diff --git a/.env.example b/.env.example
index 6454de4d..a42b9560 100644
--- a/.env.example
+++ b/.env.example
@@ -283,8 +283,11 @@ ZONE_MCP_AUTO_MAGENTS=true
 # ZONE_NOTIFY_DISCORD_WEBHOOK=https://discord.com/api/webhooks/...
 # ZONE_NOTIFY_EMAIL_TO=alerts@example.com,ops@example.com
 # ZONE_NOTIFY_TIMEOUT_SECONDS=10
-# SMTP_* - The relay ZONE_NOTIFY_EMAIL_TO, sign-up verification, password
-# resets and invitations send through. ALERT_SMTP_* below is Grafana's own.
+# SMTP_* - The relay ZONE_NOTIFY_EMAIL_TO, sign-up verification and password
+# resets send through. Port 465 connects with implicit TLS; any other port,
+# 587 included, upgrades with STARTTLS before signing in. A blank value other
+# than SMTP_PASSWORD counts as unset, and an unreadable SMTP_PORT falls back
+# to 587. ALERT_SMTP_* below is Grafana's own.
 # SMTP_HOST=smtp.example.com
 # SMTP_PORT=587
 # SMTP_USER=
diff --git a/README.md b/README.md
index ad29670e..4ccd0e3a 100644
--- a/README.md
+++ b/README.md
@@ -433,7 +433,6 @@ zone/
 │   │   ├── src/video.rs     # Training frames pulled out of a submitted clip
 │   │   ├── src/subject.rs   # Subject-aware framing for training crops
 │   │   └── src/caption.rs   # Vision captioning for training sets
-│   ├── zone_email/          # Transactional email over SMTP
 │   ├── zone_search/         # SearXNG web search client
 │   ├── zone_vcs/            # Local git operations and GitHub pull requests
 │   ├── zone_vision/         # Subject detection and subject-aware cropping
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 6cb89b0a..d00e91cd 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -1841,8 +1841,8 @@ Every notice — an auto-project merge, pause or completion, a regression alert,
 - **Description**: How long one channel is given per notice.
 
 ### `SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_FROM`, `SMTP_FROM_NAME`
-- **Default**: *empty* (`SMTP_PORT` 587, `SMTP_FROM_NAME` Zone)
-- **Description**: The relay notices, sign-up verification, password resets and invitations send through. `ALERT_SMTP_*` is Grafana's relay and is separate.
+- **Default**: *empty* (`SMTP_PORT` 587, `SMTP_FROM_NAME` Zone; a blank value other than `SMTP_PASSWORD` counts as unset and an unreadable `SMTP_PORT` falls back to 587; sign-up and reset mail falls back to `noreply@zone.app` when `SMTP_FROM` is unset, email notices need it set)
+- **Description**: The relay notices, sign-up verification and password resets send through. Port 465 connects with implicit TLS; any other port, 587 included, must upgrade with STARTTLS before signing in. `ALERT_SMTP_*` is Grafana's relay and is separate.
 
 ---
 
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 2f20d235..bd15b287 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -58,7 +58,7 @@ Verified on `main` (`d3fb7cf`). Reuse is the default; each row says whether it's
 | MQTT broker | `~/Local/mqtt` (Swoole) | OTA substrate for `ota_fleet` |
 | Appwrite | Sites, Functions, Storage, Messaging | Delivery targets + backend provisioning (v1.5) |
 | Charts, cluster | `helm/zone-apps` (`_helpers.tpl` conventions, security contexts, HPA/PDB/NetworkPolicy), `k8s/kind-config.yaml` (`zone-dev`, ports 30000-30002 pre-mapped, CNPG, HAProxy default IngressClass) | New `helm/zone-app` copies conventions; kind is the first k8s target |
-| Notifications | None in the server. `ALERT_DISCORD_WEBHOOK_URL` is consumed only by Grafana (`grafana/entrypoint.sh`); `zone_email::EmailService` has three templated senders; reminders deliver as assistant messages into a chat (`db/reminders.rs:61-90`) | New `notify` module |
+| Notifications | None in the server. `ALERT_DISCORD_WEBHOOK_URL` is consumed only by Grafana (`grafana/entrypoint.sh`); `services::mail::AccountMail` sends two templated account messages (abnegate-notify `Mailer`); reminders deliver as assistant messages into a chat (`db/reminders.rs:61-90`) | New `notify` module |
 
 **Gaps that block the feature (phase 0):**
 
@@ -639,7 +639,7 @@ Stated tradeoff: while blocked, a task holds one of `MAX_CONCURRENT_TASKS = 5` p
 `Notifier` trait with three channels, fanned out with `join_all`, failures logged and never blocking the deployment:
 
 - `DiscordWebhook` — an embed with app, target, artifact kind, digest, requester, values digest, and a deep link to `/deployments?id=…` (the desktop/mobile shell opens it too). Webhook URL from the target's `notify` block, falling back to a server-level `ALERT_DISCORD_WEBHOOK_URL` that `config.rs` now reads as well as Grafana. Webhooks are one-way; one-tap approve from Discord needs bot interactions and is a later phase.
-- `Email` — new `zone_email::send_approval_request`.
+- `Email` — a new approval-request `services::mail::Template`, sent through `AccountMail`.
 - `InApp` — an assistant message into the originating chat, the reminders pattern (`db/reminders.rs:61-90`).
 
 ### 7.6 Agent tools — `runner/zone_server/src/agent/deploy.rs`
diff --git a/docs/SYSTEM-PROMPT-RESEARCH.md b/docs/SYSTEM-PROMPT-RESEARCH.md
index 7454e974..028ba265 100644
--- a/docs/SYSTEM-PROMPT-RESEARCH.md
+++ b/docs/SYSTEM-PROMPT-RESEARCH.md
@@ -251,7 +251,7 @@ SOL 707-734 is a complete contract: the schedule is an iCal `VEVENT` with `RRULE
 CC 1688-1820 (Monitor: each stdout line is an event; "silence is not success" at 1738-1748 with a wrong-and-right grep example; a `gh pr checks` poller at 1717-1726; 200 ms batching; auto-stop on flood). CC 888 (a background command re-invokes the loop on exit; foreground sleep is blocked). CC 2107-2162 (self-paced wakeups sized to what is being waited for; `noop` ticks collapsed in the UI). Zone's `tail_task_log`, `get_task_run` and `get_build_status` force the model to poll and spend rounds. Build: `wait_for(target, timeout)` covering task-run completion, GitHub check completion and background job exit, implemented server-side, suspending the loop without consuming an iteration.
 
 **I3. Notification cost rule. P0 when a notify tool is exposed.**
-CC 1875-1906: err toward not sending; one line under 200 characters; lead with what the user would act on; skip when the user is present. `zone_notify` exists; apply when it becomes a tool.
+CC 1875-1906: err toward not sending; one line under 200 characters; lead with what the user would act on; skip when the user is present. `workers::notify` (abnegate-notify) exists; apply when it becomes a tool.
 
 ### 2.10 Git and task specifics
 
diff --git a/runner/Cargo.lock b/runner/Cargo.lock
index d51b8848..45347542 100644
--- a/runner/Cargo.lock
+++ b/runner/Cargo.lock
@@ -65,6 +65,26 @@ dependencies = [
  "thiserror 2.0.20",
 ]
 
+[[package]]
+name = "abnegate-notify"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "541104394c2a22febfab31f003d93e073a49684afbbcabbc32eb5a27eba4adc8"
+dependencies = [
+ "abnegate-secret",
+ "async-trait",
+ "chrono",
+ "futures",
+ "lettre",
+ "reqwest 0.13.5",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "abnegate-secret"
 version = "0.1.3"
@@ -9881,16 +9901,6 @@ dependencies = [
  "zone_installer",
 ]
 
-[[package]]
-name = "zone_email"
-version = "0.1.0"
-dependencies = [
- "lettre",
- "thiserror 2.0.20",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "zone_installer"
 version = "0.1.0"
@@ -9917,26 +9927,6 @@ dependencies = [
  "tracing-subscriber",
 ]
 
-[[package]]
-name = "zone_notify"
-version = "0.1.0"
-dependencies = [
- "abnegate-secret",
- "async-trait",
- "chrono",
- "futures",
- "lettre",
- "reqwest 0.13.5",
- "serde",
- "serde_json",
- "thiserror 2.0.20",
- "tokio",
- "tracing",
- "url",
- "wiremock",
- "zone_core",
-]
-
 [[package]]
 name = "zone_runner"
 version = "0.1.0"
@@ -9976,6 +9966,7 @@ version = "0.1.0"
 dependencies = [
  "abnegate-exec",
  "abnegate-http",
+ "abnegate-notify",
  "abnegate-secret",
  "aes-gcm",
  "aiusg",
@@ -9997,7 +9988,6 @@ dependencies = [
  "hyper-util",
  "iana-time-zone",
  "jsonwebtoken 11.0.0",
- "lettre",
  "metrics",
  "metrics-exporter-prometheus",
  "nix",
@@ -10028,8 +10018,6 @@ dependencies = [
  "zone_comfy",
  "zone_context",
  "zone_core",
- "zone_email",
- "zone_notify",
  "zone_search",
  "zone_vcs",
 ]
diff --git a/runner/Cargo.toml b/runner/Cargo.toml
index 5b4444a8..3d84d1a1 100644
--- a/runner/Cargo.toml
+++ b/runner/Cargo.toml
@@ -1,7 +1,7 @@
 [workspace]
 resolver = "2"
-members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_email", "zone_notify", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision", "zone_desktop"]
-default-members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_email", "zone_notify", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision"]
+members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision", "zone_desktop"]
+default-members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision"]
 
 [workspace.package]
 version = "0.1.0"
@@ -39,6 +39,7 @@ abnegate-config = "0.1"
 abnegate-exec = "0.1"
 abnegate-http = "0.1"
 abnegate-index = "0.1"
+abnegate-notify = "0.1"
 abnegate-secret = "0.1.3"
 
