docs(plugin-email): re-anchor the dead tracker citations to the commits that decided them

[objectstack-fleet]

Part of #20596
Clause-②: no

What changed

This is the eleventh stage of the domain:services lane of the dead-citation sweep. It covers packages/plugins/plugin-email/src/** and nothing else. By the seat's census at the claim (5902547086), it is the largest package in the lane that no in-flight work holds. Later stages cover the other packages, so this PR says Part of and the card stays open.

Every comment or docblock site in scope that cited a tracker number answering 404 has been rewritten in ruling C+D's form C (comment 5749154545 on #19123), by the method of stages 1 to 10 (PR #20609 as 422db788a, PR #20626 as b80ab579d, PR #20634 as 4d04b6be3, PR #20658 as 9a4b2bb38, PR #20693 as 0e9ad74fb, PR #20708 as 9b384f63a, PR #20717 as cbaf04c1f, PR #20729 as d2820876f, PR #20737 as 4dfff176b, PR #20742 as 697845d19). That is 16 sites on 16 lines in 8 files, covering 4 numbers:

• 7 census sites (every census site this package has);
• 9 sites in test comments, which the census defers. Three of them carry #13190, a dead number that stands only in test files here, so the census never judged it; it was read on its own (404);
• no site the gate's grammar cannot see (the package has none that is dead, see Acceptance notes).

Each rewritten line now cites the commit in origin/main history that decided what the line describes, and says in its own words what was decided: 4 distinct shas. No number in this package has an ADR or ruling record of its own (a grep of docs/adr/ and scripts/adr-anchors/ finds only ADR-0131 naming #11741, as evidence in its D7, not as the record of that decision; nothing else under docs/ names the four), so every anchor is a commit, per ruling C's order. No number was dropped.

Only comments changed. Every touched source file keeps its line count (16 lines out, 16 in, over 8 files), so no line citation into these files moves. Every one of the 16 changed lines carried a dead citation; there is no reflow line. No code token moves (see the guard below).

No citation number is added. The added lines carry no tracker number at all. Over the whole diff, added minus removed is negative for the four dead numbers and zero for every other number, and no number is new to the diff. No PR number is the citation on an added line: the two PR #8675 spellings became that pull request's squash commit.

10 dead sites are left on purpose, all of them describe / it titles (see the list below).

One more file: a patch changeset for @objectstack/plugin-email, because the rewritten prose ships (see Changeset below).

Census: plugin-email, before and after

Instrument (A1). The gate's own node scripts/check-issue-citations.mjs --census --json, read-only and unchanged. The count below is its allocated-but-absent findings under packages/plugins/plugin-email/. Each run counts as a reading only because its board frontier equals the newest issue or pull-request number, read by a separate request just before and just after the run.

reading	tree	board	whole-repo allocated-but-absent	plugin-email sites	lines	files	numbers
before	base 97005aed0, run 2026-09-30T02:00:45Z to 02:04:02Z	enumerated, 186 pages, frontier #20748 (newest #20747 before, #20748 after: a pull request opened at 02:03:20Z, inside the run)	1,064	7	7	4	3
after	head 15a7d69a7, run 02:11:19Z to 02:14:30Z	enumerated, 186 pages, frontier #20753 (newest #20753 before and after)	1,057	0	0	0	0

The before count matches the seat's census and A1 (7 sites: #13189 ×4, #11741 ×2, #8675 ×1). The before run's board moved during the run; its frontier equals the newest number at the run's end, which is A1's criterion (stage 7's precedent). The whole-repo drop is 7, exactly this diff's census sites. The resolves tally is 33,029 in both runs, and resolves-as-pull-request (1,984) and cross-repo-unjudged (995) did not move either. The after run was taken on 15a7d69a7; the head 23283d394 adds only the changeset. No run was truncated or discarded: both enumerations read 186 pages at the newest frontier.

