refactor(rest): move registerEmailEndpoints into email-routes.ts (#23050 slice 8)

[objectstack-fleet]

Part of #23050
Clause-②: no

Slice 8 of the rest-server.ts split, by slice 1's pattern (landed note 6136102437, steps 1–6), slice 2's getter refinement (6189011700) and slices 3–7's shape (PR #23670, PR #23705, PR #23719, PR #23729, PR #23763): the body of RestServer#registerEmailEndpoints (POST {basePath}/email/send, the transactional send door onto the IEmailService provider) moves to ONE new module, packages/rest/src/email-routes.ts. Routes, the ordered registrations, every handler's source digest, the published dist/*.d.ts and both bundles' export lists are byte-identical, and every reader whose reading included a moved line now reads it where it is, with its sum unchanged.

No token of the body changed. The body calls no class static (AST walk below), so the static exception the claim names up front (seat ruling 6205442867) is not used, and no receiver token was rewritten.

rest-server.ts goes from 10,127 to 10,047 lines (base f7e836da1e). The card stays open for the later slices.

The pattern, applied

Members the moved body reads, from an AST walk of the method (TypeScript compiler API, symbol-resolved, base f7e836da1e): registerEmailEndpoints (JSDoc :9063, method :9082-:9177, body :9083-:9176, 94 lines).

kind	member	reads	class declaration
field	routeManager	1, the register call	:2022, private
field	emailServiceProvider	2, both inside the handler (the wiring guard and the provider call)	:2091, private, not readonly
method	resolveExecCtx	1	:2868, private async
method	enforceAuth	1	:2468, private

No bare this, no element access on this, no this-rebinding function, and no RestServer.NAME access (static reads: none). Module-level reads:

• logError (./log.js): 6 more uses in rest-server.ts, so it stays there; the module imports it from the same module.
• seamOrUndefined: declared in rest-server.ts (:1493), 5 more uses there. It is exported from rest-server.ts and imported by the module: one declaration, never a copy. src/index.ts does not re-export it, so the .d.ts does not move (measured below). The same class of edit as slice 5's export function mayReadPendingDrafts.

Mechanism hypotheses from the dispatch, measured:

• (1) Partly falsified. The body reads routeManager, emailServiceProvider, resolveExecCtx and enforceAuth, and nothing else. tenancyServiceProvider, kernelManager, resolveRequestEnvironmentId, resolveAnonymousFormTenancy and readFormObjectDefinitions are NOT read by it: they belong to the next method, resolveAnonymousFormTenancy (:9185, a forms helper; the same walk on it reads kernelManager, resolveRequestEnvironmentId and tenancyServiceProvider). The claim's "about 210 lines" ran past the method's end; the method is 96 lines (plus its 19-line JSDoc), and nothing past :9177 moved.
• (2) Confirmed. No RestServer.NAME( call in the body.
• (3) Measured; the readers are listed below.

Host shape (slice 1's shape B): EmailRouteHost (4 members) lists exactly the members the body reads, each typed RestServer['m']. The class keeps the private method with its name, docblock and position; its body is now a host literal plus registerEmailEndpoints.call(host, basePath). Methods go as late-bound closures, (...a) => this.m(...a). The call site in registerRoutes' registerForBase (this.registerEmailEndpoints(bp);, :4806 at base, unconditional per base) is unchanged.

Fields, checked one by one:

field	read when	reassigned after registration?	handed over as
routeManager	registration only (one register call, a top-level statement of the body)	its one swap (:5175 / :5179 at base) wraps registerMetadataEndpointsInner, not this registrar	value
emailServiceProvider	request time: both reads are inside the handler	not by the class (constructor only, :2173), but not readonly	getter

The getter is measured, not argued. A one-off vitest file (copied in, run, deleted) boots a source RestServer with no email provider, drives POST /api/v1/email/send, assigns a provider on the instance AFTER registerRoutes(), and drives it again:

• this head: 501 then 200 (MEASURE provider-after-registration: 501 -> 200), the late provider's send called once. A second case sets resolveExecCtx and a spy on enforceAuth AFTER registerRoutes(): both are the ones the door calls (sentBy: 'late-user' stamped). Tests 3 passed (3).
• by-value ablation through scripts/ablation-replace.mjs: the literal's get emailServiceProvider() { return readEmailServiceProvider(); }, replaced by emailServiceProvider: this.emailServiceProvider, (anchor 1 → 0, replacement 0 → 1, blob 2ba4159180 → aad755d1ef). The door freezes at registration: expected … [ 200 ], received 501. Tests 1 failed | 2 passed (3). Restored by the tool's trap: blob 2ba4159180 equals HEAD, git diff HEAD empty. Source path (relative import), so no dist leg applies.
• the same file against the BASE source (base rest-server.ts restored into the tree with a trap, then git checkout HEAD and blob/diff proof): 501 -> 200, Tests 3 passed (3), the same answers as the head.

