fix(mail): deliver account mail over STARTTLS through abnegate-notify

.env.example

@@ -283,8 +283,11 @@ ZONE_MCP_AUTO_MAGENTS=true
 # ZONE_NOTIFY_DISCORD_WEBHOOK=https://discord.com/api/webhooks/...
 # ZONE_NOTIFY_EMAIL_TO=alerts@example.com,ops@example.com
 # ZONE_NOTIFY_TIMEOUT_SECONDS=10
-# SMTP_* - The relay ZONE_NOTIFY_EMAIL_TO, sign-up verification, password
-# resets and invitations send through. ALERT_SMTP_* below is Grafana's own.
+# SMTP_* - The relay ZONE_NOTIFY_EMAIL_TO, sign-up verification and password
+# resets send through. Port 465 connects with implicit TLS; any other port,
+# 587 included, upgrades with STARTTLS before signing in. A blank value other
+# than SMTP_PASSWORD counts as unset, and an unreadable SMTP_PORT falls back
+# to 587. ALERT_SMTP_* below is Grafana's own.
 # SMTP_HOST=smtp.example.com
 # SMTP_PORT=587
 # SMTP_USER=

README.md

@@ -433,7 +433,6 @@ zone/
 │   │   ├── src/video.rs     # Training frames pulled out of a submitted clip
 │   │   ├── src/subject.rs   # Subject-aware framing for training crops
 │   │   └── src/caption.rs   # Vision captioning for training sets
-│   ├── zone_email/          # Transactional email over SMTP
 │   ├── zone_search/         # SearXNG web search client
 │   ├── zone_vcs/            # Local git operations and GitHub pull requests
 │   ├── zone_vision/         # Subject detection and subject-aware cropping

docs/CONFIGURATION.md

@@ -1841,8 +1841,8 @@ Every notice — an auto-project merge, pause or completion, a regression alert,
 - **Description**: How long one channel is given per notice.
 
 ### `SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_FROM`, `SMTP_FROM_NAME`
-- **Default**: *empty* (`SMTP_PORT` 587, `SMTP_FROM_NAME` Zone)
-- **Description**: The relay notices, sign-up verification, password resets and invitations send through. `ALERT_SMTP_*` is Grafana's relay and is separate.
+- **Default**: *empty* (`SMTP_PORT` 587, `SMTP_FROM_NAME` Zone; a blank value other than `SMTP_PASSWORD` counts as unset and an unreadable `SMTP_PORT` falls back to 587; sign-up and reset mail falls back to `noreply@zone.app` when `SMTP_FROM` is unset, email notices need it set)
+- **Description**: The relay notices, sign-up verification and password resets send through. Port 465 connects with implicit TLS; any other port, 587 included, must upgrade with STARTTLS before signing in. `ALERT_SMTP_*` is Grafana's relay and is separate.
 
 ---
 

docs/DEPLOY.md

@@ -58,7 +58,7 @@ Verified on `main` (`d3fb7cf`). Reuse is the default; each row says whether it's
 | MQTT broker | `~/Local/mqtt` (Swoole) | OTA substrate for `ota_fleet` |
 | Appwrite | Sites, Functions, Storage, Messaging | Delivery targets + backend provisioning (v1.5) |
 | Charts, cluster | `helm/zone-apps` (`_helpers.tpl` conventions, security contexts, HPA/PDB/NetworkPolicy), `k8s/kind-config.yaml` (`zone-dev`, ports 30000-30002 pre-mapped, CNPG, HAProxy default IngressClass) | New `helm/zone-app` copies conventions; kind is the first k8s target |
-| Notifications | None in the server. `ALERT_DISCORD_WEBHOOK_URL` is consumed only by Grafana (`grafana/entrypoint.sh`); `zone_email::EmailService` has three templated senders; reminders deliver as assistant messages into a chat (`db/reminders.rs:61-90`) | New `notify` module |
+| Notifications | None in the server. `ALERT_DISCORD_WEBHOOK_URL` is consumed only by Grafana (`grafana/entrypoint.sh`); `services::mail::AccountMail` sends two templated account messages (abnegate-notify `Mailer`); reminders deliver as assistant messages into a chat (`db/reminders.rs:61-90`) | New `notify` module |
 
 **Gaps that block the feature (phase 0):**
 
@@ -639,7 +639,7 @@ Stated tradeoff: while blocked, a task holds one of `MAX_CONCURRENT_TASKS = 5` p
 `Notifier` trait with three channels, fanned out with `join_all`, failures logged and never blocking the deployment:
 
 - `DiscordWebhook` — an embed with app, target, artifact kind, digest, requester, values digest, and a deep link to `/deployments?id=…` (the desktop/mobile shell opens it too). Webhook URL from the target's `notify` block, falling back to a server-level `ALERT_DISCORD_WEBHOOK_URL` that `config.rs` now reads as well as Grafana. Webhooks are one-way; one-tap approve from Discord needs bot interactions and is a later phase.
-- `Email` — new `zone_email::send_approval_request`.
+- `Email` — a new approval-request `services::mail::Template`, sent through `AccountMail`.
 - `InApp` — an assistant message into the originating chat, the reminders pattern (`db/reminders.rs:61-90`).
 
 ### 7.6 Agent tools — `runner/zone_server/src/agent/deploy.rs`

docs/SYSTEM-PROMPT-RESEARCH.md

@@ -251,7 +251,7 @@ SOL 707-734 is a complete contract: the schedule is an iCal `VEVENT` with `RRULE
 CC 1688-1820 (Monitor: each stdout line is an event; "silence is not success" at 1738-1748 with a wrong-and-right grep example; a `gh pr checks` poller at 1717-1726; 200 ms batching; auto-stop on flood). CC 888 (a background command re-invokes the loop on exit; foreground sleep is blocked). CC 2107-2162 (self-paced wakeups sized to what is being waited for; `noop` ticks collapsed in the UI). Zone's `tail_task_log`, `get_task_run` and `get_build_status` force the model to poll and spend rounds. Build: `wait_for(target, timeout)` covering task-run completion, GitHub check completion and background job exit, implemented server-side, suspending the loop without consuming an iteration.
 
 **I3. Notification cost rule. P0 when a notify tool is exposed.**
-CC 1875-1906: err toward not sending; one line under 200 characters; lead with what the user would act on; skip when the user is present. `zone_notify` exists; apply when it becomes a tool.
+CC 1875-1906: err toward not sending; one line under 200 characters; lead with what the user would act on; skip when the user is present. `workers::notify` (abnegate-notify) exists; apply when it becomes a tool.
 
 ### 2.10 Git and task specifics
 

runner/Cargo.toml

@@ -1,7 +1,7 @@
 [workspace]
 resolver = "2"
-members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_email", "zone_notify", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision", "zone_desktop"]
-default-members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_email", "zone_notify", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision"]
+members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision", "zone_desktop"]
+default-members = ["zone_runner", "zone_core", "zone_chat", "zone_comfy", "zone_search", "zone_vcs", "zone_server", "zone_cli", "zone_installer", "zone_context", "zone_vision"]
 
 [workspace.package]
 version = "0.1.0"
@@ -39,6 +39,7 @@ abnegate-config = "0.1"
 abnegate-exec = "0.1"
 abnegate-http = "0.1"
 abnegate-index = "0.1"
+abnegate-notify = "0.1"
 abnegate-secret = "0.1.3"
 
 # Server dependencies