@volter/twin-postmark 0.1.0

package/dist/src/postmark-capabilities.js

@@ -0,0 +1,1502 @@
+// Postmark capability manifest — the EXPECTED REAL-PRODUCT SURFACE (the target), authored
+// TOP-DOWN from what the Postmark API actually does — NOT from what this twin has built.
+//
+// THE DENOMINATOR. Postmark's public API is ~86 endpoints across 15 documented groups (the
+// docs sidebar order: Email · Bulk · Templates · Bounce · Server · Servers · Message Streams
+// · Messages · Domains · Sender Signatures · Stats · Inbound Rule Triggers · Webhooks ·
+// Suppressions · Data Removals). Every one is enumerated below, whether or not this twin has
+// reached it. `verify()` is ground truth; `expected: 'done'` appears ONLY where a real,
+// failable verify proves the behavior, so a broken claim surfaces as a regression.
+//
+// AREAS vs GROUPS — they are deliberately NOT 1:1, and `POSTMARK_AREAS` is the smaller set.
+// **Bulk** has no area of its own: its two endpoints are approval-gated surface this twin does
+// not model, so they are filed as `todo`s under the `email` area rather than given a group
+// that would then have to be justified. Everything else maps one group → one area, plus four
+// TWIN-side areas (auth · honesty · ui · connector) that are rungs, not vendor groups.
+//
+// HONEST READING OF THE COVERAGE NUMBER. This pack reads high for a new twin, and part of
+// that is real breadth and part of it is granularity: built areas are enumerated per-operation
+// while some unbuilt ones (notably the 13 `/stats/*` endpoints) are still enumerated per-family.
+// Evening that out is tracked work, and doing it will make the percentage DROP — which is
+// success, not regression (§6). Roughly a fifth of the `done` numerator is also the twin
+// auditing itself (auth · honesty · ui · connector rungs) rather than vendor endpoints.
+//
+// The area census below is the vendor's own docs-nav grouping, enumerated top-down from the
+// published API reference — NOT derived from the entries in this file (which would make the
+// bijection a tautology, per ADDING_A_TWIN §6).
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { checkCapabilities, uiDataCoupled, verifyBoundary } from '@volter/world-tooling';
+import { handlePostmarkTwinRequest, POSTMARK_ERRORS } from "./postmark-twin.js";
+import { deliveryPlan, webhookHeaders, webhooksFor } from "./postmark-events.js";
+import { mapBounce, mapMessage, mapTemplate, pullPostmarkBounces, pullPostmarkMessages, pullPostmarkMessageStreams, pullPostmarkServer, pullPostmarkTemplates, pullPostmarkWebhooks, pushPostmarkAction, syncPostmarkFromReal, } from "./postmark-connector.js";
+import { performPending } from "./postmark-perform-harness.js";
+import { StatusPill, MessageBody, DeliveryTimeline, NestedLines } from "../client/postmark-mirror.js";
+import { deliveryTimeline, flattenPostmarkValue, messageStatus, POSTMARK_MIRROR_SECTIONS, statusTone, } from "./postmark-mirror-ui.js";
+/** Run a sequence of real Postmark requests against an ISOLATED root; tear it down after. */
+async function withRoot(steps) {
+    const root = mkdtempSync(join(tmpdir(), 'postmark-cap-'));
+    const h = (s) => handlePostmarkTwinRequest({
+        method: s.m, path: s.p,
+        body: s.b === undefined ? undefined : JSON.stringify(s.b),
+        root, ...(s.h ? { headers: s.h } : {}), ...(s.at ? { occurredAt: s.at } : {}),
+    });
+    try {
+        return await verifyBoundary('postmark.withRoot', () => steps(h, root));
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+const withRootCtx = (fn) => withRoot((h, root) => fn({ h, root }));
+/**
+ * Drive real sends with a webhook capture wired in through the HANDLER's own `deliver`
+ * injection point — so a webhook verify genuinely routes through the vendor's send-and-
+ * deliver code path (a sabotaged handler can never emit anything), and stays fully offline.
+ */
+async function withWebhookCapture(steps) {
+    const root = mkdtempSync(join(tmpdir(), 'postmark-cap-wh-'));
+    const seen = [];
+    const deliver = (url, body, headers) => {
+        seen.push({ url, body: JSON.parse(body), headers });
+    };
+    const h = (s) => handlePostmarkTwinRequest({
+        method: s.m, path: s.p,
+        body: s.b === undefined ? undefined : JSON.stringify(s.b),
+        root, deliver, ...(s.h ? { headers: s.h } : {}),
+    });
+    try {
+        return await verifyBoundary('postmark.withWebhookCapture', () => steps(h, seen));
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+const ok = (r) => r.status >= 200 && r.status < 300;
+const field = (r, k) => r.body?.[k];
+const errorCode = (r) => r.body?.ErrorCode;
+/** A failure assertion: the vendor's HTTP status AND its ErrorCode, never one alone. */
+const failedWith = (r, status, code) => r.status === status && errorCode(r) === code;
+const list = (r, key) => (r.body?.[key] ?? []);
+// A minimal valid send payload — the common fixture. NOTE it deliberately carries a Subject
+// even though Postmark does not require one; `postmark.email.subject_optional` proves the
+// vendor's real (surprising) behavior separately.
+const mkMail = (over = {}) => ({
+    From: 'Acme <notifications@acme.dev>',
+    To: 'ada@twin.test',
+    Subject: 'Your login code',
+    TextBody: 'Your code is 123456',
+    HtmlBody: '<strong>Your code is 123456</strong>',
+    ...over,
+});
+function fakePostmarkClient(over = {}) {
+    const c = {
+        sends: [], templateCreates: [], webhookCreates: [], streamCreates: [],
+        getOutboundMessages: async () => ({
+            TotalCount: 1,
+            Messages: [{
+                    MessageID: 'real-msg-0001', From: 'real@acme.dev', Subject: 'RealSubject',
+                    Recipients: ['real-recipient@twin.test'], To: [{ Email: 'real-recipient@twin.test', Name: '' }],
+                    ReceivedAt: '2026-01-01T00:00:00Z', Status: 'Sent', MessageStream: 'outbound',
+                    TrackOpens: true, TrackLinks: 'HtmlAndText', Tag: 'real-tag',
+                }],
+        }),
+        getBounces: async () => ({
+            TotalCount: 1,
+            Bounces: [{ ID: 9001, Type: 'HardBounce', Name: 'Hard bounce', Email: 'real-bounced@twin.test', BouncedAt: '2026-01-01T00:00:00Z', MessageStream: 'outbound', Inactive: true, CanActivate: true, Subject: 'RealBounceSubject' }],
+        }),
+        getTemplates: async () => ({
+            TotalCount: 1,
+            Templates: [{ TemplateId: 7001, Name: 'RealTemplate', Alias: 'real-alias', TemplateType: 'Standard', Active: true, Subject: 'Real {{ name }}' }],
+        }),
+        getMessageStreams: async () => ({
+            TotalCount: 1,
+            MessageStreams: [{ ID: 'real-stream', Name: 'RealStream', MessageStreamType: 'Broadcast', CreatedAt: '2026-01-01T00:00:00Z' }],
+        }),
+        getWebhooks: async () => ({ Webhooks: [{ ID: 5001, Url: 'https://real.test/hook', MessageStream: 'outbound', Triggers: { Delivery: { Enabled: true } } }] }),
+        getServer: async () => ({ ID: 42, Name: 'RealServer', DeliveryType: 'Live', Color: 'purple', TrackOpens: true }),
+        sendEmail: async (m) => { c.sends.push(m); return { MessageID: 'real-sent-0001', ErrorCode: 0, Message: 'OK' }; },
+        createTemplate: async (o) => { c.templateCreates.push(o); return { TemplateId: 7777 }; },
+        createWebhook: async (o) => { c.webhookCreates.push(o); return { ID: 8888 }; },
+        createMessageStream: async (o) => { c.streamCreates.push(o); return { ID: String(o.ID ?? 'real-created') }; },
+        ...over,
+    };
+    return c;
+}
+// ── shorthands (mirror the clerk/stripe/resend manifests) ──
+const done = (id, area, title, dimension, tier, verify) => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id, area, title, dimension, tier) => ({ id, area, title, dimension, tier, expected: 'todo' });
+export const POSTMARK_CAPABILITIES = [
+    // ── Email API — the headline surface (POST /email is what ships auth OTPs) ────────
+    done('postmark.email.send', 'email', 'Email: send (POST /email → MessageID/SubmittedAt/ErrorCode 0)', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email', b: mkMail() });
+        if (!ok(r) || errorCode(r) !== 0 || field(r, 'Message') !== 'OK')
+            return false;
+        const id = field(r, 'MessageID');
+        // Postmark's MessageID is a bare UUID (no vendor prefix) and the response echoes To.
+        return typeof id === 'string'
+            && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id)
+            && field(r, 'To') === 'ada@twin.test'
+            && typeof field(r, 'SubmittedAt') === 'string';
+    })),
+    done('postmark.email.stored_not_sent', 'email', 'Email: the message is STORED in twin state, never really sent', 'api', 'core', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Persisted subject', HtmlBody: '<em>persisted-body</em>' }) });
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        return ok(d) && field(d, 'Subject') === 'Persisted subject' && field(d, 'HtmlBody') === '<em>persisted-body</em>';
+    })),
+    done('postmark.email.send_text_only', 'email', 'Email: send with TextBody only', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: 'b@twin.test', Subject: 's', TextBody: 'plain only' } });
+        if (!ok(r))
+            return false;
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+        return ok(d) && field(d, 'TextBody') === 'plain only' && field(d, 'HtmlBody') === null;
+    })),
+    done('postmark.email.send_cc_bcc_reply_to', 'email', 'Email: Cc/Bcc/ReplyTo/Headers/Metadata/Tag are carried', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email', b: mkMail({
+                Cc: 'cc@twin.test', Bcc: 'Blind <bcc@twin.test>', ReplyTo: 'reply@acme.dev',
+                Tag: 'welcome', Metadata: { tenant: 'acme' }, Headers: [{ Name: 'X-Twin', Value: '1' }],
+            }) });
+        if (!ok(r) || field(r, 'Cc') !== 'cc@twin.test' || field(r, 'Bcc') !== 'bcc@twin.test')
+            return false;
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+        const cc = field(d, 'Cc');
+        const bcc = field(d, 'Bcc');
+        return ok(d) && cc?.[0]?.Email === 'cc@twin.test'
+            && bcc?.[0]?.Email === 'bcc@twin.test' && bcc?.[0]?.Name === 'Blind'
+            && field(d, 'Tag') === 'welcome' && field(d, 'Metadata')?.tenant === 'acme';
+    })),
+    done('postmark.email.recipient_string_parsing', 'email', 'Email: comma-separated `Name <addr>` recipient parsing', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'Ada Lovelace <ada@twin.test>, grace@twin.test' }) });
+        if (!ok(r) || field(r, 'To') !== 'ada@twin.test, grace@twin.test')
+            return false;
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+        const to = field(d, 'To');
+        return to?.length === 2 && to[0].Name === 'Ada Lovelace' && to[0].Email === 'ada@twin.test' && to[1].Email === 'grace@twin.test';
+    })),
+    done('postmark.email.validate_missing_from', 'email', 'Email: 422 ErrorCode 300 on missing/invalid From (validated FIRST)', 'api', 'core', () => withRoot(async (h) => {
+        const missing = await h({ m: 'POST', p: '/email', b: { To: 'x@twin.test', Subject: 's', TextBody: 't' } });
+        // [WIRE] an EMPTY body also answers the From error — From is validated before recipients.
+        const empty = await h({ m: 'POST', p: '/email', b: {} });
+        const malformed = await h({ m: 'POST', p: '/email', b: mkMail({ From: 'not-an-address' }) });
+        return failedWith(missing, 422, 300) && field(missing, 'Message') === "Invalid 'From' value."
+            && failedWith(empty, 422, 300) && field(empty, 'Message') === "Invalid 'From' value."
+            && failedWith(malformed, 422, 300);
+    })),
+    done('postmark.email.validate_zero_recipients', 'email', 'Email: 422 ErrorCode 300 "Zero recipients specified."', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', Subject: 's', TextBody: 't' } });
+        const blank = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: '', Subject: 's', TextBody: 't' } });
+        return failedWith(r, 422, 300) && field(r, 'Message') === 'Zero recipients specified.' && failedWith(blank, 422, 300);
+    })),
+    done('postmark.email.validate_missing_body', 'email', 'Email: 422 ErrorCode 300 when neither HtmlBody nor TextBody is given', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: 'b@twin.test', Subject: 's' } });
+        return failedWith(r, 422, 300) && String(field(r, 'Message')).includes('TextBody');
+    })),
+    done('postmark.email.subject_optional', 'email', 'Email: Subject is NOT required (a send without one succeeds)', 'api', 'common', () => withRoot(async (h) => {
+        // Verified against the LIVE api.postmarkapp.com with the public test token during this
+        // pack's build: Postmark accepts a send with no Subject. Guards the twin against the
+        // very common (wrong) assumption that Subject is mandatory.
+        const r = await h({ m: 'POST', p: '/email', b: { From: 'a@acme.dev', To: 'b@twin.test', TextBody: 'no subject here' } });
+        if (!ok(r) || errorCode(r) !== 0)
+            return false;
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(r, 'MessageID')}/details` });
+        return ok(d) && field(d, 'Subject') === '';
+    })),
+    done('postmark.email.validate_bad_recipient', 'email', 'Email: 422 ErrorCode 300 on an illegal recipient address', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'ada@twin.test, not-an-address' }) });
+        return failedWith(r, 422, 300) && String(field(r, 'Message')).includes('not-an-address');
+    })),
+    done('postmark.email.invalid_json', 'email', 'Email: 422 ErrorCode 402 "Invalid JSON" on a malformed body', 'api', 'common', () => withRoot(async () => {
+        const root = mkdtempSync(join(tmpdir(), 'postmark-json-'));
+        try {
+            const r = await handlePostmarkTwinRequest({ method: 'POST', path: '/email', body: '{"From":', root });
+            return failedWith(r, 422, 402) && field(r, 'Message') === 'Invalid JSON';
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('postmark.email.attachments', 'email', 'Email: attachments (Name/Content/ContentType) + their 422', 'api', 'common', () => withRoot(async (h) => {
+        const good = await h({ m: 'POST', p: '/email', b: mkMail({ Attachments: [{ Name: 'receipt.pdf', Content: 'dGVzdA==', ContentType: 'application/pdf' }] }) });
+        if (!ok(good))
+            return false;
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(good, 'MessageID')}/details` });
+        const bad = await h({ m: 'POST', p: '/email', b: mkMail({ Attachments: [{ Name: 'x.pdf' }] }) });
+        return ok(d) && field(d, 'Attachments')?.includes('receipt.pdf') && failedWith(bad, 422, 300);
+    })),
+    done('postmark.email.stream_routing', 'email', 'Email: MessageStream routing + 422 ErrorCode 1235 for an unknown stream', 'api', 'core', () => withRoot(async (h) => {
+        const created = await h({ m: 'POST', p: '/message-streams', b: { ID: 'promos', Name: 'Promos', MessageStreamType: 'Broadcast' } });
+        if (!ok(created))
+            return false;
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ MessageStream: 'promos' }) });
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        const missing = await h({ m: 'POST', p: '/email', b: mkMail({ MessageStream: 'does-not-exist' }) });
+        return ok(sent) && field(d, 'MessageStream') === 'promos' && failedWith(missing, 422, 1235);
+    })),
+    done('postmark.email.default_stream', 'email', 'Email: a send with no MessageStream lands on `outbound`', 'api', 'core', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail() });
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        return ok(d) && field(d, 'MessageStream') === 'outbound';
+    })),
+    done('postmark.email.batch', 'email', 'Email: POST /email/batch → one result per message (bare array)', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email/batch', b: [mkMail({ To: 'one@twin.test' }), mkMail({ To: 'two@twin.test' })] });
+        const arr = r.body;
+        if (!ok(r) || !Array.isArray(arr) || arr.length !== 2)
+            return false;
+        if (arr[0].To !== 'one@twin.test' || arr[1].To !== 'two@twin.test')
+            return false;
+        if (arr.some((e) => e.ErrorCode !== 0 || typeof e.MessageID !== 'string'))
+            return false;
+        // Both really landed in twin state.
