docs(service-messaging): re-anchor the dead tracker citations to the commits that decided them

[objectstack-fleet]

Part of #20596
Clause-②: no

What changed

This is the first stage of the domain:services lane of the dead-citation sweep. It covers packages/services/service-messaging/src/** and nothing else, the largest package in the lane that no open PR or in-flight claim holds (the claim, 5884863234, gives the order). Later stages cover the other packages, so this PR says Part of and the card stays open.

Every comment or docblock site in scope that cited a tracker number answering 404 has been rewritten in ruling C+D's form C (comment 5749154545 on #19123), the way the landed packages/spec/src stages apply it (PR #20533 is the method). That is 127 sites on 109 lines in 28 files, covering 14 numbers: the 97 census sites outside the generated headers, and 30 sites in test comments, which the census defers. Each rewritten line now cites the commit in origin/main history that decided what the line describes, and it says in its own words what that commit decided.

No ADR or ruling-record file in docs/adr/ or scripts/adr-anchors/ records the decision behind any of the 14 numbers, so every anchor is a commit: 13 distinct shas. No number was dropped.

Only comments changed. Every touched source file keeps its line count (116 lines out, 116 in, over 28 files), so no line citation into these files moves. Seven of those 116 lines held no dead citation: they are the other half of a sentence that had to be reflowed (inbox-caller.ts:87, :88, messaging-service.test.ts:972, notification-keyed-text-bounds.test.ts:83, notification-subscription.object.ts:81, :82), or a pointer that lost its referent (sql-outbox.ts:281, 「the race the card describes」 to 「the race that commit describes」, because line 278 now names the commit). No code token moves (see the guard below).

No citation number is added. Every tracker number on an added line was already on the line it replaces (added-minus-removed over the whole diff: 0). No PR number stands on an added line.

Fifteen dead sites are left on purpose: 12 string literals and 3 generated file headers (see the list below).

One more file: a patch changeset for @objectstack/service-messaging, because the rewritten docblocks ship (see Changeset below).

Census: service-messaging, before and after

Instrument (A1). The gate's own node scripts/check-issue-citations.mjs --census --json, read-only, unchanged. Its surface is comment prose in packages/**/src/**/*.ts with string literals blanked, and it defers *.test.ts. The count below is its allocated-but-absent findings under packages/services/service-messaging/.

reading	tree	board	whole-repo allocated-but-absent	service-messaging sites	lines	files	numbers
before	base 7a1faf1a5, run 2026-09-29T06:31:54Z to 06:35:25Z	enumerated, 185 pages, frontier #20606, 18,433 numbers	2,457	100	82	22	13
after	head 685200760, run 06:48:33Z to 06:52:17Z	enumerated, 185 pages, frontier #20606, 18,433 numbers	2,360	3	3	3	1

The before count matches the 100 that census 5884031174 read at f11b5f20. The whole-repo drop is 97, exactly this diff's census sites, and the resolves tally is 32,744 in both runs. The 3 left are the generated headers below. 267c11562, the final head, adds only the changeset, which is outside the census surface.

Supplementary instrument, the whole scope. The census does not read test files or strings, and this stage's scope includes both. So a second reading runs the gate's own exported extractCitations (whole-file and comment-prose projections) and classifyCitation over every .ts file under service-messaging/src (87 files), against the same enumerated board.

reading	citations	dead	src comment	test comment	src string	test string
before, 7a1faf1a5	613	142	100	30	3	9
after, 685200760	486	15	3	0	3	9

Its src-comment column equals the census's 100, which is the control on the second instrument. The 450 resolving citations and 21 pull-request citations are the same in both readings.

