@volter/twin-postmark 0.1.0

package/src/postmark-capabilities.ts

@@ -0,0 +1,1737 @@
+// Postmark capability manifest — the EXPECTED REAL-PRODUCT SURFACE (the target), authored
+// TOP-DOWN from what the Postmark API actually does — NOT from what this twin has built.
+//
+// THE DENOMINATOR. Postmark's public API is ~86 endpoints across 15 documented groups (the
+// docs sidebar order: Email · Bulk · Templates · Bounce · Server · Servers · Message Streams
+// · Messages · Domains · Sender Signatures · Stats · Inbound Rule Triggers · Webhooks ·
+// Suppressions · Data Removals). Every one is enumerated below, whether or not this twin has
+// reached it. `verify()` is ground truth; `expected: 'done'` appears ONLY where a real,
+// failable verify proves the behavior, so a broken claim surfaces as a regression.
+//
+// AREAS vs GROUPS — they are deliberately NOT 1:1, and `POSTMARK_AREAS` is the smaller set.
+// **Bulk** has no area of its own: its two endpoints are approval-gated surface this twin does
+// not model, so they are filed as `todo`s under the `email` area rather than given a group
+// that would then have to be justified. Everything else maps one group → one area, plus four
+// TWIN-side areas (auth · honesty · ui · connector) that are rungs, not vendor groups.
+//
+// HONEST READING OF THE COVERAGE NUMBER. This pack reads high for a new twin, and part of
+// that is real breadth and part of it is granularity: built areas are enumerated per-operation
+// while some unbuilt ones (notably the 13 `/stats/*` endpoints) are still enumerated per-family.
+// Evening that out is tracked work, and doing it will make the percentage DROP — which is
+// success, not regression (§6). Roughly a fifth of the `done` numerator is also the twin
+// auditing itself (auth · honesty · ui · connector rungs) rather than vendor endpoints.
+//
+// The area census below is the vendor's own docs-nav grouping, enumerated top-down from the
+// published API reference — NOT derived from the entries in this file (which would make the
+// bijection a tautology, per ADDING_A_TWIN §6).
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { checkCapabilities, uiDataCoupled, type CapabilityReport, type CapabilitySpec, verifyBoundary } from '@volter/world-tooling';
+import { handlePostmarkTwinRequest, POSTMARK_ERRORS, type PostmarkResponse } from './postmark-twin.ts';
+import { deliveryPlan, webhookHeaders, webhooksFor } from './postmark-events.ts';
+import {
+  mapBounce, mapMessage, mapTemplate,
+  pullPostmarkBounces, pullPostmarkMessages, pullPostmarkMessageStreams, pullPostmarkServer,
+  pullPostmarkTemplates, pullPostmarkWebhooks,  pushPostmarkAction,
+  syncPostmarkFromReal, type PostmarkClient,
+} from './postmark-connector.ts';
+import { performPending } from './postmark-perform-harness.ts';
+import { StatusPill, MessageBody, DeliveryTimeline, NestedLines } from '../client/postmark-mirror.tsx';
+import {
+  deliveryTimeline, flattenPostmarkValue, messageStatus, POSTMARK_MIRROR_SECTIONS, statusTone,
+} from './postmark-mirror-ui.ts';
+
+// ── API verify: drive REAL requests against a fresh temp root, then assert status/shape ──
+/** `at` pins the write's `occurredAt` — the kernel's dedupe key has millisecond resolution,
+ *  so pinning it makes a same-instant repeat DETERMINISTIC instead of a race (§6's
+ *  fixed-occurredAt rule, used here to make a regression pin reliably failable). */
+type Step = { m: string; p: string; b?: unknown; h?: Record<string, string>; at?: string };
+type Body = Record<string, any>;
+type Handler = (s: Step) => Promise<PostmarkResponse>;
+
+/** Run a sequence of real Postmark requests against an ISOLATED root; tear it down after. */
+async function withRoot(steps: (h: Handler, root: string) => Promise<boolean>): Promise<boolean> {
+  const root = mkdtempSync(join(tmpdir(), 'postmark-cap-'));
+  const h: Handler = (s) => handlePostmarkTwinRequest({
+    method: s.m, path: s.p,
+    body: s.b === undefined ? undefined : JSON.stringify(s.b),
+    root, ...(s.h ? { headers: s.h } : {}), ...(s.at ? { occurredAt: s.at } : {}),
+  });
+  try {
+    return await verifyBoundary('postmark.withRoot', () => steps(h, root));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+/** A `{ h, root }` context adapter over `withRoot`, for uiDataCoupled verifies. */
+type PostmarkCtx = { h: Handler; root: string };
+const withRootCtx = (fn: (ctx: PostmarkCtx) => Promise<boolean>) => withRoot((h, root) => fn({ h, root }));
+
+/**
+ * Drive real sends with a webhook capture wired in through the HANDLER's own `deliver`
+ * injection point — so a webhook verify genuinely routes through the vendor's send-and-
+ * deliver code path (a sabotaged handler can never emit anything), and stays fully offline.
+ */
+async function withWebhookCapture(
+  steps: (h: Handler, seen: Array<{ url: string; body: Body; headers: Record<string, string> }>) => Promise<boolean>,
+): Promise<boolean> {
+  const root = mkdtempSync(join(tmpdir(), 'postmark-cap-wh-'));
+  const seen: Array<{ url: string; body: Body; headers: Record<string, string> }> = [];
+  const deliver = (url: string, body: string, headers: Record<string, string>) => {
+    seen.push({ url, body: JSON.parse(body) as Body, headers });
+  };
+  const h: Handler = (s) => handlePostmarkTwinRequest({
+    method: s.m, path: s.p,
+    body: s.b === undefined ? undefined : JSON.stringify(s.b),
+    root, deliver, ...(s.h ? { headers: s.h } : {}),
+  });
+  try {
+    return await verifyBoundary('postmark.withWebhookCapture', () => steps(h, seen));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+const ok = (r: PostmarkResponse) => r.status >= 200 && r.status < 300;
+const field = (r: PostmarkResponse, k: string) => (r.body as Body)?.[k];
+const errorCode = (r: PostmarkResponse) => (r.body as Body)?.ErrorCode;
+/** A failure assertion: the vendor's HTTP status AND its ErrorCode, never one alone. */
+const failedWith = (r: PostmarkResponse, status: number, code: number) => r.status === status && errorCode(r) === code;
+const list = (r: PostmarkResponse, key: string): Body[] => ((r.body as Body)?.[key] ?? []) as Body[];
+
+// A minimal valid send payload — the common fixture. NOTE it deliberately carries a Subject
+// even though Postmark does not require one; `postmark.email.subject_optional` proves the
+// vendor's real (surprising) behavior separately.
+const mkMail = (over: Body = {}): Body => ({
+  From: 'Acme <notifications@acme.dev>',
+  To: 'ada@twin.test',
+  Subject: 'Your login code',
+  TextBody: 'Your code is 123456',
+  HtmlBody: '<strong>Your code is 123456</strong>',
+  ...over,
+});
+
+// A FAKE injected Postmark client for the connector verify()s — proves the pull/push
+// auth-boundary path works fully offline (no real `postmark` SDK, no network). The SDK
+// RESOLVES with the payload (it does not use a `{data,error}` envelope); counters let a
+// verify() assert push-once semantics.
+type FakeClient = PostmarkClient & { sends: Body[]; templateCreates: Body[]; webhookCreates: Body[]; streamCreates: Body[] };
+function fakePostmarkClient(over: Partial<PostmarkClient> = {}): FakeClient {
+  const c: FakeClient = {
+    sends: [], templateCreates: [], webhookCreates: [], streamCreates: [],
+    getOutboundMessages: async () => ({
+      TotalCount: 1,
+      Messages: [{
+        MessageID: 'real-msg-0001', From: 'real@acme.dev', Subject: 'RealSubject',
+        Recipients: ['real-recipient@twin.test'], To: [{ Email: 'real-recipient@twin.test', Name: '' }],
+        ReceivedAt: '2026-01-01T00:00:00Z', Status: 'Sent', MessageStream: 'outbound',
+        TrackOpens: true, TrackLinks: 'HtmlAndText', Tag: 'real-tag',
+      }],
+    }),
+    getBounces: async () => ({
+      TotalCount: 1,
+      Bounces: [{ ID: 9001, Type: 'HardBounce', Name: 'Hard bounce', Email: 'real-bounced@twin.test', BouncedAt: '2026-01-01T00:00:00Z', MessageStream: 'outbound', Inactive: true, CanActivate: true, Subject: 'RealBounceSubject' }],
+    }),
+    getTemplates: async () => ({
+      TotalCount: 1,
+      Templates: [{ TemplateId: 7001, Name: 'RealTemplate', Alias: 'real-alias', TemplateType: 'Standard', Active: true, Subject: 'Real {{ name }}' }],
+    }),
+    getMessageStreams: async () => ({
+      TotalCount: 1,
+      MessageStreams: [{ ID: 'real-stream', Name: 'RealStream', MessageStreamType: 'Broadcast', CreatedAt: '2026-01-01T00:00:00Z' }],
+    }),
+    getWebhooks: async () => ({ Webhooks: [{ ID: 5001, Url: 'https://real.test/hook', MessageStream: 'outbound', Triggers: { Delivery: { Enabled: true } } }] }),
+    getServer: async () => ({ ID: 42, Name: 'RealServer', DeliveryType: 'Live', Color: 'purple', TrackOpens: true }),
+    sendEmail: async (m) => { c.sends.push(m); return { MessageID: 'real-sent-0001', ErrorCode: 0, Message: 'OK' }; },
+    createTemplate: async (o) => { c.templateCreates.push(o); return { TemplateId: 7777 }; },
+    createWebhook: async (o) => { c.webhookCreates.push(o); return { ID: 8888 }; },
+    createMessageStream: async (o) => { c.streamCreates.push(o); return { ID: String(o.ID ?? 'real-created') }; },
+    ...over,
+  };
+  return c;
+}
+
+// ── shorthands (mirror the clerk/stripe/resend manifests) ──
+const done = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], verify: CapabilitySpec['verify']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo' });
+
+export const POSTMARK_CAPABILITIES: CapabilitySpec[] = [
+  // ── Email API — the headline surface (POST /email is what ships auth OTPs) ────────
+  done('postmark.email.send', 'email', 'Email: send (POST /email → MessageID/SubmittedAt/ErrorCode 0)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email', b: mkMail() });
+      if (!ok(r) || errorCode(r) !== 0 || field(r, 'Message') !== 'OK') return false;
+      const id = field(r, 'MessageID');
+      // Postmark's MessageID is a bare UUID (no vendor prefix) and the response echoes To.
+      return typeof id === 'string'
+        && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id)
+        && field(r, 'To') === 'ada@twin.test'
+        && typeof field(r, 'SubmittedAt') === 'string';
+    }),
+  ),
+  done('postmark.email.stored_not_sent', 'email', 'Email: the message is STORED in twin state, never really sent', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Persisted subject', HtmlBody: '<em>persisted-body</em>' }) });
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      return ok(d) && field(d, 'Subject') === 'Persisted subject' && field(d, 'HtmlBody') === '<em>persisted-body</em>';
+    }),
+  ),
+  done('postmark.email.send_text_only', 'email', 'Email: send with TextBody only', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: 'b@twin.test', Subject: 's', TextBody: 'plain only' } });
+      if (!ok(r)) return false;
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+      return ok(d) && field(d, 'TextBody') === 'plain only' && field(d, 'HtmlBody') === null;
+    }),
+  ),
+  done('postmark.email.send_cc_bcc_reply_to', 'email', 'Email: Cc/Bcc/ReplyTo/Headers/Metadata/Tag are carried', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email', b: mkMail({
+        Cc: 'cc@twin.test', Bcc: 'Blind <bcc@twin.test>', ReplyTo: 'reply@acme.dev',
+        Tag: 'welcome', Metadata: { tenant: 'acme' }, Headers: [{ Name: 'X-Twin', Value: '1' }],
+      }) });
+      if (!ok(r) || field(r, 'Cc') !== 'cc@twin.test' || field(r, 'Bcc') !== 'bcc@twin.test') return false;
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+      const cc = field(d, 'Cc') as Body[];
+      const bcc = field(d, 'Bcc') as Body[];
+      return ok(d) && cc?.[0]?.Email === 'cc@twin.test'
+        && bcc?.[0]?.Email === 'bcc@twin.test' && bcc?.[0]?.Name === 'Blind'
+        && field(d, 'Tag') === 'welcome' && (field(d, 'Metadata') as Body)?.tenant === 'acme';
+    }),
+  ),
+  done('postmark.email.recipient_string_parsing', 'email', 'Email: comma-separated `Name <addr>` recipient parsing', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'Ada Lovelace <ada@twin.test>, grace@twin.test' }) });
+      if (!ok(r) || field(r, 'To') !== 'ada@twin.test, grace@twin.test') return false;
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+      const to = field(d, 'To') as Body[];
+      return to?.length === 2 && to[0]!.Name === 'Ada Lovelace' && to[0]!.Email === 'ada@twin.test' && to[1]!.Email === 'grace@twin.test';
+    }),
+  ),
+  done('postmark.email.validate_missing_from', 'email', 'Email: 422 ErrorCode 300 on missing/invalid From (validated FIRST)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const missing = await h({ m: 'POST', p: '/email', b: { To: 'x@twin.test', Subject: 's', TextBody: 't' } });
+      // [WIRE] an EMPTY body also answers the From error — From is validated before recipients.
+      const empty = await h({ m: 'POST', p: '/email', b: {} });
+      const malformed = await h({ m: 'POST', p: '/email', b: mkMail({ From: 'not-an-address' }) });
+      return failedWith(missing, 422, 300) && field(missing, 'Message') === "Invalid 'From' value."
+        && failedWith(empty, 422, 300) && field(empty, 'Message') === "Invalid 'From' value."
+        && failedWith(malformed, 422, 300);
+    }),
+  ),
+  done('postmark.email.validate_zero_recipients', 'email', 'Email: 422 ErrorCode 300 "Zero recipients specified."', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', Subject: 's', TextBody: 't' } });
+      const blank = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: '', Subject: 's', TextBody: 't' } });
+      return failedWith(r, 422, 300) && field(r, 'Message') === 'Zero recipients specified.' && failedWith(blank, 422, 300);
+    }),
+  ),
+  done('postmark.email.validate_missing_body', 'email', 'Email: 422 ErrorCode 300 when neither HtmlBody nor TextBody is given', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: 'b@twin.test', Subject: 's' } });
+      return failedWith(r, 422, 300) && String(field(r, 'Message')).includes('TextBody');
+    }),
+  ),
+  done('postmark.email.subject_optional', 'email', 'Email: Subject is NOT required (a send without one succeeds)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // Verified against the LIVE api.postmarkapp.com with the public test token during this
+      // pack's build: Postmark accepts a send with no Subject. Guards the twin against the
+      // very common (wrong) assumption that Subject is mandatory.
