fix(runtime,mcp,service-datasource): the #6504 consumer sweep — three list consumers stop claiming what a known-partial read cannot support - #8854

…commits that decided them (objectstack-ai#20609)

Part of objectstack-ai#20596
Clause-②: no

## What changed

This is the first stage of the `domain:services` lane of the
dead-citation sweep. It covers
`packages/services/service-messaging/src/**` and nothing else, the
largest package in the lane that no open PR or in-flight claim holds
(the claim, `5884863234`, gives the order). Later stages cover the other
packages, so this PR says `Part of` and the card stays open.

Every comment or docblock site in scope that cited a tracker number
answering 404 has been rewritten in ruling C+D's form C (comment
5749154545 on objectstack-ai#19123), the way the landed `packages/spec/src` stages
apply it (PR objectstack-ai#20533 is the method). That is **127 sites on 109 lines in
28 files, covering 14 numbers**: the 97 census sites outside the
generated headers, and 30 sites in test comments, which the census
defers. Each rewritten line now cites the commit in `origin/main`
history that decided what the line describes, and it says in its own
words what that commit decided.

No ADR or ruling-record file in `docs/adr/` or `scripts/adr-anchors/`
records the decision behind any of the 14 numbers, so every anchor is a
commit: **13 distinct shas**. No number was dropped.

Only comments changed. Every touched source file keeps its line count
(116 lines out, 116 in, over 28 files), so no line citation into these
files moves. Seven of those 116 lines held no dead citation: they are
the other half of a sentence that had to be reflowed
(`inbox-caller.ts:87`, `:88`, `messaging-service.test.ts:972`,
`notification-keyed-text-bounds.test.ts:83`,
`notification-subscription.object.ts:81`, `:82`), or a pointer that lost
its referent (`sql-outbox.ts:281`, 「the race the card describes」 to 「the
race that commit describes」, because line 278 now names the commit). No
code token moves (see the guard below).

**No citation number is added.** Every tracker number on an added line
was already on the line it replaces (added-minus-removed over the whole
diff: 0). No PR number stands on an added line.

Fifteen dead sites are left on purpose: 12 string literals and 3
generated file headers (see the list below).

One more file: a `patch` changeset for `@objectstack/service-messaging`,
because the rewritten docblocks ship (see Changeset below).

## Census: `service-messaging`, before and after

**Instrument (A1).** The gate's own `node
scripts/check-issue-citations.mjs --census --json`, read-only,
unchanged. Its surface is comment prose in `packages/**/src/**/*.ts`
with string literals blanked, and it defers `*.test.ts`. The count below
is its `allocated-but-absent` findings under
`packages/services/service-messaging/`.

| reading | tree | board | whole-repo `allocated-but-absent` |
service-messaging sites | lines | files | numbers |
|---|---|---|---|---|---|---|---|
| before | base `7a1faf1a5`, run 2026-09-29T06:31:54Z to 06:35:25Z |
enumerated, 185 pages, frontier objectstack-ai#20606, 18,433 numbers | 2,457 | **100**
| 82 | 22 | 13 |
| after | head `685200760`, run 06:48:33Z to 06:52:17Z | enumerated, 185
pages, frontier objectstack-ai#20606, 18,433 numbers | 2,360 | **3** | 3 | 3 | 1 |

The before count matches the 100 that census `5884031174` read at
`f11b5f20`. The whole-repo drop is 97, exactly this diff's census sites,
and the `resolves` tally is 32,744 in both runs. The 3 left are the
generated headers below. `267c11562`, the final head, adds only the
changeset, which is outside the census surface.

**Supplementary instrument, the whole scope.** The census does not read
test files or strings, and this stage's scope includes both. So a second
reading runs the gate's own exported `extractCitations` (whole-file and
comment-prose projections) and `classifyCitation` over every `.ts` file
under `service-messaging/src` (87 files), against the same enumerated
board.

| reading | citations | dead | src comment | test comment | src string |
test string |
|---|---|---|---|---|---|---|
| before, `7a1faf1a5` | 613 | **142** | 100 | 30 | 3 | 9 |
| after, `685200760` | 486 | **15** | 3 | 0 | 3 | 9 |

Its src-comment column equals the census's 100, which is the control on
the second instrument. The 450 resolving citations and 21 pull-request
citations are the same in both readings.

