feat(email): concentric slot pass-through — fill a slot re-exposed through a nested component

[agreenspan]

Summary

Stacked on #74 (the MJML slot engine). Rebuilt 2026-09-08: the concentric pass-through, send-path cycle guard, and duplicate-exposed-slot validation moved into #74 (they are the Zealot-parity engine shape — expand is the single guarded walk, parseBlocks the single gate). What remains here is template-specific:

1. Send-time delivery hardening — a derived text/plain part and a sanitized subject.
2. Send-time content capture — settledMjml + variables on CommunicationLog, plus the structured component version closure (CommunicationComponentVersion junction).
3. Recompose rebuilt on the slot engine — snapshot recomposition renders through expandWith with the pinned bodies as its loader.

1 — Send-time delivery hardening

• sanitizeSubject — reverses the interpolation escaping (lodash unescape mirrors the escape applied — O'Brien no longer ships as O'Brien), replaces control characters (CR/LF header-injection guard), collapses whitespace.
• deriveTextFromHtml — derives the multipart text/plain alternative from the rendered MJML output. A configured wrapper around html-to-text@10 pinning the email contract: block boundaries as newlines, label (href) links with same-target dedupe, image alt text, nbsp/blank-run normalization, and unbounded table columns so MJML layout tables never rewrap body copy.
• deliverEmail applies both at the client handoff; SendEmailOptions/the Resend payload carry text.

2 — Send-time content capture

The existing pin (emailTemplateAuditLogId) preserves the raw stored template at its sent version, but nothing preserved what actually went out: expand resolves components through the sender's cascade at send time, and one template row serves many senders — a save-time pin structurally cannot encode per-send resolution. Two captures, both written at the sending claim:

• The document — settledMjml (post-expand, post-interpolate MJML) and variables (the resolved lens payload, now returned on SettledTemplate) on CommunicationLog. Raw body deliberately not duplicated (the audit row carries it); HTML derivable from settledMjml.
• The structured closure — CommunicationComponentVersion, one row per (send, slug): the EmailComponent row the sender's cascade actually resolved (transitively) and that component's latest audit snapshot id. composeTemplate records the resolutions from its own cascade loader (no hook on expand) and returns them as componentResolutions; the claim transaction rewrites the rows on a re-claimed retry (unique on (communicationLogId, slug)).

3 — Recompose on the slot engine

recomposeSnapshot substituted child snapshots with a regex that replaced the whole ref span — destroying the caller override slots the slot grammar keeps inline — and recursed unbounded on a cyclic snapshot graph. Now: walk the pinned componentVersions graph breadth-first collecting each slug's snapshot body (nearest pin wins, visited set bounds cycles), then expandWith(root.mjml, loader) with those bodies — override injection, empty-fill semantics, and the render cycle guard come from the engine.

Validation

• packages/email: 369/369; apps/api: 1032 pass, 2 fail — the lens count-scope tests test: provide conditions for lens count-scope regressions #95 fixes on main. Typecheck clean on db/email/api; biome clean.
• New communicationLogFactory (the closure test created its log directly, with a Space sender carrying an organization id the polymorphism axis forbids — passed alone, failed under the rules hook in the full run).

Notes

• Commits 1 and the sanitize/text pieces have Zealot mirrors (userevidence/Zealot-Monorepo#2112); 2–3 are template-specific (Zealot has no audit system yet).
• Remaining follow-up: builder region/decoration badging of a re-exposed slot (Zealot #1698 regions.ts).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uyo2oHpjDz4zjRyqRWH6bP