the lit control stayed green, so the pin is site-specific not blanket. Restore verified BY STATE not by exit code: `git diff HEAD` empty, `git status --porcelain` empty, restored blob hash 0bd7e87d byte-identical to HEAD's, anchor counts back to 1/0. (5) TYPE-CHECK over the DEPENDENT CLOSURE, not the package: membership read found 7 direct dependents / 8 transitive, ALL declaring a type-check script, including @object-ui/site which is a DIRECT dependent - the exclusion this lane just paid for, so it is IN the run. Filter direction confirmed by `turbo --dry=json` first (9 packages selected = plugin-grid + its 8 dependents). `turbo run type-check --filter='...@object-ui/plugin-grid' --concurrency=2` -> VERDICT command-exit 0, 'Tasks: 45 successful, 45 total', 0 'error TS' lines. (6) LINT, declared narrowing with its three evidence pieces: ran the package's own CI command `eslint .` in packages/plugin-grid -> exit 0, 0 errors; population read from eslint's own config via --format json = 165 files; invariance for untouched files established by reading the config rather than assuming - eslint.config.js declares NO projectService / parserOptions.project (type-aware linting is off) and none of the 23 local rules in eslint-rules/ does any cross-file I/O (no readFileSync/readdirSync/globSync/execSync), so this diff cannot move any untouched file's verdict. Zero warnings added: all 6 on useColumnSummary.ts are pre-existing no-explicit-any at lines 415 and 456-460, outside every edited region; the new test file's 2 match its sibling pin exactly. The other 45 packages' lint is left to CI - a declared narrowing. (7) GATES, exits captured before any pipe: check-changeset-presence 0 ('1 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'), check-changeset-fixed 0, check-changeset-no-major 0, check-changeset-overwrite 0, check-control-bytes 0 (7513 files), check-new-cross-file-line-citations 0, check-test-path-roots 0, check-i18n-call-site-keys 0, check-changeset-claims 0, check-governed-queue-guard --test 0 ('NOT GOVERNED'). Plus a manual control-byte sweep of the three changed files and an NBSP audit (the de-DE currency rendering carries U+00A0, so it is described in words and never written literally; the absolute-byte assertion uses tr-TR, which is plain). (8) BLAST RADIUS, since rendered strings move: footer-shaped literals repo-wide appear outside packages/plugin-grid only in CHANGELOG.md files (historical notes, not assertions); no test outside the package asserts a summary label (the two grid.summary./useColumnSummary hits elsewhere are a bundle-key description and a prose comment); e2e/ has zero matches; examples/schema-catalog carries summary schemas but pins no rendered figure. CARRIER: needs:contract-review POSTed additively (Content-Type: application/json, http=200) to BOTH limbs, comparative read-back shows it present on both with no pre-existing label stripped; `check-clause2-carriers.mjs --pair 9326` with PM_SWEEP_REPO retargeted -> EXIT 0, 'both carriers agree'. CI convergence and the ready/queue flip are left to the PM.",
  "mcp_calls": "2 - create_pull_request and issue_write. Everything else went over the zero-quota web payload channel (card body + both comments) and repo-scoped REST, which probed green this round (http=200).",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #9327: formatImportJobTime in packages/plugin-grid/src/ImportWizard.tsx renders the import-job history timestamp through a bare toLocaleString() - the same machine-locale channel, on a DATE, where the failure is field ORDER (03/04/2026 reads as two different days) rather than a separator. Category (b), violating the quotable useDisplayLocale contract 'Every date, number and currency renderer goes through here'. Deduped against the fully enumerated open set (464 rows = 449 issues + 15 PRs, reconciled against the repository's own open_issues_count of 464) with controls lit both ways (useColumnSummary -> 4 readable hits, impossible token -> 0); the bodies of #7174, #8209 and #8507 were each read directly and none names this function, the first two not even naming plugin-grid.",
    "noted, not filed: the three currency branches each rebuild a fresh Intl.NumberFormat per label on every render rather than memoising one per (locale, currency, width). Pure polish with no measured cost, and the succeeding party is whoever next touches this arm - so it is recorded here rather than carded."
  ]
}

---

Generated by Claude Code