+      const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: 'b@twin.test', TextBody: 'no subject here' } });
+      if (!ok(r) || errorCode(r) !== 0) return false;
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+      return ok(d) && field(d, 'Subject') === '';
+    }),
+  ),
+  done('postmark.email.validate_bad_recipient', 'email', 'Email: 422 ErrorCode 300 on an illegal recipient address', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'ada@twin.test, not-an-address' }) });
+      return failedWith(r, 422, 300) && String(field(r, 'Message')).includes('not-an-address');
+    }),
+  ),
+  done('postmark.email.invalid_json', 'email', 'Email: 422 ErrorCode 402 "Invalid JSON" on a malformed body', 'api', 'common', () =>
+    withRoot(async () => {
+      const root = mkdtempSync(join(tmpdir(), 'postmark-json-'));
+      try {
+        const r = await handlePostmarkTwinRequest({ method: 'POST', path: '/email', body: '{"From":', root });
+        return failedWith(r, 422, 402) && field(r, 'Message') === 'Invalid JSON';
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    }),
+  ),
+  done('postmark.email.attachments', 'email', 'Email: attachments (Name/Content/ContentType) + their 422', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const good = await h({ m: 'POST', p: '/email', b: mkMail({ Attachments: [{ Name: 'receipt.pdf', Content: 'dGVzdA==', ContentType: 'application/pdf' }] }) });
+      if (!ok(good)) return false;
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(good, 'MessageID')}/details` });
+      const bad = await h({ m: 'POST', p: '/email', b: mkMail({ Attachments: [{ Name: 'x.pdf' }] }) });
+      return ok(d) && (field(d, 'Attachments') as string[])?.includes('receipt.pdf') && failedWith(bad, 422, 300);
+    }),
+  ),
+  done('postmark.email.stream_routing', 'email', 'Email: MessageStream routing + 422 ErrorCode 1235 for an unknown stream', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const created = await h({ m: 'POST', p: '/message-streams', b: { ID: 'promos', Name: 'Promos', MessageStreamType: 'Broadcast' } });
+      if (!ok(created)) return false;
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ MessageStream: 'promos' }) });
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      const missing = await h({ m: 'POST', p: '/email', b: mkMail({ MessageStream: 'does-not-exist' }) });
+      return ok(sent) && field(d, 'MessageStream') === 'promos' && failedWith(missing, 422, 1235);
+    }),
+  ),
+  done('postmark.email.default_stream', 'email', 'Email: a send with no MessageStream lands on `outbound`', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail() });
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      return ok(d) && field(d, 'MessageStream') === 'outbound';
+    }),
+  ),
+  done('postmark.email.batch', 'email', 'Email: POST /email/batch → one result per message (bare array)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email/batch', b: [mkMail({ To: 'one@twin.test' }), mkMail({ To: 'two@twin.test' })] });
+      const arr = r.body as Body[];
+      if (!ok(r) || !Array.isArray(arr) || arr.length !== 2) return false;
+      if (arr[0]!.To !== 'one@twin.test' || arr[1]!.To !== 'two@twin.test') return false;
+      if (arr.some((e) => e.ErrorCode !== 0 || typeof e.MessageID !== 'string')) return false;
+      // Both really landed in twin state.
+      const listed = await h({ m: 'GET', p: '/messages/outbound' });
+      return field(listed, 'TotalCount') === 2;
+    }),
+  ),
+  done('postmark.email.batch_per_message_errors', 'email', 'Email: batch reports PER-MESSAGE errors inside a 200, not a top-level 422', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/email/batch', b: [mkMail({ To: 'good@twin.test' }), { To: 'x@twin.test', Subject: 's', TextBody: 't' }] });
+      const arr = r.body as Body[];
+      if (r.status !== 200 || !Array.isArray(arr) || arr.length !== 2) return false;
+      // Only the good one was actually enacted.
+      const listed = await h({ m: 'GET', p: '/messages/outbound' });
+      return arr[0]!.ErrorCode === 0 && arr[1]!.ErrorCode === 300 && field(listed, 'TotalCount') === 1;
+    }),
+  ),
+  done('postmark.email.batch_cap', 'email', 'Email: 422 ErrorCode 410 over the 500-message batch cap', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const over = Array.from({ length: 501 }, (_v, i) => mkMail({ To: `r${i}@twin.test` }));
+      const r = await h({ m: 'POST', p: '/email/batch', b: over });
+      const empty = await h({ m: 'POST', p: '/email/batch', b: [] });
+      return failedWith(r, 422, 410) && String(field(r, 'Message')).includes('500') && failedWith(empty, 422, 300);
+    }),
+  ),
+  done('postmark.email.inactive_recipient', 'email', 'Email: 422 ErrorCode 406 sending to a SUPPRESSED recipient (dirty state)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // A DIRTY-STATE capability: it can only fail over PRIOR state. First send bounces and
+      // auto-suppresses the address; the SECOND send to the same address must be refused with
+      // the vendor's inactive-recipient error. A fresh-root-only test can never reach this.
+      const first = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-me@twin.test' }) });
+      if (!ok(first)) return false;
+      const second = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-me@twin.test' }) });
+      if (!failedWith(second, 422, 406) || !String(field(second, 'Message')).includes('bounce-me@twin.test')) return false;
+      // …and only ONE message was ever stored (the refusal enacted nothing).
+      const listed = await h({ m: 'GET', p: '/messages/outbound' });
+      return field(listed, 'TotalCount') === 1;
+    }),
+  ),
+  done('postmark.email.send_with_template', 'email', 'Email: POST /email/withTemplate renders a stored template', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const t = await h({ m: 'POST', p: '/templates', b: { Name: 'Welcome', Alias: 'welcome', Subject: 'Hi {{ name }}', HtmlBody: '<p>Code {{ code }}</p>', TextBody: 'Code {{ code }}' } });
+      if (!ok(t)) return false;
+      const sent = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateAlias: 'welcome', TemplateModel: { name: 'Ada', code: '424242' } } });
+      if (!ok(sent) || errorCode(sent) !== 0) return false;
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      return field(d, 'Subject') === 'Hi Ada' && field(d, 'HtmlBody') === '<p>Code 424242</p>' && field(d, 'TextBody') === 'Code 424242';
+    }),
+  ),
+  done('postmark.email.send_with_template_by_id', 'email', 'Email: withTemplate resolves by numeric TemplateId too', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const t = await h({ m: 'POST', p: '/templates', b: { Name: 'ById', Subject: 'Sub {{ x }}', TextBody: 'Body {{ x }}' } });
+      const sent = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateId: field(t, 'TemplateId'), TemplateModel: { x: 'resolved' } } });
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      return ok(sent) && field(d, 'Subject') === 'Sub resolved';
+    }),
+  ),
+  done('postmark.email.template_not_found', 'email', 'Email: 422 ErrorCode 1101 for an unknown / unspecified template', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const unknown = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateAlias: 'nope', TemplateModel: {} } });
+      const neither = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateModel: {} } });
+      return failedWith(unknown, 422, 1101) && failedWith(neither, 422, 1101);
+    }),
+  ),
+  done('postmark.email.template_unknown_token_renders_empty', 'email', 'Email: an unmodeled template token renders EMPTY (non-strict Mustachio)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/templates', b: { Name: 'Partial', Alias: 'partial', Subject: 'S', TextBody: 'a[{{ known }}]b[{{ unknown }}]c' } });
+      const sent = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateAlias: 'partial', TemplateModel: { known: 'X' } } });
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      return ok(sent) && field(d, 'TextBody') === 'a[X]b[]c';
+    }),
+  ),
+  done('postmark.email.batch_with_templates', 'email', 'Email: POST /email/batchWithTemplates ({Messages:[…]} → array)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/templates', b: { Name: 'Batch', Alias: 'batch-t', Subject: 'S {{ n }}', TextBody: 'B {{ n }}' } });
+      const r = await h({ m: 'POST', p: '/email/batchWithTemplates', b: { Messages: [
+        { From: 'a@acme.dev', To: 'one@twin.test', TemplateAlias: 'batch-t', TemplateModel: { n: '1' } },
+        { From: 'a@acme.dev', To: 'two@twin.test', TemplateAlias: 'batch-t', TemplateModel: { n: '2' } },
+      ] } });
+      const arr = r.body as Body[];
+      if (!ok(r) || arr?.length !== 2 || arr.some((e) => e.ErrorCode !== 0)) return false;
+      const d = await h({ m: 'GET', p: `/messages/outbound/${arr[1]!.MessageID}/details` });
+      return field(d, 'Subject') === 'S 2';
+    }),
+  ),
+  // §9 DEMOTED from `done`: answering the vendor's approval refusal (ErrorCode 14) on
+  // /email/bulk is the twin declining to model the Bulk API, not modeling it. The behavior
+  // is still correct and still tested (postmark-twin.test.ts), but it is not coverage.
+  todo('postmark.email.bulk_requires_approval', 'email', 'Bulk API: POST /email/bulk approval gate (ErrorCode 14)', 'api', 'niche'),
+  todo('postmark.email.recipient_cap_50', 'email', 'Email: enforce the 50-recipients-per-field cap with the vendor message', 'api', 'niche'),
+  todo('postmark.email.payload_size_413', 'email', 'Email: 413 over the 10MB (single) / 50MB (batch) payload cap', 'api', 'niche'),
+  todo('postmark.email.inline_css_for_templates', 'email', 'Email: InlineCss option on templated sends', 'api', 'niche'),
+  // Grounded in the vendor's Bulk API docs page and its own error codes 12 ("Bulk send not
+  // found") and 14 ("requires approval to access") — real surface the pinned SDK does not
+  // implement. Filed as todo, and the twin answers the vendor's 14 on the two published
+  // routes only (postmark-twin.ts), so the rest of the subtree still 404s.
+  todo('postmark.email.bulk_send_lifecycle', 'email', 'Bulk API: POST /email/bulk + GET /email/bulk/{id} job lifecycle', 'api', 'niche'),
+  todo('postmark.email.smtp_transport', 'email', 'Postmark SMTP transport (smtp.postmarkapp.com) — accept mail over SMTP with the server token as the password', 'api', 'common'),
+
+  // ── Messages API (outbound activity) ─────────────────────────────────────────────
+  done('postmark.messages.outbound_list', 'messages', 'Messages: GET /messages/outbound → {TotalCount, Messages[]}', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Listed message' }) });
+      const r = await h({ m: 'GET', p: '/messages/outbound' });
+      const rows = list(r, 'Messages');
+      const row = rows.find((x) => x.MessageID === field(sent, 'MessageID'));
+      return ok(r) && field(r, 'TotalCount') === 1 && !!row && row.Subject === 'Listed message'
+        // the LIST shape deliberately omits bodies + events (the vendor's own split)
+        && row.HtmlBody === undefined && row.MessageEvents === undefined;
+    }),
+  ),
+  done('postmark.messages.outbound_recipient_shapes', 'messages', 'Messages: the vendor GENUINELY mixes recipient shapes in ONE payload — To/Cc/Bcc are [{Email,Name}] while Recipients is [string] — pinned so neither side ever "fixes" the other into consistency', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // GROUNDED twice over (2026-08-20): postmarkapp.com/developer/api/messages-api's outbound
+      // search example answers `"To":[{"Email":"john.doe@yahoo.com","Name":null}]` NEXT TO
+      // `"Recipients":["john.doe@yahoo.com"]`, and the official postmark.js SDK types the same
+      // split (`OutboundMessage.To: Recipient[]` vs `Recipients: string[]`). A blind adoption
+      // run read this as a twin bug; it is the vendor's real shape, in list AND details alike.
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'Ada L <ada@twin.test>', Cc: 'grace@twin.test' }) });
+      if (!ok(sent)) return false;
+      const listed = await h({ m: 'GET', p: '/messages/outbound' });
+      const row = list(listed, 'Messages').find((x) => x.MessageID === field(sent, 'MessageID'));
+      const details = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      const shapes = (m: Body | undefined): boolean => !!m
+        // To/Cc: arrays of {Email, Name} OBJECTS…
+        && Array.isArray(m.To) && (m.To as Body[]).length === 1
+        && (m.To as Body[])[0]!.Email === 'ada@twin.test' && (m.To as Body[])[0]!.Name === 'Ada L'
+        && Array.isArray(m.Cc) && (m.Cc as Body[])[0]!.Email === 'grace@twin.test'
+        // …while Recipients, in the SAME payload, is plain email STRINGS across To+Cc+Bcc
+        && Array.isArray(m.Recipients) && (m.Recipients as unknown[]).every((r) => typeof r === 'string')
+        && JSON.stringify(m.Recipients) === '["ada@twin.test","grace@twin.test"]';
+      return shapes(row) && shapes(details.body as Body);
+    }),
+  ),
+  done('postmark.messages.outbound_filters', 'messages', 'Messages: outbound filters (recipient/tag/subject/fromEmail/stream)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'alpha@twin.test', Tag: 'alpha', Subject: 'Alpha subject' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'beta@twin.test', Tag: 'beta', Subject: 'Beta subject' }) });
+      const byRecipient = await h({ m: 'GET', p: '/messages/outbound?recipient=alpha@twin.test' });
+      const byTag = await h({ m: 'GET', p: '/messages/outbound?tag=beta' });
+      const bySubject = await h({ m: 'GET', p: '/messages/outbound?subject=Alpha' });
+      const byStream = await h({ m: 'GET', p: '/messages/outbound?messageStream=broadcast' });
+      return field(byRecipient, 'TotalCount') === 1 && list(byRecipient, 'Messages')[0]!.Tag === 'alpha'
+        && field(byTag, 'TotalCount') === 1 && list(byTag, 'Messages')[0]!.Subject === 'Beta subject'
+        && field(bySubject, 'TotalCount') === 1
+        && field(byStream, 'TotalCount') === 0;
+    }),
+  ),
+  done('postmark.messages.outbound_pagination', 'messages', 'Messages: count/offset pagination keeps TotalCount whole', 'api', 'common', () =>
+    withRoot(async (h) => {
+      for (let i = 0; i < 3; i++) await h({ m: 'POST', p: '/email', b: mkMail({ Subject: `Page ${i}`, To: `p${i}@twin.test` }) });
+      const page = await h({ m: 'GET', p: '/messages/outbound?count=2&offset=1' });
+      return field(page, 'TotalCount') === 3 && list(page, 'Messages').length === 2;
+    }),
+  ),
+  done('postmark.messages.outbound_details', 'messages', 'Messages: GET /messages/outbound/:id/details (bodies + MessageEvents)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Detailed', TrackOpens: true }) });
+      const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+      const missing = await h({ m: 'GET', p: '/messages/outbound/00000000-0000-0000-0000-000000000000/details' });
+      const events = field(d, 'MessageEvents') as Body[];
+      return ok(d) && field(d, 'Subject') === 'Detailed'
+        && Array.isArray(events) && events.some((e) => e.Type === 'Delivered')
+        && typeof field(d, 'Body') === 'string'
+        && failedWith(missing, 422, 701);
+    }),
+  ),
+  done('postmark.messages.outbound_dump', 'messages', 'Messages: GET /messages/outbound/:id/dump → the raw source', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Dumped', TextBody: 'dump-marker' }) });
+      const dump = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/dump` });
+      const missing = await h({ m: 'GET', p: '/messages/outbound/nope/dump' });
+      const raw = String(field(dump, 'Body') ?? '');
+      return ok(dump) && raw.includes('Subject: Dumped') && raw.includes(String(field(sent, 'MessageID'))) && failedWith(missing, 422, 701);
+    }),
+  ),
+  done('postmark.messages.delivery_events', 'messages', 'Messages: the deterministic offline delivery lifecycle writes MessageEvents', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const plain = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'plain@twin.test' }) });
+      const tracked = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'tracked@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+      const a = await h({ m: 'GET', p: `/messages/outbound/${field(plain, 'MessageID')}/details` });
+      const b = await h({ m: 'GET', p: `/messages/outbound/${field(tracked, 'MessageID')}/details` });
+      const types = (r: PostmarkResponse) => (field(r, 'MessageEvents') as Body[]).map((e) => e.Type);
+      // Tracking is opt-in on Postmark: no TrackOpens ⇒ no Open event, ever.
