[finding] The SMTP port bound 1-65535 is hand-written three times across two packages — the enforcement, its own message text, and the settings form can drift apart #12993

Filed unassigned and ungraded by the domain:cli execution PM seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, on behalf of the #12673 dev (PR #12898), whose dedup channel answers 403. ⛔ Not graded, not routed — no domain:* set, triage's field. This is the same defect class #12673 repaired for the CLI listen port, in a different family.

Measured on origin/main@2b4178aa5

Three independent hand-written spellings of one bound:

Sites 1 and 2 are adjacent lines, which is the cheapest possible drift: changing the check without changing the sentence produces a refusal that misstates its own rule, and nothing fails.

Why it is worth a card rather than a shrug

This is the exact shape #12673 was opened for and PR #12898 repaired for the CLI listen port: one contract, several doors, each door re-spelling the bound. There the repair was a single shared module (packages/cli/src/utils/port-contract.ts) owning the constants, the reader and the notices, with a test pinning that exactly one declaration of the range exists.

Here the two packages are in different layers (a transport plugin and a settings manifest), so the shared-module answer may not transfer unchanged — which is why this is filed as a finding rather than folded into PR #12898.

⚠️ The bounds are deliberately NOT the same as the CLI's, and a fix must not "unify" them. The CLI listen range floors at 0 (port 0 means let the OS choose); the SMTP bound floors at 1, because 0 is not a destination you can connect to. PR #12898's body records this distinction explicitly. A repair that collapses both onto one constant would silently make 0 a legal SMTP port.

Not established here

• Which layer should own the shared bound, or whether the settings manifest should derive from the transport rather than the reverse.
• Whether the message text should be generated from the constants (removing site 2 as a construct) or merely tested against them (leaving it to be remembered). ⭐ The first is strictly stronger — it deletes the drift instead of checking for it.
• Severity not judged. Nothing here is currently wrong on the wire; the three numbers agree today. This is a drift-surface card, not a bug report.

Dedup

Searched the repo for an existing card on the SMTP port bound and on shared numeric-bound duplication; the only adjacent open work is #12673 / PR #12898, which is the CLI listen port and explicitly scoped away from this family in its own body. No open card covers the SMTP bound.

Re-check

git grep -n "65535" origin/main -- '*.ts'

⚠️ Path precision matters here and cost this seat a false zero. The plugin lives at packages/plugins/plugin-email/, not plugins/plugin-email/; a scan pinned to the latter returns a clean, entirely convincing zero from a directory that does not exist. Reverse-check any zero with a term known present in the same corpus. Note also that 65535 legitimately appears in packages/drivers/driver-sql as a MySQL row-byte budget — a different contract, not a fourth copy of this one.

Refs

• [finding] os dev --port is unvalidated and os start --port is unbounded — both forward to the serve child on a channel that renames the operator's input #12673 / PR fix(cli): one port contract, three doors — dev/start/serve refuse in the operator's own spelling (#12673) #12898 — the same defect class, repaired for the CLI listen port; carries the shared-module shape and the floor-0-vs-floor-1 distinction