## Per-number table

Sites and files are all dead sites in scope at the base (comments and
strings, tests included). `rewritten / left` counts comment sites
rewritten and sites left. Every anchor was read in its diff or message,
not only in its subject: it is the commit that made the change the line
describes, and its own diff or message names the number it replaces.

| number | sites / files | rewritten / left | anchor: what it decided |
|---|---|---|---|
| `objectstack-ai#6206` | 1/1 | 1/0 | `8e13ca876`: the share-link routes pass the
whole authz envelope into enforcement instead of a four-field trim. The
line lists it as one member of the defect family behind
`assembleExecutionContext` |
| `objectstack-ai#6363` | 14/2 | 13/1 | `17d095413`: `listInbox`'s `unreadCount`
counts the total unread, not the fetched window (maintainer ruling
2026-08-07, Option A: make the declaration true); it adds
`countUnreadTotal`. The same anchor the spec stages gave this number |
| `objectstack-ai#9722` | 1/1 | 1/0 | `2074b2651`: corrects the
`sys_notification_subscription` index note — `role:` and `team:` resolve
against `sys_member` and `sys_team_member` |
| `objectstack-ai#9807` | 4/3 | 4/0 | `44738f7af`: marks the subscription-to-recipient
expansion NOT WIRED and aligns `principal` with the forms
`RecipientResolver.resolveOne()` accepts, email kept verbatim |
| `objectstack-ai#11374` | 17/6 | 16/1 | route A of the maintainer's 2026-08-24
ruling: a keyed text column declares a `maxLength` sourced from its
producer. Written as 「route A, ruling 2026-08-24」 beside `e4902d2b9`,
the commit that applied it here. `scripts/check-keyed-text-bounds.mjs`'s
header states route A in words |
| `objectstack-ai#11452` | 6/3 | 5/1 | `3b5f0360c`: the plugin-facing
`listInboxAsCaller`, scoped to the authenticated caller |
| `objectstack-ai#11453` | 26/13 | 23/3 | `1a47a5368`: `ack()` refuses a row that is
not `in_flight` (`NotificationAckError`, `DELIVERY_NOT_ELIGIBLE`), as a
compare-and-set in the SQL outbox. The same anchor stage 2 gave it |
| `objectstack-ai#11671` | 4/4 | 1/3 | `09b4f4e4e`: `os i18n extract --source-hashes`
writes the per-locale provenance companion (maintainer ruling objectstack-ai#12069
Option A, which stays cited) |
| `objectstack-ai#11741` | 6/2 | 5/1 | `b706af987`: `SendEmailInput` gains
`organizationId`, and the email channel threads it on both arms. The
same anchor stage 1 gave it |
| `objectstack-ai#11859` | 29/13 | 27/2 | `d9cf78eaa`: `ack()` takes the claimed
record back and binds its claim credential in the compare-and-set. The
same anchor stage 2 gave it |
| `objectstack-ai#12144` | 2/2 | 2/0 | `3a04b0125`: identifier ceilings are
storage-owned (`sys_metadata.name` is 255) |
| `objectstack-ai#12147` | 1/1 | 1/0 | `945e91a13`: the class-level
`check-keyed-text-bounds` gate |
| `objectstack-ai#12978` | 17/6 | 16/1 | `e4902d2b9`: declares the sourced `maxLength`
on all 15 keyed text columns of the `sys_notification_*` objects. No
commit message names the card; its diff is where every `[objectstack-ai#12978]` marker
entered the tree |
| `objectstack-ai#18424` | 14/4 | 12/2 | `879b51270`: an email or SMS channel with no
transport refuses with `transport_not_configured` instead of reporting
success |

Every cited sha matches exactly one commit (`git rev-parse
--disambiguate`, count 1 for each), and every one is an ancestor of the
base (`merge-base --is-ancestor`, exit 0 for all 13). The history was
unshallowed first (`git fetch --unshallow`, 15,062 commits), so no
anchor was read from a truncated log.

