Email ingestion log behind the strict door
/admin/dev/email-ingestion still loads after GET /api/email/ingestion-log starts refusing a list read that names no company.
6 Oct 2026 · branch fix/ingestion-log-strict-door · captured against propflow-stage · at 3467c9d5bb3+local
Data note. Every name and balance below comes from propflow-stage, which is anonymized by construction (ADR-0097/0110 — phones in the impossible +1000 NPA, emails @example.test). The identical capture against prod would carry real tenants' names and balances and is not safe to attach anywhere, which is why the generator refuses to run against one.
1 · 1 · Opened with nothing in the address: the log still loads
This is the case the change could have broken. The route now refuses a list read whose own address names no company, and this page's address names nothing. Neither the server's first paint nor the 10-second refresh sends a bare request, though. The seed writes the render's one selection (mintSelection()) onto its request, and the refresh sends useTabScope().query, which is serialized from that same selection. That selection is whatever this login last picked (the remembered pick, so which company it is depends on the login's history). The assertion is the table itself: a refused read shows a 'Pick a company' banner instead of the table (pinned by pick-note.dom.test.tsx).
Asserted in the captured DOM — Email Ingestion Log · Received · Subject · Property · Status
Sections 2–2 and notes
2 · 2 · All companies named on the address
The fleet named explicitly. It should match section 1, because section 1's requests carry the same org=*.
Asserted in the captured DOM — Email Ingestion Log · Showing every company's emails.
What is not photographed here, and why
The new banner, Pick a company, or All companies, to see its emails., appears only when the route answers needs_a_selection. Inside the app that happens only for a viewer whose selection serializes to nothing (an empty grant), and that viewer cannot reach this platform-admin page. The capture tool cannot fake a route's answer, so the banner is pinned by pick-note.dom.test.tsx, which mounts the real island against a 400 needs_a_selection answer and asserts the banner, no table, and no 'couldn't load' message.