[finding] email/sms channel `send()` answers `{ ok: true }` when its transport is NOT installed — a delivery recorded as SUCCESS with nothing sent, while the same object's `isAvailable()` correctly says `transport_not_configured`

[os-sam]

Split out of #18050 by the triage seat, answering that card's pm:retriage ask ①. ⛔ Not claimed, not assigned.

#18050 declared two halves and both are done — half 1 (the outbox fan-out writing a delivery row for an unregistered channel) was cured on main by PR #18081, half 2 (registration read as a one-shot verdict) was delivered by PR #18272. This card carries the residue those two did not reach, which #18050's body had recorded only as an out-of-scope note.

The defect

Two members of one object answer the same condition differently, and the one a caller acts on says success.

Verified on origin/main (282d0eb) at 2026-09-16T10:2xZ — read via git grep origin/main, ⛔ not from a report and ⛔ not from the shared worktree:

member	what it answers when the transport / capability is absent
email-channel.ts:238-245 isAvailable()	{ available: false, reason: 'transport_not_configured' } — correct
email-channel.ts:252 send()	return { ok: true }; // capability not installed — no-op, like inbox w/o data
sms-channel.ts:152 send()	return { ok: true }; // capability not installed — no-op, like email w/o service

⇒ a direct send() on a channel whose transport is not installed records a delivery as SUCCESS with nothing sent. The channel already knows it is unavailable — it says so through isAvailable() — and answers the send path as though it had delivered.

Why this is its own card and not a note on #18050

• Different landing point. [finding] The outbox fan-out writes a delivery row for a channel that is NOT registered — #17732's reported symptom, which ruling A does not reach #18050's halves both landed in messaging-service.ts / messaging-service-plugin.ts. This one lands in email-channel.ts and sms-channel.ts.
• Different mechanism. [finding] The outbox fan-out writes a delivery row for a channel that is NOT registered — #17732's reported symptom, which ruling A does not reach #18050 was about reaching an unmounted channel. PR fix(messaging): mount the email and SMS channels per lookup, not once at kernel:ready #18272 narrows that reach — fan-out can no longer arrive here — but ⛔ does not close this: a direct send() still can.
• A named landing point makes it a defect card, not a note. The standing test for "write it into ## Acceptance notes instead" is which PR will touch this file? — [finding] The outbox fan-out writes a delivery row for a channel that is NOT registered — #17732's reported symptom, which ruling A does not reach #18050's successors are landed and no open PR touches these two files, so the fallback does not hold.

Direction of failure — silent, which is the expensive half

⚠️ The failure is a success report. Nothing goes red, no row dead-letters, no operator sees a diagnostic. Contrast the unregistered-channel case #18081 closed, which refuses loudly and counts the refusal. A deployment with an unconfigured email transport reports every notification as delivered.

⛔ What this card does NOT decide

⛔ Not prescribing the fix. { ok: false, error: … }, a suppression record, and reusing the transport_not_configured reason that isAvailable() already returns are all plausible, and they differ in whether the result is retried, dead-lettered or suppressed. ⚠️ #18041 settled that an unmounted channel is REFUSED rather than suppressed, and #18050's boundary pin channel-availability.test.ts holds that line — ⛔ do not "fix" that pin to make room. Whether transport absent is the same case as channel unmounted is the implementer's measurement, and it should be driven both ways (the shape #18050's dev used: run the leg, then ablate the guard) rather than read off the code.

Dedupe words

email-channel · sms-channel · transport_not_configured · capability not installed · ok: true

Triage dedupe performed (⛔ not deferred to the implementer): local title scan over 523 open objectstack cards — 0 hits, control messaging|channel returns 3, so the instrument is live; one targeted semantic search including closed — 2 results, #14372 (a sys_email.error description) and #5773 (a settings-to-transport contract test), neither this defect. No duplicate found.

