Email settings reference
Call email(action="settings", input={}, reasoning="inventory Email policy") to
show effective Email policy. It is SHOW-only: non-empty input is refused, no writer
exists, and it performs no mailbox I/O. Success is {"settings": [...]} with
exactly key, current, default, configurable, and comment in every row.
The complete response is bounded at 65,536 UTF-8 bytes. If applied truth or a
provider row is unavailable, the whole action fails with fixed
SETTINGS_UNAVAILABLE, never partial rows or exception detail.
Installed-code rows
These three values come from Email's installed settings.py constants. There is
no environment/owner-file override; changing them needs reviewed code/package
bytes plus full relaunch, then another SHOW. Their row order is the order below.
Send body character limit
send.body_char_limit: current/default 50,000, configurable false. Counts Unicode
body characters for send/reply; oversize bodies are refused before scheduling.
Repeated authorized mail
There is no recipient/body repetition heuristic. Identical authorized sends and replies remain separate deliveries; elapsed time, body novelty, or manager restart is not required. This is not permission for unrequested mail or ACK loops.
Check result token limit
check.result_token_limit: current/default 10,000, configurable false. Summary
entries are removed to fit a check result; truncated_by_budget reports the
number omitted, so result size alone is not the mailbox total.
Unread notification entry limit
unread.max_entries: current/default 10, configurable false. Projects newest
unread entries while preserving the total unread count. This is not a per-body
truncation or mailbox retention limit.
Pseudo-agent subscriptions
manifest.pseudo_agent_subscriptions is a sensitive construction snapshot.
Current/default stay <redacted>; raw path lists never appear in SHOW. Accepted
configuration is a JSON list of paths ([] disables subscriptions); when absent,
the launcher default is ["../human"]. Invalid path elements fail adapter
construction rather than being ignored.
For the normal CLI launcher the source is that exact init.json manifest field;
embedders can supply the POSIX constructor argument directly. There is no Email
environment or owner-file peer. After explicit authorization, edit the owning
source and fully relaunch so the adapter is reconstructed. Public System refresh
uses a process relaunch; the internal in-process _setup_from_init() only rebuilds
the EmailManager and keeps the existing mail adapter snapshot. SHOW proves
availability and redaction, never the paths. This distinction corrects the source
Contract's unqualified “ordinary refresh” wording without changing runtime.
Privacy boundary
Mailbox/session paths, addresses, identities, contacts, messages, attachments, and
read/archive state are runtime data and are excluded, not merely redacted.
LINGTAI_AGENT_ALIVE_THRESHOLD_SEC remains kernel liveness policy and
LINGTAI_NOTIFICATION_MAX_CHARS remains Notification presentation policy; Email
does not claim either variable.