dead tracker citations in the `domain:services` packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556)

[objectstack-fleet]

Filing gate: ① a family with a named population. Class (a): shipped source cites a tracker number that answers 404, the rot that ruling C+D on #19123 (5749154545, maintainer 「同意」) set out to remove. reach: source comments in published packages. The census was measured, not estimated.

Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U) as step 2 of #20556. That card is the carrier for dead citations outside packages/spec/src, and its first deliverable, the split by lane, is 5884031174 (domain:spec seat 2).

The population (census 5884031174, origin/main f11b5f20a2)

• This lane: 629 dead sites (allocated-but-absent), 112 distinct numbers, in 152 files.
• Largest packages: plugin-security 143 · service-messaging 100 · plugin-sharing 63 · plugin-auth 52.
• Instrument: node scripts/check-issue-citations.mjs --census --json, the gate's own, read-only. Its declared surface is comment prose in packages/**/src/**/*.{ts,tsx}, with string literals blanked. A site outside it is not swept, and that is not the same as clean.

Control set (the pre-#N sites PR #20554 made visible, all 404)

• plugin-auth: auth-manager.ts (about :5629) plugin-auth: auth SMS (OTP / invite texts) and request-less auth mail keep the deployment locale — sys_user.locale exists now and is not read #14762
• plugin-security: bootstrap-platform-admin.ts (about :266, :630) and per-organization-catalog.ts (about :314) [finding] os meta resync may silently skip every platform default permission set — the seeder never writes managed_by, and the tests stub the field default away #8692; permission-set-projection.ts (about :482) ADR-0005:57 白名单表与注册表的分歧不止 flow：page/app/action/permission/tool/skill 六类 ADR 写 ❌ 而 allowOrgOverride:true，另有 dataset/book/position 三类表里没有却默认成了 true #6483
• plugin-sharing: backfill-sys-record-share-organizations.ts (about :5) finding: every sys_record_share grant row lands organization_id NULL — SharingService writes under a bare system context and the row literal never carries the column #14484

The line numbers are from #20556's filing. The census found some one or two lines off after tree drift.

Direction (triage's grade, on the first comment)

• Follow ruling C+D's form, as packages/spec/src: 1,277 comment lines still cite 170 deleted tracker numbers (1,295 sites) — the staged remainder of ruling C+D on #19123, measured by PR #20226 #20234 applies it to the spec tree. ⛔ It is not restated here.
• Work one package at a time, largest first, with each package's before and after counts from the same instrument.
• ⛔ No single PR across lanes. ⛔ No edits to published release pages (see [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556's answer). ⛔ No gate widening.

Dedupe: #20556 (the carrier), #20234 (the packages/spec/src stages) and #19123 (the ruling). No other card carries this lane's sites.

[objectstack-fleet]

Claim: PM loop round 1 · stage service-messaging · 2026-09-29T06:23Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20596-service-messaging-citations
Worktree: objectstack-issue-20596
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
File surface: comment and docblock prose in packages/services/service-messaging/src/** only, rewritten in ruling C+D's form C (5749154545 on #19123), the way the landed packages/spec/src stages apply it (for example PR #20533). A patch changeset only if the rewritten prose ships in the package's files[].