+      return JSON.stringify(types(a)) === JSON.stringify(['Delivered'])
+        && JSON.stringify(types(b)) === JSON.stringify(['Delivered', 'Opened', 'LinkClicked']);
+    }),
+  ),
+  done('postmark.messages.opens', 'messages', 'Messages: GET /messages/outbound/opens (+ per-message)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'opener@twin.test', TrackOpens: true }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'untracked@twin.test' }) }); // no TrackOpens → no open
+      const all = await h({ m: 'GET', p: '/messages/outbound/opens' });
+      const one = await h({ m: 'GET', p: `/messages/outbound/opens/${field(sent, 'MessageID')}` });
+      const rows = list(all, 'Opens');
+      return ok(all) && field(all, 'TotalCount') === 1 && rows[0]!.RecordType === 'Open'
+        && rows[0]!.Recipient === 'opener@twin.test' && field(one, 'TotalCount') === 1;
+    }),
+  ),
+  done('postmark.messages.clicks', 'messages', 'Messages: GET /messages/outbound/clicks (+ per-message)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'clicker@twin.test', TrackLinks: 'HtmlAndText' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'nolinks@twin.test' }) });
+      const all = await h({ m: 'GET', p: '/messages/outbound/clicks' });
+      const one = await h({ m: 'GET', p: `/messages/outbound/clicks/${field(sent, 'MessageID')}` });
+      const rows = list(all, 'Clicks');
+      return ok(all) && field(all, 'TotalCount') === 1 && rows[0]!.RecordType === 'Click'
+        && rows[0]!.ClickLocation === 'HTML' && field(one, 'TotalCount') === 1;
+    }),
+  ),
+  done('postmark.messages.inbound_list', 'messages', 'Messages: GET /messages/inbound + /details', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // Seeded through the twin-only `_twin/inbound` route (real inbound mail is MX-routed and
+      // unreachable offline); the READ path under test is Postmark's real endpoint.
+      const seeded = await h({ m: 'POST', p: '/_twin/inbound', b: { From: 'reply@customer.test', Subject: 'Re: your invoice', TextBody: 'inbound-body-marker', MailboxHash: 'abc' } });
+      if (!ok(seeded)) return false;
+      const all = await h({ m: 'GET', p: '/messages/inbound' });
+      const rows = list(all, 'InboundMessages');
+      const d = await h({ m: 'GET', p: `/messages/inbound/${field(seeded, 'MessageID')}/details` });
+      const missing = await h({ m: 'GET', p: '/messages/inbound/nope/details' });
+      return field(all, 'TotalCount') === 1 && rows[0]!.Subject === 'Re: your invoice'
+        // the list shape omits bodies; details carries them
+        && rows[0]!.TextBody === undefined && field(d, 'TextBody') === 'inbound-body-marker'
+        && failedWith(missing, 422, 701);
+    }),
+  ),
+  done('postmark.messages.inbound_retry', 'messages', 'Messages: PUT /messages/inbound/:id/retry re-queues, bypass 422s on a non-blocked message', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const seeded = await h({ m: 'POST', p: '/_twin/inbound', b: { Subject: 'Retryable' } });
+      const id = field(seeded, 'MessageID');
+      const retried = await h({ m: 'PUT', p: `/messages/inbound/${id}/retry` });
+      const after = await h({ m: 'GET', p: `/messages/inbound/${id}/details` });
+      // Only a BLOCKED message can be bypassed — this one is Processed, so the vendor 422s.
+      const bypass = await h({ m: 'PUT', p: `/messages/inbound/${id}/bypass` });
+      return ok(retried) && errorCode(retried) === 0 && field(after, 'Status') === 'Queued' && failedWith(bypass, 422, 701);
+    }),
+  ),
+  todo('postmark.messages.inbound_ingest', 'messages', 'Messages: real inbound ingestion via the server inbound address/webhook', 'api', 'common'),
+  todo('postmark.messages.outbound_date_filters', 'messages', 'Messages: fromDate/toDate filtering on outbound activity', 'api', 'niche'),
+  todo('postmark.messages.tracking_client_filters', 'messages', 'Messages: opens/clicks filtering by client/OS/platform/geo', 'api', 'niche'),
+
+  // ── Bounce API ───────────────────────────────────────────────────────────────────
+  done('postmark.bounces.recorded_on_bounce', 'bounces', 'Bounces: a bounced send mints a real Bounce record', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-hard@twin.test', Subject: 'Bounced subject' }) });
+      const r = await h({ m: 'GET', p: '/bounces' });
+      const b = list(r, 'Bounces')[0];
+      return ok(r) && field(r, 'TotalCount') === 1 && !!b
+        && b.Type === 'HardBounce' && b.TypeCode === 1 && b.Email === 'bounce-hard@twin.test'
+        && b.MessageID === field(sent, 'MessageID') && b.Inactive === true && b.Subject === 'Bounced subject';
+    }),
+  ),
+  done('postmark.bounces.spam_complaint', 'bounces', 'Bounces: a spam complaint is recorded and is NOT reactivatable', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-reporter@twin.test' }) });
+      const r = await h({ m: 'GET', p: '/bounces' });
+      const b = list(r, 'Bounces')[0]!;
+      const activate = await h({ m: 'PUT', p: `/bounces/${b.ID}/activate` });
+      return b.Type === 'SpamComplaint' && b.TypeCode === 100001 && b.CanActivate === false
+        && failedWith(activate, 422, 1003);
+    }),
+  ),
+  done('postmark.bounces.retrieve', 'bounces', 'Bounces: GET /bounces/:id + 422 ErrorCode 1001 for an unknown id', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-one@twin.test' }) });
+      const one = await h({ m: 'GET', p: '/bounces/1' });
+      const missing = await h({ m: 'GET', p: '/bounces/9999' });
+      return ok(one) && field(one, 'ID') === 1 && field(one, 'Email') === 'bounce-one@twin.test'
+        && field(one, 'RecordType') === 'Bounce' && failedWith(missing, 422, 1001);
+    }),
+  ),
+  done('postmark.bounces.list_filters', 'bounces', 'Bounces: filter by type/emailFilter/inactive', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-a@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-b@twin.test' }) });
+      const hard = await h({ m: 'GET', p: '/bounces?type=HardBounce' });
+      const byEmail = await h({ m: 'GET', p: '/bounces?emailFilter=spam-b' });
+      return field(hard, 'TotalCount') === 1 && list(hard, 'Bounces')[0]!.Email === 'bounce-a@twin.test'
+        && field(byEmail, 'TotalCount') === 1 && list(byEmail, 'Bounces')[0]!.Type === 'SpamComplaint';
+    }),
+  ),
+  done('postmark.bounces.dump', 'bounces', 'Bounces: GET /bounces/:id/dump → the raw bounce body', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-dump@twin.test' }) });
+      const dump = await h({ m: 'GET', p: '/bounces/1/dump' });
+      const missing = await h({ m: 'GET', p: '/bounces/42/dump' });
+      return ok(dump) && String(field(dump, 'Body')).includes('Undelivered Mail') && failedWith(missing, 422, 1001);
+    }),
+  ),
+  done('postmark.bounces.activate_restores_sending', 'bounces', 'Bounces: PUT /bounces/:id/activate clears the suppression (dirty state)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // A DIRTY-STATE capability spanning three writes: bounce → refusal → reactivate → send.
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-again@twin.test' }) });
+      const refused = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-again@twin.test' }) });
+      if (!failedWith(refused, 422, 406)) return false;
+      const activated = await h({ m: 'PUT', p: '/bounces/1/activate' });
+      if (!ok(activated) || (field(activated, 'Bounce') as Body)?.Inactive !== false) return false;
+      // Reactivation clears the suppression…
+      const dump = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' });
+      if (list(dump, 'Suppressions').length !== 0) return false;
+      // …so the address is accepted again. (It re-bounces immediately — that is correct: the
+      // twin's bounce simulator is recipient-driven — so a SECOND bounce row is now minted,
+      // which is exactly what a reactivated-then-still-bad address does on the real vendor.)
+      const resent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-again@twin.test' }) });
+      const bounces = await h({ m: 'GET', p: '/bounces' });
+      return ok(resent) && errorCode(resent) === 0 && field(bounces, 'TotalCount') === 2
+        && list(bounces, 'Bounces').map((b) => b.ID).sort().join(',') === '1,2';
+    }),
+  ),
+  done('postmark.bounces.delivery_stats', 'bounces', 'Bounces: GET /deliverystats aggregates real twin bounces', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const before = await h({ m: 'GET', p: '/deliverystats' });
+      if (field(before, 'InactiveMails') !== 0 || (field(before, 'Bounces') as Body[])[0]!.Count !== 0) return false;
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-x@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-y@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-z@twin.test' }) });
+      const after = await h({ m: 'GET', p: '/deliverystats' });
+      const rows = field(after, 'Bounces') as Body[];
+      const all = rows[0]!;
+      const hard = rows.find((x) => x.Type === 'HardBounce');
+      const spam = rows.find((x) => x.Type === 'SpamComplaint');
+      // The vendor's first row is the "All" total and carries NO Type key.
+      return field(after, 'InactiveMails') === 3 && all.Name === 'All' && all.Count === 3 && all.Type === undefined
+        && hard?.Count === 2 && spam?.Count === 1;
+    }),
+  ),
+  todo('postmark.bounces.date_filters', 'bounces', 'Bounces: fromDate/toDate + messageStream filtering', 'api', 'niche'),
+  todo('postmark.bounces.soft_bounce_types', 'bounces', 'Bounces: the full BounceType taxonomy (Transient, DnsError, DMARCPolicy, …)', 'api', 'common'),
+
+  // ── Templates API ────────────────────────────────────────────────────────────────
+  done('postmark.templates.create', 'templates', 'Templates: POST /templates → the short create shape', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/templates', b: { Name: 'Receipt', Alias: 'receipt', Subject: 'Your receipt', HtmlBody: '<p>Thanks</p>' } });
+      return ok(r) && field(r, 'TemplateId') === 1 && field(r, 'Name') === 'Receipt'
+        && field(r, 'Alias') === 'receipt' && field(r, 'Active') === true
+        && field(r, 'TemplateType') === 'Standard'
+        // the CREATE response is the short shape — no bodies (SDK: TemplateInList)
+        && field(r, 'HtmlBody') === undefined;
+    }),
+  ),
+  done('postmark.templates.retrieve_by_id_or_alias', 'templates', 'Templates: GET /templates/:idOrAlias resolves both ways', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const c = await h({ m: 'POST', p: '/templates', b: { Name: 'Both', Alias: 'both-ways', Subject: 'S', TextBody: 'T' } });
+      const byId = await h({ m: 'GET', p: `/templates/${field(c, 'TemplateId')}` });
+      const byAlias = await h({ m: 'GET', p: '/templates/both-ways' });
+      const missing = await h({ m: 'GET', p: '/templates/nope' });
+      return ok(byId) && field(byId, 'Subject') === 'S' && field(byId, 'TextBody') === 'T'
+        && field(byAlias, 'TemplateId') === field(byId, 'TemplateId')
+        && failedWith(missing, 422, 1101);
+    }),
+  ),
+  done('postmark.templates.list', 'templates', 'Templates: GET /templates → {TotalCount, Templates[]} (short shape)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/templates', b: { Name: 'One', Alias: 'one', Subject: 'S1', TextBody: 'T1' } });
+      await h({ m: 'POST', p: '/templates', b: { Name: 'Layout', TemplateType: 'Layout', HtmlBody: '{{{ @content }}}' } });
+      const all = await h({ m: 'GET', p: '/templates' });
+      const layouts = await h({ m: 'GET', p: '/templates?templateType=Layout' });
+      const rows = list(all, 'Templates');
+      return field(all, 'TotalCount') === 2 && rows[0]!.Name === 'One' && rows[0]!.Subject === undefined
+        && field(layouts, 'TotalCount') === 1 && list(layouts, 'Templates')[0]!.Name === 'Layout';
+    }),
+  ),
+  done('postmark.templates.update', 'templates', 'Templates: PUT /templates/:idOrAlias edits content', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/templates', b: { Name: 'Editable', Alias: 'editable', Subject: 'Before', TextBody: 'before' } });
+      const upd = await h({ m: 'PUT', p: '/templates/editable', b: { Subject: 'After', TextBody: 'after' } });
+      const got = await h({ m: 'GET', p: '/templates/editable' });
+      const missing = await h({ m: 'PUT', p: '/templates/nope', b: { Subject: 'x' } });
+      const noData = await h({ m: 'PUT', p: '/templates/editable', b: {} });
+      return ok(upd) && field(got, 'Subject') === 'After' && field(got, 'TextBody') === 'after'
+        && failedWith(missing, 422, 1101) && failedWith(noData, 422, 1109);
+    }),
+  ),
+  done('postmark.templates.delete', 'templates', 'Templates: DELETE /templates/:idOrAlias', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/templates', b: { Name: 'Doomed', Alias: 'doomed', Subject: 'S', TextBody: 'T' } });
+      const del = await h({ m: 'DELETE', p: '/templates/doomed' });
+      const after = await h({ m: 'GET', p: '/templates/doomed' });
+      const listed = await h({ m: 'GET', p: '/templates' });
+      const again = await h({ m: 'DELETE', p: '/templates/doomed' });
+      return ok(del) && errorCode(del) === 0 && failedWith(after, 422, 1101)
+        && field(listed, 'TotalCount') === 0 && failedWith(again, 422, 1101);
+    }),
+  ),
+  done('postmark.templates.id_ratchet_after_delete', 'templates', 'Templates: a deleted TemplateId is never re-issued (dirty state)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // DIRTY-STATE: the id mint must count TOMBSTONES, not just live rows. A naive
+      // `liveRows.length + 1` re-issues id 1 here and silently aliases a retired template.