Proof of move-only

• .d.ts: packages/rest/dist/index.d.ts and index.d.cts built at base f7e836da1e (this worktree, before any edit), at the move commit 679fe5b05 and at the merge head 35f207b70 (and again after the whole-workspace build) are byte-identical: sha256 7489de84bc6feccb7cb1f28bcbe4a97775324959c61c9bfc35e8a8c45a6f3bc9 for all files, cmp silent. The head bundles carry a head-only marker (readEmailServiceProvider: 2 hits in each of index.js and index.cjs, 0 at base), so the declaration was rebuilt from the moved source, not replayed. EmailRouteHost, email-routes and seamOrUndefined appear 0 times in the .d.ts; src/index.ts is untouched.
• Export lists: the base and merge-head ESM and CJS bundles each load with 39 exports and one sorted export-name list (sha256 b3246be6a1718700… on all four). No email or seamOrUndefined name is among them.
• Routes: a source RestServer on a recording mock server, with a protocol that answers every member, dumped under slice 7's seven configs: default; scoped-optional; scoped-required; every provider set; enableDiscovery: false; enableOpenApi: false; and both off under scoped-optional. Each dump holds getRoutes() (functions as arity), the ordered server registration calls, and a whitespace-free sha256 of every handler's source plus the source itself.
  • 28 of 28 dump files byte-identical, base vs move commit and base vs merge head: routes, calls, handler digests and handler sources in every config. default 75 routes (1 email door), scoped-optional 150 (2), scoped-required 75 (1), every-provider-set equals default, discovery-off 73 (1), openapi-off 73 (1), both-off-scoped-optional 142 (2). A second base run was identical to the first.
  • Because no token changed, every handler digest is identical, the email door's included (9 email handlers over the seven configs), with no mapping.
• The handler digest can fail: a positive control changed one character of the moved handler ('[REST] Email send unhandled error:' → …error!', through ablation-replace.mjs; anchor 1 → 0, blob 30a8f5a0c8 → 78879bb810). Routes and calls were unchanged in all seven configs, and the handler digests differed in exactly the email door of each mounted base (POST /api/v1/email/send, and POST /api/v1/environments/:environmentId/email/send where scoped), nothing else. Restored, blob 30a8f5a0c8 equals HEAD.
• Moved body: base rest-server.ts lines 9083-9176, one 4-space indent removed, against email-routes.ts lines 70-163: diff exits 0 (94 lines). The body has no whitespace-only line, no trailing whitespace and no template literal spanning lines.
• Moved-line accounting: git diff --color-moved=plain --color-moved-ws=allow-indentation-change base → 679fe5b05 over the two files: all 94 deleted body lines are detected as moved; the one other deleted line is seamOrUndefined's declaration gaining export. rest-server.ts is +15 / −95 there: the stub body (host literal plus .call, +12 / −94), the module's import and its comment (+2), and the export (+1 / −1).

Readers re-pointed (sums unchanged, no gate loosened)

packages/rest/src/rest-server-registrar-files.ts gains email-routes.ts with a [#23050 slice 8] comment (length 8 → 9). Every reader that pins its length re-reads its number:

reader	sum over the list	change
rest-server-query-number-census.test.ts	9 = 8 + 1 + 0 + 0 + 0 + 0 + 0 + 0 + 0	length 8 → 9
rest-server-canonical-query-ast.test.ts (repo project)	4 = 1 + 3 + 0 + 0 + 0 + 0 + 0 + 0 + 0 query: slots	floor email-routes.ts: 0, length 8 → 9
meta-draft-read-door-census.test.ts	8 = 6 + 0 + 0 + 0 + 0 + 2 + 0 + 0 + 0	the email body reads no draft; length 8 → 9
rest-server-docblock-position.test.ts	floors 4 + 3 + 3 + 8 + 3 + 8 + 5 + 3 = 37	floor email-routes.ts: 3 (header, host interface, function; the body held no TSDoc block); rest-server.ts keeps 164 blocks, floor 100; length 8 → 9
execctx-consumer-census.test.ts	62 sites = 24 + 9 + 5 + 7 + 8 + 1 + 5 + 2 + 1	the email site is BARE and guarded on its next line, as before (46 bare / 16 caught unchanged). Mentions 113 → 117: the seam once (forwarder ×2 in rest-server.ts, interface member ×2 in the module); rest-server.ts 57 → 58 (one site out, two forwarder mentions in). Forwarders 10 = (9 − 1) + 3 − 1; neither map gains an entry, because the module carries one registrar and it reads the seam
ui-view-route-identity.measurement.test.ts / ui-view-route-tenancy.measurement.test.ts	this.enforceAuth( 57, this.resolveExecCtx( 72 over the list (56 / 71 before, +1 each for the email literal's forwarders); ownership guard 1	length 8 → 9
dogfood authz-conformance.test.ts (realtime tripwires)	0 hits over the nine files	length 8 → 9
dogfood authz-probe-blind-spot.census.ts, rest-server.ts row	70 / 19 / 51 unchanged; this.routeManager.register( 63 = 22 + 9 + 5 + 7 + 8 + 1 + 6 + 4 + 1; private register*Endpoints( 16	new control email-routes.ts: this.routeManager.register( 1; registrar list length 9; enforceAuth 96 → 100 re-anchored (the one call site moved and is counted in both readings; the four new occurrences are the seam once; no call site added); populationRule names the new module

Readers that read rest-server.ts by path outside the list:

• objectql-slot-consumer-census.test.ts: its §1 controls use emailServiceProvider, the sibling slot, as their known-present read and as the negative for the window predicate. Those reads moved: readSites over base rest-server.ts found :9093, :9122 (invocation :9122, wrapped by seamOrUndefined(); at the move commit rest-server.ts holds only the host literal's getter line, so wrappedIn('emailServiceProvider', 'seamOrUndefined(') read 0 and the test went red. The controls now read email-routes.ts (EMAIL_SOURCE): reads :80, :109, invocation :109; seamOrUndefined( 1, wiredEngineOrLoud( 0, as before. The objectQLProvider census itself (3 consumers over SLOT_FILES) is unchanged, and SLOT_FILES is not widened (the module holds no objectQLProvider site).
• scripts/check-route-envelope.mjs (a gate's target paths, domain:spec): email-routes.ts is discovered by the *-routes.ts convention and declared dialectOnly with ratchet [tracking] Envelope-position convergence line for packages/rest's flat dialect — the live ratchet owner #9559, as the seven earlier modules are, at its measured stringError 1 (the non-object body's 400 INVALID_REQUEST, 'JSON body required') and siblingCode 3 (INVALID_REQUEST, VALIDATION_FAILED, EMAIL_SEND_FAILED); the two 501 { code, message } bodies have no error key and are counted by neither. rest-server.ts goes 17 → 16 and 17 → 14, so the sums 16 + 13 + 8 + 1 + 0 + 0 + 0 + 0 + 1 = 39 and 14 + 15 + 8 + 9 + 4 + 1 + 0 + 0 + 3 = 54 are unchanged (the gate compares both counts exactly, in both directions). Output differs from base only in those two rows (18 → 19 modules, 9 → 10 ratcheted). --self-test green. Each history entry says "NOT progress — the same MOVE", as slices 1–3 wrote.
• docs/qa/platform-checklist/areas/integration-system.json (domain:devx): the email item's source entry packages/rest/src/rest-server.ts#registerEmailEndpoints (… enforceAuth 401, non-object→400 INVALID_REQUEST, VALIDATION_FAILED passthrough, 501 no-provider, 500 EMAIL_SEND_FAILED) lists the body's answers, so it now names packages/rest/src/email-routes.ts#registerEmailEndpoints; the item's verify prose said "(rest-server.ts registerEmailEndpoints: …)" for the same answers and now says email-routes.ts. check:platform-checklist: symbol anchors 735/745 → 735/745 resolved (the re-pointed anchor resolves), cited sources 347 → 348.
• No new ADR anchor: the body cites no ADR-NNNN Dk, and check-adr-anchors reads 1764 decision-letter citations at base and at head.

