@@ -0,0 +1,11 @@
+---
+'@objectstack/spec': patch
+'@objectstack/plugin-auth': patch
+---
+
+`GET /api/v1/auth/config` now says whether email leaves the deployment, in a new optional `features.emailDelivery` flag. It is `true` only when the wired email service reports itself configured, and `false` with no email service or with the stock `log` transport, which writes mail to the server console instead of sending it. The forgot-password page can read it to stop saying a reset link was sent on a deployment that sends no mail.
+
+The flag describes the deployment, not an address: `POST /api/v1/auth/request-password-reset` still answers a known and an unknown address the same way, with or without mail.
+
+Clause-②: yes (widening)
+Metadata-protocol: none
@@ -3208,6 +3208,8 @@ describe('AuthManager', () => {
         admin: false,
         phoneNumber: false,
         phoneNumberOtp: false,
+        // [#30107] No email service is wired here, so no mail leaves.
+        emailDelivery: false,
         multiOrgEnabled: false,
         // [ADR-0105 D1] Which of `single` | `group` | `isolated` is in force.
         // A vanilla deployment (no tenancy service wired, no env override) is
 
@@ -2733,7 +2733,9 @@ export class AuthManager {
    * transport swapped from the mail settings at runtime). Read at call time,
    * never cached at boot. [#27843] invite-member's `outcome` asks it too
    * (`invitation-delivery-outcome.ts`), so an invite answers `link_only` on
-   * exactly the deployments where sign-up would not mail either.
+   * exactly the deployments where sign-up would not mail either. [#30107]
+   * `getPublicConfig()`'s `features.emailDelivery` serves the same answer, so
+   * the forgot-password page stops saying a reset link was sent where none is.
    *
    * ⛔ An implementation WITHOUT the member is NOT live: the contract says an
    * absent member is unknown, and the flow asking — a success answer that only
@@ -4645,6 +4647,14 @@ export class AuthManager {
       // SMS path can actually deliver (plugin on + deliverable SMS service),
       // so the login UI never shows a dead "sign in with code" option.
       phoneNumberOtp: ((pluginConfig as any).phoneNumber ?? false) && this.isPhoneOtpDeliverable(),
+      // [#30107] Does mail leave this deployment? The one deliverability rule
+      // (`isEmailDeliveryLive()`: the wired service's own `isConfigured()`),
+      // read per request — so no email service and the stock `log` transport
+      // both answer false, and a transport configured later answers true
+      // without a restart. ⛔ Not `isEmailServiceAvailable()`: that is true on
+      // every default boot. The reset request answers known and unknown
+      // addresses alike either way; this describes the deployment, not one.
+      emailDelivery: this.isEmailDeliveryLive(),
       // The managed (cloud-hosted, SSO-only) mode, from the one accessor every
       // judgement site reads (ruling 6341690661 on #25083, Q2 D / Q3 A). A
       // hide-when-on flag: the console hides the doors that add people.
 
@@ -28,7 +28,13 @@
  *    gets; the server-side phone reset call (no `Request`) still awaits its
  *    send;
  *  - `runAfterResponse` hands a task's synchronous throw to `onFailure` and
- *    survives an `onFailure` that throws.
+ *    survives an `onFailure` that throws;
+ *  - the public config says whether mail leaves the deployment
+ *    (`features.emailDelivery`): false with no email service and with a
+ *    transport that reports itself unconfigured (the stock `log` one), true
+ *    with a configured one. It describes the deployment, not an address: in
+ *    all three a known and an unknown address get the same reset answer, and
+ *    that answer is the same one whether mail leaves or not.
  */
 
 import { describe, it, expect, afterAll, afterEach, vi } from 'vitest';
@@ -297,6 +303,45 @@ describe('the phone-number reset request answers without waiting on the reset te
   }, 60_000);
 });
 