+      const first = await h({ m: 'POST', p: '/templates', b: { Name: 'First', Alias: 'first', Subject: 'S', TextBody: 'T' } });
+      await h({ m: 'DELETE', p: '/templates/first' });
+      const second = await h({ m: 'POST', p: '/templates', b: { Name: 'Second', Alias: 'second', Subject: 'S2', TextBody: 'T2' } });
+      const got = await h({ m: 'GET', p: `/templates/${field(second, 'TemplateId')}` });
+      const oldId = await h({ m: 'GET', p: `/templates/${field(first, 'TemplateId')}` });
+      return field(first, 'TemplateId') === 1 && field(second, 'TemplateId') === 2
+        && field(got, 'Name') === 'Second' && failedWith(oldId, 422, 1101);
+    }),
+  ),
+  done('postmark.templates.alias_uniqueness', 'templates', 'Templates: a duplicate Alias is rejected', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/templates', b: { Name: 'A', Alias: 'shared', Subject: 'S', TextBody: 'T' } });
+      const dup = await h({ m: 'POST', p: '/templates', b: { Name: 'B', Alias: 'shared', Subject: 'S', TextBody: 'T' } });
+      const listed = await h({ m: 'GET', p: '/templates' });
+      return dup.status === 422 && String(field(dup, 'Message')).includes('shared') && field(listed, 'TotalCount') === 1;
+    }),
+  ),
+  done('postmark.templates.validate', 'templates', 'Templates: POST /templates/validate renders + suggests a model', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/templates/validate', b: {
+        Subject: 'Hi {{ name }}', HtmlBody: '<p>{{ product.title }}</p>', TextBody: 'plain',
+        TestRenderModel: { name: 'Ada', product: { title: 'Widget' } },
+      } });
+      const html = field(r, 'HtmlBody') as Body;
+      const suggested = field(r, 'SuggestedTemplateModel') as Body;
+      const broken = await h({ m: 'POST', p: '/templates/validate', b: { Subject: 'S', HtmlBody: '<p>{{ unterminated', TestRenderModel: {} } });
+      return ok(r) && field(r, 'AllContentIsValid') === true
+        && html.RenderedContent === '<p>Widget</p>'
+        && (field(r, 'Subject') as Body).RenderedContent === 'Hi Ada'
+        && suggested.name === 'name_Value' && suggested.product === 'product_Value'
+        && field(broken, 'AllContentIsValid') === false;
+    }),
+  ),
+  done('postmark.templates.create_validation', 'templates', 'Templates: 422 ErrorCode 1109 without a Name', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/templates', b: { Subject: 'S', TextBody: 'T' } });
+      return failedWith(r, 422, 1109);
+    }),
+  ),
+  todo('postmark.templates.push', 'templates', 'Templates: PUT /templates/push between servers (account token)', 'api', 'niche'),
+  todo('postmark.templates.layout_composition', 'templates', 'Templates: Layout templates composed into a Standard template ({{{ @content }}})', 'api', 'common'),
+  todo('postmark.templates.mustachio_blocks', 'templates', 'Templates: full Mustachio — {{#each}} / {{#if}} blocks and inverted sections', 'api', 'common'),
+  todo('postmark.templates.active_limit', 'templates', 'Templates: the per-server active-template limit (ErrorCode 1105)', 'api', 'niche'),
+
+  // ── Message Streams API ──────────────────────────────────────────────────────────
+  done('postmark.streams.default_streams', 'streams', 'Streams: a server is born with outbound/broadcast/inbound', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: '/message-streams' });
+      const rows = list(r, 'MessageStreams');
+      const byId = Object.fromEntries(rows.map((s) => [s.ID, s]));
+      // NB: this is the one list endpoint where the vendor emits TotalCount LAST.
+      return ok(r) && field(r, 'TotalCount') === 3
+        && byId.outbound?.MessageStreamType === 'Transactional'
+        && byId.broadcast?.MessageStreamType === 'Broadcast'
+        && byId.broadcast?.SubscriptionManagementConfiguration?.UnsubscribeHandlingType === 'Postmark'
+        && byId.inbound?.MessageStreamType === 'Inbound';
+    }),
+  ),
+  done('postmark.streams.create', 'streams', 'Streams: POST /message-streams', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/message-streams', b: { ID: 'newsletters', Name: 'Newsletters', MessageStreamType: 'Broadcast', Description: 'Weekly' } });
+      const got = await h({ m: 'GET', p: '/message-streams/newsletters' });
+      return ok(r) && field(r, 'ID') === 'newsletters' && field(r, 'ServerID') === 1
+        && field(got, 'Name') === 'Newsletters' && field(got, 'Description') === 'Weekly'
+        && field(got, 'MessageStreamType') === 'Broadcast' && field(got, 'ArchivedAt') === null;
+    }),
+  ),
+  done('postmark.streams.create_validation', 'streams', 'Streams: the vendor 422s for a bad ID / type / name / duplicate', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const badId = await h({ m: 'POST', p: '/message-streams', b: { ID: '9bad id', Name: 'X', MessageStreamType: 'Broadcast' } });
+      const reserved = await h({ m: 'POST', p: '/message-streams', b: { ID: 'pm-thing', Name: 'X', MessageStreamType: 'Broadcast' } });
+      const dup = await h({ m: 'POST', p: '/message-streams', b: { ID: 'outbound', Name: 'X', MessageStreamType: 'Transactional' } });
+      const badType = await h({ m: 'POST', p: '/message-streams', b: { ID: 'okid', Name: 'X', MessageStreamType: 'Nonsense' } });
+      const noName = await h({ m: 'POST', p: '/message-streams', b: { ID: 'okid2', MessageStreamType: 'Broadcast' } });
+      return failedWith(badId, 422, 1227) && failedWith(reserved, 422, 1233) && failedWith(dup, 422, 1230)
+        && failedWith(badType, 422, 1221) && failedWith(noName, 422, 1223);
+    }),
+  ),
+  done('postmark.streams.retrieve_and_edit', 'streams', 'Streams: GET/PATCH /message-streams/:id (+ 422 ErrorCode 1226)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const upd = await h({ m: 'PATCH', p: '/message-streams/broadcast', b: { Name: 'Renamed Broadcast', Description: 'Edited' } });
+      const got = await h({ m: 'GET', p: '/message-streams/broadcast' });
+      const missing = await h({ m: 'GET', p: '/message-streams/nope' });
+      const missingPatch = await h({ m: 'PATCH', p: '/message-streams/nope', b: { Name: 'x' } });
+      return ok(upd) && field(got, 'Name') === 'Renamed Broadcast' && field(got, 'Description') === 'Edited'
+        && typeof field(got, 'UpdatedAt') === 'string'
+        && failedWith(missing, 422, 1226) && failedWith(missingPatch, 422, 1226);
+    }),
+  ),
+  done('postmark.streams.archive_unarchive', 'streams', 'Streams: archive hides a stream from the list; unarchive restores it', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/message-streams', b: { ID: 'temp', Name: 'Temp', MessageStreamType: 'Broadcast' } });
+      const arch = await h({ m: 'POST', p: '/message-streams/temp/archive' });
+      const listed = await h({ m: 'GET', p: '/message-streams' });
+      const withArchived = await h({ m: 'GET', p: '/message-streams?includeArchivedStreams=true' });
+      const un = await h({ m: 'POST', p: '/message-streams/temp/unarchive' });
+      const after = await h({ m: 'GET', p: '/message-streams' });
+      return ok(arch) && typeof field(arch, 'ExpectedPurgeDate') === 'string'
+        && !list(listed, 'MessageStreams').some((s) => s.ID === 'temp')
+        && list(withArchived, 'MessageStreams').some((s) => s.ID === 'temp')
+        && ok(un) && field(un, 'ArchivedAt') === null
+        && list(after, 'MessageStreams').some((s) => s.ID === 'temp');
+    }),
+  ),
+  done('postmark.streams.archive_guards', 'streams', 'Streams: the default transactional/inbound streams cannot be archived', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const outbound = await h({ m: 'POST', p: '/message-streams/outbound/archive' });
+      const inbound = await h({ m: 'POST', p: '/message-streams/inbound/archive' });
+      const unarchiveLive = await h({ m: 'POST', p: '/message-streams/broadcast/unarchive' });
+      const stillThere = await h({ m: 'GET', p: '/message-streams/outbound' });
+      const stillLive = await h({ m: 'GET', p: '/message-streams/broadcast' });
+      // §9: the two archive guards pin the vendor's PUBLISHED code (1229). The
+      // unarchive-a-live-stream refusal does NOT — the published table has no entry for it
+      // (see postmark-twin.ts), so pinning a number there would pin an invention. Assert the
+      // 422 and that the refusal genuinely enacted nothing instead.
+      return failedWith(outbound, 422, 1229) && failedWith(inbound, 422, 1229)
+        && unarchiveLive.status === 422 && field(stillLive, 'ArchivedAt') === null
+        && ok(stillThere) && field(stillThere, 'ArchivedAt') === null;
+    }),
+  ),
+  done('postmark.streams.type_filter', 'streams', 'Streams: filter the list by messageStreamType', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const broadcast = await h({ m: 'GET', p: '/message-streams?messageStreamType=Broadcast' });
+      const all = await h({ m: 'GET', p: '/message-streams?messageStreamType=All' });
+      return field(broadcast, 'TotalCount') === 1 && list(broadcast, 'MessageStreams')[0]!.ID === 'broadcast'
+        && field(all, 'TotalCount') === 3;
+    }),
+  ),
+  todo('postmark.streams.custom_unsubscribe_handling', 'streams', 'Streams: Custom/Postmark UnsubscribeHandlingType semantics on broadcast sends', 'api', 'common'),
+  todo('postmark.streams.purge_after_archive', 'streams', 'Streams: the 45-day purge window actually retiring an archived stream', 'api', 'niche'),
+
+  // ── Suppressions API ─────────────────────────────────────────────────────────────
+  done('postmark.suppressions.add', 'suppressions', 'Suppressions: POST /message-streams/:id/suppressions', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'optout@twin.test' }, { EmailAddress: 'garbage' }] } });
+      const rows = list(r, 'Suppressions');
+      return ok(r) && rows[0]!.EmailAddress === 'optout@twin.test' && rows[0]!.Status === 'Suppressed'
+        && rows[1]!.Status === 'Failed' && String(rows[1]!.Message).includes('invalid email');
+    }),
+  ),
+  done('postmark.suppressions.dump', 'suppressions', 'Suppressions: GET /message-streams/:id/suppressions/dump (+ filters)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'manual@twin.test' }] } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-sup@twin.test' }) });
+      const all = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' });
+      const manualOnly = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump?suppressionReason=ManualSuppression' });
+      const missingStream = await h({ m: 'GET', p: '/message-streams/nope/suppressions/dump' });
+      const rows = list(all, 'Suppressions');
+      return rows.length === 2
+        && rows.some((s) => s.EmailAddress === 'manual@twin.test' && s.SuppressionReason === 'ManualSuppression' && s.Origin === 'Customer')
+        && rows.some((s) => s.EmailAddress === 'bounce-sup@twin.test' && s.SuppressionReason === 'HardBounce' && s.Origin === 'Recipient')
+        && list(manualOnly, 'Suppressions').length === 1
+        && failedWith(missingStream, 422, 1226);
+    }),
+  ),
+  done('postmark.suppressions.blocks_sending', 'suppressions', 'Suppressions: a manual suppression blocks a later send (dirty state)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const before = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'later-optout@twin.test' }) });
+      await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'later-optout@twin.test' }] } });
+      const after = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'later-optout@twin.test' }) });
+      return ok(before) && failedWith(after, 422, 406);
+    }),
+  ),
+  done('postmark.suppressions.stream_scoped', 'suppressions', 'Suppressions: a suppression is scoped to ONE message stream', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'scoped@twin.test' }] } });
+      const blocked = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'scoped@twin.test' }) });
+      const allowed = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'scoped@twin.test', MessageStream: 'broadcast' }) });
+      const otherDump = await h({ m: 'GET', p: '/message-streams/broadcast/suppressions/dump' });
+      return failedWith(blocked, 422, 406) && ok(allowed) && list(otherDump, 'Suppressions').length === 0;
+    }),
+  ),
+  done('postmark.suppressions.delete_manual_only', 'suppressions', 'Suppressions: POST …/suppressions/delete removes MANUAL entries only (dirty state)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // DIRTY-STATE: a bounce-born suppression must NOT be deletable through this endpoint —
+      // Postmark requires the Bounce API's activate for that. Both entries exist first.
