@@ -0,0 +1,13 @@
+---
+'@objectstack/service-messaging': patch
+---
+
+fix(notifications): the `email` channel answers unavailable while the email service only has the log transport, so a notification is no longer recorded as delivered when no mail left the server
+
+Clause-②: no
+Metadata-protocol: none
+
+- **What was wrong.** plugin-email registers the `email` service on every boot; with no `mail` settings saved its live transport is the log transport, which writes the message to the server log and to `sys_email` and sends nothing. The `email` channel treated "an email service is registered" as "available", so fan-out wrote a `sys_notification_delivery` row per recipient and the dispatcher marked it `success` while nobody was mailed.
+- **What changes.** The channel now asks the service's own deliverability answer, `IEmailService.isConfigured()`, on every call. While it answers `false`, `isAvailable()` answers `{ available: false, reason: 'transport_not_configured' }`: fan-out writes no delivery row and records the suppression on `sys_notification.suppressed_channels`, exactly as it does with no email service at all. `send()` refuses a row that was already written with the same `transport_not_configured` reason, graded permanent, and never hands it to the service. No new reason and no new error code.
+- **No restart needed.** The answer is read from the live transport, so saving a working provider under Setup → Email makes the channel available on the next notification, and switching back to the log transport makes it unavailable again.
+- **Unchanged.** An email service that does not implement `isConfigured` (it is optional on the contract) keeps today's behaviour: the channel stays available and sends through it. `EmailSenderSurface` gains the optional `isConfigured?(): boolean` member, mirroring the contract.
@@ -745,3 +745,133 @@ describe('email channel', () => {
         });
     });
 });
+
+// [#30510, cloud#2549 ruling B item ③] An email service is not a transport.
+//
+// plugin-email registers its `email` service on EVERY boot. With no `mail`
+// settings saved it holds the LogTransport, which only logs: a send resolves,
+// writes `sys_email`, and no mail leaves the process. The channel used to read
+// "a service is registered" as "available", so every e-mail notification on
+// such a deployment got a delivery row that dispatched to `success` while
+// nobody was mailed. The deliverability fact belongs to the package that owns
+// the transport (`IEmailService.isConfigured()`, read at call time so it
+// follows a transport the `mail` settings swap in), and this channel asks it.
+//
+// The double mirrors plugin-email's `EmailService` on the one axis that
+// matters here: `isConfigured()` answers from the LIVE transport, and
+// `setTransport()` swaps it the way the `mail` settings change bus does.
+// plugin-email's own suite pins that the real service answers this way
+// (`email-plugin.mail-settings.test.ts`, "isConfigured follows the mail
+// settings"); this file pins that the channel listens.
+describe('email channel — a LogTransport is no transport (#30510)', () => {
+    function liveSwappableEmail(initial: 'log' | 'smtp' = 'log') {
+        const sent: any[] = [];
+        let transport: 'log' | 'smtp' = initial;
+        return {
+            sent,
+            setTransport(next: 'log' | 'smtp') { transport = next; },
+            service: {
+                isConfigured: () => transport !== 'log',
+                async send(input: any) {
+                    sent.push(input);
+                    return { id: 'email_row_1' };
+                },
+            },
+        };
+    }
+
+    it('answers unavailable with the declared reason while the live transport only logs', () => {
+        const data = fakeData();
+        const email = liveSwappableEmail('log');
+        const ch = channel(() => email.service, data);
+        expect(ch.isAvailable?.(silentCtx(), { organizationId: 'org_1' }))
+            .toEqual({ available: false, reason: 'transport_not_configured' });
+    });
+
+    it('send() refuses with that SAME reason and never hands the message to the service — no fake sys_email row', async () => {
+        const data = fakeData();
+        const email = liveSwappableEmail('log');
+        const ch = channel(() => email.service, data);
+
+        const r = await ch.send(silentCtx(), delivery());
+
+        expect(r.ok).toBe(false);
+        expect(r.externalId).toBeUndefined();
+        const probe = ch.isAvailable?.(silentCtx(), {}) as { reason: string };
+        expect(r.error?.startsWith(`${probe.reason}:`)).toBe(true);
+        expect(r.error).toContain('user_1');
+        // The LogTransport would have "sent" it: the service is never called.
