Requirements: Operations Wiring (Phase 3)

Functional requirements for the operations changes. Behavior definitions in Design §9.2/§9.3/§9.5; construct blueprint in Design §12 — operations wiring.

Library Adoption

REQ-OPS-001 — operations SHALL consume common-module 13.2.0; the per-tenant email module SHALL re-import the lifted types (wire types, SendEmailOutcome, send proxy, fromHeader) and delete its local copies — public behavior unchanged (DQ-004).
REQ-OPS-002 — The tenant send service (service/EmailSender.kt) SHALL delegate its retry core to the library’s PostmarkEmailSender, retaining tenant-specific behavior (per-attempt token fetch, canSend recheck, in-flight tracking, cancellation) via the factory’s token supplier and hooks (Design §8 — Per-tenant email module).

REQ-OPS-003 — The Helm chart SHALL project the system-server token by adding a SystemEmailServerToken data entry (remoteRef {fqn}-I-EmailSystemServerToken, property: token) to the ExternalSecret that templates secrets.properties, emitting the line email.serverToken={{ .SystemEmailServerToken }}; the local-mode fallback Secret SHALL emit the same line with a dummy value (Design §9.2).
REQ-OPS-004 — The component SHALL declare a top-level email {} block (serverToken from the layered secret; from sub-block with domain system.{partition-mail-zone} derived from existing chart values, localPart, displayName) — a dataSource-less block (no db plumbing).

REQ-OPS-005 — When emailConfiguration is present, the composition root SHALL construct one systemEmailSender: EmailSender via EmailSenderFactory and expose it to backend modules in-process only (no REST surface); absent config → no sender, normal boot (DQ-006, Design §9.5).
REQ-OPS-006 — Misconfiguration (present block, blank/missing token) SHALL fail pod boot loudly (Design §9.5 — Fail-fast).
REQ-OPS-007 — A dev smoke spec (Kotest-tagged, excluded from default builds) SHALL send one real message through the deployed dev SystemEmailServer and assert a Sent(messageId) outcome — executed at the Phase 4 dev gate (BV-4-06).
REQ-OPS-008 — No webhook SHALL be installed on the system server; no system-send persistence SHALL be added (DQ-007 — fire-and-forget v1).