+      await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'manual-del@twin.test' }] } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-del@twin.test' }) });
+      const r = await h({ m: 'POST', p: '/message-streams/outbound/suppressions/delete', b: { Suppressions: [{ EmailAddress: 'manual-del@twin.test' }, { EmailAddress: 'bounce-del@twin.test' }] } });
+      const rows = list(r, 'Suppressions');
+      const dump = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' });
+      const remaining = list(dump, 'Suppressions');
+      const noBody = await h({ m: 'POST', p: '/message-streams/outbound/suppressions/delete', b: {} });
+      return rows[0]!.Status === 'Deleted' && rows[1]!.Status === 'Failed'
+        && remaining.length === 1 && remaining[0]!.EmailAddress === 'bounce-del@twin.test'
+        && failedWith(noBody, 422, 1409);
+    }),
+  ),
+  todo('postmark.suppressions.origin_filters', 'suppressions', 'Suppressions: filter the dump by Origin/date range', 'api', 'niche'),
+  todo('postmark.suppressions.bulk_limit', 'suppressions', 'Suppressions: the per-request maximum-entries guard (ErrorCode 1410)', 'api', 'niche'),
+
+  // ── Webhooks API + webhook DELIVERY ──────────────────────────────────────────────
+  done('postmark.webhooks.create', 'webhooks', 'Webhooks: POST /webhooks with Triggers/HttpAuth/HttpHeaders', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/webhooks', b: {
+        Url: 'https://app.test/hook', MessageStream: 'outbound',
+        HttpAuth: { Username: 'u', Password: 'p' },
+        HttpHeaders: [{ Name: 'X-Secret', Value: 's3cret' }],
+        Triggers: { Delivery: { Enabled: true }, Open: { Enabled: true, PostFirstOpenOnly: true } },
+      } });
+      const t = field(r, 'Triggers') as Body;
+      return ok(r) && field(r, 'ID') === 1 && field(r, 'Url') === 'https://app.test/hook'
+        && t.Delivery.Enabled === true && t.Open.PostFirstOpenOnly === true
+        // omitted triggers are defaulted OFF, not dropped
+        && t.Bounce.Enabled === false && t.SubscriptionChange.Enabled === false
+        && (field(r, 'HttpAuth') as Body).Username === 'u';
+    }),
+  ),
+  done('postmark.webhooks.crud', 'webhooks', 'Webhooks: GET/PUT/DELETE /webhooks/:id (+ 422 ErrorCode 1352)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/one', Triggers: { Delivery: { Enabled: true } } } });
+      const got = await h({ m: 'GET', p: '/webhooks/1' });
+      const upd = await h({ m: 'PUT', p: '/webhooks/1', b: { Url: 'https://app.test/updated' } });
+      const after = await h({ m: 'GET', p: '/webhooks/1' });
+      const listed = await h({ m: 'GET', p: '/webhooks' });
+      const del = await h({ m: 'DELETE', p: '/webhooks/1' });
+      const gone = await h({ m: 'GET', p: '/webhooks/1' });
+      return ok(got) && field(upd, 'Url') === 'https://app.test/updated' && field(after, 'Url') === 'https://app.test/updated'
+        // the webhooks collection is the one list with NO TotalCount
+        && list(listed, 'Webhooks').length === 1 && field(listed, 'TotalCount') === undefined
+        && ok(del) && failedWith(gone, 422, 1352);
+    }),
+  ),
+  done('postmark.webhooks.create_validation', 'webhooks', 'Webhooks: 422 ErrorCode 1354 without a Url; 1226/1350 for a bad stream', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const noUrl = await h({ m: 'POST', p: '/webhooks', b: { Triggers: { Delivery: { Enabled: true } } } });
+      const badStream = await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/x', MessageStream: 'nope' } });
+      await h({ m: 'POST', p: '/message-streams', b: { ID: 'archived', Name: 'Arch', MessageStreamType: 'Broadcast' } });
+      await h({ m: 'POST', p: '/message-streams/archived/archive' });
+      const onArchived = await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/x', MessageStream: 'archived' } });
+      return failedWith(noUrl, 422, 1354) && failedWith(badStream, 422, 1226) && failedWith(onArchived, 422, 1350);
+    }),
+  ),
+  done('postmark.webhooks.delivery_payload', 'webhooks', 'Webhooks: a send POSTs the vendor Delivery payload to a subscriber', 'api', 'core', () =>
+    withWebhookCapture(async (h, seen) => {
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/hook', Triggers: { Delivery: { Enabled: true } } } });
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'hooked@twin.test', Tag: 'hooked' }) });
+      const d = seen.find((x) => x.body.RecordType === 'Delivery');
+      return seen.length === 1 && !!d && d.url === 'https://app.test/hook'
+        && d.body.MessageID === field(sent, 'MessageID') && d.body.Recipient === 'hooked@twin.test'
+        && d.body.Tag === 'hooked' && d.body.MessageStream === 'outbound' && typeof d.body.DeliveredAt === 'string';
+    }),
+  ),
+  done('postmark.webhooks.trigger_gating', 'webhooks', 'Webhooks: only ENABLED triggers fire (per RecordType)', 'api', 'core', () =>
+    withWebhookCapture(async (h, seen) => {
+      // Bounce-only subscriber: it must NOT see the Delivery/Open of a healthy send, but it
+      // MUST see the Bounce of a bouncing one.
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/bounces', Triggers: { Bounce: { Enabled: true } } } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'fine@twin.test', TrackOpens: true }) });
+      const quietSoFar = seen.length;
+      if (quietSoFar !== 0) return false;
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-hook@twin.test' }) });
+      return seen.length === 1 && seen[0]!.body.RecordType === 'Bounce'
+        && seen[0]!.body.Email === 'bounce-hook@twin.test' && seen[0]!.body.Type === 'HardBounce'
+        && typeof seen[0]!.body.ID === 'number';
+    }),
+  ),
+  done('postmark.webhooks.open_click_payloads', 'webhooks', 'Webhooks: Open + Click payloads carry the vendor tracking fields', 'api', 'common', () =>
+    withWebhookCapture(async (h, seen) => {
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/track', Triggers: { Open: { Enabled: true }, Click: { Enabled: true } } } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'tracked@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+      const open = seen.find((x) => x.body.RecordType === 'Open');
+      const click = seen.find((x) => x.body.RecordType === 'Click');
+      return seen.length === 2 && !!open && !!click
+        && open.body.FirstOpen === true && typeof open.body.ReadSeconds === 'number' && open.body.Client?.Name === 'Twin Mail'
+        && click.body.ClickLocation === 'HTML' && typeof click.body.OriginalLink === 'string';
+    }),
+  ),
+  done('postmark.webhooks.basic_auth_and_headers', 'webhooks', 'Webhooks: HttpAuth → Basic header, HttpHeaders → custom headers (NOT a signature)', 'api', 'common', () =>
+    withWebhookCapture(async (h, seen) => {
+      // Postmark does NOT sign webhooks. Its two real authentication affordances are Basic
+      // auth and caller-chosen headers — asserted here so nobody "adds a signature" later.
+      await h({ m: 'POST', p: '/webhooks', b: {
+        Url: 'https://app.test/secure',
+        HttpAuth: { Username: 'hookuser', Password: 'hookpass' },
+        HttpHeaders: [{ Name: 'X-Shared-Secret', Value: 'sh4red' }],
+        Triggers: { Delivery: { Enabled: true } },
+      } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'secure@twin.test' }) });
+      const got = seen[0];
+      const expected = `Basic ${Buffer.from('hookuser:hookpass').toString('base64')}`;
+      return seen.length === 1 && got!.headers.Authorization === expected
+        && got!.headers['X-Shared-Secret'] === 'sh4red'
+        && got!.headers['content-type'] === 'application/json'
+        // …and NOTHING signature-shaped is invented.
+        && !Object.keys(got!.headers).some((k) => /signature|svix/i.test(k));
+    }),
+  ),
+  done('postmark.webhooks.stream_scoped', 'webhooks', 'Webhooks: a subscriber only sees ITS OWN message stream', 'api', 'common', () =>
+    withWebhookCapture(async (h, seen) => {
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/broadcast-only', MessageStream: 'broadcast', Triggers: { Delivery: { Enabled: true } } } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'tx@twin.test' }) }); // outbound → not delivered
+      const quietSoFar = seen.length;
+      if (quietSoFar !== 0) return false;
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bc@twin.test', MessageStream: 'broadcast' }) });
+      return seen.length === 1 && seen[0]!.body.MessageStream === 'broadcast';
+    }),
+  ),
+  done('postmark.webhooks.deleted_stops_firing', 'webhooks', 'Webhooks: a DELETED webhook stops receiving events (dirty state)', 'api', 'common', () =>
+    withWebhookCapture(async (h, seen) => {
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/short-lived', Triggers: { Delivery: { Enabled: true } } } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'one@twin.test' }) });
+      if (seen.length !== 1) return false;
+      await h({ m: 'DELETE', p: '/webhooks/1' });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'two@twin.test' }) });
+      return seen.length === 1; // the tombstoned subscriber is genuinely gone from the fan-out
+    }),
+  ),
+  // GROUNDING NOTE (a §9 review flagged these two as possibly-fabricated because the
+  // official SDK has neither — the SDK's webhook surface is list/get/create/edit/delete only).
+  // They are REAL but NEWER than the pinned SDK v4.0.7: both appear in the vendor's published
+  // Webhooks API nav, and the error table's "Webhooks API — new" block carries code 1364,
+  // "Webhook verification failed; nothing was saved. Fix the endpoint and retry, or send
+  // ?verify=false to save it unverified" — which only makes sense with a verify feature.
+  // Keep them; the SDK lagging the API is not evidence the API lacks them.
+  todo('postmark.webhooks.verify_endpoint', 'webhooks', 'Webhooks: POST /webhooks/:id/verify (endpoint reachability check)', 'api', 'niche'),
+  todo('postmark.webhooks.statistics', 'webhooks', 'Webhooks: GET /webhooks/:id/statistics (delivery success/failure counts)', 'api', 'niche'),
+  todo('postmark.webhooks.subscription_change', 'webhooks', 'Webhooks: SubscriptionChange payloads on broadcast unsubscribes', 'api', 'common'),
+  todo('postmark.webhooks.inbound_payload', 'webhooks', 'Webhooks: the Inbound RecordType payload delivered to InboundHookUrl', 'api', 'common'),
+  todo('postmark.webhooks.retry_schedule', 'webhooks', "Webhooks: Postmark's retry schedule for a failing endpoint", 'api', 'niche'),
+
+  // ── Server API ───────────────────────────────────────────────────────────────────
+  done('postmark.server.retrieve', 'server', 'Server: GET /server', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: '/server' });
+      return ok(r) && field(r, 'ID') === 1 && typeof field(r, 'Name') === 'string'
+        && field(r, 'DeliveryType') === 'Live' && Array.isArray(field(r, 'ApiTokens'))
+        && field(r, 'TrackLinks') === 'None' && typeof field(r, 'InboundAddress') === 'string';
+    }),
+  ),
+  done('postmark.server.edit', 'server', 'Server: PUT /server updates the modeled settings', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const upd = await h({ m: 'PUT', p: '/server', b: { Name: 'Renamed Server', TrackOpens: true, TrackLinks: 'HtmlOnly', Color: 'red' } });
+      const got = await h({ m: 'GET', p: '/server' });
+      const noData = await h({ m: 'PUT', p: '/server', b: {} });
+      return ok(upd) && field(got, 'Name') === 'Renamed Server' && field(got, 'TrackOpens') === true
+        && field(got, 'TrackLinks') === 'HtmlOnly' && field(got, 'Color') === 'red'
+        && failedWith(noData, 422, 609);
+    }),
+  ),
+  done('postmark.servers.crud', 'servers', 'Servers: account-level CRUD (GET/POST/PUT/DELETE /servers)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const created = await h({ m: 'POST', p: '/servers', b: { Name: 'Staging', Color: 'green' } });
+      const id = field(created, 'ID');
+      const listed = await h({ m: 'GET', p: '/servers' });
+      const got = await h({ m: 'GET', p: `/servers/${id}` });
+      const upd = await h({ m: 'PUT', p: `/servers/${id}`, b: { Name: 'Staging 2' } });
+      const del = await h({ m: 'DELETE', p: `/servers/${id}` });
+      const gone = await h({ m: 'GET', p: `/servers/${id}` });
+      return id === 2 && field(got, 'Name') === 'Staging' && field(got, 'Color') === 'green'
+        && field(listed, 'TotalCount') === 2 && field(upd, 'Name') === 'Staging 2'
+        // §9: was `gone.status === 422` alone, which hid a wrong ErrorCode (608, "name invalid
+        // or missing") on a NOT-FOUND path. Pin the vendor's real server-not-found code.
+        && ok(del) && failedWith(gone, 422, 1453);
+    }),
+  ),
+  done('postmark.servers.name_uniqueness', 'servers', 'Servers: 422 ErrorCode 603 on a duplicate server name', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/servers', b: { Name: 'Unique' } });
+      const dup = await h({ m: 'POST', p: '/servers', b: { Name: 'Unique' } });
+      const noName = await h({ m: 'POST', p: '/servers', b: {} });
+      return failedWith(dup, 422, 603) && failedWith(noName, 422, 608);
+    }),
+  ),
+  todo('postmark.server.hook_url_validation', 'server', 'Server: reject an invalid hook URL (ErrorCode 606)', 'api', 'niche'),
+  todo('postmark.server.smtp_tokens', 'server', 'Server: the SMTP Tokens surface (error codes 1450-1460)', 'api', 'niche'),
+  todo('postmark.servers.inbound_domain_binding', 'servers', 'Servers: inbound-domain registration + its uniqueness rules', 'api', 'niche'),
+
+  // ── Stats API ────────────────────────────────────────────────────────────────────
+  done('postmark.stats.outbound_overview', 'stats', 'Stats: GET /stats/outbound computed from real twin messages', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const empty = await h({ m: 'GET', p: '/stats/outbound' });
+      if (field(empty, 'Sent') !== 0 || field(empty, 'BounceRate') !== 0) return false;
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'a@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'b@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-stat@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-stat@twin.test' }) });
+      const r = await h({ m: 'GET', p: '/stats/outbound' });
+      return ok(r) && field(r, 'Sent') === 4 && field(r, 'Bounced') === 1 && field(r, 'SpamComplaints') === 1
+        && field(r, 'Opens') === 1 && field(r, 'TotalClicks') === 1
+        && field(r, 'WithOpenTracking') === 1 && field(r, 'WithLinkTracking') === 1
+        && field(r, 'BounceRate') === 25 && field(r, 'SpamComplaintsRate') === 25;
+    }),
+  ),
+  done('postmark.stats.sends_by_day', 'stats', 'Stats: GET /stats/outbound/sends → {Days:[{Date,Sent}], Sent}', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'd1@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'd2@twin.test' }) });
+      const r = await h({ m: 'GET', p: '/stats/outbound/sends' });
+      const days = field(r, 'Days') as Body[];
+      return ok(r) && field(r, 'Sent') === 2 && days.length === 1
+        && days[0]!.Sent === 2 && /^\d{4}-\d{2}-\d{2}$/.test(String(days[0]!.Date));
+    }),
+  ),
+  done('postmark.stats.bounces_spam_tracked', 'stats', 'Stats: /bounces, /spam and /tracked per-day counts', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-s@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-s@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'ok-s@twin.test', TrackOpens: true }) });
+      const bounces = await h({ m: 'GET', p: '/stats/outbound/bounces' });
+      const spam = await h({ m: 'GET', p: '/stats/outbound/spam' });
+      const tracked = await h({ m: 'GET', p: '/stats/outbound/tracked' });
+      return field(bounces, 'HardBounce') === 1 && field(spam, 'SpamComplaint') === 1 && field(tracked, 'Tracked') === 1;
+    }),
+  ),
+  done('postmark.stats.opens_and_clicks', 'stats', 'Stats: the opens/clicks families (counts, platforms, clients, locations)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'stat@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+      const opens = await h({ m: 'GET', p: '/stats/outbound/opens' });
+      const platforms = await h({ m: 'GET', p: '/stats/outbound/opens/platforms' });
+      const clients = await h({ m: 'GET', p: '/stats/outbound/opens/emailClients' });
+      const readTimes = await h({ m: 'GET', p: '/stats/outbound/opens/readTimes' });
+      const clicks = await h({ m: 'GET', p: '/stats/outbound/clicks' });
+      const browsers = await h({ m: 'GET', p: '/stats/outbound/clicks/browserFamilies' });
+      const clickPlatforms = await h({ m: 'GET', p: '/stats/outbound/clicks/platforms' });
+      const location = await h({ m: 'GET', p: '/stats/outbound/clicks/location' });
+      return field(opens, 'Opens') === 1 && field(platforms, 'WebMail') === 1
+        && (field(clients, 'Twin Mail') as number) === 1 && (field(readTimes, '7s+') as number) === 1
+        && field(clicks, 'Clicks') === 1 && (field(browsers, 'Twin Browser') as number) === 1
+        && field(clickPlatforms, 'Desktop') === 1 && field(location, 'HTML') === 1 && field(location, 'Text') === 0;
+    }),
+  ),
+  todo('postmark.stats.date_and_tag_filters', 'stats', 'Stats: fromDate/toDate/tag/messageStream filtering across the stats family', 'api', 'common'),
+  todo('postmark.stats.real_client_taxonomy', 'stats', 'Stats: the real email-client / OS / browser taxonomy rather than a twin placeholder', 'api', 'niche'),
+
+  // ── Inbound rule triggers ────────────────────────────────────────────────────────
+  done('postmark.inbound_rules.crud', 'inbound_rules', 'Inbound rules: GET/POST/DELETE /triggers/inboundRules', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const created = await h({ m: 'POST', p: '/triggers/inboundRules', b: { Rule: 'spammer.test' } });
+      const listed = await h({ m: 'GET', p: '/triggers/inboundRules' });
+      const dup = await h({ m: 'POST', p: '/triggers/inboundRules', b: { Rule: 'spammer.test' } });
+      const noData = await h({ m: 'POST', p: '/triggers/inboundRules', b: {} });
+      const del = await h({ m: 'DELETE', p: `/triggers/inboundRules/${field(created, 'ID')}` });
+      const gone = await h({ m: 'DELETE', p: `/triggers/inboundRules/${field(created, 'ID')}` });
+      const after = await h({ m: 'GET', p: '/triggers/inboundRules' });
+      return field(created, 'ID') === 1 && field(created, 'Rule') === 'spammer.test'
+        && field(listed, 'TotalCount') === 1 && list(listed, 'InboundRules')[0]!.Rule === 'spammer.test'
+        && failedWith(dup, 422, 810) && failedWith(noData, 422, 809)
+        && ok(del) && failedWith(gone, 422, 812) && field(after, 'TotalCount') === 0;
+    }),
+  ),
+  todo('postmark.inbound_rules.blocking_effect', 'inbound_rules', 'Inbound rules: an inbound message from a blocked sender is actually Blocked', 'api', 'common'),
+
+  // ── Domains API (account token) ──────────────────────────────────────────────────
+  done('postmark.domains.create', 'domains', 'Domains: POST /domains returns the DNS detail block', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/domains', b: { Name: 'acme.dev' } });
+      return ok(r) && field(r, 'ID') === 1 && field(r, 'Name') === 'acme.dev'
+        && field(r, 'SPFVerified') === false && field(r, 'DKIMVerified') === false
+        && String(field(r, 'SPFTextValue')).includes('spf.mtasv.net')
+        && String(field(r, 'DKIMHost')).includes('_domainkey.acme.dev')
+        && field(r, 'ReturnPathDomainCNAMEValue') === 'pm.mtasv.net';
+    }),
+  ),
+  done('postmark.domains.list_and_retrieve', 'domains', 'Domains: GET /domains (short shape) + GET /domains/:id (detail)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/domains', b: { Name: 'acme.dev' } });
+      const listed = await h({ m: 'GET', p: '/domains' });
+      const got = await h({ m: 'GET', p: '/domains/1' });
+      const missing = await h({ m: 'GET', p: '/domains/99' });
+      const row = list(listed, 'Domains')[0]!;
+      return field(listed, 'TotalCount') === 1 && row.Name === 'acme.dev'
+        // the list shape omits the DNS detail block the retrieve carries
+        && row.SPFTextValue === undefined && typeof field(got, 'SPFTextValue') === 'string'
+        && failedWith(missing, 422, 510);
+    }),
+  ),
+  done('postmark.domains.verify_dkim_spf_return_path', 'domains', 'Domains: verifyDKIM / verifySPF / verifyReturnPath flip the flags', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/domains', b: { Name: 'verify.dev' } });
+      const dkim = await h({ m: 'PUT', p: '/domains/1/verifyDKIM' });
+      const spf = await h({ m: 'POST', p: '/domains/1/verifySPF' });
+      // ⚠ TWIN-LOCAL precondition, not a vendor-documented ordering (§9): reporting a return
+      // path "verified" when none is configured would be a fake success, so the twin refuses.