 # Server dependencies
diff --git a/runner/zone_email/Cargo.toml b/runner/zone_email/Cargo.toml
deleted file mode 100644
index b80f351e..00000000
--- a/runner/zone_email/Cargo.toml
+++ /dev/null
@@ -1,14 +0,0 @@
-[package]
-name = "zone_email"
-description = "Transactional email over SMTP"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-rust-version.workspace = true
-
-[dependencies]
-thiserror = { workspace = true }
-tokio = { workspace = true }
-tracing = { workspace = true }
-lettre = { version = "=0.11.23", features = ["tokio1-native-tls", "builder", "smtp-transport"] }
diff --git a/runner/zone_email/src/lib.rs b/runner/zone_email/src/lib.rs
deleted file mode 100644
index d21ff21a..00000000
--- a/runner/zone_email/src/lib.rs
+++ /dev/null
@@ -1,347 +0,0 @@
-//! Transactional email over SMTP.
-//!
-//! [`EmailService`] sends the verification, password reset, and invitation
-//! messages an account flow needs.
-//!
-//! ```no_run
-//! # async fn example() -> Result<(), Box<dyn std::error::Error>> {
-//! use zone_email::EmailService;
-//!
-//! EmailService::from_env()?
-//!     .send_verification_email("person@example.com", "Sam", "https://zone.test/verify?t=abc")
-//!     .await?;
-//! # Ok(())
-//! # }
-//! ```
-
-use lettre::address::AddressError;
-use lettre::message::header::ContentType;
-use lettre::transport::smtp::authentication::Credentials;
-use lettre::{Message, SmtpTransport, Transport};
-use std::env;
-use thiserror::Error;
-
-#[derive(Debug, Error)]
-pub enum EmailError {
-    #[error("Failed to build email: {0}")]
-    BuildError(#[from] lettre::error::Error),
-
-    #[error("Failed to send email: {0}")]
-    SendError(#[from] lettre::transport::smtp::Error),
-
-    #[error("Invalid email address: {0}")]
-    AddressError(#[from] AddressError),
-
-    #[error("Email service not configured")]
-    NotConfigured,
-
-    #[error("Invalid email configuration: {0}")]
-    InvalidConfig(String),
-}
-
-pub type EmailResult<T> = Result<T, EmailError>;
-
-/// Email service configuration
-#[derive(Clone)]
-pub struct EmailConfig {
-    pub smtp_host: String,
-    pub smtp_port: u16,
-    pub smtp_user: String,
-    pub smtp_password: String,
-    pub from_email: String,
-    pub from_name: String,
-}
-
-/// Custom Debug implementation that redacts the SMTP password
-impl std::fmt::Debug for EmailConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("EmailConfig")
-            .field("smtp_host", &self.smtp_host)
-            .field("smtp_port", &self.smtp_port)
-            .field("smtp_user", &self.smtp_user)
-            .field("smtp_password", &"[REDACTED]")
-            .field("from_email", &self.from_email)
-            .field("from_name", &self.from_name)
-            .finish()
-    }
-}
-
-impl EmailConfig {
-    /// Load configuration from environment variables
-    pub fn from_env() -> EmailResult<Self> {
-        let smtp_host = env::var("SMTP_HOST").map_err(|_| EmailError::NotConfigured)?;
-
-        let smtp_port = env::var("SMTP_PORT")
-            .unwrap_or_else(|_| "587".to_string())
-            .parse::<u16>()
-            .map_err(|e| EmailError::InvalidConfig(format!("Invalid SMTP_PORT: {}", e)))?;
-
-        let smtp_user = env::var("SMTP_USER").map_err(|_| EmailError::NotConfigured)?;
-
-        let smtp_password = env::var("SMTP_PASSWORD").map_err(|_| EmailError::NotConfigured)?;
-
-        let from_email = env::var("SMTP_FROM").unwrap_or_else(|_| "noreply@zone.app".to_string());
-
-        let from_name = env::var("SMTP_FROM_NAME").unwrap_or_else(|_| "Zone".to_string());
-
-        Ok(Self {
-            smtp_host,
-            smtp_port,
-            smtp_user,
-            smtp_password,
-            from_email,
-            from_name,
-        })
-    }
-}
-
-/// Email service for sending transactional emails
-pub struct EmailService {
-    config: EmailConfig,
-    mailer: SmtpTransport,
-}
-
-impl EmailService {
-    /// Create a new email service with the given configuration
-    pub fn new(config: EmailConfig) -> EmailResult<Self> {
-        let creds = Credentials::new(config.smtp_user.clone(), config.smtp_password.clone());
-
-        let mailer = SmtpTransport::relay(&config.smtp_host)
-            .map_err(|e| EmailError::InvalidConfig(format!("Invalid SMTP host: {}", e)))?
-            .port(config.smtp_port)
-            .credentials(creds)
-            .build();
-
-        Ok(Self { config, mailer })
-    }
-
-    /// Create email service from environment variables
-    pub fn from_env() -> EmailResult<Self> {
-        let config = EmailConfig::from_env()?;
-        Self::new(config)
-    }
-
-    /// Send an email verification email
-    pub async fn send_verification_email(
-        &self,
-        to_email: &str,
-        to_name: &str,
-        verification_url: &str,
-    ) -> EmailResult<()> {
-        let subject = "Verify your email address";
-        let body = format!(
-            r#"
-Hello {},
-
-Thank you for signing up for Zone!
-
-Please verify your email address by clicking the link below:
-
-{}
-
-This link will expire in 24 hours.
-
-If you did not create an account, you can safely ignore this email.
-
-Best regards,
-The Zone Team
-            "#,
-            to_name, verification_url
-        );
-
-        self.send_email(to_email, subject, &body).await
-    }
-
-    /// Send a password reset email
-    pub async fn send_password_reset_email(
-        &self,
-        to_email: &str,
-        to_name: &str,
-        reset_url: &str,
-    ) -> EmailResult<()> {
-        let subject = "Reset your password";
-        let body = format!(
-            r#"
-Hello {},
-
-We received a request to reset your password for your Zone account.
-
-Click the link below to reset your password:
-
-{}
-
-This link will expire in 1 hour.
-
-If you did not request a password reset, you can safely ignore this email.
-Your password will not be changed unless you click the link above and create a new password.
-
-Best regards,
-The Zone Team
-            "#,
-            to_name, reset_url
-        );
-
-        self.send_email(to_email, subject, &body).await
-    }
-
-    /// Send an invitation email
-    pub async fn send_invitation_email(
-        &self,
-        to_email: &str,
-        org_name: &str,
-        inviter_name: &str,
-        invitation_url: &str,
-    ) -> EmailResult<()> {
-        let subject = format!("You've been invited to join {} on Zone", org_name);
-        let body = format!(
-            r#"
-Hello,
-
-{} has invited you to join the {} organization on Zone.
-
-Click the link below to accept the invitation:
-
-{}
-
-This link will expire in 7 days.
-
-If you don't have a Zone account yet, you'll be able to create one after clicking the link.
-
-Best regards,
-The Zone Team
-            "#,
-            inviter_name, org_name, invitation_url
-        );
-
-        self.send_email(to_email, &subject, &body).await
-    }
-
-    /// Send a generic email
-    async fn send_email(&self, to_email: &str, subject: &str, body: &str) -> EmailResult<()> {
-        let email = Message::builder()
-            .from(format!("{} <{}>", self.config.from_name, self.config.from_email).parse()?)
-            .to(to_email.parse()?)
-            .subject(subject)
-            .header(ContentType::TEXT_PLAIN)
-            .body(body.to_string())?;
-
-        // Send email in a blocking task to avoid blocking the async runtime
-        let mailer = self.mailer.clone();
-        tokio::task::spawn_blocking(move || mailer.send(&email))
-            .await
-            .map_err(|e| EmailError::InvalidConfig(format!("Task join error: {}", e)))?
-            .map_err(EmailError::SendError)?;
-
-        Ok(())
-    }
-}
-
-/// Mock email service for testing (doesn't actually send emails)
-#[cfg(test)]
-pub struct MockEmailService {
-    pub sent_emails: std::sync::Arc<tokio::sync::Mutex<Vec<SentEmail>>>,
-}
-
-#[cfg(test)]
-#[derive(Debug, Clone)]
-pub struct SentEmail {
-    pub to: String,
-    pub subject: String,
-    pub body: String,
-}
-
-#[cfg(test)]
-impl Default for MockEmailService {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[cfg(test)]
-impl MockEmailService {
-    pub fn new() -> Self {
-        Self {
-            sent_emails: std::sync::Arc::new(tokio::sync::Mutex::new(Vec::new())),
-        }
-    }
-
-    pub async fn send_verification_email(
-        &self,
-        to_email: &str,
-        _to_name: &str,
-        _verification_url: &str,
-    ) -> EmailResult<()> {
-        let mut emails = self.sent_emails.lock().await;
-        emails.push(SentEmail {
-            to: to_email.to_string(),
-            subject: "Verify your email address".to_string(),
-            body: "Verification email".to_string(),
-        });
-        Ok(())
-    }
-
-    pub async fn send_password_reset_email(
-        &self,
-        to_email: &str,
-        _to_name: &str,
-        _reset_url: &str,
-    ) -> EmailResult<()> {
-        let mut emails = self.sent_emails.lock().await;
-        emails.push(SentEmail {
-            to: to_email.to_string(),
-            subject: "Reset your password".to_string(),
-            body: "Password reset email".to_string(),
-        });
-        Ok(())
-    }
-
-    pub async fn get_sent_emails(&self) -> Vec<SentEmail> {
-        self.sent_emails.lock().await.clone()
-    }
-
-    pub async fn clear(&self) {
-        self.sent_emails.lock().await.clear();
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn test_mock_email_service_tracks_sent_emails() {
-        let service = MockEmailService::new();
-
-        service
-            .send_verification_email("test@example.com", "Test User", "http://example.com/verify")
-            .await
-            .expect("Failed to send verification email");
-
-        service
-            .send_password_reset_email("test@example.com", "Test User", "http://example.com/reset")
-            .await
-            .expect("Failed to send reset email");
-
-        let emails = service.get_sent_emails().await;
-        assert_eq!(emails.len(), 2);
-        assert_eq!(emails[0].to, "test@example.com");
-        assert_eq!(emails[0].subject, "Verify your email address");
-        assert_eq!(emails[1].subject, "Reset your password");
-    }
-
-    #[tokio::test]
-    async fn test_mock_email_service_can_be_cleared() {
-        let service = MockEmailService::new();
-
-        service
-            .send_verification_email("test@example.com", "Test User", "http://example.com/verify")
-            .await
-            .expect("Failed to send email");
-
-        assert_eq!(service.get_sent_emails().await.len(), 1);
-
-        service.clear().await;
-
-        assert_eq!(service.get_sent_emails().await.len(), 0);
-    }
-}
diff --git a/runner/zone_notify/Cargo.toml b/runner/zone_notify/Cargo.toml
deleted file mode 100644
index a5bc5dfb..00000000
--- a/runner/zone_notify/Cargo.toml
+++ /dev/null
@@ -1,34 +0,0 @@
-[package]
-name = "zone_notify"
-description = "Multi-channel notification fan-out"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-repository.workspace = true
-rust-version.workspace = true
-
-[dependencies]
-async-trait = { workspace = true }
-chrono = { workspace = true }
-futures = { workspace = true }
-serde = { workspace = true }
-serde_json = { workspace = true }
-thiserror = { workspace = true }
-tokio = { workspace = true }
-tracing = { workspace = true }
-url = "=2.5.8"
-
-reqwest = { workspace = true }
-lettre = { version = "=0.11.23", default-features = false, features = [
-    "builder",
-    "smtp-transport",
-    "hostname",
-    "tokio1-native-tls",
-] }
-
-abnegate-secret = { workspace = true }
-zone_core = { path = "../zone_core" }
-
-[dev-dependencies]
-tokio = { workspace = true, features = ["test-util", "macros"] }
-wiremock = "=0.6.5"
diff --git a/runner/zone_notify/src/backend/discord.rs b/runner/zone_notify/src/backend/discord.rs
deleted file mode 100644
index b3d50e61..00000000
--- a/runner/zone_notify/src/backend/discord.rs
+++ /dev/null
@@ -1,302 +0,0 @@
-//! Discord, over a channel webhook.
-
-use async_trait::async_trait;
-use chrono::SecondsFormat;
-use serde_json::{Value, json};
-
-use crate::backend::webhook::Webhook;
-use crate::channel::Channel;
-use crate::endpoint::Endpoint;
-use crate::error::NotifyError;
-use crate::fanout::DEFAULT_TIMEOUT;
-use crate::notification::Notification;
-use crate::notifier::Notifier;
-use crate::severity::Severity;
-use crate::text::truncate;
-
-const HOSTS: &[&str] = &[
-    "discord.com",
-    "discordapp.com",
-    "canary.discord.com",
-    "ptb.discord.com",
-];
-const MAX_TITLE_CHARS: usize = 256;
-const MAX_DESCRIPTION_CHARS: usize = 4_096;
-const MAX_FIELD_NAME_CHARS: usize = 256;
-const MAX_FIELD_VALUE_CHARS: usize = 1_024;
-const MAX_FIELDS: usize = 25;
-const FOOTER: &str = "Zone";
-
-/// Delivers to one Discord channel webhook.
-#[derive(Debug)]
-pub struct Discord {
-    webhook: Webhook,
-    name: Option<String>,
-}
-
-impl Discord {
-    /// Point at `webhook_url`, which must be a Discord webhook URL.
-    pub fn new(webhook_url: &str) -> Result<Self, NotifyError> {
-        let endpoint = Endpoint::new(webhook_url, HOSTS)?;
-        Ok(Self {
-            webhook: Webhook::new(endpoint, DEFAULT_TIMEOUT)?,
-            name: None,
-        })
-    }
-
-    /// Label this instance, for a workspace with more than one Discord hook.
-    #[must_use]
-    pub fn named(mut self, name: impl Into<String>) -> Self {
-        self.name = Some(name.into());
-        self
-    }
-
-    #[cfg(test)]
-    pub(crate) fn at_test_server(base_url: &str) -> Self {
-        Self {
-            webhook: Webhook::new(
-                Endpoint::for_test(&format!("{base_url}/api/webhooks/1/secret")),
-                DEFAULT_TIMEOUT,
-            )
-            .expect("test client"),
-            name: None,
-        }
-    }
-
-    fn payload(&self, notification: &Notification) -> Value {
-        let mut embed = json!({
-            "title": truncate(notification.title(), MAX_TITLE_CHARS),
-            "color": colour(notification.kind()),
-            "footer": { "text": FOOTER },
-            "timestamp": notification
-                .timestamp()
-                .to_rfc3339_opts(SecondsFormat::Secs, true),
-        });
-
-        if !notification.body().is_empty() {
-            embed["description"] = json!(truncate(notification.body(), MAX_DESCRIPTION_CHARS));
-        }
-
-        if let Some(link) = notification.url() {
-            embed["url"] = json!(link);
-        }
-
-        if !notification.fields().is_empty() {
-            let fields: Vec<Value> = notification
-                .fields()
-                .iter()
-                .take(MAX_FIELDS)
-                .map(|field| {
-                    json!({
-                        "name": truncate(field.name(), MAX_FIELD_NAME_CHARS),
-                        "value": truncate(field.value(), MAX_FIELD_VALUE_CHARS),
-                        "inline": true,
-                    })
-                })
-                .collect();
-            embed["fields"] = json!(fields);
-        }
-
-        json!({ "embeds": [embed] })
-    }
-}
-
-#[async_trait]
-impl Notifier for Discord {
-    fn channel(&self) -> Channel {
-        Channel::DISCORD
-    }
-
-    fn name(&self) -> Option<&str> {
-        self.name.as_deref()
-    }
-
-    async fn deliver(&self, notification: &Notification) -> Result<(), NotifyError> {
-        self.webhook.post(&self.payload(notification)).await?;
-        Ok(())
-    }
-}
-
-/// Discord renders an embed's accent bar from a decimal RGB integer.
-fn colour(severity: Severity) -> u32 {
-    match severity {
-        Severity::Info => 0x3498db,
-        Severity::Success => 0x2ecc71,
-        Severity::Warning => 0xf39c12,
-        Severity::Error => 0xe74c3c,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::endpoint::EndpointError;
-    use chrono::{TimeZone, Utc};
-    use std::time::Duration;
-    use wiremock::matchers::{body_json, header, method, path};
-    use wiremock::{Mock, MockServer, ResponseTemplate};
-
-    fn at(server: &MockServer) -> Discord {
-        Discord::at_test_server(&server.uri())
-    }
-
-    fn pinned(title: &str, body: &str) -> Notification {
-        Notification::new(title, body).at(Utc.with_ymd_and_hms(2026, 9, 8, 12, 0, 0).unwrap())
-    }
-
-    #[test]
-    fn every_discord_host_is_accepted_and_others_are_not() {
-        for host in HOSTS {
-            let url = format!("https://{host}/api/webhooks/1/token");
-            assert!(Discord::new(&url).is_ok(), "{host} should be allowed");
-        }
-
-        let error = Discord::new("https://discord.com.attacker.test/api/webhooks/1/token")
-            .expect_err("lookalike host must be refused");
-        assert!(matches!(
-            error,
-            NotifyError::Endpoint(EndpointError::HostNotAllowed { .. })
-        ));
-    }
-
-    #[test]
-    fn the_webhook_url_never_appears_in_debug() {
-        let discord =
-            Discord::new("https://discord.com/api/webhooks/1/xxxxSECRETxxxx").expect("valid");
-        let rendered = format!("{discord:?}");
-        assert!(!rendered.contains("xxxxSECRETxxxx"), "leaked: {rendered}");
-        assert!(rendered.contains("discord.com"));
-    }
-
-    #[tokio::test]
-    async fn the_payload_is_a_single_embed() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .and(path("/api/webhooks/1/secret"))
-            .and(header("content-type", "application/json"))
-            .and(body_json(json!({
-                "embeds": [{
-                    "title": "Build failed",
-                    "color": 15158332,
-                    "footer": { "text": "Zone" },
-                    "timestamp": "2026-09-08T12:00:00Z",
-                    "description": "3 tests failed",
-                    "url": "https://zone.test/b/1",
-                    "fields": [
-                        { "name": "Branch", "value": "main", "inline": true },
-                        { "name": "Commit", "value": "abc", "inline": true }
-                    ]
-                }]
-            })))
-            .respond_with(ResponseTemplate::new(204))
-            .expect(1)
-            .mount(&server)
-            .await;
-
-        let notification = pinned("Build failed", "3 tests failed")
-            .severity(Severity::Error)
-            .link("https://zone.test/b/1")
-            .field("Branch", "main")
-            .field("Commit", "abc");
-
-        at(&server).deliver(&notification).await.expect("delivered");
-    }
-
-    #[tokio::test]
-    async fn optional_parts_are_omitted_rather_than_sent_as_null() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .and(body_json(json!({
-                "embeds": [{
-                    "title": "Heads up",
-                    "color": 3447003,
-                    "footer": { "text": "Zone" },
-                    "timestamp": "2026-09-08T12:00:00Z",
-                }]
-            })))
-            .respond_with(ResponseTemplate::new(204))
-            .expect(1)
-            .mount(&server)
-            .await;
-
-        at(&server)
-            .deliver(&pinned("Heads up", ""))
-            .await
-            .expect("delivered");
-    }
-
-    #[test]
-    fn each_severity_maps_to_its_own_colour() {
-        assert_eq!(colour(Severity::Info), 3447003);
-        assert_eq!(colour(Severity::Success), 3066993);
-        assert_eq!(colour(Severity::Warning), 15965202);
-        assert_eq!(colour(Severity::Error), 15158332);
-    }
-
-    #[test]
-    fn discords_field_ceiling_is_respected() {
-        let mut notification = pinned("Many", "");
-        for index in 0..40 {
-            notification = notification.field(format!("Key {index}"), "value");
-        }
-
-        let discord = Discord::new("https://discord.com/api/webhooks/1/token").expect("valid");
-        let payload = discord.payload(&notification);
-        assert_eq!(
-            payload["embeds"][0]["fields"]
-                .as_array()
-                .expect("fields")
-                .len(),
-            MAX_FIELDS
-        );
-    }
-
-    #[test]
-    fn over_long_text_is_cut_to_discords_limits() {
-        let notification =
-            pinned(&"T".repeat(500), &"B".repeat(9_000)).field("N".repeat(400), "V".repeat(2_000));
-
-        let discord = Discord::new("https://discord.com/api/webhooks/1/token").expect("valid");
-        let embed = discord.payload(&notification);
-        let embed = &embed["embeds"][0];
-
-        assert_eq!(
-            embed["title"].as_str().unwrap().chars().count(),
-            MAX_TITLE_CHARS
-        );
-        assert_eq!(
-            embed["description"].as_str().unwrap().chars().count(),
-            MAX_DESCRIPTION_CHARS
-        );
-        assert_eq!(
-            embed["fields"][0]["name"].as_str().unwrap().chars().count(),
-            MAX_FIELD_NAME_CHARS
-        );
-        assert_eq!(
-            embed["fields"][0]["value"]
-                .as_str()
-                .unwrap()
-                .chars()
-                .count(),
-            MAX_FIELD_VALUE_CHARS
-        );
-    }
-
-    #[tokio::test]
-    async fn a_rate_limit_is_reported_with_the_wait_discord_asked_for() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(429).insert_header("retry-after", "2"))
-            .mount(&server)
-            .await;
-
-        let error = at(&server)
-            .deliver(&pinned("Title", "Body"))
-            .await
-            .expect_err("rate limited");
-
-        assert_eq!(error.retry_after(), Some(Duration::from_secs(2)));
-        assert!(error.is_retryable());
-        assert!(!error.to_string().contains("secret"));
-    }
-}
diff --git a/runner/zone_notify/src/backend/email.rs b/runner/zone_notify/src/backend/email.rs
deleted file mode 100644
index f38d8261..00000000
--- a/runner/zone_notify/src/backend/email.rs
+++ /dev/null
@@ -1,275 +0,0 @@
-//! Email, over SMTP.
-
-use std::fmt;
-
-use async_trait::async_trait;
-use lettre::message::Mailbox;
-use lettre::message::header::ContentType;
-use lettre::transport::smtp::authentication::Credentials;
-use lettre::{Address, AsyncSmtpTransport, AsyncTransport, Message, Tokio1Executor};
-use zone_core::tools::sanitize;
-
-use crate::backend::smtp::SmtpConfig;
-use crate::channel::Channel;
-use crate::error::NotifyError;
-use crate::notification::Notification;
-use crate::notifier::Notifier;
-
-/// Implicit-TLS submissions port, the one port relay() is built for.
-const SUBMISSIONS_PORT: u16 = 465;
-
-/// Delivers to a fixed set of recipients through one SMTP relay.
-///
-/// This is a separate transport from `zone_email`, which owns the account
-/// flow's three templates and keeps its own synchronous relay. That crate's
-/// generic send is private, so a notification of arbitrary content cannot go
-/// through it without changing it; see this crate's documentation for what
-/// folding the two together would involve.
-///
-/// Construct and drop this inside a Tokio runtime. When `lettre`'s `pool`
-/// feature is on anywhere in the build, its connection pool spawns a task
-/// from its own `Drop`, and a panic in a destructor aborts the process rather
-/// than unwinding.
-pub struct Email {
-    transport: AsyncSmtpTransport<Tokio1Executor>,
-    from: Mailbox,
-    recipients: Vec<Mailbox>,
-    host: String,
-    name: Option<String>,
-}
-
-impl Email {
-    /// Connect to the relay in `config` and deliver to `recipients`.
-    pub fn new(config: SmtpConfig, recipients: &[&str]) -> Result<Self, NotifyError> {
-        if recipients.is_empty() {
-            return Err(NotifyError::Malformed {
-                message: "an email channel needs at least one recipient".to_string(),
-            });
-        }
-
-        let from = mailbox(&config.from_address, Some(config.from_name.clone()))?;
-        let recipients = recipients
-            .iter()
-            .map(|recipient| mailbox(recipient, None))
-            .collect::<Result<Vec<Mailbox>, NotifyError>>()?;
-
-        let credentials =
-            Credentials::new(config.user.clone(), config.password.expose().to_string());
-        // relay() sets implicit TLS and port 465. Pointing that at 587, the
-        // submission port every mainstream relay serves with STARTTLS -- and
-        // the workspace default -- sends a ClientHello to a plaintext
-        // listener. starttls_relay refuses to send credentials if the upgrade
-        // fails, so this stays downgrade-safe.
-        let builder = if config.port == SUBMISSIONS_PORT {
-            AsyncSmtpTransport::<Tokio1Executor>::relay(&config.host)
-        } else {
-            AsyncSmtpTransport::<Tokio1Executor>::starttls_relay(&config.host)
-        };
-        let transport = builder
-            .map_err(|error| NotifyError::Smtp {
-                host: config.host.clone(),
-                message: describe(error),
-            })?
-            .port(config.port)
-            .credentials(credentials)
-            .build();
-
-        Ok(Self {
-            transport,
-            from,
-            recipients,
-            host: config.host,
-            name: None,
-        })
-    }
-
-    /// Label this instance, for a workspace with more than one recipient set.
-    #[must_use]
-    pub fn named(mut self, name: impl Into<String>) -> Self {
-        self.name = Some(name.into());
-        self
-    }
-
-    fn compose(&self, notification: &Notification) -> Result<Message, NotifyError> {
-        let mut builder = Message::builder()
-            .from(self.from.clone())
-            .subject(notification.title());
-
-        for recipient in &self.recipients {
-            builder = builder.to(recipient.clone());
-        }
-
-        builder
-            .header(ContentType::TEXT_PLAIN)
-            .body(notification.to_plain_text())
-            .map_err(|error| NotifyError::Malformed {
-                message: error.to_string(),
-            })
-    }
-}
-
-#[async_trait]
-impl Notifier for Email {
-    fn channel(&self) -> Channel {
-        Channel::EMAIL
-    }
-
-    fn name(&self) -> Option<&str> {
-        self.name.as_deref()
-    }
-
-    async fn deliver(&self, notification: &Notification) -> Result<(), NotifyError> {
-        let message = self.compose(notification)?;
-        self.transport
-            .send(message)
-            .await
-            .map_err(|error| NotifyError::Smtp {
-                host: self.host.clone(),
-                message: describe(error),
-            })?;
-        Ok(())
-    }
-}
-
-/// Written out rather than derived: the transport holds the relay password
-/// inside a `lettre::Credentials`, which has no redacting `Debug` of its own.
-impl fmt::Debug for Email {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("Email")
-            .field("host", &self.host)
-            .field("from", &self.from)
-            .field("recipients", &self.recipients)
-            .field("name", &self.name)
-            .finish_non_exhaustive()
-    }
-}
-
-fn mailbox(address: &str, name: Option<String>) -> Result<Mailbox, NotifyError> {
-    let parsed: Address = address.parse().map_err(|_| NotifyError::Malformed {
-        message: format!("{address} is not a valid email address"),
-    })?;
-    Ok(Mailbox::new(name, parsed))
-}
-
-/// An SMTP error's message, sanitized.
-///
-/// A relay's reply text is written by the far end, so it is treated like any
-/// other outside text on its way to a log line.
-fn describe(error: lettre::transport::smtp::Error) -> String {
-    sanitize(&error.to_string()).into_owned()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::severity::Severity;
-    use abnegate_secret::SecretValue;
-
-    fn config() -> SmtpConfig {
-        SmtpConfig {
-            host: "smtp.zone.test".to_string(),
-            port: 587,
-            user: "postmaster".to_string(),
-            password: SecretValue::new("hunter2-not-a-real-password"),
-            from_address: "noreply@zone.test".to_string(),
-            from_name: "Zone".to_string(),
-        }
-    }
-
-    fn email() -> Email {
-        Email::new(config(), &["sam@example.test"]).expect("configured")
-    }
-
-    fn rendered(notification: &Notification) -> String {
-        String::from_utf8(email().compose(notification).expect("composed").formatted())
-            .expect("utf-8")
-    }
-
-    #[test]
-    fn a_channel_with_no_recipients_is_refused() {
-        let error = Email::new(config(), &[]).expect_err("no recipients");
-        assert!(matches!(error, NotifyError::Malformed { .. }));
-        assert!(error.to_string().contains("at least one recipient"));
-    }
-
-    #[test]
-    fn an_unparseable_recipient_is_refused() {
-        let error = Email::new(config(), &["not an address"]).expect_err("bad recipient");
-        assert!(matches!(error, NotifyError::Malformed { .. }));
-    }
-
-    #[test]
-    fn an_unparseable_sender_is_refused() {
-        let mut broken = config();
-        broken.from_address = "@@@".to_string();
-        assert!(matches!(
-            Email::new(broken, &["sam@example.test"]).expect_err("bad sender"),
-            NotifyError::Malformed { .. }
-        ));
-    }
-
-    #[tokio::test]
-    async fn the_subject_is_the_title_and_the_body_carries_everything() {
-        let message = rendered(
-            &Notification::new("Build failed", "3 tests failed")
-                .severity(Severity::Error)
-                .field("Branch", "main")
-                .link("https://zone.test/b/1"),
-        );
-
-        assert!(message.contains("Subject: Build failed"));
-        assert!(message.contains("From: Zone <noreply@zone.test>"));
-        assert!(message.contains("To: sam@example.test"));
-        assert!(message.contains("Content-Type: text/plain"));
-        assert!(message.contains("3 tests failed"));
-        assert!(message.contains("Branch: main"));
-        assert!(message.contains("https://zone.test/b/1"));
-    }
-
-    #[tokio::test]
-    async fn every_recipient_is_addressed() {
-        let email =
-            Email::new(config(), &["sam@example.test", "alex@example.test"]).expect("configured");
-        let message = String::from_utf8(
-            email
-                .compose(&Notification::new("Title", "Body"))
-                .expect("composed")
-                .formatted(),
-        )
-        .expect("utf-8");
-
-        assert!(message.contains("sam@example.test"));
-        assert!(message.contains("alex@example.test"));
-    }
-
-    #[tokio::test]
-    async fn the_relay_password_never_reaches_the_message() {
-        let message = rendered(&Notification::new("Title", "Body"));
-        assert!(!message.contains("hunter2"), "leaked into the message");
-    }
-
-    #[tokio::test]
-    async fn a_credential_in_the_body_is_redacted_before_it_is_composed() {
-        let message = rendered(&Notification::new(
-            "Deploy log",
-            "GITHUB_TOKEN=ghp_0123456789abcdefghij",
-        ));
-        assert!(!message.contains("ghp_0123456789abcdefghij"));
-        assert!(message.contains("[REDACTED]"));
-    }
-
-    #[tokio::test]
-    async fn the_relay_password_never_appears_in_debug() {
-        let rendered = format!("{:?}", email());
-        assert!(!rendered.contains("hunter2"), "leaked: {rendered}");
-        assert!(rendered.contains("smtp.zone.test"));
-    }
-
-    #[tokio::test]
-    async fn the_channel_and_name_are_reported() {
-        assert_eq!(email().channel(), Channel::EMAIL);
-        assert_eq!(email().name(), None);
-        assert_eq!(email().named("ops").name(), Some("ops"));
-    }
-}
diff --git a/runner/zone_notify/src/backend/mod.rs b/runner/zone_notify/src/backend/mod.rs
deleted file mode 100644
index 1a5df0c3..00000000
--- a/runner/zone_notify/src/backend/mod.rs
+++ /dev/null
@@ -1,15 +0,0 @@
-//! The channels this crate ships with.
-//!
-//! Each backend is one file implementing [`Notifier`](crate::Notifier).
-//! Adding another is the same: a file here, exported below.
-
-mod discord;
-mod email;
-mod slack;
-mod smtp;
-mod webhook;
-
-pub use discord::Discord;
-pub use email::Email;
-pub use slack::Slack;
-pub use smtp::SmtpConfig;
diff --git a/runner/zone_notify/src/backend/slack.rs b/runner/zone_notify/src/backend/slack.rs
deleted file mode 100644
index 676b947d..00000000
--- a/runner/zone_notify/src/backend/slack.rs
+++ /dev/null
@@ -1,338 +0,0 @@
-//! Slack, over an incoming webhook.
-
-use async_trait::async_trait;
-use serde_json::{Value, json};
-
-use crate::backend::webhook::Webhook;
-use crate::channel::Channel;
-use crate::endpoint::Endpoint;
-use crate::error::NotifyError;
-use crate::fanout::DEFAULT_TIMEOUT;
-use crate::notification::Notification;
-use crate::notifier::Notifier;
-use crate::severity::Severity;
-use crate::text::truncate;
-
-const HOSTS: &[&str] = &["hooks.slack.com"];
-const MAX_HEADER_CHARS: usize = 150;
-const MAX_SECTION_CHARS: usize = 3_000;
-const MAX_FIELD_CHARS: usize = 2_000;
-const MAX_FIELDS_PER_SECTION: usize = 10;
-
-/// Delivers to one Slack incoming webhook.
-#[derive(Debug)]
-pub struct Slack {
-    webhook: Webhook,
-    name: Option<String>,
-}
-
-impl Slack {
-    /// Point at `webhook_url`, which must be an `hooks.slack.com` URL.
-    pub fn new(webhook_url: &str) -> Result<Self, NotifyError> {
-        let endpoint = Endpoint::new(webhook_url, HOSTS)?;
-        Ok(Self {
-            webhook: Webhook::new(endpoint, DEFAULT_TIMEOUT)?,
-            name: None,
-        })
-    }
-
-    /// Label this instance, for a workspace with more than one Slack hook.
-    #[must_use]
-    pub fn named(mut self, name: impl Into<String>) -> Self {
-        self.name = Some(name.into());
-        self
-    }
-
-    #[cfg(test)]
-    pub(crate) fn at_test_server(base_url: &str) -> Self {
-        Self {
-            webhook: Webhook::new(
-                Endpoint::for_test(&format!("{base_url}/services/T000/B000/secret")),
-                DEFAULT_TIMEOUT,
-            )
-            .expect("test client"),
-            name: None,
-        }
-    }
-
-    fn payload(&self, notification: &Notification) -> Value {
-        let mut blocks = vec![json!({
-            "type": "header",
-            "text": {
-                "type": "plain_text",
-                "text": truncate(
-                    &format!("{} {}", icon(notification.kind()), escape(notification.title())),
-                    MAX_HEADER_CHARS,
-                ),
-                "emoji": true,
-            }
-        })];
-
-        if !notification.body().is_empty() {
-            blocks.push(json!({
-                "type": "section",
-                "text": {
-                    "type": "mrkdwn",
-                    "text": truncate(&escape(notification.body()), MAX_SECTION_CHARS),
-                }
-            }));
-        }
-
-        for chunk in notification.fields().chunks(MAX_FIELDS_PER_SECTION) {
-            let fields: Vec<Value> = chunk
-                .iter()
-                .map(|field| {
-                    json!({
-                        "type": "mrkdwn",
-                        "text": truncate(
-                            &format!("*{}*\n{}", escape(field.name()), escape(field.value())),
-                            MAX_FIELD_CHARS,
-                        ),
-                    })
-                })
-                .collect();
-            blocks.push(json!({ "type": "section", "fields": fields }));
-        }
-
-        if let Some(link) = notification.url() {
-            blocks.push(json!({
-                "type": "context",
-                "elements": [{ "type": "mrkdwn", "text": format!("<{}|Open in Zone>", escape(link)) }],
-            }));
-        }
-
-        json!({
-            "text": truncate(&escape(&notification.to_plain_text()), MAX_SECTION_CHARS),
-            "blocks": blocks,
-        })
-    }
-}
-
-#[async_trait]
-impl Notifier for Slack {
-    fn channel(&self) -> Channel {
-        Channel::SLACK
-    }
-
-    fn name(&self) -> Option<&str> {
-        self.name.as_deref()
-    }
-
-    async fn deliver(&self, notification: &Notification) -> Result<(), NotifyError> {
-        self.webhook.post(&self.payload(notification)).await?;
-        Ok(())
-    }
-}
-
-fn icon(severity: Severity) -> &'static str {
-    match severity {
-        Severity::Info => ":information_source:",
-        Severity::Success => ":white_check_mark:",
-        Severity::Warning => ":warning:",
-        Severity::Error => ":rotating_light:",
-    }
-}
-
-/// Slack's three reserved mrkdwn characters, escaped in the order it requires.
-///
-/// `&` has to go first or the ampersands introduced by the other two would be
-/// escaped a second time.
-fn escape(text: &str) -> String {
-    text.replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::endpoint::EndpointError;
-    use wiremock::matchers::{body_json, header, method, path};
-    use wiremock::{Mock, MockServer, ResponseTemplate};
-
-    fn at(server: &MockServer) -> Slack {
-        Slack::at_test_server(&server.uri())
-    }
-
-    #[test]
-    fn ampersands_are_escaped_before_the_angle_brackets() {
-        assert_eq!(escape("a & b"), "a &amp; b");
-        assert_eq!(escape("<script>"), "&lt;script&gt;");
-        assert_eq!(escape("Tom & <Jerry>"), "Tom &amp; &lt;Jerry&gt;");
-        assert!(!escape("<a>").contains("&amp;lt;"));
-    }
-
-    #[test]
-    fn a_url_outside_the_allowlist_is_refused() {
-        let error = Slack::new("https://hooks.example.com/services/T/B/x")
-            .expect_err("only Slack hosts are allowed");
-        assert!(matches!(
-            error,
-            NotifyError::Endpoint(EndpointError::HostNotAllowed { .. })
-        ));
-    }
-
-    #[test]
-    fn a_slack_webhook_url_is_accepted() {
-        assert!(Slack::new("https://hooks.slack.com/services/T000/B000/xyz").is_ok());
-    }
-
-    #[test]
-    fn the_webhook_url_never_appears_in_debug() {
-        let slack =
-            Slack::new("https://hooks.slack.com/services/T000/B000/xxxxSECRETxxxx").expect("valid");
-        let rendered = format!("{slack:?}");
-        assert!(!rendered.contains("xxxxSECRETxxxx"), "leaked: {rendered}");
-        assert!(rendered.contains("hooks.slack.com"));
