# Census approval: sec-mail-user-boundary

Ruling `census-ruling-sec-mail-user-boundary`. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

| unit | change | read sites | what changed |
|---|---|---|---|
| `cmd/console/main.go` `serve` | body | unchanged (3) | reads CARLOS_MAIL_USER_BOUNDARY and passes it to mail.NewAWSProvisioner; runs the one-shot boundary sweep behind CARLOS_MAIL_BOUNDARY_SWEEP=1, refused under CARLOS_HOST_CLAIM |

Envelopes re-pinned: `cmd/console`, `internal/mail`.

Seal: `27b020590845320cd37b94fdeddf61b7c6f90e12ba7841850f2e7bbd6836ecd8` → `68ca9635da386f34ef483c790af19e954122c11edc406d64cde8d55d99d12de5`.

Overlay: `internal/provision/testdata/plan14-root-reads-sec-mail-user-boundary.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.