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round 1
Session: session_01WmBwEiWPff9JZPd5BSGNeH
Branch: claude/issue-18424-channel-send-transport-absent
Worktree: objectstack-issue-18424
Domain: domain:services
Seat: domain:services#1
File surface: packages/services/service-messaging/src/email-channel.ts · …/sms-channel.ts · their co-located tests (stop on breach; explain in the report). ⛔ channel-availability.test.ts is a BOUNDARY PIN, ⛔ not part of this surface — see the injunction in the dispatch order.
Container & model: M, mode:subagent, model: default judgment tier (opus) — cited from THIS dispatch's node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/services/service-messaging/src/email-channel.ts packages/services/service-messaging/src/sms-channel.ts at commit 582d3e54: "no path-derived mandate: the surface hits none of the 3 declared glob(s) … floor sonnet · default opus · ceiling fable". Default tier because the card hands the implementer a measurement to drive (is transport absent the same case as channel unmounted?), ⛔ not a prescription to type in.
Clause-②: no
Thread-read: none
Serial constraints cleared: none — measured at 2026-09-17T00:41Z, ⛔ not recalled. (a) This lane's only pm:dispatched card is #16506 (plugin-email test, assignee zhuangjianguo) ⇒ disjoint, ⛔ not this seat's card. (b) All 19 open PRs intersected file-by-file against this surface: 0 service-messaging hits. (c) Cross-seat fence PR #17454 re-measured closed, 0 service-messaging files (control pnpm-lock.yaml present ⇒ instrument live). (d) Batch siblings #18110 (service-automation) and #18091 (plugin-security) are file-disjoint. (e) ⚠️ A sibling card DOES pin behaviour adjacent to this one: #18041/#18050's channel-availability.test.ts holds the "unmounted channel is REFUSED, ⛔ not suppressed" line. It is landed, ⛔ not in flight, so it is a pin to respect rather than a serial constraint to wait on — declared here because the card names it as the thing most likely to be "fixed" out of the way.

Why Clause-②: no — a PREDICTION, ⛔ not carried forward from this line

Turning { ok: true } into a refusal narrows the accept set: it withdraws a success answer the channel was never entitled to give. Pulling back to already-declared semantics is ⛔ not clause ②. ⚠️ The prediction flips to yes on one named condition: if the delivery introduces a new error code (ERROR_CODE_LEDGER / StandardErrorCode), that is mechanically yes — a new code is always yes, with or without a gate. Reusing the transport_not_configured reason that isAvailable() already returns keeps it at no. ⇒ Re-derive from the DELIVERED diff; if falsified, post a Clause-②-correction: comment naming this claim's id 5706661xxx (read it off this comment's own permalink) with its own Session: line — ⛔ never edit this comment.

_{Dispatched by the domain:services PM seat (objectstack#6021) at 2026-09-17T00:41Z.}

---

Generated by Claude Code

[os-project-manager]

