feat(spec): an email field declares itself a correspondent address for inbound mail (FieldSchema.mailAssociation)

[objectstack-fleet]

Part of #22870
Clause-②: yes (widening)

PR 1 of 2 on #22870, as ruled in 6116489638 (Q1 → A) and built from the stage-0 report 6115941082 §3.3, §3.5 and §4. PR 2 (packages/services/service-mailbox: the three objects, both read gates, manage_mailboxes and the mailbox token) stays on the card, so #22870 remains open after this lands. The key's runtime reader is the sibling ingest card #22871, which is Blocked-by: #22870.

The ruling executed (verbatim, not re-ruled)

Q1 → A. The seam is a declared field-level key. FieldSchema.mailAssociation: true, valid only on type: 'email' and refused at parse on any other type (the referenceVia refine's shape). Input: the participant set (normalised addr-specs from From, Sender, Reply-To, To and Cc, plus Q3's forwarded-part headers, minus the mailbox's own addresses), scoped to the mailbox's organisation. Output: { object, recordId, matchedField, matchedAddress } rows, which become sys_mail_association links; an empty set means the pool. The platform learns which fields carry a correspondent address and never what a contact is. No published resolver contract in phase 1.

The card's constraint, verbatim: "Declared = enforced. Every key this card adds must get its runtime reader in the sibling ingest card, or it is not added. Liveness rows start planned and leave it when the reader lands."

What

Surface	Change
FieldSchema (packages/spec/src/data/field.zod.ts)	mailAssociation: z.boolean().optional() beside referenceVia. The TSDoc and the describe state the input, the output, the organization scope and the one legal type. No default, so undefined always means "not authored".
The parse door	FieldSchema's superRefine, right after the two referenceVia checks. On any type but email the key (TRUE or FALSE) gets one custom issue at [mailAssociation]. The message names the field's type and the remedy: change the type to email, or drop the key.
Studio	field.form.ts: one row, "Match Inbound Mail", visibleWhen: "data.type == 'email'". This is a parse gate, so the row shows exactly where the key parses. The help text says where the key takes effect ("only where a mailbox service is set up"), not when. The zh-CN, ja-JP and es-ES leaves are hand-authored.
Liveness	liveness/field.json: planned, authorWarn: true, authorHint "Keep it: no mailbox service reads this yet; it takes effect when the mailbox capability ships." The note names the flip condition: the row goes live when the #22871 ingest lands, citing its matcher, and drops authorWarn / authorHint in the same edit.
Changeset	.changeset/22870-field-mail-association.md: @objectstack/spec minor, Clause-②: yes (widening); @objectstack/driver-sql, @objectstack/metadata-core and @objectstack/platform-objects patch (added in the patch round, seat order 6117707461).

Nothing outside packages/spec reads the key yet. No object, gate, capability name or capability token is added; those belong to PR 2.

Declared = enforced

Half	Where	State after this PR
Parse (authoring)	FieldSchema superRefine	Enforced: refused off email
Author warning	@objectstack/lint liveness-planned-property, at objectstack validate / objectstack lint and the metadata save door	Live: an authored mailAssociation: true warns with the authorHint
Runtime reader	Mailbox service ingest and re-match (#22871)	Not yet. The row is planned until that reader lands

Mechanism assumptions, measured at origin/main 018b077fb

1. Holds. git grep -c mailAssociation -- packages answers 0 hits (exit 1). Control: git grep -c referenceVia -- packages/spec/src/data/field.zod.ts answers 12.
2. Holds. The referenceVia type check sits at field.zod.ts:2173–:2200, inside FieldSchema's superRefine. The pin expect([...authorWarnedProperties('field')]).toEqual(['conditionalRequired']) sits at lint-liveness-properties.test.ts:1624.
3. Holds. dropped-refinements.baseline.json gains no site. data/Field already carries the root site "", the file is unchanged, and check:authorable-surface is green.
4. Partly holds. These generated shards moved: authorable-surface/data.json (+1 line, written by the spec build), content/docs/references/data/field.mdx, .../data/object.mdx and .../system/migration.mdx (from gen:docs), and liveness/state-counts/field.md (from gen:liveness-counts). The predicted json-schema.manifest/ shards did not move. After regeneration check:generated answers "All 14 generated artifacts are up to date".
5. Holds. No gate demanded a governed surface. Five non-governed classification ratchets did, listed in the next section.