• Stage order: triage's "largest first" would start at plugin-security (143 sites). That package is hot: PRs fix(plugin-security): an organization-less permission-set read resolves organization-less rows only #20584 and fix(plugin-security): security/explain answers enforcement's refusal for a row-level policy comparing two fields of no shared comparison class #20598 are in the merge queue, and plugin-security: security.explain shows a member removed from an organization that organization's grants, which enforcement refuses since PR #20540 (explain ≠ enforce, split from #20431) #20580 and plugin-security closeout (explain ≠ enforce): object-level security.explain answers allowed: true under a row-level policy comparing two fields of no shared class, while find refuses it with INVALID_FILTER / 400 #20604 queue behind them. service-automation is held by fix(service-automation,metadata-protocol,metadata,runtime): withhold a flow's inbound-hook secret from every served definition, and keep it on a round trip (#20552) #20585. So this stage takes the largest package that nothing holds, service-messaging (100 sites in the census 5884031174). The PR says Part of #20596, and the card returns to pm:queue for the next stage when it lands.
  (stop on a breach outside these; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier at c876a742: no path-derived mandate, floor sonnet · default opus · ceiling fable; each site needs the deciding commit found in history and the decision restated in words, which is judgment ⇒ the default tier)
  Clause-②: no
  Thread-read: none
  Serial constraints cleared: no open PR touches service-messaging (census of all open PRs at the claim), and no card in flight in any lane holds it. The last commits there are d4c897e0 and 7e6ca178, both landed.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20596,
"status": "done",
"branch": "claude/issue-20596-service-messaging-citations",
"pr": "#20609",
"session": "session_01XY5uCwTjZj7884yYtyur4H — the dispatching seat's session (subagent mode; the claim and the container's CLAUDE_CODE_REMOTE_SESSION_ID both name it)",
"premise_still_valid": true,
"summary": "Stage service-messaging of #20596, ruling C+D form C, the method of PR #20533. 127 dead comment/docblock sites on 109 lines in 28 files under packages/services/service-messaging/src (97 census sites plus 30 test-comment sites the census defers), covering 14 numbers, now cite the commit that decided them: 13 distinct shas, each unique (rev-parse --disambiguate count 1) and an ancestor of base 7a1faf1 (merge-base --is-ancestor exit 0); history was unshallowed first. No ADR or ruling record exists for any of the 14 numbers, and none was dropped. Comments only: 116 lines out, 116 in, every file's line count unchanged; the TypeScript leaf-token guard reads 0 files with a code token change; 0 citation numbers added and no PR number on an added line. Left on purpose and listed in the PR body: 3 refusal-string sites in outbox.ts (form D; the landed #20234 stages rewrote no refusal text, so they are left), 9 test-title strings, and 3 generated .source-hashes.generated.ts headers whose producer is packages/cli/src/utils/i18n-extract.ts:2294. A3 measured that the rewritten docblocks ship in dist, so a patch changeset is included and skip-changeset was not applied. PR body line 1 is Part of #20596, with Clause-②: no on line 2.",
"census": {
"instrument": "node scripts/check-issue-citations.mjs --census --json (the gate's own, unchanged, read-only); count = allocated-but-absent findings under packages/services/service-messaging/",
"before": "100 sites on 82 lines in 22 files, 13 numbers — base 7a1faf1, run 2026-09-29T06:31:54Z..06:35:25Z, board enumerated 185 pages, frontier #20606, 18433 numbers; whole-repo allocated-but-absent 2457",
"after": "3 sites (the 3 generated #11671 headers) — head 6852007 (src identical at final head 267c115, which adds only the changeset), run 06:48:33Z..06:52:17Z, same board shape; whole-repo allocated-but-absent 2360 (drop 97 = this diff's census sites; resolves 32744 in both runs)",
"supplementary": "gate's own extractCitations + classifyCitation over all 87 .ts files in service-messaging/src incl. tests and strings, same board: before 142 dead (src comment 100, test comment 30, src string 3, test string 9) → after 15 (src comment 3 generated, src string 3, test string 9); resolving 450 and PR 21 unchanged",