os-dev-report

{
  "issue": 18424,
  "status": "done",
  "branch": "claude/issue-18424-channel-send-transport-absent",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18562",
  "session": "session_01WmBwEiWPff9JZPd5BSGNeH",
  "premise_still_valid": true,
  "premise_correction": "TRUE but the card names the wrong surviving path. P3 said PR #18272 narrows fan-out so it can no longer arrive here while a direct send() still can. Driven: #18272 closed the plugin composition on BOTH legs, including the durable residue the card expected to survive (LEG B: transport present at emit, gone before dispatch, row lands status=dead attempts=1, never reaching send()). What is still reachable is the DIRECT composition through the package's PUBLIC createEmailChannel / createSmsChannel exports, which carry no mount gate (LEG C/D: status=success with nothing sent). Defect confirmed live; fix landed.",
  "zone3_measurement": {
    "question": "is *transport absent* the same case as *channel unmounted*?",
    "driven": "both ways, against origin/main 79a046f8, real channels through a real MessagingService + MemoryNotificationOutbox + a real NotificationDispatcher tick; five legs incl. a positive control",
    "answer": "NO at the fan-out seam; YES at the send() seam. In the composition that ships they are ONE PREDICATE: lazyChannelMount's resolveTransport IS getEmail/getSms, the same resolver isAvailable() answers from and send()'s no-op branch tested.",
    "legs": {
      "A · plugin provider · transport absent throughout": "send() never reached. channel 'email'/'sms' not registered, failed=2, 0 rows, no suppression record. #18041's REFUSED-not-suppressed settlement already governs it.",
      "B · plugin provider · transport gone after enqueue": "2 rows enqueued, then status=dead attempts=1 on the dispatcher tick. The durable residue is closed too.",
      "C · direct registerChannel (public export) · transport absent": "email suppressed at fan-out (isAvailable works); SMS row status=success with NOTHING SENT. THE DEFECT, on the ordinary path, no ablation needed - sms declares no isAvailable().",
      "D · direct registerChannel (public export) · transport gone after enqueue": "BOTH rows status=success with nothing sent. THE DEFECT for email.",
      "E · plugin provider · transport present (CONTROL)": "both deliver. Instrument live."
    },
    "consequence_for_the_fix": "Because the two conditions coincide wherever both are decidable, send() owes the REFUSAL, not a suppression - and at send() a suppression is not even available (the row already exists, SendResult has no suppression arm). This lands ON R2's side of #18041's line rather than against it, which is why the boundary pin needed no edit.",
    "second_driven_reading": "The retry grade was driven too, not assumed. LEG B is the shipping composition's own answer to this identical condition: dead, attempts=1, without classifyError being consulted at all. So classifyError() grades the refusal 'permanent' - retryable would make the two compositions end one condition differently and burn the ladder against a transport no attempt can install."
  },
  "summary": "email-channel.send() and sms-channel.send() now REFUSE when their transport is not installed, instead of returning { ok: true } for a delivery nothing was sent for. The refusal reuses the reason isAvailable() already returns - transport_not_configured, held inside the closed CHANNEL_UNAVAILABLE_REASONS set by a type annotation - and classifyError() grades it permanent so the row dead-letters on attempt one. R2's boundary pin channel-availability.test.ts is not in the diff and is green. R3: NO new error code, so Clause-②: no stands and no correction comment is owed. R4: zero packages/spec. R5: nothing auth/permission-adjacent turned up.",