Per-number table

Sites and files are all dead sites in scope at the base (comments and strings, tests included). rewritten / left counts comment sites rewritten and sites left. Every anchor was read in its diff or message, not only in its subject: it is the commit that made the change the line describes, and its own diff or message names the number it replaces.

number	sites / files	rewritten / left	anchor: what it decided
#6206	1/1	1/0	8e13ca876: the share-link routes pass the whole authz envelope into enforcement instead of a four-field trim. The line lists it as one member of the defect family behind assembleExecutionContext
#6363	14/2	13/1	17d095413: listInbox's unreadCount counts the total unread, not the fetched window (maintainer ruling 2026-08-07, Option A: make the declaration true); it adds countUnreadTotal. The same anchor the spec stages gave this number
#9722	1/1	1/0	2074b2651: corrects the sys_notification_subscription index note — role: and team: resolve against sys_member and sys_team_member
#9807	4/3	4/0	44738f7af: marks the subscription-to-recipient expansion NOT WIRED and aligns principal with the forms RecipientResolver.resolveOne() accepts, email kept verbatim
#11374	17/6	16/1	route A of the maintainer's 2026-08-24 ruling: a keyed text column declares a maxLength sourced from its producer. Written as 「route A, ruling 2026-08-24」 beside e4902d2b9, the commit that applied it here. scripts/check-keyed-text-bounds.mjs's header states route A in words
#11452	6/3	5/1	3b5f0360c: the plugin-facing listInboxAsCaller, scoped to the authenticated caller
#11453	26/13	23/3	1a47a5368: ack() refuses a row that is not in_flight (NotificationAckError, DELIVERY_NOT_ELIGIBLE), as a compare-and-set in the SQL outbox. The same anchor stage 2 gave it
#11671	4/4	1/3	09b4f4e4e: os i18n extract --source-hashes writes the per-locale provenance companion (maintainer ruling #12069 Option A, which stays cited)
#11741	6/2	5/1	b706af987: SendEmailInput gains organizationId, and the email channel threads it on both arms. The same anchor stage 1 gave it
#11859	29/13	27/2	d9cf78eaa: ack() takes the claimed record back and binds its claim credential in the compare-and-set. The same anchor stage 2 gave it
#12144	2/2	2/0	3a04b0125: identifier ceilings are storage-owned (sys_metadata.name is 255)
#12147	1/1	1/0	945e91a13: the class-level check-keyed-text-bounds gate
#12978	17/6	16/1	e4902d2b9: declares the sourced maxLength on all 15 keyed text columns of the sys_notification_* objects. No commit message names the card; its diff is where every [#12978] marker entered the tree
#18424	14/4	12/2	879b51270: an email or SMS channel with no transport refuses with transport_not_configured instead of reporting success

Every cited sha matches exactly one commit (git rev-parse --disambiguate, count 1 for each), and every one is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 13). The history was unshallowed first (git fetch --unshallow, 15,062 commits), so no anchor was read from a truncated log.

Wordings to check, each true of its commit:

• inbox-caller.ts:86-88: 「(两处手写的 ExecutionContext 组装已漂移:REST 传输不带 principalKind / onBehalfOf,而 explain / security 会读它 #6071, dispatcher 面的 /share-links 把已解析完整的 ExecutionContext 重新裁成两个字段再喂给 enforcement —— 与 #6206 同一条 enforcement 路径的另一张脸 #6551, and the share-link envelope trim commit 8e13ca8 undid)」. 8e13ca876's message records the trim (four fields kept, five dropped) and the whole-envelope fix.
• outbox.ts:72: 「the option-A shape commit d9cf78e's ruling refused」. d9cf78eaa's message: 「The caller never supplies an identity: ownership is proven by round-tripping what claim() returned.」
• The fifteen sys_notification_* bound comments: [commit e4902d2b9] ... (route A, ruling 2026-08-24). e4902d2b9's message opens 「Every bound names its producer in the declaration」, and 3954fb7df's records the ruling's date and its A and C routes.
• notification-keyed-text-bounds.test.ts:82-83: the #9807 pointer becomes 「Every other arm of the grammar commit 44738f7 documented is narrower」, because 44738f7af is where the email arm of the selector grammar was written down.
• outbox-ack-claim-ownership.integration.test.ts:40: 「the INotificationOutbox has no cancellation, and ack() on an unclaimed pending row silently succeeds in both implementations #11453 file beside this one」 names the file itself, outbox-ack-precondition.integration.test.ts.