+        const listed = await h({ m: 'GET', p: '/messages/outbound' });
+        return field(listed, 'TotalCount') === 2;
+    })),
+    done('postmark.email.batch_per_message_errors', 'email', 'Email: batch reports PER-MESSAGE errors inside a 200, not a top-level 422', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/email/batch', b: [mkMail({ To: 'good@twin.test' }), { To: 'x@twin.test', Subject: 's', TextBody: 't' }] });
+        const arr = r.body;
+        if (r.status !== 200 || !Array.isArray(arr) || arr.length !== 2)
+            return false;
+        // Only the good one was actually enacted.
+        const listed = await h({ m: 'GET', p: '/messages/outbound' });
+        return arr[0].ErrorCode === 0 && arr[1].ErrorCode === 300 && field(listed, 'TotalCount') === 1;
+    })),
+    done('postmark.email.batch_cap', 'email', 'Email: 422 ErrorCode 410 over the 500-message batch cap', 'api', 'common', () => withRoot(async (h) => {
+        const over = Array.from({ length: 501 }, (_v, i) => mkMail({ To: `r${i}@twin.test` }));
+        const r = await h({ m: 'POST', p: '/email/batch', b: over });
+        const empty = await h({ m: 'POST', p: '/email/batch', b: [] });
+        return failedWith(r, 422, 410) && String(field(r, 'Message')).includes('500') && failedWith(empty, 422, 300);
+    })),
+    done('postmark.email.inactive_recipient', 'email', 'Email: 422 ErrorCode 406 sending to a SUPPRESSED recipient (dirty state)', 'api', 'core', () => withRoot(async (h) => {
+        // A DIRTY-STATE capability: it can only fail over PRIOR state. First send bounces and
+        // auto-suppresses the address; the SECOND send to the same address must be refused with
+        // the vendor's inactive-recipient error. A fresh-root-only test can never reach this.
+        const first = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-me@twin.test' }) });
+        if (!ok(first))
+            return false;
+        const second = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-me@twin.test' }) });
+        if (!failedWith(second, 422, 406) || !String(field(second, 'Message')).includes('bounce-me@twin.test'))
+            return false;
+        // …and only ONE message was ever stored (the refusal enacted nothing).
+        const listed = await h({ m: 'GET', p: '/messages/outbound' });
+        return field(listed, 'TotalCount') === 1;
+    })),
+    done('postmark.email.send_with_template', 'email', 'Email: POST /email/withTemplate renders a stored template', 'api', 'core', () => withRoot(async (h) => {
+        const t = await h({ m: 'POST', p: '/templates', b: { Name: 'Welcome', Alias: 'welcome', Subject: 'Hi {{ name }}', HtmlBody: '<p>Code {{ code }}</p>', TextBody: 'Code {{ code }}' } });
+        if (!ok(t))
+            return false;
+        const sent = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateAlias: 'welcome', TemplateModel: { name: 'Ada', code: '424242' } } });
+        if (!ok(sent) || errorCode(sent) !== 0)
+            return false;
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        return field(d, 'Subject') === 'Hi Ada' && field(d, 'HtmlBody') === '<p>Code 424242</p>' && field(d, 'TextBody') === 'Code 424242';
+    })),
+    done('postmark.email.send_with_template_by_id', 'email', 'Email: withTemplate resolves by numeric TemplateId too', 'api', 'common', () => withRoot(async (h) => {
+        const t = await h({ m: 'POST', p: '/templates', b: { Name: 'ById', Subject: 'Sub {{ x }}', TextBody: 'Body {{ x }}' } });
+        const sent = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateId: field(t, 'TemplateId'), TemplateModel: { x: 'resolved' } } });
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        return ok(sent) && field(d, 'Subject') === 'Sub resolved';
+    })),
+    done('postmark.email.template_not_found', 'email', 'Email: 422 ErrorCode 1101 for an unknown / unspecified template', 'api', 'core', () => withRoot(async (h) => {
+        const unknown = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateAlias: 'nope', TemplateModel: {} } });
+        const neither = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateModel: {} } });
+        return failedWith(unknown, 422, 1101) && failedWith(neither, 422, 1101);
+    })),
+    done('postmark.email.template_unknown_token_renders_empty', 'email', 'Email: an unmodeled template token renders EMPTY (non-strict Mustachio)', 'api', 'niche', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/templates', b: { Name: 'Partial', Alias: 'partial', Subject: 'S', TextBody: 'a[{{ known }}]b[{{ unknown }}]c' } });
+        const sent = await h({ m: 'POST', p: '/email/withTemplate', b: { From: 'a@acme.dev', To: 'b@twin.test', TemplateAlias: 'partial', TemplateModel: { known: 'X' } } });
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        return ok(sent) && field(d, 'TextBody') === 'a[X]b[]c';
+    })),
+    done('postmark.email.batch_with_templates', 'email', 'Email: POST /email/batchWithTemplates ({Messages:[…]} → array)', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/templates', b: { Name: 'Batch', Alias: 'batch-t', Subject: 'S {{ n }}', TextBody: 'B {{ n }}' } });
+        const r = await h({ m: 'POST', p: '/email/batchWithTemplates', b: { Messages: [
+                    { From: 'a@acme.dev', To: 'one@twin.test', TemplateAlias: 'batch-t', TemplateModel: { n: '1' } },
+                    { From: 'a@acme.dev', To: 'two@twin.test', TemplateAlias: 'batch-t', TemplateModel: { n: '2' } },
+                ] } });
+        const arr = r.body;
+        if (!ok(r) || arr?.length !== 2 || arr.some((e) => e.ErrorCode !== 0))
+            return false;
+        const d = await h({ m: 'GET', p: `/messages/outbound/${arr[1].MessageID}/details` });
+        return field(d, 'Subject') === 'S 2';
+    })),
+    // §9 DEMOTED from `done`: answering the vendor's approval refusal (ErrorCode 14) on
+    // /email/bulk is the twin declining to model the Bulk API, not modeling it. The behavior
+    // is still correct and still tested (postmark-twin.test.ts), but it is not coverage.
+    todo('postmark.email.bulk_requires_approval', 'email', 'Bulk API: POST /email/bulk approval gate (ErrorCode 14)', 'api', 'niche'),
+    todo('postmark.email.recipient_cap_50', 'email', 'Email: enforce the 50-recipients-per-field cap with the vendor message', 'api', 'niche'),
+    todo('postmark.email.payload_size_413', 'email', 'Email: 413 over the 10MB (single) / 50MB (batch) payload cap', 'api', 'niche'),
+    todo('postmark.email.inline_css_for_templates', 'email', 'Email: InlineCss option on templated sends', 'api', 'niche'),
+    // Grounded in the vendor's Bulk API docs page and its own error codes 12 ("Bulk send not
+    // found") and 14 ("requires approval to access") — real surface the pinned SDK does not
+    // implement. Filed as todo, and the twin answers the vendor's 14 on the two published
+    // routes only (postmark-twin.ts), so the rest of the subtree still 404s.
+    todo('postmark.email.bulk_send_lifecycle', 'email', 'Bulk API: POST /email/bulk + GET /email/bulk/{id} job lifecycle', 'api', 'niche'),
+    todo('postmark.email.smtp_transport', 'email', 'Postmark SMTP transport (smtp.postmarkapp.com) — accept mail over SMTP with the server token as the password', 'api', 'common'),
+    // ── Messages API (outbound activity) ─────────────────────────────────────────────
+    done('postmark.messages.outbound_list', 'messages', 'Messages: GET /messages/outbound → {TotalCount, Messages[]}', 'api', 'core', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Listed message' }) });
+        const r = await h({ m: 'GET', p: '/messages/outbound' });
+        const rows = list(r, 'Messages');
+        const row = rows.find((x) => x.MessageID === field(sent, 'MessageID'));
+        return ok(r) && field(r, 'TotalCount') === 1 && !!row && row.Subject === 'Listed message'
+            // the LIST shape deliberately omits bodies + events (the vendor's own split)
+            && row.HtmlBody === undefined && row.MessageEvents === undefined;
+    })),
+    done('postmark.messages.outbound_recipient_shapes', 'messages', 'Messages: the vendor GENUINELY mixes recipient shapes in ONE payload — To/Cc/Bcc are [{Email,Name}] while Recipients is [string] — pinned so neither side ever "fixes" the other into consistency', 'api', 'core', () => withRoot(async (h) => {
+        // GROUNDED twice over (2026-08-20): postmarkapp.com/developer/api/messages-api's outbound
+        // search example answers `"To":[{"Email":"john.doe@yahoo.com","Name":null}]` NEXT TO
+        // `"Recipients":["john.doe@yahoo.com"]`, and the official postmark.js SDK types the same
+        // split (`OutboundMessage.To: Recipient[]` vs `Recipients: string[]`). A blind adoption
+        // run read this as a twin bug; it is the vendor's real shape, in list AND details alike.
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'Ada L <ada@twin.test>', Cc: 'grace@twin.test' }) });
+        if (!ok(sent))
+            return false;
+        const listed = await h({ m: 'GET', p: '/messages/outbound' });
+        const row = list(listed, 'Messages').find((x) => x.MessageID === field(sent, 'MessageID'));
+        const details = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        const shapes = (m) => !!m
+            // To/Cc: arrays of {Email, Name} OBJECTS…
+            && Array.isArray(m.To) && m.To.length === 1
+            && m.To[0].Email === 'ada@twin.test' && m.To[0].Name === 'Ada L'
+            && Array.isArray(m.Cc) && m.Cc[0].Email === 'grace@twin.test'
+            // …while Recipients, in the SAME payload, is plain email STRINGS across To+Cc+Bcc
+            && Array.isArray(m.Recipients) && m.Recipients.every((r) => typeof r === 'string')
+            && JSON.stringify(m.Recipients) === '["ada@twin.test","grace@twin.test"]';
+        return shapes(row) && shapes(details.body);
+    })),
+    done('postmark.messages.outbound_filters', 'messages', 'Messages: outbound filters (recipient/tag/subject/fromEmail/stream)', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'alpha@twin.test', Tag: 'alpha', Subject: 'Alpha subject' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'beta@twin.test', Tag: 'beta', Subject: 'Beta subject' }) });
+        const byRecipient = await h({ m: 'GET', p: '/messages/outbound?recipient=alpha@twin.test' });
+        const byTag = await h({ m: 'GET', p: '/messages/outbound?tag=beta' });
+        const bySubject = await h({ m: 'GET', p: '/messages/outbound?subject=Alpha' });
+        const byStream = await h({ m: 'GET', p: '/messages/outbound?messageStream=broadcast' });
+        return field(byRecipient, 'TotalCount') === 1 && list(byRecipient, 'Messages')[0].Tag === 'alpha'
+            && field(byTag, 'TotalCount') === 1 && list(byTag, 'Messages')[0].Subject === 'Beta subject'
+            && field(bySubject, 'TotalCount') === 1
+            && field(byStream, 'TotalCount') === 0;
+    })),
+    done('postmark.messages.outbound_pagination', 'messages', 'Messages: count/offset pagination keeps TotalCount whole', 'api', 'common', () => withRoot(async (h) => {
+        for (let i = 0; i < 3; i++)
+            await h({ m: 'POST', p: '/email', b: mkMail({ Subject: `Page ${i}`, To: `p${i}@twin.test` }) });
+        const page = await h({ m: 'GET', p: '/messages/outbound?count=2&offset=1' });
+        return field(page, 'TotalCount') === 3 && list(page, 'Messages').length === 2;
+    })),
+    done('postmark.messages.outbound_details', 'messages', 'Messages: GET /messages/outbound/:id/details (bodies + MessageEvents)', 'api', 'core', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Detailed', TrackOpens: true }) });
+        const d = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/details` });
+        const missing = await h({ m: 'GET', p: '/messages/outbound/00000000-0000-0000-0000-000000000000/details' });
+        const events = field(d, 'MessageEvents');
+        return ok(d) && field(d, 'Subject') === 'Detailed'
+            && Array.isArray(events) && events.some((e) => e.Type === 'Delivered')
+            && typeof field(d, 'Body') === 'string'
+            && failedWith(missing, 422, 701);
+    })),
+    done('postmark.messages.outbound_dump', 'messages', 'Messages: GET /messages/outbound/:id/dump → the raw source', 'api', 'niche', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Dumped', TextBody: 'dump-marker' }) });
+        const dump = await h({ m: 'GET', p: `/messages/outbound/${field(sent, 'MessageID')}/dump` });
+        const missing = await h({ m: 'GET', p: '/messages/outbound/nope/dump' });
+        const raw = String(field(dump, 'Body') ?? '');
+        return ok(dump) && raw.includes('Subject: Dumped') && raw.includes(String(field(sent, 'MessageID'))) && failedWith(missing, 422, 701);
+    })),
+    done('postmark.messages.delivery_events', 'messages', 'Messages: the deterministic offline delivery lifecycle writes MessageEvents', 'api', 'core', () => withRoot(async (h) => {
+        const plain = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'plain@twin.test' }) });
+        const tracked = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'tracked@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+        const a = await h({ m: 'GET', p: `/messages/outbound/${field(plain, 'MessageID')}/details` });
+        const b = await h({ m: 'GET', p: `/messages/outbound/${field(tracked, 'MessageID')}/details` });
+        const types = (r) => field(r, 'MessageEvents').map((e) => e.Type);
+        // Tracking is opt-in on Postmark: no TrackOpens ⇒ no Open event, ever.