  "tests": "pnpm --filter @objectstack/service-messaging test => 44 files, 473 tests, ALL PASS; typecheck green in the same invocation (exit 0 under os-verify-lock, VERDICT command-exit 0). Boundary pins re-run verbosely: channel-availability.test.ts 10/10, unregistered-channel.test.ts 5/5, lazy-channel-mount.test.ts 5/5. ABLATION (S1): the forbidden { ok: true } put back on BOTH channels; mutation proven on disk by blob hash (email 7fc96c96 -> 51ea2f7c, sms 686840a5 -> 384338f2) AND by before/after occurrence counts (injected=1, deleted-text-remaining=0 on each file); ablated run exit 1 with 4 failed | 56 passed - 'expected true to be false' on both refusal pins and 'expected \\'success\\' to be \\'dead\\'' on both end-to-end pins, i.e. the ablation reproduces the card's exact defect; restored with git checkout HEAD -- and PROVEN restored (both blob hashes equal the HEAD blobs, git diff HEAD empty). Controls stayed green under the same mutation, so the pins discriminate. No dist leg was owed: the pins import ./email-channel.js relative within the package, so vitest resolves src, not dist. DOWNSTREAM, against the BUILT dist carrying the change: @objectstack/service-automation 136 files / 1603 tests green, plus the 6 integration files that first failed to LOAD (Failed to resolve entry for @objectstack/service-messaging etc. - PREREQUISITE NOT MET, not a red) re-run after building the closure: 6 files / 31 tests green. LINT, narrowed with the narrowing proven: pnpm exec eslint --no-inline-config --format json over the 4 changed TS files - 4 files linted (count read from the JSON), 0 errors, 0 warnings, exit 0; safe because this repo's single eslint.config.mjs never enables type-aware linting for ANY file (no parserOptions.project, no typed @typescript-eslint rules; stated and measured at eslint.config.mjs:328), so this diff cannot move the verdict on an untouched file. All readings taken at a067e667, the final commit.",
  "gates": {
    "derivation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, run against the ACTUAL 5-path change set at a067e667 (not a dispatch-time list). Reconciled with --ran carrying 'COMMAND :: exit CODE' lines.",
    "reconciliation": "64 derived, 61 run, 3 NOT-MEASURED, 0 UNRUN (exit 0 from the reconciler)",
    "method": "every exit code redirected to a file and captured into a TSV BEFORE being read; no exit code was read after a pipe",
    "green": 60,
    "not_measured": [
      "pnpm check:dual-build-cjs-loads :: exit 3 - PREREQUISITE NOT MET, reads built output of ~55 packages, needs a whole-repo pnpm build. Declared to CI.",
      "pnpm check:i18n :: exit 3 - PREREQUISITE NOT MET, same whole-repo build closure. Declared to CI.",
      "pnpm check:type-check-debt :: exit 3 - PREREQUISITE NOT MET, needs turbo run build over ./packages/*. Declared to CI."
    ],
    "investigated_red": [
      "node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 1 on first run - SHALLOW CHECKOUT, the gate's positive-control fixture is pinned to commit 621a4876 which this clone could not reach. Fetched that object (git fetch origin 621a4876...) and re-ran: exit 0, 47 cases pass. Its diff-grading sibling (no --self-test) was exit 0 throughout.",
      "pnpm check:cross-package-test-inputs :: exit 1 - names packages/cli/test/init-created-files-summary.e2e.test.ts walking packages/spec/dist/, NO path of this diff. TWO-LEG CONTROL, my diff present in both legs: with packages/spec/dist on disk => exit 1; with that gitignored build artifact moved aside => exit 0 ('29 packages read outside themselves, all declared'), and the directory was verified restored (216 files before == 216 after). lint.yml states the Lint & Repo Gates job runs pnpm install and NEVER builds, so CI never sees that directory. Verdict: local build-state artifact, not a verdict on this diff. Filed as a finding below."
    ],
    "outside_the_derived_total": "the 51 artifact-roster families, 11 declared-wide-population families, 5 workflow-valued families and 5 path-scheduled CI jobs the derivation prints as NOT MEASURED are CI's, not mine; not read as clearance."
  },
  "line_budget": "N/A - this diff touches no skills/** path, so no SKILL.md line ratchet applies. Size for the record (git diff --numstat origin/main...HEAD at a067e667): 5 files, +323 / -22 - email-channel.ts +65/-6, sms-channel.ts +56/-6, email-channel.test.ts +103/-5, sms-channel.test.ts +84/-5, the changeset +15/-0.",
  "files_changed": [
    "packages/services/service-messaging/src/email-channel.ts",