-    }
-
-    #[tokio::test]
-    async fn the_payload_is_block_kit_with_a_plain_text_fallback() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .and(path("/services/T000/B000/secret"))
-            .and(header("content-type", "application/json"))
-            .and(body_json(json!({
-                "text": "Build failed\n\n3 tests failed\n\nBranch: main\n\nhttps://zone.test/b/1",
-                "blocks": [
-                    {
-                        "type": "header",
-                        "text": {
-                            "type": "plain_text",
-                            "text": ":rotating_light: Build failed",
-                            "emoji": true,
-                        }
-                    },
-                    {
-                        "type": "section",
-                        "text": { "type": "mrkdwn", "text": "3 tests failed" }
-                    },
-                    {
-                        "type": "section",
-                        "fields": [{ "type": "mrkdwn", "text": "*Branch*\nmain" }]
-                    },
-                    {
-                        "type": "context",
-                        "elements": [{
-                            "type": "mrkdwn",
-                            "text": "<https://zone.test/b/1|Open in Zone>"
-                        }]
-                    }
-                ]
-            })))
-            .respond_with(ResponseTemplate::new(200).set_body_string("ok"))
-            .expect(1)
-            .mount(&server)
-            .await;
-
-        let notification = Notification::new("Build failed", "3 tests failed")
-            .severity(Severity::Error)
-            .field("Branch", "main")
-            .link("https://zone.test/b/1");
-
-        at(&server).deliver(&notification).await.expect("delivered");
-    }
-
-    #[tokio::test]
-    async fn a_notification_with_no_body_omits_the_body_section() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .and(body_json(json!({
-                "text": "Heads up",
-                "blocks": [{
-                    "type": "header",
-                    "text": {
-                        "type": "plain_text",
-                        "text": ":information_source: Heads up",
-                        "emoji": true,
-                    }
-                }]
-            })))
-            .respond_with(ResponseTemplate::new(200).set_body_string("ok"))
-            .expect(1)
-            .mount(&server)
-            .await;
-
-        at(&server)
-            .deliver(&Notification::new("Heads up", ""))
-            .await
-            .expect("delivered");
-    }
-
-    #[tokio::test]
-    async fn user_text_cannot_forge_slack_markup() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(200).set_body_string("ok"))
-            .mount(&server)
-            .await;
-
-        let payload = at(&server).payload(&Notification::new(
-            "Deploy",
-            "<https://evil.test|click me> & <@U000>",
-        ));
-        let body = payload["blocks"][1]["text"]["text"]
-            .as_str()
-            .expect("body section");
-
-        assert_eq!(
-            body,
-            "&lt;https://evil.test|click me&gt; &amp; &lt;@U000&gt;"
-        );
-
-        let fallback = payload["text"].as_str().expect("fallback text");
-        assert!(
-            !fallback.contains("<https://evil.test|"),
-            "the notification preview is mrkdwn too: {fallback}"
-        );
-        assert!(fallback.contains("&lt;https://evil.test|click me&gt;"));
-    }
-
-    #[test]
-    fn more_than_ten_fields_are_split_across_sections() {
-        let mut notification = Notification::new("Many", "");
-        for index in 0..23 {
-            notification = notification.field(format!("Key {index}"), "value");
-        }
-
-        let server_free = Slack::new("https://hooks.slack.com/services/T/B/x").expect("valid");
-        let payload = server_free.payload(&notification);
-        let blocks = payload["blocks"].as_array().expect("blocks");
-
-        let sections: Vec<usize> = blocks
-            .iter()
-            .filter_map(|block| block["fields"].as_array().map(Vec::len))
-            .collect();
-        assert_eq!(sections, vec![10, 10, 3]);
-    }
-
-    #[test]
-    fn an_over_long_title_is_truncated_to_slacks_header_limit() {
-        let notification = Notification::new("T".repeat(400), "");
-        let slack = Slack::new("https://hooks.slack.com/services/T/B/x").expect("valid");
-        let header = slack.payload(&notification)["blocks"][0]["text"]["text"]
-            .as_str()
-            .expect("header")
-            .chars()
-            .count();
-        assert_eq!(header, MAX_HEADER_CHARS);
-    }
-
-    #[tokio::test]
-    async fn a_rejection_becomes_a_failure_that_names_only_the_host() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(400).set_body_string("invalid_payload"))
-            .mount(&server)
-            .await;
-
-        let error = at(&server)
-            .deliver(&Notification::new("Title", "Body"))
-            .await
-            .expect_err("rejected");
-
-        let rendered = error.to_string();
-        assert!(rendered.contains("invalid_payload"));
-        assert!(!rendered.contains("secret"), "leaked: {rendered}");
-    }
-}
diff --git a/runner/zone_notify/src/backend/smtp.rs b/runner/zone_notify/src/backend/smtp.rs
deleted file mode 100644
index c8c4fc55..00000000
--- a/runner/zone_notify/src/backend/smtp.rs
+++ /dev/null
@@ -1,63 +0,0 @@
-//! How to reach an SMTP relay.
-
-use std::fmt;
-
-use abnegate_secret::SecretValue;
-
-/// The connection details for one SMTP relay.
-///
-/// The password is a [`SecretValue`], so it is redacted in `Debug`, zeroized
-/// when the config is dropped, and readable only at the point it is handed to
-/// the transport.
-#[derive(Clone)]
-pub struct SmtpConfig {
-    pub host: String,
-    pub port: u16,
-    pub user: String,
-    pub password: SecretValue,
-    pub from_address: String,
-    pub from_name: String,
-}
-
-impl fmt::Debug for SmtpConfig {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("SmtpConfig")
-            .field("host", &self.host)
-            .field("port", &self.port)
-            .field("user", &self.user)
-            .field("password", &self.password)
-            .field("from_address", &self.from_address)
-            .field("from_name", &self.from_name)
-            .finish()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn config() -> SmtpConfig {
-        SmtpConfig {
-            host: "smtp.zone.test".to_string(),
-            port: 587,
-            user: "postmaster".to_string(),
-            password: SecretValue::new("hunter2-not-a-real-password"),
-            from_address: "noreply@zone.test".to_string(),
-            from_name: "Zone".to_string(),
-        }
-    }
-
-    #[test]
-    fn the_password_never_appears_in_debug() {
-        let rendered = format!("{:?}", config());
-        assert!(!rendered.contains("hunter2"), "leaked: {rendered}");
-        assert!(rendered.contains("[REDACTED]"));
-        assert!(rendered.contains("smtp.zone.test"));
-    }
-
-    #[test]
-    fn the_password_is_still_readable_at_the_point_of_use() {
-        assert_eq!(config().password.expose(), "hunter2-not-a-real-password");
-    }
-}
diff --git a/runner/zone_notify/src/backend/webhook.rs b/runner/zone_notify/src/backend/webhook.rs
deleted file mode 100644
index f17ded7d..00000000
--- a/runner/zone_notify/src/backend/webhook.rs
+++ /dev/null
@@ -1,323 +0,0 @@
-//! The HTTP half that Slack and Discord share.
-
-use std::time::Duration;
-
-use futures::StreamExt;
-use reqwest::redirect::Policy;
-use reqwest::{Client, Response, StatusCode};
-use serde_json::Value;
-use zone_core::tools::sanitize;
-
-use crate::endpoint::Endpoint;
-use crate::error::NotifyError;
-use crate::text::truncate;
-
-const USER_AGENT: &str = concat!("Zone/", env!("CARGO_PKG_VERSION"), " (+zone_notify)");
-const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
-const MAX_ERROR_BODY_BYTES: usize = 2_048;
-const MAX_ERROR_BODY_CHARS: usize = 512;
-const RETRY_AFTER: &str = "retry-after";
-
-/// A JSON POST to one validated endpoint.
-///
-/// Redirects are refused rather than followed. Following one would let the
-/// endpoint hand back a `Location` pointing at a private address and walk
-/// straight around the host allowlist that [`Endpoint`] enforces, which is
-/// the usual way an allowlisted webhook still turns into an SSRF.
-#[derive(Debug)]
-pub(crate) struct Webhook {
-    endpoint: Endpoint,
-    client: Client,
-}
-
-impl Webhook {
-    pub(crate) fn new(endpoint: Endpoint, timeout: Duration) -> Result<Self, NotifyError> {
-        let client = Client::builder()
-            .redirect(Policy::none())
-            .timeout(timeout)
-            .connect_timeout(CONNECT_TIMEOUT)
-            .user_agent(USER_AGENT)
-            .build()
-            .map_err(|error| NotifyError::Malformed {
-                message: strip_url(error),
-            })?;
-
-        Ok(Self { endpoint, client })
-    }
-
-    pub(crate) fn host(&self) -> &str {
-        self.endpoint.host()
-    }
-
-    pub(crate) async fn post(&self, payload: &Value) -> Result<Response, NotifyError> {
-        let response = self
-            .endpoint
-            .post(&self.client)
-            .json(payload)
-            .send()
-            .await
-            .map_err(|error| NotifyError::Unreachable {
-                host: self.host().to_string(),
-                message: strip_url(error),
-            })?;
-
-        let status = response.status();
-        if status.is_success() {
-            return Ok(response);
-        }
-
-        if status == StatusCode::TOO_MANY_REQUESTS {
-            return Err(NotifyError::RateLimited {
-                host: self.host().to_string(),
-                retry_after: retry_after(&response),
-            });
-        }
-
-        Err(NotifyError::Rejected {
-            host: self.host().to_string(),
-            status: status.as_u16(),
-            body: self.read_failure_body(response).await,
-        })
-    }
-
-    /// The first of an error body, bounded before it is read.
-    ///
-    /// The body comes from whoever owns the endpoint, so it is neither
-    /// trusted nor assumed to be small: reading it whole would let a hostile
-    /// endpoint answer a webhook with an unbounded stream, and it reaches a
-    /// log line, so it is sanitized like any other outside text.
-    async fn read_failure_body(&self, response: Response) -> String {
-        let mut stream = response.bytes_stream();
-        let mut collected: Vec<u8> = Vec::new();
-
-        while collected.len() < MAX_ERROR_BODY_BYTES {
-            match stream.next().await {
-                Some(Ok(chunk)) => collected.extend_from_slice(&chunk),
-                Some(Err(_)) | None => break,
-            }
-        }
-        collected.truncate(MAX_ERROR_BODY_BYTES);
-
-        let text = String::from_utf8_lossy(&collected);
-        let cleaned = truncate(sanitize(text.trim()).trim(), MAX_ERROR_BODY_CHARS);
-        if cleaned.is_empty() {
-            "no response body".to_string()
-        } else {
-            cleaned
-        }
-    }
-}
-
-/// A reqwest error's message with the request URL removed.
-///
-/// `reqwest::Error` appends `for url (...)` to its `Display`, and for a
-/// webhook that URL is the credential, so it never survives into a message.
-fn strip_url(error: reqwest::Error) -> String {
-    error.without_url().to_string()
-}
-
-fn retry_after(response: &Response) -> Option<Duration> {
-    let header = response.headers().get(RETRY_AFTER)?.to_str().ok()?;
-    let seconds: f64 = header.trim().parse().ok()?;
-    // try_from_secs_f64 rejects negative, NaN, infinite and overflowing values
-    // in one call. The header is the least trusted input in this crate, and
-    // from_secs_f64 panics rather than erroring on overflow.
-    Duration::try_from_secs_f64(seconds).ok()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-    use wiremock::matchers::{method, path};
-    use wiremock::{Mock, MockServer, ResponseTemplate};
-
-    async fn webhook(server: &MockServer) -> Webhook {
-        Webhook::new(
-            Endpoint::for_test(&format!("{}/hook", server.uri())),
-            Duration::from_secs(5),
-        )
-        .expect("client")
-    }
-
-    #[tokio::test]
-    async fn a_success_returns_the_response() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .and(path("/hook"))
-            .respond_with(ResponseTemplate::new(204))
-            .mount(&server)
-            .await;
-
-        let response = webhook(&server)
-            .await
-            .post(&json!({ "text": "hi" }))
-            .await
-            .expect("delivered");
-        assert_eq!(response.status(), 204);
-    }
-
-    #[tokio::test]
-    async fn a_rejection_carries_the_status_and_a_bounded_body() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(400).set_body_string("invalid_payload"))
-            .mount(&server)
-            .await;
-
-        let error = webhook(&server)
-            .await
-            .post(&json!({}))
-            .await
-            .expect_err("rejected");
-
-        match error {
-            NotifyError::Rejected { status, body, .. } => {
-                assert_eq!(status, 400);
-                assert_eq!(body, "invalid_payload");
-            }
-            other => panic!("expected a rejection, got {other:?}"),
-        }
-    }
-
-    #[tokio::test]
-    async fn an_enormous_error_body_is_capped() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(500).set_body_string("x".repeat(200_000)))
-            .mount(&server)
-            .await;
-
-        let error = webhook(&server)
-            .await
-            .post(&json!({}))
-            .await
-            .expect_err("rejected");
-
-        match error {
-            NotifyError::Rejected { body, .. } => {
-                assert!(
-                    body.chars().count() <= MAX_ERROR_BODY_CHARS,
-                    "body was {} chars",
-                    body.chars().count()
-                );
-            }
-            other => panic!("expected a rejection, got {other:?}"),
-        }
-    }
-
-    #[tokio::test]
-    async fn an_error_body_is_sanitized_before_it_reaches_a_log() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(
-                ResponseTemplate::new(400)
-                    .set_body_string("\u{1b}]0;hijack\u{7}bad token ghp_0123456789abcdefghij"),
-            )
-            .mount(&server)
-            .await;
-
-        let error = webhook(&server)
-            .await
-            .post(&json!({}))
-            .await
-            .expect_err("rejected");
-
-        let rendered = error.to_string();
-        assert!(!rendered.contains('\u{1b}'), "control sequence survived");
-        assert!(!rendered.contains("ghp_0123456789abcdefghij"));
-        assert!(rendered.contains("[REDACTED]"));
-    }
-
-    #[tokio::test]
-    async fn an_empty_error_body_says_so() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(503))
-            .mount(&server)
-            .await;
-
-        let error = webhook(&server)
-            .await
-            .post(&json!({}))
-            .await
-            .expect_err("rejected");
-        assert!(error.to_string().contains("no response body"));
-    }
-
-    #[tokio::test]
-    async fn a_rate_limit_reads_the_retry_after_header() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(429).insert_header("retry-after", "3"))
-            .mount(&server)
-            .await;
-
-        let error = webhook(&server)
-            .await
-            .post(&json!({}))
-            .await
-            .expect_err("rate limited");
-
-        assert_eq!(error.retry_after(), Some(Duration::from_secs(3)));
-        assert!(error.is_retryable());
-    }
-
-    #[tokio::test]
-    async fn a_rate_limit_without_a_header_still_reports_itself() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(429))
-            .mount(&server)
-            .await;
-
-        let error = webhook(&server)
-            .await
-            .post(&json!({}))
-            .await
-            .expect_err("rate limited");
-        assert!(matches!(error, NotifyError::RateLimited { .. }));
-        assert_eq!(error.retry_after(), None);
-    }
-
-    #[tokio::test]
-    async fn a_redirect_is_refused_rather_than_followed() {
-        let server = MockServer::start().await;
-        Mock::given(method("POST"))
-            .respond_with(
-                ResponseTemplate::new(302)
-                    .insert_header("location", "http://169.254.169.254/latest/meta-data/"),
-            )
-            .mount(&server)
-            .await;
-
-        let error = webhook(&server)
-            .await
-            .post(&json!({}))
-            .await
-            .expect_err("a redirect is not a delivery");
-
-        match error {
-            NotifyError::Rejected { status, .. } => assert_eq!(status, 302),
-            other => panic!("expected the redirect to be reported, got {other:?}"),
-        }
-    }
-
-    #[tokio::test]
-    async fn an_unreachable_host_never_names_the_url() {
-        // Port 1 is privileged, so no concurrent test can bind it and answer.
-        // Freeing an ephemeral port instead races every other test's mock
-        // server, which then answers 200 and the assertion never runs.
-        let webhook = Webhook::new(
-            Endpoint::for_test("http://127.0.0.1:1/services/T000/B000/xxxxSECRETxxxx"),
-            Duration::from_millis(500),
-        )
-        .expect("client");
-
-        let error = webhook.post(&json!({})).await.expect_err("unreachable");
-        let rendered = error.to_string();
-        assert!(!rendered.contains("xxxxSECRETxxxx"), "leaked: {rendered}");
-        assert!(!rendered.contains("/services/"), "leaked: {rendered}");
-        assert!(!format!("{error:?}").contains("xxxxSECRETxxxx"));
-    }
-}
diff --git a/runner/zone_notify/src/channel.rs b/runner/zone_notify/src/channel.rs
deleted file mode 100644
index ed61b715..00000000
--- a/runner/zone_notify/src/channel.rs
+++ /dev/null
@@ -1,57 +0,0 @@
-//! The name a delivery is reported under.
-
-use std::borrow::Cow;
-use std::fmt;
-
-/// The kind of destination a [`Notifier`](crate::Notifier) delivers to.
-///
-/// Open rather than a closed enum so a channel can live outside this crate:
-/// the workspace chat the reminder worker already writes to belongs in
-/// `zone_server`, not here, and it should still be able to join a fan-out.
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub struct Channel(Cow<'static, str>);
-
-impl Channel {
-    pub const EMAIL: Self = Self(Cow::Borrowed("email"));
-    pub const SLACK: Self = Self(Cow::Borrowed("slack"));
-    pub const DISCORD: Self = Self(Cow::Borrowed("discord"));
-
-    pub fn custom(name: impl Into<Cow<'static, str>>) -> Self {
-        Self(name.into())
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-impl fmt::Display for Channel {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str(&self.0)
-    }
-}
-
-impl AsRef<str> for Channel {
-    fn as_ref(&self) -> &str {
-        &self.0
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn built_in_channels_name_themselves() {
-        assert_eq!(Channel::EMAIL.as_str(), "email");
-        assert_eq!(Channel::SLACK.to_string(), "slack");
-        assert_eq!(Channel::DISCORD.as_str(), "discord");
-    }
-
-    #[test]
-    fn a_custom_channel_carries_its_own_name() {
-        let channel = Channel::custom("workspace-chat");
-        assert_eq!(channel.as_str(), "workspace-chat");
-        assert_ne!(channel, Channel::SLACK);
-    }
-}
diff --git a/runner/zone_notify/src/delivery.rs b/runner/zone_notify/src/delivery.rs
deleted file mode 100644
index 887283e6..00000000
--- a/runner/zone_notify/src/delivery.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-//! What happened on one channel.
-
-use crate::channel::Channel;
-use crate::error::NotifyError;
-
-/// The outcome of a single channel's attempt.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Delivery {
-    channel: Channel,
-    name: String,
-    outcome: Result<(), NotifyError>,
-}
-
-impl Delivery {
-    pub(crate) fn new(channel: Channel, name: String, outcome: Result<(), NotifyError>) -> Self {
-        Self {
-            channel,
-            name,
-            outcome,
-        }
-    }
-
-    pub fn channel(&self) -> &Channel {
-        &self.channel
-    }
-
-    /// The configured instance name, falling back to the channel name.
-    pub fn name(&self) -> &str {
-        &self.name
-    }
-
-    pub fn is_delivered(&self) -> bool {
-        self.outcome.is_ok()
-    }
-
-    pub fn error(&self) -> Option<&NotifyError> {
-        self.outcome.as_ref().err()
-    }
-
-    /// Whether sending to this channel again could plausibly work.
-    pub fn is_retryable(&self) -> bool {
-        self.error().is_some_and(NotifyError::is_retryable)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::time::Duration;
-
-    #[test]
-    fn a_delivered_notification_has_no_error() {
-        let delivery = Delivery::new(Channel::SLACK, "slack".to_string(), Ok(()));
-        assert!(delivery.is_delivered());
-        assert!(delivery.error().is_none());
-        assert!(!delivery.is_retryable());
-        assert_eq!(delivery.channel(), &Channel::SLACK);
-        assert_eq!(delivery.name(), "slack");
-    }
-
-    #[test]
-    fn a_failure_carries_its_reason() {
-        let delivery = Delivery::new(
-            Channel::DISCORD,
-            "discord".to_string(),
-            Err(NotifyError::Timeout {
-                after: Duration::from_secs(5),
-            }),
-        );
-        assert!(!delivery.is_delivered());
-        assert!(delivery.is_retryable());
-        assert_eq!(
-            delivery.error().map(ToString::to_string),
-            Some("delivery timed out after 5000ms".to_string())
-        );
-    }
-}
diff --git a/runner/zone_notify/src/endpoint.rs b/runner/zone_notify/src/endpoint.rs
deleted file mode 100644
index 33c778ca..00000000
--- a/runner/zone_notify/src/endpoint.rs
+++ /dev/null
@@ -1,293 +0,0 @@
-//! A webhook target that has been checked before anything is sent to it.
-
-use std::fmt;
-
-use abnegate_secret::SecretValue;
-use reqwest::{Client, RequestBuilder};
-use thiserror::Error;
-use url::{Host, Url};
-
-const LOOPBACK_SUFFIX: &str = ".localhost";
-const LOOPBACK_NAME: &str = "localhost";
-const REQUIRED_SCHEME: &str = "https";
-
-/// Why a webhook URL was refused.
-///
-/// A rejected URL is never quoted back: the path of a webhook URL is the
-/// credential, so only the host reaches the message.
-#[derive(Clone, Debug, Error, PartialEq, Eq)]
-pub enum EndpointError {
-    #[error("the webhook URL could not be parsed")]
-    Malformed,
-
-    #[error("a webhook must use {REQUIRED_SCHEME}, not {scheme}")]
-    Scheme { scheme: String },
-
-    #[error("the webhook URL has no host")]
-    MissingHost,
-
-    #[error("the webhook URL embeds credentials in its authority")]
-    EmbeddedCredentials,
-
-    #[error("{host} is an IP literal, which a webhook may not target")]
-    AddressLiteral { host: String },
-
-    #[error("{host} resolves to the local machine")]
-    Loopback { host: String },
-
-    #[error("{host} is not an allowed host for this channel")]
-    HostNotAllowed { host: String },
-}
-
-/// A validated webhook URL, held as the credential it is.
-///
-/// An outbound webhook is a server-side request to an address someone else
-/// chose, so the URL is checked once here rather than at each call site. The
-/// host allowlist is the load-bearing control: because each backend talks to
-/// exactly one provider, an exact-match allowlist removes the whole class of
-/// redirect, rebinding and encoded-address bypasses that a private-range
-/// blocklist has to chase. The scheme, authority and literal-address rules
-/// keep the type sound on its own, for an allowlist wider than one host.
-#[derive(Clone)]
-pub struct Endpoint {
-    url: SecretValue,
-    host: String,
-}
-
-impl Endpoint {
-    /// Validate `url` and accept it only if its host is one of `allowed`.
-    ///
-    /// `allowed` is matched exactly against the parsed host, which `url` has
-    /// already lowercased and punycode-encoded, so a lookalike host cannot
-    /// match by casing or by Unicode confusable.
-    pub fn new(url: &str, allowed: &[&str]) -> Result<Self, EndpointError> {
-        let parsed = Url::parse(url).map_err(|_| EndpointError::Malformed)?;
-
-        if parsed.scheme() != REQUIRED_SCHEME {
-            return Err(EndpointError::Scheme {
-                scheme: parsed.scheme().to_string(),
-            });
-        }
-
-        if !parsed.username().is_empty() || parsed.password().is_some() {
-            return Err(EndpointError::EmbeddedCredentials);
-        }
-
-        let host = parsed.host().ok_or(EndpointError::MissingHost)?;
-        let name = match host {
-            Host::Domain(domain) => domain.to_string(),
-            Host::Ipv4(address) => {
-                return Err(EndpointError::AddressLiteral {
-                    host: address.to_string(),
-                });
-            }
-            Host::Ipv6(address) => {
-                return Err(EndpointError::AddressLiteral {
-                    host: address.to_string(),
-                });
-            }
-        };
-
-        if name == LOOPBACK_NAME || name.ends_with(LOOPBACK_SUFFIX) {
-            return Err(EndpointError::Loopback { host: name });
-        }
-
-        if !allowed.contains(&name.as_str()) {
-            return Err(EndpointError::HostNotAllowed { host: name });
-        }
-
-        Ok(Self {
-            url: SecretValue::new(url),
-            host: name,
-        })
-    }
-
-    /// The host, which is safe to log. The rest of the URL is not.
-    pub fn host(&self) -> &str {
-        &self.host
-    }
-
-    pub(crate) fn post(&self, client: &Client) -> RequestBuilder {
-        client.post(self.url.expose())
-    }
-
-    /// An endpoint pointed at a local test server, bypassing every check.
-    #[cfg(test)]
-    pub(crate) fn for_test(url: &str) -> Self {
-        let host = Url::parse(url)
-            .ok()
-            .and_then(|parsed| parsed.host_str().map(str::to_string))
-            .unwrap_or_else(|| "test".to_string());
-        Self {
-            url: SecretValue::new(url),
-            host,
-        }
-    }
-}
-
-impl fmt::Debug for Endpoint {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("Endpoint")
-            .field("host", &self.host)
-            .field("url", &self.url)
-            .finish()
-    }
-}
-
-impl fmt::Display for Endpoint {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str(&self.host)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const ALLOWED: &[&str] = &["hooks.slack.com"];
-    const SECRET_PATH: &str = "https://hooks.slack.com/services/T000/B000/xxxxSECRETxxxx";
-
-    #[test]
-    fn an_allowed_https_host_is_accepted() {
-        let endpoint = Endpoint::new(SECRET_PATH, ALLOWED).expect("allowed host");
-        assert_eq!(endpoint.host(), "hooks.slack.com");
-    }
-
-    #[test]
-    fn the_url_never_appears_in_debug_or_display() {
-        let endpoint = Endpoint::new(SECRET_PATH, ALLOWED).expect("allowed host");
-
-        let debug = format!("{endpoint:?}");
-        let display = endpoint.to_string();
-
-        assert!(!debug.contains("xxxxSECRETxxxx"), "Debug leaked: {debug}");
-        assert!(!debug.contains("/services/"), "Debug leaked: {debug}");
-        assert!(!display.contains("xxxxSECRETxxxx"), "Display leaked");
-        assert_eq!(display, "hooks.slack.com");
-        assert!(debug.contains("[REDACTED]"));
-    }
-
-    #[test]
-    fn plain_http_is_refused() {
-        let error = Endpoint::new("http://hooks.slack.com/services/T/B/x", ALLOWED)
-            .expect_err("http must be refused");
-        assert_eq!(
-            error,
-            EndpointError::Scheme {
-                scheme: "http".to_string()
-            }
-        );
-    }
-
-    #[test]
-    fn a_link_local_metadata_address_is_refused() {
-        let error = Endpoint::new("https://169.254.169.254/latest/meta-data/", ALLOWED)
-            .expect_err("an IP literal must be refused");
-        assert_eq!(
-            error,
-            EndpointError::AddressLiteral {
-                host: "169.254.169.254".to_string()
-            }
-        );
-    }
-
-    #[test]
-    fn private_and_loopback_addresses_are_refused() {
-        for url in [
-            "https://127.0.0.1/hook",
-            "https://10.0.0.1/hook",
-            "https://192.168.1.1/hook",
-            "https://[::1]/hook",
-            "https://[fd00::1]/hook",
-        ] {
-            let error = Endpoint::new(url, ALLOWED).expect_err("must be refused");
-            assert!(
-                matches!(error, EndpointError::AddressLiteral { .. }),
-                "{url} produced {error:?}"
-            );
-        }
-    }
-
-    #[test]
-    fn loopback_by_name_is_refused_even_when_allowlisted() {
-        for host in ["localhost", "anything.localhost"] {
-            let url = format!("https://{host}/hook");
-            let error = Endpoint::new(&url, &[host]).expect_err("must be refused");
-            assert_eq!(
-                error,
-                EndpointError::Loopback {
-                    host: host.to_string()
-                }
-            );
-        }
-    }
-
-    #[test]
-    fn a_host_outside_the_allowlist_is_refused() {
-        let error =
-            Endpoint::new("https://evil.example.com/hook", ALLOWED).expect_err("must be refused");
-        assert_eq!(
-            error,
-            EndpointError::HostNotAllowed {
-                host: "evil.example.com".to_string()
-            }
-        );
-    }
-
-    #[test]
-    fn a_host_that_merely_ends_with_an_allowed_host_is_refused() {
-        let error = Endpoint::new("https://evilhooks.slack.com.attacker.test/hook", ALLOWED)
-            .expect_err("suffix matching must not apply");
-        assert!(matches!(error, EndpointError::HostNotAllowed { .. }));
-
-        let prefixed = Endpoint::new("https://nothooks.slack.com/hook", ALLOWED)
-            .expect_err("prefix padding must not match");
-        assert!(matches!(prefixed, EndpointError::HostNotAllowed { .. }));
-    }
-
-    #[test]
-    fn credentials_in_the_authority_are_refused() {
-        for url in [
-            "https://user@hooks.slack.com/hook",
-            "https://user:pass@hooks.slack.com/hook",
-        ] {
-            assert_eq!(
-                Endpoint::new(url, ALLOWED).expect_err("must be refused"),
-                EndpointError::EmbeddedCredentials
-            );
-        }
-    }
-
-    #[test]
-    fn non_http_schemes_are_refused() {
-        for url in [
-            "file:///etc/passwd",
-            "gopher://hooks.slack.com/",
-            "ftp://hooks.slack.com/",
-        ] {
-            let error = Endpoint::new(url, ALLOWED).expect_err("must be refused");
-            assert!(
-                matches!(
-                    error,
-                    EndpointError::Scheme { .. } | EndpointError::Malformed
-                ),
-                "{url} produced {error:?}"
-            );
-        }
-    }
-
-    #[test]
-    fn unparseable_input_is_refused_without_quoting_it() {
-        let error = Endpoint::new("not a url at all", ALLOWED).expect_err("must be refused");
-        assert_eq!(error, EndpointError::Malformed);
-        assert!(!error.to_string().contains("not a url"));
-    }
-
-    #[test]
-    fn host_casing_is_normalised_before_matching() {
-        let endpoint =
-            Endpoint::new("https://HOOKS.Slack.COM/services/T/B/x", ALLOWED).expect("same host");
-        assert_eq!(endpoint.host(), "hooks.slack.com");
-    }
-}
diff --git a/runner/zone_notify/src/error.rs b/runner/zone_notify/src/error.rs
deleted file mode 100644
index 0667a723..00000000
--- a/runner/zone_notify/src/error.rs
+++ /dev/null
@@ -1,142 +0,0 @@
-//! What a delivery can fail with.
-
-use std::time::Duration;
-
-use thiserror::Error;
-
-use crate::endpoint::EndpointError;
-
-/// A single channel's failure.
-///
-/// No variant carries the endpoint URL. A webhook URL is a bearer credential,
-/// and an error message is the shortest path from a credential to a log file,
-/// so failures name the host and nothing more.
-#[derive(Clone, Debug, Error, PartialEq, Eq)]
-pub enum NotifyError {
-    #[error("delivery timed out after {}ms", .after.as_millis())]
-    Timeout { after: Duration },
-
-    #[error("the notifier panicked")]
-    Panicked,
-
-    #[error("{host} rejected the notification with HTTP {status}: {body}")]
-    Rejected {
-        host: String,
-        status: u16,
-        body: String,
-    },
-
-    #[error("{host} is rate limiting this webhook{}", retry_hint(.retry_after))]
-    RateLimited {
-        host: String,
-        retry_after: Option<Duration>,
-    },
-
-    #[error("could not reach {host}: {message}")]
-    Unreachable { host: String, message: String },
-
-    #[error("SMTP delivery via {host} failed: {message}")]
-    Smtp { host: String, message: String },
-
-    #[error("the message could not be built: {message}")]
-    Malformed { message: String },
-
-    #[error(transparent)]
-    Endpoint(#[from] EndpointError),
-}
-
-impl NotifyError {
-    /// Whether sending the same notification again could plausibly succeed.
-    ///
-    /// A rejected payload and an unusable endpoint will fail identically no
-    /// matter how often they are retried; a timeout, a rate limit and a
-    /// transport fault will not.
-    pub fn is_retryable(&self) -> bool {
-        match self {
-            Self::Timeout { .. } | Self::RateLimited { .. } | Self::Unreachable { .. } => true,
-            Self::Rejected { status, .. } => *status >= 500 || *status == 408 || *status == 429,
-            Self::Smtp { .. } => true,
-            Self::Panicked | Self::Malformed { .. } | Self::Endpoint(_) => false,
-        }
-    }
-
-    /// How long the provider asked the caller to wait, when it said.
-    pub fn retry_after(&self) -> Option<Duration> {
-        match self {
-            Self::RateLimited { retry_after, .. } => *retry_after,
-            _ => None,
-        }
-    }
-}
-
-fn retry_hint(retry_after: &Option<Duration>) -> String {
-    match retry_after {
-        Some(after) => format!("; retry after {}ms", after.as_millis()),
-        None => String::new(),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_timeout_reports_how_long_it_waited() {
-        let error = NotifyError::Timeout {
-            after: Duration::from_millis(2500),
-        };
-        assert_eq!(error.to_string(), "delivery timed out after 2500ms");
-        assert!(error.is_retryable());
-    }
-
-    #[test]
-    fn a_rate_limit_reports_the_wait_when_the_provider_gave_one() {
-        let told = NotifyError::RateLimited {
-            host: "discord.com".to_string(),
-            retry_after: Some(Duration::from_millis(1200)),
-        };
-        assert_eq!(
-            told.to_string(),
-            "discord.com is rate limiting this webhook; retry after 1200ms"
-        );
-        assert_eq!(told.retry_after(), Some(Duration::from_millis(1200)));
-
-        let untold = NotifyError::RateLimited {
-            host: "discord.com".to_string(),
-            retry_after: None,
-        };
-        assert_eq!(
-            untold.to_string(),
-            "discord.com is rate limiting this webhook"
-        );
-        assert_eq!(untold.retry_after(), None);
-    }
-
-    #[test]
-    fn client_rejections_are_permanent_and_server_rejections_are_not() {
-        let malformed = NotifyError::Rejected {
-            host: "hooks.slack.com".to_string(),
-            status: 400,
-            body: "invalid_payload".to_string(),
-        };
-        assert!(!malformed.is_retryable());
-
-        for status in [500, 502, 503, 408, 429] {
-            let transient = NotifyError::Rejected {
-                host: "hooks.slack.com".to_string(),
-                status,
-                body: String::new(),
-            };
-            assert!(
-                transient.is_retryable(),
-                "HTTP {status} should be retryable"
-            );
-        }
-    }
-
-    #[test]
-    fn a_panic_is_never_retried() {
-        assert!(!NotifyError::Panicked.is_retryable());
-        assert_eq!(NotifyError::Panicked.to_string(), "the notifier panicked");
-    }
-}
diff --git a/runner/zone_notify/src/fanout.rs b/runner/zone_notify/src/fanout.rs
deleted file mode 100644
index e2b76411..00000000
--- a/runner/zone_notify/src/fanout.rs
+++ /dev/null
@@ -1,216 +0,0 @@
-//! Delivering one notification to every channel at once.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-use std::time::Duration;
-
-use tokio::task::{Id, JoinSet};
-use tokio::time::timeout;
-
-use crate::delivery::Delivery;
-use crate::error::NotifyError;
-use crate::notification::Notification;
-use crate::notifier::Notifier;
-use crate::report::Report;
-
-/// The default a channel gets before it is abandoned.
-pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(10);
-
-/// Delivers a notification to every registered channel concurrently.
-///
-/// Each channel runs as its own task under its own timeout, so a webhook that
-/// hangs, fails or panics costs exactly one entry in the [`Report`] and
-/// nothing else. Nothing here returns a `Result`: a fan-out has no single
-/// outcome, only one per channel.
-pub struct Fanout {
-    notifiers: Vec<Arc<dyn Notifier>>,
-    timeout: Duration,
-}
-
-impl Default for Fanout {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl Fanout {
-    pub fn new() -> Self {
-        Self {
-            notifiers: Vec::new(),
-            timeout: DEFAULT_TIMEOUT,
-        }
-    }
-
-    /// The budget for any channel that does not set its own.
-    #[must_use]
-    pub fn timeout(mut self, timeout: Duration) -> Self {
-        self.timeout = timeout;
-        self
-    }
-