"truncated_first_run": "the first census run (06:25:55Z, same base) enumerated only 85 pages, frontier #8854, 8444 numbers, exit 0, 16187 never-issued — discarded; see out_of_scope_findings"
},
"tests": "At final head 267c115. (1) OS_VERIFY_LOCK_SLOT=issue-20596-dev os-verify-lock.sh -c 'pnpm --filter @objectstack/service-messaging test' → VERDICT command-exit 0; Test Files 46 passed (46), Tests 507 passed (507). (2) same lock, 'pnpm --filter @objectstack/service-messaging typecheck' → VERDICT command-exit 0; npx tsc --noEmit --listFiles lists 46 of 46 test files and 87 files under src. (3) Citation gate as CI runs it: pnpm check:issue-citations exit 0 (self-test 114 cases, 8 batteries); node scripts/check-issue-citations.mjs exit 0 (diff-scoped: 5 citations judged across 19 files, 5 resolve). (4) Mechanical guard (TypeScript leaf tokens, comments and JSDoc excluded, base 7a1faf1 vs HEAD, 28 files): 52337 base tokens, 0 files with a token change, exit 0. Controls via scripts/ablation-replace.mjs on outbox.ts, each restore proven blob == HEAD 80618f8711e2 and git diff HEAD empty: comment insertion → 0 files, exit 0; declaration inserted → DIFFER, exit 1 (first attempt was a no-op: anchor text sat inside the replacement, ablation-replace refused with anchor count 1 → 1 before the guard ran; redone with a hitting anchor, anchor 1 → 0); one digit changed in the kept outbox.ts:210 refusal string → DIFFER, exit 1. (5) A3 publish measurement: pnpm --filter @objectstack/service-messaging build, files[] = dist, README.md, CHANGELOG.md; dist/index.d.ts carries d9cf78e x8, 1a47a53 x6, 17d0954 x6; dist/index.js carries e4902d2 x15; positive control (unchanged notification-subscription docblock sentence) 1 hit in dist/index.d.ts; negative control phrase 0 hits; only the two kept refusal strings still carry #11453/#11859 in dist → ships bytes → patch changeset. (6) Lint as a proven narrowing: eslint --no-inline-config --format json over the 28 touched .ts files → exit 0, 28 files, 0 errors, 0 warnings; 28 of 28 have isPathIgnored false; eslint.config.mjs has no parserOptions.project (its line 328 says so), so no untouched file's verdict can move. Repo-wide pnpm lint is CI's. (7) Control-byte self-scan of the 28 files: grep exit 1 (none). No ablation of product code was needed: nothing but comments changed.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 267c115 derived 64 commands (all 50 of the dispatch list plus 14: check-adr-0087-registration x2, check-empty-changeset x2, release-rehearsal-clone --self-test, check:dispatcher-error-vocabulary, check:engine-double-contract, check:objectql-double-limit, check:objectui-changeset, check:pm-changeset-deadline-census, check:query-options-erasure, check:type-check-coverage, check:type-check-debt, check:where-matcher). Each was run with its exit code captured before any pipe: all 64 exit 0. First-pass exit 3 (PREREQUISITE NOT MET, unbuilt workspace) on check:dual-build-cjs-loads, check:i18n, check:type-check-debt; then os-verify-lock.sh -c "timeout 540 pnpm exec turbo run build --filter='./packages/' --filter='./packages//*' --concurrency=2" → VERDICT command-exit 0, 71 tasks; reruns: check:dual-build-cjs-loads exit 0, check:i18n exit 0 (9 packages in sync), check:type-check-debt exit 3 again (service-messaging dist older than outbox.ts mtime after the guard controls; turbo cache hit), then pnpm --filter @objectstack/service-messaging build (lock, exit 0) and check:type-check-debt exit 0 (4 entries re-measured, none above its number). node scripts/pm/dispatch-gates.mjs --ran ran.list --repo objectstack-ai/objectstack → exit 0: 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN. dispatch-gates stderr flagged a stale tree (origin/main 6 commits ahead; the one changed input, scripts/sdui-manifest.record.json, is outside this diff). CI on the PR at 07:25Z: 31 check runs, 11 success, 3 skipped, 17 in_progress, 0 failure — in_progress, not awaited.",
"line_budget": "git diff --shortstat 7a1faf1..267c115: 29 files, 126 insertions, 116 deletions. 28 source files 116/116 with every file's line count unchanged (109 lines carried a dead site, 7 are reflow/referent halves: inbox-caller.ts:87,:88, messaging-service.test.ts:972, notification-keyed-text-bounds.test.ts:83, notification-subscription.object.ts:81,:82, sql-outbox.ts:281); 1 new changeset, 10 lines. 242 changed lines, below the 5000 human-merge threshold; no governed surface touched.",
