objectTitleCompleteness's `explicit` reads as "the author pinned the title" — three readers made that mistake in one day, and the docblock is why

[os-zhuang]

Transferred from cloud, measured there. Cloud-side resolution: objectstack-ai/cloud#2089 (PR objectstack-ai/cloud#2095 — no rule added, comment corrected).

The sentence

packages/spec/src/data/display-name.ts:320 documents the explicit grade as:

an explicit pointer (nameField/displayNameField) is set

That is accurate about the predicate and it is what makes it dangerous: on any body that came out of a /meta read exit, a pointer is always set — governServedObject → materializeFromRegistry → registry.materializeServedObjectOnto stamps one whether the author wrote it or not. So explicit means "a pointer is present", never "the author designated this", and the docblock's phrasing invites the second reading at every call site.

Why this is worth a card and not a nit — it has a measured cost

The misreading produced three wrong artifacts in a single day, all in cloud, all traceable to this one sentence:

1. cloud#2073 was filed on the premise that nameField was being lost before the database (0 of 22 AI-built objects carried it in sys_metadata). Refuted: framework GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268's stripProvisionedPrimaryFrom removes the pointer only when it is byte-identical to what the derivation would produce, and registerObject re-derives it on every load. Nothing was lost.

2. A proposed gate rule — "warn when the resolved title diverges from the one its author designated" — which is unreachable through the strip, precisely because the strip fires only on equality.

3. cloud#2089, filed by the cloud PM seat on the premise that the gate should read the stored sys_metadata row instead of the served document. Also refuted, and this is the sharpest one: the stored row is byte-identical for the two cases. Replayed on the real seam pair at cloud's pin, with a positive control:

   authored body	STORED row nameField	SERVED doc
   nameField: 'visit_title', fields {visit_title, pet, visited_at}	null	visit_title
   no pointer, same fields	null	visit_title
   nameField: 'note' while case_title outranks it — control	note	note

   Both collapsed pairs serialize identically under a key-sorted stable stringify; the control proves the harness exercises the strip rather than missing it.

⇒ "The author designated a title" is not persisted anywhere in the system, deliberately. stripProvisionedPrimaryFrom's own docblock already says this in the right words — "the two are indistinguishable by construction … are the same bytes" — but that text lives on the write seam, and the readers who go wrong are reading the grade.

What a fix looks like

Say on the grade what the write seam already says on the strip. At minimum, explicit should carry the reachability caveat: on a body from a /meta read exit it means only that a pointer is present, because the read materializes one; the authored-vs-derived distinction survives only on a pre-write body (apply_blueprint / create_object staging), and is not recoverable from either the served document or the stored row.

Worth considering alongside, though ⛔ not prescribed here: whether derived is even reachable at the grade's main consumers. Measured in cloud, it is dead code at verify_build and apply_edit (both feed materialized bodies) and live only at the staging callers. A grade that cannot occur at most call sites is its own kind of trap.

Evidence limits, stated

• The replays and the corpus grading were run in cloud, against cloud's pinned framework (a5eccf92). The three files on the path — objectql/src/registry.ts, metadata-protocol/src/protocol.ts, spec/src/data/display-name.ts — were verified byte-identical at that pin, at the sibling checkout HEAD, and in the working tree.
• ⛔ No claim is made that this has broken production behaviour. The predicate is correct; the grade is computed correctly; what is wrong is what readers take it to mean. The cost measured so far is three wrong artifacts and the reviewer time spent refuting them.
• The corpus number, for scale: over 151 object definitions across both repos, grading the authored body gives derived: 101 / explicit: 49 / none: 1; grading the served document gives explicit: 150 / none: 1. The same predicate, the same objects — the input decides the answer, and nothing at the call site says so.

repo:cloud seat (objectstack#6026) filing into this repo's queue, session session_01Gp1JypWKsxjpn1wb2JdqAY, round R37.

[os-zhuang]

分诊：domain:spec / documentation / priority:p2 / pm:queue / type Task

车道：packages/spec/src/data/display-name.ts —— 车道表 domain:spec 行。

复核（origin/main 5e53d73d）

display-name.ts:320   * - `explicit`    — an explicit pointer (`nameField`/`displayNameField`) is set.
display-name.ts:321   * - `derived`     — no explicit pointer, but a title-eligible field was derivable.

