feat: add msglib bounded message listing

docs/superpowers/plans/2026-07-09-stage-c-log-backed-receive-messages-loop.md

@@ -2679,20 +2679,60 @@ Bounded DB-backed receive-source design result:
 - First evidence-backed copied-DB smoke uses `include_body=false` and prints only counts/source refs/booleans.
 - Do not return copied-DB `MsgText`, `MessageBody`, `FilePath`, raw rows, sends, downloads, hooks, injection, or DB writes in verification output.
 
-- [ ] **Step 1: Write failing Go wrapper test**
+- [x] **Step 1: Write failing Go wrapper test**
 
-Use fake sidecar to assert request args and decoded normalized message shape.
+Added `TestListMessagesPassesBoundedArgsAndDecodesNormalizedMessages`. RED failed because `Client.ListMessages` and `ListMessagesOptions` did not exist.
 
-- [ ] **Step 2: Implement sidecar `list_messages`**
+- [x] **Step 2: Implement sidecar `list_messages`**
 
-Read allowlisted columns only, clamp limit, reject cursor, hide file paths, and support `include_body=false`.
+Implemented Go wrapper `ListMessages(ctx, ListMessagesOptions)` and x86 sidecar op `list_messages`. The wrapper clamps `limit` to `1..50` and rejects non-empty cursor. The sidecar reads allowlisted direct/group/system message tables, uses copied DB read-only mode, returns normalized messages, hides raw rows, and excludes file path/download refs from attachment metadata.
 
-- [ ] **Step 3: Update verification and docs**
+- [x] **Step 3: Update verification and docs**
 
-Extend `verify-msglib-sidecar.ps1` with sanitized `list_messages` smoke and run full gate.
+Extended `verify-msglib-sidecar.ps1` with sanitized copied-DB `list_messages` smoke using `include_body=false`, then updated status, matrix, contract, and this plan. Full verification gate is required before commit/push.
 
 ---
 
+## Loop C38 Result
+
+Sidecar bounded DB message listing result:
+
+- Added `list_messages` to `native/MsgLibReadSidecar` and bumped sidecar version to `0.4.0`.
+- Added Go wrapper types and `Client.ListMessages(ctx, options)` in `internal/msglib`.
+- Fake-sidecar unit coverage verifies bounded args, decoded normalized messages, safety flags, and no body values when `include_body=false`.
+- Evidence-backed copied-DB smoke returned only sanitized `message_list_count`, `message_list_sources`, body/raw/file-path booleans, and omission booleans.
+- C38 does not wire MsgLib DB rows into the MCP receive default; PacketReader remains the default receive source.
+
+---
+
+## Loop C39: DB-backed receive source adapter test slice
+
+**Goal:** Add the smallest Go adapter/test layer that can translate `msglib.ListMessages` results into the existing receive-message domain model, while keeping MCP source selection explicit and PacketReader default unchanged.
+
+**Planned files:**
+- Modify or create: `internal/isphere` DB-backed source adapter files/tests, or a narrow `internal/tools` adapter if the existing receive model is tool-local.
+- Modify: `internal/msglib` only if C38 return shape exposes a decoding gap.
+- Modify docs/status/matrix/plan after implementation.
+
+**Planned behavior:**
+- Use an injected/fake MsgLib list provider first; do not require real DB in unit tests.
+- Map normalized MsgLib fields to the current `isphere_receive_messages` envelope without returning raw rows or file paths.
+- Keep source selection explicit. Do not silently merge MsgLib rows into default MCP receive output.
+- Verification should continue to clear MsgLib env in the standard `verify-go-mcp.ps1`; optional copied-DB verification remains separate.
+
+- [ ] **Step 1: Locate current receive-message model boundary**
+
+Inspect `internal/isphere` and `internal/tools` receive-message code and decide whether the adapter belongs below the tool layer or inside the tool registration layer.
+
+- [ ] **Step 2: Write failing adapter test**
+
+Use a fake MsgLib list provider returning redacted normalized messages and assert mapped receive-message fields, source refs, attachment metadata behavior, and explicit source-selection handling.
+
+- [ ] **Step 3: Implement minimal adapter and update docs**
+
+Implement only enough code to pass the adapter test; defer MCP default wiring until reconciliation/source-selection behavior is proven.
+
+---
 ## Self-Review
 
 - Spec coverage: the plan follows the user's cyclic requirement: plan first, implement one loop at a time, update the next loop after each result, and ask only on blockers.