The 15 sites left

• Non-test strings (3 sites, 2 lines), refusal text. outbox.ts:187 (「see INotificationOutbox has no cancellation, and ack() on an unclaimed pending row silently succeeds in both implementations #11453」) and outbox.ts:210 (「(INotificationOutbox has no cancellation, and ack() on an unclaimed pending row silently succeeds in both implementations #11453, INotificationOutbox.ack() carries no nodeId, so its compare-and-set can prove a claim exists but not whose #11859)」) are inside notificationAckNotClaimedMessage and notificationAckLostClaimMessage, the messages NotificationAckError carries. They are runtime strings, so they are form D, not form C. The landed packages/spec/src: 1,277 comment lines still cite 170 deleted tracker numbers (1,295 sites) — the staged remainder of ruling C+D on #19123, measured by PR #20226 #20234 stages left every string site as a token and rewrote no refusal text, so these are left and listed, as PR docs(spec): re-anchor the dead tracker citations in data/ to the commits that decided them (stage 3) #20533 did. The form D stages that did rewrite strings (os migrate meta prints tracker numbers to the author: ADR-0087 migration entries' reason / replacement / acceptanceCriteria text carries ~2,060 of them, 178 dead, which AGENTS.md's runtime-string rule forbids #20233's) cover os migrate meta guidance, a different class.
• Test titles (9 sites, 8 lines). describe titles in email-channel.test.ts:90, :592, messaging-service.test.ts:809, :1286, notification-keyed-text-bounds.test.ts:38 (2 numbers), outbox-ack-claim-ownership.integration.test.ts:109, outbox-ack-precondition.integration.test.ts:110 and sms-channel.test.ts:90. Tokens, left as they were.
• Generated headers (3 sites). Line 8 of es-ES, ja-JP and zh-CN .source-hashes.generated.ts reads 「([finding] check:i18n verifies key presence, not that an untranslated leaf still matches the source string it was filled from — and the drift is sticky #11671, maintainer ruling [Decision] 把 #8765 的 source-hash sidecar 扩展到生成的 i18n bundle —— #9672 写明的升级条件已满足 #12069 Option A, extending i18n: a source-string edit still leaves zh-CN / ja-JP / es-ES silently stale — and pinning en to the source makes the asymmetry sharper, not smaller (needs a maintainer decision) #8765 Option B)」. os i18n extract writes that line from packages/cli/src/utils/i18n-extract.ts:2294, and 27 generated files across the repo carry it. A hand edit here would be undone by the next extract, so the fix belongs at the producer in a later stage, which regenerates every copy. The hand-written translations/index.ts:29 is rewritten here.

Mechanical guard: no code token moves

The check compares leaf tokens with comments stripped, base 7a1faf1a5 against head. It uses the TypeScript parser's leaf nodes, so template literals are read in context, and it excludes JSDoc nodes. It ran over all 28 touched .ts files.

• Real run: 52,337 base tokens, 0 files with a token change (exit 0).
• Comment-insertion control, in outbox.ts: 0 files changed, as expected (exit 0).
• Positive control, a declaration inserted into outbox.ts: DIFFER (exit 1). The first attempt was a no-op: its anchor text was still inside the replacement, so scripts/ablation-replace.mjs refused it before the guard ran. It was redone with a hitting anchor.
• Positive control, one digit changed inside the kept outbox.ts:210 refusal string: DIFFER (exit 1).

Every mutation went through scripts/ablation-replace.mjs, and each restore was proven byte-identical to the HEAD blob (80618f8711e2) with git diff HEAD empty.

Changeset

This change ships bytes, so a patch changeset for @objectstack/service-messaging is included. It says only that the provenance comments were re-anchored.

Measured on the built package (A3): files[] is dist, README.md and CHANGELOG.md. After pnpm --filter @objectstack/service-messaging build, the rewritten comments reach both halves of dist. d9cf78eaa appears 8 times in dist/index.d.ts, 1a47a5368 6 times and 17d095413 6 times, and e4902d2b9 appears 15 times in dist/index.js. The positive control, an unchanged notification-subscription.object.ts docblock sentence, appears in dist/index.d.ts, and a negative control phrase appears nowhere. The only dead numbers left in dist are the two kept refusal strings.