Files beyond the claim's declared surface (each demanded by a pin; none governed)

The claim fenced field.zod.ts, field.form.ts, one new spec test, liveness/field.json, the authorWarnedProperties('field') pin, the generated artifacts and one changeset. A new FieldSchema key and a new form row are also counted by the ratchets below, and each one is red until the key is classified. The dueLike precedent (215e662) paid the same set.

• packages/drivers/driver-sql/src/builtin-column-collision.ts: FIELD_KEY_STORAGE_CLASS is pinned against FieldSchema.shape. The new entry is mailAssociation: 'presentation'.
• packages/metadata-core/src/object-schema-fls-references.ts: FIELD_REFERENCE_POSITIONS is pinned against FieldSchema.shape. The new entry is keep, because the key is a boolean that names no field.
• packages/metadata-protocol/src/protocol.meta-types-degenerate-derivation.test.ts: the served field property count moves 78 → 79.
• packages/lint/src/validate-predicate-path-refs.test.ts: the shipped-form predicate census moves 87 → 88, and the literal-comparison census moves 64 → 65.
• packages/platform-objects/src/apps/translations/*.metadata-forms.generated.ts: the row's label and help text, in en plus three hand-authored locales. In object-lifecycle-panel-echo-decisions.test.ts, the translated-label control moves 669 → 670.

Neither classification table changes runtime behaviour for a boolean. An unclassified key was already silent in driver-sql, and the FLS scrub already passed a boolean through. The changeset first named @objectstack/spec alone, as the precedent's did; the patch round (seat order 6117707461) added a patch entry for each of the three touched published packages, because every touched published package names itself in a changeset.

Tests (HEAD 52bcc8429)

• New spec test packages/spec/src/data/field-mail-association.test.ts (16 cases):
  • Accepted on email (TRUE and FALSE, full safeParse green), and no default materializes.
  • A non-boolean is invalid_type.
  • Refused on text, url, phone, textarea, lookup, formula, number and boolean. Each case gets exactly one custom issue at path ['mailAssociation'], naming type: 'email' and the offending type.
  • An off-type false is refused.
  • Positive control: the refusal is the only issue on the text fixture, and the same fixture without the key parses.
  • The JSON-schema projection carries an optional boolean mailAssociation.
  • The form offers exactly one row, gated data.type == 'email'.
• Ablation (committed state, scripts/ablation-replace.mjs with a trap restore):
  • The refusal condition was mutated to if (false && field.mailAssociation …, and the tool reported the anchor 1 → 0, blob 2a3049530 → a290fcd02.
  • Result: 10 failed | 6 passed (16). Every refusal case went red; the accept, projection and form cases stayed green.
  • Restore: blob back to the HEAD blob 2a30495308c6 and git diff HEAD empty, both from the tool and from the trap's own git hash-object comparison.
  • The test imports ./field.zod from source, so no dist sits on the path.
• @objectstack/spec, rebuilt at 52bcc8429: the full suite pnpm --filter @objectstack/spec test passed 649 files / 19410 tests (1 todo), and pnpm --filter @objectstack/spec typecheck exits 0.
• Downstream suites, each on a freshly built dependency closure (pnpm --filter 'PKG^...' build for the five packages):
  • @objectstack/lint: full suite, 137 files / 6529 tests passed.
  • @objectstack/metadata-core: full suite, 17 / 386 passed.
  • @objectstack/platform-objects: full suite, 69 / 1083 passed.
  • @objectstack/driver-sql: builtin-column-collision.test.ts, 11 passed.
  • @objectstack/metadata-protocol: protocol.meta-types-degenerate-derivation.test.ts, 18 passed.
  • typecheck exits 0 on all five.
• ESLint, narrowed to the 13 changed TS files (eslint --no-inline-config --format json): 13 files linted, 0 errors, 0 warnings.
  • The population is eslint.config.mjs's files: ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}']; no changed file is ignored.
  • The config never enables type-aware linting (eslint.config.mjs: "no parserOptions.project, no typed @typescript-eslint rules"), so this diff cannot move a verdict on an untouched file.
  • The repo-wide pnpm lint is CI's.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 114 commands at merge base 018b077fb. Each one was run with its exit code recorded before any pipe, then reconciled with --ran: 114 derived, 112 run, 2 NOT-MEASURED, 0 UNRUN.