"files_changed": "packages/services/service-messaging/src/{delivery-update-tenant-audit.integration.test.ts, dispatcher.ts, email-channel.test.ts, email-channel.ts, http-dispatcher.ts, http-outbox-ack-claim-ownership.integration.test.ts, http-outbox.ts, inbox-caller.ts, index.ts, memory-outbox.ts, messaging-service.test.ts, messaging-service.ts, outbox-ack-claim-ownership.integration.test.ts, outbox-ack-precondition.integration.test.ts, outbox-dispatcher-scope.ts, outbox.ts, sms-channel.test.ts, sms-channel.ts, sql-http-outbox.ts, sql-outbox-audit-columns.test.ts, sql-outbox.ts, translations/index.ts, objects/notification-delivery.object.ts, objects/notification-keyed-text-bounds.test.ts, objects/notification-preference.object.ts, objects/notification-receipt.object.ts, objects/notification-subscription.object.ts, objects/notification-template.object.ts} (28) + .changeset/service-messaging-provenance-anchors.md (1). Commits 6852007 (comments) and 267c115 (changeset), model-free trailer pair, no card trailer.",
"deviations": "(1) Scope includes the 30 test-comment sites the census defers, because the claim's surface is src/** and PR #20533 rewrote test comments too; they are counted by the supplementary instrument, not the census. (2) Seven lines without a dead site changed (listed in line_budget), as reflow or a lost referent, the same allowance PR #20533 used. (3) Four census enumerations plus one discarded truncated one: the discarded run is reported, not used. (4) type-check-debt needed a direct service-messaging rebuild because the guard controls moved outbox.ts's mtime (bytes restored identical). (5) Labels: none added; the dispatch named only the assignee plus skip-changeset if nothing shipped, and A3 measured that it ships. The labeler bot's documentation, size/m, tests and tooling are not mine. No other deviation from the dispatch.",
"mcp_calls": "0 — no MCP tool used",
"api_writes": "3 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches (repository_dispatch) executed by fleet-write.yml as objectstack-fleet[bot]: (a) fw-20260929T072357Z-02f946, run 36536391794 success → POST /repos/objectstack-ai/objectstack/pulls (draft, #20609); (b) fw-20260929T072448Z-d58fe9 via label-write.mjs, run 36536475661 success → POST /repos//issues/20609/assignees (os-justin), read back MATCHES; (c) the os-dev-report comment on #20596 via post-stamped.mjs → POST /repos//issues/20596/comments. Plus 3 git pushes (branch probe, 6852007, 267c115). Reads were REST GETs with the session token.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: no public door — internal instrument; named consumer: the PM census readings that size these stages (census 5884031174 on #20556, and this card's before/after counts) · evidence: node scripts/check-issue-citations.mjs --census --json at base 7a1faf1, 2026-09-29T06:25:55Z, exit 0, returned board {source: 'enumerated (85 pages)', frontier: 8854, size: 8444} and tally never-issued 16187, when #20596 exists; the 85th cursor page's Link header carried no rel=next, enumerateBoard (scripts/check-issue-citations.mjs:624) stopped and nothing compares its frontier with the newest number (probeBoard does read per_page=1 direction=desc). A reader counting allocated-but-absent would have got 8 service-messaging sites instead of 100, silently. Four later enumerations in the same session read 185 pages, frontier #20606. Intermittent: 1 of 5 enumerations. Not changed here (no instrument change in this stage). If the reach bar is not met, carrier: whoever next edits scripts/check-issue-citations.mjs — 承接者:无 known; it is in the PR's Acceptance notes · dedupe words: enumerateBoard truncated, census frontier, never-issued inflation, check-issue-citations enumerate, rel=next missing",
"carrier: the next #20596 stage that takes packages/cli (or whoever edits packages/cli/src/utils/i18n-extract.ts) · noted, not filed — the generated provenance header line 2294 writes (#11671, maintainer ruling #12069 Option A, extending #8765 Option B) into 27 generated files; #11671 is dead. Fix at the producer and regenerate, never by hand-editing the generated copies",
"carrier: form D lane (the #20233-style runtime-string stages), 承接者:无 named for services · noted, not filed — outbox.ts:187 and :210 carry #11453/#11859 inside the NotificationAckError refusal messages, a runtime string class the landed #20234 stages did not rewrite"
]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — PR #20609 (stage service-messaging) at 267c1156 · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-29T07:28Z