Gates (head 267c11562)

• Citation judging, as CI runs it: pnpm check:issue-citations (self-test, 114 cases in 8 batteries) exits 0, and node scripts/check-issue-citations.mjs exits 0. The diff-scoped run judged 5 citations across 19 files, and all 5 resolve.
• Doc authoring: pnpm check:doc-authoring exits 0.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 267c11562 derived 64 families. They include all 50 derived at dispatch, plus 14 more. All 64 exit 0. --ran reports 64 run, 0 NOT MEASURED, 0 unrun, and exits 0.
  • Three gates first exited 3 (PREREQUISITE NOT MET) because the workspace was unbuilt: check:dual-build-cjs-loads, check:i18n and check:type-check-debt. A full turbo run build of ./packages/* and ./packages/*/* then ran under the shared verify lock (71 tasks, exit 0). The first two exited 0 on their rerun.
  • check:type-check-debt exited 3 once more: outbox.ts's mtime had moved during the guard controls, although its bytes had not, so turbo's cache hit left dist older than the source. A direct pnpm --filter @objectstack/service-messaging build then let it exit 0 (4 ledger entries re-measured, none above its number).
• Tests and typecheck:
  • pnpm --filter @objectstack/service-messaging test: 46 files and 507 tests pass, covering every touched test file.
  • pnpm --filter @objectstack/service-messaging typecheck exits 0. Its tsc program lists all 46 test files and 87 files under src/ in total (--listFiles).
• Lint, as a proven narrowing: eslint --no-inline-config --format json over the 28 touched .ts files gives 28 files, 0 errors and 0 warnings. All 28 are in eslint's own population (isPathIgnored is false for each). eslint.config.mjs never enables type-aware linting (no parserOptions.project, as its own line 328 states), so a comment edit here cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's run.
• Control bytes: pnpm check:nul-bytes exits 0, and a raw scan of the 28 files for control bytes finds none.

Acceptance notes

• The census instrument returned a truncated board once, at exit 0. The first --census --json run of this stage (06:25:55Z, base 7a1faf1a5) read enumerated (85 pages), frontier fix(runtime,mcp,service-datasource): the #6504 consumer sweep — three list consumers stop claiming what a known-partial read cannot support #8854, 8,444 numbers, when the newest number was above [finding] nextUtcCalendarDay('9999-12-31') answers '10000-01-01', so on SQLite a datetime $lte '9999-12-31' or a $between maximum on that day answers no rows #20600. The Link header of its 85th page had carried no rel="next", so enumerateBoard stopped and classified 16,187 citations as never-issued. A reader counting only allocated-but-absent, as this stage's count does, would have got 8 service-messaging sites instead of 100, silently. The next four enumerations in this session read 185 pages and frontier docs(spec): re-anchor the dead tracker citations in the packages/spec/src remainder to the commits and ADRs that decided them (stage 6) #20606, and the counts above come from those. Nothing in enumerateBoard compares its frontier with the newest issue number, which probeBoard does read. Reported to the seat, not changed here: this stage makes no instrument change.
• What stays for later stages.
  • The 3 generated #11671 headers, whose producer is packages/cli/src/utils/i18n-extract.ts:2294. That line is the repo-wide carrier (27 generated files).
  • The 3 refusal-string sites in outbox.ts (form D) and the 9 test-title sites.
• Base. The branch is 9 commits behind origin/main (0f6dcac5e, read at 07:23Z). One of them, 8c87d26a5 (the version packages release), touches service-messaging, but only its CHANGELOG.md and package.json, and neither is in this diff. So there was no merge.
• Anchors shared with the spec stages. 17d095413 (notification 响应侧:unreadCount 声明「总未读数」实测只数 limit 窗口内;响应 cursor 从无 producer 发出 #6363), 1a47a5368 (INotificationOutbox has no cancellation, and ack() on an unclaimed pending row silently succeeds in both implementations #11453), d9cf78eaa (INotificationOutbox.ack() carries no nodeId, so its compare-and-set can prove a claim exists but not whose #11859) and b706af987 (Widen SendEmailInput with organizationId so sys_email can be stamped at its producers (Decision 2 of #11303) #11741) are the anchors stages 1 and 2 already gave the same numbers in packages/spec/src, so each number carries one anchor across the tree.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-messaging, touching 20 documentable anchor(s). ⚠️ 4 changed file(s) yielded no anchor (packages/services/service-messaging/src/inbox-caller.ts, packages/services/service-messaging/src/index.ts, packages/services/service-messaging/src/outbox-dispatcher-scope.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

