fix(mcp, email, knowledge, queue, sms, storage, trigger, i18n): runtime strings state each decision in words instead of a tracker number

Stage 2 of the services lane: every ledgered tracker-number occurrence in
connector-mcp, plugin-email, service-storage, service-knowledge,
service-queue, service-sms, trigger-record-change and service-i18n (22
occurrences in 21 string sites) is gone. Where the sentence already said
what was decided, only the citation goes; where it leaned on the number,
it now says the decision in words. The change-email notice template
description changes in all four locales.

The doc-authoring ledger is recomputed with --census-ledger: the 14 file
blocks of these packages are deleted and no other row moves. Four test
assertions that pinned an id now pin the sentence that replaced it. Text
only: no status, error code, field, route or control flow moves.

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20751-services-strings-stage2-state-the-decision.md

@@ -0,0 +1,25 @@
+---
+'@objectstack/connector-mcp': patch
+'@objectstack/plugin-email': patch
+'@objectstack/service-knowledge': patch
+'@objectstack/service-queue': patch
+'@objectstack/service-sms': patch
+'@objectstack/service-storage': patch
+'@objectstack/trigger-record-change': patch
+---
+
+MCP stdio, email, knowledge, queue, SMS, storage and record-trigger refusals, warnings and template descriptions no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+Some strings these seven packages show to operators, administrators and flow authors pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- `@objectstack/connector-mcp`: the declarative stdio refusals say a stdio transport launches a local process, so stack metadata may only name a command the host's own code allows, and that an http transport is not gated by this policy.
+- `@objectstack/plugin-email`: the built-in change-email notice template's description, in all four locales, says the notice goes to the previous address so a hijacked session cannot move the account identity unannounced; the internal-headers refusal says a missing header does not announce itself, so the send would succeed while silently deviating from what was authored; the over-limit attachments line says the storage capability holds large content outside the row while the row keeps a reference and the attachment's audit metadata.
+- `@objectstack/service-knowledge`: the no-identity retrieval warning says a missing identity is not a grant of authority, so retrieval fails closed rather than searching the whole corpus unscoped; the predicate-write warning says the lifecycle reap guard de-indexes retention-swept rows before they are deleted.
+- `@objectstack/service-queue`: the missing-retention refusal says the one platform reaper sweeps completed rows by that declaration, so the adapter does not sweep the table itself; the rejected-floor error says the floor is what makes the lifecycle service refuse an override below the idempotency window.
+- `@objectstack/service-sms`: the unreadable-counter warning says a quota the platform cannot count must not refuse the one-time codes users sign in with; the counter store's lines name the daily SMS send quota without a number.
+- `@objectstack/service-storage`: the reclamation-gate line says deleting bytes cannot be undone, so it waits for a verified migration with no deviation on record, while reversible work carries on.
+- `@objectstack/trigger-record-change`: the array-trigger warning says multi-event arrays are deferred until two independent projects need a combination other than created-or-updated.
+
+Text only: no status, error code, field, route or control flow moves. A client or log filter that matches the old text (for example a tracker-number suffix) needs the new spelling.

packages/connectors/connector-mcp/src/mcp-provider.ts

@@ -138,14 +138,16 @@ function assertDeclarativeStdioAllowed(
     throw new Error(
       `connector-mcp provider: connector '${connectorName}' declares a stdio transport with command '${command}', ` +
         `which is not in the host's declarativeStdio allowlist [${policy.join(', ')}]. ` +
-        `Add the command to new ConnectorMcpPlugin({ declarativeStdio: [...] }) if this server is trusted (#3055).`,
+        `Add the command to new ConnectorMcpPlugin({ declarativeStdio: [...] }) if this server is trusted: a stdio ` +
+        `transport launches a local process, so stack metadata may only name a command the host's own code allows.`,
     );
   }
   throw new Error(
     `connector-mcp provider: connector '${connectorName}' declares a stdio transport (command '${command}'), ` +
       `but declarative stdio transports are disabled by default — a stdio transport launches a local process ` +
       `from stack metadata (including runtime Studio publishes). If this server is trusted, opt in deliberately: ` +
-      `new ConnectorMcpPlugin({ declarativeStdio: ['${command}'] }) — or use an http transport (#3055, ADR-0024 §4).`,
+      `new ConnectorMcpPlugin({ declarativeStdio: ['${command}'] }) — or use an http transport, which this policy ` +
+      `does not gate (ADR-0024 §4).`,
   );
 }
 