Red before the re-points, each measured with the move in place (679fe5b05): the seven local readers read Test Files 7 failed (7), Tests 8 failed | 121 passed (129) (six length pins, the docblock pin's unfloored new module, and the objectQLProvider census's seamOrUndefined( control at 0). rest-server-canonical-query-ast.test.ts (repo) read Tests 2 failed | 61 passed | 9 skipped (72). The dogfood census read control "registrar list length" moved … expected 9 to be 8; authz-conformance.test.ts could not load at that point (@objectstack/verify was not built yet), so its length pin's red was not observed, only its green after the re-point. tsc --noEmit was clean, but check:test-typecheck found 2 type errors, the two typed floor tables without the new module. check:route-envelope read email-routes.ts NOT DECLARED (MODULES and EXPRESS_RESPONSE_MODULES) and rest-server.ts 16 vs 17 / 14 vs 17.

Readers examined and not re-pointed

• packages/spec (stopped at, per the dispatch, not edited): packages/spec/src/api/discovery.zod.ts (about :396) says "the REST server's registerEmailEndpoints mounts under getApiBasePath()". It names the method, not a file, and the method still registers the door (through the module), so it stays true. No packages/spec/liveness row cites the email registrar or a moved line, and check:liveness output is identical at base and head.
• rest-server.ts' getMountedEmailRouteBase docblock names registerEmailEndpoints as the recorder of the send route. It ships in the published .d.ts (a public method), and it stays true. Not edited.
• Prose that names the method or the door without a file, still true: packages/rest/src/discovery-routes.ts (about :304), discovery-advertised-direct-mounts.parity.test.ts, packages/metadata-protocol/src/discovery-schema-conformance.test.ts, rest.test.ts's email describe block, rest-api-plugin.ts's provider comment.
• meta-state-route-engine-outage.test.ts §5 says "POST /email/send carried the other .catch(() => undefined) in this file": dated repair history about rest-server.ts; the test drives the door over HTTP and reads no source. Not edited.
• packages/rest/CHANGELOG.md (released text) and docs/audits/2026-07-dispatcher-client-route-coverage.md (a dated audit naming POST /email/send, no file or line): not edited.
• No rest-server.ts:NNNN line citation in the tree falls inside the moved range (:9063-:9177); the highest cited line is :5872. As with every earlier slice's import, every line after the new import (:342) moved down by 2 (and every line after the stub by 2 − 80); none of those citations is in a gated document (check:platform-checklist reports 0 surviving line citations; check:scripts-symbol-anchors 0 line anchors on tracked targets).
• REST_ROUTE_LEDGER names POST /api/v1/email/send by route, not by file: unchanged.

Acceptance notes

• The provider's call receiver, measured. The handler calls this.emailServiceProvider!(environmentId); through the host that call's receiver is the host literal, where at base it was the RestServer (the one-off file's third case records receiver === server: true at base, false at head). Only a provider written as a non-arrow function that reads this could observe it. The shipped provider (rest-api-plugin.ts, about :406) is an async arrow, and the constructor parameter's type declares no this. Every earlier slice that moved a provider call through a getter (objectQLProvider, approvalsServiceProvider, the two sharing providers, analyticsServiceProvider, securityServiceProvider) has the same property. Recorded, not changed: a bound hand-over would be a new host shape, which this slice may not introduce.
• The moved [#15405] comment's references ("the if (!this.emailServiceProvider) guard above", "rest-api-plugin.ts hands over") still read true in the module.

Gates and tests

Measured at this branch: base f7e836da1e, the move 679fe5b05, the re-points 626eb4c15, and one merge of origin/main 6422da58e8 (35f207b70: one commit, #23854, in packages/spec contracts and service-automation; no file in this diff). All builds and tests went through os-verify-lock. Every exit code was captured to a file before any pipe. Final head: 35f207b70.