8 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/environment-routing.mdx (via HttpDispatcher (symbol, a top-level class))
• content/docs/automation/email-templates.mdx (via sendTemplate (symbol, a method of interface EmailSenderSurface))
• content/docs/automation/webhooks.mdx (via HttpDispatcher (symbol, a top-level class), in_flight (literal, a string literal in a comment in INotificationOutbox))
• content/docs/kernel/cluster.mdx (via HttpDispatcher (symbol, a top-level class))
• content/docs/kernel/index.mdx (via sendTemplate (symbol, a method of interface EmailSenderSurface))
• content/docs/kernel/runtime-services/email-service.mdx (via sendTemplate (symbol, a method of interface EmailSenderSurface))
• content/docs/kernel/services-checklist.mdx (via listInbox (symbol, a method of class MessagingService))
• content/docs/plugins/packages.mdx (via HttpDispatcher (symbol, a top-level class))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-2.mdx (via IHttpOutbox (symbol, a top-level interface), MessagingService (symbol, a top-level class), SqlHttpOutbox (symbol, a top-level class))
• content/docs/releases/v17/17-3.mdx (via INotificationOutbox (symbol, a top-level interface))
• content/docs/releases/v17/17-5.mdx (via HttpDispatcher (symbol, a top-level class), NotificationDispatcher (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 4 changed file(s) yielded no anchor (packages/services/service-messaging/src/inbox-caller.ts, packages/services/service-messaging/src/index.ts, packages/services/service-messaging/src/outbox-dispatcher-scope.ts, …) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 04c984fb2537e95b691fb3c64403f7a96a619235 — the merge of head 267c1156211c9351d9963594808cf6db1f675d14 into base 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 04c984fb2537e95b691fb3c64403f7a96a619235 && git checkout 04c984fb2537e95b691fb3c64403f7a96a619235
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f 267c1156211c9351d9963594808cf6db1f675d14 && git checkout -B drift-repro 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f && git merge --no-ff 267c1156211c9351d9963594808cf6db1f675d14

node scripts/docs-audit/affected-docs.mjs --json 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 267c1156211c9351d9963594808cf6db1f675d14
Local-runs: none

Reviewed for card #20596 (stage service-messaging) against the ruling it cites, C+D (comment 5749154545 on #19123). Inputs: the card body and its three comments, the PR body, its file list and the net diff against main at the head, and the head's check-runs. The head equals the PR object's head.sha; the head repo is the base repo; 29 files, +126 / −116; no governed surface in the file list. Reads only — git diff, git show, git grep, git merge-base against the shared object store, and REST GETs. Nothing built, run or re-run.

① Derived judgments

Accept set: unchanged — right. Every one of the 232 changed lines in the 28 .ts files (116 out, 116 in) opens with a comment marker (*, //, /**); the only non-comment added lines in the whole diff are the changeset's ten. index.ts's two changed lines are comments inside the export type block. No export, type, schema, refusal text or runtime token moves. Per-file line counts are preserved (--stat reads 116/116), so no line citation into these files moves. The dev's leaf-token guard (0 files changed) agrees with this reading and was not re-run.

Citations: 0 added — right. The #N tokens on added lines (#6071, #6551, #10753, #11009 twice, #12069, #17634, #18567) each stand on the removed line they replace, so added minus removed is 0 for every number, and no PR number stands on an added line. The 14 dead numbers count 142 tokens under service-messaging/src at base 7a1faf1a5 and 15 at the head: 127 removed, the PR's 127 sites.