Wordings to check, each true of its commit:
- `inbox-caller.ts:86-88`: 「(objectstack-ai#6071, objectstack-ai#6551, and the share-link envelope
trim commit 8e13ca8 undid)」. `8e13ca876`'s message records the trim
(four fields kept, five dropped) and the whole-envelope fix.
- `outbox.ts:72`: 「the option-A shape commit d9cf78e's ruling
refused」. `d9cf78eaa`'s message: 「The caller never supplies an identity:
ownership is proven by round-tripping what claim() returned.」
- The fifteen `sys_notification_*` bound comments: `[commit e4902d2]
... (route A, ruling 2026-08-24)`. `e4902d2b9`'s message opens 「Every
bound names its producer in the declaration」, and `3954fb7df`'s records
the ruling's date and its A and C routes.
- `notification-keyed-text-bounds.test.ts:82-83`: the `objectstack-ai#9807` pointer
becomes 「Every other arm of the grammar commit 44738f7 documented is
narrower」, because `44738f7af` is where the email arm of the selector
grammar was written down.
- `outbox-ack-claim-ownership.integration.test.ts:40`: 「the objectstack-ai#11453 file
beside this one」 names the file itself,
`outbox-ack-precondition.integration.test.ts`.

## The 15 sites left

- **Non-test strings (3 sites, 2 lines), refusal text.** `outbox.ts:187`
(「see objectstack-ai#11453」) and `outbox.ts:210` (「(objectstack-ai#11453, objectstack-ai#11859)」) are inside
`notificationAckNotClaimedMessage` and
`notificationAckLostClaimMessage`, the messages `NotificationAckError`
carries. They are runtime strings, so they are form D, not form C. The
landed objectstack-ai#20234 stages left every string site as a token and rewrote no
refusal text, so these are left and listed, as PR objectstack-ai#20533 did. The form D
stages that did rewrite strings (objectstack-ai#20233's) cover `os migrate meta`
guidance, a different class.
- **Test titles (9 sites, 8 lines).** `describe` titles in
`email-channel.test.ts:90`, `:592`, `messaging-service.test.ts:809`,
`:1286`, `notification-keyed-text-bounds.test.ts:38` (2 numbers),
`outbox-ack-claim-ownership.integration.test.ts:109`,
`outbox-ack-precondition.integration.test.ts:110` and
`sms-channel.test.ts:90`. Tokens, left as they were.
- **Generated headers (3 sites).** Line 8 of `es-ES`, `ja-JP` and
`zh-CN` `.source-hashes.generated.ts` reads 「(objectstack-ai#11671, maintainer ruling
objectstack-ai#12069 Option A, extending objectstack-ai#8765 Option B)」. `os i18n extract` writes
that line from `packages/cli/src/utils/i18n-extract.ts:2294`, and 27
generated files across the repo carry it. A hand edit here would be
undone by the next extract, so the fix belongs at the producer in a
later stage, which regenerates every copy. The hand-written
`translations/index.ts:29` is rewritten here.

## Mechanical guard: no code token moves

The check compares leaf tokens with comments stripped, base `7a1faf1a5`
against head. It uses the TypeScript parser's leaf nodes, so template
literals are read in context, and it excludes JSDoc nodes. It ran over
all 28 touched `.ts` files.

- Real run: 52,337 base tokens, **0 files with a token change** (exit
0).
- Comment-insertion control, in `outbox.ts`: 0 files changed, as
expected (exit 0).
- Positive control, a declaration inserted into `outbox.ts`: DIFFER
(exit 1). The first attempt was a no-op: its anchor text was still
inside the replacement, so `scripts/ablation-replace.mjs` refused it
before the guard ran. It was redone with a hitting anchor.
- Positive control, one digit changed inside the kept `outbox.ts:210`
refusal string: DIFFER (exit 1).

Every mutation went through `scripts/ablation-replace.mjs`, and each
restore was proven byte-identical to the HEAD blob (`80618f8711e2`) with
`git diff HEAD` empty.

## Changeset

This change ships bytes, so a `patch` changeset for
`@objectstack/service-messaging` is included. It says only that the
provenance comments were re-anchored.

Measured on the built package (A3): `files[]` is `dist`, `README.md` and
`CHANGELOG.md`. After `pnpm --filter @objectstack/service-messaging
build`, the rewritten comments reach both halves of `dist`. `d9cf78eaa`
appears 8 times in `dist/index.d.ts`, `1a47a5368` 6 times and
`17d095413` 6 times, and `e4902d2b9` appears 15 times in
`dist/index.js`. The positive control, an unchanged
`notification-subscription.object.ts` docblock sentence, appears in
`dist/index.d.ts`, and a negative control phrase appears nowhere. The
only dead numbers left in `dist` are the two kept refusal strings.