• pnpm install --frozen-lockfile exit 0; pnpm --filter '@objectstack/rest...' --filter '@objectstack/verify...' build exit 0; then pnpm turbo run build --concurrency=2, the whole workspace, exit 0 (76 tasks, 74 cached), after which the @objectstack/rest .d.ts / .d.cts still equal base.
• pnpm --filter @objectstack/rest typecheck: exit 0 (tsc --noEmit, then check:test-typecheck: 0 file(s) / 0 error(s)).
• pnpm --filter @objectstack/rest exec vitest run --project local --maxWorkers=2: Test Files 286 passed (286), Tests 5892 passed / 326 skipped (6218).
• pnpm --filter @objectstack/rest exec vitest run --project repo --maxWorkers=2: Test Files 5 passed (5), Tests 242 passed / 9 skipped (251).
• pnpm --filter @objectstack/dogfood exec vitest run test/authz-probe-blind-spot.test.ts test/authz-conformance.test.ts: Test Files 2 passed (2), Tests 108 passed (108).
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no paths, at 35f207b70 (stderr names that commit; the --repo assertion holds; 15 paths against merge base 6422da58e): 80 commands, all run at 35f207b70. 79 exited 0 on the first pass; pnpm check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: no dist for 18 packages) and exited 0 after the whole-workspace build above. --ran: Run reconciliation — 80 derived, 80 run, 0 NOT-MEASURED, 0 UNRUN. Among them: pnpm check:route-envelope, pnpm check:platform-checklist, pnpm --filter @objectstack/spec run check:liveness, pnpm check:durability-log-level, pnpm check:dispatcher-error-vocabulary, pnpm check:dts-closure, pnpm check:published-files, pnpm check:cross-package-test-inputs, pnpm check:nul-bytes and pnpm check:pm-dispatch-gates. check-adr-anchors (not derived) also run: exit 0.
• Scan outputs, base f7e836da1e vs head 35f207b70, diffed: identical for check-single-authz-resolver, check-system-context-census, check-rest-log-declared, check:rest-log-spy-declared, check-durability-degradation-log-level, check-filter-alias-parity, check-adr-symbol-anchors and check:liveness. Differing only by this diff's new file: check-meta-type-normalized (36 → 37 files), check-affected-docs (route sources 26 → 27, registration call sites 21 → 22, by the *-routes.ts convention, no edit), check-dispatcher-error-vocabulary and check-error-status-conformance (+1 scanned file each; 57 unregistered sites and 465 producer sites unchanged), check-undeclared-dep-imports (+1 file), check-route-envelope (the two rows above), check-scripts-symbol-anchors (+4 file-level anchors, the gate's new comments) and check:platform-checklist (348 cited sources). check-adr-anchors reads 1764 decision-letter citations at both; its +2 citations / +1 file and check-undeclared-dep-imports' +1 specifier are main's (feat(spec,automation): FlowRuntimeState.unboundCause classifies an unbound flow row beside its reason #23854's changeset and engine.ts import).
• Lint: pnpm exec eslint --no-inline-config --format json over the 14 changed code files: 0 errors, 0 warnings (the 15th changed file is the checklist JSON, which eslint . never reads). The published .d.ts is byte-identical, so no consumer outside packages/rest can lint differently. Repo-wide pnpm lint is CI's (Lint & Repo Gates).
• check:dev-prereqs and check:skill-frame-freshness (local-only) were not run: this diff touches no packages/spec build input and no four-axis frame file.
• No changeset: nothing any released package publishes changes (.d.ts, export lists and routes above). skip-changeset is the seat's to apply on its own check.

Cross-lane files in this diff: scripts/check-route-envelope.mjs (domain:spec, a gate's target paths: one new MODULES entry and the rest-server.ts row's two counts, sums unchanged) and docs/qa/platform-checklist/areas/integration-system.json (domain:devx, one source anchor and one verify phrase). The dogfood files (packages/qa/dogfood/test/authz-conformance.test.ts, authz-probe-blind-spot.census.ts) are re-pointed as in slices 3–7. check-governed-merges --test over the 15 paths: NOT governed; 426 changed lines.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 17 documentable anchor(s).

32 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 944f03850ec68ffb52374ce51424074f9e43b564.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 3 cross-cutting symbol(s) contributed no route anchor: enforceAuth (23 routes), resolveExecCtx (28 routes), routeManager (20 routes)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 18 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 944f03850ec68ffb52374ce51424074f9e43b564 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from abd4663d03b59e1da60c04d08d5062fac18b43f7 — the merge of head 35f207b70e9155039b2f71a65cbd9e9c682a7ad9 into base 944f03850ec68ffb52374ce51424074f9e43b564, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin abd4663d03b59e1da60c04d08d5062fac18b43f7 && git checkout abd4663d03b59e1da60c04d08d5062fac18b43f7
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 944f03850ec68ffb52374ce51424074f9e43b564 35f207b70e9155039b2f71a65cbd9e9c682a7ad9 && git checkout -B drift-repro 944f03850ec68ffb52374ce51424074f9e43b564 && git merge --no-ff 35f207b70e9155039b2f71a65cbd9e9c682a7ad9

node scripts/docs-audit/affected-docs.mjs --json 944f03850ec68ffb52374ce51424074f9e43b564

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 944f03850ec68ffb52374ce51424074f9e43b564 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 35f207b70e9155039b2f71a65cbd9e9c682a7ad9
Local-runs: none

Face: the declaration face. This is a move-only slice of @objectstack/rest, and no token of the moved body changed. The diff does six things:

• it moves one registrar body into one new module, packages/rest/src/email-routes.ts;
• it adds export to one module-level helper, seamOrUndefined;
• it grows the registrar list 8 → 9 and re-points the nine readers of that list;
• it re-points one more test reader, objectql-slot-consumer-census.test.ts;
• it re-points one gate's target table, scripts/check-route-envelope.mjs;
• it re-points one platform-checklist item (two strings).

The 15-file list holds no published schema and no governed path. record-recognisers --template --paths over that list derives TIER_DEFAULT. Governed Surface Queue Guard concluded success. The PR body reads Clause-②: no with no arm, and the diff adds no changeset.

Inputs:

• card [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050: its body and all 34 comments. These include the triage 6126748916, slice 1's landing 6136102437, slice 2's refinement 6189011700, the seat ruling 6205442867, slice 7's release 6206265218, the slice 8 claim 6213111311 and the slice 8 report 6214413749;
• slice 7's record 6205886625 on PR refactor(rest): move registerDiscoveryEndpoints and registerOpenApiEndpoints into discovery-routes.ts (#23050 slice 7) #23763, used as precedent;
• PR refactor(rest): move registerEmailEndpoints into email-routes.ts (#23050 slice 8) #23882:
  • its body;
  • its file list: 15 files, +299 / −127, which matches git diff --numstat file for file;
  • its one comment, the advisory Docs Drift Check;
  • its timeline: the labels, and the declarations 6214477252 on [PM seat] domain:spec — 🟢 os-elon-musk · session_01HjR8RUwTPQ3TgbfKihmxp9 #6017 and 6214486315 on [PM seat] domain:devx @ objectstack — ⏳ vacant #6023;
• the net diff against the merge base 6422da58e8;
• the 44 check-runs on this head, read last.

