docs(specs): correct six S17 claims the merged code contradicts

Hayley Swimelarrequested to merge
583/spec-corrections into main

Why

Correct nine S17 claims the merged code contrad... (#583) • Hayley Swimelar • 19.3 lists nine S17 claims the merged code contradicts, plus a comment-harmonization note. Dispositions in the issue's order:

  1. Attachment inventory: the section defers to the structure.sql FK inventory and states no count on purpose, already fixed on docs(specs): correct four S17 claims the merged... (!1453 - merged) • Hayley Swimelar • 19.3.
  2. Bulk-batch round trip: the subset-selector text and the blast-radius bullet both name the namespace-lookup cost, already fixed on docs(specs): correct four S17 claims the merged... (!1453 - merged) • Hayley Swimelar • 19.3.
  3. Tag cap: per-manifest binding, multi-call image clearing, and the retarget-at-cap 422 are stated, AC included, already fixed on docs(specs): correct four S17 claims the merged... (!1453 - merged) • Hayley Swimelar • 19.3.
  4. Repository-columns Resolution: the false "no code maintains them" clause was already removed on docs: correct stale claims across the S17 phase... (!1560 - merged) • Hayley Swimelar • 19.3. This MR adds the structural deferral reason: S22 moves the columns through one shared post-commit accounting emit rather than a write in each of the eight format arms.
  5. AC-62: corrected. Completion is bounded at committed state, in the AC and in the delete_all prose that carried the same promise.
  6. Delete-semantics mirror instruction: corrected. ADR-007's counter rules are named as the canonical source, in the passage and its Resolutions echo.
  7. Bulk-versions settlement: corrected. tags_count settles at marking, and versions_count decrements only at hard delete.
  8. Body-validation order: corrected. Scoped to the artifact identifier segments, with the format-family guard's body-independent 404 stated.
  9. delete_all concurrent-publish justification: corrected. Both sites now say concurrent creations, and the prose states a retargeted tag stays in scope.

The execution note rides as a second commit: the issue names two inherited "moves only when hard-deleted" comment sites, today's main holds ten of the same shape (lines drifted, later merges copied the variant), and all ten now read "decrements only", matching the sites narrowed on feat(managementapi): serve the npm arm of the v... (!1535 - merged) • Hayley Swimelar • 19.3.

Test plan

Every corrected claim was read back against merged code: dispatchPackageWrite's family 404, TagNamesInScope's created_at predicate, the tag upsert's DO UPDATE clause, drainBulkNpmScope's committed-state bound (the Maven worker shares it), and NpmPackageTagsCountSettler's per-pass dispatch. markdownlint: 0 errors on the spec, unchanged. Vale: two warnings lower (240 to 238). Fragment links: 0 errors. go vet -tags=integration passes, and the pinned golangci-lint reports nothing on the edited lines.

Related to #583

Merge request reports