+        expect(email.sent).toHaveLength(0);
+        expect(ch.classifyError?.(r.error ?? '')).toBe('permanent');
+    });
+
+    it('flips to available, with no restart, once the mail settings swap a real transport in — and back', async () => {
+        const data = fakeData();
+        const email = liveSwappableEmail('log');
+        const ch = channel(() => email.service, data);
+        expect(ch.isAvailable?.(silentCtx(), {})).toEqual({ available: false, reason: 'transport_not_configured' });
+
+        email.setTransport('smtp');
+        expect(ch.isAvailable?.(silentCtx(), {})).toEqual({ available: true });
+        const r = await ch.send(silentCtx(), delivery());
+        expect(r.ok).toBe(true);
+        expect(email.sent).toHaveLength(1);
+
+        email.setTransport('log');
+        expect(ch.isAvailable?.(silentCtx(), {})).toEqual({ available: false, reason: 'transport_not_configured' });
+    });
+
+    it('THE CONTROL: a service that does not answer isConfigured stays available (absent = unknown, not a LogTransport)', async () => {
+        // `isConfigured` is OPTIONAL on `IEmailService`. Reading its absence as
+        // "no transport" would mute every host-supplied email service that
+        // predates the member, which is a different decision than the ruling's.
+        const data = fakeData();
+        const email = fakeEmail();
+        const ch = channel(() => email.service, data);
+        expect(ch.isAvailable?.(silentCtx(), {})).toEqual({ available: true });
+        const r = await ch.send(silentCtx(), delivery());
+        expect(r.ok).toBe(true);
+        expect(email.sent).toHaveLength(1);
+    });
+
+    it('END TO END: an emit on a log-only deployment writes no delivery row and records the suppression; after the swap it delivers', async () => {
+        const data = fakeData();
+        const email = liveSwappableEmail('log');
+        const outbox = new MemoryNotificationOutbox(1);
+        const service = new MessagingService({
+            logger: { info: () => {}, warn: () => {}, error: () => {} },
+            outbox,
+            getData: () => data,
+        });
+        service.registerChannel(channel(() => email.service, data));
+        const dispatcher = new NotificationDispatcher({
+            nodeId: 'node-test',
+            outbox,
+            channels: service,
+            channelContext: silentCtx(),
+            intervalMs: 10_000,
+        });
+        const emit = () => service.emit({
+            topic: 'deal.won',
+            audience: ['user_1'],
+            channels: ['email'],
+            payload: { title: 'Deal closed', body: 'Acme signed' },
+        });
+
+        const before = await emit();
+        await dispatcher.tick();
+        expect(await outbox.list()).toHaveLength(0);
+        expect(before.enqueued).toBe(0);
+        expect(before.suppressed).toEqual([{ channel: 'email', reason: 'transport_not_configured' }]);
+        expect(email.sent).toHaveLength(0);
+
+        email.setTransport('smtp');
+        const after = await emit();
+        await dispatcher.tick();
+        const rows = await outbox.list();
+        expect(after.suppressed).toEqual([]);
+        expect(rows).toHaveLength(1);
+        expect(rows[0].status).toBe('success');
+        expect(email.sent).toHaveLength(1);
+    });
+});
@@ -43,6 +43,21 @@ export interface EmailSenderSurface {
          */
         organizationId?: string;
     }): Promise<{ id?: string } | unknown>;
+    /**
+     * Structural mirror of `IEmailService.isConfigured` — whether mail sent
+     * through the service is actually delivered, answered by the package that
+     * owns the transport. plugin-email answers `false` while its live
+     * transport is the LogTransport (no `mail` settings saved: every send
+     * resolves and writes `sys_email`, and no mail leaves the process), and
+     * reads the live transport on every call, so the answer follows a
+     * transport the `mail` settings swap in without a restart.
+     *
+     * OPTIONAL, as on the contract. An implementation without it is UNKNOWN,
+     * and this channel keeps treating it as it always has (available): only an
+     * explicit `false` is evidence that nothing would be delivered
+     * ({@link emailTransportRefusal}).
+     */
+    isConfigured?(): boolean;
     /**
      * Structural mirror of `IEmailService.sendTemplate` (#9205) — resolves a
      * `sys_email_template` bundle by `(template, locale)` with the documented
@@ -96,7 +111,9 @@ export interface EmailChannelOptions {
      * {@link MessagingChannel.isAvailable} reports as
      * `transport_not_configured` and {@link MessagingChannel.send} REFUSES with
      * the same reason (commit 879b51270). ⛔ Not a no-op success: a delivery nothing was
-     * sent for is never reported as delivered.
