ADR-0150: the email template send judges the served holders (a disabled package holds no name at the send) #32670

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Parent: #32354 (nested here because #31527 is at GitHub's sub-issue cap). Filed under epic ruling R4-E on PR #32497 (#32183).

Blocked-by: #32183

Premise

#32183 makes a disabled package hold no name at the resolve. Under ruling R4-A, PR #32497 holds the email template send door (packages/plugins/plugin-email/src/template-loader.ts, bundleAddressOf) at main's answers: the resolve, the holder count and the shared view read every holder (includeDisabledPackages: true). So at the send, a disabled package still counts as a holder, and a refusal still names it. This card makes the send judge the served holders without leaking another package's bundle member.

Why it was not done in #32183: the door reads a flat environment-wide list after a scoped resolve. Three review rounds each found another member on a disabled holder's side of that list: a row of its customization pair, or a locale a dependent adds (contract review 6819947096, M3).

Fix shape

• The send judges the served holders: the resolve, the count and the shared view.
• Member rule (6819947096): a send returns only members stored under one of:
  • the resolved holder;
  • its pair;
  • a dependent whose closure holds the resolved holder;
  • no package.
• A dependent never gets a template from outside its closure.
• Restore rows 27 to 31 of PR fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497's round-3 table (withdrawn under R4-A). Declare each FROM → TO with its Clause-② arm, and pin it.
• Sweep: any other door held at main under R4-G of the same ruling joins this card.

Acceptance

• The reviewer's probe matrix of 6819947096 ① (704 answers per tree at the send door):
  • one or two holders, each enabled or disabled;
  • a package-less row (the environment's item before or after, a stored row);
  • a pair member row;
  • a dependent's addition, enabled or disabled;
  • a built-in template;
  • every caller class;
  • en-US and fr-FR, both reads, both orders.
• Every answer is either unchanged from main or a declared, pinned row.
• Real stored pair rows and a dependent's addition in the pins, not a double over registry.listItems.
• CONTROLs: all enabled; one holder.

Order

• Server lane (epic-dispatched). Start after objectql + metadata-protocol + runtime: by-name doors judge a name's holders over the served list, so a disabled package neither refuses nor is named (ADR-0150 D3; #32101 F4 class) #32183 (PR fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497) lands.
• Lands after metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354, which owns the unmoved list cases.