Method: read-only. Every count below was read off the git objects of the merge base and the head with git show, text diff and grep. Each reader's own rule was applied to that text: the execctx site rule, the docblock opener rule, scanSource's two dialect rules and the two realtime tripwire regexes. Nothing was built, tested or re-run. The merge base's rest-server.ts blob (730c2aaa03) is the same blob as at the dev's base f7e836da1e, so the PR's base line numbers apply as written. Between f7e836da1e and the merge base, nothing changed under packages/rest, packages/qa or docs/qa, or in the gate.

① Derived judgments

No accept set changes and no public surface changes. Each change the diff makes is judged below.

1. The moved body is byte-identical once de-indented: right.

   • Base rest-server.ts :9083–:9176 is 94 lines. With one 4-space indent removed, it equals head email-routes.ts :70–:163, and diff finds 0 differing lines.
   • The range holds 3 empty lines. It has no whitespace-only line and no trailing whitespace.
   • Its one template literal, ${basePath}/email/send (base :9086), sits on one line. Every other line with a backtick is a line comment. So removing the indent changed no runtime string.
   • The body has no RestServer. access. The claim's static exception was not used, and no token changed.
   • The rest of rest-server.ts changes in three hunks, +15 / −95 in total:
     • the import and its comment (head :342–:343);
     • export on seamOrUndefined (head :1495);
     • the stub, 12 lines in place of the 94.
   • The file goes from 10,127 to 10,047 lines.
   • The private method keeps its name, its JSDoc (head :9064–:9083) and its position.
   • The call site in registerForBase is unchanged: base :4806, head :4808.
     • It is still unconditional for each base.
     • It still sits between registerSearchEndpoints and registerFormEndpoints.
     • So the registration order holds on every base.

2. The host lists exactly what the body reads: right.

   • The body's code reads of this. (comments excluded):
     • emailServiceProvider 2 (module :80 and :109);
     • routeManager 1 (:71);
     • resolveExecCtx 1 (:77);
     • enforceAuth 1 (:78).
   • A third mention of this.emailServiceProvider (:105) sits inside a comment.
   • EmailRouteHost (:56–:61) declares exactly these 4. Each is typed by indexed access on the class.
   • The body has no bare this, no element access on this and no function keyword.
   • It reads two module-level bindings:
     • logError, imported from ./log.js as rest-server.ts imports it (6 calls stay there);
     • seamOrUndefined.
   • String is a global.
   • So the dev's finding is right: the claim's hypothesis (1) was partly wrong.
     • tenancyServiceProvider, kernelManager and resolveRequestEnvironmentId are read by the next method, resolveAnonymousFormTenancy (base :9185).
     • That method did not move.

3. Value or getter, field by field: right.

   • routeManager goes by value.
     • Its one read is the top-level register call, which runs during registration.
     • The class reassigns the field only at head :5177 / :5181, in the try/finally around registerMetadataEndpointsInner.
     • registerForBase calls the email registrar outside that window.
   • emailServiceProvider goes as a getter.
     • Both code reads are inside the handler, so they run at request time.
     • The field (head :2093) is private and not readonly. Only the constructor assigns it (head :2175).
     • A copy taken at registration would not follow a later assignment.
     • The getter reads through a closure on the server (readEmailServiceProvider), in slice 5's spelling. This is slice 2's refinement, applied to this one field.
   • The two methods go as late-bound closures. So their receiver is still the server, and a spy set after registration is still the one reached.
   • The dev's getter measurement (501 then 200) and by-value ablation (frozen at 501) are the dev's, not re-run here. They match this reading.

4. seamOrUndefined gains export, and it does not reach the published .d.ts: right.

   • There is one declaration (head :1495), and the module imports it. Nothing is copied.
   • 5 code uses stay in rest-server.ts: head :3121, :3129, :3144, :3192 and :3352.
   • Why the .d.ts does not change:
     • @objectstack/rest publishes dist only.
     • The root tsup.config.ts builds it from the single entry src/index.ts, with splitting: false, and emits the .d.ts from that entry.
     • src/index.ts is untouched. It re-exports from ./rest-server.js by name only: RestServer, the types RestProtocol and MountedRoute, and metaItemPackageBinding.
     • It has no export *. It names neither seamOrUndefined nor the new module.
     • EmailRouteHost appears only inside a private method body, which declaration emit does not reach.
   • This is the same class of edit as slice 5's export function mayReadPendingDrafts.
   • The new import cycle is harmless.
     • seamOrUndefined is a hoisted function declaration, read only at request time.
     • Earlier modules already import values from rest-server.ts, for example discovery-routes.ts and batch-routes.ts.
   • The dev's .d.ts sha and export-list readings are the dev's, not re-run here. They are what this construction predicts.