Supplementary instrument, the whole scope. The census does not read test files or strings, and this stage's scope includes test comments. So a second reading runs the gate's own exported extractCitations (whole-file and comment-prose projections) and namesThisRepository over every .ts file under plugin-email/src (50 files). It takes its verdicts from the before census's own board reading rather than from a second enumeration: a number is dead when that census reported it allocated-but-absent, and alive when that census judged it on this board anywhere (its --list extraction, 37,072 rows) and did not report it. The eleven numbers the census never saw, because they stand only in test files or as the second half of a slash pair here, were read one by one on the issues endpoint: #13190 answers 404; #5169, #5286, #10619, #16506, #20374, #5197 answer 200 as issues, and #8348, #5191, #5211, #5232 as pull requests.

reading	citations	dead	src comment	test comment	src string	test string
before, 97005aed0	360	26	7	9	0	10
after, 15a7d69a7	344	10	0	0	0	10

Its src-comment column equals the census's 7, which is the control on the second instrument. The 323 live citations are the same in both readings, and the drop of 16 citations is exactly the rewritten sites. 11 extracted tokens are not tracker references at all and are not judged: the HTML entity ' (6 sites in the template engine and its tests) and the fixture subjects Invoice #42 to Invoice #45 (5 sites). A third, raw reading (every # followed by 2 to 6 digits, whatever surrounds it) finds 371 occurrences and 26 dead before, 355 and 10 after. Beyond the gate's grammar it sees 11 tokens, none dead: the nine second numbers of the #A/#B lines (all live), the excused Prime Directive #12, and the CSS colour #2563eb.

Per-number table

Sites and files count every dead occurrence in scope at the base (comments and strings, tests included). rewritten / left counts the sites rewritten and the sites left. Each anchor was read in its message and diff, not only its subject, and git blame at the base puts every rewritten line in its anchor commit or in a later commit that descends from it (merge-base --is-ancestor exit 0 for all 16 line and anchor pairs).

number	sites / files	rewritten / left	anchor: what it decided
#13189	13/4	8/5	33fbd3566 (PR #13375): the SMTP port guard tests integrality (Number.isInteger), so a fractional port such as 587.5 is refused at construction, and the generated refusal sentence reads (expected an integer 1-65535), the range still rendered from the constants. Its changeset headline names #13189; its diff writes the integrality docblocks the rewritten lines sit in. New to the sweep
#13190	5/1	3/2	56c5b1dbe (PR #13316): smtpOptionsFromMailSettings passes a present-but-unreadable smtp_port through to the guard instead of omitting it (which had silently fallen back to 587); absent and '' still mean "not set", and no second refusal was added. Its changeset headline names #13190; its diff writes the #13190 comment block itself. New to the sweep
#11741	6/3	3/3	b706af987 (PR #11839): SendEmailInput / SendTemplateInput gain an optional organizationId, which plugin-email's writer stamps verbatim onto sys_email.organization_id (pass-through only, no resolution or fabrication), and sendTemplate forwards it as a producer of send(). Its message names #11741 as the card that commit closed; git blame puts all three rewritten lines in it. The plugin-auth stage's anchor for the same number
#8675	2/2	2/0	c9f595083: the squash commit of the pull request that was #8675 (its subject ends (#7987) (#8675)): sys_account's OAuth token columns are declared internal: true. Its diff records the trap both lines describe: those columns are required: false, so inferring "key missing, therefore the strip ran" broke ordinary sign-in (16 red tests), which is why the readback carries the absenceProvesStrip discriminator. New to the sweep

Every cited sha matches exactly one commit (git rev-parse --disambiguate, count 1 for each of the 4), and every one is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 4; control leg: stage 1's landing 422db788a exit 0; the history is complete, --is-shallow-repository false, 15,155 commits). Each of the 4 numbers answers 404 on the issues endpoint, which serves pull requests too. Independently, the package's own shipped CHANGELOG.md pairs b706af9, 33fbd35 and 56c5b1d with the same three decisions.