-    #[must_use]
-    pub fn with(mut self, notifier: impl Notifier) -> Self {
-        self.register(Arc::new(notifier));
-        self
-    }
-
-    pub fn register(&mut self, notifier: Arc<dyn Notifier>) {
-        self.notifiers.push(notifier);
-    }
-
-    pub fn len(&self) -> usize {
-        self.notifiers.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.notifiers.is_empty()
-    }
-
-    /// Deliver to every channel, and report what each one did.
-    ///
-    /// With nothing registered this is an empty report rather than an error:
-    /// a workspace that has configured no channels has not failed at
-    /// anything.
-    pub async fn deliver(&self, notification: &Notification) -> Report {
-        if self.notifiers.is_empty() {
-            return Report::default();
-        }
-
-        let shared = Arc::new(notification.clone());
-        let mut tasks = JoinSet::new();
-        let mut indices: HashMap<Id, usize> = HashMap::with_capacity(self.notifiers.len());
-
-        for (index, notifier) in self.notifiers.iter().enumerate() {
-            let notifier = Arc::clone(notifier);
-            let notification = Arc::clone(&shared);
-            let budget = notifier.timeout().unwrap_or(self.timeout);
-
-            let handle = tasks.spawn(async move {
-                let outcome = match timeout(budget, notifier.deliver(&notification)).await {
-                    Ok(outcome) => outcome,
-                    Err(_) => Err(NotifyError::Timeout { after: budget }),
-                };
-                (index, describe(notifier.as_ref(), outcome))
-            });
-            indices.insert(handle.id(), index);
-        }
-
-        let mut collected: Vec<(usize, Delivery)> = Vec::with_capacity(self.notifiers.len());
-        while let Some(joined) = tasks.join_next().await {
-            match joined {
-                Ok(entry) => collected.push(entry),
-                Err(error) => {
-                    let Some(&index) = indices.get(&error.id()) else {
-                        continue;
-                    };
-                    let notifier = self.notifiers[index].as_ref();
-                    tracing::error!(
-                        channel = %notifier.channel(),
-                        "Notification channel panicked"
-                    );
-                    collected.push((index, describe(notifier, Err(NotifyError::Panicked))));
-                }
-            }
-        }
-
-        collected.sort_by_key(|(index, _)| *index);
-        let deliveries: Vec<Delivery> = collected.into_iter().map(|(_, one)| one).collect();
-
-        for failure in deliveries.iter().filter(|one| !one.is_delivered()) {
-            if let Some(error) = failure.error() {
-                tracing::warn!(
-                    channel = %failure.channel(),
-                    name = failure.name(),
-                    %error,
-                    "Notification delivery failed"
-                );
-            }
-        }
-
-        Report::new(deliveries)
-    }
-}
-
-fn describe(notifier: &dyn Notifier, outcome: Result<(), NotifyError>) -> Delivery {
-    let channel = notifier.channel();
-    let name = notifier
-        .name()
-        .unwrap_or_else(|| channel.as_str())
-        .to_string();
-    Delivery::new(channel, name, outcome)
-}
-
-/// The real backends driven through the fan-out.
-///
-/// The stub-driven tests in `tests/fanout.rs` cover the dispatch contract and
-/// the backends' own tests cover their payloads; these two check that the
-/// assembled thing works, which neither of those would catch on its own.
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::backend::{Discord, Slack};
-    use crate::channel::Channel;
-    use crate::severity::Severity;
-    use wiremock::matchers::method;
-    use wiremock::{Mock, MockServer, ResponseTemplate};
-
-    #[tokio::test]
-    async fn real_backends_deliver_together() {
-        let slack_server = MockServer::start().await;
-        let discord_server = MockServer::start().await;
-
-        for (server, status) in [(&slack_server, 200), (&discord_server, 204)] {
-            Mock::given(method("POST"))
-                .respond_with(ResponseTemplate::new(status))
-                .expect(1)
-                .mount(server)
-                .await;
-        }
-
-        let report = Fanout::new()
-            .with(Slack::at_test_server(&slack_server.uri()))
-            .with(Discord::at_test_server(&discord_server.uri()))
-            .deliver(&Notification::new("Build failed", "3 tests failed").severity(Severity::Error))
-            .await;
-
-        assert!(report.all_delivered(), "{report:?}");
-        assert_eq!(report.len(), 2);
-    }
-
-    #[tokio::test]
-    async fn a_broken_webhook_does_not_stop_the_other_channel() {
-        let slack_server = MockServer::start().await;
-        let discord_server = MockServer::start().await;
-
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(200))
-            .expect(1)
-            .mount(&slack_server)
-            .await;
-        Mock::given(method("POST"))
-            .respond_with(ResponseTemplate::new(404).set_body_string("Unknown Webhook"))
-            .mount(&discord_server)
-            .await;
-
-        let report = Fanout::new()
-            .with(Slack::at_test_server(&slack_server.uri()))
-            .with(Discord::at_test_server(&discord_server.uri()))
-            .deliver(&Notification::new("Build failed", "3 tests failed"))
-            .await;
-
-        assert_eq!(report.delivered().count(), 1);
-        assert_eq!(
-            report.delivered().next().map(|one| one.channel().clone()),
-            Some(Channel::SLACK)
-        );
-
-        let failure = report.failures().next().expect("discord failed");
-        assert_eq!(failure.channel(), &Channel::DISCORD);
-        assert!(
-            failure
-                .error()
-                .is_some_and(|error| matches!(error, NotifyError::Rejected { status: 404, .. }))
-        );
-        assert!(!failure.is_retryable());
-    }
-}
diff --git a/runner/zone_notify/src/field.rs b/runner/zone_notify/src/field.rs
deleted file mode 100644
index 2180633b..00000000
--- a/runner/zone_notify/src/field.rs
+++ /dev/null
@@ -1,46 +0,0 @@
-//! A labelled detail hung off a notification.
-
-use crate::notification::clean;
-
-/// One name/value pair, rendered as an embed field or a Slack section field.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Field {
-    name: String,
-    value: String,
-}
-
-impl Field {
-    pub fn new(name: impl Into<String>, value: impl Into<String>) -> Self {
-        Self {
-            name: clean(name.into()),
-            value: clean(value.into()),
-        }
-    }
-
-    pub fn name(&self) -> &str {
-        &self.name
-    }
-
-    pub fn value(&self) -> &str {
-        &self.value
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_field_keeps_its_name_and_value() {
-        let field = Field::new("Branch", "main");
-        assert_eq!(field.name(), "Branch");
-        assert_eq!(field.value(), "main");
-    }
-
-    #[test]
-    fn both_halves_are_sanitized() {
-        let field = Field::new("\u{1b}[1mBranch\u{1b}[0m", "token=ghp_0123456789abcdefghij");
-        assert_eq!(field.name(), "Branch");
-        assert_eq!(field.value(), "token=[REDACTED]");
-    }
-}
diff --git a/runner/zone_notify/src/lib.rs b/runner/zone_notify/src/lib.rs
deleted file mode 100644
index d797ac9f..00000000
--- a/runner/zone_notify/src/lib.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-//! Zone Notify - one notification, every channel.
-//!
-//! [`Fanout`] delivers a [`Notification`] to every registered [`Notifier`]
-//! concurrently and returns a [`Report`] saying what each one did. A channel
-//! that hangs, fails or panics costs one entry in that report and nothing
-//! else, so a misconfigured webhook cannot stop an email going out.
-//!
-//! ```no_run
-//! # async fn example() -> Result<(), Box<dyn std::error::Error>> {
-//! use zone_notify::{Discord, Fanout, Notification, Severity, Slack};
-//!
-//! let fanout = Fanout::new()
-//!     .with(Slack::new("https://hooks.slack.com/services/T000/B000/xxxx")?)
-//!     .with(Discord::new("https://discord.com/api/webhooks/1/xxxx")?);
-//!
-//! let report = fanout
-//!     .deliver(
-//!         &Notification::new("Build failed", "3 tests failed on main")
-//!             .severity(Severity::Error)
-//!             .link("https://zone.test/builds/1"),
-//!     )
-//!     .await;
-//!
-//! for failure in report.failures() {
-//!     eprintln!("{} did not take it: {:?}", failure.name(), failure.error());
-//! }
-//! # Ok(())
-//! # }
-//! ```
-//!
-//! # Credentials
-//!
-//! A webhook URL is a bearer credential: anyone holding it can post to the
-//! channel. [`Endpoint`] keeps one in a [`SecretValue`](abnegate_secret::SecretValue)
-//! and no error, `Debug` or log line in this crate reproduces it. That
-//! includes errors from `reqwest`, whose own `Display` appends the request
-//! URL and is stripped before it is ever rendered.
-//!
-//! # Content
-//!
-//! A notification's text passes through [`zone_core::tools::sanitize`] as it
-//! is built, which strips terminal control sequences and redacts credentials.
-//! Bodies carry tool output and user data, a chat channel's history is much
-//! harder to scrub than a log file, and control sequences in a message can
-//! forge output in a terminal-based reader.
-//!
-//! # Outbound requests
-//!
-//! A workspace-configured webhook URL points wherever its author said, which
-//! makes delivery a server-side request forgery surface. Each backend accepts
-//! only `https` URLs whose host matches its provider exactly, and redirects
-//! are refused rather than followed.
-
-mod backend;
-mod channel;
-mod delivery;
-mod endpoint;
-mod error;
-mod fanout;
-mod field;
-mod notification;
-mod notifier;
-mod report;
-mod severity;
-mod text;
-
-pub use backend::{Discord, Email, Slack, SmtpConfig};
-pub use channel::Channel;
-pub use delivery::Delivery;
-pub use endpoint::{Endpoint, EndpointError};
-pub use error::NotifyError;
-pub use fanout::{DEFAULT_TIMEOUT, Fanout};
-pub use field::Field;
-pub use notification::Notification;
-pub use notifier::Notifier;
-pub use report::Report;
-pub use severity::Severity;
diff --git a/runner/zone_notify/src/notification.rs b/runner/zone_notify/src/notification.rs
deleted file mode 100644
index 4900bb26..00000000
--- a/runner/zone_notify/src/notification.rs
+++ /dev/null
@@ -1,236 +0,0 @@
-//! What gets delivered.
-
-use chrono::{DateTime, Utc};
-use url::Url;
-use zone_core::tools::sanitize;
-
-use crate::field::Field;
-use crate::severity::Severity;
-
-/// One message, on its way to every channel at once.
-///
-/// Fields are private because the text is sanitized on the way in and that
-/// invariant has to hold for every backend. A notification body carries tool
-/// output and user data, so it passes through
-/// [`zone_core::tools::sanitize`], which strips terminal control sequences
-/// and redacts credentials. A chat channel's history is far harder to scrub
-/// than a log file, and control sequences in a message can forge output in
-/// any terminal-based reader, so sanitizing happens here, once, rather than
-/// in each backend where it could be forgotten.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Notification {
-    title: String,
-    body: String,
-    severity: Severity,
-    link: Option<String>,
-    fields: Vec<Field>,
-    timestamp: DateTime<Utc>,
-}
-
-impl Notification {
-    pub fn new(title: impl Into<String>, body: impl Into<String>) -> Self {
-        Self {
-            title: clean(title.into()),
-            body: clean(body.into()),
-            severity: Severity::default(),
-            link: None,
-            fields: Vec::new(),
-            timestamp: Utc::now(),
-        }
-    }
-
-    #[must_use]
-    pub fn severity(mut self, severity: Severity) -> Self {
-        self.severity = severity;
-        self
-    }
-
-    /// Attach a link, which is kept only if it is an `http(s)` URL.
-    ///
-    /// Anything else is dropped rather than rejected: a `javascript:` or
-    /// `data:` target is worth refusing, but not at the cost of failing an
-    /// otherwise deliverable notification. Unlike the text, a link is not
-    /// redacted, because it is built by the application rather than taken
-    /// from tool output.
-    #[must_use]
-    pub fn link(mut self, link: impl Into<String>) -> Self {
-        let link = link.into();
-        self.link = Url::parse(&link)
-            .ok()
-            .filter(|parsed| matches!(parsed.scheme(), "http" | "https"))
-            .map(String::from);
-        self
-    }
-
-    #[must_use]
-    pub fn field(mut self, name: impl Into<String>, value: impl Into<String>) -> Self {
-        self.fields.push(Field::new(name, value));
-        self
-    }
-
-    #[must_use]
-    pub fn at(mut self, timestamp: DateTime<Utc>) -> Self {
-        self.timestamp = timestamp;
-        self
-    }
-
-    pub fn title(&self) -> &str {
-        &self.title
-    }
-
-    pub fn body(&self) -> &str {
-        &self.body
-    }
-
-    pub fn kind(&self) -> Severity {
-        self.severity
-    }
-
-    pub fn url(&self) -> Option<&str> {
-        self.link.as_deref()
-    }
-
-    pub fn fields(&self) -> &[Field] {
-        &self.fields
-    }
-
-    pub fn timestamp(&self) -> DateTime<Utc> {
-        self.timestamp
-    }
-
-    /// The whole notification as plain text.
-    ///
-    /// Every channel can render this, so a backend that has no richer format
-    /// still says everything the notification carries.
-    pub fn to_plain_text(&self) -> String {
-        let mut rendered = self.title.clone();
-        if !self.body.is_empty() {
-            rendered.push_str("\n\n");
-            rendered.push_str(&self.body);
-        }
-        for field in &self.fields {
-            rendered.push_str("\n\n");
-            rendered.push_str(field.name());
-            rendered.push_str(": ");
-            rendered.push_str(field.value());
-        }
-        if let Some(link) = &self.link {
-            rendered.push_str("\n\n");
-            rendered.push_str(link);
-        }
-        rendered
-    }
-}
-
-pub(crate) fn clean(text: String) -> String {
-    sanitize(&text).into_owned()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use chrono::TimeZone;
-
-    #[test]
-    fn a_notification_keeps_what_it_was_given() {
-        let notification = Notification::new("Build failed", "3 tests failed")
-            .severity(Severity::Error)
-            .link("https://zone.test/builds/1")
-            .field("Branch", "main");
-
-        assert_eq!(notification.title(), "Build failed");
-        assert_eq!(notification.body(), "3 tests failed");
-        assert_eq!(notification.kind(), Severity::Error);
-        assert_eq!(notification.url(), Some("https://zone.test/builds/1"));
-        assert_eq!(notification.fields().len(), 1);
-        assert_eq!(notification.fields()[0].name(), "Branch");
-    }
-
-    #[test]
-    fn terminal_control_sequences_are_stripped_from_the_body() {
-        let notification = Notification::new(
-            "\u{1b}[31mBuild failed\u{1b}[0m",
-            "\u{1b}]0;stolen title\u{7}done",
-        );
-        assert_eq!(notification.title(), "Build failed");
-        assert_eq!(notification.body(), "done");
-    }
-
-    #[test]
-    fn a_credential_in_the_body_is_redacted_before_it_leaves() {
-        let notification =
-            Notification::new("Deploy log", "export GITHUB_TOKEN=ghp_0123456789abcdefghij");
-        assert!(!notification.body().contains("ghp_0123456789abcdefghij"));
-        assert!(notification.body().contains("[REDACTED]"));
-    }
-
-    #[test]
-    fn a_credential_in_a_field_is_redacted_too() {
-        let notification =
-            Notification::new("Deploy", "").field("Env", "OPENAI_KEY=sk-0123456789abcdefghij");
-        assert!(!notification.fields()[0].value().contains("sk-0123456789"));
-        assert!(notification.fields()[0].value().contains("[REDACTED]"));
-    }
-
-    /// The reason [`Notification::link`] does not redact.
-    ///
-    /// A one-time token in a query parameter is exactly what the redactor is
-    /// built to catch, so an account-flow URL survives as a link and does not
-    /// survive being interpolated into the body.
-    #[test]
-    fn a_one_time_token_survives_as_a_link_but_not_in_the_body() {
-        let reset = "https://zone.test/reset?token=8Xk2Qm9Lp4Rw7Tz1Vb6Nh3Yj5Fd0Gs8Ac2Ee4Ii6Ko";
-        let notification =
-            Notification::new("Reset your password", format!("Open {reset}")).link(reset);
-
-        assert_eq!(notification.url(), Some(reset));
-        assert!(
-            notification.body().contains("[REDACTED]"),
-            "body was {}",
-            notification.body()
-        );
-    }
-
-    #[test]
-    fn a_non_http_link_is_dropped() {
-        for link in [
-            "javascript:alert(1)",
-            "data:text/html,<script>",
-            "file:///etc/passwd",
-            "not a url",
-        ] {
-            let notification = Notification::new("Title", "Body").link(link);
-            assert_eq!(notification.url(), None, "{link} should have been dropped");
-        }
-    }
-
-    #[test]
-    fn plain_text_carries_every_part() {
-        let rendered = Notification::new("Build failed", "3 tests failed")
-            .field("Branch", "main")
-            .link("https://zone.test/builds/1")
-            .to_plain_text();
-
-        assert!(rendered.starts_with("Build failed"));
-        assert!(rendered.contains("3 tests failed"));
-        assert!(rendered.contains("Branch: main"));
-        assert!(rendered.ends_with("https://zone.test/builds/1"));
-    }
-
-    #[test]
-    fn plain_text_omits_an_absent_body_and_link() {
-        assert_eq!(
-            Notification::new("Just a title", "").to_plain_text(),
-            "Just a title"
-        );
-    }
-
-    #[test]
-    fn the_timestamp_can_be_pinned() {
-        let moment = Utc.with_ymd_and_hms(2026, 9, 8, 12, 0, 0).unwrap();
-        assert_eq!(
-            Notification::new("Title", "Body").at(moment).timestamp(),
-            moment
-        );
-    }
-}
diff --git a/runner/zone_notify/src/notifier.rs b/runner/zone_notify/src/notifier.rs
deleted file mode 100644
index 2216260f..00000000
--- a/runner/zone_notify/src/notifier.rs
+++ /dev/null
@@ -1,37 +0,0 @@
-//! The one trait every channel implements.
-
-use std::time::Duration;
-
-use async_trait::async_trait;
-
-use crate::channel::Channel;
-use crate::error::NotifyError;
-use crate::notification::Notification;
-
-/// A single delivery destination.
-///
-/// One method, taking the whole payload, so a new kind of notification is a
-/// new [`Notification`] rather than a new trait method every existing backend
-/// has to grow. Adding a channel is then one file: implement this, hand it to
-/// a [`Fanout`](crate::Fanout).
-#[async_trait]
-pub trait Notifier: Send + Sync + 'static {
-    /// Which kind of destination this is.
-    fn channel(&self) -> Channel;
-
-    /// Which configured instance this is, when one channel is set up twice.
-    ///
-    /// `None` reports the delivery under the channel name, which is right
-    /// until a workspace has both an alerts Slack and an engineering Slack
-    /// and needs to know which of the two failed.
-    fn name(&self) -> Option<&str> {
-        None
-    }
-
-    /// How long this backend should be given, overriding the fan-out default.
-    fn timeout(&self) -> Option<Duration> {
-        None
-    }
-
-    async fn deliver(&self, notification: &Notification) -> Result<(), NotifyError>;
-}
diff --git a/runner/zone_notify/src/report.rs b/runner/zone_notify/src/report.rs
deleted file mode 100644
index 1733f7e8..00000000
--- a/runner/zone_notify/src/report.rs
+++ /dev/null
@@ -1,124 +0,0 @@
-//! What happened across every channel.
-
-use crate::delivery::Delivery;
-
-/// Every channel's outcome from one fan-out, in registration order.
-///
-/// A fan-out returns this instead of a `Result`, because "the Slack webhook
-/// is misconfigured" and "nothing was delivered anywhere" are different
-/// facts and a caller has to be able to tell them apart.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct Report {
-    deliveries: Vec<Delivery>,
-}
-
-impl Report {
-    pub(crate) fn new(deliveries: Vec<Delivery>) -> Self {
-        Self { deliveries }
-    }
-
-    pub fn deliveries(&self) -> &[Delivery] {
-        &self.deliveries
-    }
-
-    /// The channels that took the notification.
-    pub fn delivered(&self) -> impl Iterator<Item = &Delivery> {
-        self.deliveries.iter().filter(|one| one.is_delivered())
-    }
-
-    /// The channels that did not.
-    pub fn failures(&self) -> impl Iterator<Item = &Delivery> {
-        self.deliveries.iter().filter(|one| !one.is_delivered())
-    }
-
-    /// The failures worth trying again.
-    pub fn retryable(&self) -> impl Iterator<Item = &Delivery> {
-        self.deliveries.iter().filter(|one| one.is_retryable())
-    }
-
-    /// How many channels were attempted.
-    pub fn len(&self) -> usize {
-        self.deliveries.len()
-    }
-
-    /// Whether no channel was configured.
-    ///
-    /// Distinct from [`Report::all_delivered`], which is vacuously true here:
-    /// a fan-out with nothing registered is not a failure, but a caller that
-    /// expected to reach someone will want to know it reached no one.
-    pub fn is_empty(&self) -> bool {
-        self.deliveries.is_empty()
-    }
-
-    pub fn all_delivered(&self) -> bool {
-        self.deliveries.iter().all(Delivery::is_delivered)
-    }
-
-    pub fn any_delivered(&self) -> bool {
-        self.deliveries.iter().any(Delivery::is_delivered)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::channel::Channel;
-    use crate::error::NotifyError;
-    use std::time::Duration;
-
-    fn delivered(name: &str) -> Delivery {
-        Delivery::new(Channel::SLACK, name.to_string(), Ok(()))
-    }
-
-    fn failed(name: &str) -> Delivery {
-        Delivery::new(
-            Channel::DISCORD,
-            name.to_string(),
-            Err(NotifyError::Timeout {
-                after: Duration::from_secs(1),
-            }),
-        )
-    }
-
-    fn permanently_failed(name: &str) -> Delivery {
-        Delivery::new(
-            Channel::EMAIL,
-            name.to_string(),
-            Err(NotifyError::Malformed {
-                message: "no recipients".to_string(),
-            }),
-        )
-    }
-
-    #[test]
-    fn an_empty_report_is_not_a_failure() {
-        let report = Report::default();
-        assert!(report.is_empty());
-        assert_eq!(report.len(), 0);
-        assert!(report.all_delivered());
-        assert!(!report.any_delivered());
-        assert_eq!(report.failures().count(), 0);
-    }
-
-    #[test]
-    fn a_mixed_report_separates_the_two_groups() {
-        let report = Report::new(vec![delivered("slack"), failed("discord"), delivered("b")]);
-
-        assert_eq!(report.len(), 3);
-        assert!(!report.is_empty());
-        assert!(!report.all_delivered());
-        assert!(report.any_delivered());
-        assert_eq!(report.delivered().count(), 2);
-
-        let failures: Vec<&str> = report.failures().map(Delivery::name).collect();
-        assert_eq!(failures, vec!["discord"]);
-    }
-
-    #[test]
-    fn only_retryable_failures_are_offered_for_a_retry() {
-        let report = Report::new(vec![failed("discord"), permanently_failed("email")]);
-        let retryable: Vec<&str> = report.retryable().map(Delivery::name).collect();
-        assert_eq!(retryable, vec!["discord"]);
-        assert_eq!(report.failures().count(), 2);
-    }
-}
diff --git a/runner/zone_notify/src/severity.rs b/runner/zone_notify/src/severity.rs
deleted file mode 100644
index cbc8af3d..00000000
--- a/runner/zone_notify/src/severity.rs
+++ /dev/null
@@ -1,67 +0,0 @@
-//! How loud a notification is.
-
-use serde::{Deserialize, Serialize};
-use std::fmt;
-
-/// The weight of a notification, which each backend renders in its own way.
-///
-/// Closed, unlike [`Channel`](crate::Channel): a backend has to map every
-/// severity to a colour or an icon, and a variant it has never heard of would
-/// have no rendering at all.
-#[derive(
-    Clone, Copy, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize,
-)]
-#[serde(rename_all = "lowercase")]
-pub enum Severity {
-    #[default]
-    Info,
-    Success,
-    Warning,
-    Error,
-}
-
-impl Severity {
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Info => "info",
-            Self::Success => "success",
-            Self::Warning => "warning",
-            Self::Error => "error",
-        }
-    }
-}
-
-impl fmt::Display for Severity {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str(self.as_str())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn info_is_the_default() {
-        assert_eq!(Severity::default(), Severity::Info);
-    }
-
-    #[test]
-    fn severities_are_ordered_by_weight() {
-        assert!(Severity::Error > Severity::Warning);
-        assert!(Severity::Warning > Severity::Success);
-        assert!(Severity::Success > Severity::Info);
-    }
-
-    #[test]
-    fn serde_uses_lowercase_names() {
-        assert_eq!(
-            serde_json::to_string(&Severity::Warning).expect("serialize"),
-            r#""warning""#
-        );
-        assert_eq!(
-            serde_json::from_str::<Severity>(r#""error""#).expect("deserialize"),
-            Severity::Error
-        );
-    }
-}
diff --git a/runner/zone_notify/src/text.rs b/runner/zone_notify/src/text.rs
deleted file mode 100644
index 4700f8a8..00000000
--- a/runner/zone_notify/src/text.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-//! Length limits shared by the backends.
-
-const ELLIPSIS: char = '\u{2026}';
-
-/// `text` shortened to `limit` characters, ending in an ellipsis when cut.
-///
-/// Every provider rejects an over-long field outright, so a message is
-/// truncated rather than lost. Counting characters and cutting on a boundary
-/// keeps multi-byte text from being split mid-codepoint.
-pub(crate) fn truncate(text: &str, limit: usize) -> String {
-    debug_assert!(
-        limit > 0,
-        "a zero limit would leave nothing but an ellipsis"
-    );
-    match text.char_indices().nth(limit) {
-        None => text.to_string(),
-        Some(_) => {
-            let keep = limit.saturating_sub(1);
-            let end = text
-                .char_indices()
-                .nth(keep)
-                .map(|(index, _)| index)
-                .unwrap_or(text.len());
-            let mut truncated = String::with_capacity(end + ELLIPSIS.len_utf8());
-            truncated.push_str(&text[..end]);
-            truncated.push(ELLIPSIS);
-            truncated
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn text_within_the_limit_is_untouched() {
-        assert_eq!(truncate("hello", 5), "hello");
-        assert_eq!(truncate("hello", 50), "hello");
-        assert_eq!(truncate("", 10), "");
-    }
-
-    #[test]
-    fn longer_text_is_cut_to_the_limit() {
-        let truncated = truncate("hello world", 8);
-        assert_eq!(truncated, "hello w\u{2026}");
-        assert_eq!(truncated.chars().count(), 8);
-    }
-
-    #[test]
-    fn multibyte_text_is_cut_on_a_character_boundary() {
-        let truncated = truncate("héllo wörld 中文", 8);
-        assert_eq!(truncated.chars().count(), 8);
-        assert!(std::str::from_utf8(truncated.as_bytes()).is_ok());
-        assert!(truncated.ends_with(ELLIPSIS));
-    }
-
-    #[test]
-    fn a_single_character_over_the_limit_still_truncates() {
-        assert_eq!(truncate("abcdef", 5), "abcd\u{2026}");
-    }
-}
diff --git a/runner/zone_notify/tests/fanout.rs b/runner/zone_notify/tests/fanout.rs
deleted file mode 100644
index e85dbcf5..00000000
--- a/runner/zone_notify/tests/fanout.rs
+++ /dev/null
@@ -1,332 +0,0 @@
-//! The fan-out contract, exercised through the public API.
-
-use std::sync::Arc;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::time::Duration;
-
-use async_trait::async_trait;
-use zone_notify::{Channel, Fanout, Notification, Notifier, NotifyError, Severity};
-
-/// A notifier that records what it was asked to send and then does as told.
-struct Stub {
-    channel: Channel,
-    name: Option<String>,
-    outcome: Outcome,
-    delivered: Arc<AtomicUsize>,
-}
-
-enum Outcome {
-    Succeed,
-    Fail,
-    Hang,
-    Panic,
-    Slow(Duration),
-}
-
-impl Stub {
-    fn new(channel: Channel, outcome: Outcome) -> Self {
-        Self {
-            channel,
-            name: None,
-            outcome,
-            delivered: Arc::new(AtomicUsize::new(0)),
-        }
-    }
-
-    fn named(mut self, name: &str) -> Self {
-        self.name = Some(name.to_string());
-        self
-    }
-
-    fn counter(&self) -> Arc<AtomicUsize> {
-        Arc::clone(&self.delivered)
-    }
-}
-
-#[async_trait]
-impl Notifier for Stub {
-    fn channel(&self) -> Channel {
-        self.channel.clone()
-    }
-
-    fn name(&self) -> Option<&str> {
-        self.name.as_deref()
-    }
-
-    async fn deliver(&self, _notification: &Notification) -> Result<(), NotifyError> {
-        match &self.outcome {
-            Outcome::Succeed => {
-                self.delivered.fetch_add(1, Ordering::SeqCst);
-                Ok(())
-            }
-            Outcome::Fail => Err(NotifyError::Malformed {
-                message: "nope".to_string(),
-            }),
-            Outcome::Hang => {
-                tokio::time::sleep(Duration::from_secs(3_600)).await;
-                Ok(())
-            }
-            Outcome::Slow(duration) => {
-                tokio::time::sleep(*duration).await;
-                self.delivered.fetch_add(1, Ordering::SeqCst);
-                Ok(())
-            }
-            Outcome::Panic => panic!("this backend is broken"),
-        }
-    }
-}
-
-/// A notifier that insists on a budget of its own.
-struct Impatient;
-
-#[async_trait]
-impl Notifier for Impatient {
-    fn channel(&self) -> Channel {
-        Channel::custom("impatient")
-    }
-
-    fn timeout(&self) -> Option<Duration> {
-        Some(Duration::from_millis(50))
-    }
-
-    async fn deliver(&self, _notification: &Notification) -> Result<(), NotifyError> {
-        tokio::time::sleep(Duration::from_secs(3_600)).await;
-        Ok(())
-    }
-}
-
-fn notification() -> Notification {
-    Notification::new("Build failed", "3 tests failed").severity(Severity::Error)
-}
-
-#[tokio::test]
-async fn an_empty_fanout_is_not_an_error() {
-    let report = Fanout::new().deliver(&notification()).await;
-
-    assert!(report.is_empty());
-    assert_eq!(report.len(), 0);
-    assert!(report.all_delivered());
-    assert!(!report.any_delivered());
-    assert_eq!(report.failures().count(), 0);
-}
-
-#[tokio::test]
-async fn every_configured_channel_receives_the_notification() {
-    let slack = Stub::new(Channel::SLACK, Outcome::Succeed);
-    let discord = Stub::new(Channel::DISCORD, Outcome::Succeed);
-    let email = Stub::new(Channel::EMAIL, Outcome::Succeed);
-    let counts = [slack.counter(), discord.counter(), email.counter()];
-
-    let report = Fanout::new()
-        .with(slack)
-        .with(discord)
-        .with(email)
-        .deliver(&notification())
-        .await;
-
-    assert_eq!(report.len(), 3);
-    assert!(report.all_delivered());
-    for counter in counts {
-        assert_eq!(counter.load(Ordering::SeqCst), 1);
-    }
-
-    let channels: Vec<String> = report
-        .deliveries()
-        .iter()
-        .map(|one| one.channel().to_string())
-        .collect();
-    assert_eq!(channels, vec!["slack", "discord", "email"]);
-}
-
-#[tokio::test]
-async fn one_failing_channel_does_not_stop_the_others() {
-    let slack = Stub::new(Channel::SLACK, Outcome::Succeed);
-    let email = Stub::new(Channel::EMAIL, Outcome::Succeed);
-    let (slack_count, email_count) = (slack.counter(), email.counter());
-
-    let report = Fanout::new()
-        .with(slack)
-        .with(Stub::new(Channel::DISCORD, Outcome::Fail))
-        .with(email)
-        .deliver(&notification())
-        .await;
-
-    assert_eq!(slack_count.load(Ordering::SeqCst), 1);
-    assert_eq!(email_count.load(Ordering::SeqCst), 1);
-
-    assert!(!report.all_delivered());
-    assert!(report.any_delivered());
-    assert_eq!(report.delivered().count(), 2);
-
-    let failures: Vec<&str> = report
-        .failures()
-        .map(|one| one.channel().as_str())
-        .collect();
-    assert_eq!(failures, vec!["discord"]);
-}
-
-#[tokio::test]
-async fn a_failure_is_reported_with_its_reason() {
-    let report = Fanout::new()
-        .with(Stub::new(Channel::DISCORD, Outcome::Fail))
-        .deliver(&notification())
-        .await;
-
-    let failure = report.failures().next().expect("one failure");
-    assert_eq!(failure.name(), "discord");
-    assert_eq!(
-        failure.error().map(ToString::to_string),
-        Some("the message could not be built: nope".to_string())
-    );
-    assert!(!failure.is_retryable());
-}
-
-#[tokio::test(start_paused = true)]
-async fn a_hanging_channel_is_abandoned_at_the_timeout() {
-    let slack = Stub::new(Channel::SLACK, Outcome::Succeed);
-    let slack_count = slack.counter();
-
-    let report = Fanout::new()
-        .timeout(Duration::from_secs(2))
-        .with(Stub::new(Channel::DISCORD, Outcome::Hang))
-        .with(slack)
-        .deliver(&notification())
-        .await;
-
-    assert_eq!(slack_count.load(Ordering::SeqCst), 1);
-    assert_eq!(report.len(), 2);
-
-    let timed_out = report.failures().next().expect("one failure");
-    assert_eq!(timed_out.channel().as_str(), "discord");
-    assert_eq!(
-        timed_out.error(),
-        Some(&NotifyError::Timeout {
-            after: Duration::from_secs(2)
-        })
-    );
-    assert!(timed_out.is_retryable());
-}
-
-#[tokio::test(start_paused = true)]
-async fn a_channel_inside_the_budget_still_delivers() {
-    let slow = Stub::new(Channel::EMAIL, Outcome::Slow(Duration::from_millis(500)));
-    let counter = slow.counter();
-
-    let report = Fanout::new()
-        .timeout(Duration::from_secs(5))
-        .with(slow)
-        .deliver(&notification())
-        .await;
-
-    assert!(report.all_delivered());
-    assert_eq!(counter.load(Ordering::SeqCst), 1);
-}
-
-#[tokio::test(start_paused = true)]
-async fn a_channel_may_impose_a_tighter_budget_than_the_fanout() {
-    let report = Fanout::new()
-        .timeout(Duration::from_secs(600))
-        .with(Impatient)
-        .deliver(&notification())
-        .await;
-
-    let failure = report.failures().next().expect("one failure");
-    assert_eq!(failure.channel().as_str(), "impatient");
-    assert_eq!(
-        failure.error(),
-        Some(&NotifyError::Timeout {
-            after: Duration::from_millis(50)
-        })
-    );
-}
-
-#[tokio::test]
-async fn a_panicking_channel_is_contained_and_reported() {
-    let slack = Stub::new(Channel::SLACK, Outcome::Succeed);
-    let counter = slack.counter();
-
-    let report = Fanout::new()
-        .with(Stub::new(Channel::DISCORD, Outcome::Panic))
-        .with(slack)
-        .deliver(&notification())
-        .await;
-
-    assert_eq!(counter.load(Ordering::SeqCst), 1);
-    assert_eq!(report.len(), 2);
-
-    let failure = report.failures().next().expect("one failure");
-    assert_eq!(failure.channel().as_str(), "discord");
-    assert_eq!(failure.error(), Some(&NotifyError::Panicked));
-    assert!(!failure.is_retryable());
-}
-
-#[tokio::test]
-async fn two_instances_of_one_channel_are_told_apart() {
-    let report = Fanout::new()
-        .with(Stub::new(Channel::SLACK, Outcome::Succeed).named("alerts"))
-        .with(Stub::new(Channel::SLACK, Outcome::Fail).named("engineering"))
-        .deliver(&notification())
-        .await;
-
-    let names: Vec<&str> = report.deliveries().iter().map(|one| one.name()).collect();
-    assert_eq!(names, vec!["alerts", "engineering"]);
-    assert_eq!(
-        report.failures().map(|one| one.name()).collect::<Vec<_>>(),
-        vec!["engineering"]
-    );
-}
-
-#[tokio::test]
-async fn deliveries_are_reported_in_registration_order() {
-    let mut fanout = Fanout::new();
-    for index in 0..8 {
-        let outcome = if index % 2 == 0 {
-            Outcome::Succeed
-        } else {
-            Outcome::Fail
-        };
-        fanout.register(Arc::new(
-            Stub::new(Channel::custom("bulk"), outcome).named(&format!("channel-{index}")),
-        ));
-    }
-
-    let report = fanout.deliver(&notification()).await;
-    let names: Vec<&str> = report.deliveries().iter().map(|one| one.name()).collect();
-
-    assert_eq!(
-        names,
-        vec![
-            "channel-0",
-            "channel-1",
-            "channel-2",
-            "channel-3",
-            "channel-4",
-            "channel-5",
-            "channel-6",
-            "channel-7"
-        ]
-    );
-    assert_eq!(report.delivered().count(), 4);
-    assert_eq!(report.failures().count(), 4);
-}
-
-#[tokio::test(start_paused = true)]
-async fn channels_run_concurrently_rather_than_one_after_another() {
-    let mut fanout = Fanout::new().timeout(Duration::from_secs(30));
-    for _ in 0..5 {
-        fanout.register(Arc::new(Stub::new(
-            Channel::custom("slow"),
-            Outcome::Slow(Duration::from_secs(4)),
-        )));
-    }
-
-    let started = tokio::time::Instant::now();
-    let report = fanout.deliver(&notification()).await;
-    let elapsed = started.elapsed();
-
-    assert!(report.all_delivered());
-    assert!(
-        elapsed < Duration::from_secs(20),
-        "five 4s channels took {elapsed:?}, so they ran in series"
-    );
-}
diff --git a/runner/zone_server/Cargo.toml b/runner/zone_server/Cargo.toml
index 17cedda2..9d2afd8c 100644
--- a/runner/zone_server/Cargo.toml
+++ b/runner/zone_server/Cargo.toml
@@ -69,9 +69,6 @@ regex = "=1.13.1"
 aes-gcm = { workspace = true }
 base64 = { workspace = true }
 
