Finish the Pad URL follow-ups after the backend deploys #661

Follow-ups left open on purpose by the Pad URL work (#646, #647, #648). The final industry-standard review granted the flag on 2026-10-31; these are the items it, or the maintainer, kept for later.

After the backend deploys

• Stop sending document_slug in the immediate email payload. process_email_queue (packages/supabase/scripts/07-5-email-notifications-pgmq.sql) still reads channels.slug and sends it, so a server that has not deployed yet keeps working. The new server no longer reads it. Remove the key and the channels.slug read in a new migration, once the backend from Build every sent pad link from one shared pad-url package #648 is live.

Maintainer decision

• Retire POST /api/email/send-digest, or give it its own document type. Nothing in the repo calls it (apps/hocuspocus.server/src/api/email.ts), but API.md and the OpenAPI spec document it. While it exists, DigestDocument.workspace_id (packages/email-templates/src/types.ts) must stay optional, which keeps two unreachable guards (digestContentChanges.ts enrichDigestDocuments, digestDocuments.ts). Recommended: retire the route, then make the field required.

Polish (safe today)

• The digest consumer reads the grouping setting before it plans (apps/hocuspocus.server/src/lib/email/pgmqConsumer.ts), so the defer and skip paths also touch Redis. It is bounded by REDIS_COMMAND_TIMEOUT, and a defer is redelivered. Fix: split the pure plan into an outcome step and a grouping step, so defer and skip never read Redis; read the two settings with one Promise.all.
• The digest catch arm marks every queue id failed, including mails already queued and left-over rows. A later sent settle repairs queued mails, and redelivery re-marks left-over rows skipped. Fix: settle only plan.leftOver plus the mails that were not queued.

Record: Notes/local-docs/2026-10-30-pad-url-engine/architecture-review/final-flag.md (local).

Done in 60c4262a0 (not pushed yet): the digest outcome split, the catch fix, and the send-digest retirement. Only the document_slug removal is left, and it waits for the backend deploy.