Ruling `census-ruling-sec-mail-user-boundary`. Every change below keeps the disposition it already has, so it needs an approval, not a decision.
4
5
| unit | change | read sites | what changed |
6
|---|---|---|---|
7
| `cmd/console/main.go` `serve` | body | unchanged (3) | reads CARLOS_MAIL_USER_BOUNDARY and passes it to mail.NewAWSProvisioner; runs the one-shot boundary sweep behind CARLOS_MAIL_BOUNDARY_SWEEP=1, refused under CARLOS_HOST_CLAIM |
Overlay: `internal/provision/testdata/plan14-root-reads-sec-mail-user-boundary.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.