packages/plugins/plugin-email/src/email-service.ts

@@ -922,7 +922,8 @@ export class EmailService implements IEmailService {
         `EmailService: queue delivery skipped for one message — its attachments total `
         + `${encodedAttachments.totalBytes} bytes, over the ${SYS_EMAIL_ATTACHMENT_LIMIT_BYTES}-byte limit a `
         + 'sys_email row carries, so the message was delivered inline (in-process retries only) rather than '
-        + 'queued without them. Content that large is queueable through the storage capability (#5172), '
+        + 'queued without them. Content that large is queueable through the storage capability, which holds '
+        + 'it outside the row while the row keeps a reference and the attachment\'s audit metadata, '
         + `but ${encodedAttachments.storageDetail ?? 'that path was not attempted for this message'}. `
         + 'Fix: mount the storage capability (@objectstack/service-storage) so large attachments are '
         + 'stored out of the row and the message can be delivered durably.',

packages/plugins/plugin-email/src/internal-header-readback.ts

@@ -124,8 +124,9 @@ export async function readInternalHeadersJson(
     throw new Error(
       `EmailService: ${SYS_EMAIL_OBJECT}.${HEADERS_COLUMN} is declared \`internal: true\`, but this `
       + 'data engine does not implement resolveInternalField() — the custom headers this message was '
-      + 'authored with are stored but cannot be recovered, and a message must not be sent missing them '
-      + '(#8149). The row stays `queued`: the queue retry or the next boot outbox sweep delivers it '
+      + 'authored with are stored but cannot be recovered, and a message must not be sent missing them: '
+      + 'a missing header does not announce itself, so the send would succeed while silently deviating '
+      + 'from what was authored. The row stays `queued`: the queue retry or the next boot outbox sweep delivers it '
       + 'intact once an engine that implements the privileged accessor is mounted.',
     );
   }

packages/plugins/plugin-email/src/templates/auth-templates.ts

@@ -570,7 +570,7 @@ to end other sessions.`,
   variables: EMAIL_CHANGE_NOTICE_VARIABLES,
   active: true,
   isSystem: true,
-  description: 'Sent to the PREVIOUS address when a change-email request is accepted (#8019). Notification only — never gates the change.',
+  description: 'Sent to the PREVIOUS address when a change-email request is accepted, so a hijacked session cannot move the account identity unannounced. Notification only — never gates the change.',
 };
 
 export const AUTH_EMAIL_CHANGE_NOTICE_TEMPLATE_ZH_CN: EmailTemplate = {
@@ -598,7 +598,7 @@ export const AUTH_EMAIL_CHANGE_NOTICE_TEMPLATE_ZH_CN: EmailTemplate = {
 
 如果这不是您本人的操作，您的账号可能已被入侵。请立即联系您的 {{appName}} 管理员
 或支持团队，并修改密码以结束其他会话。`,
-  description: '在接受变更邮箱请求时发送至原邮箱地址（#8019）。仅为通知，绝不阻断变更流程。',
+  description: '在接受变更邮箱请求时发送至原邮箱地址，使被劫持的会话无法在原邮箱不知情的情况下转移账号身份。仅为通知，绝不阻断变更流程。',
 };
 
 export const AUTH_EMAIL_CHANGE_NOTICE_TEMPLATE_JA_JP: EmailTemplate = {
@@ -627,7 +627,7 @@ export const AUTH_EMAIL_CHANGE_NOTICE_TEMPLATE_JA_JP: EmailTemplate = {
 心当たりがない場合、アカウントが不正利用されている可能性があります。直ちに
 {{appName}} の管理者またはサポートへご連絡のうえ、パスワードを変更して他の
 セッションを終了してください。`,
-  description: '変更メールの要求が受理された際に変更前のアドレスへ送信されます（#8019）。通知のみで、変更を妨げることはありません。',
+  description: '変更メールの要求が受理された際に変更前のアドレスへ送信され、乗っ取られたセッションが元のアドレスに知られないままアカウントの識別情報を移せないようにします。通知のみで、変更を妨げることはありません。',
 };
 
 export const AUTH_EMAIL_CHANGE_NOTICE_TEMPLATE_ES_ES: EmailTemplate = {
@@ -657,7 +657,7 @@ aprobación.
 Si no has solicitado este cambio, tu cuenta podría estar comprometida. Ponte en
 contacto de inmediato con el administrador o el equipo de soporte de {{appName}}
 y cambia tu contraseña para cerrar las demás sesiones.`,
-  description: 'Se envía a la dirección ANTERIOR cuando se acepta una solicitud de cambio de correo (#8019). Solo notificación; nunca bloquea el cambio.',
+  description: 'Se envía a la dirección ANTERIOR cuando se acepta una solicitud de cambio de correo, para que una sesión secuestrada no pueda trasladar la identidad de la cuenta sin aviso. Solo notificación; nunca bloquea el cambio.',
 };
 