Wordings to check

• Tag swaps in parentheses. 「(SmtpTransport accepts a non-integer port its own message promises to reject, then fails at connect time under an internal name #13189)」 became 「(commit 33fbd35)」 at transports/smtp-port-contract.ts:87 (a section heading), :134 and transports/smtp.ts:68.
• Line openers. 「Widen SendEmailInput with organizationId so sys_email can be stamped at its producers (Decision 2 of #11303) #11741 —」 became 「Commit b706af9 —」 at email-service.ts:742 and :1439; 「A non-numeric stored smtp_port is silently dropped and mail goes out on 587 instead — the setting is ignored without a word #13190 —」 became 「Commit 56c5b1d —」 at transports/smtp.test.ts:221; 「## SmtpTransport accepts a non-integer port its own message promises to reject, then fails at connect time under an internal name #13189 —」 became 「## Commit 33fbd35 —」 at transports/smtp-port-contract.test.ts:34.
• email-service.test.ts:342, a section rule: 「── Widen SendEmailInput with organizationId so sys_email can be stamped at its producers (Decision 2 of #11303) #11741 —」 became 「── Commit b706af9 —」, and its trailing rule was shortened by 10 characters so the line keeps its width exactly.
• internal-header-readback.ts:37. 「(PR fix(security): sys_account OAuth access/refresh/id tokens stop serializing on the data API (#7987) #8675 hit exactly this on sys_account's optional」 became 「(Commit c9f5950 records exactly this on sys_account's optional」: a commit does not "hit" a trap, it records one, and that commit's own diff is where the 16 red tests are recorded.
• email-headers-internal.integration.test.ts:251. 「The regression PR fix(security): sys_account OAuth access/refresh/id tokens stop serializing on the data API (#7987) #8675 measured on a sibling card」 became 「The regression commit c9f5950 records from a sibling card」, the same reading.
• transports/smtp-port-contract.test.ts:228. 「SmtpTransport accepts a non-integer port its own message promises to reject, then fails at connect time under an internal name #13189 is the card that SPENDS that」 became 「Commit 33fbd35 is the change that SPENDS that」, so the noun matches the anchor.
• transports/smtp.ts:127, transports/smtp.test.ts:272, :276, :281, :283. The number became 「commit SHA」 in place (「until commit 33fbd35:」, 「The bucket commit 56c5b1d never had to name」, 「Commit 33fbd35 made the guard test」, 「Commit 56c5b1d's rule is that」, 「commit 33fbd35 changed which numbers」).

The 10 sites left

• Test strings, 10 sites on 9 lines, all describe / it titles, left as stages 1 to 10 left theirs: email-service.test.ts:349 and send-template.test.ts:63, :88 (#11741); transports/smtp-port-contract.test.ts:225, :309, :340 (#13189); transports/smtp.test.ts:230 (#13190), :271 (#13189), :293 (#13190 and #13189).
• No source string, operator log string, assertion message, quoted maintainer ruling or generated file in this package carries a dead number.
• Outside src, the package's CHANGELOG.md names three of these numbers on 5 lines. It is release-owned and deliberately not edited here (see Acceptance notes).

Mechanical guard: no code token moves

The guard compares the TypeScript parser's leaf nodes (a forEachChild walk, so comments are trivia and JSDoc nodes are never visited), base 97005aed0 against head. String and template literals are therefore read in full. It ran over all 8 touched .ts files.

• Real run: 7,035 base leaf tokens, 0 files with a token change (exit 0).
• Comment control in email-service.ts (「no resolution, no default, no fabrication」 to 「… no default and no fabrication」): 0 files changed, as expected (exit 0).
• Positive control, a code token added in transports/smtp.ts (isValidSmtpPort(port) given as number): DIFFER, 587 to 588 leaf tokens (exit 1).
• Positive control, one digit changed inside a kept test title (transports/smtp.test.ts:293, #13189 to #13188): DIFFER (exit 1).

Every mutation went through scripts/ablation-replace.mjs (wrap mode) under a shell trap that restores by absolute path, and each landed (anchor 1 to 0, blob changed). Each restore was proven byte-identical to the HEAD blob (1e99bd5e2bcb, 46c13267611b, da5314910bc4), with git diff HEAD empty and a clean tree afterwards.

Changeset

This change ships bytes, so a patch changeset for @objectstack/plugin-email (.changeset/20596-plugin-email-provenance-anchors.md) is included. Its body is stage 10's, word for word, with the package name changed.