5. The registrar list and every reader were re-counted, and no reader was loosened: right.

   • The list grows 8 → 9 by one appended entry. All nine importers of the list are in the diff, and each moves its length pin 8 → 9.
   • execctx census. Its site rule counts lines that hold this.resolveExecCtx(environmentId, req).
     • Sites: 62 at both. Base 25 + 9 + 5 + 7 + 8 + 1 + 5 + 2; head 24 + 9 + 5 + 7 + 8 + 1 + 5 + 2 + 1.
     • Split: 46 bare / 16 caught at both. Each of the 46 bare sites is followed by the enforceAuth guard line, the email site included (:78).
     • Mentions of resolveExecCtx: 113 → 117. rest-server.ts goes 57 → 58 (one site out, one forwarder's 2 mentions in). The module holds 3 (the site 1, the interface member 2).
     • Forwarder lines in rest-server.ts: 9 → 10. The pin is exact: (9 − 1) + 3 − 1 = 10.
     • Neither map gains an entry. That is right, because the module carries one registrar and that registrar reads the seam.
   • ui-view pair (counted over the list):
     • this.enforceAuth( 56 → 57 and this.resolveExecCtx( 71 → 72.
     • rest-server.ts stays at 19 and 34 (one site out, one forwarder in).
     • The floors of 40 are unchanged.
   • dogfood blind-spot row:
     • this.routeManager.register( stays at 63 = 22 + 9 + 5 + 7 + 8 + 1 + 6 + 4 + 1.
     • private register*Endpoints( 16, registerPerItemRoute( 8 and const registerPerItemRoute = 1 are each unchanged.
     • The population 70 / 19 / 51 is unchanged: 63 − 1 + 8 = 70. The email door is outside registerMetadataEndpoints before and after.
     • enforceAuth goes 96 → 100: rest-server.ts 41 → 42, and the module 3.
       • The four new mentions are the seam once: the forwarder 2, the interface member 2.
       • No call site was added.
       • It is an exact re-anchor, as in slices 3–7.
     • The new control email-routes.ts: this.routeManager.register( reads 1. registrar list length reads 9.
   • docblock pin:
     • The module has exactly 3 TSDoc openers (:3, :49, :63), and its floor is 3.
     • The moved range held 0, so rest-server.ts keeps 164 at base and head (floor 100).
     • The floors' sum goes 34 → 37, and the sum is pinned exactly.
   • query-number 9, canonical-query 4, meta-draft 8:
     • The module has 0 Number / parseInt / parseFloat tokens, 0 query: text and 0 draft tokens.
     • Each new floor is 0, and each sum is unchanged.
   • dogfood realtime tripwire: both probe regexes read 0 on each of the nine files.

6. objectql-slot-consumer-census.test.ts is re-pointed, not loosened: right.

   • Its §1 controls read emailServiceProvider twice: as the known-present sibling slot, and as the window predicate's negative. Those reads moved.
   • At head, rest-server.ts still holds one read of the field (the stub's closure) but no call of it. So wrappedIn('emailServiceProvider', 'seamOrUndefined(') would read 0 there. Re-pointing both controls to the module is the honest move.
   • Read on email-routes.ts:
     • 2 read sites (:80, :109) and 1 call site (:109);
     • seamOrUndefined( 1 and wiredEngineOrLoud( 0 in the call's window.
   • The expected values (more than 0, then 1, then 0) did not change.
   • The objectQLProvider census (3 sites over SLOT_FILES) is untouched, and so is SLOT_FILES. The module holds no objectQLProvider site.
   • The removed local lines had one user, and that user now reads emailLines.

7. scripts/check-route-envelope.mjs is re-pointed, not loosened: right.

   • Counted on the module by scanSource's own rules:
     • stringError is 1: :120, error: 'JSON body required'.
     • siblingCode is 3: :120, :143 and :153 (INVALID_REQUEST, VALIDATION_FAILED, EMAIL_SEND_FAILED).
     • The two 501 bodies (:81, :111) carry code and message but no error, so neither rule counts them.
     • :134 and :137 pass a variable, not a literal.
   • The body moved byte for byte, and the stub has no .json( call. So rest-server.ts drops by exactly those counts: 17 → 16 and 17 → 14.
   • Both sums hold:
     • stringError: 16 + 13 + 8 + 1 + 0 + 0 + 0 + 0 + 1 = 39;
     • siblingCode: 14 + 15 + 8 + 9 + 4 + 1 + 0 + 0 + 3 = 54.
   • auditDialectOnly requires each count to equal its pin and reds in both directions. So the pins are as tight as before.
   • The new entry is dialectOnly with ratchet #9559, like the seven moved modules before it.
   • A MODULES declaration also takes the file out of the express-writer walk (discoverExpressRoutes). So no EXPRESS_RESPONSE_MODULES entry is owed.
   • Both new history comments say "NOT progress — the same MOVE".
   • Slice 6's "two arms" carry was already closed by slice 7 ("four arms"). This slice appends after it.
   • Lint · docs & code guards concluded success.

8. The checklist JSON re-point is pure: right.

   • In integration-system.json, two strings change:
     • the source entry packages/rest/src/rest-server.ts#registerEmailEndpoints (…) becomes packages/rest/src/email-routes.ts#registerEmailEndpoints (…);
     • the verify prose's file name changes the same way.
   • All other text is unchanged.
   • The new anchor names an exported function at that path (:69).
   • The answers the entry lists are the moved body's: 401, 400 INVALID_REQUEST, VALIDATION_FAILED, 501, and 500 EMAIL_SEND_FAILED.
   • check:platform-checklist is kept out of per-PR CI by design. The dev's local reading (735 / 745 anchors resolved before and after; cited sources 347 → 348) is the dev's.

9. The readers left untouched read no moved line: right.

   • Line citations: none of the tree's rest-server.ts:NNNN citations falls in the moved range :9063–:9177. Outside released CHANGELOG text, the highest is :5872.
   • ADR anchors: the moved body cites no ADR-NNNN Dk, so no ADR anchor is owed. The rest-server.ts ADR anchor names no email symbol.
   • packages/spec:
     • No packages/spec/liveness row cites the email registrar, the route or a moved line.
     • discovery.zod.ts :396 names the method, and the method still registers the door.
   • Other source readers of rest-server.ts read regions this move does not touch:
     • execctx-authz-input-seam-reachability reads computeExecCtx only, and its seamOrUndefined( sites are there;
     • auth-gate-allowlist-fault-window reads the auth gate;
     • meta-list-projection-parity reads the /meta routes;
     • authz-store-unavailable checks for other tokens' presence;
     • check-system-context-census anchors the enforceAuth declaration;
     • check-single-authz-resolver lists the file as a delegator.
   • Gates that walk packages/rest/src still reach the moved code in its new file. These are check-rest-log-declared, check-durability-degradation-log-level, check-meta-type-normalized, check-dispatcher-error-vocabulary and check-error-status-conformance. The moved logError call is among what they reach.
   • Prose that names the method or the door without a file stays true. This covers getMountedEmailRouteBase's docblock (head :9991), discovery-routes.ts :304 and the two parity tests.