-# Email
-lettre = { version = "=0.11.23", features = ["tokio1-native-tls", "builder", "smtp-transport"] }
-
 # WebSocket
 dashmap = { workspace = true }
 once_cell = { workspace = true }
@@ -97,17 +94,17 @@ aiusg = { version = "=0.5.0", default-features = false }
 # Internal
 abnegate-exec = { workspace = true }
 abnegate-http = { workspace = true }
+abnegate-notify = { workspace = true, features = ["smtp"] }
 abnegate-secret = { workspace = true, features = ["sqlx"] }
 zone_chat = { path = "../zone_chat" }
 zone_comfy = { path = "../zone_comfy" }
-zone_email = { path = "../zone_email" }
-zone_notify = { path = "../zone_notify" }
 zone_search = { path = "../zone_search" }
 zone_vcs = { path = "../zone_vcs" }
 zone_core = { path = "../zone_core", features = ["sqlx"] }
 zone_context = { path = "../zone_context" }
 
 [dev-dependencies]
+abnegate-notify = { workspace = true, features = ["testing"] }
 zone_chat = { path = "../zone_chat" }
 tokio = { workspace = true, features = ["test-util", "macros"] }
 http-body-util = "=0.1.5"
diff --git a/runner/zone_server/src/main.rs b/runner/zone_server/src/main.rs
index cc4b8e0d..84a1ed67 100644
--- a/runner/zone_server/src/main.rs
+++ b/runner/zone_server/src/main.rs
@@ -19,6 +19,8 @@ use zone_server::services::embedding::{
     create_embedding_service, default_embedding_model, embedding_engine_from_env,
 };
 use zone_server::services::login;
+use zone_server::services::mail;
+use zone_server::services::mail::AccountMail;
 use zone_server::state::{AppState, default_adapter_registry};
 
