[miakh]

A partial Compose recreation on 2026-10-27 omitted the email and monitoring overlays, stopping provider preflight and queue delivery. The live runtime is recovered using its full installed configuration; the due queue has drained and health is clear.

Add a guarded Functions code-reload command that validates the complete protected Compose model against the running environment/image/command and canonical database identity before stopping anything. It requires email to be paused/drained, restarts the existing container without replacing its environment, and checks the real unauthorized worker response. It leaves email paused on failure. Configuration migrations remain separately reviewed operations.

Make this procedure mandatory in the project backend-access skill and architecture context; record the incident and recovery. Register 9 regression tests in the explicit automation lane, including actual Compose interpolation with and without the email overlay, rejecting partial configuration before any restart, preserving the container, drain checks, worker readiness/error responses, and preservation of the independently configured shared app-links sender organization.

Validation: all 9 tests pass, including real Compose rendering; whitespace checks pass. Authoritative main fetched before publication at bff3b0a; no intervening changes. Final commit f570785 passed read-only validation against the restored production runtime: complete configuration matches, alerts are empty, quota/heartbeat are fresh, and no messages are overdue. No additional restart or synthetic email was performed.