Measured on the built package (A3): files[] is dist, README.md and CHANGELOG.md, and the package is not private. After the build, b706af987 appears twice in each of dist/index.js and dist/index.mjs (the two inline comments in email-service.ts, which the bundle keeps). c9f595083 appears once in each of dist/index.d.ts and dist/index.d.mts (the internal-header-readback.ts docblock), and so does 33fbd3566 (the docblock on SmtpTransportOptions.port). 56c5b1dbe reaches nothing (test files only). Positive controls, one unchanged line beside each shipped rewrite, land exactly where their neighbours do: 「context, so the input's organization is the one fact it may stamp:」 and 「caller's organization so the sys_email row it persists is stamped.」 once in each JS file; 「token columns: inheriting」 and the unchanged line just above the rewritten one in the port docblock once in each declaration file. A never-written negative phrase appears nowhere in dist. None of the 4 dead numbers is left in dist.

Gates (head 23283d394)

• Citation judging, as CI runs it: pnpm check:issue-citations exits 0. node scripts/check-issue-citations.mjs exits 0: the diff-scoped run found no citation added against 97005aed0 (4 files read; test files are a deferred surface).
• Doc authoring: pnpm check:doc-authoring exits 0.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 23283d394 derived 61 commands: all 55 derived at dispatch, plus check:engine-double-contract, check:objectql-double-limit, check:query-options-erasure, check:type-check-coverage, check:type-check-debt and check:where-matcher. Each ran with its exit code captured before any pipe, and all 61 exit 0. --ran, fed each command with its exit code, reports 61 run, 0 NOT MEASURED (a derived zero), 0 unrun, and exits 0. A full turbo run build of ./packages/* and ./packages/*/* ran first under the shared verify lock (71 of 71 tasks, exit 0), so no gate hit an unbuilt workspace.
• Roster families the derivation lists outside its commands (their rosters sit in directories this diff touches): node scripts/check-changeset-fixed.mjs, pnpm check:authz-resolver, pnpm check:error-code-casing and pnpm check:filter-alias-parity, each exit 0.
• Tests and typecheck, under the verify lock:
  • pnpm --filter @objectstack/plugin-email test: 31 files pass and 510 tests pass. vitest list --filesOnly names 31 files, all the tracked test files, the 4 touched ones included.
  • pnpm --filter @objectstack/plugin-email typecheck exits 0 (tsc on tsconfig.json, then check:test-typecheck on tsconfig.test.json: 0 files and 0 errors in its debt ledger). tsc --listFiles holds all 8 touched files in both programs, and the test program holds all 50 files under src/.
• Lint, as a proven narrowing: eslint with inline config disabled, over the 8 touched .ts files, gives 8 files, 0 errors and 0 warnings. All 8 are in eslint's own population (isPathIgnored is false for each; a dist file, as the control, is ignored). eslint.config.mjs never enables type-aware linting (no parserOptions.project, as its own lines 327-328 state), so a comment edit here cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's run.
• Control bytes: pnpm check:nul-bytes exits 0, and a raw scan of the 9 changed files for control bytes finds none.