+        return JSON.stringify(types(a)) === JSON.stringify(['Delivered'])
+            && JSON.stringify(types(b)) === JSON.stringify(['Delivered', 'Opened', 'LinkClicked']);
+    })),
+    done('postmark.messages.opens', 'messages', 'Messages: GET /messages/outbound/opens (+ per-message)', 'api', 'common', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'opener@twin.test', TrackOpens: true }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'untracked@twin.test' }) }); // no TrackOpens → no open
+        const all = await h({ m: 'GET', p: '/messages/outbound/opens' });
+        const one = await h({ m: 'GET', p: `/messages/outbound/opens/${field(sent, 'MessageID')}` });
+        const rows = list(all, 'Opens');
+        return ok(all) && field(all, 'TotalCount') === 1 && rows[0].RecordType === 'Open'
+            && rows[0].Recipient === 'opener@twin.test' && field(one, 'TotalCount') === 1;
+    })),
+    done('postmark.messages.clicks', 'messages', 'Messages: GET /messages/outbound/clicks (+ per-message)', 'api', 'common', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'clicker@twin.test', TrackLinks: 'HtmlAndText' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'nolinks@twin.test' }) });
+        const all = await h({ m: 'GET', p: '/messages/outbound/clicks' });
+        const one = await h({ m: 'GET', p: `/messages/outbound/clicks/${field(sent, 'MessageID')}` });
+        const rows = list(all, 'Clicks');
+        return ok(all) && field(all, 'TotalCount') === 1 && rows[0].RecordType === 'Click'
+            && rows[0].ClickLocation === 'HTML' && field(one, 'TotalCount') === 1;
+    })),
+    done('postmark.messages.inbound_list', 'messages', 'Messages: GET /messages/inbound + /details', 'api', 'common', () => withRoot(async (h) => {
+        // Seeded through the twin-only `_twin/inbound` route (real inbound mail is MX-routed and
+        // unreachable offline); the READ path under test is Postmark's real endpoint.
+        const seeded = await h({ m: 'POST', p: '/_twin/inbound', b: { From: 'reply@customer.test', Subject: 'Re: your invoice', TextBody: 'inbound-body-marker', MailboxHash: 'abc' } });
+        if (!ok(seeded))
+            return false;
+        const all = await h({ m: 'GET', p: '/messages/inbound' });
+        const rows = list(all, 'InboundMessages');
+        const d = await h({ m: 'GET', p: `/messages/inbound/${field(seeded, 'MessageID')}/details` });
+        const missing = await h({ m: 'GET', p: '/messages/inbound/nope/details' });
+        return field(all, 'TotalCount') === 1 && rows[0].Subject === 'Re: your invoice'
+            // the list shape omits bodies; details carries them
+            && rows[0].TextBody === undefined && field(d, 'TextBody') === 'inbound-body-marker'
+            && failedWith(missing, 422, 701);
+    })),
+    done('postmark.messages.inbound_retry', 'messages', 'Messages: PUT /messages/inbound/:id/retry re-queues, bypass 422s on a non-blocked message', 'api', 'niche', () => withRoot(async (h) => {
+        const seeded = await h({ m: 'POST', p: '/_twin/inbound', b: { Subject: 'Retryable' } });
+        const id = field(seeded, 'MessageID');
+        const retried = await h({ m: 'PUT', p: `/messages/inbound/${id}/retry` });
+        const after = await h({ m: 'GET', p: `/messages/inbound/${id}/details` });
+        // Only a BLOCKED message can be bypassed — this one is Processed, so the vendor 422s.
+        const bypass = await h({ m: 'PUT', p: `/messages/inbound/${id}/bypass` });
+        return ok(retried) && errorCode(retried) === 0 && field(after, 'Status') === 'Queued' && failedWith(bypass, 422, 701);
+    })),
+    todo('postmark.messages.inbound_ingest', 'messages', 'Messages: real inbound ingestion via the server inbound address/webhook', 'api', 'common'),
+    todo('postmark.messages.outbound_date_filters', 'messages', 'Messages: fromDate/toDate filtering on outbound activity', 'api', 'niche'),
+    todo('postmark.messages.tracking_client_filters', 'messages', 'Messages: opens/clicks filtering by client/OS/platform/geo', 'api', 'niche'),
+    // ── Bounce API ───────────────────────────────────────────────────────────────────
+    done('postmark.bounces.recorded_on_bounce', 'bounces', 'Bounces: a bounced send mints a real Bounce record', 'api', 'core', () => withRoot(async (h) => {
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-hard@twin.test', Subject: 'Bounced subject' }) });
+        const r = await h({ m: 'GET', p: '/bounces' });
+        const b = list(r, 'Bounces')[0];
+        return ok(r) && field(r, 'TotalCount') === 1 && !!b
+            && b.Type === 'HardBounce' && b.TypeCode === 1 && b.Email === 'bounce-hard@twin.test'
+            && b.MessageID === field(sent, 'MessageID') && b.Inactive === true && b.Subject === 'Bounced subject';
+    })),
+    done('postmark.bounces.spam_complaint', 'bounces', 'Bounces: a spam complaint is recorded and is NOT reactivatable', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-reporter@twin.test' }) });
+        const r = await h({ m: 'GET', p: '/bounces' });
+        const b = list(r, 'Bounces')[0];
+        const activate = await h({ m: 'PUT', p: `/bounces/${b.ID}/activate` });
+        return b.Type === 'SpamComplaint' && b.TypeCode === 100001 && b.CanActivate === false
+            && failedWith(activate, 422, 1003);
+    })),
+    done('postmark.bounces.retrieve', 'bounces', 'Bounces: GET /bounces/:id + 422 ErrorCode 1001 for an unknown id', 'api', 'core', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-one@twin.test' }) });
+        const one = await h({ m: 'GET', p: '/bounces/1' });
+        const missing = await h({ m: 'GET', p: '/bounces/9999' });
+        return ok(one) && field(one, 'ID') === 1 && field(one, 'Email') === 'bounce-one@twin.test'
+            && field(one, 'RecordType') === 'Bounce' && failedWith(missing, 422, 1001);
+    })),
+    done('postmark.bounces.list_filters', 'bounces', 'Bounces: filter by type/emailFilter/inactive', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-a@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-b@twin.test' }) });
+        const hard = await h({ m: 'GET', p: '/bounces?type=HardBounce' });
+        const byEmail = await h({ m: 'GET', p: '/bounces?emailFilter=spam-b' });
+        return field(hard, 'TotalCount') === 1 && list(hard, 'Bounces')[0].Email === 'bounce-a@twin.test'
+            && field(byEmail, 'TotalCount') === 1 && list(byEmail, 'Bounces')[0].Type === 'SpamComplaint';
+    })),
+    done('postmark.bounces.dump', 'bounces', 'Bounces: GET /bounces/:id/dump → the raw bounce body', 'api', 'niche', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-dump@twin.test' }) });
+        const dump = await h({ m: 'GET', p: '/bounces/1/dump' });
+        const missing = await h({ m: 'GET', p: '/bounces/42/dump' });
+        return ok(dump) && String(field(dump, 'Body')).includes('Undelivered Mail') && failedWith(missing, 422, 1001);
+    })),
+    done('postmark.bounces.activate_restores_sending', 'bounces', 'Bounces: PUT /bounces/:id/activate clears the suppression (dirty state)', 'api', 'common', () => withRoot(async (h) => {
+        // A DIRTY-STATE capability spanning three writes: bounce → refusal → reactivate → send.
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-again@twin.test' }) });
+        const refused = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-again@twin.test' }) });
+        if (!failedWith(refused, 422, 406))
+            return false;
+        const activated = await h({ m: 'PUT', p: '/bounces/1/activate' });
+        if (!ok(activated) || field(activated, 'Bounce')?.Inactive !== false)
+            return false;
+        // Reactivation clears the suppression…
+        const dump = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' });
+        if (list(dump, 'Suppressions').length !== 0)
+            return false;
+        // …so the address is accepted again. (It re-bounces immediately — that is correct: the
+        // twin's bounce simulator is recipient-driven — so a SECOND bounce row is now minted,
+        // which is exactly what a reactivated-then-still-bad address does on the real vendor.)
+        const resent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-again@twin.test' }) });
+        const bounces = await h({ m: 'GET', p: '/bounces' });
+        return ok(resent) && errorCode(resent) === 0 && field(bounces, 'TotalCount') === 2
+            && list(bounces, 'Bounces').map((b) => b.ID).sort().join(',') === '1,2';
+    })),
+    done('postmark.bounces.delivery_stats', 'bounces', 'Bounces: GET /deliverystats aggregates real twin bounces', 'api', 'core', () => withRoot(async (h) => {
+        const before = await h({ m: 'GET', p: '/deliverystats' });
+        if (field(before, 'InactiveMails') !== 0 || field(before, 'Bounces')[0].Count !== 0)
+            return false;
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-x@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-y@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-z@twin.test' }) });
+        const after = await h({ m: 'GET', p: '/deliverystats' });
+        const rows = field(after, 'Bounces');
+        const all = rows[0];
+        const hard = rows.find((x) => x.Type === 'HardBounce');
+        const spam = rows.find((x) => x.Type === 'SpamComplaint');
+        // The vendor's first row is the "All" total and carries NO Type key.
+        return field(after, 'InactiveMails') === 3 && all.Name === 'All' && all.Count === 3 && all.Type === undefined
+            && hard?.Count === 2 && spam?.Count === 1;
+    })),
+    todo('postmark.bounces.date_filters', 'bounces', 'Bounces: fromDate/toDate + messageStream filtering', 'api', 'niche'),
+    todo('postmark.bounces.soft_bounce_types', 'bounces', 'Bounces: the full BounceType taxonomy (Transient, DnsError, DMARCPolicy, …)', 'api', 'common'),
+    // ── Templates API ────────────────────────────────────────────────────────────────
+    done('postmark.templates.create', 'templates', 'Templates: POST /templates → the short create shape', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/templates', b: { Name: 'Receipt', Alias: 'receipt', Subject: 'Your receipt', HtmlBody: '<p>Thanks</p>' } });
+        return ok(r) && field(r, 'TemplateId') === 1 && field(r, 'Name') === 'Receipt'
+            && field(r, 'Alias') === 'receipt' && field(r, 'Active') === true
+            && field(r, 'TemplateType') === 'Standard'
+            // the CREATE response is the short shape — no bodies (SDK: TemplateInList)
+            && field(r, 'HtmlBody') === undefined;
+    })),
+    done('postmark.templates.retrieve_by_id_or_alias', 'templates', 'Templates: GET /templates/:idOrAlias resolves both ways', 'api', 'core', () => withRoot(async (h) => {
+        const c = await h({ m: 'POST', p: '/templates', b: { Name: 'Both', Alias: 'both-ways', Subject: 'S', TextBody: 'T' } });
+        const byId = await h({ m: 'GET', p: `/templates/${field(c, 'TemplateId')}` });
+        const byAlias = await h({ m: 'GET', p: '/templates/both-ways' });
+        const missing = await h({ m: 'GET', p: '/templates/nope' });
+        return ok(byId) && field(byId, 'Subject') === 'S' && field(byId, 'TextBody') === 'T'
+            && field(byAlias, 'TemplateId') === field(byId, 'TemplateId')
+            && failedWith(missing, 422, 1101);
+    })),
+    done('postmark.templates.list', 'templates', 'Templates: GET /templates → {TotalCount, Templates[]} (short shape)', 'api', 'core', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/templates', b: { Name: 'One', Alias: 'one', Subject: 'S1', TextBody: 'T1' } });
+        await h({ m: 'POST', p: '/templates', b: { Name: 'Layout', TemplateType: 'Layout', HtmlBody: '{{{ @content }}}' } });
+        const all = await h({ m: 'GET', p: '/templates' });
+        const layouts = await h({ m: 'GET', p: '/templates?templateType=Layout' });
+        const rows = list(all, 'Templates');
+        return field(all, 'TotalCount') === 2 && rows[0].Name === 'One' && rows[0].Subject === undefined
+            && field(layouts, 'TotalCount') === 1 && list(layouts, 'Templates')[0].Name === 'Layout';
+    })),
+    done('postmark.templates.update', 'templates', 'Templates: PUT /templates/:idOrAlias edits content', 'api', 'core', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/templates', b: { Name: 'Editable', Alias: 'editable', Subject: 'Before', TextBody: 'before' } });
+        const upd = await h({ m: 'PUT', p: '/templates/editable', b: { Subject: 'After', TextBody: 'after' } });
+        const got = await h({ m: 'GET', p: '/templates/editable' });
+        const missing = await h({ m: 'PUT', p: '/templates/nope', b: { Subject: 'x' } });
+        const noData = await h({ m: 'PUT', p: '/templates/editable', b: {} });
+        return ok(upd) && field(got, 'Subject') === 'After' && field(got, 'TextBody') === 'after'
+            && failedWith(missing, 422, 1101) && failedWith(noData, 422, 1109);
+    })),
+    done('postmark.templates.delete', 'templates', 'Templates: DELETE /templates/:idOrAlias', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/templates', b: { Name: 'Doomed', Alias: 'doomed', Subject: 'S', TextBody: 'T' } });
+        const del = await h({ m: 'DELETE', p: '/templates/doomed' });
+        const after = await h({ m: 'GET', p: '/templates/doomed' });
+        const listed = await h({ m: 'GET', p: '/templates' });
+        const again = await h({ m: 'DELETE', p: '/templates/doomed' });
+        return ok(del) && errorCode(del) === 0 && failedWith(after, 422, 1101)
+            && field(listed, 'TotalCount') === 0 && failedWith(again, 422, 1101);
+    })),
+    done('postmark.templates.id_ratchet_after_delete', 'templates', 'Templates: a deleted TemplateId is never re-issued (dirty state)', 'api', 'common', () => withRoot(async (h) => {
+        // DIRTY-STATE: the id mint must count TOMBSTONES, not just live rows. A naive
+        // `liveRows.length + 1` re-issues id 1 here and silently aliases a retired template.