13 anchors — each right. Every sha resolves to exactly one commit (rev-parse --disambiguate, count 1) and every one is an ancestor of the base (merge-base --is-ancestor, 13 of 13). Each commit's message and file stat were read against the line it now anchors:

• 8e13ca876 — share-link enforcement takes the whole authz envelope, undoing the four-field trim (同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206 in its subject); inbox-caller.ts names it as exactly that.
• 17d095413 — listInbox counts the total unread (maintainer ruling 2026-08-07, Option A), adding countUnreadTotal; the messaging-service lines say so.
• 2074b2651 — corrects the sys_notification_subscription index note to sys_member / sys_team_member (Fixes finding: sys_notification_subscription's index comment says role:/team: resolve against sys_permission_set/sys_position; RecipientResolver reads sys_member/sys_team_member #9722).
• 44738f7af — marks the subscription expansion NOT WIRED and rewrites principal's grammar; its diff is where the owner_of and email arms entered the description, so "the grammar commit 44738f7 documented" is true.
• e4902d2b9 — declares the sourced maxLength on the 15 keyed columns; its message never names service-messaging: 15 keyed text columns declare no maxLength — five sys_notification_* objects land registered-but-broken on MySQL #12978 but its diff carries the marker 37 times, the entry point for every [#12978] rewritten here.
• 3b5f0360c — listInboxAsCaller scoped to the authenticated caller (Part of MessagingService.listInbox has the same free-userId shape markRead just lost — any in-process plugin can read any user's inbox #11452).
• 1a47a5368 — ack() refuses a row that is not in_flight, as a compare-and-set in the SQL outbox (INotificationOutbox has no cancellation, and ack() on an unclaimed pending row silently succeeds in both implementations #11453).
• 09b4f4e4e — os i18n extract --source-hashes and the provenance companion; its diff writes the #11671 header line the generated files carry.
• b706af987 — SendEmailInput.organizationId, threaded on both email-channel arms (Fixes Widen SendEmailInput with organizationId so sys_email can be stamped at its producers (Decision 2 of #11303) #11741).
• d9cf78eaa — the claim credential joins ack()'s compare-and-set; "the caller never supplies an identity", which is the option-A shape outbox.ts:72 says it refused.
• 3a04b0125 — identifier ceilings are storage-owned, sys_metadata.name at 255 (The shared identifier schemas declare no maximum length, so every cap on an identifier is a storage accident rather than a contract #12144).
• 945e91a13 — the class-level check-keyed-text-bounds gate; Class-level keyed-text-bounds coverage needs a source-scanning gate — lifting the platform-objects pin is blocked by dependency direction (measured on #12059) #12147 is in its diff (the workflow step's name).
• 879b51270 — a channel with no transport refuses with transport_not_configured (Fixes [finding] email/sms channel send() answers { ok: true } when its transport is NOT installed — a delivery recorded as SUCCESS with nothing sent, while the same object's isAvailable() correctly says transport_not_configured #18424).

Ruling C's order, ADR or ruling record first — the commit rung is right. git grep of the 14 numbers over docs/adr/** and scripts/adr-anchors/** at origin/main hits one line, ADR-0131 line 474, which cites #11741 as a writer fact ("#11741 widened SendEmailInput") and does not decide it; so b706af987 is the correct rung, and no ADR records the other 13 decisions. The [commit 9-hex] spelling is the one packages/spec/src already carries on main (for example [commit d2619fd0c]).

The #11374 rewrite — right, with a note. "(route A, ruling 2026-08-24)" beside [commit e4902d2b9] leaves no tracker number; the in-repo record of that ruling is the header of scripts/check-keyed-text-bounds.mjs (lines 25 to 26, "route A, the maintainer's 2026-08-24 ruling") and commit 3954fb7df's message. A stricter spelling would have named 3954fb7df beside the date; a note, not a defect.

Seven reflow / referent lines — right. All comment lines; each hunk keeps its count. sql-outbox.ts:281 now reads "the race that commit describes", and 1a47a5368's message does describe the ack-versus-claim race it replaced the card pointer with.