+      // Asserted as a 422 + unchanged state; the CODE is not pinned because it is borrowed.
+      const tooEarly = await h({ m: 'PUT', p: '/domains/1/verifyReturnPath' });
+      await h({ m: 'PUT', p: '/domains/1', b: { ReturnPathDomain: 'pm-bounces.verify.dev' } });
+      const rp = await h({ m: 'PUT', p: '/domains/1/verifyReturnPath' });
+      return field(dkim, 'DKIMVerified') === true && field(spf, 'SPFVerified') === true
+        && tooEarly.status === 422 && field(tooEarly, 'ReturnPathDomainVerified') === undefined
+        && field(rp, 'ReturnPathDomainVerified') === true
+        && field(rp, 'ReturnPathDomain') === 'pm-bounces.verify.dev';
+    }),
+  ),
+  done('postmark.domains.rotate_dkim', 'domains', 'Domains: POST /domains/:id/rotateDKIM stages a PENDING key', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/domains', b: { Name: 'rotate.dev' } });
+      await h({ m: 'PUT', p: '/domains/1/verifyDKIM' });
+      const rot = await h({ m: 'POST', p: '/domains/1/rotateDKIM' });
+      const reVerified = await h({ m: 'PUT', p: '/domains/1/verifyDKIM' });
+      return field(rot, 'DKIMUpdateStatus') === 'Pending' && field(rot, 'DKIMVerified') === false
+        && String(field(rot, 'DKIMPendingHost')).includes('_domainkey.rotate.dev')
+        && field(reVerified, 'DKIMVerified') === true && field(reVerified, 'DKIMPendingHost') === '';
+    }),
+  ),
+  done('postmark.domains.delete_and_validation', 'domains', 'Domains: DELETE + the vendor 422s (512 duplicate, 514 no Name)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/domains', b: { Name: 'dup.dev' } });
+      const dup = await h({ m: 'POST', p: '/domains', b: { Name: 'dup.dev' } });
+      const noName = await h({ m: 'POST', p: '/domains', b: {} });
+      const del = await h({ m: 'DELETE', p: '/domains/1' });
+      const gone = await h({ m: 'GET', p: '/domains/1' });
+      return failedWith(dup, 422, 512) && failedWith(noName, 422, 514)
+        && ok(del) && failedWith(gone, 422, 510);
+    }),
+  ),
+  done('postmark.domains.repeat_transition_applies', 'domains', 'Domains: a REPEATED identical transition applies again (no same-ms write dedupe)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // REGRESSION PIN, and a deliberately DETERMINISTIC one. The kernel dedupes an action by
+      // `operation:subjectId:occurredAt(ms):contentHash`, so two identical verifyDKIM calls in
+      // the SAME millisecond used to collapse into one and leave the domain stuck on the
+      // rotated PENDING key — silent data loss (see `_seq` in postmark-twin.ts). Pinning one
+      // `occurredAt` across the whole cycle reproduces that collision every single run instead
+      // of racing the clock, so this pin genuinely fails if the fix is reverted.
+      const at = '2026-01-01T00:00:00.000Z';
+      await h({ m: 'POST', p: '/domains', b: { Name: 'repeat.dev' }, at });
+      for (let i = 0; i < 3; i++) {
+        await h({ m: 'PUT', p: '/domains/1/verifyDKIM', at });
+        const rotated = await h({ m: 'POST', p: '/domains/1/rotateDKIM', at });
+        if (field(rotated, 'DKIMUpdateStatus') !== 'Pending' || field(rotated, 'DKIMVerified') !== false) return false;
+        const reVerified = await h({ m: 'PUT', p: '/domains/1/verifyDKIM', at });
+        // Every cycle must land back on Verified with the pending key cleared.
+        if (field(reVerified, 'DKIMVerified') !== true || field(reVerified, 'DKIMUpdateStatus') !== 'Verified') return false;
+        if (field(reVerified, 'DKIMPendingHost') !== '') return false;
+      }
+      return true;
+    }),
+  ),
+  todo('postmark.domains.real_dns_lookup', 'domains', 'Domains: verification driven by a real DNS lookup rather than a local flip', 'api', 'niche'),
+
+  // ── Sender Signatures API (account token) ────────────────────────────────────────
+  done('postmark.senders.create', 'senders', 'Senders: POST /senders creates an UNCONFIRMED signature', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'hello@acme.dev', Name: 'Acme Hello', ReplyToEmail: 'support@acme.dev' } });
+      return ok(r) && field(r, 'ID') === 1 && field(r, 'EmailAddress') === 'hello@acme.dev'
+        && field(r, 'Domain') === 'acme.dev' && field(r, 'Confirmed') === false
+        && field(r, 'ReplyToEmailAddress') === 'support@acme.dev';
+    }),
+  ),
+  done('postmark.senders.list_and_retrieve', 'senders', 'Senders: GET /senders → {TotalCount, SenderSignatures[]}', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/senders', b: { FromEmail: 'a@acme.dev', Name: 'A' } });
+      const listed = await h({ m: 'GET', p: '/senders' });
+      const got = await h({ m: 'GET', p: '/senders/1' });
+      const missing = await h({ m: 'GET', p: '/senders/99' });
+      // The collection key is `SenderSignatures`, NOT `Senders`, despite the path.
+      return field(listed, 'TotalCount') === 1 && list(listed, 'SenderSignatures')[0]!.EmailAddress === 'a@acme.dev'
+        && field(listed, 'Senders') === undefined
+        && field(got, 'Name') === 'A' && failedWith(missing, 422, 501);
+    }),
+  ),
+  done('postmark.senders.validation', 'senders', 'Senders: 422s for missing/invalid/public-domain/duplicate FromEmail', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const noEmail = await h({ m: 'POST', p: '/senders', b: { Name: 'X' } });
+      const bad = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'nope' } });
+      const publicDomain = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'someone@gmail.com' } });
+      await h({ m: 'POST', p: '/senders', b: { FromEmail: 'dup@acme.dev' } });
+      const dup = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'dup@acme.dev' } });
+      return failedWith(noEmail, 422, 520) && failedWith(bad, 422, 522)
+        && failedWith(publicDomain, 422, 503) && failedWith(dup, 422, 504);
+    }),
+  ),
+  done('postmark.senders.edit_delete_resend', 'senders', 'Senders: PUT / DELETE / resend-confirmation', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/senders', b: { FromEmail: 'edit@acme.dev', Name: 'Before' } });
+      const upd = await h({ m: 'PUT', p: '/senders/1', b: { Name: 'After', ReplyToEmail: 'new-reply@acme.dev' } });
+      const resent = await h({ m: 'POST', p: '/senders/1/resend' });
+      const del = await h({ m: 'DELETE', p: '/senders/1' });
+      const gone = await h({ m: 'GET', p: '/senders/1' });
+      return field(upd, 'Name') === 'After' && field(upd, 'ReplyToEmailAddress') === 'new-reply@acme.dev'
+        && ok(resent) && errorCode(resent) === 0 && ok(del) && failedWith(gone, 422, 501);
+    }),
+  ),
+  done('postmark.senders.verify_spf_and_dkim', 'senders', 'Senders: verifySpf + requestNewDkim on a signature', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/senders', b: { FromEmail: 'dns@acme.dev' } });
+      const spf = await h({ m: 'POST', p: '/senders/1/verifySpf' });
+      const dkim = await h({ m: 'POST', p: '/senders/1/requestNewDkim' });
+      const after = await h({ m: 'GET', p: '/senders/1' });
+      return field(spf, 'SPFVerified') === true && ok(dkim)
+        && field(after, 'DKIMUpdateStatus') === 'Pending'
+        && String(field(after, 'DKIMPendingHost')).includes('acme.dev');
+    }),
+  ),
+  todo('postmark.senders.confirmation_flow', 'senders', 'Senders: the real confirmation-email round trip that sets Confirmed', 'api', 'common'),
+  todo('postmark.senders.sending_requires_signature', 'senders', 'Senders: refuse a send whose From has no confirmed signature (ErrorCode 400/401)', 'api', 'common'),
+
+  // ── Data removals (GDPR, account token) ──────────────────────────────────────────
+  done('postmark.data_removals.request_and_status', 'data_removals', 'Data removals: POST /data-removals + GET /data-removals/:id', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/data-removals', b: { RequestedBy: 'admin@acme.dev', RequestedFor: 'user@customer.test', NotifyWhenCompleted: true } });
+      const got = await h({ m: 'GET', p: `/data-removals/${field(r, 'ID')}` });
+      const bad = await h({ m: 'POST', p: '/data-removals', b: { RequestedBy: 'admin@acme.dev' } });
+      const missing = await h({ m: 'GET', p: '/data-removals/999' });
+      return ok(r) && field(r, 'ID') === 1 && field(r, 'Status') === 'Pending'
+        && field(got, 'Status') === 'Pending' && bad.status === 422 && failedWith(missing, 422, 1301);
+    }),
+  ),
+  todo('postmark.data_removals.actual_purge', 'data_removals', 'Data removals: the request actually purging the subject\'s stored messages', 'api', 'niche'),
+
+  // ── Auth ─────────────────────────────────────────────────────────────────────────
+  done('postmark.auth.server_token_header', 'auth', 'Auth: X-Postmark-Server-Token (NOT Bearer); missing/empty → 401 ErrorCode 10', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const good = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'X-Postmark-Server-Token': '11111111-2222-3333-4444-555555555555' } });
+      const missing = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'content-type': 'application/json' } });
+      const empty = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'X-Postmark-Server-Token': '   ' } });
+      // A BEARER token is not Postmark's scheme and must not be accepted as one.
+      const bearer = await h({ m: 'POST', p: '/email', b: mkMail(), h: { authorization: 'Bearer 11111111-2222-3333-4444-555555555555' } });
+      return ok(good) && errorCode(good) === 0
+        && failedWith(missing, 401, 10) && field(missing, 'Message') === 'Request does not contain a valid Server token.'
+        && failedWith(empty, 401, 10) && failedWith(bearer, 401, 10);
+    }),
+  ),
+  done('postmark.auth.header_case_insensitive', 'auth', 'Auth: the token header is matched case-insensitively', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // Asserts real VALUES, not just `ok()` — a status-only version of this passed against
+      // the dead-twin saboteur (caught by scripts/mutation-test.ts) because an empty 200 is
+      // still a 200. Each casing must return the SERVER OBJECT, and the missing-token case
+      // must still fail, so both the positive and negative paths have teeth.
+      const lower = await h({ m: 'GET', p: '/server', h: { 'x-postmark-server-token': 'tok-lower' } });
+      const upper = await h({ m: 'GET', p: '/server', h: { 'X-POSTMARK-SERVER-TOKEN': 'tok-upper' } });
+      const mixed = await h({ m: 'GET', p: '/server', h: { 'X-Postmark-Server-Token': 'tok-mixed' } });
+      const none = await h({ m: 'GET', p: '/server', h: { 'x-postmark-account-token': 'wrong-scope' } });
+      const served = (r: PostmarkResponse) => ok(r) && field(r, 'ID') === 1 && field(r, 'DeliveryType') === 'Live' && Array.isArray(field(r, 'ApiTokens'));
+      return served(lower) && served(upper) && served(mixed) && failedWith(none, 401, 10);
+    }),
+  ),
+  done('postmark.auth.account_token_scope', 'auth', 'Auth: account routes need X-Postmark-Account-Token, and say so', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // [WIRE] the 401 message is ENDPOINT-SCOPED — "Account token" here, "Server token" above.
