chore(email): preserve superseded process-local throttle provenance

[seonghobae]

Current authority — 2026-09-10

• canonical send-throttling owner: #1417@489bcbeaf131da123551a187228862b0e47ad549
• generated predecessor: f7390a362863c29351b1b37f5db09ca4acfc3fa5
• exact head: 624ab25137227dba244efeb9dc2171f71b557a36
• lifecycle: Draft / superseded process-local limiter provenance / do not merge independently
• intended effective delta over fix(email): enforce shared send throttling #1417: 0 files; verify with fresh compare after retarget.

The generated proposal tried to bound the protected develop process-local send-throttle dictionary by evicting expired scopes when its size exceeded 1000. The finding is real only for the legacy process-local implementation: if many distinct scopes remain active inside the 60-second window, the proposed eviction does not itself guarantee a hard ≤1000 bound.

More importantly, that process-local limiter is already superseded by canonical Naruon owner #1417. #1417 removes _email_send_attempts_by_scope, _email_send_rate_limit_lock, and _enforce_send_email_rate_limit() from backend/api/emails.py and replaces them with a PostgreSQL-backed, fail-closed transaction-scoped limiter. Its retained tests cover concurrent same-scope quota enforcement, user/organization/workspace isolation, real 61-second window expiry, pruning of expired allowed reservations while preserving denial evidence, unavailable-state fail closure, cancellation/connection cleanup, and a signed send route with a one-slot pool. Those contracts are stronger than the four process-local tests introduced by the generated proposal and eliminate the in-memory scope-map growth mechanism itself.

Ordinary two-parent reconciliation 624ab251... preserves generated f7390a36... as first-parent provenance, adopts current #1417 as second parent, and uses #1417's exact tree. The branch advanced with force=false; no process-local limiter source or test remains independently owned here. The prior body also incorrectly named #1631 as the frontend dependency-security owner; canonical dependency-security ownership remains #1623.

Keep Draft until protected integration proves complete succession. Do not recreate a local-map cap, Redis workaround, duplicate limiter, dummy requeue, self-approval, force push, or gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

trivy-fs triage (head f7390a3, read-only local repro): 3 fixable CRITICAL/HIGH findings, all in frontend/pnpm-lock.yaml — CVE-2026-75604 (next 16.2.12), GHSA-2xp9-vwfh-vxw4 (next 16.2.12), GHSA-rgj7-g3m4-5g8c (sharp 0.35.0). This slice touches only backend/api/emails.py + backend/tests/test_emails_api.py, so it cannot introduce these findings; remediation belongs to PR1631 (dependabot next 16.3.3), not duplicated here. Local evidence: trivy fs scan, 600 targets, findings confined to the lockfile.