 /**

packages/services/service-i18n/src/i18n-route-ledger.ts

@@ -95,7 +95,7 @@ export interface I18nRouteLedgerEntry {
 export const I18N_ROUTE_LEDGER: readonly I18nRouteLedgerEntry[] = [
   { route: 'GET /api/v1/i18n/locales', family: 'i18n', disposition: 'sdk', client: 'i18n.getLocales' },
   { route: 'GET /api/v1/i18n/translations/:locale', family: 'i18n', disposition: 'sdk', client: 'i18n.getTranslations',
-    note: 'was a wire-level 404 — the client sent /translations?locale=xx, a shape no server mounts (the dispatcher domain body accepts it, but nothing routes a bare /translations to that body). Since #3636 the client sends the path form the spec declares.' },
+    note: 'was a wire-level 404 — the client sent /translations?locale=xx, a shape no server mounts (the dispatcher domain body accepts it, but nothing routes a bare /translations to that body). The client now sends the path form the spec declares.' },
   { route: 'GET /api/v1/i18n/labels/:object/:locale', family: 'i18n', disposition: 'sdk', client: 'i18n.getFieldLabels',
-    note: 'ditto — the client sent /labels/:object?locale=xx against a two-path-param mount (#3636).' },
+    note: 'ditto — the client sent /labels/:object?locale=xx against a two-path-param mount; it now sends both the object and the locale in the path.' },
 ];

packages/services/service-knowledge/src/__tests__/event-sync-data-events.test.ts

@@ -163,8 +163,8 @@ describe('#4626 — KnowledgeServicePlugin event sync on data.record.*', () => {
     await deliver(BULK_DELETED);
 
     const [message] = harness.ctx.logger.warn.mock.calls.at(-1) as [string];
-    expect(message).toContain('#4639');
-    expect(message).toContain('lifecycle reap guard (#4672)');
+    expect(message).toContain('cannot be repaired from the event stream');
+    expect(message).toContain('the lifecycle reap guard de-indexes those rows before they are deleted');
     expect(message).toContain('application-level predicate writes are not');
   });
 });

packages/services/service-knowledge/src/knowledge-service-plugin.ts

@@ -217,8 +217,9 @@ export class KnowledgeServicePlugin implements Plugin {
             `KnowledgeServicePlugin: '${object}' had a predicate write (${type}) affecting ` +
               `${typeof matched === 'number' ? matched : 'an unreported number of'} record(s). ` +
               'A bulk event carries a count, not records, so the knowledge index for this object ' +
-              'may now be stale and cannot be repaired from the event stream (#4639). ' +
-              'Retention-sweep deletes are covered separately by the lifecycle reap guard (#4672); ' +
+              'may now be stale and cannot be repaired from the event stream. ' +
+              'Retention-sweep deletes are covered separately: the lifecycle reap guard de-indexes those rows ' +
+              'before they are deleted; ' +
               'application-level predicate writes are not, and need an explicit reindexSource.',
             { object, type, matched },
           );

packages/services/service-knowledge/src/knowledge-service.ts

@@ -318,7 +318,8 @@ export class KnowledgeService implements IKnowledgeService {
     // No identity → fail closed on object-backed hits (keep file/http hits).
     if (!ctx) {
       this.options.logger?.warn?.(
-        '[knowledge] retrieval with no ExecutionContext — dropping object-source hits to stay safe (#2981). ' +
+        '[knowledge] retrieval with no ExecutionContext — dropping object-source hits to stay safe: a missing ' +
+          'identity is not a grant of authority, so retrieval fails closed rather than searching the whole corpus unscoped. ' +
           'Pass the caller identity (or an explicit system context) to retrieve object-backed knowledge.',
       );
       return hits.filter((h) => !h.sourceRecordId);

packages/services/service-queue/src/db-queue-adapter.ts

@@ -89,8 +89,10 @@ export function completedRetentionWindowMs(): number {
   if (!maxAge) {
     throw new Error(
       '[service-queue] sys_job_queue no longer declares lifecycle.retention — DbQueueAdapter dedups against '
-      + 'terminal rows by `created_at` window and relies on that declared retention to keep them (ADR-0057, #5179). '
-      + 'Restore the declaration in @objectstack/platform-objects rather than sweeping the table from here.',
+      + 'terminal rows by `created_at` window and relies on that declared retention to keep them (ADR-0057). '
+      + 'Restore the declaration in @objectstack/platform-objects rather than sweeping the table from here: '
+      + 'the one platform reaper sweeps completed rows by that declaration, and a sweeper here would be a '
+      + 'second copy of the window, free to drift from the first.',
     );
   }
   return lifecycleDurationMs(maxAge);