+describe('the public config says whether a reset link can be emailed from this deployment', () => {
+  /** The deployment's one account, then the email service under test swapped in. */
+  async function withEmailService(service: Record<string, unknown> | undefined) {
+    const d = await deployment(async () => ({ status: 'sent' }));
+    d.manager.setEmailService(service as never);
+    const config = d.manager.getPublicConfig() as { features: Record<string, unknown> };
+    const forAccount = await requestReset(d.manager, EMAIL);
+    const forNobody = await requestReset(d.manager, NOBODY);
+    return { emailDelivery: config.features.emailDelivery, forAccount, forNobody };
+  }
+
+  const sendTemplate = async () => ({ status: 'sent' });
+
+  it('no email service: no delivery, and a known and an unknown address get the same answer', async () => {
+    const r = await withEmailService(undefined);
+
+    expect(r.emailDelivery).toBe(false);
+    expect(r.forAccount.status).toBe(200);
+    expect(r.forAccount).toEqual(r.forNobody);
+  }, 60_000);
+
+  it('a transport that reports itself unconfigured (the log one): no delivery, same answer for both addresses', async () => {
+    const r = await withEmailService({ sendTemplate, isConfigured: () => false });
+
+    expect(r.emailDelivery).toBe(false);
+    expect(r.forAccount.status).toBe(200);
+    expect(r.forAccount).toEqual(r.forNobody);
+  }, 60_000);
+
+  it('a configured transport: delivery, and the reset answer is the one a deployment without mail gives', async () => {
+    const live = await withEmailService({ sendTemplate, isConfigured: () => true });
+    const none = await withEmailService(undefined);
+
+    expect(live.emailDelivery).toBe(true);
+    expect(live.forAccount).toEqual(live.forNobody);
+    expect(live.forAccount).toEqual(none.forAccount);
+  }, 60_000);
+});
+
 describe('runAfterResponse', () => {
   it("hands a task's synchronous throw to onFailure", async () => {
     const failures: unknown[] = [];
 
@@ -234,6 +234,7 @@ describe('AuthFeaturesConfig declares every classified served key', () => {
     admin: true,
     phoneNumber: false,
     phoneNumberOtp: false,
+    emailDelivery: false,
     cloudManaged: false,
     termsUrl: 'https://objectstack.ai/terms',
     privacyUrl: 'https://objectstack.ai/privacy',
 
@@ -262,6 +262,11 @@ export const AuthFeaturesConfigSchema = lazySchema(() => z.object({
   phoneNumberOtp: z.boolean().optional().describe(
     'Phone-number OTP sign-in and self-service password reset available — requires the phoneNumber plugin plus a deliverable SMS service',
   ),
+  emailDelivery: z.boolean().optional().describe(
+    'Email leaves this deployment: the wired email service reports itself configured with a real transport, so password-reset, verification and invitation mail is delivered. '
+    + 'False with no email service and with the stock log transport, which writes mail to the server console instead of sending it; the forgot-password page can then say a reset link cannot be emailed here and to ask an administrator. '
+    + 'A statement about the deployment, never about an address: the password-reset request answers known and unknown addresses alike either way. Absent means not live',
+  ),
   cloudManaged: z.boolean().optional().describe(
     'Managed (cloud-hosted, SSO-only) mode: people arrive through the identity provider, so the UI hides inviting, creating users and setting their passwords; absent means not managed',
   ),
 
@@ -16,14 +16,15 @@ import {
 describe('PUBLIC_AUTH_FEATURES registry', () => {
   const entries = Object.entries(PUBLIC_AUTH_FEATURES);
 
-  it('classifies all 12 public flags', () => {
-    expect(PUBLIC_AUTH_FEATURE_NAMES).toHaveLength(12);
+  it('classifies all 13 public flags', () => {
+    expect(PUBLIC_AUTH_FEATURE_NAMES).toHaveLength(13);
     expect([...PUBLIC_AUTH_FEATURE_NAMES].sort()).toEqual(
       [
         'admin',
         'cloudManaged',
         'degradedTenancy',
         'deviceAuthorization',
+        'emailDelivery',
         'multiOrgEnabled',
         'oidcProvider',
         'organization',
 
@@ -283,6 +283,19 @@ export const PUBLIC_AUTH_FEATURES = {
         'transport in production keeps it off.',
     },
   },
+  emailDelivery: {
+    surface: 'login',
+    semantics: 'opt-in',
+    exempt: {
+      reason:
+        'Login-surface only: tells the forgot-password page whether a reset ' +
+        'link can be emailed on this deployment, so its success screen does ' +
+        'not say a link was sent when no mail leaves. True only when the wired ' +
+        'email service reports itself configured; no email service and the ' +
+        'stock log transport keep it off. Describes the deployment, never an ' +
+        'address: the reset request answers known and unknown addresses alike.',
+    },
+  },
 } as const satisfies Record<string, PublicAuthFeatureEntry>;
 
 export type PublicAuthFeatureName = keyof typeof PUBLIC_AUTH_FEATURES;