② Semver level

• skip-changeset is right. Nothing a released package publishes changes.
  • @objectstack/rest:
    • The .d.ts and the export list hold by construction (① item 4).
    • The routes and their registration order hold by the move (① item 1).
  • The rest of the diff:
    • tests, including @objectstack/dogfood's;
    • comments;
    • one gate's target table;
    • the checklist JSON.
  • The one runtime difference is the provider's call receiver (③ item 1).
    • The provider's declared type has no this.
    • No shipped wiring can observe it.
    • So it is not a published behaviour.
  • A move that changes no behaviour is not a feature or a fix. So no patch changeset is owed, the same reading slices 1–7 landed on.
• Clause-②: no is right.
  • The door reads req.params.environmentId and req.body, as before.
  • No route is added or removed, and no spec key moves.
  • No accept set widens or narrows, so no (narrowing) arm is owed.
  • Line 2 of the PR body carries the line. No changeset exists to carry it a second time.
• The changeset check's history:
  • Check Changeset concluded failure at 11:22:37Z, before the label.
  • skip-changeset was written at 11:25:59Z by objectstack-fleet[bot], the seat's write path.
  • The re-run concluded skipped at 11:26:01Z.

③ Boundary flags

Every dev flag is answered or escalated. The flags come from two places: the PR body's Acceptance notes, and the report's (6214413749) deviations and out_of_scope_findings. The report's open_questions is empty.

1. Acceptance note and out-of-scope finding 1: the provider's call receiver. ESCALATED to the seat, non-blocking.
   • The finding is right.
     • Through the host, this.emailServiceProvider!(environmentId) (:109) calls the provider with the host literal as receiver.
     • At base, the receiver was the server.
   • Only a non-arrow provider that reads this could observe the change.
     • The constructor parameter's type declares no this.
     • The shipped provider (rest-api-plugin.ts :406) is an async arrow.
   • It is not new to this slice. main already calls six providers through host getters, at these sites:
     • batch-routes.ts :172 and approvals-routes.ts :97;
     • sharing-routes.ts :108 and :563;
     • analytics-routes.ts :105;
     • security-routes.ts :124 and :417.
     • No earlier record named the property.
   • Leaving it as it is is right for this slice. A bound hand-over would be a new host shape, which the claim forbids.
   • For the seat: should later slices hand providers over bound? That includes the CRUD and /meta slices. It is a pattern question and the seat's ruling, like 6205442867.
2. Acceptance note: the moved [#15405] comment still reads true. Verified.
   • The if (!this.emailServiceProvider) guard is above it, at :80.
   • The shipped provider is async (rest-api-plugin.ts :406).
3. Deviation: hypothesis (1) partly falsified. Answered: verified (① item 2). Nothing past base :9177 moved.
4. Deviation: the static exception unused. Answered: verified (① item 1). No token changed.
5. Deviation: export on seamOrUndefined. Answered: right (① item 4).
6. Deviation: readers edited beyond the claim's named families.
   • These are the objectql census and the checklist verify prose.
   • Answered: each reads a moved line, and each edit is a pure re-point (① items 6 and 8).
   • Both cross-lane edits were declared before this review:
     • the checklist edit on [PM seat] domain:devx @ objectstack — ⏳ vacant #6023 (6214486315);
     • the gate edit on [PM seat] domain:spec — 🟢 os-elon-musk · session_01HjR8RUwTPQ3TgbfKihmxp9 #6017 (6214477252).
7. Deviation: getMountedEmailRouteBase's docblock was not edited. Answered: right.
   • It sits on a class member that ships in the .d.ts.
   • It names the method, and the method still registers the route.
   • Slices 6 and 7 handled such docblocks the same way.
8. Deviation: one merge of origin/main (6422da58e8). Answered: it is disjoint.
   • The merge commit changes none of the 15 files.
   • main is now 11 commits further on, at 94114c1f2. None of them touches packages/rest, the gate, docs/qa or the re-pointed dogfood files.
9. The other deviations are not contract matters:
   • check:dual-build-cjs-loads exiting 3, then 0;
   • the lock's batch-last-exit line;
   • the commit trailers;
   • the scratch and worktree notes.
10. Deviation: the red-before of authz-conformance.test.ts was not observed. Answered: not blocking.
    • The file pins the list's length plus a zero over the list.
    • The static recount (① item 5) reads 0 on all nine files.
11. Out-of-scope finding 2: packages/spec/src/api/discovery.zod.ts :396. Answered.
    • It names the method, not a file, and it stays true.
    • No carry is owed. No packages/spec file is edited, as the claim ordered.
12. Out-of-scope finding 3: meta-state-route-engine-outage.test.ts :95. Note only, 承接者:无.
    • Its "in this file" is dated history about rest-server.ts.
    • The test reads no source.
13. Out-of-scope finding 4: stale rest-server.ts line citations. Answered.
    • None falls in the moved range (① item 9).
    • Every line after :342 moved down by 2, as each earlier slice's import moved them.
14. New from this review: one new header sentence is wrong for one mode. Non-blocking.
    • The new module header (email-routes.ts :7–:8) says "an environment-scoped deployment mounts the door twice".
    • That holds only for projectResolution optional or auto.
    • Under required, registerRoutes mounts the scoped base alone, so the door mounts once (head :4851–:4853). The dev's own scoped-required dump counts 1 door.
    • It is new prose, not moved text, and no behaviour depends on it. The seat may have it fixed in one line before landing, or carry it to the module's next edit.
15. The dogfood pair has no PR-time verdict.
    • The sharded Dogfood Regression Gate leg and Dogfood Verify CLI skipped. The aggregate Dogfood Regression Gate concluded success.
    • The edits are attested by the dev's local run (108 passed) and by the static recount in ① item 5.
    • Not blocking, by CI's design. The seat watches main's first full battery, as for slices 4–7.
16. The Docs Drift Check (advisory) lists 32 hand-written pages and 6 release-owned pages, through route and symbol anchors. The routes, their order and each handler's logic are unchanged, so this move can falsify none of them.
17. PR shape:
    • The PR is a draft with base main.
    • Line 1 is Part of #23050 and line 2 is Clause-②: no.
    • The body has no closing keyword, and Part-of PR must not also close its card concluded success.
    • The assignee is os-tesla. The labels are size/m, tests and skip-changeset.
    • Marking it ready is the seat's act.
18. Tier: the file list derives TIER_DEFAULT. That is the tier this record serves, as the claim promised.
19. Gate verdicts on this head. There are 44 runs over 40 names. Taking the latest run per name: 29 success, 9 skipped, 0 failure, 2 in progress.
    • The one superseded failure is the pre-label Check Changeset (②).
    • The successes include:
      • Build Core, and Test Core 1/6, 4/6, 5/6 and 6/6;
      • TypeScript Type Check and the four Type Check · lanes;
      • all eight Lint · lanes and Lint & Repo Gates;
      • Spec property liveness and Governed Surface Queue Guard;
      • both No other open PR may claim … checks.
    • In progress at read: Test Core (2/6) and Test Core (3/6). The seat re-reads both before landing.