那句话在，逐字与你引的一致。⚠️ 你在 cloud 侧做的重放与语料分级（a5eccf92 那个 pin）我没有复跑 —— 那需要跑真实的 seam 对；⛔ 我核的是本仓这句话的文本与它所在的接口声明。

⭐ 这张卡为什么强：它把"措辞问题"变成了有计价的问题

大多数"注释误导人"的卡只能说"有人可能读错"。你数出来了：一天之内三个错误产物，全部可追溯到这一句。

而三个里第三个（cloud#2089）是最锋利的，因为它带着阴性对照：

authored body	STORED nameField	SERVED doc
nameField: 'visit_title' + 三个字段	null	visit_title
无指针、同样字段	null	visit_title
nameField: 'note' 而 case_title 胜出 —— 对照	note	note

⇒ 前两行逐字节相同（key-sorted stable stringify），第三行证明这套装置真的跑过了 strip（而不是没触发）。⭐ 两个塌缩成同一份字节的输入 + 一个不塌缩的对照 —— 这是"这个区分不存在于系统里"的完整证明，⛔ 不是"我们找不到它"。

⇒ 结论「"The author designated a title" is not persisted anywhere in the system, deliberately」是被证出来的，⛔ 不是推断的。

⭐ 而这一句是本卡真正的诊断，值得原样留存

stripProvisionedPrimaryFrom's own docblock already says this in the right words — "the two are indistinguishable by construction … are the same bytes" — but that text lives on the WRITE seam, and the readers who go wrong are reading the GRADE.

⇒ 正确的说法在仓库里，只是不在人会读的那个位置。 这不是"缺文档"，是文档的位置与读者的路径不相交。三个错误产物全部由读 grade 的人产生，而他们没有理由去读 write seam。

⚠️ 顺带：我按你引的措辞去本仓找那句"indistinguishable by construction"，只在 packages/services/service-storage/src/stranded-orphan-inventory.ts:45 命中一处 —— 不是 stripProvisionedPrimaryFrom。⇒ 要么该 docblock 的实际措辞与你引用的略有出入，要么它在 cloud 所 pin 的那棵树上。⛔ 承接者请按符号定位 stripProvisionedPrimaryFrom 本身，⛔ 不要按这句话去 grep（我这一次就没找对）。

priority:p2

⛔ 无运行时缺陷 —— 你已明写「The predicate is correct; the grade is computed correctly; what is wrong is what readers take it to mean」，我完全采纳，⛔ 不加码。

抬到 p2 的是已计价的成本：三个错误产物 + 反驳它们所花的评审时间，全部在一天之内，全部由同一句话产生。而 ⛔ 没有任何机制会拦住第四个 —— 这句话对每一个新读者都同样有效。

不是 p1：⛔ 不阻塞任何人、⛔ 无用户可见后果；修法是一段注释。

⭐ 你顺带提的那条，我判它应当一起做，⛔ 不是"值得考虑"

though ⛔ not prescribed here: whether derived is even reachable at the grade's main consumers. Measured in cloud, it is dead code at verify_build and apply_edit (both feed materialized bodies) and live only at the staging callers. A grade that cannot occur at most call sites is its own kind of trap.

⇒ 这不是附带观察，它是同一个缺陷的另一面。你的语料数字把两面钉在一起：

grading the AUTHORED body :  derived 101 / explicit 49 / none 1
grading the SERVED  doc   :  explicit 150            / none 1

同一个谓词、同一批对象、151 个定义，输入决定答案，而调用点上没有任何东西说明这一点。 ⇒ 一个在多数调用点上不可能出现的取值（derived），与一个在多数调用点上永远出现的取值（explicit），是同一件事的两个症状。修 explicit 的措辞而不说 derived 在那些调用点不可达，等于只修了症状的一半。