Acceptance notes

• The gate-invisible spellings, grepped as the claim asked. CITATION_RE refuses a hyphen after the digits and a / before the # (check-issue-citations closeout (extractor spellings): CITATION_RE refuses a hyphen after the digits, so a dead #N-word citation (#13398-class) is invisible to the diff gate and to the census #20636), and NON_CITATION_HEADS excuses a number after the word 「option」. In this package: #N-word none, #A/#B 9 lines, option #N none, at the base and at the head, which is the claim's 0 / 9 / 0. Every second number on the 9 slash lines answers 200 (#5197 ×2, #5191, #5211, #5232 ×2, #5177, #4251, #5094), so nothing there needed rewriting.
• ADR-0131 names #11741. Its D7 cites #11741 as the writer fact that keeps sys_email tenant data. That is evidence inside a later record, not the record of what #11741 decided, so it is not this stage's anchor, and docs/adr/** is a governed Tier H surface outside this card's stages. It joins the ADR-tree residue the seat already carries (ADR-0131's #14484, stage 2).
• CHANGELOG.md is left. packages/plugins/plugin-email/CHANGELOG.md names #11741, #13189, #13190 and #8675 on 5 lines. It is release-owned (AGENTS.md, Documentation Guardrails), a deferred surface of the citation gate, and ⛔ not part of this stage.
• 「This card」 phrases are left. 20 comment lines in 8 files of this package speak of 「this card」, 「the card」 or 「the two cards」. They carry no number and neither instrument sees them. Inside the #13189 test block, they still have the kept (#13189) title as their referent; the one rewritten line that said 「the card」 now says 「the change」 (above). The rest are unchanged, as in stages 8 to 10.
• The census instrument did not truncate in this stage. Both enumerations read 186 pages at the newest frontier.
• Anchors the next stages can reuse, each checked here: #13189 → 33fbd3566; #13190 → 56c5b1dbe; #8675 → c9f595083. #11741 → b706af987 reuses the plugin-auth stage's anchor.
• Base. The branch is on main at 97005aed0. main has since moved two commits (9c8f113c6, a6866da0c). Their 14 files touch nothing under plugin-email, nor scripts/check-issue-citations.mjs, .changeset/config.json or the doc-authoring-prose-id baseline, and the three console-injection scripts they change are not among this diff's 61 derived families. So no merge was taken; the merge queue rebuilds on the merged generation.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-email, touching 3 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/plugins/plugin-email/src/internal-header-readback.ts, packages/plugins/plugin-email/src/transports/smtp-port-contract.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/email-templates.mdx (via sendTemplate (symbol, a method of class EmailService))
• content/docs/kernel/index.mdx (via sendTemplate (symbol, a method of class EmailService))
• content/docs/kernel/runtime-services/email-service.mdx (via sendTemplate (symbol, a method of class EmailService))

What this run could not see

• 2 changed file(s) yielded no anchor (packages/plugins/plugin-email/src/internal-header-readback.ts, packages/plugins/plugin-email/src/transports/smtp-port-contract.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 33e4a5609c4d6cc012279f08e24e111c3370d14f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from f45ff2b360bae3f620678bb768c8c0cd8cb4b35f — the merge of head 23283d394b2182a846066d4bd6fd1b7aa2d170ac into base 33e4a5609c4d6cc012279f08e24e111c3370d14f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin f45ff2b360bae3f620678bb768c8c0cd8cb4b35f && git checkout f45ff2b360bae3f620678bb768c8c0cd8cb4b35f
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 33e4a5609c4d6cc012279f08e24e111c3370d14f 23283d394b2182a846066d4bd6fd1b7aa2d170ac && git checkout -B drift-repro 33e4a5609c4d6cc012279f08e24e111c3370d14f && git merge --no-ff 23283d394b2182a846066d4bd6fd1b7aa2d170ac

node scripts/docs-audit/affected-docs.mjs --json 33e4a5609c4d6cc012279f08e24e111c3370d14f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 33e4a5609c4d6cc012279f08e24e111c3370d14f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 23283d394b2182a846066d4bd6fd1b7aa2d170ac
Local-runs: none

① Derived judgments

Read against main at the merge-base 97005aed0 (stage 10's landing 697845d19 plus two). The branch was fetched into an owned ref, refs/review/pr-20757, which resolves to the head above; nothing was read through FETCH_HEAD. origin/main at 33e4a5609 (the PR's recorded base) is three commits past that merge-base (9c8f113c6, a6866da0c, 33e4a5609); of the 24 files they touch, none is under packages/plugins/plugin-email, none is this PR's changeset, .changeset/config.json or scripts/check-issue-citations.mjs (the one .changeset/ file among them is #20599's own), and the merge-base diff and the three-dot diff against origin/main are byte-identical: 9 files, +26/−16 — 8 source files under packages/plugins/plugin-email/src/** (4 modules, 4 test files) and one changeset. The head 23283d394 adds only the changeset on top of 15a7d69a7, which holds every source line.