+      const serverTokenOnly = await h({ m: 'GET', p: '/domains', h: { 'X-Postmark-Server-Token': 'srv-token' } });
+      const withAccount = await h({ m: 'GET', p: '/domains', h: { 'X-Postmark-Account-Token': 'acct-token' } });
+      const sendersNoToken = await h({ m: 'GET', p: '/senders', h: { 'content-type': 'application/json' } });
+      return failedWith(serverTokenOnly, 401, 10)
+        && field(serverTokenOnly, 'Message') === 'Request does not contain a valid Account token.'
+        && ok(withAccount) && failedWith(sendersNoToken, 401, 10);
+    }),
+  ),
+  done('postmark.auth.test_token_email_only', 'auth', 'Auth: POSTMARK_API_TEST works on /email only (403 ErrorCode 10 elsewhere)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // Verified live during this pack's build: the public test token is /email-scoped, the
+      // refusal is a 403 (not 401), and a test-token send answers "Test job accepted".
+      const send = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'X-Postmark-Server-Token': 'POSTMARK_API_TEST' } });
+      const elsewhere = await h({ m: 'GET', p: '/server', h: { 'X-Postmark-Server-Token': 'POSTMARK_API_TEST' } });
+      const bounces = await h({ m: 'GET', p: '/bounces', h: { 'X-Postmark-Server-Token': 'POSTMARK_API_TEST' } });
+      return ok(send) && errorCode(send) === 0 && field(send, 'Message') === 'Test job accepted'
+        && elsewhere.status === 403 && errorCode(elsewhere) === 10
+        && String(field(elsewhere, 'Message')).includes('/email')
+        && bounces.status === 403;
+    }),
+  ),
+  todo('postmark.auth.rate_limit_headers', 'auth', 'Auth: the RateLimit-*/X-RateLimit-*-Second response headers and the 429 path', 'api', 'niche'),
+  // GROUNDING NOTE: yes, a `problem+json` body really is unlike Postmark's usual
+  // `{ErrorCode, Message}` envelope — that IS the finding. Observed live during this pack's
+  // build: a request without `Content-Type: application/json` never reaches Postmark's own
+  // error layer and falls through to the ASP.NET Core host, which answers RFC-9110
+  // problem+json. A twin that "tidied" this into the Postmark envelope would be less faithful,
+  // which is exactly why it is filed as surface to model rather than quietly normalized.
+  todo('postmark.auth.unsupported_media_type', 'auth', 'Auth/protocol: 415 RFC-9110 problem+json when Content-Type is not application/json', 'api', 'niche'),
+
+  // ── Honesty rungs ────────────────────────────────────────────────────────────────
+  done('postmark.honesty.readonly_rejects_writes', 'honesty', 'read-only twin rejects writes (405)', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'postmark-cap-ro-'));
+    try {
+      const write = await handlePostmarkTwinRequest({ method: 'POST', path: '/email', body: JSON.stringify(mkMail()), readOnly: true, root });
+      const read = await handlePostmarkTwinRequest({ method: 'GET', path: '/messages/outbound', readOnly: true, root });
+      return write.status === 405 && read.status === 200;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  done('postmark.honesty.unmodeled_404', 'honesty', 'an unmodeled route fails like the vendor (404), never a fake success', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const bogus = await h({ m: 'POST', p: '/segments', b: {} });
+      // A route family the twin serves, but a shape the vendor does not:
+      const wrongShape = await h({ m: 'DELETE', p: '/messages/outbound' });
+      // Real routes the twin deliberately does NOT model must 404 rather than answer a
+      // plausible-but-wrong error from a neighbouring branch (§9 finding 7): `PUT
+      // /templates/push` used to be swallowed by /templates/:idOrAlias and answer 1101
+      // "template not found", and the whole /email/bulk subtree used to answer 422/14 on
+      // EVERY verb, so nothing under it could ever 404.
+      const unmodeledPush = await h({ m: 'PUT', p: '/templates/push', b: { SourceServerID: 1, DestinationServerID: 2, PerformChanges: true } });
+      const bulkWrongVerb = await h({ m: 'DELETE', p: '/email/bulk/abc' });
+      // …while the two routes the vendor DOES publish there still answer its approval refusal.
+      const bulkStart = await h({ m: 'POST', p: '/email/bulk', b: {} });
+      return bogus.status === 404 && wrongShape.status === 404
+        && unmodeledPush.status === 404 && errorCode(unmodeledPush) !== POSTMARK_ERRORS.templateNotFound
+        && bulkWrongVerb.status === 404 && failedWith(bulkStart, 422, 14)
+        && typeof (bogus.body as Body).ErrorCode === 'number';
+    }),
+  ),
+  done('postmark.honesty.every_response_has_envelope', 'honesty', 'every failure carries Postmark\'s {ErrorCode, Message} envelope', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const failures = [
+        await h({ m: 'POST', p: '/email', b: {} }),
+        await h({ m: 'GET', p: '/templates/nope' }),
+        await h({ m: 'GET', p: '/bounces/9' }),
+        await h({ m: 'GET', p: '/message-streams/nope' }),
+        await h({ m: 'GET', p: '/webhooks/9' }),
+        await h({ m: 'GET', p: '/domains/9' }),
+        await h({ m: 'GET', p: '/senders/9' }),
+        await h({ m: 'POST', p: '/nonexistent', b: {} }),
+      ];
+      return failures.every((r) => {
+        const b = r.body as Body;
+        return r.status >= 400 && typeof b?.ErrorCode === 'number' && b.ErrorCode !== 0 && typeof b?.Message === 'string' && b.Message.length > 0;
+      });
+    }),
+  ),
+  done('postmark.honesty.no_webhook_signature', 'honesty', 'the twin never invents a webhook signature Postmark does not send', 'api', 'common', () =>
+    withWebhookCapture(async (h, seen) => {
+      // A deliberate NEGATIVE fidelity assertion: Postmark webhooks are UNSIGNED. If someone
+      // later bolts on an svix/HMAC scheme copied from a sibling pack, this goes red.
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/plain', Triggers: { Delivery: { Enabled: true } } } });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'plainhook@twin.test' }) });
+      const headers = seen[0]?.headers ?? {};
+      const body = seen[0]?.body ?? {};
+      return seen.length === 1
+        && !Object.keys(headers).some((k) => /signature|svix|hmac/i.test(k))
+        && !Object.keys(body).some((k) => /signature/i.test(k));
+    }),
+  ),
+  done('postmark.honesty.conformance_schemas', 'honesty', 'every served resource validates against the published object schemas', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'postmark-cap-conf-'));
+    try {
+      const h: Handler = (s) => handlePostmarkTwinRequest({ method: s.m, path: s.p, body: s.b === undefined ? undefined : JSON.stringify(s.b), root });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-conf@twin.test' }) });
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'ok-conf@twin.test', TrackOpens: true }) });
+      await h({ m: 'POST', p: '/templates', b: { Name: 'Conf', Alias: 'conf', Subject: 'S', TextBody: 'T' } });
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/conf' } });
+      await h({ m: 'POST', p: '/domains', b: { Name: 'conf.dev' } });
+      await h({ m: 'POST', p: '/senders', b: { FromEmail: 'conf@conf.dev' } });
+      await h({ m: 'POST', p: '/triggers/inboundRules', b: { Rule: 'conf.test' } });
+      const { checkPostmarkConformance } = await import('./postmark-conformance.ts');
+      const report = checkPostmarkConformance({ root });
+      // Failable both ways: it must have found real resources AND found zero violations.
+      return report.ok && report.resourcesChecked >= 9 && report.fieldsChecked > 40 && report.violations.length === 0;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+
+  // ── UI mirror (data-coupled — archetype A, every screen reads a real vendor path) ─
+  done('postmark.ui.activity_screen', 'ui', 'UI mirror: Activity list of sent messages from twin state (data-coupled)', 'ui', 'core',
+    uiDataCoupled<PostmarkCtx, Body[]>({
+      withRoot: withRootCtx,
+      seed: ({ h }) => h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Activity proof', To: 'activity@twin.test' }) }),
+      fetch: async ({ h }) => list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages'),
+      assert: (rows) => rows.some((r) => r.Subject === 'Activity proof' && (r.Recipients as string[])?.includes('activity@twin.test')),
+    })),
+  done('postmark.ui.message_body_render', 'ui', 'UI mirror: renders a message\'s html/text body (data-coupled)', 'ui', 'core',
+    uiDataCoupled<PostmarkCtx, { html: Body; text: Body }>({
+      withRoot: withRootCtx,
+      seed: async ({ h }) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'HtmlOne', HtmlBody: '<em>seeded-html-marker</em>', TextBody: undefined }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'TextOne', HtmlBody: undefined, TextBody: 'seeded-text-marker' }) });
+      },
+      fetch: async ({ h }) => {
+        // Fetch through the SAME two-step path the detail pane uses: list, then per-id details.
+        const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+        const detail = async (subject: string) => {
+          const row = rows.find((r) => r.Subject === subject)!;
+          return (await h({ m: 'GET', p: `/messages/outbound/${row?.MessageID}/details` })).body as Body;
+        };
+        return { html: await detail('HtmlOne'), text: await detail('TextOne') };
+      },
+      render: ({ html, text }) => JSON.stringify({
+        html: renderToStaticMarkup(createElement(MessageBody, { message: html })),
+        text: renderToStaticMarkup(createElement(MessageBody, { message: text })),
+      }),
+      assert: (_data, markup) => !!markup
+        && markup.includes('message-html') && markup.includes('seeded-html-marker')
+        && markup.includes('message-text') && markup.includes('seeded-text-marker'),
+    })),
+  done('postmark.ui.delivery_timeline', 'ui', 'UI mirror: MessageEvents timeline, incl. a bounce (data-coupled)', 'ui', 'core',
+    uiDataCoupled<PostmarkCtx, { bounced: Body; tracked: Body }>({
+      withRoot: withRootCtx,
+      seed: async ({ h }) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'TimelineBounce', To: 'bounce-ui@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'TimelineTracked', To: 'ui-tracked@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+      },
+      fetch: async ({ h }) => {
+        const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+        const detail = async (subject: string) => (await h({ m: 'GET', p: `/messages/outbound/${rows.find((r) => r.Subject === subject)?.MessageID}/details` })).body as Body;
+        return { bounced: await detail('TimelineBounce'), tracked: await detail('TimelineTracked') };
+      },
+      render: ({ bounced, tracked }) => JSON.stringify({
+        bounced: renderToStaticMarkup(createElement(DeliveryTimeline, { message: bounced })),
+        tracked: renderToStaticMarkup(createElement(DeliveryTimeline, { message: tracked })),
+      }),
+      assert: (data, markup) => {
+        // The mirror's OWN timeline helper must agree with the twin's recorded events…
+        const bouncedSteps = deliveryTimeline(data.bounced);
+        const trackedSteps = deliveryTimeline(data.tracked);
+        return JSON.stringify(bouncedSteps) === JSON.stringify(['Sent', 'Bounced'])
+          && JSON.stringify(trackedSteps) === JSON.stringify(['Sent', 'Delivered', 'Opened', 'LinkClicked'])
+          // …and the rendered markup must carry the seeded outcome with its tone class.
+          && !!markup && markup.includes('event bad') && markup.includes('Bounced')
+          && markup.includes('event ok') && markup.includes('LinkClicked');
+      },
+    })),
+  done('postmark.ui.status_pill', 'ui', 'UI mirror: the status pill tone comes from the mirror\'s own mapper (data-coupled)', 'ui', 'common',
+    uiDataCoupled<PostmarkCtx, { bounced: Body; delivered: Body }>({
+      withRoot: withRootCtx,
+      seed: async ({ h }) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'PillBounce', To: 'bounce-pill@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'PillOk', To: 'pill-ok@twin.test' }) });
+      },
+      fetch: async ({ h }) => {
+        const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+        const detail = async (subject: string) => (await h({ m: 'GET', p: `/messages/outbound/${rows.find((r) => r.Subject === subject)?.MessageID}/details` })).body as Body;
+        return { bounced: await detail('PillBounce'), delivered: await detail('PillOk') };
+      },
+      render: ({ bounced, delivered }) => renderToStaticMarkup(createElement('div', null,
+        createElement(StatusPill, { value: messageStatus(bounced) }),
+        createElement(StatusPill, { value: messageStatus(delivered) }),
+      )),
+      assert: (data, markup) => messageStatus(data.bounced) === 'Bounced' && messageStatus(data.delivered) === 'Delivered'
+        && statusTone('Bounced') === 'bad' && statusTone('Delivered') === 'ok'
+        && !!markup && markup.includes('pill bad') && markup.includes('pill ok')
+        && markup.includes('>Bounced<') && markup.includes('>Delivered<'),
+    })),
+  done('postmark.ui.bounces_screen', 'ui', 'UI mirror: Bounces screen (data-coupled)', 'ui', 'common',
+    uiDataCoupled<PostmarkCtx, Body[]>({
+      withRoot: withRootCtx,
+      seed: ({ h }) => h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-screen@twin.test', Subject: 'Bounce screen proof' }) }),
+      fetch: async ({ h }) => list(await h({ m: 'GET', p: '/bounces' }), 'Bounces'),
+      assert: (rows) => rows.some((b) => b.Email === 'bounce-screen@twin.test' && b.Subject === 'Bounce screen proof' && b.Type === 'HardBounce'),
+    })),
+  done('postmark.ui.templates_screen', 'ui', 'UI mirror: Templates screen (data-coupled)', 'ui', 'common',
+    uiDataCoupled<PostmarkCtx, Body[]>({
+      withRoot: withRootCtx,
+      seed: ({ h }) => h({ m: 'POST', p: '/templates', b: { Name: 'UI Check Template', Alias: 'ui-check', Subject: 'S', TextBody: 'T' } }),
+      fetch: async ({ h }) => list(await h({ m: 'GET', p: '/templates' }), 'Templates'),
+      assert: (rows) => rows.some((t) => t.Name === 'UI Check Template' && t.Alias === 'ui-check' && t.Active === true),
+    })),
+  done('postmark.ui.streams_screen', 'ui', 'UI mirror: Streams screen (data-coupled)', 'ui', 'common',
+    uiDataCoupled<PostmarkCtx, Body[]>({
+      withRoot: withRootCtx,
+      seed: ({ h }) => h({ m: 'POST', p: '/message-streams', b: { ID: 'uicheck', Name: 'UI Check Stream', MessageStreamType: 'Broadcast' } }),
+      fetch: async ({ h }) => list(await h({ m: 'GET', p: '/message-streams' }), 'MessageStreams'),
+      assert: (rows) => rows.some((s) => s.ID === 'uicheck' && s.Name === 'UI Check Stream') && rows.some((s) => s.ID === 'outbound'),
+    })),
+  done('postmark.ui.webhooks_screen', 'ui', 'UI mirror: Webhooks screen (data-coupled)', 'ui', 'common',
+    uiDataCoupled<PostmarkCtx, Body[]>({
+      withRoot: withRootCtx,
+      seed: ({ h }) => h({ m: 'POST', p: '/webhooks', b: { Url: 'https://ui-check.test/hook', Triggers: { Delivery: { Enabled: true } } } }),
+      fetch: async ({ h }) => list(await h({ m: 'GET', p: '/webhooks' }), 'Webhooks'),
+      assert: (rows) => rows.some((w) => w.Url === 'https://ui-check.test/hook' && w.MessageStream === 'outbound'),
+    })),
+  done('postmark.ui.suppressions_screen', 'ui', 'UI mirror: Suppressions screen (data-coupled)', 'ui', 'common',
+    uiDataCoupled<PostmarkCtx, Body[]>({
+      withRoot: withRootCtx,
+      seed: ({ h }) => h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'ui-suppressed@twin.test' }] } }),
+      fetch: async ({ h }) => list(await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' }), 'Suppressions'),
+      assert: (rows) => rows.some((s) => s.EmailAddress === 'ui-suppressed@twin.test' && s.SuppressionReason === 'ManualSuppression'),
+    })),
+  done('postmark.ui.nav', 'ui', 'UI mirror: the nav shell — EVERY section it routes to reads live twin state', 'ui', 'core',
+    uiDataCoupled<PostmarkCtx, Record<string, number>>({
+      withRoot: withRootCtx,
+      // A nav shell's honest data-coupling is proving every screen it routes to reads live
+      // data (the sentry.ui.nav precedent) — so seed one row per section, then walk the
+      // mirror's OWN declared section table and fetch each section's real API path.
