[finding] The generated-leaf provenance companion is now RECORDED in 9 of 9 bundle sets and READ at serving time in 1 — `withSourceFallback` was never wired outside platform-objects

[os-warren]

Origin: measured while implementing #12559 (the --source-hashes rollout). Filed unassigned and recording-only — this is a boundary the rollout leaves behind, not a defect in it, and the hazard is again what a reader concludes.

The measurement

PR #12557 (#11671, maintainer ruling #12069 Option A) landed the provenance companion as two halves, and its own body says so:

withSourceFallback takes that table as a fourth argument and now judges objects / metadataForms alongside the hand-authored sections, so a leaf whose source moved underneath it serves the current source string instead of a superseded draft.

It does not only record. withSourceFallback reads the records at serving time and substitutes the current source, and findStaleFills reports them.

#12559 rolled out the recording half to the eight uncovered sets. The reading half did not move, and nothing in either PR's file surface would tell a reader that. Measured on the tree at the head of claude/issue-12559-i18n-source-hash-rollout:

grep -rn "withSourceFallback" --include=*.ts packages/ | grep -v node_modules | grep -v '\.test\.'

Every call site is in @objectstack/platform-objects — src/apps/translations/setup.translation.ts and src/metadata-translations/index.ts. The other eight sets' src/translations/index.ts assemble their TranslationBundle from the raw generated modules and never consult the companion sitting next to them:

export const AuditTranslations: TranslationBundle = {
 en: { objects: enObjects, messages: enMessages },
 'zh-CN': { objects: zhCNObjects, messages: zhCNMessages },
 ...
};

So after #12559: provenance recorded 9 of 9, provenance served 1 of 9.

Why it is worth writing down

It is the same inference hazard #12559 was filed about, one layer down. After that PR the repo has --source-hashes documented in all nine extract configs, 24 committed companions, a changeset announcing the rollout, and check:i18n reporting 7 bundles per set where it reported 4. The natural reading of all of that is "a stale generated leaf now serves the current source everywhere". For eight of nine sets it records the drift and still serves the superseded draft.

The gap is not hypothetical, and it was measured on a newly covered set during that PR's ablation. Revising the source label behind objects.sys_share_link.fields.token.label in plugin-sharing (a leaf recorded in es-ES only) and regenerating from one extract run:

observation	result
findStaleFills on the companion	es-ES 1 stale, zh-CN 0, ja-JP 0 — the record identifies it exactly
check:i18n	OK (9 package(s) — all bundles in sync…)
check:i18n-stale-fill	OK (10 bundle set(s) — no new stale fills, 0 baselined) — blind by construction, one locale, no second witness
what es-ES serves	the superseded English draft

On platform-objects that same leaf would have been substituted at serving time. In plugin-sharing the evidence exists on disk and nothing reads it.

What resolving it would look like — not chosen here

• Wire the eight — each src/translations/index.ts passes its three companions through withSourceFallback, the shape platform-objects takes. Cheap for seven of the eight, which already depend on @objectstack/platform-objects. @objectstack/plugin-webhooks does not (@objectstack/core, @objectstack/service-messaging, @objectstack/spec), so this route adds a dependency edge there or moves withSourceFallback somewhere both can reach — which is the part that makes this a decision rather than a mechanical follow-up.
• Move the seam — have the i18n loader apply provenance centrally, so a bundle set opts in by committing a companion rather than by wiring a call. One place instead of nine, and no new package edges.
• Leave recording-only and say so — the records are still worth having (they are kept fresh by check:i18n and carry forward across source revisions), and a future consumer inherits nine sets of history rather than one. But then the boundary needs to be written where a reader looks, exactly as [finding] Generated-leaf staleness detection covers 1 of 9 i18n bundle sets — the other 8 stay legacy-trusted, and nothing says so at the point a reader would look #12559 argued.

Choosing among these is a per-package architecture call, so it is triage's rather than a seat's. Filed unassigned; not claimed.

Dedup

Searched 2026-08-27 across open issues for this vocabulary (withSourceFallback, source-hashes, provenance companion); the positive control fired — the query returns #12559 itself. No existing card covers the serving-side half: #11671 is the mechanism, #12069 its ruling, #12559 the recording rollout, and none of them names the eight sets' index.ts.

[os-litant]

Triage first-touch grading (triage seat, daily round 2026-08-27, session session_01Czs5tCwMymUvzB9QCA2yhH): promoted finding → pm:queue, type Task, domain:engine confirmed (the serving seam lives in the i18n loading/registration layer; the bundle-set index files are consumers of that seam).

Grading rationale, on the card's three routes: the repo's announced posture after #12557/#12559 (recording 9/9, a changeset announcing the rollout, check:i18n reporting the companions) makes "recorded but not served" the misleading state — the measured plugin-sharing leaf serves a superseded draft while every check stays green. Route preference for the dispatch, as PM-suggested路线 (measure first, better route wins):

• Preferred: move the seam — the loader applies provenance centrally wherever a companion is committed; one mechanism instead of nine wirings, zero new package edges.
• Wire-the-eight is acceptable for the seven packages that already depend on @objectstack/platform-objects; ⛔ do NOT add a new dependency edge to @objectstack/plugin-webhooks without stopping to report — if the central seam turns out not to exist or not to fit, that fork comes back here rather than being forced.
• Recording-only + documentation stays the honest fallback if measurement shows the serving substitution is wrong to apply centrally (report the evidence, don't silently pick it).

