email-connect/docs/sender-transition-boundary-2026-10-31.md

Sender transition: ledger and shutdown boundary

The current receiver remains generation 74/image 5d79fd1f, using forgejo@coulomb.social. The platform sender's credential foundation is prepared under RPF-WP-0068 but unadmitted. EMAIL-WP-0010 now owns the separate configuration executor, attended switch and native return, supporting CSOC-WP-0015-T02.

At 15:16:41Z, inspect-sender-ledger.py read the native ledger in one read-only SQLite transaction. All six tables pass integrity/fingerprint checks, including committed WAL. Aggregate results: 2 accepted invitations, 121 accepted verification attempts, 1 suppression, no unknown outcomes, orphan attempts, unrecognized states or unlinked verification rows. No private row values were printed. Evidence: sender-ledger-native-2026-10-31.json. The receipt binds the exact observer source and native transactional source, which matches the checkout. The deployment spec was unchanged across observation; no resource or sender change was made.

What the observation means

The successful invitation path writes its provider receipt into deliveries but leaves the corresponding send_attempts row in_flight. That row by itself is not evidence of uncertainty: delivery_status and reserve_send check deliveries first. Verification sends instead explicitly update their attempt to accepted. The observer follows both conventions and reports only counts and hashes.

The source uses wsgiref.simple_server without an explicit SIGTERM handler. The Deployment has 15 seconds termination grace, but that setting does not establish application-level draining. Termination between SMTP acceptance and ledger commit can retain an unknown outcome. Existing source refuses blind resubmission; a configuration change must preserve this behavior and the whole ledger. The new observer neither alters reservations nor decides whether a provider accepted mail.

No uncertain outcomes were present at this observation. Writers were active; new requests can arrive afterward. Therefore this does not establish a drained receiver or a valid execution-time baseline. Unlinked historical challenges are reported separately; they may include superseded retries and are not automatically classified as uncertain sends or relabeled as accepted.

Remaining executor work

The executor must combine a verified foundation return with current identity/spec guards, writer quiescence and a fresh recoverable ledger point. It must retain phase evidence across lost replies and distinguish source configuration rollback from data restoration. A failed rollout must not overwrite accepted/unknown sends, consumed or canceled handles, suppression or quotas, including later legitimate writes. The old reader/projection remains retained for guarded rollback; no mailbox credential is copied into source, chat or a public receipt.

The existing consumer dry-run candidate changes only the sender and credential references, but is not an execution procedure. Exact supervised controller and interruption tests are EMAIL-WP-0010-T02; live switch and independent postflight are T03/T04. Productive mail authentication and inbox/return handling remain CSOC-WP-0015-T02/T05. No new execution approval is requested by this observation.

Validation

Twelve new synthetic cases pass. They compare the exact fingerprint format with the existing archive implementation, preserve all rows, distinguish accepted in_flight invitation rows from unknowns, retain unknown retry refusal after reopen, classify verification/history cases, and prove that a concurrent committed WAL write cannot split the fingerprint and outcome counts across snapshots. Missing, symlinked, oversized and unexpected-schema input refuses; CLI failures redact paths. Tests use no production URLs/accounts or provider sends.

Owner default suite: 192 passed, 21 skipped in 13.21s. Those 21 existing tests require the opt-in container mail harness; no new test is skipped. This is sufficient evidence for the read-only observer and is not a delivered-message or rollout acceptance claim. Ruff passes for both changed Python files. Log: /tmp/email-sender-ledger-check-20261031.log.