 #[tokio::main]
@@ -153,15 +155,15 @@ async fn main() {
         }
     };
 
-    // Try to initialize email service
-    let email_service = match zone_email::EmailService::from_env() {
-        Ok(service) => {
-            tracing::info!("Email service initialized successfully");
-            Some(Arc::new(service))
+    let mail = match mail::Config::from_environment(mail::SenderPolicy::Default)
+        .and_then(|config| AccountMail::from_config(&config))
+    {
+        Ok(mail) => {
+            tracing::info!("Account mail configured");
+            Some(Arc::new(mail))
         }
-        Err(e) => {
-            tracing::warn!("Email service not configured: {}", e);
-            tracing::warn!("Email features will be unavailable (verification, password reset)");
+        Err(error) => {
+            tracing::warn!(%error, "Account mail is not configured; verification and password reset emails will not be sent");
             None
         }
     };
@@ -191,11 +193,10 @@ async fn main() {
             adapter_registry,
             embedding_service,
             context_service,
-            email_service,
+            mail,
         )
     } else {
-        // Fall back to basic state without context services
-        AppState::new(config.clone(), db, Some(cache))
+        AppState::new_with_mail(config.clone(), db, Some(cache), mail)
     };
 
     // Start background workers
diff --git a/runner/zone_server/src/routes/auth.rs b/runner/zone_server/src/routes/auth.rs
index 9c678b1b..59bc6fe1 100644
--- a/runner/zone_server/src/routes/auth.rs
+++ b/runner/zone_server/src/routes/auth.rs
@@ -14,6 +14,7 @@ use crate::db::{
     workspace_members::{self, WorkspaceRole},
     workspaces,
 };
+use crate::services::mail::Template;
 use crate::state::AppState;
 use crate::utils::crypto::hash_token;
 
@@ -790,23 +791,19 @@ pub async fn resend_verification(
             }
         };
 
-    // Send verification email if email service is configured
-    if let Some(email_service) = state.email_service() {
-        let verification_url = verification_url(&state.config().app_base_url, &token);
-        let display_name = user.display_name.as_deref().unwrap_or(&user.email);
+    if let Some(mail) = state.mail() {
+        let link = verification_url(&state.config().app_base_url, &token);
+        let name = user.display_name.as_deref().unwrap_or(&user.email);
 
-        if let Err(e) = email_service
-            .send_verification_email(&user.email, display_name, &verification_url)
-            .await
+        if mail
+            .dispatch(&user.email, &Template::Verification { name, link: &link })
+            .is_some()
         {
-            tracing::error!("Failed to send verification email: {}", e);
-            // Don't fail the request - token is created, user can retry
-        } else {
-            tracing::info!("Verification email sent to user_id: {}", user.id);
+            tracing::info!("Verification email queued for user_id: {}", user.id);
         }
     } else {
         tracing::debug!(
-            "Email service not configured, verification token created for user_id: {}",
+            "Account mail not configured, verification token created for user_id: {}",
             user.id
         );
     }
@@ -880,28 +877,23 @@ pub async fn forgot_password(
         }
     };
 
-    // Send password reset email if email service is configured
-    if let Some(email_service) = state.email_service() {
-        // Build reset URL using configured base URL
-        let reset_url = format!(
+    if let Some(mail) = state.mail() {
+        let link = format!(
             "{}/reset-password?token={}",
             state.config().app_base_url,
             token
         );
-        let display_name = user.display_name.as_deref().unwrap_or(&user.email);
+        let name = user.display_name.as_deref().unwrap_or(&user.email);
 
-        if let Err(e) = email_service
-            .send_password_reset_email(&user.email, display_name, &reset_url)
-            .await
+        if mail
+            .dispatch(&user.email, &Template::PasswordReset { name, link: &link })
+            .is_some()
         {
-            tracing::error!("Failed to send password reset email: {}", e);
-            // Don't fail the request - token is created, user can retry
-        } else {
-            tracing::info!("Password reset email sent to user_id: {}", user.id);
+            tracing::info!("Password reset email queued for user_id: {}", user.id);
         }
     } else {
         tracing::debug!(
-            "Email service not configured, password reset token created for user_id: {}",
+            "Account mail not configured, password reset token created for user_id: {}",
             user.id
         );
     }
diff --git a/runner/zone_server/src/services/mail/account.rs b/runner/zone_server/src/services/mail/account.rs
new file mode 100644
index 00000000..8ec108b7
--- /dev/null
+++ b/runner/zone_server/src/services/mail/account.rs
@@ -0,0 +1,367 @@
+//! Sending account messages.
+
+use std::fmt;
+use std::sync::Arc;
+use std::time::Duration;
+
+use abnegate_notify::Mail;
+use abnegate_notify::Mailer;
+use tokio::sync::Semaphore;
+use tokio::task::JoinHandle;
+use tracing::Instrument;
+
+use crate::services::mail::Config;
+use crate::services::mail::Error;
+use crate::services::mail::Template;
+
+/// How many dispatched messages may be with the relay at once. The endpoints
+/// that dispatch are public, so without a bound each request could open an
+/// SMTP session of its own.
+pub const MAX_CONCURRENT_SENDS: usize = 8;
+
+/// How long one dispatched message may take. lettre's async transport bounds
+/// only the TCP connect: a relay that stalls after it would otherwise hold the
+/// message's permit forever, and [`MAX_CONCURRENT_SENDS`] stalls would switch
+/// account mail off until the server restarts.
+pub const SEND_TIMEOUT: Duration = Duration::from_secs(60);
+
+/// Sends the account flow's messages through one [`Mail`].
+#[derive(Clone)]
+pub struct AccountMail {
+    mailer: Arc<dyn Mail>,
+    sends: Arc<Semaphore>,
+}
+
+impl AccountMail {
+    pub fn new(mailer: Arc<dyn Mail>) -> Self {
+        Self {
+            mailer,
+            sends: Arc::new(Semaphore::new(MAX_CONCURRENT_SENDS)),
+        }
+    }
+
+    /// Mail through the relay `config` describes. Nothing connects until a
+    /// message is sent.
+    pub fn from_config(config: &Config) -> Result<Self, Error> {
+        Ok(Self::new(Arc::new(Mailer::new(config.relay())?)))
+    }
+
+    pub async fn send(&self, recipient: &str, template: &Template<'_>) -> Result<(), Error> {
+        self.mailer
+            .send(recipient, template.subject(), &template.body())
+            .await?;
+        Ok(())
+    }
+
+    /// Send on a task of its own and log how it went, so a caller can answer
+    /// without waiting on the relay.
+    ///
+    /// When [`MAX_CONCURRENT_SENDS`] messages are already with the relay, the
+    /// message is dropped with a warning and `None` comes back. A send is given
+    /// up after [`SEND_TIMEOUT`], which frees its place. Each account
+    /// message carries a token that is stored before it is sent, so the person
+    /// loses nothing by asking again.
+    pub fn dispatch(&self, recipient: &str, template: &Template<'_>) -> Option<JoinHandle<()>> {
+        let subject = template.subject();
+        let Ok(permit) = Arc::clone(&self.sends).try_acquire_owned() else {
+            tracing::warn!(subject, "Account mail is at capacity; dropping the message");
+            return None;
+        };
+        let mailer = Arc::clone(&self.mailer);
+        let recipient = recipient.to_string();
+        let body = template.body();
+        Some(tokio::spawn(
+            async move {
+                let _permit = permit;
+                match tokio::time::timeout(SEND_TIMEOUT, mailer.send(&recipient, subject, &body))
+                    .await
+                {
+                    Ok(Ok(())) => tracing::info!(subject, "Account mail sent"),
+                    Ok(Err(error)) => {
+                        tracing::error!(%error, subject, "Account mail did not go out")
+                    }
+                    Err(_) => tracing::error!(
+                        subject,
+                        "Account mail did not go out: the relay did not answer in time"
+                    ),
+                }
+            }
+            .in_current_span(),
+        ))
+    }
+}
+
+impl fmt::Debug for AccountMail {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AccountMail")
+            .finish_non_exhaustive()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::AtomicUsize;
+    use std::sync::atomic::Ordering;
+
+    use abnegate_notify::MockMailer;
+    use abnegate_notify::SentMail;
+    use async_trait::async_trait;
+    use tokio::io::AsyncBufReadExt;
+    use tokio::io::AsyncWriteExt;
+    use tokio::io::BufReader;
+    use tokio::net::TcpListener;
+    use tokio::net::TcpStream;
+    use tokio::net::tcp::OwnedReadHalf;
+
+    use super::*;
+    use crate::services::mail::SenderPolicy;
+    use crate::services::mail::Variable;
+
+    const RECIPIENT: &str = "person@zone.test";
+    const LINK: &str = "https://zone.test/reset-password?token=abc";
+    const DEADLINE: Duration = Duration::from_secs(10);
+
+    fn recorded() -> (AccountMail, MockMailer) {
+        let mock = MockMailer::new();
+        (AccountMail::new(Arc::new(mock.clone())), mock)
+    }
+
+    #[tokio::test]
+    async fn every_message_reaches_the_mailer_with_its_subject_and_body() {
+        let (mail, mock) = recorded();
+        let verification = Template::Verification {
+            name: "Sam",
+            link: LINK,
+        };
+        let reset = Template::PasswordReset {
+            name: "Sam",
+            link: LINK,
+        };
+
+        mail.send(RECIPIENT, &verification).await.expect("sent");
+        mail.send(RECIPIENT, &reset).await.expect("sent");
+
+        assert_eq!(
+            mock.sent().await,
+            vec![
+                SentMail::new(RECIPIENT, verification.subject(), verification.body()),
+                SentMail::new(RECIPIENT, reset.subject(), reset.body()),
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn a_dispatched_message_reaches_the_mailer_on_its_own_task() {
+        let (mail, mock) = recorded();
+        let reset = Template::PasswordReset {
+            name: "Sam",
+            link: LINK,
+        };
+
+        let sending = mail.dispatch(RECIPIENT, &reset).expect("a free permit");
+        tokio::time::timeout(DEADLINE, sending)
+            .await
+            .expect("the send finishes")
+            .expect("the send did not panic");
+        assert_eq!(
+            mail.sends.available_permits(),
+            MAX_CONCURRENT_SENDS,
+            "a finished send gives its permit back"
+        );
+
+        assert_eq!(
+            mock.sent().await,
+            vec![SentMail::new(RECIPIENT, reset.subject(), reset.body())]
+        );
+    }
+
+    /// A relay that never answers, so every send it is given stays in flight.
+    /// It counts the sends that have reached it.
+    #[derive(Clone, Default)]
+    struct Silent {
+        entered: Arc<AtomicUsize>,
+    }
+
+    impl Silent {
+        /// Yield until `count` sends are inside [`Mail::send`].
+        async fn reached(&self, count: usize) {
+            tokio::time::timeout(DEADLINE, async {
+                while self.entered.load(Ordering::SeqCst) < count {
+                    tokio::task::yield_now().await;
+                }
+            })
+            .await
+            .expect("every dispatched send reaches the relay");
+        }
+    }
+
+    #[async_trait]
+    impl Mail for Silent {
+        async fn send(
+            &self,
+            _recipient: &str,
+            _subject: &str,
+            _body: &str,
+        ) -> Result<(), abnegate_notify::Error> {
+            self.entered.fetch_add(1, Ordering::SeqCst);
+            std::future::pending().await
+        }
+    }
+
+    fn reset() -> Template<'static> {
+        Template::PasswordReset {
+            name: "Sam",
+            link: LINK,
+        }
+    }
+
+    #[tokio::test]
+    async fn a_message_past_the_concurrency_bound_is_dropped_without_a_task() {
+        let silent = Silent::default();
+        let mail = AccountMail::new(Arc::new(silent.clone()));
+
+        let in_flight: Vec<JoinHandle<()>> = (0..MAX_CONCURRENT_SENDS)
+            .map(|_| mail.dispatch(RECIPIENT, &reset()).expect("a free permit"))
+            .collect();
+        silent.reached(MAX_CONCURRENT_SENDS).await;
+
+        assert!(
+            mail.dispatch(RECIPIENT, &reset()).is_none(),
+            "every permit is held by a send that is with the relay"
+        );
+        assert_eq!(mail.sends.available_permits(), 0);
+        assert_eq!(
+            silent.entered.load(Ordering::SeqCst),
+            MAX_CONCURRENT_SENDS,
+            "the dropped message never reached the relay"
+        );
+
+        for sending in in_flight {
+            sending.abort();
+            assert!(sending.await.expect_err("aborted").is_cancelled());
+        }
+        assert_eq!(
+            mail.sends.available_permits(),
+            MAX_CONCURRENT_SENDS,
+            "an ended send gives its permit back"
+        );
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_relay_that_never_answers_gives_its_permit_back_after_the_send_timeout() {
+        let silent = Silent::default();
+        let mail = AccountMail::new(Arc::new(silent.clone()));
+
+        let sending = mail.dispatch(RECIPIENT, &reset()).expect("a free permit");
+        silent.reached(1).await;
+        assert_eq!(mail.sends.available_permits(), MAX_CONCURRENT_SENDS - 1);
+
+        tokio::time::advance(SEND_TIMEOUT + Duration::from_secs(1)).await;
+        tokio::time::timeout(DEADLINE, sending)
+            .await
+            .expect("the send is given up once SEND_TIMEOUT passes")
+            .expect("the send did not panic");
+
+        assert_eq!(mail.sends.available_permits(), MAX_CONCURRENT_SENDS);
+    }
+
+    /// One line from the client, or what arrived before it hung up.
+    async fn command(reader: &mut BufReader<OwnedReadHalf>) -> String {
+        let mut line = Vec::new();
+        let read = tokio::time::timeout(DEADLINE, reader.read_until(b'\n', &mut line)).await;
+        if !matches!(read, Ok(Ok(_))) {
+            line.clear();
+        }
+        String::from_utf8_lossy(&line).trim_end().to_string()
+    }
+
+    /// A relay that greets in plaintext, offers STARTTLS, and records the
+    /// client's first two commands before hanging up.
+    async fn plaintext_relay(stream: TcpStream) -> Vec<String> {
+        let (reader, mut writer) = stream.into_split();
+        let mut reader = BufReader::new(reader);
+        let mut commands = Vec::new();
+
+        if writer
+            .write_all(b"220 relay.zone.test ESMTP\r\n")
+            .await
+            .is_err()
+        {
+            return commands;
+        }
+        commands.push(command(&mut reader).await);
+
+        if writer
+            .write_all(b"250-relay.zone.test\r\n250-STARTTLS\r\n250 AUTH PLAIN LOGIN\r\n")
+            .await
+            .is_err()
+        {
+            return commands;
+        }
+        commands.push(command(&mut reader).await);
+        commands
+    }
+
+    /// `SMTP_PORT` defaults to 587, the submission port relays serve with
+    /// STARTTLS. Every port but 465 must greet in plaintext and upgrade before
+    /// the credentials go out; an implicit-TLS client opens with a ClientHello
+    /// instead and never gets past the relay's greeting.
+    #[tokio::test]
+    async fn a_submission_port_relay_is_upgraded_with_starttls_before_signing_in() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("a local port");
+        let port = listener.local_addr().expect("bound").port();
+        let relay = tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.expect("the mailer connects");
+            plaintext_relay(stream).await
+        });
+
+        let config = Config::from_variables(
+            |variable| match variable {
+                Variable::Host => Some("127.0.0.1".to_string()),
+                Variable::Port => Some(port.to_string()),
+                Variable::User => Some("zone".to_string()),
+                Variable::Password => Some("hunter2-not-a-real-password".to_string()),
+                _ => None,
+            },
+            SenderPolicy::Default,
+        )
+        .expect("configured");
+        let mail = AccountMail::from_config(&config).expect("a mailer");
+
+        let outcome = tokio::time::timeout(
+            DEADLINE,
+            mail.send(
+                RECIPIENT,
+                &Template::PasswordReset {
+                    name: "Sam",
+                    link: LINK,
+                },
+            ),
+        )
+        .await
+        .expect("the send finishes once the relay hangs up");
+        let commands = tokio::time::timeout(DEADLINE, relay)
+            .await
+            .expect("the relay finishes")
+            .expect("the relay did not panic");
+
+        assert!(
+            commands
+                .first()
+                .is_some_and(|line| line.starts_with("EHLO ")),
+            "the client must answer the plaintext greeting with EHLO, got {commands:?}"
+        );
+        assert_eq!(
+            commands.get(1).map(String::as_str),
+            Some("STARTTLS"),
+            "the client must upgrade before anything else, got {commands:?}"
+        );
+        assert!(
+            outcome.is_err(),
+            "a relay that hangs up mid-upgrade cannot have taken the message"
+        );
+    }
+}
diff --git a/runner/zone_server/src/services/mail/config.rs b/runner/zone_server/src/services/mail/config.rs
new file mode 100644
index 00000000..cee33072
--- /dev/null
+++ b/runner/zone_server/src/services/mail/config.rs
@@ -0,0 +1,286 @@
+//! The relay account mail and email notices are sent through.
+
+use abnegate_notify::Sender;
+use abnegate_notify::SmtpConfig;
+
+use crate::services::mail::Error;
+use crate::services::mail::SenderPolicy;
+use crate::services::mail::Variable;
+
+pub const DEFAULT_PORT: u16 = 587;
+pub const DEFAULT_SENDER: &str = "noreply@zone.app";
+pub const DEFAULT_SENDER_NAME: &str = "Zone";
+
+/// The relay and sender mail goes out through.
+#[derive(Clone, Debug)]
+pub struct Config {
+    relay: SmtpConfig,
+}
+
+impl Config {
+    /// The relay the process environment describes.
+    pub fn from_environment(sender: SenderPolicy) -> Result<Self, Error> {
+        Self::from_variables(Variable::read, sender)
+    }
+
+    /// The relay `read` describes.
+    ///
+    /// Compose passes every `SMTP_*` variable through even when `.env` leaves
+    /// it out, so a value that is blank once trimmed counts as unset. The
+    /// password is the exception: it is taken exactly as given, blank
+    /// included, because a relay may accept an empty one.
+    ///
+    /// `SMTP_HOST`, `SMTP_USER` and `SMTP_PASSWORD` are required. The port and
+    /// sender name fall back to [`DEFAULT_PORT`] and [`DEFAULT_SENDER_NAME`],
+    /// and so does a port that is not a number, with a warning. `sender`
+    /// decides whether the address falls back to [`DEFAULT_SENDER`].
+    pub fn from_variables(
+        read: impl Fn(Variable) -> Option<String>,
+        sender: SenderPolicy,
+    ) -> Result<Self, Error> {
+        let value = |variable: Variable| {
+            read(variable)
+                .map(|value| value.trim().to_string())
+                .filter(|value| !value.is_empty())
+        };
+        let required = |variable: Variable| value(variable).ok_or(Error::Missing(variable));
+
+        let host = required(Variable::Host)?;
+        let port = value(Variable::Port).map_or(DEFAULT_PORT, |port| port_or_default(&port));
+        let user = required(Variable::User)?;
+        let password = read(Variable::Password).ok_or(Error::Missing(Variable::Password))?;
+        let address = match sender {
+            SenderPolicy::Default => {
+                value(Variable::From).unwrap_or_else(|| DEFAULT_SENDER.to_string())
+            }
+            SenderPolicy::Required => required(Variable::From)?,
+        };
+        let name = value(Variable::FromName).unwrap_or_else(|| DEFAULT_SENDER_NAME.to_string());
+
+        Ok(Self {
+            relay: SmtpConfig::new(
+                host,
+                port,
+                user,
+                password,
+                Sender::new(address).with_name(name),
+            ),
+        })
+    }
+
+    pub fn relay(&self) -> &SmtpConfig {
+        &self.relay
+    }
+}
+
+fn port_or_default(port: &str) -> u16 {
+    port.parse().unwrap_or_else(|error| {
+        tracing::warn!(
+            %error,
+            value = port,
+            default = DEFAULT_PORT,
+            "{} is not a port number; using the default",
+            Variable::Port.name()
+        );
+        DEFAULT_PORT
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PASSWORD: &str = "hunter2-not-a-real-password";
+
+    fn configured(variable: Variable) -> Option<String> {
+        match variable {
+            Variable::Host => Some("smtp.zone.test".to_string()),
+            Variable::User => Some("zone".to_string()),
+            Variable::Password => Some(PASSWORD.to_string()),
+            _ => None,
+        }
+    }
+
+    fn blank(blanked: Variable) -> impl Fn(Variable) -> Option<String> {
+        move |variable| {
+            if variable == blanked {
+                Some("  ".to_string())
+            } else {
+                configured(variable)
+            }
+        }
+    }
+
+    #[test]
+    fn the_required_variables_alone_configure_a_relay_with_the_defaults() {
+        let config = Config::from_variables(configured, SenderPolicy::Default).expect("configured");
+        let relay = config.relay();
+
+        assert_eq!(relay.host, "smtp.zone.test");
+        assert_eq!(relay.port, DEFAULT_PORT);
+        assert_eq!(relay.user, "zone");
+        assert_eq!(relay.password.expose(), PASSWORD);
+        assert_eq!(
+            relay.sender,
+            Sender::new(DEFAULT_SENDER).with_name(DEFAULT_SENDER_NAME)
+        );
+    }
+
+    #[test]
+    fn every_optional_variable_is_honoured() {
+        let config = Config::from_variables(
+            |variable| match variable {
+                Variable::Port => Some("465".to_string()),
+                Variable::From => Some("accounts@zone.test".to_string()),
+                Variable::FromName => Some("Zone Accounts".to_string()),
+                other => configured(other),
+            },
+            SenderPolicy::Default,
+        )
+        .expect("configured");
+
+        assert_eq!(config.relay().port, 465);
+        assert_eq!(
+            config.relay().sender,
+            Sender::new("accounts@zone.test").with_name("Zone Accounts")
+        );
+    }
+
+    #[test]
+    fn each_required_variable_is_named_when_it_is_missing() {
+        for missing in [Variable::Host, Variable::User, Variable::Password] {
+            let error = Config::from_variables(
+                |variable| {
+                    (variable != missing)
+                        .then(|| configured(variable))
+                        .flatten()
+                },
+                SenderPolicy::Default,
+            )
+            .expect_err("incomplete");
+
+            assert!(
+                matches!(error, Error::Missing(variable) if variable == missing),
+                "{missing:?}: {error}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_blank_host_is_named_as_missing() {
+        let error = Config::from_variables(blank(Variable::Host), SenderPolicy::Default)
+            .expect_err("a blank host names no relay");
+
+        assert!(matches!(error, Error::Missing(Variable::Host)), "{error}");
+    }
+
+    #[test]
+    fn a_blank_user_is_named_as_missing() {
+        let error = Config::from_variables(blank(Variable::User), SenderPolicy::Default)
+            .expect_err("a blank user signs in as no one");
+
+        assert!(matches!(error, Error::Missing(Variable::User)), "{error}");
+    }
+
+    #[test]
+    fn a_blank_password_is_kept_for_a_relay_that_takes_an_empty_one() {
+        for password in ["", "  "] {
+            let config = Config::from_variables(
+                |variable| match variable {
+                    Variable::Password => Some(password.to_string()),
+                    other => configured(other),
+                },
+                SenderPolicy::Default,
+            )
+            .expect("an empty password is still a password");
+
+            assert_eq!(config.relay().password.expose(), password);
+        }
+    }
+
+    #[test]
+    fn a_blank_sender_falls_back_to_the_default() {
+        let config = Config::from_variables(
+            |variable| match variable {
+                Variable::From | Variable::FromName | Variable::Port => Some(String::new()),
+                other => configured(other),
+            },
+            SenderPolicy::Default,
+        )
+        .expect("a blank sender is no sender");
+
+        assert_eq!(config.relay().port, DEFAULT_PORT);
+        assert_eq!(
+            config.relay().sender,
+            Sender::new(DEFAULT_SENDER).with_name(DEFAULT_SENDER_NAME)
+        );
+    }
+
+    #[test]
+    fn a_required_sender_is_named_when_it_is_missing_or_blank() {
+        for from in [None, Some(" ".to_string())] {
+            let error = Config::from_variables(
+                |variable| match variable {
+                    Variable::From => from.clone(),
+                    other => configured(other),
+                },
+                SenderPolicy::Required,
+            )
+            .expect_err("no sender");
+
+            assert!(
+                matches!(error, Error::Missing(Variable::From)),
+                "{from:?}: {error}"
+            );
+        }
+    }
+
+    #[test]
+    fn values_are_trimmed_but_the_password_is_kept_as_given() {
+        let config = Config::from_variables(
+            |variable| match variable {
+                Variable::Host => Some(" smtp.zone.test ".to_string()),
+                Variable::Port => Some(" 2525 ".to_string()),
+                Variable::User => Some(" zone ".to_string()),
+                Variable::Password => Some(" spaced password ".to_string()),
+                Variable::From => Some(" alerts@zone.test ".to_string()),
+                Variable::FromName => Some(" Zone Alerts ".to_string()),
+            },
+            SenderPolicy::Required,
+        )
+        .expect("configured");
+        let relay = config.relay();
+
+        assert_eq!(relay.host, "smtp.zone.test");
+        assert_eq!(relay.port, 2525);
+        assert_eq!(relay.user, "zone");
+        assert_eq!(relay.password.expose(), " spaced password ");
+        assert_eq!(
+            relay.sender,
+            Sender::new("alerts@zone.test").with_name("Zone Alerts")
+        );
+    }
+
+    #[test]
+    fn an_unreadable_port_falls_back_to_the_default() {
+        let config = Config::from_variables(
+            |variable| match variable {
+                Variable::Port => Some("submission".to_string()),
+                other => configured(other),
+            },
+            SenderPolicy::Default,
+        )
+        .expect("a bad port is not a missing relay");
+
+        assert_eq!(config.relay().port, DEFAULT_PORT);
+    }
+
+    #[test]
+    fn the_password_never_appears_in_debug() {
+        let config = Config::from_variables(configured, SenderPolicy::Default).expect("configured");
+        let rendered = format!("{config:?}");
+
+        assert!(!rendered.contains("hunter2"), "leaked: {rendered}");
+        assert!(rendered.contains("smtp.zone.test"));
+    }
+}
diff --git a/runner/zone_server/src/services/mail/error.rs b/runner/zone_server/src/services/mail/error.rs
new file mode 100644
index 00000000..e3e97960
--- /dev/null
+++ b/runner/zone_server/src/services/mail/error.rs
@@ -0,0 +1,24 @@
+//! Why account mail is unavailable, or a message did not go out.
+
+use crate::services::mail::Variable;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("{} is not set", .0.name())]
+    Missing(Variable),
+    #[error(transparent)]
+    Delivery(#[from] abnegate_notify::Error),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_missing_variable_is_named() {
+        assert_eq!(
+            Error::Missing(Variable::Host).to_string(),
+            "SMTP_HOST is not set"
+        );
+    }
+}
diff --git a/runner/zone_server/src/services/mail/mod.rs b/runner/zone_server/src/services/mail/mod.rs
new file mode 100644
index 00000000..e126e8b6
--- /dev/null
+++ b/runner/zone_server/src/services/mail/mod.rs
@@ -0,0 +1,23 @@
+//! The messages an account flow sends: sign-up verification and password reset.
+//!
+//! Zone owns the wording; delivery is `abnegate_notify`'s [`Mailer`] through
+//! the relay the `SMTP_*` variables describe, or any other
+//! [`Mail`](abnegate_notify::Mail) a test hands [`AccountMail::new`]. The email
+//! notification channel reads the same relay through [`Config`].
+//!
+//! [`Mailer`]: abnegate_notify::Mailer
+
+mod account;
+mod config;
+mod error;
+mod sender_policy;
+mod template;
+mod variable;
+
+pub use account::AccountMail;
+pub use config::Config;
+pub use config::DEFAULT_PORT;
+pub use error::Error;
+pub use sender_policy::SenderPolicy;
+pub use template::Template;
+pub use variable::Variable;
diff --git a/runner/zone_server/src/services/mail/sender_policy.rs b/runner/zone_server/src/services/mail/sender_policy.rs
new file mode 100644
index 00000000..84d124c8
--- /dev/null
+++ b/runner/zone_server/src/services/mail/sender_policy.rs
@@ -0,0 +1,11 @@
+//! What a relay does without `SMTP_FROM`.
+
+/// Whether a relay may fall back to a default sender address.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SenderPolicy {
+    /// Send from [`DEFAULT_SENDER`](super::config::DEFAULT_SENDER) when
+    /// `SMTP_FROM` is unset or blank.
+    Default,
+    /// Refuse the relay unless `SMTP_FROM` names an address.
+    Required,
+}
diff --git a/runner/zone_server/src/services/mail/template.rs b/runner/zone_server/src/services/mail/template.rs
new file mode 100644
index 00000000..3aa058bd
--- /dev/null
+++ b/runner/zone_server/src/services/mail/template.rs
@@ -0,0 +1,146 @@
+//! The wording of each account message.
+
+use abnegate_secret::sanitize;
+
+/// One account message, addressed to `name` and carrying its one-time `link`.
+///
+/// The name is whatever the person typed as their display name, so it is
+/// sanitised before it reaches a mail client. The link is not: redaction would
+/// eat the token that is its whole point.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Template<'a> {
+    Verification { name: &'a str, link: &'a str },
+    PasswordReset { name: &'a str, link: &'a str },
+}
+
+impl Template<'_> {
+    pub fn subject(&self) -> &'static str {
+        match self {
+            Self::Verification { .. } => "Verify your email address",
+            Self::PasswordReset { .. } => "Reset your password",
+        }
+    }
+
+    pub fn body(&self) -> String {
+        let name = sanitize(self.name());
+        match self {
+            Self::Verification { link, .. } => format!(
+                "Hello {name},\n\
+                 \n\
+                 Thank you for signing up for Zone!\n\
+                 \n\
+                 Please verify your email address by clicking the link below:\n\
+                 \n\
+                 {link}\n\
+                 \n\
+                 This link will expire in 24 hours.\n\
+                 \n\
+                 If you did not create an account, you can safely ignore this email.\n\
+                 \n\
+                 Best regards,\n\
+                 The Zone Team\n"
+            ),
+            Self::PasswordReset { link, .. } => format!(
+                "Hello {name},\n\
+                 \n\
+                 We received a request to reset your password for your Zone account.\n\
+                 \n\
+                 Click the link below to reset your password:\n\
+                 \n\
+                 {link}\n\
+                 \n\
+                 This link will expire in 1 hour.\n\
+                 \n\
+                 If you did not request a password reset, you can safely ignore this email.\n\
+                 Your password will not be changed unless you click the link above and create a new password.\n\
+                 \n\
+                 Best regards,\n\
+                 The Zone Team\n"
+            ),
+        }
+    }
+
+    fn name(&self) -> &str {
+        match self {
+            Self::Verification { name, .. } | Self::PasswordReset { name, .. } => name,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const LINK: &str =
+        "https://zone.test/verify-email?token=8Xk2Qm9Lp4Rw7Tz1Vb6Nh3Yj5Fd0Gs8Ac2Ee4Ii6Ko";
+
+    fn lines(body: &str) -> Vec<&str> {
+        body.lines().collect()
+    }
+
+    #[test]
+    fn each_template_has_its_subject() {
+        let verification = Template::Verification {
+            name: "Sam",
+            link: LINK,
+        };
+        let reset = Template::PasswordReset {
+            name: "Sam",
+            link: LINK,
+        };
+
+        assert_eq!(verification.subject(), "Verify your email address");
+        assert_eq!(reset.subject(), "Reset your password");
+    }
+
+    #[test]
+    fn verification_greets_the_person_and_carries_the_link_on_its_own_line() {
+        let body = Template::Verification {
+            name: "Sam",
+            link: LINK,
+        }
+        .body();
+        let lines = lines(&body);
+
+        assert_eq!(lines.first(), Some(&"Hello Sam,"));
+        assert!(lines.contains(&LINK), "{body}");
+        assert!(lines.contains(&"This link will expire in 24 hours."));
+        assert_eq!(lines.last(), Some(&"The Zone Team"));
+    }
+
+    #[test]
+    fn a_password_reset_greets_the_person_and_carries_the_link_on_its_own_line() {
+        let body = Template::PasswordReset {
+            name: "Sam",
+            link: LINK,
+        }
+        .body();
+        let lines = lines(&body);
+
+        assert_eq!(lines.first(), Some(&"Hello Sam,"));
+        assert!(lines.contains(&LINK), "{body}");
+        assert!(lines.contains(&"This link will expire in 1 hour."));
+        assert_eq!(lines.last(), Some(&"The Zone Team"));
+    }
+
+    #[test]
+    fn control_sequences_in_a_name_are_stripped_and_the_link_is_left_whole() {
+        let name = "Sam\u{1b}[2J\u{1b}]8;;https://evil.test\u{7}\u{202e}\u{200d}";
+        assert_ne!(
+            sanitize(LINK),
+            LINK,
+            "the link must be one that sanitising would change"
+        );
+
+        for template in [
+            Template::Verification { name, link: LINK },
+            Template::PasswordReset { name, link: LINK },
+        ] {
+            let body = template.body();
+            let lines = lines(&body);
+
+            assert_eq!(lines.first(), Some(&"Hello Sam,"), "{body:?}");
+            assert!(lines.contains(&LINK), "{body:?}");
+        }
+    }
+}
diff --git a/runner/zone_server/src/services/mail/variable.rs b/runner/zone_server/src/services/mail/variable.rs
new file mode 100644
index 00000000..4cd230f9
--- /dev/null
+++ b/runner/zone_server/src/services/mail/variable.rs
@@ -0,0 +1,61 @@
+//! The environment variables an SMTP relay is configured from.
+
+/// One `SMTP_*` variable, shared by account mail and the email notification
+/// channel so both read the same relay.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Variable {
+    Host,
+    Port,
+    User,
+    Password,
+    From,
+    FromName,
+}
+
+impl Variable {
+    pub const fn name(self) -> &'static str {
+        match self {
+            Self::Host => "SMTP_HOST",
+            Self::Port => "SMTP_PORT",
+            Self::User => "SMTP_USER",
+            Self::Password => "SMTP_PASSWORD",
+            Self::From => "SMTP_FROM",
+            Self::FromName => "SMTP_FROM_NAME",
+        }
+    }
+
+    /// The variable's value in the process environment, when it is set.
+    pub fn read(self) -> Option<String> {
+        std::env::var(self.name()).ok()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_variable_keeps_its_documented_name() {
+        let names = [
+            Variable::Host,
+            Variable::Port,
+            Variable::User,
+            Variable::Password,
+            Variable::From,
+            Variable::FromName,
+        ]
+        .map(Variable::name);
+
+        assert_eq!(
+            names,
+            [
+                "SMTP_HOST",
+                "SMTP_PORT",
+                "SMTP_USER",
+                "SMTP_PASSWORD",
+                "SMTP_FROM",
+                "SMTP_FROM_NAME",
+            ]
+        );
+    }
+}
diff --git a/runner/zone_server/src/services/mod.rs b/runner/zone_server/src/services/mod.rs
index 318a8a71..6123f232 100644
--- a/runner/zone_server/src/services/mod.rs
+++ b/runner/zone_server/src/services/mod.rs
@@ -17,6 +17,7 @@ pub mod hosts;
 pub mod image_intent;
 pub mod knowledge;
 pub mod login;
+pub mod mail;
 pub mod media_source;
 pub mod model;
 pub mod prioritisation;
diff --git a/runner/zone_server/src/state.rs b/runner/zone_server/src/state.rs
index 5caffdc5..251296e8 100644
--- a/runner/zone_server/src/state.rs
+++ b/runner/zone_server/src/state.rs
@@ -3,6 +3,7 @@
 use abnegate_http::{RateLimitConfig, RateLimiter};
 use sqlx::PgPool;
 use std::sync::Arc;
+use std::time::Duration;
 use tokio::sync::{OnceCell, Semaphore};
 use uuid::Uuid;
 use zone_context::adapters::{
@@ -18,10 +19,10 @@ use crate::cache::Cache;
 use crate::config::AgentConfig;
 use crate::config::{Config, ModelBackend};
 use crate::pull::PullRegistry;
+use crate::services::mail::AccountMail;
 use crate::services::task_progress::{self, TaskProgressBroadcaster};
 use crate::sync::SyncRegistry;
 use crate::train_jobs::TrainRegistry;
-use zone_email::EmailService;
 