+        const first = await h({ m: 'POST', p: '/templates', b: { Name: 'First', Alias: 'first', Subject: 'S', TextBody: 'T' } });
+        await h({ m: 'DELETE', p: '/templates/first' });
+        const second = await h({ m: 'POST', p: '/templates', b: { Name: 'Second', Alias: 'second', Subject: 'S2', TextBody: 'T2' } });
+        const got = await h({ m: 'GET', p: `/templates/${field(second, 'TemplateId')}` });
+        const oldId = await h({ m: 'GET', p: `/templates/${field(first, 'TemplateId')}` });
+        return field(first, 'TemplateId') === 1 && field(second, 'TemplateId') === 2
+            && field(got, 'Name') === 'Second' && failedWith(oldId, 422, 1101);
+    })),
+    done('postmark.templates.alias_uniqueness', 'templates', 'Templates: a duplicate Alias is rejected', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/templates', b: { Name: 'A', Alias: 'shared', Subject: 'S', TextBody: 'T' } });
+        const dup = await h({ m: 'POST', p: '/templates', b: { Name: 'B', Alias: 'shared', Subject: 'S', TextBody: 'T' } });
+        const listed = await h({ m: 'GET', p: '/templates' });
+        return dup.status === 422 && String(field(dup, 'Message')).includes('shared') && field(listed, 'TotalCount') === 1;
+    })),
+    done('postmark.templates.validate', 'templates', 'Templates: POST /templates/validate renders + suggests a model', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/templates/validate', b: {
+                Subject: 'Hi {{ name }}', HtmlBody: '<p>{{ product.title }}</p>', TextBody: 'plain',
+                TestRenderModel: { name: 'Ada', product: { title: 'Widget' } },
+            } });
+        const html = field(r, 'HtmlBody');
+        const suggested = field(r, 'SuggestedTemplateModel');
+        const broken = await h({ m: 'POST', p: '/templates/validate', b: { Subject: 'S', HtmlBody: '<p>{{ unterminated', TestRenderModel: {} } });
+        return ok(r) && field(r, 'AllContentIsValid') === true
+            && html.RenderedContent === '<p>Widget</p>'
+            && field(r, 'Subject').RenderedContent === 'Hi Ada'
+            && suggested.name === 'name_Value' && suggested.product === 'product_Value'
+            && field(broken, 'AllContentIsValid') === false;
+    })),
+    done('postmark.templates.create_validation', 'templates', 'Templates: 422 ErrorCode 1109 without a Name', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/templates', b: { Subject: 'S', TextBody: 'T' } });
+        return failedWith(r, 422, 1109);
+    })),
+    todo('postmark.templates.push', 'templates', 'Templates: PUT /templates/push between servers (account token)', 'api', 'niche'),
+    todo('postmark.templates.layout_composition', 'templates', 'Templates: Layout templates composed into a Standard template ({{{ @content }}})', 'api', 'common'),
+    todo('postmark.templates.mustachio_blocks', 'templates', 'Templates: full Mustachio — {{#each}} / {{#if}} blocks and inverted sections', 'api', 'common'),
+    todo('postmark.templates.active_limit', 'templates', 'Templates: the per-server active-template limit (ErrorCode 1105)', 'api', 'niche'),
+    // ── Message Streams API ──────────────────────────────────────────────────────────
+    done('postmark.streams.default_streams', 'streams', 'Streams: a server is born with outbound/broadcast/inbound', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: '/message-streams' });
+        const rows = list(r, 'MessageStreams');
+        const byId = Object.fromEntries(rows.map((s) => [s.ID, s]));
+        // NB: this is the one list endpoint where the vendor emits TotalCount LAST.
+        return ok(r) && field(r, 'TotalCount') === 3
+            && byId.outbound?.MessageStreamType === 'Transactional'
+            && byId.broadcast?.MessageStreamType === 'Broadcast'
+            && byId.broadcast?.SubscriptionManagementConfiguration?.UnsubscribeHandlingType === 'Postmark'
+            && byId.inbound?.MessageStreamType === 'Inbound';
+    })),
+    done('postmark.streams.create', 'streams', 'Streams: POST /message-streams', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/message-streams', b: { ID: 'newsletters', Name: 'Newsletters', MessageStreamType: 'Broadcast', Description: 'Weekly' } });
+        const got = await h({ m: 'GET', p: '/message-streams/newsletters' });
+        return ok(r) && field(r, 'ID') === 'newsletters' && field(r, 'ServerID') === 1
+            && field(got, 'Name') === 'Newsletters' && field(got, 'Description') === 'Weekly'
+            && field(got, 'MessageStreamType') === 'Broadcast' && field(got, 'ArchivedAt') === null;
+    })),
+    done('postmark.streams.create_validation', 'streams', 'Streams: the vendor 422s for a bad ID / type / name / duplicate', 'api', 'common', () => withRoot(async (h) => {
+        const badId = await h({ m: 'POST', p: '/message-streams', b: { ID: '9bad id', Name: 'X', MessageStreamType: 'Broadcast' } });
+        const reserved = await h({ m: 'POST', p: '/message-streams', b: { ID: 'pm-thing', Name: 'X', MessageStreamType: 'Broadcast' } });
+        const dup = await h({ m: 'POST', p: '/message-streams', b: { ID: 'outbound', Name: 'X', MessageStreamType: 'Transactional' } });
+        const badType = await h({ m: 'POST', p: '/message-streams', b: { ID: 'okid', Name: 'X', MessageStreamType: 'Nonsense' } });
+        const noName = await h({ m: 'POST', p: '/message-streams', b: { ID: 'okid2', MessageStreamType: 'Broadcast' } });
+        return failedWith(badId, 422, 1227) && failedWith(reserved, 422, 1233) && failedWith(dup, 422, 1230)
+            && failedWith(badType, 422, 1221) && failedWith(noName, 422, 1223);
+    })),
+    done('postmark.streams.retrieve_and_edit', 'streams', 'Streams: GET/PATCH /message-streams/:id (+ 422 ErrorCode 1226)', 'api', 'core', () => withRoot(async (h) => {
+        const upd = await h({ m: 'PATCH', p: '/message-streams/broadcast', b: { Name: 'Renamed Broadcast', Description: 'Edited' } });
+        const got = await h({ m: 'GET', p: '/message-streams/broadcast' });
+        const missing = await h({ m: 'GET', p: '/message-streams/nope' });
+        const missingPatch = await h({ m: 'PATCH', p: '/message-streams/nope', b: { Name: 'x' } });
+        return ok(upd) && field(got, 'Name') === 'Renamed Broadcast' && field(got, 'Description') === 'Edited'
+            && typeof field(got, 'UpdatedAt') === 'string'
+            && failedWith(missing, 422, 1226) && failedWith(missingPatch, 422, 1226);
+    })),
+    done('postmark.streams.archive_unarchive', 'streams', 'Streams: archive hides a stream from the list; unarchive restores it', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/message-streams', b: { ID: 'temp', Name: 'Temp', MessageStreamType: 'Broadcast' } });
+        const arch = await h({ m: 'POST', p: '/message-streams/temp/archive' });
+        const listed = await h({ m: 'GET', p: '/message-streams' });
+        const withArchived = await h({ m: 'GET', p: '/message-streams?includeArchivedStreams=true' });
+        const un = await h({ m: 'POST', p: '/message-streams/temp/unarchive' });
+        const after = await h({ m: 'GET', p: '/message-streams' });
+        return ok(arch) && typeof field(arch, 'ExpectedPurgeDate') === 'string'
+            && !list(listed, 'MessageStreams').some((s) => s.ID === 'temp')
+            && list(withArchived, 'MessageStreams').some((s) => s.ID === 'temp')
+            && ok(un) && field(un, 'ArchivedAt') === null
+            && list(after, 'MessageStreams').some((s) => s.ID === 'temp');
+    })),
+    done('postmark.streams.archive_guards', 'streams', 'Streams: the default transactional/inbound streams cannot be archived', 'api', 'common', () => withRoot(async (h) => {
+        const outbound = await h({ m: 'POST', p: '/message-streams/outbound/archive' });
+        const inbound = await h({ m: 'POST', p: '/message-streams/inbound/archive' });
+        const unarchiveLive = await h({ m: 'POST', p: '/message-streams/broadcast/unarchive' });
+        const stillThere = await h({ m: 'GET', p: '/message-streams/outbound' });
+        const stillLive = await h({ m: 'GET', p: '/message-streams/broadcast' });
+        // §9: the two archive guards pin the vendor's PUBLISHED code (1229). The
+        // unarchive-a-live-stream refusal does NOT — the published table has no entry for it
+        // (see postmark-twin.ts), so pinning a number there would pin an invention. Assert the
+        // 422 and that the refusal genuinely enacted nothing instead.
+        return failedWith(outbound, 422, 1229) && failedWith(inbound, 422, 1229)
+            && unarchiveLive.status === 422 && field(stillLive, 'ArchivedAt') === null
+            && ok(stillThere) && field(stillThere, 'ArchivedAt') === null;
+    })),
+    done('postmark.streams.type_filter', 'streams', 'Streams: filter the list by messageStreamType', 'api', 'niche', () => withRoot(async (h) => {
+        const broadcast = await h({ m: 'GET', p: '/message-streams?messageStreamType=Broadcast' });
+        const all = await h({ m: 'GET', p: '/message-streams?messageStreamType=All' });
+        return field(broadcast, 'TotalCount') === 1 && list(broadcast, 'MessageStreams')[0].ID === 'broadcast'
+            && field(all, 'TotalCount') === 3;
+    })),
+    todo('postmark.streams.custom_unsubscribe_handling', 'streams', 'Streams: Custom/Postmark UnsubscribeHandlingType semantics on broadcast sends', 'api', 'common'),
+    todo('postmark.streams.purge_after_archive', 'streams', 'Streams: the 45-day purge window actually retiring an archived stream', 'api', 'niche'),
+    // ── Suppressions API ─────────────────────────────────────────────────────────────
+    done('postmark.suppressions.add', 'suppressions', 'Suppressions: POST /message-streams/:id/suppressions', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'optout@twin.test' }, { EmailAddress: 'garbage' }] } });
+        const rows = list(r, 'Suppressions');
+        return ok(r) && rows[0].EmailAddress === 'optout@twin.test' && rows[0].Status === 'Suppressed'
+            && rows[1].Status === 'Failed' && String(rows[1].Message).includes('invalid email');
+    })),
+    done('postmark.suppressions.dump', 'suppressions', 'Suppressions: GET /message-streams/:id/suppressions/dump (+ filters)', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'manual@twin.test' }] } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-sup@twin.test' }) });
+        const all = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' });
+        const manualOnly = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump?suppressionReason=ManualSuppression' });
+        const missingStream = await h({ m: 'GET', p: '/message-streams/nope/suppressions/dump' });
+        const rows = list(all, 'Suppressions');
+        return rows.length === 2
+            && rows.some((s) => s.EmailAddress === 'manual@twin.test' && s.SuppressionReason === 'ManualSuppression' && s.Origin === 'Customer')
+            && rows.some((s) => s.EmailAddress === 'bounce-sup@twin.test' && s.SuppressionReason === 'HardBounce' && s.Origin === 'Recipient')
+            && list(manualOnly, 'Suppressions').length === 1
+            && failedWith(missingStream, 422, 1226);
+    })),
+    done('postmark.suppressions.blocks_sending', 'suppressions', 'Suppressions: a manual suppression blocks a later send (dirty state)', 'api', 'common', () => withRoot(async (h) => {
+        const before = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'later-optout@twin.test' }) });
+        await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'later-optout@twin.test' }] } });
+        const after = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'later-optout@twin.test' }) });
+        return ok(before) && failedWith(after, 422, 406);
+    })),
+    done('postmark.suppressions.stream_scoped', 'suppressions', 'Suppressions: a suppression is scoped to ONE message stream', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'scoped@twin.test' }] } });
+        const blocked = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'scoped@twin.test' }) });
+        const allowed = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'scoped@twin.test', MessageStream: 'broadcast' }) });
+        const otherDump = await h({ m: 'GET', p: '/message-streams/broadcast/suppressions/dump' });
+        return failedWith(blocked, 422, 406) && ok(allowed) && list(otherDump, 'Suppressions').length === 0;
+    })),
+    done('postmark.suppressions.delete_manual_only', 'suppressions', 'Suppressions: POST …/suppressions/delete removes MANUAL entries only (dirty state)', 'api', 'common', () => withRoot(async (h) => {
+        // DIRTY-STATE: a bounce-born suppression must NOT be deletable through this endpoint —
+        // Postmark requires the Bounce API's activate for that. Both entries exist first.
+        await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'manual-del@twin.test' }] } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-del@twin.test' }) });
+        const r = await h({ m: 'POST', p: '/message-streams/outbound/suppressions/delete', b: { Suppressions: [{ EmailAddress: 'manual-del@twin.test' }, { EmailAddress: 'bounce-del@twin.test' }] } });
+        const rows = list(r, 'Suppressions');
+        const dump = await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' });
+        const remaining = list(dump, 'Suppressions');
+        const noBody = await h({ m: 'POST', p: '/message-streams/outbound/suppressions/delete', b: {} });
+        return rows[0].Status === 'Deleted' && rows[1].Status === 'Failed'
+            && remaining.length === 1 && remaining[0].EmailAddress === 'bounce-del@twin.test'
+            && failedWith(noBody, 422, 1409);
+    })),
+    todo('postmark.suppressions.origin_filters', 'suppressions', 'Suppressions: filter the dump by Origin/date range', 'api', 'niche'),
+    todo('postmark.suppressions.bulk_limit', 'suppressions', 'Suppressions: the per-request maximum-entries guard (ErrorCode 1410)', 'api', 'niche'),
+    // ── Webhooks API + webhook DELIVERY ──────────────────────────────────────────────
+    done('postmark.webhooks.create', 'webhooks', 'Webhooks: POST /webhooks with Triggers/HttpAuth/HttpHeaders', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/webhooks', b: {
+                Url: 'https://app.test/hook', MessageStream: 'outbound',
+                HttpAuth: { Username: 'u', Password: 'p' },
+                HttpHeaders: [{ Name: 'X-Secret', Value: 's3cret' }],
+                Triggers: { Delivery: { Enabled: true }, Open: { Enabled: true, PostFirstOpenOnly: true } },
+            } });
+        const t = field(r, 'Triggers');
+        return ok(r) && field(r, 'ID') === 1 && field(r, 'Url') === 'https://app.test/hook'
+            && t.Delivery.Enabled === true && t.Open.PostFirstOpenOnly === true
+            // omitted triggers are defaulted OFF, not dropped
+            && t.Bounce.Enabled === false && t.SubscriptionChange.Enabled === false
+            && field(r, 'HttpAuth').Username === 'u';
+    })),
+    done('postmark.webhooks.crud', 'webhooks', 'Webhooks: GET/PUT/DELETE /webhooks/:id (+ 422 ErrorCode 1352)', 'api', 'core', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/one', Triggers: { Delivery: { Enabled: true } } } });
+        const got = await h({ m: 'GET', p: '/webhooks/1' });
+        const upd = await h({ m: 'PUT', p: '/webhooks/1', b: { Url: 'https://app.test/updated' } });
+        const after = await h({ m: 'GET', p: '/webhooks/1' });
+        const listed = await h({ m: 'GET', p: '/webhooks' });
+        const del = await h({ m: 'DELETE', p: '/webhooks/1' });
+        const gone = await h({ m: 'GET', p: '/webhooks/1' });
+        return ok(got) && field(upd, 'Url') === 'https://app.test/updated' && field(after, 'Url') === 'https://app.test/updated'
+            // the webhooks collection is the one list with NO TotalCount
+            && list(listed, 'Webhooks').length === 1 && field(listed, 'TotalCount') === undefined
+            && ok(del) && failedWith(gone, 422, 1352);
+    })),
+    done('postmark.webhooks.create_validation', 'webhooks', 'Webhooks: 422 ErrorCode 1354 without a Url; 1226/1350 for a bad stream', 'api', 'common', () => withRoot(async (h) => {
+        const noUrl = await h({ m: 'POST', p: '/webhooks', b: { Triggers: { Delivery: { Enabled: true } } } });
+        const badStream = await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/x', MessageStream: 'nope' } });
+        await h({ m: 'POST', p: '/message-streams', b: { ID: 'archived', Name: 'Arch', MessageStreamType: 'Broadcast' } });
+        await h({ m: 'POST', p: '/message-streams/archived/archive' });
+        const onArchived = await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/x', MessageStream: 'archived' } });
+        return failedWith(noUrl, 422, 1354) && failedWith(badStream, 422, 1226) && failedWith(onArchived, 422, 1350);
+    })),
+    done('postmark.webhooks.delivery_payload', 'webhooks', 'Webhooks: a send POSTs the vendor Delivery payload to a subscriber', 'api', 'core', () => withWebhookCapture(async (h, seen) => {
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/hook', Triggers: { Delivery: { Enabled: true } } } });
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'hooked@twin.test', Tag: 'hooked' }) });
+        const d = seen.find((x) => x.body.RecordType === 'Delivery');
+        return seen.length === 1 && !!d && d.url === 'https://app.test/hook'
+            && d.body.MessageID === field(sent, 'MessageID') && d.body.Recipient === 'hooked@twin.test'
+            && d.body.Tag === 'hooked' && d.body.MessageStream === 'outbound' && typeof d.body.DeliveredAt === 'string';
+    })),
+    done('postmark.webhooks.trigger_gating', 'webhooks', 'Webhooks: only ENABLED triggers fire (per RecordType)', 'api', 'core', () => withWebhookCapture(async (h, seen) => {
+        // Bounce-only subscriber: it must NOT see the Delivery/Open of a healthy send, but it
+        // MUST see the Bounce of a bouncing one.