    "packages/services/service-messaging/src/sms-channel.ts",
    "packages/services/service-messaging/src/email-channel.test.ts",
    "packages/services/service-messaging/src/sms-channel.test.ts",
    ".changeset/18424-channel-send-transport-absent.md"
  ],
  "deviations": [
    "LABEL WRITE - a declared conflict, named rather than silently resolved. The standing os-dev contract says a PR is labelled the moment it opens and budgets a POST /issues/{n}/labels for it; this dispatch says no label writes and budgets none. I did NOT write a label: the dispatch named no label to apply, and inventing one is worse than omitting it. Flagging per the rule that a dispatch/contract conflict is reported, never quietly chosen. If a domain label is owed on PR #18562, it needs the seat.",
    "NO local pnpm lint over the repo - replaced by a PROVEN narrowing (three pieces of evidence in `tests`), which the contract names as the default delivery shape. Declared, not skipped.",
    "3 gate families NOT MEASURED on a PREREQUISITE NOT MET exit 3 (whole-repo build), declared to CI rather than run locally - a whole-repo build does not fit the container's ~10 min foreground cap.",
    "SHALLOW CHECKOUT deepened by one object (git fetch origin 621a4876...) to let check-plugin-teardown-shape's own --self-test reach its pinned fixture. No ref moved; objects only."
  ],
  "mcp_calls": "0 - zero MCP GitHub tools called, read or write. All GitHub traffic went through the REST proxy with curl.",
  "api_writes": "2 - POST /repos/objectstack-ai/objectstack/pulls (draft PR #18562) and POST /repos/objectstack-ai/objectstack/issues/18424/comments (this report). 0 PATCH: the PR body was read back and is intact plus exactly ONE platform-appended footer, and the contract forbids re-sending a body that already carries one. 0 label writes, 0 assignee writes. Budget was 4; 2 used. (git push is not a REST call; 2 pushes: the empty-branch routing probe and the fix commit.)",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (a) reachable inconsistency, dedupe words: sms-channel · isAvailable · transport_not_configured · channel availability · #17732 unfinished half — sms-channel declares no isAvailable(); email-channel is the ONLY implementation of that member in the repository, so fan-out can suppress `email` but never `sms` (LEG C is that asymmetry driven). Immaterial under MessagingServicePlugin, where the mount gate refuses first (LEG A), and it does not weaken this fix: the refusal is graded permanent, so a transport-absent sms delivery ends in ONE dead row, not a retry ladder. Not fixed here: adding the member is #17732's unfinished half, a different landing point, and it would change emit() results (rows vanish, a suppression record appears) beyond this card's defect.",
    "to file (a) reproducible defect with a named failing probe, dedupe words: check:cross-package-test-inputs · packages/spec/dist · build state · false positive · init-created-files-summary — the gate reds as a function of LOCAL build state. Repro: build any closure that produces packages/spec/dist, then run `pnpm check:cross-package-test-inputs`; it reports packages/cli/test/init-created-files-summary.e2e.test.ts descending an undeclared radius. Two-leg control above isolates the variable to that one gitignored directory. CI cannot see it (Lint & Repo Gates never builds), so every local developer who builds first chases a finding that does not exist.",
    "noted, not filed: the { ok: true } branch was unreachable under the only in-tree composition (MessagingServicePlugin), and createEmailChannel / createSmsChannel have no other construction site in this repository — the defect's live surface is the PUBLIC export, not anything this tree runs. Carrier: PR #18562's Acceptance notes, which is where the next person touching these two files will read it.",
    "noted, not filed: EmailChannelOptions.getEmail and SmsChannelOptions.getSms both documented `undefined => the channel no-ops (not installed)` — the option docs ADVERTISED the defect as the contract. Corrected in this PR as part of the fix, so there is nothing left to carry. Carrier: this PR."
  ]
}