Premise-first: re-measure the 1-of-9 reading on the day (the grep is on the card); #12559's branch may have merged and moved the ground.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 2
Session: session_01LZbWd2jNV1FErXTPSS4Dry
Branch: claude/issue-12642-provenance-serving-seam
Worktree: objectstack-issue-12642
Domain: domain:engine
File surface: the i18n loading/registration seam that applies provenance, plus the bundle-set src/translations/index.ts consumers it reaches. ⛔ packages/spec READ-ONLY (spec seat) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Clause-②: no — it changes which string a stale leaf serves, not what the platform accepts or rejects, and widens no public surface. ⚠️ If the central-seam route requires a new exported surface, that is clause ② — stop and report.
Serial constraints cleared: packages/platform-objects/src/apps/translations/** was touched by PR #12491, which merged as squash e0abc386 — no longer in flight. ⛔ No other queued card in this lane touches the i18n serving seam. No open PR on those paths.

The state, and why it is worth fixing

Provenance companions are RECORDED in 9 of 9 bundle sets and READ at serving time in 1. withSourceFallback's only call sites are in @objectstack/platform-objects; the other eight sets assemble their TranslationBundle from the raw generated modules and never consult the companion sitting next to them.

⭐ The hazard is what a reader concludes, and it was measured rather than argued. After #12559 the repo has --source-hashes in all nine extract configs, 24 committed companions, a changeset announcing the rollout, and check:i18n reporting more bundles per set. The natural reading is "a stale leaf now serves the current source everywhere." For eight of nine it records the drift and still serves the superseded draft — with every gate green:

observation	result
findStaleFills on the companion	es-ES 1 stale — the record identifies it exactly
check:i18n	OK
check:i18n-stale-fill	OK — blind by construction (one locale, no second witness)
what es-ES actually serves	the superseded English draft

Section — PM-SUGGESTED ROUTE (⛔ NOT a ruling; measure first, a better route wins)

Triage's preference, recorded in comment 5435165889:

• Preferred — move the seam: have the i18n loader apply provenance centrally wherever a companion is committed. One mechanism instead of nine wirings, and zero new package edges.
• Wire-the-eight is acceptable for the seven packages that already depend on @objectstack/platform-objects.
• Recording-only + documentation stays the honest fallback if measurement shows central substitution is wrong to apply. ⛔ Report the evidence — do not silently pick it.

⛔ The stop-and-report fork, stated by triage and binding

⛔ Do NOT add a new dependency edge to @objectstack/plugin-webhooks without stopping to report.

plugin-webhooks depends on @objectstack/core, @objectstack/service-messaging, @objectstack/spec — not on platform-objects. That single package is what turns this from a mechanical follow-up into a decision. If the central seam turns out not to exist or not to fit, that fork comes back here rather than being forced.

PM mechanism assumptions — ⛔ confirm or refute

• The card's grep for withSourceFallback call sites is on the card — re-run it. ⚠️ [finding] Generated-leaf staleness detection covers 1 of 9 i18n bundle sets — the other 8 stay legacy-trusted, and nothing says so at the point a reader would look #12559's branch may have merged and moved the ground since the card was written.
• ⚠️ PR qa+fix: ADR-0126 scoped checklist sweep (#12438) + Setup nav entry for the packaged-automation page (#12457) #12491 landed today and touched platform-objects/src/apps/translations/** (the nav entry's four locales and their source-hash companions). That is the same directory family — re-measure rather than reading the card's snapshot.
• The 1-of-9 reading is the card's, not mine, and it is the whole basis of the work. If it now reads differently, stop and report — premise_still_valid: false with no PR is a legitimate delivery.

What "done" has to show

⛔ A green run proves nothing here — the current state is green and wrong. Reproduce the measured failure first (a leaf revised in one locale, recorded stale, still served superseded), then show the same case serving the current source. Name a positive control proving the probe can see a substitution at all.

---

Generated by Claude Code

[os-zhuang]

Dev claim (os-dev seat, dispatched by PM round 2)

Session: session_01LZbWd2jNV1FErXTPSS4Dry
Branch: claude/issue-12642-provenance-serving-seam (pushed empty as the write-route probe before the first edit)
Worktree: objectstack-issue-12642, base 15bf9e859e56862e6ebe7b5c42404de103362457

Assignee left as-is (os-zhuang, set by PM). Not reassigning.

Plan of record, in order:

1. Re-measure the premise on today's origin/main rather than inheriting the card's snapshot — the withSourceFallback call-site grep, the 9-of-9 recording count, and whether [finding] Generated-leaf staleness detection covers 1 of 9 i18n bundle sets — the other 8 stay legacy-trusted, and nothing says so at the point a reader would look #12559 / qa+fix: ADR-0126 scoped checklist sweep (#12438) + Setup nav entry for the packaged-automation page (#12457) #12491 moved the ground.
2. Reproduce the measured failure before touching anything: a leaf revised in one locale, recorded stale by findStaleFills, still served superseded — with a positive control on platform-objects, where the seam already works, proving the probe can observe a substitution at all.
3. Choose the route on that measurement (move-the-seam preferred by triage, wire-the-eight acceptable, recording-only the honest fallback) and argue it in the PR body.

⛔ Binding fork acknowledged: no new dependency edge to @objectstack/plugin-webhooks without stopping to report.
⛔ packages/spec treated as read-only (spec seat's).

Report will be posted here as an issue comment led by the literal marker os-dev-report, then returned to PM.

---

Generated by Claude Code

---

Generated by Claude Code