 /// Maximum concurrent indexing operations
 const MAX_CONCURRENT_INDEX: usize = 3;
@@ -31,6 +32,8 @@ const MAX_CONCURRENT_TRAIN: usize = 1;
 /// Clip extracts run ffmpeg and decode frames; a handful at once keeps a dump
 /// of hundreds of videos moving without stacking every clip in RAM.
 const MAX_CONCURRENT_FRAME_EXTRACT: usize = 4;
+/// Without a sweep, every client the rate limiter has ever seen stays in it.
+const RATE_LIMITER_CLEANUP_INTERVAL: Duration = Duration::from_secs(300);
 
 /// The adapters a source can be verified and fetched with.
 ///
@@ -85,7 +88,7 @@ struct AppStateInner {
     pub adapter_registry: Option<Arc<AdapterRegistry>>,
     pub embedding_service: Option<Arc<dyn EmbeddingService>>,
     pub context_service: Option<Arc<ContextService>>,
-    pub email_service: Option<Arc<EmailService>>,
+    pub mail: Option<Arc<AccountMail>>,
     pub rate_limiter: Arc<RateLimiter<Uuid>>,
     pub sync_registry: SyncRegistry,
     pub pull_registry: PullRegistry,
@@ -114,46 +117,26 @@ struct AppStateInner {
 impl AppState {
     /// Create a new application state without embedding or context services
     pub fn new(config: Config, db: PgPool, cache: Option<Cache>) -> Self {
-        // Derive encryption key from config
-        let encryption_key = crate::crypto::derive_key(config.encryption_key())
-            .expect("Encryption key should be valid (validated in Config::from_env)");
-
-        // Create rate limiter with default config (10 requests per minute)
-        let rate_limiter = Arc::new(RateLimiter::new(RateLimitConfig::default()));
-
-        // Spawn background cleanup task to prevent unbounded memory growth
-        let rate_limiter_clone = rate_limiter.clone();
-        tokio::spawn(async move {
-            use std::time::Duration;
-            let mut interval = tokio::time::interval(Duration::from_secs(300)); // 5 min
-            loop {
-                interval.tick().await;
-                rate_limiter_clone.cleanup();
-                tracing::debug!("Rate limiter cleanup completed");
-            }
-        });
+        Self::new_with_mail(config, db, cache, None)
+    }
 
-        Self {
-            inner: Arc::new(AppStateInner {
-                config,
-                db,
-                cache,
-                adapter_registry: Some(Arc::new(default_adapter_registry())),
-                embedding_service: None,
-                context_service: None,
-                email_service: None,
-                rate_limiter,
-                sync_registry: SyncRegistry::new(),
-                pull_registry: PullRegistry::new(),
-                train_jobs: TrainRegistry::new(),
-                encryption_key,
-                index_semaphore: Arc::new(Semaphore::new(MAX_CONCURRENT_INDEX)),
-                train_semaphore: Arc::new(Semaphore::new(MAX_CONCURRENT_TRAIN)),
-                frame_semaphore: Arc::new(Semaphore::new(MAX_CONCURRENT_FRAME_EXTRACT)),
-                mcp: OnceCell::new(),
-                task_progress: task_progress::progress(),
-            }),
-        }
+    /// The state the server falls back to when the embedding service will not
+    /// start: no embedding or context services, but account mail all the same.
+    pub fn new_with_mail(
+        config: Config,
+        db: PgPool,
+        cache: Option<Cache>,
+        mail: Option<Arc<AccountMail>>,
+    ) -> Self {
+        Self::assemble(
+            config,
+            db,
+            cache,
+            Arc::new(default_adapter_registry()),
+            None,
+            None,
+            mail,
+        )
     }
 
     /// Create a new application state with zone_context services
@@ -165,49 +148,18 @@ impl AppState {
         embedding_service: Arc<dyn EmbeddingService>,
         context_service: Arc<ContextService>,
     ) -> Self {
-        // Derive encryption key from config
-        let encryption_key = crate::crypto::derive_key(config.encryption_key())
-            .expect("Encryption key should be valid (validated in Config::from_env)");
-
-        // Create rate limiter with default config (10 requests per minute)
-        let rate_limiter = Arc::new(RateLimiter::new(RateLimitConfig::default()));
-
-        // Spawn background cleanup task to prevent unbounded memory growth
-        let rate_limiter_clone = rate_limiter.clone();
-        tokio::spawn(async move {
-            use std::time::Duration;
-            let mut interval = tokio::time::interval(Duration::from_secs(300)); // 5 min
-            loop {
-                interval.tick().await;
-                rate_limiter_clone.cleanup();
-                tracing::debug!("Rate limiter cleanup completed");
-            }
-        });
-
-        Self {
-            inner: Arc::new(AppStateInner {
-                config,
-                db,
-                cache,
-                adapter_registry: Some(adapter_registry),
-                embedding_service: Some(embedding_service),
-                context_service: Some(context_service),
-                email_service: None,
-                rate_limiter,
-                sync_registry: SyncRegistry::new(),
-                pull_registry: PullRegistry::new(),
-                train_jobs: TrainRegistry::new(),
-                encryption_key,
-                index_semaphore: Arc::new(Semaphore::new(MAX_CONCURRENT_INDEX)),
-                train_semaphore: Arc::new(Semaphore::new(MAX_CONCURRENT_TRAIN)),
-                frame_semaphore: Arc::new(Semaphore::new(MAX_CONCURRENT_FRAME_EXTRACT)),
-                mcp: OnceCell::new(),
-                task_progress: task_progress::progress(),
-            }),
-        }
+        Self::new_with_all_services(
+            config,
+            db,
+            cache,
+            adapter_registry,
+            embedding_service,
+            context_service,
+            None,
+        )
     }
 
-    /// Create a new application state with all services including email
+    /// Create a new application state with all services, account mail included
     pub fn new_with_all_services(
         config: Config,
         db: PgPool,
@@ -215,23 +167,38 @@ impl AppState {
         adapter_registry: Arc<AdapterRegistry>,
         embedding_service: Arc<dyn EmbeddingService>,
         context_service: Arc<ContextService>,
-        email_service: Option<Arc<EmailService>>,
+        mail: Option<Arc<AccountMail>>,
+    ) -> Self {
+        Self::assemble(
+            config,
+            db,
+            cache,
+            adapter_registry,
+            Some(embedding_service),
+            Some(context_service),
+            mail,
+        )
+    }
+
+    fn assemble(
+        config: Config,
+        db: PgPool,
+        cache: Option<Cache>,
+        adapter_registry: Arc<AdapterRegistry>,
+        embedding_service: Option<Arc<dyn EmbeddingService>>,
+        context_service: Option<Arc<ContextService>>,
+        mail: Option<Arc<AccountMail>>,
     ) -> Self {
-        // Derive encryption key from config
         let encryption_key = crate::crypto::derive_key(config.encryption_key())
             .expect("Encryption key should be valid (validated in Config::from_env)");
 
-        // Create rate limiter with default config (10 requests per minute)
         let rate_limiter = Arc::new(RateLimiter::new(RateLimitConfig::default()));
-
-        // Spawn background cleanup task to prevent unbounded memory growth
-        let rate_limiter_clone = rate_limiter.clone();
+        let cleaned = Arc::clone(&rate_limiter);
         tokio::spawn(async move {
-            use std::time::Duration;
-            let mut interval = tokio::time::interval(Duration::from_secs(300)); // 5 min
+            let mut interval = tokio::time::interval(RATE_LIMITER_CLEANUP_INTERVAL);
             loop {
                 interval.tick().await;
-                rate_limiter_clone.cleanup();
+                cleaned.cleanup();
                 tracing::debug!("Rate limiter cleanup completed");
             }
         });
@@ -242,9 +209,9 @@ impl AppState {
                 db,
                 cache,
                 adapter_registry: Some(adapter_registry),
-                embedding_service: Some(embedding_service),
-                context_service: Some(context_service),
-                email_service,
+                embedding_service,
+                context_service,
+                mail,
                 rate_limiter,
                 sync_registry: SyncRegistry::new(),
                 pull_registry: PullRegistry::new(),
@@ -294,9 +261,9 @@ impl AppState {
         &self.inner.encryption_key
     }
 
-    /// Get the email service (if available)
-    pub fn email_service(&self) -> Option<&Arc<EmailService>> {
-        self.inner.email_service.as_ref()
+    /// The account mail sender, when an SMTP relay is configured.
+    pub fn mail(&self) -> Option<&Arc<AccountMail>> {
+        self.inner.mail.as_ref()
     }
 
     /// Get the rate limiter
@@ -427,10 +394,10 @@ pub(crate) fn test_config() -> Config {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use abnegate_notify::MockMailer;
     use std::path::PathBuf;
     use zone_context::embeddings::providers::MockEmbeddingService;
     use zone_core::llm::AgentKind;
-    use zone_email::EmailConfig;
 
     #[test]
     fn a_test_config_reads_agent_usage_only_from_loopback() {
@@ -606,7 +573,7 @@ mod tests {
         assert!(Arc::ptr_eq(state.adapter_registry().unwrap(), &registry));
         assert!(Arc::ptr_eq(state.embedding_service().unwrap(), &embedding));
         assert!(Arc::ptr_eq(state.context_service().unwrap(), &context));
-        assert!(state.email_service().is_none());
+        assert!(state.mail().is_none());
         assert_eq!(
             state.index_semaphore().available_permits(),
             MAX_CONCURRENT_INDEX
@@ -632,29 +599,33 @@ mod tests {
             state.existing_mcp().unwrap()
         ));
 
-        let email = Arc::new(
-            EmailService::new(EmailConfig {
-                smtp_host: "localhost".to_string(),
-                smtp_port: 2525,
-                smtp_user: "zone".to_string(),
-                smtp_password: "secret".to_string(),
-                from_email: "zone@example.com".to_string(),
-                from_name: "Zone".to_string(),
-            })
-            .expect("valid SMTP settings"),
-        );
-        let with_email = AppState::new_with_all_services(
+        let mail = Arc::new(AccountMail::new(Arc::new(MockMailer::new())));
+        let with_mail = AppState::new_with_all_services(
             config,
             pool,
             None,
             registry,
             embedding,
             context,
-            Some(email.clone()),
+            Some(mail.clone()),
         );
-        assert!(Arc::ptr_eq(with_email.email_service().unwrap(), &email));
-        assert_eq!(with_email.train_semaphore().available_permits(), 1);
-        assert_eq!(with_email.frame_semaphore().available_permits(), 4);
+        assert!(Arc::ptr_eq(with_mail.mail().unwrap(), &mail));
+        assert_eq!(with_mail.train_semaphore().available_permits(), 1);
+        assert_eq!(with_mail.frame_semaphore().available_permits(), 4);
+    }
+
+    #[tokio::test]
+    async fn the_state_without_embedding_still_carries_mail() {
+        let pool = PgPool::connect_lazy("postgres://localhost/state-fallback")
+            .expect("a lazy pool needs no server");
+        let mail = Arc::new(AccountMail::new(Arc::new(MockMailer::new())));
+
+        let state = AppState::new_with_mail(create_test_config(), pool, None, Some(mail.clone()));
+
+        assert!(state.embedding_service().is_none());
+        assert!(state.context_service().is_none());
+        assert!(state.adapter_registry().is_some());
+        assert!(Arc::ptr_eq(state.mail().unwrap(), &mail));
     }
 
     #[tokio::test]
diff --git a/runner/zone_server/src/workers/auto_project/driver.rs b/runner/zone_server/src/workers/auto_project/driver.rs
index afd1e975..9128717d 100644
--- a/runner/zone_server/src/workers/auto_project/driver.rs
+++ b/runner/zone_server/src/workers/auto_project/driver.rs
@@ -4,8 +4,10 @@
 use std::collections::HashSet;
 use std::sync::Arc;
 
+use abnegate_notify::Fanout;
+use abnegate_notify::Notification;
+use abnegate_notify::Notifier;
 use uuid::Uuid;
-use zone_notify::{Fanout, Notification, Notifier};
 
 use crate::config::AutoProjectConfig;
 use crate::db::auto_projects::{self, Kind, ProjectAutomation, SettledRun, Stage, TaskAutomation};
diff --git a/runner/zone_server/src/workers/auto_project/mod.rs b/runner/zone_server/src/workers/auto_project/mod.rs
index b6e6cdf8..4a009c3e 100644
--- a/runner/zone_server/src/workers/auto_project/mod.rs
+++ b/runner/zone_server/src/workers/auto_project/mod.rs
@@ -17,10 +17,10 @@ pub mod summary;
 use std::sync::Arc;
 use std::time::Duration;
 
+use abnegate_notify::Notifier;
 use dashmap::DashMap;
 use tokio::sync::Notify;
 use uuid::Uuid;
-use zone_notify::Notifier;
 use zone_vcs::conflict::ConflictService;
 use zone_vcs::pull_request::PrService;
 
diff --git a/runner/zone_server/src/workers/auto_project/notification.rs b/runner/zone_server/src/workers/auto_project/notification.rs
index 75c5c40a..6eaf1612 100644
--- a/runner/zone_server/src/workers/auto_project/notification.rs
+++ b/runner/zone_server/src/workers/auto_project/notification.rs
@@ -8,7 +8,8 @@
 
 use std::fmt::Write as _;
 
-use zone_notify::{Notification, Severity};
+use abnegate_notify::Notification;
+use abnegate_notify::Severity;
 
 /// Everything the merge notice draws on.
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
diff --git a/runner/zone_server/src/workers/housekeeping/mod.rs b/runner/zone_server/src/workers/housekeeping/mod.rs
index 285a2f76..bd054870 100644
--- a/runner/zone_server/src/workers/housekeeping/mod.rs
+++ b/runner/zone_server/src/workers/housekeeping/mod.rs
@@ -21,7 +21,7 @@
 //! - **Error isolation.** Every sweep is its own [`tokio::task`] in a
 //!   [`tokio::task::JoinSet`]. A failure is a `Result` the loop logs; a panic is
 //!   a `JoinError` mapped back to its job through the task id, the way
-//!   [`zone_notify::Fanout`] maps a panicking channel back to its notifier.
+//!   [`abnegate_notify::Fanout`] maps a panicking channel back to its notifier.
 //!   Neither reaches the loop's own stack, and neither costs a sibling its turn.
 //!
 //! # What did not move
diff --git a/runner/zone_server/src/workers/housekeeping/periodic.rs b/runner/zone_server/src/workers/housekeeping/periodic.rs
index e4086bfb..2f8fb519 100644
--- a/runner/zone_server/src/workers/housekeeping/periodic.rs
+++ b/runner/zone_server/src/workers/housekeeping/periodic.rs
@@ -12,8 +12,8 @@
 use std::sync::Arc;
 use std::time::Duration;
 