• Accept-set: no change — right. No Zod schema, REST handler, query-parameter set, refusal text, log text or runtime string moves. 16 source lines out, 16 in; every one of the 32 opens with a comment marker after whitespace (// or *), and a -U0 diff filtered on those markers leaves nothing. Each of the 8 touched files keeps its line count (350, 383, 1445, 152, 396, 145, 324, 329), so no line citation into these files moves. The dev's parser leaf-token guard (0 files with a token change; both positive controls DIFFER) says the same and is not repeated here.
• Public surface: no change — right. No export added, removed or renamed; no packages/spec file touched, so no generated artifact is owed.
• Published bytes: changed — right, and it decides ②. @objectstack/plugin-email (17.5.0, not private, files = dist, README.md, CHANGELOG.md; in the changeset fixed group) ships the rewritten lines: the two inline comments inside EmailService.send and sendTemplate (email-service.ts:742, :1439), the SmtpTransportOptions.port docblock (transports/smtp.ts:68), the isValidSmtpPort and refusal-sentence docblocks (transports/smtp-port-contract.ts:87, :134) and the module docblock of internal-header-readback.ts (whose exports reach src/index.ts:131). The dev's A3 build reading (each sha located in dist with positive and negative controls, 56c5b1dbe correctly absent because its lines are test-only) says the same; this record does not repeat the build.
• The 4 numbers are dead — right. Each of #13189 #13190 #11741 #8675 answers 404 on the issues endpoint (which serves pull requests too), read for this record. No ADR, scripts/adr-anchors/ file or other docs/ page records any of the four as its decision: a grep over docs/ and scripts/adr-anchors/ at the head finds only ADR-0131 line 474 naming #11741 as evidence inside its D7. Ruling C's first rung is empty, so a commit is the right anchor for every one.
• The 4 anchors — each right. Each abbreviated sha resolves to exactly one commit (rev-parse --disambiguate, count 1 for all 4) and is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 4). Each names the number it replaces, and the decision the rewritten lines state is the commit's. #13189 → 33fbd3566 (PR fix(plugin-email): refuse a fractional SMTP port at construction, in the sentence that promised to #13375): its changeset headline names #13189, its diff writes both smtp-port-contract.ts docblocks the rewritten lines sit in, and its message decides what the eight lines say — the guard tests Number.isInteger, a fractional port such as 587.5 is refused at construction, the generated sentence reads (expected an integer 1-65535) with the range still rendered from the constants. #13190 → 56c5b1dbe (PR fix(plugin-email): refuse a present-but-unreadable smtp_port instead of silently sending on 587 #13316): its changeset headline names #13190, its diff wrote the #13190 comment block and describe title in smtp.test.ts, and its message decides the three lines — a present-but-unreadable smtp_port is passed through to the constructor's existing refusal, while absent and '' still fall back to 587. #11741 → b706af987 (PR feat(spec,plugin-email,service-messaging,plugin-auth): widen SendEmailInput with optional organizationId, threaded from org-holding producers #11839): "Fixes Widen SendEmailInput with organizationId so sys_email can be stamped at its producers (Decision 2 of #11303) #11741" in its message; SendEmailInput / SendTemplateInput gain an optional organizationId, stamped verbatim onto sys_email.organization_id (pass-through only), sendTemplate forwarding it — what email-service.ts:742, :1439 and email-service.test.ts:342 say. #8675 → c9f595083: the squash commit of the pull request that was #8675 (subject ends (#7987) (#8675)); its diff declares sys_account's three OAuth token columns internal: true, records "measured: 16 red tests" on those required: false columns, and adds the absenceProvesStrip discriminator — exactly what internal-header-readback.ts:37 and email-headers-internal.integration.test.ts:251 now say, and the two PR #N spellings in scope became this sha.
• Line origin — right. git blame at the base puts 12 of the 16 rewritten lines in their anchor commit and the other 4 in a descendant of it: 61581462b for the two #8675 lines, and 33fbd3566 for smtp.test.ts:272 and :281, which cite 56c5b1dbe — right, because those two sentences state #13190's bucket rule, not #13189's narrowing, and form C anchors what the sentence describes. The dev's "anchor or a descendant" reading holds for all 16 pairs.
• The wordings — each right. smtp-port-contract.test.ts:228 「the card that SPENDS」 → 「the change that SPENDS」, so the noun matches a commit. internal-header-readback.ts:37 「PR fix(security): sys_account OAuth access/refresh/id tokens stop serializing on the data API (#7987) #8675 hit exactly this」 → 「Commit c9f5950 records exactly this」 — the commit's own diff is where the 16 red tests are recorded, so "records" is the truer verb. email-headers-internal.integration.test.ts:251 「The regression PR fix(security): sys_account OAuth access/refresh/id tokens stop serializing on the data API (#7987) #8675 measured on a sibling card:」 → 「The regression commit c9f5950 records from a sibling card:」 — faithful, if a little stiff; a wording nit, not a finding. email-service.test.ts:342, a section rule: the 16-character phrase replaces a 6-character number and the trailing rule loses 10 characters, so the line keeps its width; checked. The five in-place swaps in smtp.ts:127 and smtp.test.ts:272, :276, :281, :283 keep each sentence's subject and tense.
• Citation accounting — right. Over the diff: the 16 removed lines carry 16 dead occurrences (#13189 ×8, #11741 ×3, #13190 ×3, #8675 ×2) and no other number; the added lines carry no tracker number at all (a grep for # plus digits over the + lines is empty); 4 distinct shas stand on added lines; no PR #N stands on an added line. A grep of the four numbers over plugin-email/src returns 25 lines at the base and 9 at the head: the 16 rewritten lines, exactly.
• The 10 sites left — right, and the list is exact. The 9 lines at the head carry 10 occurrences, every one a describe or it title: email-service.test.ts:349, send-template.test.ts:63, :88 (#11741); transports/smtp-port-contract.test.ts:225, :309, :340 (#13189); transports/smtp.test.ts:230 (#13190), :271 (#13189), :293 (#13190 and #13189). Titles are string tokens, left as stages 1 to 10 left theirs. No source string, log string, assertion message, quoted ruling or generated file in this package carries a dead number. Because that grep also matches a dead number standing as the second half of an #A/#B pair, none of the package's 9 slash lines carries one of the four; the liveness of their second numbers rests on the dev's single-number reads, not repeated here. packages/plugins/plugin-email/CHANGELOG.md names all four numbers on 5 lines (808, 917, 946, 962, 1696): release-owned, untouched, right. (The PR body says "three of these numbers" in one place and four in another; the file carries four. A body nit, not a finding.)
• Form — consistent with the landed stages 1 to 10 (422db788a through 697845d19): the word commit plus the abbreviated sha in the position where the number stood, the decision carried in the sentence. The one reuse this thread can check, #11741 → b706af987, is the plugin-auth stage's anchor for the same number.
• Check-runs on the head, the gate verdicts, read 2026-09-30T03:01Z: 34 check-runs, each name once, so latest-per-name is the list itself — 30 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in): paths-filtered or opt-in, not verdicts against), 1 in_progress, 0 failure. Of the seven required contexts, six are success — TypeScript Type Check, Test Core (the aggregate and all six shards), Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard — and one was still in_progress at that read: Lint & Repo Gates, which carries check:issue-citations and check:doc-authoring, the two gates this diff answers to. Check Changeset, Check PR Size, Part-of PR must not also close its card, The card this PR closes must claim this branch, No other open PR may claim the same issue and No other open PR may claim the same single-writer path are success. Not awaited: the ① judgments above rest on the diff, and the landing separately requires every check green, so the owning seat reads that one before it queues. Nothing was built, run or re-run locally.