• pnpm check:i18n first answered PREREQUISITE NOT MET. It was re-run after building its stated prerequisite closure, and answered "all bundles in sync, no undeclared authoring keys" for 9 packages. That makes the hand-authored locale leaves byte-identical to the extractor's output, with the *.source-hashes.generated.ts files untouched. check:lean-entry-closure likewise went exit 3 → exit 0.
• NOT MEASURED: check:skill-examples. Reason: the client SDK packages are not built with declarations, and this diff touches no skill or example.
• NOT MEASURED: check:dual-build-cjs-loads. Reason: it needs every package built with declarations, while the local i18n prerequisite build was JS-only.
• check:platform-checklist exits 1 with 8 ABSENT SYMBOL / ANCHORS LOST problems in docs/qa/platform-checklist/areas/*.json. The control run on a detached 018b077fb checkout answers the identical 8, so this is not this diff. The gate is kept out of per-PR CI by checklist-status.yml's own note.

Acceptance notes

• packages/spec/liveness/README.md's field cell still says the type "carries NO authorWarn row at any depth". That was already untrue before this PR (conditionalRequired's dead row has warned on its own since the verdict-warns ruling), and it is further from true now. Prose only; no gate reads it. Carrier: none.
• lint-liveness-properties.test.ts's "field walk: a malformed fields array …" block could take mailAssociation as a real subject. It is not re-subjected here because a planned row is scheduled to flip live, which is exactly the subject loss that block's neighbour exists to survive.
• No hand-written docs page (content/docs/data-modeling/fields.mdx) is added. The reference page carries the describe, and a narrative page belongs with the reader, so no page advertises a capability that nothing delivers yet.

Review

Clause-②: yes (widening) on packages/spec, so a review at CONTRACT_REVIEW_TIER is owed before landing. No governed surface is in the file list.

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/driver-sql, @objectstack/metadata-core, @objectstack/platform-objects, @objectstack/spec, touching 8 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/spec/authorable-surface/data.json, packages/spec/liveness/field.json, packages/spec/liveness/state-counts/field.md), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-driven.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/external-datasources.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/field-types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/validation-rules.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/troubleshooting.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/validating-metadata.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/getting-started/quick-reference.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/kernel/contracts/data-engine.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/backward-compatibility.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectql/types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectui/concept.mdx (via FieldSchema (symbol, a top-level const))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/releases/v17/17-1.mdx (via FieldSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 changed file(s) yielded no anchor (packages/spec/authorable-surface/data.json, packages/spec/liveness/field.json, packages/spec/liveness/state-counts/field.md) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e357a441c6423798a673d4a39ecee4b31adacf79 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 80f8d66a607562d2acbf19dcec3771903b4be343 — the merge of head 1986ccb7414e85791d12961955aa9c83d90b1af2 into base e357a441c6423798a673d4a39ecee4b31adacf79, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 80f8d66a607562d2acbf19dcec3771903b4be343 && git checkout 80f8d66a607562d2acbf19dcec3771903b4be343
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e357a441c6423798a673d4a39ecee4b31adacf79 1986ccb7414e85791d12961955aa9c83d90b1af2 && git checkout -B drift-repro e357a441c6423798a673d4a39ecee4b31adacf79 && git merge --no-ff 1986ccb7414e85791d12961955aa9c83d90b1af2

node scripts/docs-audit/affected-docs.mjs --json e357a441c6423798a673d4a39ecee4b31adacf79

