fix(notifications): NOT_FOUND provenance row, the roster pin, and the device refusal rows' wording

- error-code-ledger: service-messaging's NOT_FOUND (unregisterDevice), with
  its wire path.
- platform-object-names.test: service-messaging's roster pin names
  sys_user_device (forced by the roster hunk).
- route-ledger: the device refusal rows say 404 with or without an inbox,
  501 only without a notification service; pinned in the device-face test.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ADHkmRD9KKqvTU3THnute6

Author: claude

packages/runtime/src/domains/notifications-devices.test.ts

@@ -133,5 +133,13 @@ describe('/notifications/devices — the device registry faces', () => {
         }
         expect(service.registerDevice).not.toHaveBeenCalled();
         expect(service.unregisterDevice).not.toHaveBeenCalled();
+
+        // Unserved with or without an inbox (the route ledger's refusal rows):
+        // only a missing notification service answers 501.
+        const { listInbox: _dropped, ...registryOnly } = deviceService();
+        const noInbox = await makeDispatcher(registryOnly).handleNotification('/devices', 'GET', undefined, {}, SIGNED_IN());
+        expect(noInbox.handled).toBe(false);
+        const noService = await makeDispatcher(null).handleNotification('/devices', 'GET', undefined, {}, SIGNED_IN());
+        expect(noService.response?.status).toBe(501);
     });
 });

packages/runtime/src/route-ledger.ts

@@ -404,21 +404,21 @@ export const ROUTE_LEDGER: readonly RouteLedgerEntry[] = [
   { route: 'POST /notifications/devices', domain: '/notifications', disposition: 'sdk', client: 'notifications.registerDevice' },
   { route: 'DELETE /notifications/devices/:deviceId', domain: '/notifications', disposition: 'sdk', client: 'notifications.unregisterDevice' },
   { route: 'GET /notifications/devices', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
   { route: 'PUT /notifications/devices', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
   { route: 'PATCH /notifications/devices', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
   { route: 'DELETE /notifications/devices', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
   { route: 'GET /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
   { route: 'POST /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
   { route: 'PUT /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
   { route: 'PATCH /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
-    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 with or without an inbox (its 501 only when no notification service is registered)' },
 
   // ── security (ADR-0090 suggested audience bindings) ───────────────────────
   { route: 'GET /security/suggested-bindings', domain: '/security', disposition: 'sdk', client: 'security.suggestedBindings.list' },

packages/spec/src/api/error-code-ledger.zod.ts

@@ -1208,6 +1208,13 @@ export const ERROR_CODE_LEDGER = {
     // operation, try when it settles"; that one says "never, fix the
     // configuration instead".
     'DELIVERY_NOT_ELIGIBLE',
+    // [#29068] `unregisterDevice`'s refusal for a device id the caller does
+    // not hold, unknown or another user's alike (`deviceNotFoundError` in
+    // `device-registry.ts`), so the answer never says the id exists for
+    // somebody else. Wire path: `DELETE /api/v1/notifications/devices/:deviceId`
+    // throws it out of the `/notifications` domain and the dispatcher answers
+    // `404 NOT_FOUND` through `resolveThrownHttpError`.
+    'NOT_FOUND',
   ],
   '@objectstack/trigger-api': [
     'ENQUEUE_FAILED',                // queue accepted the call but publish threw

packages/spec/src/system/constants/platform-object-names.test.ts

@@ -175,6 +175,7 @@ describe('platform-object predicates', () => {
       'sys_notification_preference',
       'sys_notification_receipt',
       'sys_notification_template',
+      'sys_user_device',
     ]);
     expect(isPlatformProvidedObjectName('sys_notification_subscription')).toBe(false);
     expect(isPlatformProvidedObjectName('sys_notification_preference')).toBe(true);