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/bounces', Triggers: { Bounce: { Enabled: true } } } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'fine@twin.test', TrackOpens: true }) });
+        const quietSoFar = seen.length;
+        if (quietSoFar !== 0)
+            return false;
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-hook@twin.test' }) });
+        return seen.length === 1 && seen[0].body.RecordType === 'Bounce'
+            && seen[0].body.Email === 'bounce-hook@twin.test' && seen[0].body.Type === 'HardBounce'
+            && typeof seen[0].body.ID === 'number';
+    })),
+    done('postmark.webhooks.open_click_payloads', 'webhooks', 'Webhooks: Open + Click payloads carry the vendor tracking fields', 'api', 'common', () => withWebhookCapture(async (h, seen) => {
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/track', Triggers: { Open: { Enabled: true }, Click: { Enabled: true } } } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'tracked@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+        const open = seen.find((x) => x.body.RecordType === 'Open');
+        const click = seen.find((x) => x.body.RecordType === 'Click');
+        return seen.length === 2 && !!open && !!click
+            && open.body.FirstOpen === true && typeof open.body.ReadSeconds === 'number' && open.body.Client?.Name === 'Twin Mail'
+            && click.body.ClickLocation === 'HTML' && typeof click.body.OriginalLink === 'string';
+    })),
+    done('postmark.webhooks.basic_auth_and_headers', 'webhooks', 'Webhooks: HttpAuth → Basic header, HttpHeaders → custom headers (NOT a signature)', 'api', 'common', () => withWebhookCapture(async (h, seen) => {
+        // Postmark does NOT sign webhooks. Its two real authentication affordances are Basic
+        // auth and caller-chosen headers — asserted here so nobody "adds a signature" later.
+        await h({ m: 'POST', p: '/webhooks', b: {
+                Url: 'https://app.test/secure',
+                HttpAuth: { Username: 'hookuser', Password: 'hookpass' },
+                HttpHeaders: [{ Name: 'X-Shared-Secret', Value: 'sh4red' }],
+                Triggers: { Delivery: { Enabled: true } },
+            } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'secure@twin.test' }) });
+        const got = seen[0];
+        const expected = `Basic ${Buffer.from('hookuser:hookpass').toString('base64')}`;
+        return seen.length === 1 && got.headers.Authorization === expected
+            && got.headers['X-Shared-Secret'] === 'sh4red'
+            && got.headers['content-type'] === 'application/json'
+            // …and NOTHING signature-shaped is invented.
+            && !Object.keys(got.headers).some((k) => /signature|svix/i.test(k));
+    })),
+    done('postmark.webhooks.stream_scoped', 'webhooks', 'Webhooks: a subscriber only sees ITS OWN message stream', 'api', 'common', () => withWebhookCapture(async (h, seen) => {
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/broadcast-only', MessageStream: 'broadcast', Triggers: { Delivery: { Enabled: true } } } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'tx@twin.test' }) }); // outbound → not delivered
+        const quietSoFar = seen.length;
+        if (quietSoFar !== 0)
+            return false;
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bc@twin.test', MessageStream: 'broadcast' }) });
+        return seen.length === 1 && seen[0].body.MessageStream === 'broadcast';
+    })),
+    done('postmark.webhooks.deleted_stops_firing', 'webhooks', 'Webhooks: a DELETED webhook stops receiving events (dirty state)', 'api', 'common', () => withWebhookCapture(async (h, seen) => {
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/short-lived', Triggers: { Delivery: { Enabled: true } } } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'one@twin.test' }) });
+        if (seen.length !== 1)
+            return false;
+        await h({ m: 'DELETE', p: '/webhooks/1' });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'two@twin.test' }) });
+        return seen.length === 1; // the tombstoned subscriber is genuinely gone from the fan-out
+    })),
+    // GROUNDING NOTE (a §9 review flagged these two as possibly-fabricated because the
+    // official SDK has neither — the SDK's webhook surface is list/get/create/edit/delete only).
+    // They are REAL but NEWER than the pinned SDK v4.0.7: both appear in the vendor's published
+    // Webhooks API nav, and the error table's "Webhooks API — new" block carries code 1364,
+    // "Webhook verification failed; nothing was saved. Fix the endpoint and retry, or send
+    // ?verify=false to save it unverified" — which only makes sense with a verify feature.
+    // Keep them; the SDK lagging the API is not evidence the API lacks them.
+    todo('postmark.webhooks.verify_endpoint', 'webhooks', 'Webhooks: POST /webhooks/:id/verify (endpoint reachability check)', 'api', 'niche'),
+    todo('postmark.webhooks.statistics', 'webhooks', 'Webhooks: GET /webhooks/:id/statistics (delivery success/failure counts)', 'api', 'niche'),
+    todo('postmark.webhooks.subscription_change', 'webhooks', 'Webhooks: SubscriptionChange payloads on broadcast unsubscribes', 'api', 'common'),
+    todo('postmark.webhooks.inbound_payload', 'webhooks', 'Webhooks: the Inbound RecordType payload delivered to InboundHookUrl', 'api', 'common'),
+    todo('postmark.webhooks.retry_schedule', 'webhooks', "Webhooks: Postmark's retry schedule for a failing endpoint", 'api', 'niche'),
+    // ── Server API ───────────────────────────────────────────────────────────────────
+    done('postmark.server.retrieve', 'server', 'Server: GET /server', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: '/server' });
+        return ok(r) && field(r, 'ID') === 1 && typeof field(r, 'Name') === 'string'
+            && field(r, 'DeliveryType') === 'Live' && Array.isArray(field(r, 'ApiTokens'))
+            && field(r, 'TrackLinks') === 'None' && typeof field(r, 'InboundAddress') === 'string';
+    })),
+    done('postmark.server.edit', 'server', 'Server: PUT /server updates the modeled settings', 'api', 'common', () => withRoot(async (h) => {
+        const upd = await h({ m: 'PUT', p: '/server', b: { Name: 'Renamed Server', TrackOpens: true, TrackLinks: 'HtmlOnly', Color: 'red' } });
+        const got = await h({ m: 'GET', p: '/server' });
+        const noData = await h({ m: 'PUT', p: '/server', b: {} });
+        return ok(upd) && field(got, 'Name') === 'Renamed Server' && field(got, 'TrackOpens') === true
+            && field(got, 'TrackLinks') === 'HtmlOnly' && field(got, 'Color') === 'red'
+            && failedWith(noData, 422, 609);
+    })),
+    done('postmark.servers.crud', 'servers', 'Servers: account-level CRUD (GET/POST/PUT/DELETE /servers)', 'api', 'common', () => withRoot(async (h) => {
+        const created = await h({ m: 'POST', p: '/servers', b: { Name: 'Staging', Color: 'green' } });
+        const id = field(created, 'ID');
+        const listed = await h({ m: 'GET', p: '/servers' });
+        const got = await h({ m: 'GET', p: `/servers/${id}` });
+        const upd = await h({ m: 'PUT', p: `/servers/${id}`, b: { Name: 'Staging 2' } });
+        const del = await h({ m: 'DELETE', p: `/servers/${id}` });
+        const gone = await h({ m: 'GET', p: `/servers/${id}` });
+        return id === 2 && field(got, 'Name') === 'Staging' && field(got, 'Color') === 'green'
+            && field(listed, 'TotalCount') === 2 && field(upd, 'Name') === 'Staging 2'
+            // §9: was `gone.status === 422` alone, which hid a wrong ErrorCode (608, "name invalid
+            // or missing") on a NOT-FOUND path. Pin the vendor's real server-not-found code.
+            && ok(del) && failedWith(gone, 422, 1453);
+    })),
+    done('postmark.servers.name_uniqueness', 'servers', 'Servers: 422 ErrorCode 603 on a duplicate server name', 'api', 'niche', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/servers', b: { Name: 'Unique' } });
+        const dup = await h({ m: 'POST', p: '/servers', b: { Name: 'Unique' } });
+        const noName = await h({ m: 'POST', p: '/servers', b: {} });
+        return failedWith(dup, 422, 603) && failedWith(noName, 422, 608);
+    })),
+    todo('postmark.server.hook_url_validation', 'server', 'Server: reject an invalid hook URL (ErrorCode 606)', 'api', 'niche'),
+    todo('postmark.server.smtp_tokens', 'server', 'Server: the SMTP Tokens surface (error codes 1450-1460)', 'api', 'niche'),
+    todo('postmark.servers.inbound_domain_binding', 'servers', 'Servers: inbound-domain registration + its uniqueness rules', 'api', 'niche'),
+    // ── Stats API ────────────────────────────────────────────────────────────────────
+    done('postmark.stats.outbound_overview', 'stats', 'Stats: GET /stats/outbound computed from real twin messages', 'api', 'common', () => withRoot(async (h) => {
+        const empty = await h({ m: 'GET', p: '/stats/outbound' });
+        if (field(empty, 'Sent') !== 0 || field(empty, 'BounceRate') !== 0)
+            return false;
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'a@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'b@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-stat@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-stat@twin.test' }) });
+        const r = await h({ m: 'GET', p: '/stats/outbound' });
+        return ok(r) && field(r, 'Sent') === 4 && field(r, 'Bounced') === 1 && field(r, 'SpamComplaints') === 1
+            && field(r, 'Opens') === 1 && field(r, 'TotalClicks') === 1
+            && field(r, 'WithOpenTracking') === 1 && field(r, 'WithLinkTracking') === 1
+            && field(r, 'BounceRate') === 25 && field(r, 'SpamComplaintsRate') === 25;
+    })),
+    done('postmark.stats.sends_by_day', 'stats', 'Stats: GET /stats/outbound/sends → {Days:[{Date,Sent}], Sent}', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'd1@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'd2@twin.test' }) });
+        const r = await h({ m: 'GET', p: '/stats/outbound/sends' });
+        const days = field(r, 'Days');
+        return ok(r) && field(r, 'Sent') === 2 && days.length === 1
+            && days[0].Sent === 2 && /^\d{4}-\d{2}-\d{2}$/.test(String(days[0].Date));
+    })),
+    done('postmark.stats.bounces_spam_tracked', 'stats', 'Stats: /bounces, /spam and /tracked per-day counts', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-s@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'spam-s@twin.test' }) });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'ok-s@twin.test', TrackOpens: true }) });
+        const bounces = await h({ m: 'GET', p: '/stats/outbound/bounces' });
+        const spam = await h({ m: 'GET', p: '/stats/outbound/spam' });
+        const tracked = await h({ m: 'GET', p: '/stats/outbound/tracked' });
+        return field(bounces, 'HardBounce') === 1 && field(spam, 'SpamComplaint') === 1 && field(tracked, 'Tracked') === 1;
+    })),
+    done('postmark.stats.opens_and_clicks', 'stats', 'Stats: the opens/clicks families (counts, platforms, clients, locations)', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'stat@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+        const opens = await h({ m: 'GET', p: '/stats/outbound/opens' });
+        const platforms = await h({ m: 'GET', p: '/stats/outbound/opens/platforms' });
+        const clients = await h({ m: 'GET', p: '/stats/outbound/opens/emailClients' });
+        const readTimes = await h({ m: 'GET', p: '/stats/outbound/opens/readTimes' });
+        const clicks = await h({ m: 'GET', p: '/stats/outbound/clicks' });
+        const browsers = await h({ m: 'GET', p: '/stats/outbound/clicks/browserFamilies' });
+        const clickPlatforms = await h({ m: 'GET', p: '/stats/outbound/clicks/platforms' });
+        const location = await h({ m: 'GET', p: '/stats/outbound/clicks/location' });
+        return field(opens, 'Opens') === 1 && field(platforms, 'WebMail') === 1
+            && field(clients, 'Twin Mail') === 1 && field(readTimes, '7s+') === 1
+            && field(clicks, 'Clicks') === 1 && field(browsers, 'Twin Browser') === 1
+            && field(clickPlatforms, 'Desktop') === 1 && field(location, 'HTML') === 1 && field(location, 'Text') === 0;
+    })),
+    todo('postmark.stats.date_and_tag_filters', 'stats', 'Stats: fromDate/toDate/tag/messageStream filtering across the stats family', 'api', 'common'),
+    todo('postmark.stats.real_client_taxonomy', 'stats', 'Stats: the real email-client / OS / browser taxonomy rather than a twin placeholder', 'api', 'niche'),
+    // ── Inbound rule triggers ────────────────────────────────────────────────────────
+    done('postmark.inbound_rules.crud', 'inbound_rules', 'Inbound rules: GET/POST/DELETE /triggers/inboundRules', 'api', 'common', () => withRoot(async (h) => {
+        const created = await h({ m: 'POST', p: '/triggers/inboundRules', b: { Rule: 'spammer.test' } });
+        const listed = await h({ m: 'GET', p: '/triggers/inboundRules' });
+        const dup = await h({ m: 'POST', p: '/triggers/inboundRules', b: { Rule: 'spammer.test' } });
+        const noData = await h({ m: 'POST', p: '/triggers/inboundRules', b: {} });
+        const del = await h({ m: 'DELETE', p: `/triggers/inboundRules/${field(created, 'ID')}` });
+        const gone = await h({ m: 'DELETE', p: `/triggers/inboundRules/${field(created, 'ID')}` });
+        const after = await h({ m: 'GET', p: '/triggers/inboundRules' });
+        return field(created, 'ID') === 1 && field(created, 'Rule') === 'spammer.test'
+            && field(listed, 'TotalCount') === 1 && list(listed, 'InboundRules')[0].Rule === 'spammer.test'
+            && failedWith(dup, 422, 810) && failedWith(noData, 422, 809)
+            && ok(del) && failedWith(gone, 422, 812) && field(after, 'TotalCount') === 0;
+    })),
+    todo('postmark.inbound_rules.blocking_effect', 'inbound_rules', 'Inbound rules: an inbound message from a blocked sender is actually Blocked', 'api', 'common'),
+    // ── Domains API (account token) ──────────────────────────────────────────────────
+    done('postmark.domains.create', 'domains', 'Domains: POST /domains returns the DNS detail block', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/domains', b: { Name: 'acme.dev' } });
+        return ok(r) && field(r, 'ID') === 1 && field(r, 'Name') === 'acme.dev'
+            && field(r, 'SPFVerified') === false && field(r, 'DKIMVerified') === false
+            && String(field(r, 'SPFTextValue')).includes('spf.mtasv.net')
+            && String(field(r, 'DKIMHost')).includes('_domainkey.acme.dev')
+            && field(r, 'ReturnPathDomainCNAMEValue') === 'pm.mtasv.net';
+    })),
+    done('postmark.domains.list_and_retrieve', 'domains', 'Domains: GET /domains (short shape) + GET /domains/:id (detail)', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/domains', b: { Name: 'acme.dev' } });
+        const listed = await h({ m: 'GET', p: '/domains' });
+        const got = await h({ m: 'GET', p: '/domains/1' });
+        const missing = await h({ m: 'GET', p: '/domains/99' });
+        const row = list(listed, 'Domains')[0];
+        return field(listed, 'TotalCount') === 1 && row.Name === 'acme.dev'
+            // the list shape omits the DNS detail block the retrieve carries
+            && row.SPFTextValue === undefined && typeof field(got, 'SPFTextValue') === 'string'
+            && failedWith(missing, 422, 510);
+    })),
+    done('postmark.domains.verify_dkim_spf_return_path', 'domains', 'Domains: verifyDKIM / verifySPF / verifyReturnPath flip the flags', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/domains', b: { Name: 'verify.dev' } });
+        const dkim = await h({ m: 'PUT', p: '/domains/1/verifyDKIM' });
+        const spf = await h({ m: 'POST', p: '/domains/1/verifySPF' });
+        // ⚠ TWIN-LOCAL precondition, not a vendor-documented ordering (§9): reporting a return
+        // path "verified" when none is configured would be a fake success, so the twin refuses.