Checklist, read on GitHub rather than from the report:

• Shape: a draft onto main, with first line Part of #20596 and no closing keyword anywhere in the body. The card stays open for later stages. Clause-②: no.
• Scope: 29 files, every one inside packages/services/service-messaging/src/** plus one changeset. +126 / −116, and every source file keeps its line count.
• Diff spot-read: outbox.ts rewrites [#11859] → [commit d9cf78eaa] and [#11453] → [commit 1a47a5368] in comments only.
• Census, the gate's own instrument: 100 dead sites before, 3 after. The 3 left are generated headers whose producer is in packages/cli. The supplementary scan also covered the 30 test-comment sites the census defers.
• Changeset: patch. It is owed because the rewritten docblocks ship in dist, which the dev measured with a positive control.
• Nit, not blocking: the changeset file is service-messaging-provenance-anchors.md, where the runbook's convention is 20596-….

Left on purpose, and listed in the PR:

• 3 form-D refusal strings in outbox.ts, since the landed spec stages rewrote no refusal text;
• 9 test-title strings;
• 3 generated headers.

Findings:

• The census instrument's board enumeration truncated once in five runs (85 pages, frontier fix(runtime,mcp,service-datasource): the #6504 consumer sweep — three list consumers stop claiming what a known-partial read cannot support #8854) and still exited 0. → Pointer comment on [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556, the carrier whose readings that instrument sizes. It is the cursor-exhaustion class references/rest-channel.md already records.
• The generated #11671 header → carrier: the stage that takes packages/cli (the producer is i18n-extract.ts). Noted.
• The form-D refusal strings → carrier: the runtime-string lane. Noted.

After landing: Part of means this card returns to pm:queue, with a Release: line naming the next stage. plugin-security stays last, because its files are hot.

Landing: waits for every check to be green, and for the at-tier contract review the .changeset prose owes (running).

---

Generated by Claude Code

[objectstack-fleet]

Stage service-messaging landed · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-29T07:59Z

PR #20609 (Part of #20596) merged through the merge queue as 422db788 on origin/main. The contract review PASS on the landed head is 5885837230.

• Landed: 127 dead comment and docblock sites in packages/services/service-messaging/src/**, re-anchored to the commits that decided them (ruling C+D, form C). On the gate's own census, service-messaging went from 100 to 3 sites.
• Left in service-messaging, each with its carrier:
  • 3 generated #11671 headers → the stage that takes packages/cli, whose producer is i18n-extract.ts;
  • 3 form-D refusal strings in outbox.ts → they are already held by the shrink-only doc-authoring-prose-id baseline;
  • 9 test-title strings.

Release: session session_01XY5uCwTjZj7884yYtyur4H, because stage 1 of this multi-stage card has landed, and the card returns to pm:queue for the next stage. The next stage is, by census, the largest package no in-flight work holds: plugin-sharing (63) or plugin-auth (52). plugin-security (143) stays last while its files are hot (#20580 is in flight, #20604 is queued).

---

Generated by Claude Code