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e357a441c6423798a673d4a39ecee4b31adacf79 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1986ccb7414e85791d12961955aa9c83d90b1af2
Local-runs: none

PR #22943, PR 1 of 2 on card #22870 (Part of; the card stays open for PR 2), branch claude/issue-22870-p1-mail-association-key: 20 paths, +291 / −13 against main at the merge base 018b077fb. Inputs read, and nothing else: the card body and all 11 comments (the stage-0 report 6115941082, the ruling 6116489638, the claim 6116810037, the two os-dev reports 6117670284 and 6117732579, the seat order 6117707461, the ACCEPT 6117746501); the PR body, its file list and the net diff; the check-runs on this head. Base files were read with git show origin/main:PATH; nothing was built, run or re-run. Rendered by an isolated at-tier subagent of the dispatching seat's session; the dispatch order and the seat's ACCEPT were read as inputs, not adopted.

① Derived judgments

Each accept-set or public-surface change the diff implies, judged.

1. FieldSchema accept set — RIGHT, a pure widening. packages/spec/src/data/field.zod.ts gains mailAssociation: z.boolean().optional() (no default, so undefined always means "not authored") beside referenceVia. On type: 'email', true and false now parse and are kept; a non-boolean is invalid_type. On every other type the key is refused by one custom issue at path ['mailAssociation'] naming the field's type and the remedy, in the referenceVia refine's shape (!== undefined, so an authored false off-type is refused too — the dueLike rule). Not a narrowing anywhere: FieldSchema is built with strictObject(...) at the base, so at the merge base the key was already an unknown-key refusal on every type; off email only the refusal's text changes, never the verdict. This is ruling 6116489638 Q1 → A verbatim (a field-level key, email only, refused at parse). The refusal prose, the describe, the author hint and the help text carry no tracker number.
2. Published type and served schema — RIGHT. The Field type gains an optional boolean member; the JSON-schema projection carries mailAssociation as an optional boolean with its describe (pinned); authorable-surface/data.json gains data/Field:mailAssociation; /meta/types serves field with 79 properties (78 → 79, pinned in metadata-protocol). json-schema.manifest/ shards unchanged is right: that directory is a name-only ratchet of emitted schemas and no schema is added. dropped-refinements.baseline.json unchanged is right: data/Field already carries the root site. check:api-surface, check:authorable-surface and check:generated run in the Lint & Repo Gates lane (state below).
3. Studio offer — RIGHT. field.form.ts adds one row, label "Match Inbound Mail", visibleWhen: "data.type == 'email'", so the designer offers the key exactly where the door accepts it (a parse gate, like the deadline pair). The help text says where it takes effect ("only where a mailbox service is set up"), not when. Consequences paid: the lint predicate censuses 87 → 88 and 64 → 65; the metadata-form bundles in en / zh-CN / ja-JP / es-ES (the en label and help text byte-equal to the form row); the translated-label control 669 → 670. The *.source-hashes.generated.ts files staying untouched is right: those digests cover objects.generated.ts leaves, and a hand-written leaf makes no digest claim. The help text's "sender or a recipient" is a Studio simplification of the normative participant set the describe and TSDoc spell out (From, Sender, Reply-To, To, Cc, plus a forwarded part); acceptable.
4. Liveness ledger — RIGHT, and the card's constraint is met. liveness/field.json gains mailAssociation: planned, authorWarn: true, authorHint "Keep it: no mailbox service reads this yet; it takes effect when the mailbox capability ships." The README's two truthfulness rules hold: the hint is the right corrective (keep, never remove), and with no materialized default the lint warns only on an authored true. The evidence cites the enforced half (the parse door and its pins); the note names the flip condition (the connector-imap + minimal service-mailbox: shared-mailbox (forward/BCC) ingest into sys_mail_message, associated at ingest through the seam — phase 1 of #8998 inbound mail #22871 matcher lands → live, with authorWarn and authorHint dropped in that same edit). state-counts/field.md 3 → 4 planned, 98 → 99 classified, generated. Check-run Spec property liveness: success.
5. @objectstack/lint behaviour, through the ledger — RIGHT; it is the "author warning" half the PR claims. authorWarnedProperties('field') becomes ['conditionalRequired', 'mailAssociation'], which re-opens the lint's field walk (if (fieldWarn.size > 0)) for shipped ledgers: an authored mailAssociation: true now draws liveness-planned-property at objectstack validate / lint and the metadata save door. The pin is updated, not deleted, as the claim required, and its comment names the scheduled move. No lint source moves; both lint files in the diff are tests.
6. FIELD_KEY_STORAGE_CLASS (@objectstack/driver-sql, exported) — RIGHT. mailAssociation: 'presentation': a boolean read by a service, never by createColumn; the column stays the email string the type sizes. The pin against FieldSchema.shape demanded the row.
7. FIELD_REFERENCE_POSITIONS (@objectstack/metadata-core, exported) — RIGHT. mailAssociation: keep: a boolean facet naming no field, so the FLS scrub passes it through on a served field (a denied field is dropped whole upstream). Both rows are the dueLike precedent's shape (215e66204).
8. Docs — RIGHT. Three generated reference pages carry the describe verbatim. No hand-written narrative page: right while nothing delivers the capability, and the one narrative page the drift check names for this surface (data-modeling/field-types.mdx) enumerates no per-type keys that this one would falsify.
9. Scope fence — RIGHT. No object, read gate, capability name, capability token or service package: PR 2's surface stays on the card. No governed path in the file list (Governed Surface Queue Guard: success). No ADR governs the key beyond ADR-0049, which the parse seam plus the planned + authorWarn row satisfy under the card's own sanction; the ADR grep for inbound mail finds only ADR-0041's unbuilt trigger-email-inbound idea.

