Wire `config.locale` at the runtime's seed-load call sites — the locale axis added by #16510 is inert on the default boot path until a producer supplies it

[hotlong]

Blocked-by: #16510

Why this exists

#16510 / PR #16592 adds a locale filter axis to seed datasets and the loader that enforces it. The
consumer half is complete; no first-party call site supplies config.locale yet, so on the
default boot path the axis is inert — a locale-scoped dataset loads everywhere, exactly as if it
carried no scope.

The dev that landed the consumer half named this gap in its own PR body and asked the PM to file it
rather than widening its card past the declared file surface. That is the right call: packages/spec
and packages/metadata-protocol are one lane's surface, packages/runtime is another's.

Call sites

Confirmed by grep at tree c383352:

• packages/runtime/src/app-plugin.ts:1249
• packages/runtime/src/app-plugin.ts:1326
• packages/runtime/src/app-plugin.ts:1642

all three await seedLoader.load(request).

PR #16592's body additionally names a draft-publish path in protocol.ts. I could not confirm that
one in my checkout — the grep over packages/metadata-protocol/src/protocol.ts returned nothing at
c383352. Whoever picks this up should re-derive the full call-site list against current main
rather than trusting either reading; the three above are the ones that stand up today.

What to do

1. Resolve the locale from the stack's configured locale (i18n.defaultLocale is the obvious source;
   confirm against how env is resolved in resolveEnvConfig, which is the shape this mirrors) and
   pass it as SeedLoaderConfig.locale at each call site.
2. Flip the liveness ledger row seed.locale in packages/spec/liveness/seed.json from
   experimental to live, with a producer pointer to the wiring. That flip is the point of the
   card — the row is experimental today specifically because publishing live on a
   correct-but-insufficient consumer pointer is the falsehood the producer field exists to prevent.
3. warnOnUnresolvedLocaleScope in the loader exists to signpost the unwired state. Check whether it
   should stay as a guard for embedding hosts that still pass no locale, or go once the default path
   supplies one — that is a judgement call for the implementer, not a decided answer here.

Not in scope

Reconciling rows already written under a different locale. Switching an app's active locale on a
non-empty database leaves the other locale's rows resident, because every seed is upsert and the
loader only writes. That is a real gap, it is named in #16510's body as a cost the consuming app
currently documents in its README, and it is not filed yet — it needs a decision on whether the
loader should own that reconciliation at all before it becomes a card.

Origin

Follow-up requested by the dev on #16510 (PR #16592). Filed by the PM seat that dispatched it.

[hotlong]

Correction to the Not in scope section above: the reconciliation follow-up is now filed, as #16596.

When I wrote this card I said it "needs a decision on whether the loader should own that
reconciliation at all before it becomes a card". The dev's report on #16510 supplies the judgement I
was missing — the loader holds both externalId and the _packageId / _provenance keys, so it is
the only layer that could reconcile; no app knows which rows a previous load wrote. That settles
the home question, so the card was filed with the remaining open decisions (is it the loader's job,
what is a removal's scope, opt-in or default) written into it as what the implementer must answer
first.

The two are independent: #16595 makes the axis live, #16596 decides what happens to what it replaces.
Both blocked on #16510.

---

Generated by Claude Code