[leemour]

Why

memo people unlink took a colleague's mailbox off the colleague instead of off the owner, because it never asked which person the identities leave (BUG-709). cli-core #2841 added the "from whom" check to the store, and memo #806 makes --from required. tg, max and wa contacts unlink still took an identity off whoever held it. The owner approved the same check there (NEED-2525 A), with --from required.

What

• contacts unlink <person> --from person:<uid>|person:me (and services.people.unlink(person, { by, from })). Without --from it is refused with validation_error, reason person.from-required. The message names who holds the identity and gives the command to run with their --from. An identity on someone else is refused with identity.held-elsewhere, and nothing moves.
• cli-base 0.96.0, whose vocabulary has --from <person> (cli-base chore: release 0.148.2 #563, NEED-2530 A). bot search messages --from now shows <person>, and its option-role baseline entry goes.
• parity.json lists --from for contacts unlink; docs/dev/STANDARD.md is regenerated.
• mongoose 9.12.1 in bench/stemming/pnpm-lock.yaml only, for Dependabot alert 29 (SEC-183, NEED-2527 A).
• The changelog entry is under "Changed — may break callers". tg, max and wa need their docs regenerated at their next cli-core bump.

Testing

• Full vitest run on cli-base 0.96.0 (11179 passed, 16 skipped). This includes fix(permissions): deny contact-context body reads with messages #562's refusal of the owner's real home.
• ci:quick, lint, docs:check, and the command lint (0 new violations).
• New tests: the service refuses without --from and names the holder and the command; it refuses a wrong --from and person:me when the identity sits elsewhere. The CLI test reads the --from out of the refusal and unlinks with it.

🤖 Generated with Claude Code