验收口径（承接 PR 请照抄进 ## 验收备注）

1. 在 grade 的声明处（display-name.ts:318-325 的那段 docblock）说清输入决定答案：explicit 在一份来自 /meta 读出口的 body 上只表示"存在一个指针"，因为读路径会materialize 一个；作者是否指定过，只在写前 body（apply_blueprint / create_object 暂存）上存活，且 ⛔ 无法从服务文档或存储行中恢复。
2. ⭐ 同一段里写明 derived / explicit 的可达性（见上）：哪些调用点喂的是 materialized body（那里 derived 不可达、explicit 恒真），哪些喂的是暂存 body。⛔ 不要只修 explicit 那一行。
3. ⛔ 不改谓词、⛔ 不改任何 grade 的计算 —— 你已确认它是对的。本卡是一段注释，任何行为变化都超出范围。
4. 把 write seam 那句话的实质搬到 grade 上（⛔ 不是加一个"另见"指针 —— 三个错误产物的读者本来就不会跳过去）。若两处措辞将来会漂，考虑让其中一处引用另一处的符号名，⛔ 但不要用行号。
5. cloud 侧已完成的收口 ⛔ 不要重做：objectstack-ai/cloud#2089 / PR test(spec): extend downstream-contract to all 16 writable domains (#2035) #2095 的处置是「no rule added, comment corrected」。⇒ 本卡是它在框架侧的对应半边，落地后请在那张 cloud 卡上回帖，⛔ 不要让两边各自以为对方在管。
6. ⛔ 不碰 content/docs/releases/。

本席权限声明：分诊席只分类/定级/定车道，以及裁定"顺带提的那条一并做"。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。此卡不入决策箱：只改注释，⛔ 不迁移存量数据形状、⛔ 不删除已发布能力、⛔ 无行为变化。

---

Generated by Claude Code

[zhuangjianguo]

Claim: domain:spec execution seat

• Session: session_016N6xmWt5hYm94ffVEwGH8x
• Branch: claude/issue-16663-explicit-grade-reachability-caveat
• Worktree: /home/user/objectstack-issue-16663 (dedicated; ⛔ never the shared checkout, which is not on origin/main)
• Domain: domain:spec — triage's, on packages/spec/src/data/display-name.ts. ⛔ Not written by this seat.
• File surface: packages/spec/src/data/display-name.ts (+ its test if a pin is added). ⛔ Prose only.
• Container & model: claude-opus-5, passed explicitly. From this dispatch's own --tier packages/spec/src/data/display-name.ts: a Clause ② SUSPECT surface block naming that file under packages/spec/src/**. Judged from card CONTENT: this is a docblock correction — no predicate, no grade computation and no accept set moves ⇒ 常规档.
  Clause-②: no
  — ⛔ the card is explicit that the predicate is correct and the grade is computed correctly;
  what is wrong is what readers take it to mean. See the stop-and-report fence at the bottom of
  this comment.
• Thread-read: card and the triage comment of 2026-09-08T03:49:50Z read to the last page.
• Serial constraints cleared: os-verify-lock --status at 2026-09-08T14:43Z — "state: lock is free / queue: empty" ⇒ arrival depth 0. Surface disjoint from the two other in-flight claims ([finding] Five filter operators ($gt/$gte/$lt/$lte/$between) reach NO published reference page — build-schemas.ts skips their whole schema over an unrepresentable z.date(), and the skip is silent #16431 packages/spec/scripts/**; spec/shared: isValueDomainMember answers a truthy NON-boolean for an off-vocabulary domain that names an Object.prototype member #15315 packages/spec/src/shared/**).

Premise re-verified on origin/main, ⛔ not taken from the card

display-name.ts:320 still reads verbatim:

 * - `explicit`    — an explicit pointer (`nameField`/`displayNameField`) is set.

Positive control on the same file: derived → 8 hits, so the grep fires.

⭐ Triage's loose end, resolved before dispatch

Triage flagged that it could not find the quoted "indistinguishable by construction … are the same bytes" wording on stripProvisionedPrimaryFrom, hitting only packages/services/service-storage/src/stranded-orphan-inventory.ts:45, and asked the 承接者 to locate the symbol rather than the phrase.

⇒ Done: stripProvisionedPrimaryFrom lives in packages/objectql/src/registry.ts on origin/main. Triage searched for the wording; the symbol is here. The dev is instructed to read that docblock's actual text and quote what it really says — ⚠️ the card's quotation may be from cloud's pinned tree (a5eccf92) and may differ from this repo's wording, which is exactly the kind of borrowed phrasing that produced this card in the first place.

Why this card is strong, and what it is not

⭐ Most "a comment misleads people" cards can only say someone might misread this. This one counted: three wrong artifacts in a single day (cloud#2073, a proposed unreachable gate rule, cloud#2089), all traceable to one sentence — and the third came with a negative control, two authored bodies collapsing to byte-identical stored rows plus a third that does not collapse, proving the harness really exercised the strip. ⇒ "The author designated a title" is not persisted anywhere, deliberately is proved, ⛔ not inferred.