+        // Asserted as a 422 + unchanged state; the CODE is not pinned because it is borrowed.
+        const tooEarly = await h({ m: 'PUT', p: '/domains/1/verifyReturnPath' });
+        await h({ m: 'PUT', p: '/domains/1', b: { ReturnPathDomain: 'pm-bounces.verify.dev' } });
+        const rp = await h({ m: 'PUT', p: '/domains/1/verifyReturnPath' });
+        return field(dkim, 'DKIMVerified') === true && field(spf, 'SPFVerified') === true
+            && tooEarly.status === 422 && field(tooEarly, 'ReturnPathDomainVerified') === undefined
+            && field(rp, 'ReturnPathDomainVerified') === true
+            && field(rp, 'ReturnPathDomain') === 'pm-bounces.verify.dev';
+    })),
+    done('postmark.domains.rotate_dkim', 'domains', 'Domains: POST /domains/:id/rotateDKIM stages a PENDING key', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/domains', b: { Name: 'rotate.dev' } });
+        await h({ m: 'PUT', p: '/domains/1/verifyDKIM' });
+        const rot = await h({ m: 'POST', p: '/domains/1/rotateDKIM' });
+        const reVerified = await h({ m: 'PUT', p: '/domains/1/verifyDKIM' });
+        return field(rot, 'DKIMUpdateStatus') === 'Pending' && field(rot, 'DKIMVerified') === false
+            && String(field(rot, 'DKIMPendingHost')).includes('_domainkey.rotate.dev')
+            && field(reVerified, 'DKIMVerified') === true && field(reVerified, 'DKIMPendingHost') === '';
+    })),
+    done('postmark.domains.delete_and_validation', 'domains', 'Domains: DELETE + the vendor 422s (512 duplicate, 514 no Name)', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/domains', b: { Name: 'dup.dev' } });
+        const dup = await h({ m: 'POST', p: '/domains', b: { Name: 'dup.dev' } });
+        const noName = await h({ m: 'POST', p: '/domains', b: {} });
+        const del = await h({ m: 'DELETE', p: '/domains/1' });
+        const gone = await h({ m: 'GET', p: '/domains/1' });
+        return failedWith(dup, 422, 512) && failedWith(noName, 422, 514)
+            && ok(del) && failedWith(gone, 422, 510);
+    })),
+    done('postmark.domains.repeat_transition_applies', 'domains', 'Domains: a REPEATED identical transition applies again (no same-ms write dedupe)', 'api', 'common', () => withRoot(async (h) => {
+        // REGRESSION PIN, and a deliberately DETERMINISTIC one. The kernel dedupes an action by
+        // `operation:subjectId:occurredAt(ms):contentHash`, so two identical verifyDKIM calls in
+        // the SAME millisecond used to collapse into one and leave the domain stuck on the
+        // rotated PENDING key — silent data loss (see `_seq` in postmark-twin.ts). Pinning one
+        // `occurredAt` across the whole cycle reproduces that collision every single run instead
+        // of racing the clock, so this pin genuinely fails if the fix is reverted.
+        const at = '2026-01-01T00:00:00.000Z';
+        await h({ m: 'POST', p: '/domains', b: { Name: 'repeat.dev' }, at });
+        for (let i = 0; i < 3; i++) {
+            await h({ m: 'PUT', p: '/domains/1/verifyDKIM', at });
+            const rotated = await h({ m: 'POST', p: '/domains/1/rotateDKIM', at });
+            if (field(rotated, 'DKIMUpdateStatus') !== 'Pending' || field(rotated, 'DKIMVerified') !== false)
+                return false;
+            const reVerified = await h({ m: 'PUT', p: '/domains/1/verifyDKIM', at });
+            // Every cycle must land back on Verified with the pending key cleared.
+            if (field(reVerified, 'DKIMVerified') !== true || field(reVerified, 'DKIMUpdateStatus') !== 'Verified')
+                return false;
+            if (field(reVerified, 'DKIMPendingHost') !== '')
+                return false;
+        }
+        return true;
+    })),
+    todo('postmark.domains.real_dns_lookup', 'domains', 'Domains: verification driven by a real DNS lookup rather than a local flip', 'api', 'niche'),
+    // ── Sender Signatures API (account token) ────────────────────────────────────────
+    done('postmark.senders.create', 'senders', 'Senders: POST /senders creates an UNCONFIRMED signature', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'hello@acme.dev', Name: 'Acme Hello', ReplyToEmail: 'support@acme.dev' } });
+        return ok(r) && field(r, 'ID') === 1 && field(r, 'EmailAddress') === 'hello@acme.dev'
+            && field(r, 'Domain') === 'acme.dev' && field(r, 'Confirmed') === false
+            && field(r, 'ReplyToEmailAddress') === 'support@acme.dev';
+    })),
+    done('postmark.senders.list_and_retrieve', 'senders', 'Senders: GET /senders → {TotalCount, SenderSignatures[]}', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/senders', b: { FromEmail: 'a@acme.dev', Name: 'A' } });
+        const listed = await h({ m: 'GET', p: '/senders' });
+        const got = await h({ m: 'GET', p: '/senders/1' });
+        const missing = await h({ m: 'GET', p: '/senders/99' });
+        // The collection key is `SenderSignatures`, NOT `Senders`, despite the path.
+        return field(listed, 'TotalCount') === 1 && list(listed, 'SenderSignatures')[0].EmailAddress === 'a@acme.dev'
+            && field(listed, 'Senders') === undefined
+            && field(got, 'Name') === 'A' && failedWith(missing, 422, 501);
+    })),
+    done('postmark.senders.validation', 'senders', 'Senders: 422s for missing/invalid/public-domain/duplicate FromEmail', 'api', 'common', () => withRoot(async (h) => {
+        const noEmail = await h({ m: 'POST', p: '/senders', b: { Name: 'X' } });
+        const bad = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'nope' } });
+        const publicDomain = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'someone@gmail.com' } });
+        await h({ m: 'POST', p: '/senders', b: { FromEmail: 'dup@acme.dev' } });
+        const dup = await h({ m: 'POST', p: '/senders', b: { FromEmail: 'dup@acme.dev' } });
+        return failedWith(noEmail, 422, 520) && failedWith(bad, 422, 522)
+            && failedWith(publicDomain, 422, 503) && failedWith(dup, 422, 504);
+    })),
+    done('postmark.senders.edit_delete_resend', 'senders', 'Senders: PUT / DELETE / resend-confirmation', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/senders', b: { FromEmail: 'edit@acme.dev', Name: 'Before' } });
+        const upd = await h({ m: 'PUT', p: '/senders/1', b: { Name: 'After', ReplyToEmail: 'new-reply@acme.dev' } });
+        const resent = await h({ m: 'POST', p: '/senders/1/resend' });
+        const del = await h({ m: 'DELETE', p: '/senders/1' });
+        const gone = await h({ m: 'GET', p: '/senders/1' });
+        return field(upd, 'Name') === 'After' && field(upd, 'ReplyToEmailAddress') === 'new-reply@acme.dev'
+            && ok(resent) && errorCode(resent) === 0 && ok(del) && failedWith(gone, 422, 501);
+    })),
+    done('postmark.senders.verify_spf_and_dkim', 'senders', 'Senders: verifySpf + requestNewDkim on a signature', 'api', 'niche', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/senders', b: { FromEmail: 'dns@acme.dev' } });
+        const spf = await h({ m: 'POST', p: '/senders/1/verifySpf' });
+        const dkim = await h({ m: 'POST', p: '/senders/1/requestNewDkim' });
+        const after = await h({ m: 'GET', p: '/senders/1' });
+        return field(spf, 'SPFVerified') === true && ok(dkim)
+            && field(after, 'DKIMUpdateStatus') === 'Pending'
+            && String(field(after, 'DKIMPendingHost')).includes('acme.dev');
+    })),
+    todo('postmark.senders.confirmation_flow', 'senders', 'Senders: the real confirmation-email round trip that sets Confirmed', 'api', 'common'),
+    todo('postmark.senders.sending_requires_signature', 'senders', 'Senders: refuse a send whose From has no confirmed signature (ErrorCode 400/401)', 'api', 'common'),
+    // ── Data removals (GDPR, account token) ──────────────────────────────────────────
+    done('postmark.data_removals.request_and_status', 'data_removals', 'Data removals: POST /data-removals + GET /data-removals/:id', 'api', 'niche', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/data-removals', b: { RequestedBy: 'admin@acme.dev', RequestedFor: 'user@customer.test', NotifyWhenCompleted: true } });
+        const got = await h({ m: 'GET', p: `/data-removals/${field(r, 'ID')}` });
+        const bad = await h({ m: 'POST', p: '/data-removals', b: { RequestedBy: 'admin@acme.dev' } });
+        const missing = await h({ m: 'GET', p: '/data-removals/999' });
+        return ok(r) && field(r, 'ID') === 1 && field(r, 'Status') === 'Pending'
+            && field(got, 'Status') === 'Pending' && bad.status === 422 && failedWith(missing, 422, 1301);
+    })),
+    todo('postmark.data_removals.actual_purge', 'data_removals', 'Data removals: the request actually purging the subject\'s stored messages', 'api', 'niche'),
+    // ── Auth ─────────────────────────────────────────────────────────────────────────
+    done('postmark.auth.server_token_header', 'auth', 'Auth: X-Postmark-Server-Token (NOT Bearer); missing/empty → 401 ErrorCode 10', 'api', 'core', () => withRoot(async (h) => {
+        const good = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'X-Postmark-Server-Token': '11111111-2222-3333-4444-555555555555' } });
+        const missing = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'content-type': 'application/json' } });
+        const empty = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'X-Postmark-Server-Token': '   ' } });
+        // A BEARER token is not Postmark's scheme and must not be accepted as one.
+        const bearer = await h({ m: 'POST', p: '/email', b: mkMail(), h: { authorization: 'Bearer 11111111-2222-3333-4444-555555555555' } });
+        return ok(good) && errorCode(good) === 0
+            && failedWith(missing, 401, 10) && field(missing, 'Message') === 'Request does not contain a valid Server token.'
+            && failedWith(empty, 401, 10) && failedWith(bearer, 401, 10);
+    })),
+    done('postmark.auth.header_case_insensitive', 'auth', 'Auth: the token header is matched case-insensitively', 'api', 'common', () => withRoot(async (h) => {
+        // Asserts real VALUES, not just `ok()` — a status-only version of this passed against
+        // the dead-twin saboteur (caught by scripts/mutation-test.ts) because an empty 200 is
+        // still a 200. Each casing must return the SERVER OBJECT, and the missing-token case
+        // must still fail, so both the positive and negative paths have teeth.