## Gates (head `267c11562`)

- **Citation judging, as CI runs it:** `pnpm check:issue-citations`
(self-test, 114 cases in 8 batteries) exits 0, and `node
scripts/check-issue-citations.mjs` exits 0. The diff-scoped run judged 5
citations across 19 files, and all 5 resolve.
- **Doc authoring:** `pnpm check:doc-authoring` exits 0.
- **Derived gates:** `node scripts/pm/dispatch-gates.mjs --commands
--repo objectstack-ai/objectstack` at `267c11562` derived 64 families.
They include all 50 derived at dispatch, plus 14 more. All 64 exit 0.
`--ran` reports 64 run, 0 NOT MEASURED, 0 unrun, and exits 0.
- Three gates first exited 3 (PREREQUISITE NOT MET) because the
workspace was unbuilt: `check:dual-build-cjs-loads`, `check:i18n` and
`check:type-check-debt`. A full `turbo run build` of `./packages/*` and
`./packages/*/*` then ran under the shared verify lock (71 tasks, exit
0). The first two exited 0 on their rerun.
- `check:type-check-debt` exited 3 once more: `outbox.ts`'s mtime had
moved during the guard controls, although its bytes had not, so turbo's
cache hit left `dist` older than the source. A direct `pnpm --filter
@objectstack/service-messaging build` then let it exit 0 (4 ledger
entries re-measured, none above its number).
- **Tests and typecheck:**
- `pnpm --filter @objectstack/service-messaging test`: 46 files and 507
tests pass, covering every touched test file.
- `pnpm --filter @objectstack/service-messaging typecheck` exits 0. Its
`tsc` program lists all 46 test files and 87 files under `src/` in total
(`--listFiles`).
- **Lint, as a proven narrowing:** `eslint --no-inline-config --format
json` over the 28 touched `.ts` files gives 28 files, 0 errors and 0
warnings. All 28 are in eslint's own population (`isPathIgnored` is
false for each). `eslint.config.mjs` never enables type-aware linting
(no `parserOptions.project`, as its own line 328 states), so a comment
edit here cannot move the verdict on any untouched file. The repo-wide
`pnpm lint` is CI's run.
- **Control bytes:** `pnpm check:nul-bytes` exits 0, and a raw scan of
the 28 files for control bytes finds none.

## Acceptance notes

- **The census instrument returned a truncated board once, at exit 0.**
The first `--census --json` run of this stage (06:25:55Z, base
`7a1faf1a5`) read `enumerated (85 pages)`, frontier objectstack-ai#8854, 8,444
numbers, when the newest number was above objectstack-ai#20600. The `Link` header of
its 85th page had carried no `rel="next"`, so `enumerateBoard` stopped
and classified 16,187 citations as `never-issued`. A reader counting
only `allocated-but-absent`, as this stage's count does, would have got
8 service-messaging sites instead of 100, silently. The next four
enumerations in this session read 185 pages and frontier objectstack-ai#20606, and the
counts above come from those. Nothing in `enumerateBoard` compares its
frontier with the newest issue number, which `probeBoard` does read.
Reported to the seat, not changed here: this stage makes no instrument
change.
- **What stays for later stages.**
- The 3 generated `objectstack-ai#11671` headers, whose producer is
`packages/cli/src/utils/i18n-extract.ts:2294`. That line is the
repo-wide carrier (27 generated files).
- The 3 refusal-string sites in `outbox.ts` (form D) and the 9
test-title sites.
- **Base.** The branch is 9 commits behind `origin/main` (`0f6dcac5e`,
read at 07:23Z). One of them, `8c87d26a5` (the version packages
release), touches `service-messaging`, but only its `CHANGELOG.md` and
`package.json`, and neither is in this diff. So there was no merge.
- **Anchors shared with the spec stages.** `17d095413` (objectstack-ai#6363),
`1a47a5368` (objectstack-ai#11453), `d9cf78eaa` (objectstack-ai#11859) and `b706af987` (objectstack-ai#11741) are
the anchors stages 1 and 2 already gave the same numbers in
`packages/spec/src`, so each number carries one anchor across the tree.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01XY5uCwTjZj7884yYtyur4H)_

---------

Co-authored-by: Claude <noreply@anthropic.com>