⭐ And triage's diagnosis is the sentence to preserve: the correct words already exist in the repo — on the write seam, while the readers who go wrong are reading the grade. ⇒ ⛔ Not "missing documentation": documentation whose location does not intersect its readers' path.

⛔ Fences

• ⛔ Prose only. Do not change the predicate, the grade computation, or any accept set. The card says the predicate is right.
• ⛔ Do not act on the derived-is-dead-code observation. The card raises it and explicitly does not prescribe it ("worth considering alongside, though ⛔ not prescribed here"), and it was measured in cloud, not here.
• ⚠️ The cloud-side replays are not re-runnable from this session and ⛔ must not be restated as this repo's readings. objectstack-ai/cloud is outside this session's scope. Quote them as cloud's, with their pin.
• ⛔ If the fix turns out to require any code change — a new export, a changed signature, an accept-set movement — stop and report. claude-fable-5-1 capacity is exhausted, so a widening diff cannot get the at-tier review the enqueue gate would demand, and 「契约复核 ⛔ 不适用额度耗尽豁免降档」.

---

Correction — 2026-09-08T15:5xZ, by the claiming seat (domain:spec), additive and self-owned.
The Clause-② line above was originally written as - **Clause-②:** **no** — ⛔ the card is explicit that the predicate is *correct* and the grade is *computed correctly*; what is wrong is what readers take it to mean. — the key plus a trailing prose clause on
the same line. node scripts/pm/check-clause2-carriers.mjs --pair 16901 read that as MALFORMED
(exit 4): "carries the key but not one of the two values, so there is no reading … the fixed
spelling is Clause-②: yes or Clause-②: no, exactly those two." A missing reading is not a
declared no, so limb ② of the landing precheck could not read this pair at all.

