@@ -0,0 +1,108 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0131 D6/D10, ruling C] The pin of `emailTemplateDefinitionFromRow` — the
+ * mapping the upgrade ceremony applies to promote a customized
+ * `sys_email_template` row to an environment `email_template` item through the
+ * metadata door. The expected bodies are the outputs the module doc states,
+ * written out by hand; the schema is read only to hold the body to it.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { EmailTemplateDefinitionSchema } from '@objectstack/spec/system';
+import { emailTemplateDefinitionFromRow } from './email-template-row-definition.js';
+
+/** A row as `sys_email_template` stores it, its state and provenance riding along. */
+const storedRow = {
+  id: 'tpl_01',
+  name: 'crm.welcome',
+  label: 'Welcome',
+  category: 'notification',
+  locale: 'zh-CN',
+  description: 'Sent on sign-up',
+  subject: 'Welcome, {{user.name}}',
+  body_html: '<p>Hello {{user.name}}</p>',
+  body_text: 'Hello {{user.name}}',
+  from_name: 'Acme Support',
+  from_address: 'support@acme.test',
+  reply_to: 'help@acme.test',
+  active: 0,
+  is_system: 1,
+  variables_json: '[{"name":"user.name","type":"string","required":true}]',
+  managed_by: 'package',
+  customized: 1,
+  organization_id: 'org_1',
+  created_at: '2026-01-01T00:00:00.000Z',
+  updated_at: '2026-01-02T00:00:00.000Z',
+};
+
+const schemaKeys = (): Set<string> =>
+  new Set(Object.keys((EmailTemplateDefinitionSchema as unknown as { shape: Record<string, unknown> }).shape));
+
+describe('emailTemplateDefinitionFromRow', () => {
+  it('answers the definition the row carries, in order, with no state or provenance column', () => {
+    expect(emailTemplateDefinitionFromRow(storedRow)).toStrictEqual({
+      name: 'crm.welcome',
+      label: 'Welcome',
+      locale: 'zh-CN',
+      subject: 'Welcome, {{user.name}}',
+      bodyHtml: '<p>Hello {{user.name}}</p>',
+      bodyText: 'Hello {{user.name}}',
+      variables: [{ name: 'user.name', type: 'string', required: true }],
+      fromOverride: { name: 'Acme Support', address: 'support@acme.test' },
+      replyTo: 'help@acme.test',
+      active: false,
+      description: 'Sent on sign-up',
+    });
+  });
+
+  it('answers a body the email_template schema accepts whole, with no key the schema does not declare', () => {
+    const body = emailTemplateDefinitionFromRow(storedRow);
+    const keys = schemaKeys();
+    expect(Object.keys(body).filter((k) => !keys.has(k))).toEqual([]);
+    expect(EmailTemplateDefinitionSchema.safeParse(body).success).toBe(true);
+  });
+
+  it('falls back for the sparse row: label to name, locale to en-US, bodies to empty, active to true', () => {
+    const body = emailTemplateDefinitionFromRow({
+      name: 'auth.reset',
+      label: '',
+      locale: null,
+      subject: null,
+      body_html: null,
+      body_text: '',
+      from_name: 'Nobody',
+      from_address: '',
+      reply_to: null,
+      variables_json: 'not json',
+      description: null,
+    });
+    expect(body).toStrictEqual({
+      name: 'auth.reset',
+      label: 'auth.reset',
+      locale: 'en-US',
+      subject: '',
+      bodyHtml: '',
+      variables: [],
+      active: true,
+    });
+    expect(EmailTemplateDefinitionSchema.safeParse(body).success).toBe(true);
+  });
+
+  it('reads active the way the stored spellings mean it, and variables already parsed', () => {
+    for (const off of [false, 0, '0', 'false']) {
+      expect(emailTemplateDefinitionFromRow({ name: 'a', active: off }).active).toBe(false);
+    }
+    for (const on of [true, 1, '1', 'true', undefined, null]) {
+      expect(emailTemplateDefinitionFromRow({ name: 'a', active: on }).active).toBe(true);
+    }
+    expect(emailTemplateDefinitionFromRow({ name: 'a', variables_json: [{ name: 'x' }] }).variables).toEqual([{ name: 'x' }]);
+    expect(emailTemplateDefinitionFromRow({ name: 'a', variables_json: '{"name":"x"}' }).variables).toEqual([]);
+  });
+
+  it('is deterministic: the same row answers the same serialization', () => {
+    expect(JSON.stringify(emailTemplateDefinitionFromRow({ ...storedRow }))).toBe(
+      JSON.stringify(emailTemplateDefinitionFromRow(storedRow)),
+    );
+  });
+});
@@ -0,0 +1,106 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0131 D6/D10, ruling C on §6 Q1] A `sys_email_template` row, turned into
+ * the `email_template` DEFINITION it carries.