② Semver level

• .changeset/20596-plugin-email-provenance-anchors.md declares '@objectstack/plugin-email': patch — matches what the diff publishes. The package is released and its dist carries the rewritten comments and docblocks, so bytes ship; skip-changeset would be wrong (it is for a diff that publishes nothing from any released package), and the PR carries no such label. Not minor: no accept set widens and no surface is added. The body is truthful (comments only; no type, schema, export, log or refusal text, or runtime behaviour change), carries no tracker number and no model identifier, follows stage 10's landed form, and the filename carries the card number. plugin-email sits in the fixed group beside the ten packages whose stages declared the same level.
• Clause-②: no — right. It is line 2 of the PR body under Part of #20596, and the claim (5902547086) declares the same. The diff widens no accept set, so no arm is owed and no minor is owed. Nothing breaks, so no ADR-0087 marker is owed; Check Changeset on the head is success.
• Not a governed-surface diff (no path under docs/adr/**, docs/NORTH-STAR.md, .claude/**, skills/**, AGENTS.md, CLAUDE.md); 42 changed lines, under the 5,000-line human-merge threshold; head repo equals base repo; Governed Surface Queue Guard on the head is success. A draft with Part of on line 1 and no closing keyword anywhere in the body, so the card stays open for the remaining stages. Both commits end with the model-free trailer pair and no model identifier appears in the diff, the commit messages, the PR body or the changeset.