+      seed: async ({ h }) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-nav@twin.test' }) }); // messages + bounces
+        await h({ m: 'POST', p: '/templates', b: { Name: 'Nav', Alias: 'nav', Subject: 'S', TextBody: 'T' } });
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://nav.test/hook' } });
+        await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'nav@twin.test' }] } });
+      },
+      fetch: async ({ h }) => {
+        const counts: Record<string, number> = {};
+        for (const s of POSTMARK_MIRROR_SECTIONS) {
+          const r = await h({ m: 'GET', p: s.path });
+          counts[s.key] = ok(r) ? list(r, s.collection).length : -1;
+        }
+        return counts;
+      },
+      assert: (counts) => POSTMARK_MIRROR_SECTIONS.length === 6
+        && POSTMARK_MIRROR_SECTIONS.every((s) => (counts[s.key] ?? 0) > 0),
+    })),
+  done('postmark.ui.detail_panel', 'ui', 'UI mirror: the detail panel flattens nested vendor fields (data-coupled)', 'ui', 'common',
+    uiDataCoupled<PostmarkCtx, Body>({
+      withRoot: withRootCtx,
+      seed: ({ h }) => h({ m: 'POST', p: '/email', b: mkMail({
+        Subject: 'Detail check', To: 'Ada <detail-to@twin.test>', Cc: 'detail-cc@twin.test',
+        Tag: 'detail-tag', Metadata: { tenant: 'detail-tenant' }, TrackOpens: true,
+      }) }),
+      fetch: async ({ h }) => {
+        const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+        const row = rows.find((r) => r.Subject === 'Detail check')!;
+        return (await h({ m: 'GET', p: `/messages/outbound/${row?.MessageID}/details` })).body as Body;
+      },
+      render: (message) => renderToStaticMarkup(createElement(NestedLines, { lines: flattenPostmarkValue(message) })),
+      assert: (message, markup) => !!markup && markup.includes('detail-line')
+        // nested arrays/objects the vendor returns are flattened into dotted paths
+        && markup.includes('To[0].Email') && markup.includes('detail-to@twin.test')
+        && markup.includes('Ada') && markup.includes('detail-cc@twin.test')
+        && markup.includes('Metadata.tenant') && markup.includes('detail-tenant')
+        && markup.includes('MessageEvents[0].Type')
+        && String(message.Tag) === 'detail-tag',
+    })),
+  todo('postmark.ui.stats_dashboard', 'ui', 'UI mirror: a stats/overview screen over GET /stats/outbound', 'ui', 'common'),
+  todo('postmark.ui.message_search', 'ui', 'UI mirror: an activity search box driving the outbound filters', 'ui', 'common'),
+  todo('postmark.ui.inbound_screen', 'ui', 'UI mirror: an inbound-message screen', 'ui', 'niche'),
+  todo('postmark.ui.domains_screen', 'ui', 'UI mirror: a Domains/Sender-Signatures DNS screen', 'ui', 'niche'),
+
+  // ── Connector ────────────────────────────────────────────────────────────────────
+  done('postmark.connector.pull_messages', 'connector', 'Connector: pull outbound messages from real Postmark', 'connector', 'core', () =>
+    withRoot(async (h, root) => {
+      const mapped = await pullPostmarkMessages(fakePostmarkClient());
+      if (mapped[0]?.id !== 'real-msg-0001' || (mapped[0]!.fields as Body).Subject !== 'RealSubject') return false;
+      await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      const listed = await h({ m: 'GET', p: '/messages/outbound' });
+      const row = list(listed, 'Messages').find((m) => m.MessageID === 'real-msg-0001');
+      return ok(listed) && !!row && row.Subject === 'RealSubject' && row.Tag === 'real-tag' && row.TrackOpens === true;
+    }),
+  ),
+  done('postmark.connector.pull_bounces', 'connector', 'Connector: pull bounces from real Postmark', 'connector', 'common', () =>
+    withRoot(async (h, root) => {
+      const mapped = await pullPostmarkBounces(fakePostmarkClient());
+      if ((mapped[0]!.fields as Body).Email !== 'real-bounced@twin.test') return false;
+      await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      const one = await h({ m: 'GET', p: '/bounces/9001' });
+      const stats = await h({ m: 'GET', p: '/deliverystats' });
+      return ok(one) && field(one, 'Email') === 'real-bounced@twin.test' && field(one, 'Type') === 'HardBounce'
+        && (field(stats, 'Bounces') as Body[])[0]!.Count === 1;
+    }),
+  ),
+  done('postmark.connector.pull_templates', 'connector', 'Connector: pull templates from real Postmark', 'connector', 'common', () =>
+    withRoot(async (h, root) => {
+      const mapped = await pullPostmarkTemplates(fakePostmarkClient());
+      if ((mapped[0]!.fields as Body).Alias !== 'real-alias') return false;
+      await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      const got = await h({ m: 'GET', p: '/templates/real-alias' });
+      return ok(got) && field(got, 'TemplateId') === 7001 && field(got, 'Name') === 'RealTemplate';
+    }),
+  ),
+  done('postmark.connector.pull_streams_webhooks_server', 'connector', 'Connector: pull message streams, webhooks and the server', 'connector', 'common', () =>
+    withRoot(async (h, root) => {
+      const streams = await pullPostmarkMessageStreams(fakePostmarkClient());
+      const hooks = await pullPostmarkWebhooks(fakePostmarkClient());
+      const server = await pullPostmarkServer(fakePostmarkClient());
+      if (streams[0]?.id !== 'real-stream' || hooks[0]?.id !== '5001' || server[0]?.id !== '42') return false;
+      await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      const s = await h({ m: 'GET', p: '/message-streams/real-stream' });
+      const w = await h({ m: 'GET', p: '/webhooks/5001' });
+      const servers = await h({ m: 'GET', p: '/servers' });
+      return field(s, 'Name') === 'RealStream' && field(w, 'Url') === 'https://real.test/hook'
+        && list(servers, 'Servers').some((x) => x.ID === 42 && x.Name === 'RealServer');
+    }),
+  ),
+  done('postmark.connector.pull_idempotent', 'connector', 'Connector: a re-pull of identical state appends NO deltas', 'connector', 'common', () =>
+    withRoot(async (h, root) => {
+      const first = await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      const second = await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-02T00:00:00.000Z' });
+      const listed = await h({ m: 'GET', p: '/messages/outbound' });
+      return first.observed > 0 && first.deltasAppended > 0 && second.deltasAppended === 0
+        && field(listed, 'TotalCount') === 1; // no duplicate rows from the second pull
+    }),
+  ),
+  done('postmark.connector.push_message', 'connector', 'Connector: push a local send to real Postmark, ONCE', 'connector', 'core', () =>
+    withRoot(async (h, root) => {
+      await h({ m: 'POST', p: '/email', b: mkMail({ To: 'Pushed <pushed@twin.test>', Subject: 'Pushed subject', Tag: 'pushed' }) });
+      const client = fakePostmarkClient();
+      const first = await performPending(client, { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      const sent = client.sends.find((s) => s.Subject === 'Pushed subject');
+      if (!sent || sent.To !== 'pushed@twin.test' || sent.Tag !== 'pushed' || sent.From !== 'Acme <notifications@acme.dev>') return false;
+      // A re-push must enact NOTHING — confirmed actions are no longer pending.
+      const before = client.sends.length;
+      const second = await performPending(client, { root, occurredAt: '2026-01-02T00:00:00.000Z' });
+      return first.pushed >= 1 && second.pushed === 0 && client.sends.length === before;
+    }),
+  ),
+  done('postmark.connector.push_template_and_webhook', 'connector', 'Connector: push local templates/webhooks/streams', 'connector', 'common', () =>
+    withRoot(async (h, root) => {
+      await h({ m: 'POST', p: '/templates', b: { Name: 'PushMe', Alias: 'push-me', Subject: 'PS', HtmlBody: '<p>ph</p>' } });
+      await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://push.test/hook', Triggers: { Delivery: { Enabled: true } } } });
+      await h({ m: 'POST', p: '/message-streams', b: { ID: 'pushed', Name: 'Pushed Stream', MessageStreamType: 'Broadcast' } });
+      const client = fakePostmarkClient();
+      const res = await performPending(client, { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      return res.pushed === 3
+        && client.templateCreates[0]!.Name === 'PushMe' && client.templateCreates[0]!.Alias === 'push-me'
+        && client.webhookCreates[0]!.Url === 'https://push.test/hook'
+        && client.streamCreates[0]!.ID === 'pushed' && client.streamCreates[0]!.MessageStreamType === 'Broadcast';
+    }),
+  ),
+  done('postmark.connector.push_refuses_unmodeled', 'connector', 'Connector: push REFUSES an unmodeled op rather than dropping it', 'connector', 'common', async () => {
+    // A silent drop is the failure mode this guards: the connector must throw with the op name.
+    try {
+      await pushPostmarkAction(fakePostmarkClient(), { operation: 'bounce.activate', subject: { type: 'bounce', id: '1' }, fields: {} });
+      return false;
+    } catch (error) {
+      return String(error).includes("unsupported operation 'bounce.activate'") && String(error).includes('refusing to silently drop');
+    }
+  }),
+  done('postmark.connector.map_shapes', 'connector', 'Connector: the pure vendor→twin shape mappers', 'connector', 'niche', async () => {
+    const m = mapMessage({ MessageID: 'm1', From: 'f@x.dev', Subject: 'S', Recipients: ['r@x.dev'] });
+    const b = mapBounce({ ID: 7, Type: 'Transient', Email: 'b@x.dev' });
+    const t = mapTemplate({ TemplateId: 3, Name: 'T', Alias: null });
+    return m.type === 'message' && m.id === 'm1' && (m.fields as Body).MessageStream === 'outbound'
+      && b.type === 'bounce' && b.id === '7' && (b.fields as Body).RecordType === 'Bounce'
+      && t.type === 'template' && t.id === '3' && (t.fields as Body).Active === true;
+  }),
+  done('postmark.connector.send_after_pull', 'connector', 'Connector: a PULLED twin is still sendable — defaults survive a pull (dirty state)', 'connector', 'core', () =>
+    withRoot(async (h, root) => {
+      // §9 REGRESSION PIN for a real bug the gate was structurally blind to. `bootstrap()`
+      // used to materialize the default streams/server only when the resource TYPE was
+      // empty — so after a pull brought in ONE real stream and ONE real server, the
+      // `outbound` stream and server 1 were never created, and a pulled twin answered
+      // "server not found" on GET /server and ErrorCode 1235 on a plain POST /email.
+      // Nothing in the pull_* verifies touched either path, which is exactly why an
+      // independent skeptic found it and the mutation gate could not.
+      await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+      // The pulled objects are there…
+      const pulledStream = await h({ m: 'GET', p: '/message-streams/real-stream' });
+      const pulledServer = await h({ m: 'GET', p: '/servers/42' });
+      if (!ok(pulledStream) || !ok(pulledServer)) return false;
+      // …AND the defaults a real Postmark server always has are still there beside them.
+      const outbound = await h({ m: 'GET', p: '/message-streams/outbound' });
+      const server = await h({ m: 'GET', p: '/server' });
+      if (!ok(outbound) || field(server, 'ID') !== 1) return false;
+      // …so the headline flow still works on a pulled twin.
+      const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'after-pull@twin.test' }) });
+      const listed = await h({ m: 'GET', p: '/messages/outbound' });
+      return ok(sent) && errorCode(sent) === 0
+        && list(listed, 'Messages').some((m) => (m.Recipients as string[])?.includes('after-pull@twin.test'))
+        // the pulled message is still there too — bootstrap did not trample observed state
+        && list(listed, 'Messages').some((m) => m.MessageID === 'real-msg-0001');
+    }),
+  ),
+  todo('postmark.connector.pull_domains_senders', 'connector', 'Connector: pull account-level domains + sender signatures', 'connector', 'common'),
+  todo('postmark.connector.pull_suppressions', 'connector', 'Connector: pull each stream\'s suppression list', 'connector', 'common'),
+  todo('postmark.connector.pull_inbound_messages', 'connector', 'Connector: pull inbound messages', 'connector', 'niche'),
+  todo('postmark.connector.pull_pagination', 'connector', 'Connector: page through >500 outbound messages/bounces on pull', 'connector', 'common'),
+  todo('postmark.connector.rate_budget', 'connector', 'Connector: a persistent rolling-window rate budget guarding live calls', 'connector', 'common'),
+];
+
+/** The vendor's own docs-nav API groups, enumerated TOP-DOWN from developer.postmarkapp.com
+ *  (not derived from the manifest above — that would make any bijection a tautology). */
+export const POSTMARK_AREAS = [
+  'email', 'messages', 'bounces', 'templates', 'streams', 'suppressions', 'webhooks',
+  'server', 'servers', 'stats', 'inbound_rules', 'domains', 'senders', 'data_removals',
+  // Twin-side rungs, not vendor groups:
+  'auth', 'honesty', 'ui', 'connector',
+] as const;
+
+export function postmarkCapabilities(): Promise<CapabilityReport> {
+  return checkCapabilities('postmark', POSTMARK_CAPABILITIES);
+}
+
+// Referenced so the mirror's webhook helpers stay part of the pack's typed surface even when
+// a verify() exercises them only indirectly through the handler.
+export const __postmarkInternals = { deliveryPlan, webhookHeaders, webhooksFor };