+        const lower = await h({ m: 'GET', p: '/server', h: { 'x-postmark-server-token': 'tok-lower' } });
+        const upper = await h({ m: 'GET', p: '/server', h: { 'X-POSTMARK-SERVER-TOKEN': 'tok-upper' } });
+        const mixed = await h({ m: 'GET', p: '/server', h: { 'X-Postmark-Server-Token': 'tok-mixed' } });
+        const none = await h({ m: 'GET', p: '/server', h: { 'x-postmark-account-token': 'wrong-scope' } });
+        const served = (r) => ok(r) && field(r, 'ID') === 1 && field(r, 'DeliveryType') === 'Live' && Array.isArray(field(r, 'ApiTokens'));
+        return served(lower) && served(upper) && served(mixed) && failedWith(none, 401, 10);
+    })),
+    done('postmark.auth.account_token_scope', 'auth', 'Auth: account routes need X-Postmark-Account-Token, and say so', 'api', 'core', () => withRoot(async (h) => {
+        // [WIRE] the 401 message is ENDPOINT-SCOPED — "Account token" here, "Server token" above.
+        const serverTokenOnly = await h({ m: 'GET', p: '/domains', h: { 'X-Postmark-Server-Token': 'srv-token' } });
+        const withAccount = await h({ m: 'GET', p: '/domains', h: { 'X-Postmark-Account-Token': 'acct-token' } });
+        const sendersNoToken = await h({ m: 'GET', p: '/senders', h: { 'content-type': 'application/json' } });
+        return failedWith(serverTokenOnly, 401, 10)
+            && field(serverTokenOnly, 'Message') === 'Request does not contain a valid Account token.'
+            && ok(withAccount) && failedWith(sendersNoToken, 401, 10);
+    })),
+    done('postmark.auth.test_token_email_only', 'auth', 'Auth: POSTMARK_API_TEST works on /email only (403 ErrorCode 10 elsewhere)', 'api', 'common', () => withRoot(async (h) => {
+        // Verified live during this pack's build: the public test token is /email-scoped, the
+        // refusal is a 403 (not 401), and a test-token send answers "Test job accepted".
+        const send = await h({ m: 'POST', p: '/email', b: mkMail(), h: { 'X-Postmark-Server-Token': 'POSTMARK_API_TEST' } });
+        const elsewhere = await h({ m: 'GET', p: '/server', h: { 'X-Postmark-Server-Token': 'POSTMARK_API_TEST' } });
+        const bounces = await h({ m: 'GET', p: '/bounces', h: { 'X-Postmark-Server-Token': 'POSTMARK_API_TEST' } });
+        return ok(send) && errorCode(send) === 0 && field(send, 'Message') === 'Test job accepted'
+            && elsewhere.status === 403 && errorCode(elsewhere) === 10
+            && String(field(elsewhere, 'Message')).includes('/email')
+            && bounces.status === 403;
+    })),
+    todo('postmark.auth.rate_limit_headers', 'auth', 'Auth: the RateLimit-*/X-RateLimit-*-Second response headers and the 429 path', 'api', 'niche'),
+    // GROUNDING NOTE: yes, a `problem+json` body really is unlike Postmark's usual
+    // `{ErrorCode, Message}` envelope — that IS the finding. Observed live during this pack's
+    // build: a request without `Content-Type: application/json` never reaches Postmark's own
+    // error layer and falls through to the ASP.NET Core host, which answers RFC-9110
+    // problem+json. A twin that "tidied" this into the Postmark envelope would be less faithful,
+    // which is exactly why it is filed as surface to model rather than quietly normalized.
+    todo('postmark.auth.unsupported_media_type', 'auth', 'Auth/protocol: 415 RFC-9110 problem+json when Content-Type is not application/json', 'api', 'niche'),
+    // ── Honesty rungs ────────────────────────────────────────────────────────────────
+    done('postmark.honesty.readonly_rejects_writes', 'honesty', 'read-only twin rejects writes (405)', 'api', 'common', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'postmark-cap-ro-'));
+        try {
+            const write = await handlePostmarkTwinRequest({ method: 'POST', path: '/email', body: JSON.stringify(mkMail()), readOnly: true, root });
+            const read = await handlePostmarkTwinRequest({ method: 'GET', path: '/messages/outbound', readOnly: true, root });
+            return write.status === 405 && read.status === 200;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    }),
+    done('postmark.honesty.unmodeled_404', 'honesty', 'an unmodeled route fails like the vendor (404), never a fake success', 'api', 'core', () => withRoot(async (h) => {
+        const bogus = await h({ m: 'POST', p: '/segments', b: {} });
+        // A route family the twin serves, but a shape the vendor does not:
+        const wrongShape = await h({ m: 'DELETE', p: '/messages/outbound' });
+        // Real routes the twin deliberately does NOT model must 404 rather than answer a
+        // plausible-but-wrong error from a neighbouring branch (§9 finding 7): `PUT
+        // /templates/push` used to be swallowed by /templates/:idOrAlias and answer 1101
+        // "template not found", and the whole /email/bulk subtree used to answer 422/14 on
+        // EVERY verb, so nothing under it could ever 404.
+        const unmodeledPush = await h({ m: 'PUT', p: '/templates/push', b: { SourceServerID: 1, DestinationServerID: 2, PerformChanges: true } });
+        const bulkWrongVerb = await h({ m: 'DELETE', p: '/email/bulk/abc' });
+        // …while the two routes the vendor DOES publish there still answer its approval refusal.
+        const bulkStart = await h({ m: 'POST', p: '/email/bulk', b: {} });
+        return bogus.status === 404 && wrongShape.status === 404
+            && unmodeledPush.status === 404 && errorCode(unmodeledPush) !== POSTMARK_ERRORS.templateNotFound
+            && bulkWrongVerb.status === 404 && failedWith(bulkStart, 422, 14)
+            && typeof bogus.body.ErrorCode === 'number';
+    })),
+    done('postmark.honesty.every_response_has_envelope', 'honesty', 'every failure carries Postmark\'s {ErrorCode, Message} envelope', 'api', 'common', () => withRoot(async (h) => {
+        const failures = [
+            await h({ m: 'POST', p: '/email', b: {} }),
+            await h({ m: 'GET', p: '/templates/nope' }),
+            await h({ m: 'GET', p: '/bounces/9' }),
+            await h({ m: 'GET', p: '/message-streams/nope' }),
+            await h({ m: 'GET', p: '/webhooks/9' }),
+            await h({ m: 'GET', p: '/domains/9' }),
+            await h({ m: 'GET', p: '/senders/9' }),
+            await h({ m: 'POST', p: '/nonexistent', b: {} }),
+        ];
+        return failures.every((r) => {
+            const b = r.body;
+            return r.status >= 400 && typeof b?.ErrorCode === 'number' && b.ErrorCode !== 0 && typeof b?.Message === 'string' && b.Message.length > 0;
+        });
+    })),
+    done('postmark.honesty.no_webhook_signature', 'honesty', 'the twin never invents a webhook signature Postmark does not send', 'api', 'common', () => withWebhookCapture(async (h, seen) => {
+        // A deliberate NEGATIVE fidelity assertion: Postmark webhooks are UNSIGNED. If someone
+        // later bolts on an svix/HMAC scheme copied from a sibling pack, this goes red.
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/plain', Triggers: { Delivery: { Enabled: true } } } });
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'plainhook@twin.test' }) });
+        const headers = seen[0]?.headers ?? {};
+        const body = seen[0]?.body ?? {};
+        return seen.length === 1
+            && !Object.keys(headers).some((k) => /signature|svix|hmac/i.test(k))
+            && !Object.keys(body).some((k) => /signature/i.test(k));
+    })),
+    done('postmark.honesty.conformance_schemas', 'honesty', 'every served resource validates against the published object schemas', 'api', 'common', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'postmark-cap-conf-'));
+        try {
+            const h = (s) => handlePostmarkTwinRequest({ method: s.m, path: s.p, body: s.b === undefined ? undefined : JSON.stringify(s.b), root });
+            await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-conf@twin.test' }) });
+            await h({ m: 'POST', p: '/email', b: mkMail({ To: 'ok-conf@twin.test', TrackOpens: true }) });
+            await h({ m: 'POST', p: '/templates', b: { Name: 'Conf', Alias: 'conf', Subject: 'S', TextBody: 'T' } });
+            await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://app.test/conf' } });
+            await h({ m: 'POST', p: '/domains', b: { Name: 'conf.dev' } });
+            await h({ m: 'POST', p: '/senders', b: { FromEmail: 'conf@conf.dev' } });
+            await h({ m: 'POST', p: '/triggers/inboundRules', b: { Rule: 'conf.test' } });
+            const { checkPostmarkConformance } = await import("./postmark-conformance.js");
+            const report = checkPostmarkConformance({ root });
+            // Failable both ways: it must have found real resources AND found zero violations.
+            return report.ok && report.resourcesChecked >= 9 && report.fieldsChecked > 40 && report.violations.length === 0;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    }),
+    // ── UI mirror (data-coupled — archetype A, every screen reads a real vendor path) ─
+    done('postmark.ui.activity_screen', 'ui', 'UI mirror: Activity list of sent messages from twin state (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: ({ h }) => h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'Activity proof', To: 'activity@twin.test' }) }),
+        fetch: async ({ h }) => list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages'),
+        assert: (rows) => rows.some((r) => r.Subject === 'Activity proof' && r.Recipients?.includes('activity@twin.test')),
+    })),
+    done('postmark.ui.message_body_render', 'ui', 'UI mirror: renders a message\'s html/text body (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: async ({ h }) => {
+            await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'HtmlOne', HtmlBody: '<em>seeded-html-marker</em>', TextBody: undefined }) });
+            await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'TextOne', HtmlBody: undefined, TextBody: 'seeded-text-marker' }) });
+        },
+        fetch: async ({ h }) => {
+            // Fetch through the SAME two-step path the detail pane uses: list, then per-id details.
+            const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+            const detail = async (subject) => {
+                const row = rows.find((r) => r.Subject === subject);
+                return (await h({ m: 'GET', p: `/messages/outbound/${row?.MessageID}/details` })).body;
+            };
+            return { html: await detail('HtmlOne'), text: await detail('TextOne') };
+        },
+        render: ({ html, text }) => JSON.stringify({
+            html: renderToStaticMarkup(createElement(MessageBody, { message: html })),
+            text: renderToStaticMarkup(createElement(MessageBody, { message: text })),
+        }),
+        assert: (_data, markup) => !!markup
+            && markup.includes('message-html') && markup.includes('seeded-html-marker')
+            && markup.includes('message-text') && markup.includes('seeded-text-marker'),
+    })),
+    done('postmark.ui.delivery_timeline', 'ui', 'UI mirror: MessageEvents timeline, incl. a bounce (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: async ({ h }) => {
+            await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'TimelineBounce', To: 'bounce-ui@twin.test' }) });
+            await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'TimelineTracked', To: 'ui-tracked@twin.test', TrackOpens: true, TrackLinks: 'HtmlAndText' }) });
+        },
+        fetch: async ({ h }) => {
+            const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+            const detail = async (subject) => (await h({ m: 'GET', p: `/messages/outbound/${rows.find((r) => r.Subject === subject)?.MessageID}/details` })).body;
+            return { bounced: await detail('TimelineBounce'), tracked: await detail('TimelineTracked') };
+        },
+        render: ({ bounced, tracked }) => JSON.stringify({
+            bounced: renderToStaticMarkup(createElement(DeliveryTimeline, { message: bounced })),
+            tracked: renderToStaticMarkup(createElement(DeliveryTimeline, { message: tracked })),
+        }),
+        assert: (data, markup) => {
+            // The mirror's OWN timeline helper must agree with the twin's recorded events…
+            const bouncedSteps = deliveryTimeline(data.bounced);
+            const trackedSteps = deliveryTimeline(data.tracked);
+            return JSON.stringify(bouncedSteps) === JSON.stringify(['Sent', 'Bounced'])
+                && JSON.stringify(trackedSteps) === JSON.stringify(['Sent', 'Delivered', 'Opened', 'LinkClicked'])
+                // …and the rendered markup must carry the seeded outcome with its tone class.
+                && !!markup && markup.includes('event bad') && markup.includes('Bounced')
+                && markup.includes('event ok') && markup.includes('LinkClicked');
+        },
+    })),
+    done('postmark.ui.status_pill', 'ui', 'UI mirror: the status pill tone comes from the mirror\'s own mapper (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: async ({ h }) => {
+            await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'PillBounce', To: 'bounce-pill@twin.test' }) });
+            await h({ m: 'POST', p: '/email', b: mkMail({ Subject: 'PillOk', To: 'pill-ok@twin.test' }) });
+        },
+        fetch: async ({ h }) => {
+            const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+            const detail = async (subject) => (await h({ m: 'GET', p: `/messages/outbound/${rows.find((r) => r.Subject === subject)?.MessageID}/details` })).body;
+            return { bounced: await detail('PillBounce'), delivered: await detail('PillOk') };
+        },
+        render: ({ bounced, delivered }) => renderToStaticMarkup(createElement('div', null, createElement(StatusPill, { value: messageStatus(bounced) }), createElement(StatusPill, { value: messageStatus(delivered) }))),
+        assert: (data, markup) => messageStatus(data.bounced) === 'Bounced' && messageStatus(data.delivered) === 'Delivered'
+            && statusTone('Bounced') === 'bad' && statusTone('Delivered') === 'ok'
+            && !!markup && markup.includes('pill bad') && markup.includes('pill ok')
+            && markup.includes('>Bounced<') && markup.includes('>Delivered<'),
+    })),
+    done('postmark.ui.bounces_screen', 'ui', 'UI mirror: Bounces screen (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: ({ h }) => h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-screen@twin.test', Subject: 'Bounce screen proof' }) }),
+        fetch: async ({ h }) => list(await h({ m: 'GET', p: '/bounces' }), 'Bounces'),
+        assert: (rows) => rows.some((b) => b.Email === 'bounce-screen@twin.test' && b.Subject === 'Bounce screen proof' && b.Type === 'HardBounce'),
+    })),
+    done('postmark.ui.templates_screen', 'ui', 'UI mirror: Templates screen (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: ({ h }) => h({ m: 'POST', p: '/templates', b: { Name: 'UI Check Template', Alias: 'ui-check', Subject: 'S', TextBody: 'T' } }),
+        fetch: async ({ h }) => list(await h({ m: 'GET', p: '/templates' }), 'Templates'),
+        assert: (rows) => rows.some((t) => t.Name === 'UI Check Template' && t.Alias === 'ui-check' && t.Active === true),
+    })),
+    done('postmark.ui.streams_screen', 'ui', 'UI mirror: Streams screen (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: ({ h }) => h({ m: 'POST', p: '/message-streams', b: { ID: 'uicheck', Name: 'UI Check Stream', MessageStreamType: 'Broadcast' } }),
+        fetch: async ({ h }) => list(await h({ m: 'GET', p: '/message-streams' }), 'MessageStreams'),
+        assert: (rows) => rows.some((s) => s.ID === 'uicheck' && s.Name === 'UI Check Stream') && rows.some((s) => s.ID === 'outbound'),
+    })),
+    done('postmark.ui.webhooks_screen', 'ui', 'UI mirror: Webhooks screen (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: ({ h }) => h({ m: 'POST', p: '/webhooks', b: { Url: 'https://ui-check.test/hook', Triggers: { Delivery: { Enabled: true } } } }),
+        fetch: async ({ h }) => list(await h({ m: 'GET', p: '/webhooks' }), 'Webhooks'),
+        assert: (rows) => rows.some((w) => w.Url === 'https://ui-check.test/hook' && w.MessageStream === 'outbound'),
+    })),
+    done('postmark.ui.suppressions_screen', 'ui', 'UI mirror: Suppressions screen (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: ({ h }) => h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'ui-suppressed@twin.test' }] } }),
+        fetch: async ({ h }) => list(await h({ m: 'GET', p: '/message-streams/outbound/suppressions/dump' }), 'Suppressions'),
+        assert: (rows) => rows.some((s) => s.EmailAddress === 'ui-suppressed@twin.test' && s.SuppressionReason === 'ManualSuppression'),
+    })),
+    done('postmark.ui.nav', 'ui', 'UI mirror: the nav shell — EVERY section it routes to reads live twin state', 'ui', 'core', uiDataCoupled({
+        withRoot: withRootCtx,
+        // A nav shell's honest data-coupling is proving every screen it routes to reads live
+        // data (the sentry.ui.nav precedent) — so seed one row per section, then walk the
+        // mirror's OWN declared section table and fetch each section's real API path.