Obligation carried forward, not a finding: the describe promises an effect ("associates the message with every record of this object…") that nothing in this repo delivers yet. The card sanctions that window ("Liveness rows start planned and leave it when the reader lands") and the warning reaches every author who sets the key; the row flips live with #22871's matcher, and if that reader never lands the key comes out, by the card's own words ("or it is not added").

② Semver level

• .changeset/22870-field-mail-association.md: @objectstack/spec minor; @objectstack/driver-sql, @objectstack/metadata-core, @objectstack/platform-objects patch — RIGHT. A new optional authorable key widens a published accept set, which takes at least minor; the three patch rows name the published packages whose shipped source moved (one classification row each, and four locale bundles), none changing behaviour for a boolean. @objectstack/metadata-protocol and @objectstack/lint move tests only and are rightly absent. All four named packages sit in the fixed group, so they version together either way.
• Not skip-changeset, not major; no **BREAKING banner, no !, and no ADR-0087 marker owed (nothing removed or renamed, no conversion entry). Check Changeset: success on this head (both runs); check-changeset-no-major and check-adr-0087-registration exit 0 per the patch-round report.
• The direction arm, as judged on the diff and as the changeset body and the PR body both carry it:

Clause-②: yes (widening)

Right: the diff widens one accept set (① 1) and narrows none; yes with the (widening) arm is the legal pair, and minor is at least what yes takes.

• One body drift, not a defect: the PR body's "What" table still says the changeset names @objectstack/spec alone; the head's changeset names four packages, as the seat order 6117707461 and the ACCEPT 6117746501 record. A body refresh is housekeeping for the seat, not a gate.

③ Boundary flags

Every dev flag and every open_questions entry on this PR, answered or escalated.