+     * sent for is never reported as delivered. A resolved service whose
+     * `isConfigured()` answers `false` (only the log transport is live) is
+     * answered the same way (#30510).
      */
     getEmail(): EmailSenderSurface | undefined;
     /** Resolve the data engine (recipient address lookup). */
@@ -198,6 +215,33 @@ export async function templateRefusalAfterCurrencyReadFault(
  */
 const TRANSPORT_NOT_CONFIGURED: ChannelUnavailableReason = 'transport_not_configured';
 
+/**
+ * [#30510, cloud#2549 ruling B item ③] Why a resolved email service cannot
+ * deliver, or `undefined` when nothing says it cannot.
+ *
+ * A registered `email` service is not a transport. plugin-email registers one
+ * on every boot, and with no `mail` settings saved it holds the LogTransport:
+ * a send resolves, writes `sys_email`, and no mail leaves the process. Before
+ * this, the channel read "a service is registered" as "available", so every
+ * e-mail notification on such a deployment dispatched to `success` while
+ * nobody was mailed.
+ *
+ * Asked of the service, ⛔ never of the options it was built from: the answer
+ * must follow a transport the `mail` settings swap in after boot, and only the
+ * service sees its live transport. Read on every call, never cached.
+ *
+ * Only an explicit `false` refuses. `isConfigured` is optional on the
+ * contract, and an implementation without it is unknown, not a log transport:
+ * reading its absence as "no transport" would mute every host-supplied email
+ * service that predates the member, which is not what the ruling decided.
+ */
+function emailTransportRefusal(email: EmailSenderSurface): string | undefined {
+    if (typeof email.isConfigured !== 'function') return undefined;
+    return email.isConfigured() === false
+        ? "the 'email' service has no delivering transport (only the log transport is active; configure the mail settings)"
+        : undefined;
+}
+
 const EMAIL_SHAPE = (s: string): boolean => {
     // Linear, non-backtracking "looks like an email" — same shape as the
     // recipient resolver's check (avoids the ReDoS-prone regex).
@@ -343,9 +387,13 @@ export function createEmailChannel(opts: EmailChannelOptions): MessagingChannel
             // it causes is announced ONCE per emit by the service and recorded
             // durably on `sys_notification.suppressed_channels` — a line per
             // emit here would be the noisy half of an answer already written down.
-            return opts.getEmail()
+            //
+            // [#30510] A registered service whose live transport only logs is
+            // the same condition as no service: nothing would be delivered.
+            const email = opts.getEmail();
+            return email && emailTransportRefusal(email) === undefined
                 ? { available: true }
-                : { available: false, reason: 'transport_not_configured' };
+                : { available: false, reason: TRANSPORT_NOT_CONFIGURED };
         },
 
         async send(ctx: MessagingChannelContext, delivery: Delivery): Promise<SendResult> {
@@ -378,6 +426,21 @@ export function createEmailChannel(opts: EmailChannelOptions): MessagingChannel
                     error: `${TRANSPORT_NOT_CONFIGURED}: no 'email' service is registered; nothing was sent to '${delivery.recipient}'`,
                 };
             }
+            // [#30510] The same answer for a service whose live transport only
+            // logs, which `isAvailable()` above gives too. This is the residue
+            // fan-out's suppression cannot cover: a row written while a real
+            // transport was live and dispatched after the settings dropped back
+            // to the log transport. ⛔ Never handed to the service: its
+            // LogTransport would "send" it, write `sys_email`, and the row
+            // would read `success` with nobody mailed.
+            const refusal = emailTransportRefusal(email);
+            if (refusal !== undefined) {
+                ctx.logger.warn(`[email] ${refusal}; '${delivery.recipient}' was NOT emailed`);
+                return {
+                    ok: false,
+                    error: `${TRANSPORT_NOT_CONFIGURED}: ${refusal}; nothing was sent to '${delivery.recipient}'`,
+                };
+            }
 
             const n = delivery.notification;
             const resolved = await resolveRecipient(ctx, opts.getData(), delivery.recipient);