PREWAVE-BE-099 — Enforce Owner-Scoped Notification Delivery History Queries #800

Problem context

DeliveryTrackerService.getUserDeliveryHistory(userId, ...) currently ignores userId and queries delivery history without an ownership predicate. This risks returning delivery records belonging to other users.

Technical scope

Join delivery history to its owning notification (or use an equally authoritative ownership relation) and constrain every page/count query to the requested authenticated user. Apply stable ordering, bounded pagination, and only return fields the user is authorized to see. Keep administrative aggregate statistics behind a separate privileged boundary.

Required tests

• Two-user isolation tests proving neither items nor total counts leak across accounts.
• Empty, large, and multi-page histories.
• Deleted/missing notification relation behavior.
• Attempts to pass another user's notification ID or cursor.
• SQL/query-level assertion that both data and count queries include the owner constraint.

Security and architecture constraints

• Contracts and finalized canonical events remain authoritative for protocol state.
• The API remains a projection/read and notification-delivery layer; it must not invent protocol outcomes.
• Fail closed on missing, stale, ambiguous, unauthorized, or incomplete state.
• Do not expose secrets, device tokens, email verification tokens, private evidence, or unnecessary personal data.
• Preserve strict typing, idempotency, privacy, observability redaction, and existing CI/security gates.

Acceptance criteria

• The identified placeholder or unsafe behavior is replaced by a production-quality implementation.
• Provider/recipient/ownership behavior is explicit and documented.
• Every required failure mode is covered by automated tests.
• No synthetic success, cross-user data exposure, or secret leakage remains in the affected path.
• The pull request links exactly this issue and maps evidence to every acceptance criterion.
• Exact-head required CI passes and independent human review is recorded.

Dependencies

• API PREWAVE-BE-019 — Restore the Canonical Notification Outbox Entity Contract #615 — canonical notification outbox entity contract.

Non-goals

Changing delivery retry policy or exposing internal provider diagnostics to end users.

Complexity and points

• High — 200 points

Candidate only. Activation remains maintainer-controlled; do not apply Stellar Wave as part of implementation.