+        seed: async ({ h }) => {
+            await h({ m: 'POST', p: '/email', b: mkMail({ To: 'bounce-nav@twin.test' }) }); // messages + bounces
+            await h({ m: 'POST', p: '/templates', b: { Name: 'Nav', Alias: 'nav', Subject: 'S', TextBody: 'T' } });
+            await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://nav.test/hook' } });
+            await h({ m: 'POST', p: '/message-streams/outbound/suppressions', b: { Suppressions: [{ EmailAddress: 'nav@twin.test' }] } });
+        },
+        fetch: async ({ h }) => {
+            const counts = {};
+            for (const s of POSTMARK_MIRROR_SECTIONS) {
+                const r = await h({ m: 'GET', p: s.path });
+                counts[s.key] = ok(r) ? list(r, s.collection).length : -1;
+            }
+            return counts;
+        },
+        assert: (counts) => POSTMARK_MIRROR_SECTIONS.length === 6
+            && POSTMARK_MIRROR_SECTIONS.every((s) => (counts[s.key] ?? 0) > 0),
+    })),
+    done('postmark.ui.detail_panel', 'ui', 'UI mirror: the detail panel flattens nested vendor fields (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: withRootCtx,
+        seed: ({ h }) => h({ m: 'POST', p: '/email', b: mkMail({
+                Subject: 'Detail check', To: 'Ada <detail-to@twin.test>', Cc: 'detail-cc@twin.test',
+                Tag: 'detail-tag', Metadata: { tenant: 'detail-tenant' }, TrackOpens: true,
+            }) }),
+        fetch: async ({ h }) => {
+            const rows = list(await h({ m: 'GET', p: '/messages/outbound' }), 'Messages');
+            const row = rows.find((r) => r.Subject === 'Detail check');
+            return (await h({ m: 'GET', p: `/messages/outbound/${row?.MessageID}/details` })).body;
+        },
+        render: (message) => renderToStaticMarkup(createElement(NestedLines, { lines: flattenPostmarkValue(message) })),
+        assert: (message, markup) => !!markup && markup.includes('detail-line')
+            // nested arrays/objects the vendor returns are flattened into dotted paths
+            && markup.includes('To[0].Email') && markup.includes('detail-to@twin.test')
+            && markup.includes('Ada') && markup.includes('detail-cc@twin.test')
+            && markup.includes('Metadata.tenant') && markup.includes('detail-tenant')
+            && markup.includes('MessageEvents[0].Type')
+            && String(message.Tag) === 'detail-tag',
+    })),
+    todo('postmark.ui.stats_dashboard', 'ui', 'UI mirror: a stats/overview screen over GET /stats/outbound', 'ui', 'common'),
+    todo('postmark.ui.message_search', 'ui', 'UI mirror: an activity search box driving the outbound filters', 'ui', 'common'),
+    todo('postmark.ui.inbound_screen', 'ui', 'UI mirror: an inbound-message screen', 'ui', 'niche'),
+    todo('postmark.ui.domains_screen', 'ui', 'UI mirror: a Domains/Sender-Signatures DNS screen', 'ui', 'niche'),
+    // ── Connector ────────────────────────────────────────────────────────────────────
+    done('postmark.connector.pull_messages', 'connector', 'Connector: pull outbound messages from real Postmark', 'connector', 'core', () => withRoot(async (h, root) => {
+        const mapped = await pullPostmarkMessages(fakePostmarkClient());
+        if (mapped[0]?.id !== 'real-msg-0001' || mapped[0].fields.Subject !== 'RealSubject')
+            return false;
+        await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        const listed = await h({ m: 'GET', p: '/messages/outbound' });
+        const row = list(listed, 'Messages').find((m) => m.MessageID === 'real-msg-0001');
+        return ok(listed) && !!row && row.Subject === 'RealSubject' && row.Tag === 'real-tag' && row.TrackOpens === true;
+    })),
+    done('postmark.connector.pull_bounces', 'connector', 'Connector: pull bounces from real Postmark', 'connector', 'common', () => withRoot(async (h, root) => {
+        const mapped = await pullPostmarkBounces(fakePostmarkClient());
+        if (mapped[0].fields.Email !== 'real-bounced@twin.test')
+            return false;
+        await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        const one = await h({ m: 'GET', p: '/bounces/9001' });
+        const stats = await h({ m: 'GET', p: '/deliverystats' });
+        return ok(one) && field(one, 'Email') === 'real-bounced@twin.test' && field(one, 'Type') === 'HardBounce'
+            && field(stats, 'Bounces')[0].Count === 1;
+    })),
+    done('postmark.connector.pull_templates', 'connector', 'Connector: pull templates from real Postmark', 'connector', 'common', () => withRoot(async (h, root) => {
+        const mapped = await pullPostmarkTemplates(fakePostmarkClient());
+        if (mapped[0].fields.Alias !== 'real-alias')
+            return false;
+        await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        const got = await h({ m: 'GET', p: '/templates/real-alias' });
+        return ok(got) && field(got, 'TemplateId') === 7001 && field(got, 'Name') === 'RealTemplate';
+    })),
+    done('postmark.connector.pull_streams_webhooks_server', 'connector', 'Connector: pull message streams, webhooks and the server', 'connector', 'common', () => withRoot(async (h, root) => {
+        const streams = await pullPostmarkMessageStreams(fakePostmarkClient());
+        const hooks = await pullPostmarkWebhooks(fakePostmarkClient());
+        const server = await pullPostmarkServer(fakePostmarkClient());
+        if (streams[0]?.id !== 'real-stream' || hooks[0]?.id !== '5001' || server[0]?.id !== '42')
+            return false;
+        await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        const s = await h({ m: 'GET', p: '/message-streams/real-stream' });
+        const w = await h({ m: 'GET', p: '/webhooks/5001' });
+        const servers = await h({ m: 'GET', p: '/servers' });
+        return field(s, 'Name') === 'RealStream' && field(w, 'Url') === 'https://real.test/hook'
+            && list(servers, 'Servers').some((x) => x.ID === 42 && x.Name === 'RealServer');
+    })),
+    done('postmark.connector.pull_idempotent', 'connector', 'Connector: a re-pull of identical state appends NO deltas', 'connector', 'common', () => withRoot(async (h, root) => {
+        const first = await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        const second = await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-02T00:00:00.000Z' });
+        const listed = await h({ m: 'GET', p: '/messages/outbound' });
+        return first.observed > 0 && first.deltasAppended > 0 && second.deltasAppended === 0
+            && field(listed, 'TotalCount') === 1; // no duplicate rows from the second pull
+    })),
+    done('postmark.connector.push_message', 'connector', 'Connector: push a local send to real Postmark, ONCE', 'connector', 'core', () => withRoot(async (h, root) => {
+        await h({ m: 'POST', p: '/email', b: mkMail({ To: 'Pushed <pushed@twin.test>', Subject: 'Pushed subject', Tag: 'pushed' }) });
+        const client = fakePostmarkClient();
+        const first = await performPending(client, { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        const sent = client.sends.find((s) => s.Subject === 'Pushed subject');
+        if (!sent || sent.To !== 'pushed@twin.test' || sent.Tag !== 'pushed' || sent.From !== 'Acme <notifications@acme.dev>')
+            return false;
+        // A re-push must enact NOTHING — confirmed actions are no longer pending.
+        const before = client.sends.length;
+        const second = await performPending(client, { root, occurredAt: '2026-01-02T00:00:00.000Z' });
+        return first.pushed >= 1 && second.pushed === 0 && client.sends.length === before;
+    })),
+    done('postmark.connector.push_template_and_webhook', 'connector', 'Connector: push local templates/webhooks/streams', 'connector', 'common', () => withRoot(async (h, root) => {
+        await h({ m: 'POST', p: '/templates', b: { Name: 'PushMe', Alias: 'push-me', Subject: 'PS', HtmlBody: '<p>ph</p>' } });
+        await h({ m: 'POST', p: '/webhooks', b: { Url: 'https://push.test/hook', Triggers: { Delivery: { Enabled: true } } } });
+        await h({ m: 'POST', p: '/message-streams', b: { ID: 'pushed', Name: 'Pushed Stream', MessageStreamType: 'Broadcast' } });
+        const client = fakePostmarkClient();
+        const res = await performPending(client, { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        return res.pushed === 3
+            && client.templateCreates[0].Name === 'PushMe' && client.templateCreates[0].Alias === 'push-me'
+            && client.webhookCreates[0].Url === 'https://push.test/hook'
+            && client.streamCreates[0].ID === 'pushed' && client.streamCreates[0].MessageStreamType === 'Broadcast';
+    })),
+    done('postmark.connector.push_refuses_unmodeled', 'connector', 'Connector: push REFUSES an unmodeled op rather than dropping it', 'connector', 'common', async () => {
+        // A silent drop is the failure mode this guards: the connector must throw with the op name.
+        try {
+            await pushPostmarkAction(fakePostmarkClient(), { operation: 'bounce.activate', subject: { type: 'bounce', id: '1' }, fields: {} });
+            return false;
+        }
+        catch (error) {
+            return String(error).includes("unsupported operation 'bounce.activate'") && String(error).includes('refusing to silently drop');
+        }
+    }),
+    done('postmark.connector.map_shapes', 'connector', 'Connector: the pure vendor→twin shape mappers', 'connector', 'niche', async () => {
+        const m = mapMessage({ MessageID: 'm1', From: 'f@x.dev', Subject: 'S', Recipients: ['r@x.dev'] });
+        const b = mapBounce({ ID: 7, Type: 'Transient', Email: 'b@x.dev' });
+        const t = mapTemplate({ TemplateId: 3, Name: 'T', Alias: null });
+        return m.type === 'message' && m.id === 'm1' && m.fields.MessageStream === 'outbound'
+            && b.type === 'bounce' && b.id === '7' && b.fields.RecordType === 'Bounce'
+            && t.type === 'template' && t.id === '3' && t.fields.Active === true;
+    }),
+    done('postmark.connector.send_after_pull', 'connector', 'Connector: a PULLED twin is still sendable — defaults survive a pull (dirty state)', 'connector', 'core', () => withRoot(async (h, root) => {
+        // §9 REGRESSION PIN for a real bug the gate was structurally blind to. `bootstrap()`
+        // used to materialize the default streams/server only when the resource TYPE was
+        // empty — so after a pull brought in ONE real stream and ONE real server, the
+        // `outbound` stream and server 1 were never created, and a pulled twin answered
+        // "server not found" on GET /server and ErrorCode 1235 on a plain POST /email.
+        // Nothing in the pull_* verifies touched either path, which is exactly why an
+        // independent skeptic found it and the mutation gate could not.
+        await syncPostmarkFromReal(fakePostmarkClient(), { root, occurredAt: '2026-01-01T00:00:00.000Z' });
+        // The pulled objects are there…
+        const pulledStream = await h({ m: 'GET', p: '/message-streams/real-stream' });
+        const pulledServer = await h({ m: 'GET', p: '/servers/42' });
+        if (!ok(pulledStream) || !ok(pulledServer))
+            return false;
+        // …AND the defaults a real Postmark server always has are still there beside them.
+        const outbound = await h({ m: 'GET', p: '/message-streams/outbound' });
+        const server = await h({ m: 'GET', p: '/server' });
+        if (!ok(outbound) || field(server, 'ID') !== 1)
+            return false;
+        // …so the headline flow still works on a pulled twin.
+        const sent = await h({ m: 'POST', p: '/email', b: mkMail({ To: 'after-pull@twin.test' }) });
+        const listed = await h({ m: 'GET', p: '/messages/outbound' });
+        return ok(sent) && errorCode(sent) === 0
+            && list(listed, 'Messages').some((m) => m.Recipients?.includes('after-pull@twin.test'))
+            // the pulled message is still there too — bootstrap did not trample observed state
+            && list(listed, 'Messages').some((m) => m.MessageID === 'real-msg-0001');
+    })),
+    todo('postmark.connector.pull_domains_senders', 'connector', 'Connector: pull account-level domains + sender signatures', 'connector', 'common'),
+    todo('postmark.connector.pull_suppressions', 'connector', 'Connector: pull each stream\'s suppression list', 'connector', 'common'),
+    todo('postmark.connector.pull_inbound_messages', 'connector', 'Connector: pull inbound messages', 'connector', 'niche'),
+    todo('postmark.connector.pull_pagination', 'connector', 'Connector: page through >500 outbound messages/bounces on pull', 'connector', 'common'),
+    todo('postmark.connector.rate_budget', 'connector', 'Connector: a persistent rolling-window rate budget guarding live calls', 'connector', 'common'),
+];
+/** The vendor's own docs-nav API groups, enumerated TOP-DOWN from developer.postmarkapp.com
+ *  (not derived from the manifest above — that would make any bijection a tautology). */
+export const POSTMARK_AREAS = [
+    'email', 'messages', 'bounces', 'templates', 'streams', 'suppressions', 'webhooks',
+    'server', 'servers', 'stats', 'inbound_rules', 'domains', 'senders', 'data_removals',
+    // Twin-side rungs, not vendor groups:
+    'auth', 'honesty', 'ui', 'connector',
+];
+export function postmarkCapabilities() {
+    return checkCapabilities('postmark', POSTMARK_CAPABILITIES);
+}
+// Referenced so the mirror's webhook helpers stay part of the pack's typed surface even when
+// a verify() exercises them only indirectly through the handler.
+export const __postmarkInternals = { deliveryPlan, webhookHeaders, webhooksFor };