Fifteen sites left — right to leave. Verified at the head: outbox.ts:187 and :210, three tokens inside the two NotificationAckError refusal messages — runtime strings, form D, outside the claim's comment-prose surface, and already ledgered in scripts/doc-authoring-prose-id.baseline.json under outbox.ts (#11453 twice, #11859 once); nine describe titles on eight lines (string literals); and line 8 of the three *.source-hashes.generated.ts headers, whose producer is packages/cli/src/utils/i18n-extract.ts:2294 on origin/main — a hand edit would be undone by the next os i18n extract.

② Semver level

patch for @objectstack/service-messaging — right; skip-changeset would have been wrong. The package publishes (publishConfig.access: public; files is dist, README.md, CHANGELOG.md). The rewritten JSDoc sits on exported declarations — ClaimedDeliveryRecord, NotificationAckError, INotificationOutbox.ack and reap, MessagingService.listInbox, the sys_notification_* object literals — and tsup.config.ts emits dts, so dist/index.d.ts changes bytes and the tarball differs. The dev's dist/index.js counts are its own measurement, not re-run here; this verdict rests on the .d.ts half. Same treatment the landed spec stages received (.changeset/spec-remainder-provenance-anchors.md, patch).

Clause-②: no — right. PR body line 2 carries it; no key, code or accept-set movement, so no arm and no ADR-0087 marker is owed. The changeset names one package, carries no tracker number and no model identifier, and states the change is comments only. Check Changeset on the head: success.

Nit, not verdict-bearing. The file is service-messaging-provenance-anchors.md where the dispatch runbook asks for an issue-number-then-slug name. No gate enforces it, the name is descriptive rather than a random word pair, and the landed spec stages used the same unnumbered shape.

③ Boundary flags

os-dev-report (comment 5885673193): five deviations, three out_of_scope_findings, no open_questions.

• D1 — 30 test-comment sites included. Within the claim's surface, comment and docblock prose under src/**, where the test files live; counted by the supplementary instrument since the census defers tests. Answered: right.
• D2 — seven lines without a dead site reflowed. Verified in ①. Answered: right.
• D3 — five census enumerations, one truncated run discarded. A reading discipline, not a diff matter; the before-count used (100) equals the card's census. Answered: accepted.
• D4 — a direct rebuild for check:type-check-debt. Local build state only; outbox.ts at the head is blob 80618f871, the one the diff's index line names. Answered: accepted.
• D5 — no labels added. The PR's labels (documentation, size/m, tests, tooling) are the labeler's; skip-changeset was rightly not applied. Answered: right.
• F1 — enumerateBoard in scripts/check-issue-citations.mjs returned an 85-page board at exit 0, once in five runs. A verifier that degrades silently is the class AGENTS.md's "Absence must be loud" names; the instrument is outside this diff's file surface. The seat's ACCEPT (comment 5885704534) records a pointer on [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556; that carrier must hold it, or a card is owed. Escalated to the seat; verdict-neutral here.
• F2 — the three generated #11671 headers. Producer verified at i18n-extract.ts:2294; the fix is at the producer plus a regeneration of every copy, never a hand edit. Carrier: the stage that takes packages/cli. Answered: right to leave.
• F3 — the two outbox.ts refusal strings. Form D, outside this stage's form-C surface, already baselined. Ruling C+D orders D first, and the report names no carrier for the services lane's runtime strings. Escalated: a form-D card or carrier for domain:services. Verdict-neutral for this PR.

Check-runs on the head, as read in the act that wrote this record (2026-09-29T07:38Z): 25 success — among them Build Core, Dogfood Regression Gate (and its three shards), Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard, Check Changeset, Check PR Size, Type Check · source gates, Type Check · consumer gates, Type Check · debt ledger, Test Core 1, 2, 5 and 6 of 6; 3 skipped — Console Pin Gate, Build Docs, Packed-tarball smoke; 4 in progress — Lint & Repo Gates, Type Check · workspace, Test Core 3 and 4 of 6; 0 failure. The seat checks convergence before landing; this verdict judges ①②③.

Implemented-by: claude/issue-20596-service-messaging-citations
Reviewed-by: session_01XY5uCwTjZj7884yYtyur4H

VERDICT: PASS

---

Generated by Claude Code