Round-1 report 6117670284, deviations:

1. Files beyond the claim's five paths (driver-sql, metadata-core, metadata-protocol, the lint census, the platform-objects bundles and control) — answered: each is a pin that moves with any new authorable field key, none governed; the seat amended the surface in 6117707461; precedent 215e66204 paid the same set. Right to take under the dispatch's assumption 5.
2. Changeset naming spec alone — superseded by the patch round at this head; judged in ②.
3. authorHint reordered to lead with "Keep it:" — answered: the hint is the corrective one-liner the CLI prints as the fix line; the content is the proposal's; the order follows the planned default idiom.
4. Row label "Match Inbound Mail" and the == predicate form — answered: none was prescribed; == is the referenceVia precedent; both census pins were moved with the measured reason written in.
5. Locale leaves hand-authored to the generator's format, then verified in sync by check:i18n — answered: acceptable; the digest files make no claim on hand-written leaves; the Lint & Repo Gates lane re-asks check:i18n in CI.
6. check:dual-build-cjs-loads NOT MEASURED locally (JS-only prerequisite build) — answered: CI answers it; this diff adds no entry point or export shape a CJS load could newly miss.
7. Commit trailers in AGENTS.md's model-free pair rather than the harness reminder's — answered: AGENTS.md is the repo's rule and the pre-push hook enforces it; the reminder yields to repo instructions by its own sentence.
8. Four pushes — answered: AGENTS.md's WIP-push rule; not a deviation.

Round-1 report, out_of_scope_findings, and the PR body's Acceptance notes:
9. packages/spec/liveness/README.md field cell still says the type "carries NO authorWarn row at any depth" — answered, routed: prose no gate reads, already untrue on main; not owed by this PR, and that cell's own sentence anticipates this row ("recorded because the next warned field row re-opens that walk"). Carrier: PR 2 on this card, or a docs-only follow-up; the seat decides.
10. check:platform-checklist exits 1 on main (8 problems, identical on the detached base) — answered: not this diff; outside per-PR CI; its carrier is the board-snapshot watchdog.
11. The lint "field walk: a malformed fields array" block not re-subjected with mailAssociation — answered: right; a row scheduled to flip is no stable subject, which is the very loss the synthetic subject exists to survive.
12. No hand-written docs page — answered: right (① 8).
13. check:skill-examples and check:dual-build-cjs-loads NOT MEASURED — answered: CI's lanes answer them; state below.

Patch-round report 6117732579: deviations and open_questions both empty; nothing to answer.

open_questions: the PR-1 reports carry none. The stage-0 report's Q1 to Q5 were closed by ruling 6116489638 (Q1 A · Q2 C3 · Q3 C staged · Q4 A · Q5 A); this diff executes Q1 → A only, and Q2 / Q3 / Q4 / Q5 bind PR 2 and #22871, not this head. Nothing escalated.

Check-runs on this head, as read in this act

The conclusions are the gate verdicts. At this reading every check-run on the head is completed; none is in_progress or queued, and none concluded failure. The seat separately requires every check green before the queue; at this reading they are.

39 check-runs on the head.

• success: Auto Label, Build Core, Build Docs, Check Changeset (2 runs), Check Documentation Links, Check PR Size, Dogfood Regression Gate, Dogfood Regression Gate (1/3), Dogfood Regression Gate (2/3), Dogfood Regression Gate (3/3), Dogfood Verify CLI, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, Temporal Conformance (live PG + MySQL), Test Core, Test Core (1/6), Test Core (2/6), Test Core (3/6), Test Core (4/6), Test Core (5/6), Test Core (6/6), The card this PR closes must claim this branch, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check, filter.
• skipped (the path filter, by design): Auto Label, Check PR Size, Console Pin Gate, Packed-tarball smoke (opt-in) (2 runs).
• failure / cancelled / timed_out / action_required: none.

Implemented-by: claude/issue-22870-p1-mail-association-key
Reviewed-by: session_019G5ZnRrTMiwcHG6iZM19zf

VERDICT: PASS

_{read 2026-10-12T04:49Z.}

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 38205616907 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core — 失败步骤: Check the per-package suite-duration ceilings（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 8 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 38206500175 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (6/6) — 失败步骤: Check this shard's timing drift（日志不可读，点进 job 看）
• Test Core — 失败步骤: Verify test shard results、Check the per-package suite-duration ceilings（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️ 本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 12 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)