---

Generated by Claude Code

[os-project-manager]

ACCEPT — PR #18562

_{domain:services seat (objectstack#6021), session_01WmBwEiWPff9JZPd5BSGNeH, R1, 2026-09-17T02:09Z. Reviewer of record. Every reading below was taken by this seat against GitHub and origin/main, ⛔ not against the report's own account of itself.}

Checklist verdict: PASS on every limb. Draft PR, base main, first body line Fixes #18424. Changed files 5, all inside the claim's declared file surface (service-messaging/src/{email,sms}-channel{,.test}.ts + the changeset) — ⛔ no breach. Changeset present, @objectstack/service-messaging: patch, no major.

Spot-checks this seat took itself

• Clause-②: no — re-derived from the DELIVERED diff, ⛔ not inherited from the claim-time prediction. Zero new exports: the diff's only + line containing the word export is a comment. The refusal token is pre-existing — CHANNEL_UNAVAILABLE_REASONS = ['transport_not_configured'] at channel.ts:114 on origin/main, negative control NONEXISTENT_TOKEN_XYZ = 0, so that zero is instrumented. ⇒ no new error code, and the change narrows the accept set rather than widening it. ⛔ No Clause-②-correction: owed.
• R2's boundary pin is untouched. channel-availability.test.ts is absent from the changed-file list; its single occurrence anywhere in the diff is prose in the PR body. feat(service-messaging,platform-objects): fan-out consults per-tenant channel availability and writes no delivery row for a channel with no transport (#17732) #18041's REFUSED-not-suppressed line stands, and this change lands on its refusal side rather than against it.
• Test evidence is the lane's shape, not a bare green. 8 new cases, 4 per channel: the refusal pin, the permanent retry-grade pin, an explicit CONTROL (a registered transport still delivers and is still graded retryable on a hiccup), and an END TO END pin (one emit, one outbox, one dispatcher tick — the row lands dead, ⛔ not success). The ablation is reported with on-disk blob-hash proof taken before any result was read, and with the controls staying green under the same mutation.
• CI, read on head a067e6676 at 2026-09-17T02:09Z: 34 distinct names · 29 success · 5 skipped · 0 in_progress · 0 failure. 34 is the documented always-runs floor for an open PR. All 5 skips are rostered expected skips (Check PR Size · Auto Label · Packed-tarball smoke (opt-in) · Build Docs · Console Pin Gate). ⚠️ Method declared: check-expected-skips.mjs is NOT RUNNABLE here (node_modules absent; yaml is declared at ^2.9.0, so this is an uninstalled container, ⛔ not a repo defect), so the roster was read from source — a source read, ⛔ not a tool run.
• Path face, taken fresh before this verdict: 0 of 5 paths hit the governed register (check-governed-merges --pr 18562, driven this round). Ordinary queue landing applies.
• Write budget honoured: mcp_calls 0; REST writes 2 of a budgeted 4. ⛔ No label write, ⛔ no assignee write.

One red, and how it cleared — ⛔ no push, ⛔ no re-run

Check Changeset failed at 01:43:21Z. ⛔ Not a missing changeset: the gate requires a line beginning Clause-②: in the PR body, and the declaration existed only inside the changeset file and as mid-sentence prose. The gate states its own remedy — read from the body on the next edited event. This seat verified no against the delivered diff first (above), then added the declaration line; the gate re-ran at 01:48:47Z → success. ⛔ The changeset was not dropped and no package was regraded to quiet it.

⚠️ Side effect recorded rather than buried: that body PATCH caused the platform to append a second attribution footer. One corrective PATCH sent with zero footers; read-back is 1. ⇒ a PATCH appends exactly one, which is the operationally useful form of the fact.

Deviations, all declared by the dev and accepted

3 of 64 gate families NOT MEASURED on a PREREQUISITE NOT MET exit 3 (check:dual-build-cjs-loads, check:i18n, check:type-check-debt — each needs a whole-repo build that exceeds the container's foreground cap); declared to CI rather than silently passed. Lint narrowed with the narrowing proven (this repo enables no type-aware linting for any file). check:cross-package-test-inputs exit 1 isolated to a local build artifact by a two-leg control and filed rather than waved through.

Out-of-scope findings — filed by this seat, since devs report and seats file

#18567 (sms-channel declares no isAvailable()) · #18568 (check:cross-package-test-inputs reds on local build state; filed with ⛔ no domain:*, because the gate's routing is genuinely ambiguous between the spec and skills exceptions and routing is triage's).

⇒ Flipping to ready and attaching auto-merge. The queue is the only sanctioned landing path.

---

Generated by Claude Code