docs: design bounded db receive source

docs/superpowers/plans/2026-07-09-stage-c-log-backed-receive-messages-loop.md

@@ -2638,17 +2638,58 @@ MsgLib message-source metadata sidecar result:
 - Define direct/group source selection, ordering, limit, body-column policy, attachment metadata policy, and fallback behavior versus PacketReader.
 - Decide whether C38 should add sidecar-level bounded row listing or first add a redacted synthetic DB fixture.
 
-- [ ] **Step 1: Write bounded DB receive-source contract**
+- [x] **Step 1: Write bounded DB receive-source contract**
 
-Define request args, returned fields, limits, and no-output boundaries for DB-backed receive listing.
+Created `docs/source-discovery/2026-07-10-db-backed-receive-source-design.md`. It defines sidecar op `list_messages`, args, return fields, hard limit `1..50`, no cursor initially, `include_body` policy, attachment policy, no raw rows, no file path values, and PacketReader remains default until reconciliation.
 
-- [ ] **Step 2: Choose implementation route**
+- [x] **Step 2: Choose implementation route**
 
-Select between sidecar row listing, Go source abstraction first, or synthetic fixture-first tests.
+Decision: C38 should implement sidecar-level `list_messages` plus Go wrapper fake-sidecar tests and sanitized evidence-backed verification. Do not wire DB rows into `isphere_receive_messages` MCP in C38.
 
-- [ ] **Step 3: Update next implementation loop**
+- [x] **Step 3: Update next implementation loop**
 
-Record C37 decision and prepare C38.
+Updated matrix/status/plan. Verification for this design-only loop will use `git diff --check` and `go test ./...` before commit.
+
+---
+
+## Loop C37 Result
+
+Bounded DB-backed receive-source design result:
+
+- Created `docs/source-discovery/2026-07-10-db-backed-receive-source-design.md`.
+- Selected future sidecar op `list_messages` with strict limit, empty cursor initially, explicit `include_body`, safe attachment metadata, no raw rows, and no file path values.
+- PacketReader remains the default receive source; MsgLib DB rows should not silently merge into MCP until reconciliation is tested.
+- C38 should implement sidecar-level bounded listing and sanitized verification only; no MCP integration yet.
+
+---
+
+## Loop C38: Sidecar bounded DB message listing
+
+**Goal:** Implement sidecar-level `list_messages` for copied/operator-local MsgLib DBs with strict limits and sanitized verification, without wiring DB rows into MCP yet.
+
+**Planned files:**
+- Modify: `internal/msglib/sidecar_client.go` and tests.
+- Modify: `native/MsgLibReadSidecar/Program.cs`.
+- Modify: `scripts/verify-msglib-sidecar.ps1`.
+- Modify docs/status/matrix/plan.
+
+**Planned behavior:**
+- Add Go wrapper such as `ListMessages(ctx, options)`.
+- Add sidecar op `list_messages`.
+- First evidence-backed copied-DB smoke uses `include_body=false` and prints only counts/source refs/booleans.
+- Do not return copied-DB `MsgText`, `MessageBody`, `FilePath`, raw rows, sends, downloads, hooks, injection, or DB writes in verification output.
+
+- [ ] **Step 1: Write failing Go wrapper test**
+
+Use fake sidecar to assert request args and decoded normalized message shape.
+
+- [ ] **Step 2: Implement sidecar `list_messages`**
+
+Read allowlisted columns only, clamp limit, reject cursor, hide file paths, and support `include_body=false`.
+
+- [ ] **Step 3: Update verification and docs**
+
+Extend `verify-msglib-sidecar.ps1` with sanitized `list_messages` smoke and run full gate.
 
 ---