+use abnegate_notify::Fanout;
 use tokio::sync::Mutex;
-use zone_notify::Fanout;
 
 use super::catchup::Catchup;
 use super::job::Failure;
diff --git a/runner/zone_server/src/workers/housekeeping/worker.rs b/runner/zone_server/src/workers/housekeeping/worker.rs
index 06154371..673aa02f 100644
--- a/runner/zone_server/src/workers/housekeeping/worker.rs
+++ b/runner/zone_server/src/workers/housekeeping/worker.rs
@@ -36,7 +36,7 @@ struct Dispatch {
 /// worker unkillable by the work it runs: a sweep that fails is a `Result` the
 /// loop logs, a sweep that panics is a [`tokio::task::JoinError`] the loop maps
 /// back to its job through the task id, and neither reaches the loop's own
-/// stack. This is the same arrangement [`zone_notify::Fanout`] uses to keep one
+/// stack. This is the same arrangement [`abnegate_notify::Fanout`] uses to keep one
 /// broken webhook from costing a notification its other channels.
 pub struct Worker {
     registry: Registry,
diff --git a/runner/zone_server/src/workers/notify.rs b/runner/zone_server/src/workers/notify.rs
index 8c3ae3e8..db725c21 100644
--- a/runner/zone_server/src/workers/notify.rs
+++ b/runner/zone_server/src/workers/notify.rs
@@ -12,23 +12,22 @@
 use std::sync::Arc;
 use std::time::Duration;
 
-use abnegate_secret::SecretValue;
-use zone_notify::{Discord, Email, Fanout, Notifier, NotifyError, Slack, SmtpConfig};
+use abnegate_notify::Channel;
+use abnegate_notify::Discord;
+use abnegate_notify::Email;
+use abnegate_notify::Fanout;
+use abnegate_notify::Notification;
+use abnegate_notify::Notifier;
+use abnegate_notify::Slack;
+
+use crate::services::mail;
 
 const SLACK_VARIABLE: &str = "ZONE_NOTIFY_SLACK_WEBHOOK";
 const DISCORD_VARIABLE: &str = "ZONE_NOTIFY_DISCORD_WEBHOOK";
 const EMAIL_TO_VARIABLE: &str = "ZONE_NOTIFY_EMAIL_TO";
 const TIMEOUT_VARIABLE: &str = "ZONE_NOTIFY_TIMEOUT_SECONDS";
 
-const SMTP_HOST_VARIABLE: &str = "SMTP_HOST";
-const SMTP_PORT_VARIABLE: &str = "SMTP_PORT";
-const SMTP_USER_VARIABLE: &str = "SMTP_USER";
-const SMTP_PASSWORD_VARIABLE: &str = "SMTP_PASSWORD";
-const SMTP_FROM_VARIABLE: &str = "SMTP_FROM";
-const SMTP_FROM_NAME_VARIABLE: &str = "SMTP_FROM_NAME";
-
-const DEFAULT_SMTP_PORT: u16 = 587;
-const DEFAULT_FROM_NAME: &str = "Zone";
+const DISCORD_FOOTER: &str = "Zone";
 const DEFAULT_TIMEOUT_SECONDS: u64 = 10;
 const MAXIMUM_TIMEOUT_SECONDS: u64 = 120;
 
@@ -54,12 +53,12 @@ impl NotifyEnvironment {
             discord_webhook: std::env::var(DISCORD_VARIABLE).ok(),
             email_recipients: std::env::var(EMAIL_TO_VARIABLE).ok(),
             timeout_seconds: std::env::var(TIMEOUT_VARIABLE).ok(),
-            smtp_host: std::env::var(SMTP_HOST_VARIABLE).ok(),
-            smtp_port: std::env::var(SMTP_PORT_VARIABLE).ok(),
-            smtp_user: std::env::var(SMTP_USER_VARIABLE).ok(),
-            smtp_password: std::env::var(SMTP_PASSWORD_VARIABLE).ok(),
-            smtp_from: std::env::var(SMTP_FROM_VARIABLE).ok(),
-            smtp_from_name: std::env::var(SMTP_FROM_NAME_VARIABLE).ok(),
+            smtp_host: mail::Variable::Host.read(),
+            smtp_port: mail::Variable::Port.read(),
+            smtp_user: mail::Variable::User.read(),
+            smtp_password: mail::Variable::Password.read(),
+            smtp_from: mail::Variable::From.read(),
+            smtp_from_name: mail::Variable::FromName.read(),
         }
     }
 }
@@ -128,31 +127,23 @@ fn timeout(raw: Option<&str>) -> Duration {
         .unwrap_or(Duration::from_secs(DEFAULT_TIMEOUT_SECONDS))
 }
 
-fn smtp(environment: &NotifyEnvironment) -> Option<SmtpConfig> {
-    Some(SmtpConfig {
-        host: trimmed(environment.smtp_host.as_deref())?,
-        port: environment
-            .smtp_port
-            .as_deref()
-            .and_then(|value| match value.trim().parse() {
-                Ok(port) => Some(port),
-                Err(_) => {
-                    tracing::warn!(
-                        value,
-                        default = DEFAULT_SMTP_PORT,
-                        "SMTP_PORT could not be read; every send will fail against the default \
-                         port and retry forever with no log naming the cause"
-                    );
-                    None
-                }
-            })
-            .unwrap_or(DEFAULT_SMTP_PORT),
-        user: trimmed(environment.smtp_user.as_deref())?,
-        password: SecretValue::new(environment.smtp_password.clone()?),
-        from_address: trimmed(environment.smtp_from.as_deref())?,
-        from_name: trimmed(environment.smtp_from_name.as_deref())
-            .unwrap_or_else(|| DEFAULT_FROM_NAME.to_string()),
-    })
+/// The relay email notices go through: the one account mail reads, except
+/// that a notice needs `SMTP_FROM` rather than falling back to a default.
+fn relay(environment: &NotifyEnvironment) -> Result<mail::Config, mail::Error> {
+    mail::Config::from_variables(
+        |variable| {
+            match variable {
+                mail::Variable::Host => &environment.smtp_host,
+                mail::Variable::Port => &environment.smtp_port,
+                mail::Variable::User => &environment.smtp_user,
+                mail::Variable::Password => &environment.smtp_password,
+                mail::Variable::From => &environment.smtp_from,
+                mail::Variable::FromName => &environment.smtp_from_name,
+            }
+            .clone()
+        },
+        mail::SenderPolicy::Required,
+    )
 }
 
 /// The channels these settings describe, each already validated.
@@ -161,43 +152,45 @@ fn smtp(environment: &NotifyEnvironment) -> Option<SmtpConfig> {
 /// the build: one malformed webhook should cost that channel, not every other
 /// one configured beside it.
 ///
-/// Call this from inside the tokio runtime. The email backend builds a pooled
-/// SMTP transport, which needs a reactor to attach its timers to and panics
-/// without one.
+/// Slack and Discord are given the fan-out's budget for their own requests
+/// too, so a timeout above the crate's default is not cut short by the client.
 pub fn channels(environment: &NotifyEnvironment) -> Vec<Arc<dyn Notifier>> {
     let settings = NotifySettings::resolve(environment);
     let mut channels: Vec<Arc<dyn Notifier>> = Vec::new();
 
     if let Some(webhook) = &settings.slack_webhook {
         match Slack::new(webhook) {
-            Ok(slack) => channels.push(Arc::new(slack)),
+            Ok(slack) => channels.push(Arc::new(slack.timeout(settings.timeout))),
             Err(error) => tracing::warn!(%error, "Slack notification channel is misconfigured"),
         }
     }
 
     if let Some(webhook) = &settings.discord_webhook {
         match Discord::new(webhook) {
-            Ok(discord) => channels.push(Arc::new(discord)),
+            Ok(discord) => channels.push(Arc::new(
+                discord.footer(DISCORD_FOOTER).timeout(settings.timeout),
+            )),
             Err(error) => tracing::warn!(%error, "Discord notification channel is misconfigured"),
         }
     }
 
     if !settings.email_recipients.is_empty() {
-        match smtp(environment) {
-            Some(config) => {
+        match relay(environment) {
+            Ok(config) => {
                 let addresses: Vec<&str> = settings
                     .email_recipients
                     .iter()
                     .map(String::as_str)
                     .collect();
-                match Email::new(config, &addresses) {
+                match Email::new(config.relay(), &addresses) {
                     Ok(email) => channels.push(Arc::new(email)),
                     Err(error) => {
                         tracing::warn!(%error, "Email notification channel is misconfigured")
                     }
                 }
             }
-            None => tracing::warn!(
+            Err(error) => tracing::warn!(
+                %error,
                 "Email recipients are configured but the SMTP relay is not; skipping email"
             ),
         }
@@ -254,16 +247,13 @@ impl ChatNotifier {
 #[async_trait::async_trait]
 impl Notifier for ChatNotifier {
     /// The custom `chat` channel.
-    fn channel(&self) -> zone_notify::Channel {
-        zone_notify::Channel::custom("chat")
+    fn channel(&self) -> Channel {
+        Channel::custom("chat")
     }
 
     /// Insert the notification as an assistant message and publish it to the open chat.
-    async fn deliver(&self, notification: &zone_notify::Notification) -> Result<(), NotifyError> {
-        let failed = |error: sqlx::Error| NotifyError::Unreachable {
-            host: "database".to_string(),
-            message: error.to_string(),
-        };
+    async fn deliver(&self, notification: &Notification) -> Result<(), abnegate_notify::Error> {
+        let failed = |error: sqlx::Error| abnegate_notify::Error::unreachable("database", error);
         let mut transaction = self.pool.begin().await.map_err(failed)?;
         let stored: serde_json::Value = sqlx::query_scalar(
             "INSERT INTO messages (chat_id, role, content, metadata) VALUES ($1, 'assistant', $2, $3) \
@@ -370,6 +360,26 @@ mod tests {
         assert_eq!(built.len(), 1, "Discord still registered");
     }
 
+    #[test]
+    fn webhook_channels_are_given_the_configured_budget() {
+        let built = channels(&NotifyEnvironment {
+            slack_webhook: Some("https://hooks.slack.com/services/T/B/x".to_string()),
+            discord_webhook: Some("https://discord.com/api/webhooks/1/token".to_string()),
+            timeout_seconds: Some("45".to_string()),
+            ..NotifyEnvironment::default()
+        });
+
+        assert_eq!(built.len(), 2);
+        for channel in built {
+            assert_eq!(
+                channel.timeout(),
+                Some(Duration::from_secs(45)),
+                "{}",
+                channel.channel()
+            );
+        }
+    }
+
     #[test]
     fn a_webhook_pointing_somewhere_else_is_refused() {
         let built = fanout(&NotifyEnvironment {
@@ -387,30 +397,95 @@ mod tests {
         assert!(built.is_empty());
     }
 
-    #[tokio::test]
-    async fn a_complete_relay_registers_the_email_channel() {
-        let built = fanout(&NotifyEnvironment {
+    #[test]
+    fn a_complete_relay_registers_the_email_channel_without_a_runtime() {
+        let built = fanout(&relay_environment());
+
+        assert_eq!(built.len(), 1);
+    }
+
+    fn relay_environment() -> NotifyEnvironment {
+        NotifyEnvironment {
             email_recipients: Some("alerts@zone.test".to_string()),
             smtp_host: Some("smtp.zone.test".to_string()),
             smtp_user: Some("zone".to_string()),
             smtp_password: Some("secret".to_string()),
             smtp_from: Some("noreply@zone.test".to_string()),
             ..NotifyEnvironment::default()
-        });
-
-        assert_eq!(built.len(), 1);
+        }
     }
 
     #[test]
     fn a_relay_missing_its_sender_leaves_email_out() {
-        assert!(
-            smtp(&NotifyEnvironment {
-                smtp_host: Some("smtp.zone.test".to_string()),
-                smtp_user: Some("zone".to_string()),
-                smtp_password: Some("secret".to_string()),
-                ..NotifyEnvironment::default()
-            })
-            .is_none()
+        for smtp_from in [None, Some("   ".to_string())] {
+            let environment = NotifyEnvironment {
+                smtp_from: smtp_from.clone(),
+                ..relay_environment()
+            };
+
+            assert!(
+                matches!(
+                    relay(&environment),
+                    Err(mail::Error::Missing(mail::Variable::From))
+                ),
+                "{smtp_from:?}"
+            );
+            assert!(fanout(&environment).is_empty(), "{smtp_from:?}");
+        }
+    }
+
+    #[test]
+    fn a_blank_host_leaves_email_out_and_is_named() {
+        let environment = NotifyEnvironment {
+            smtp_host: Some(String::new()),
+            ..relay_environment()
+        };
+
+        assert!(matches!(
+            relay(&environment),
+            Err(mail::Error::Missing(mail::Variable::Host))
+        ));
+        assert!(fanout(&environment).is_empty());
+    }
+
+    #[test]
+    fn an_unreadable_port_falls_back_to_the_default_and_keeps_email() {
+        let environment = NotifyEnvironment {
+            smtp_port: Some("submission".to_string()),
+            ..relay_environment()
+        };
+
+        assert_eq!(
+            relay(&environment).expect("configured").relay().port,
+            mail::DEFAULT_PORT
+        );
+        assert_eq!(fanout(&environment).len(), 1);
+    }
+
+    #[test]
+    fn a_blank_password_still_registers_email() {
+        let environment = NotifyEnvironment {
+            smtp_password: Some(String::new()),
+            ..relay_environment()
+        };
+
+        assert_eq!(fanout(&environment).len(), 1);
+    }
+
+    #[test]
+    fn a_padded_relay_is_trimmed_and_a_blank_sender_name_falls_back() {
+        let environment = NotifyEnvironment {
+            smtp_port: Some(" 2525 ".to_string()),
+            smtp_from_name: Some(" ".to_string()),
+            ..relay_environment()
+        };
+        let relay = relay(&environment).expect("configured");
+
+        assert_eq!(relay.relay().host, "smtp.zone.test");
+        assert_eq!(relay.relay().port, 2525);
+        assert_eq!(
+            relay.relay().sender,
+            abnegate_notify::Sender::new("noreply@zone.test").with_name("Zone")
         );
     }
 }
diff --git a/runner/zone_server/src/workers/regression/worker.rs b/runner/zone_server/src/workers/regression/worker.rs
index 6a5e27ff..6167f5bb 100644
--- a/runner/zone_server/src/workers/regression/worker.rs
+++ b/runner/zone_server/src/workers/regression/worker.rs
@@ -25,7 +25,9 @@ use crate::state::AppState;
 use crate::workers::analytics::{AgentRun, TimeWindow, load_runs};
 use crate::workers::learning::attempt::AttemptOutcome;
 use crate::workers::learning::error_category::ErrorCategory;
-use zone_notify::{Fanout, Notification, Severity};
+use abnegate_notify::Fanout;
+use abnegate_notify::Notification;
+use abnegate_notify::Severity;
 
 pub const REGRESSION_INTERVAL_SECONDS: u64 = 60 * 60;
 const MAXIMUM_TASKS_PER_WORKSPACE: i64 = 500;
diff --git a/runner/zone_server/src/workers/reports.rs b/runner/zone_server/src/workers/reports.rs
index 8da0a9ed..8ed5fea9 100644
--- a/runner/zone_server/src/workers/reports.rs
+++ b/runner/zone_server/src/workers/reports.rs
@@ -16,7 +16,7 @@
 //! the window to keep it tidy would drop the days nobody saw.
 //!
 //! **A dead channel is not a failed report.** Delivery goes through
-//! [`zone_notify::Fanout`], which returns a report rather than a result, so a
+//! [`abnegate_notify::Fanout`], which returns a report rather than a result, so a
 //! workspace with a stale Discord webhook still gets its digest on Slack and the
 //! slot is recorded rather than retried into a duplicate.
 //!
diff --git a/runner/zone_server/src/workers/reports/digest.rs b/runner/zone_server/src/workers/reports/digest.rs
index 820963b3..6c53fa09 100644
--- a/runner/zone_server/src/workers/reports/digest.rs
+++ b/runner/zone_server/src/workers/reports/digest.rs
@@ -11,8 +11,9 @@
 
 use std::fmt::Write;
 
+use abnegate_notify::Notification;
+use abnegate_notify::Severity;
 use chrono::NaiveDateTime;
-use zone_notify::{Notification, Severity};
 
 use crate::workers::analytics::{
     AgentAnalytics, SeriesPoint, TimePeriod, TimeWindow, TrendDirection,
diff --git a/runner/zone_server/src/workers/reports/worker.rs b/runner/zone_server/src/workers/reports/worker.rs
index 231db4a1..5545458d 100644
--- a/runner/zone_server/src/workers/reports/worker.rs
+++ b/runner/zone_server/src/workers/reports/worker.rs
@@ -1,6 +1,6 @@
 //! The pass that builds a digest and hands it to every channel.
 //!
-//! Delivery goes through [`zone_notify::Fanout`], which returns a report rather
+//! Delivery goes through [`abnegate_notify::Fanout`], which returns a report rather
 //! than a result. That matters here: a workspace with a stale Discord webhook
 //! and a working Slack should get its digest on Slack, and the run should be
 //! recorded as delivered rather than retried into a duplicate.
@@ -14,10 +14,11 @@ use std::collections::BTreeMap;
 use std::str::FromStr;
 use std::sync::Arc;
 
+use abnegate_notify::Fanout;
+use abnegate_notify::Report;
 use chrono::{NaiveDateTime, Utc, Weekday};
 use sqlx::PgPool;
 use uuid::Uuid;
-use zone_notify::{Fanout, Report};
 
 use super::digest::{Digest, generate};
 use super::schedule::{Cadence, Due, Schedule, due};
@@ -337,8 +338,11 @@ pub fn announce(settings: &ReportSettings, fanout: &Fanout) {
 mod tests {
     use super::super::digest::fixtures::{digest, moment};
     use super::*;
+    use abnegate_notify::Channel;
+    use abnegate_notify::Error;
+    use abnegate_notify::Notification;
+    use abnegate_notify::Notifier;
     use std::sync::Mutex;
-    use zone_notify::{Channel, Notification, Notifier, NotifyError};
 
     fn environment(cadence: &str, hour: &str) -> ReportEnvironment {
         ReportEnvironment {
@@ -431,7 +435,7 @@ mod tests {
 
     struct Recorder {
         channel: Channel,
-        failure: Option<NotifyError>,
+        failure: Option<Error>,
         seen: Arc<Mutex<Vec<String>>>,
     }
 
@@ -447,11 +451,7 @@ mod tests {
         fn broken(channel: Channel, seen: Arc<Mutex<Vec<String>>>) -> Self {
             Self {
                 channel,
-                failure: Some(NotifyError::Rejected {
-                    host: "hooks.zone.test".to_string(),
-                    status: 404,
-                    body: "Unknown Webhook".to_string(),
-                }),
+                failure: Some(Error::rejected("hooks.zone.test", 404, "Unknown Webhook")),
                 seen,
             }
         }
@@ -463,7 +463,7 @@ mod tests {
             self.channel.clone()
         }
 
-        async fn deliver(&self, notification: &Notification) -> Result<(), NotifyError> {
+        async fn deliver(&self, notification: &Notification) -> Result<(), Error> {
             match &self.failure {
                 Some(error) => Err(error.clone()),
                 None => {
diff --git a/runner/zone_server/src/ws/chat.rs b/runner/zone_server/src/ws/chat.rs
index 70cc1d5d..df188670 100644
--- a/runner/zone_server/src/ws/chat.rs
+++ b/runner/zone_server/src/ws/chat.rs
@@ -388,7 +388,7 @@ enum Routing {
     Video(crate::config::ComfyUiConfig),
     Audio(crate::config::ComfyUiConfig),
     Upscale(crate::config::ComfyUiConfig),
-    Chat(chats::ChatRow, Route),
+    Chat(chats::ChatRow, Box<Route>),
 }
 
 /// What a provider reported when a turn failed, remedied for a coding agent's
@@ -2495,7 +2495,7 @@ async fn handle_send_message(
                         return Ok(());
                     }
                     _ = session.guard.lost() => { return Err(OWNERSHIP_LOST.into()); }
-                    result = prepare_chat(state, stream, chat_id, workspace_id, user_id, content, metadata.as_ref(), chat, route, web_search_requested) => result?,
+                    result = prepare_chat(state, stream, chat_id, workspace_id, user_id, content, metadata.as_ref(), chat, *route, web_search_requested) => result?,
                 };
                 handle_chat_generation(state, stream, chat_id, workspace_id, user_id, preparation, &mut request, &mut session, &mut jobs).await
             }
@@ -2666,7 +2666,9 @@ async fn prepare_message(
         }
         crate::services::image_intent::GenerationIntent::Audio => Routing::Audio(image_config),
         crate::services::image_intent::GenerationIntent::Upscale => Routing::Upscale(image_config),
-        crate::services::image_intent::GenerationIntent::Chat => Routing::Chat(chat, route),
+        crate::services::image_intent::GenerationIntent::Chat => {
+            Routing::Chat(chat, Box::new(route))
+        }
     })
 }
 
@@ -4569,7 +4571,7 @@ mod tests {
                 QUESTION,
                 None,
                 chat,
-                route,
+                *route,
                 false,
             )
             .await
diff --git a/runner/zone_server/tests/auth_console_contract_tests.rs b/runner/zone_server/tests/auth_console_contract_tests.rs
index 8803ed89..729beebd 100644
--- a/runner/zone_server/tests/auth_console_contract_tests.rs
+++ b/runner/zone_server/tests/auth_console_contract_tests.rs
@@ -6,12 +6,21 @@
 
 mod common;
 
+use std::sync::Arc;
+use std::time::Duration;
+
 use axum::http::StatusCode;
 use serde_json::{Value, json};
 use uuid::Uuid;
 
+use common::mail::Silent;
 use common::{TestClient, test_email, test_password};
 use zone_server::db::{email_verification, password_reset};
+use zone_server::services::mail::AccountMail;
+
+/// Far longer than a handler takes without mail, far shorter than a stalled
+/// relay holds a send open.
+const ANSWER_DEADLINE: Duration = Duration::from_secs(10);
 
 struct Login {
     access: String,
@@ -115,6 +124,27 @@ async fn every_auth_outcome_carries_a_success_flag() {
     assert!(body["message"].is_string(), "{body}");
 }
 
+/// A known address must be answered as soon as an unknown one, so neither
+/// endpoint may wait on the relay before it responds.
+#[tokio::test]
+async fn a_known_address_is_answered_without_waiting_on_the_relay() {
+    let client = TestClient::with_mail(Arc::new(AccountMail::new(Arc::new(Silent)))).await;
+    let email = test_email();
+    register(&client, &email).await;
+
+    for path in ["/api/auth/resend-verification", "/api/auth/forgot-password"] {
+        let response = tokio::time::timeout(
+            ANSWER_DEADLINE,
+            client.post_json(path, &json!({ "email": email })),
+        )
+        .await
+        .unwrap_or_else(|_| panic!("{path} waited on a relay that never answers"));
+
+        response.assert_status(StatusCode::OK);
+        assert_eq!(response.json_value()["success"], json!(true), "{path}");
+    }
+}
+
 #[tokio::test]
 async fn the_sessions_listing_names_the_user_and_the_current_session() {
     let client = TestClient::with_db().await;
diff --git a/runner/zone_server/tests/common/mail.rs b/runner/zone_server/tests/common/mail.rs
new file mode 100644
index 00000000..3972679d
--- /dev/null
+++ b/runner/zone_server/tests/common/mail.rs
@@ -0,0 +1,16 @@
+//! Account mail for a test that must not wait on a relay.
+
+use abnegate_notify::Error;
+use abnegate_notify::Mail;
+use async_trait::async_trait;
+
+/// A relay that accepts the connection and never answers, as a stalled one
+/// does until the client's own timeout gives up on it.
+pub struct Silent;
+
+#[async_trait]
+impl Mail for Silent {
+    async fn send(&self, _recipient: &str, _subject: &str, _body: &str) -> Result<(), Error> {
+        std::future::pending().await
+    }
+}
diff --git a/runner/zone_server/tests/common/mod.rs b/runner/zone_server/tests/common/mod.rs
index 6a0fa70e..7d35b2ee 100644
--- a/runner/zone_server/tests/common/mod.rs
+++ b/runner/zone_server/tests/common/mod.rs
@@ -6,6 +6,7 @@
 #![allow(dead_code)]
 
 pub mod context;
+pub mod mail;
 pub mod transcript;
 
 use axum::Router;
@@ -26,6 +27,7 @@ use zone_context::embeddings::EmbeddingService;
 use zone_server::config::AgentConfig;
 use zone_server::config::Config;
 use zone_server::routes::create_router;
+use zone_server::services::mail::AccountMail;
 use zone_server::state::AppState;
 
 /// Send server tracing to the test's stdout. Without this the server's own
@@ -163,6 +165,18 @@ impl TestClient {
         }
     }
 
+    /// Create a test client whose state sends account mail through `mail`.
+    pub async fn with_mail(mail: Arc<AccountMail>) -> Self {
+        let pool = create_test_pool().await;
+        let state = AppState::new_with_mail(test_config(), pool, None, Some(mail));
+        state.disable_mcp();
+        let router = create_test_router(state.clone());
+        Self {
+            router,
+            state: Some(state),
+        }
+    }
+
     /// Create a test client whose state embeds through the given service, for
     /// a test that has to see what the routes do when embedding fails.
     pub async fn with_embedding(embedding: Arc<dyn EmbeddingService>) -> Self {