[jayleaton]

Summary

#103 makes web and admin refuse to boot in production with an unset FROM_EMAIL or one on a reserved example/test domain. Every Railway service runs with APP_ENV=production, and deploy/ defaulted email.from to noreply@example.com, so a fresh make railway-setup on defaults would deploy apps that never boot. This makes the deploy side refuse first. It goes in before #103.

 deploy/platform
+  RealSender(address)        same rule as #103's realSender: example.com/.net/.org, example, test, invalid, localhost; "Name <a@b>" ok
+  Config.SenderProblems()    per environment: email.from, or per_environment.<env>.from_email (manual: not checked)
~  email.from default        noreply@example.com -> unset
~  Edit                      sets dotted keys (email.from)
 cmd/railway-setup
+  plan / setup / apply      refuse before touching anything, error + nextSteps entry
+  apply on a terminal, no --yes: asks for the sender, writes it into platform.yaml
+  --email-from / PLATFORM_EMAIL_FROM
+  doctor                    fails the email.from check
 deploy/platform.yaml        email.from: "" with a "required" comment
 docs/deploy.md, AGENTS.md   a real sender is required; agents ask the developer for it

Evidence

Read-only bin/railway-setup runs against a scratch platform.yaml (staging,production; project gfs-senderprobe-261023, which does not exist and was never created: railway list shows 0).

case	command	result
unset	plan --json	exit 1: refusing to deploy apps that would not boot: production needs a real FROM_EMAIL (staging: email.from is not set; production: email.from is not set): set email.from in deploy/platform.yaml … and nextSteps[0] Set a real sender for auth emails: …
noreply@example.com	plan --json	exit 1: staging: "noreply@example.com" is an example or test address; production: …
"Acme <noreply@acme.dev>" + per_environment.staging.from_email: qa@mail.test	plan --json	exit 1: only staging: "qa@mail.test" is an example or test address
"Acme <noreply@acme.dev>"	plan --json	exit 2, 9 change(s) pending (a normal plan)
unset, non-interactive	apply --yes --json < /dev/null	exit 1, "project": null, the nextSteps entry; nothing created
unset	plan --email-from noreply@acme.dev	platform.yaml: set email.from (commit it); the file now has from: noreply@acme.dev, exit 2
unset	doctor --json	exit 4, email.from check fail

make check-fast ok, make deploy-vars ok (44 app variables), make lint-layering ok.

No unit tests, on purpose: the brief asked for tests in deploy/platform, but scripts/check-test-boundaries.sh (AGENTS.md "Test boundaries", mandatory) allows tests only in the five service/handler/auth directories and rejects any _test.go in deploy/. deploy/ has no tests on main. The runs above cover the unset, example and real-sender cases instead. To get tests here, JJ would have to sign off on changing that rule.

Merge Danger

Door: two-way.

Blast Radius: deploys

Projects whose platform.yaml still says noreply@example.com (or has no sender) now get a refused plan/apply with the fix spelled out. That is intended: with #103 their apps would not boot. A manual from_email is not checked, because its value lives in Railway.

🤖 Generated with Claude Code