③ Boundary flags

The dev report (5903104616) has open_questions: []. Its eleven deviations and two out-of-scope findings, and the ACCEPT's (5903127828) accepted list, each answered:

1. 9 test-comment sites beyond the census's 7 — answered, in scope. The claim's surface is comment and docblock prose under plugin-email/src/**; test comments are that, and stages 1 to 10 rewrote theirs. The head grep above confirms the residue is titles only. Three of the nine carry #13190, which stands only in test files here, so the census never judged it; it was read on its own and answers 404 (confirmed for this record).
2. Wordings beyond the tag swap — answered, right (① above). Every one sits on a line that already carried a dead number; no reflow line; every file keeps its line count.
3. The read-channel refusal — answered, right, and nothing for this PR. A first card read by curl carrying the session token was refused by the local permission layer; the dev did not re-route it through another credential-bearing channel, took every later read through the read-only MCP tools, and sent every write (three relay strokes: the draft PR, the assignee, the report comment) through the relay. That is the rule applied as written, and the ACCEPT records it as it recorded stage 6's.
4. Earlier dev reports for stages 1 to 5, 7 and 8 read only through their deviations and out-of-scope fields — answered, immaterial. The method is the landed form of stages 1 to 10, read off the tree; this record read all 47 comments on the card in full and found nothing there that binds this stage differently.
5. Supplementary and raw instruments judged against the before census's own board reading plus single-number reads, no board-dump script — answered, immaterial here. Stage 6's method; the census instrument itself ran unchanged, and the residue at the head is verified above by grep.
6. One docs/ grep loop discarded because its exit codes were a pipe's, then re-run without the pipe — answered, right. Process hygiene, and the re-run's reading (no ADR hit for the four numbers) equals this record's own grep.
7. The harness attribution reminder versus AGENTS.md's trailer pair — answered, right. Both head commits end with the model-free pair AGENTS.md prescribes (the session-URL trailer and Co-authored-by: Claude), no model identifier appears in either message, and the PR body's footer is the session-URL form that surface keeps.
8. No pre-PR merge of main — answered, right. Verified above: the three commits past the base touch no path in this diff and no input the citation gate derives from, so the queue's rebuild has nothing to reconcile by hand.
9. PR-body byte-level comparison NOT MEASURED — answered, immaterial. The body read over the API for this record carries every section named in the report and exactly one footer.
10. Labels — answered. documentation, size/s, tests, tooling are the labeler's; no skip-changeset, which is right.
11. Cleanup after the report (worktree removed, branch kept on the remote) — answered, immaterial to the head.
12. Out-of-scope 1, ADR-0131 line 474 (D7) cites the dead #11741 — verified at the head; escalated to its carrier, not to this PR. docs/adr/** is Tier H and outside every stage of this card; the ADR names the number as evidence, not as the record of its decision, so the anchor here is rightly the commit. It joins the ADR-tree residue this seat already carries (ADR-0131's #14484 from stage 2; ADR-0055 and ADR-0094 from stage 4). Stage 9's landing note records that [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556 has closed, so the seat names a live carrier when it leaves this residue — the same observation stage 4's record made, still open. Not blocking.
13. Out-of-scope 2, 「this card」 on 20 comment lines in 8 files — answered. Wording only, no number, seen by neither instrument; stages 8 to 10 left theirs; the one rewritten line that said 「the card」 now says 「the change」, and inside the #13189 test block the kept (#13189) title is still the referent. Not blocking.

One advisory read, not a flag: the Docs Drift Check comment on the PR lists three pages via sendTemplate; it fired on the inline comment inside that method, and nothing those pages document changed.

Nothing is escalated against this PR. One reading for the seat, not a flag: Lint & Repo Gates was still in progress when this record was rendered, so the landing waits on its success as it always does.

Implemented-by: claude/issue-20596-plugin-email-citations
Reviewed-by: session_01XY5uCwTjZj7884yYtyur4H

VERDICT: PASS

---

Generated by Claude Code