Implemented-by: claude/issue-23050-s8-email-endpoints
Reviewed-by: session_018t6a5rvqPRvEDMCVVW9kYT

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · #23050 slice 8 (email) · domain:cli seat 2 · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT · 2026-10-16T12:02Z · reviewed head 35f207b70e9155039b2f71a65cbd9e9c682a7ad9, against GitHub and the branch, not against the report's prose. Holder of claim 6213111311; report 6214413749 on #23050.

1. Shape. Draft, base main, title refactor(rest):, assignee os-tesla. Line 1 is Part of #23050: the card stays open for later slices. Line 2 is Clause-②: no. 15 files, +299 / −127. check-governed-merges --pr 23882: NOT governed (0 of 15 paths); 426 changed lines. git merge-tree is clean against origin/main.
2. Move-only, read by this seat on the git objects. Base rest-server.ts :9083–:9176 (94 lines), with one 4-space indent removed, equals head email-routes.ts :70–:163: diff exits 0. The module has no RestServer. access, so no token changed and the static exception was not used. packages/rest/src/index.ts is untouched, and the diff adds no .changeset file.
3. The review is the ## Contract review record 6214674841 on this PR: TIER_DEFAULT (the declaration face; record-recognisers --brief-template --paths over the 15 paths derives it), isolated, read-only, PASS on this head.
4. Changeset: none. This seat applied skip-changeset on its own check: no .changeset file is touched, and the published surface is byte-identical (the dev's .d.ts sha 7489de84… at base and head; the review's ① item 4 by construction).
5. Gates, pinned to the head. Check-runs on 35f207b70e read at this stamp, latest run per name: 41 names, 32 success, 9 skipped, 0 failure, nothing running. The successes include Build Core, Test Core 1–6/6, TypeScript Type Check and the four Type Check · lanes, all eight Lint · lanes, Lint & Repo Gates, Spec property liveness, Governed Surface Queue Guard and the aggregate Dogfood Regression Gate. The 9 skips are roster names: Build Docs, Console Pin Gate, Dogfood Regression Gate (matrix), Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance, and the label-event re-runs of Auto Label, Check PR Size and Check Changeset (its first run, before the label, was the expected red). The dev's local subset at this head: 80 of 80 derived gate commands exit 0 (--ran: 0 NOT-MEASURED, 0 UNRUN); @objectstack/rest local 5892 passed, repo 242 passed; typecheck exit 0; the dogfood pair 108 passed.
6. Cross-lane, declared before review: scripts/check-route-envelope.mjs on domain:spec's post (6214477252), and the integration-system.json re-point on domain:devx's post (6214486315). The dogfood files are this lane's. packages/spec is not touched.
7. Accepted deviations: hypothesis (1) of the claim partly falsified (the body reads 4 members, not the forms helpers' set); export on seamOrUndefined (one declaration, not reachable from src/index.ts, as slice 5's mayReadPendingDrafts); readers beyond the claim's named families, each a reader of a moved line (objectql-slot-consumer-census.test.ts, the checklist verify prose); getMountedEmailRouteBase's docblock left as it is (it ships in the .d.ts and stays true); one merge of origin/main 6422da58e8, disjoint.

Seat ruling on the review's escalation (③ item 1, the provider's call receiver). Later slices keep the getter shape for a provider field, unbound, as slices 2–8 did. Reason: no shipped provider reads this (each is an arrow), and no provider type declares a this parameter, so a bound hand-over changes nothing anyone can observe and would be a new host shape. If a provider's type ever declares this, the slice that moves its caller binds it and names that in its report. Recorded on #23050 with this ACCEPT.

Carried, not edited here (a new head would need a new review for comment-only text):

• The new module header (email-routes.ts :7–:8) says "an environment-scoped deployment mounts the door twice". That holds for projectResolution optional / auto only; under required the scoped base alone is mounted (rest-server.ts :4851–:4853), so the door mounts once. Read by this seat on the head. 承接者: the first non-move edit of email-routes.ts.
• 「承接者:无」: meta-state-route-engine-outage.test.ts :95's "in this file" is dated history about rest-server.ts; the test reads no source.

Landing: pr_ready + automerge_enable through the relay, in this act. On landing, #23050 goes back to pm:queue for its next slice. This seat watches main's first full battery after the landing for the dogfood pair, as for slices 4–7.

---

Generated by Claude Code