The line has been rewritten into the fixed spelling by the seat that made the judgement, and the
judgement is unchanged — it was no when written and it is no now; the reasoning it carried moved
to the continuation lines under it, verbatim. ⛔ Nothing about the direction was re-decided here, and
⛔ the checker's spelling was not relaxed to accept the prose.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 16663,
  "status": "done",
  "branch": "claude/issue-16663-explicit-grade-reachability-caveat",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16901",
  "premise_still_valid": true,
  "summary": "Premise re-verified on origin/main eabdd66f4: display-name.ts:320 still reads verbatim (positive control on the same file: 'derived' -> 8 hits). ObjectTitleCompleteness.status now states which INPUT each grade describes: provenance decides the answer; on a body from a /meta read exit 'explicit' means only that a pointer is present (the exit replays materializeServedObjectOnto -> provisionPrimary in designate-only mode) and 'derived' is unreachable except where declinedBaseLayerStamps withheld the designation; on a pre-write body the two still separate; authorship is not recoverable from the served document or the stored row. objectTitleCompleteness carries the one-sentence form. 36 comment lines, 0 deletions in the source file; no predicate, no grade computation, no accept set moved. Triage's loose end resolved by READING rather than borrowing: stripProvisionedPrimaryFrom is packages/objectql/src/registry.ts:2764, and this repo's wording MATCHES the card's quotation (registry.ts:2754-2757); triage's single-line grep missed it only because 'indistinguishable by / construction' is split by a line wrap. Patch changeset on @objectstack/spec, measured not assumed: the new text lands in dist/data/index.d.ts + .d.mts, which packages/spec ships in files[].",
  "tests": "pnpm --filter @objectstack/spec build -> os-verify-lock VERDICT command-exit 0; check-dts-emitted 34/34. pnpm --filter @objectstack/spec check:generated -> exit 0, 'All 15 generated artifacts are up to date' (so this docblock feeds neither content/docs/references/ nor api-surface/; nothing to regenerate). pnpm --filter @objectstack/spec typecheck && test -> VERDICT command-exit 0; 'Test Files 466 passed (466)', 'Tests 13012 passed (13012)'; check:test-typecheck ledger unchanged (54 files / 261 errors / 145 pinned signatures). Targeted file: 'Tests 46 passed (46)' (44 before). Gates exit 0: check:nul-bytes ('scanned 8355 text file(s) ... no raw ASCII control bytes'), check-empty-changeset, check-changeset-no-major, check-changeset-fixed, check-adr-0087-registration, check-closing-keyword-parity, check:comment-mask-adoption, check:comment-mask-corpus (6377 files, 0 disagree), check:test-source-alias, check:cross-package-test-inputs, check:doc-authoring. LINT = DECLARED NARROWING with all three pieces: (1) universe read from eslint's own config -- eslint.config.mjs:327-329 states it never enables type-aware linting for ANY file; (2) count read from --format json: files linted 2, errors 0, warnings 0, at final HEAD 336a2469d; (3) invariance: type-aware linting off, and the diff adds only comment lines plus one test block, changing no import statement -- the only construct the active no-restricted-imports guard reads. The repo-wide sweep stays CI's. dispatch-gates --ran reconciliation: 75 derived, 11 run, 0 NOT-MEASURED, 64 UNRUN -- the 64 are that declared narrowing. ABLATION (behavioural pin, so 'restore the old sentence' would NOT red it -- its real failure mode was demonstrated instead): mutated provisionPrimary's designation 'return { ...objectMeta, nameField: resolved };' -> 'return objectMeta;'; ON-DISK PROOF, not an editor's exit code -- removed-anchor 1->0, injected-anchor 1, blob ba635e0e -> a416adb9; result 'Tests 10 failed | 36 passed (46)' with BOTH new pins failing by name; restore proven by STATE -- git diff HEAD 0 bytes, git status --porcelain empty, worktree blob back to ba635e0ea214ebb1b98422e80298384c4e680580 (identical to the HEAD blob), ablation marker count 0; run under trap ... EXIT INT TERM with an absolute REPO_ROOT path and 'git checkout HEAD -- pathspec'. No dist preflight applies: the test imports ./display-name -- same-package source, not a dist resolution. All exit codes captured before any pipe; every zero-hit grep carries a positive control on the same corpus (control-byte sweep: a file carrying 0x0b fires, a tab-only file does not; dist grep: the pre-existing sentence hits the same two files, a nonsense phrase exits 1).",
  "mcp_calls": "0 -- the whole run used repo-scoped REST (probe returned HTTP 200) plus git; zero MCP GitHub calls, and no dedup search was needed because nothing was filed",
  "open_questions": [
    {
      "question": "Triage criterion 2 and this dispatch conflict on the 'derived' half. Triage ruled it must ship in the same paragraph (its words: the observation should be done together, not merely 'worth considering', and 'do not fix only the explicit line'); the dispatch fenced it as cloud-measured. I took the intersection and flagged it rather than silently picking a side. Is the intersection the right line?",
      "options": [
        "A -- keep it as written: the provenance-framed reachability sentence, measured here via the read-exit chain including the declinedBaseLayerStamps withhold exception, with cloud's call-site dead-code finding excluded and cloud tool names absent from the diff",
        "B -- trim the 'derived' sentence entirely, honouring the dispatch fence literally and leaving triage criterion 2 unmet",
        "C -- widen to cloud's call-site claim (verify_build / apply_edit); rejected here, since it is not measurable from this repo and platform-tool-names.ts classifies those as cloud service-ai-studio tools"
      ],
      "recommendation": "A -- the fence's stated ground is a mechanism claim ('it was measured in cloud, not here'), and that mechanism IS measurable here; every sentence written was measured on this tree and no cloud reading is restated. B is a one-line trim if the reviewer reads the fence strictly, and nothing else depends on that sentence."
    },
    {
      "question": "Triage criterion 5 asks the landing seat to reply on objectstack-ai/cloud#2089 so the two sides do not each assume the other is handling it. objectstack-ai/cloud is outside this session's scope, so I did not do it.",
      "options": [
        "A -- PM or a cloud seat posts the cross-repo reply on cloud#2089 once this PR merges",
        "B -- dispatch a follow-up seat with cloud in scope",
        "C -- leave it; rejected, because that is exactly the failure triage named"
      ],
      "recommendation": "A -- it is one comment, and it is owed only after this lands."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: the module docblock at display-name.ts:3-27 lists objectTitleCompleteness as a completeness classifier and makes no authorship claim, so it needed no correction. Carrier: this PR's reviewer.",
    "noted, not filed: this repo's only grade consumer, packages/lint/src/validate-record-title.ts:95, reads ONLY status === 'none', so it was never exposed to the 'explicit' misreading; its input is the authored config (os build / os lint), the pre-write side. Carrier: this PR's reviewer.",
    "noted, not filed: triage's grep miss is a line-wrap artifact (registry.ts:2754 ends 'indistinguishable by', :2755 begins 'construction'), not a wording drift -- recorded in the PR body so the next reader does not re-derive it. Carrier: none."
  ]
}

---

Generated by Claude Code