+ *
+ * Templates resolve from the registry (`email_template` metadata); the rows are
+ * no longer read on the send path. A row an organization customized before
+ * that door closed is the one copy of the customer's edit, and ruling C
+ * promotes it to an environment template before the row is deleted. The
+ * upgrade ceremony (`os migrate`, C7b) reads the row, calls this function and
+ * saves the answer through the metadata door. ⛔ Never at boot.
+ *
+ * The function is pure: one row in, one body out — no engine, no I/O, and no
+ * import, so the lean entry carries it as it stands. The mapping is the
+ * inverse of the row shape the retired projector wrote, which is also the
+ * render input the email service reads (`EmailTemplateRow`):
+ *
+ *  - `name` → `name`; `label` → `label`, falling back to the name when the
+ *    column is empty or absent;
+ *  - `locale` → `locale`, falling back to `en-US` (the schema's default and
+ *    the bundle floor) when empty or absent;
+ *  - `subject` → `subject` and `body_html` → `bodyHtml`, each `''` when empty
+ *    or absent (both are required strings);
+ *  - `body_text` → `bodyText`, `reply_to` → `replyTo` and `description` →
+ *    `description`, each only when a non-empty string;
+ *  - `from_address` → `fromOverride.address`, with `from_name` →
+ *    `fromOverride.name` when non-empty; no `fromOverride` without an address;
+ *  - `variables_json` → `variables` when it is JSON text (or an already
+ *    parsed value) holding an array, else `[]`;
+ *  - `active` → `active`: `false` for a stored `false`, `0`, `'0'` or
+ *    `'false'`, `true` for anything else, an absent column included (the
+ *    schema's default).
+ *
+ * The retired keys (`category`, `is_system`) and every state or provenance
+ * column (`managed_by`, `customized`, `organization_id`, the timestamps) are
+ * not a definition and never travel into one.
+ *
+ * ⛔ It is not validation. A name outside the schema's dotted snake_case still
+ * answers a body; the metadata door refuses it, and reporting that refusal is
+ * the ceremony's.
+ */
+
+/**
+ * One `sys_email_template` row, as the mapping reads it. Every other column a
+ * row carries is accepted and ignored.
+ */
+export interface EmailTemplateRowForDefinition {
+  readonly name?: unknown;
+  readonly label?: unknown;
+  readonly locale?: unknown;
+  readonly description?: unknown;
+  readonly subject?: unknown;
+  readonly body_html?: unknown;
+  readonly body_text?: unknown;
+  readonly from_name?: unknown;
+  readonly from_address?: unknown;
+  readonly reply_to?: unknown;
+  readonly active?: unknown;
+  readonly variables_json?: unknown;
+  readonly [column: string]: unknown;
+}
+
+const filled = (value: unknown): string | undefined =>
+  typeof value === 'string' && value !== '' ? value : undefined;
+
+const variablesOf = (value: unknown): unknown[] => {
+  let parsed = value;
+  if (typeof value === 'string') {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return [];
+    }
+  }
+  return Array.isArray(parsed) ? parsed : [];
+};
+
+/**
+ * The `email_template` definition one `sys_email_template` row carries (module
+ * doc). Deterministic: the same row answers the same body, key for key and in
+ * the same key order.
+ */
+export function emailTemplateDefinitionFromRow(row: EmailTemplateRowForDefinition): Record<string, unknown> {
+  const body: Record<string, unknown> = {
+    name: row.name,
+    label: filled(row.label) ?? row.name,
+    locale: filled(row.locale) ?? 'en-US',
+    subject: filled(row.subject) ?? '',
+    bodyHtml: filled(row.body_html) ?? '',
+  };
+  const bodyText = filled(row.body_text);
+  if (bodyText !== undefined) body.bodyText = bodyText;
+  body.variables = variablesOf(row.variables_json);
+  const address = filled(row.from_address);
+  if (address !== undefined) {
+    const name = filled(row.from_name);
+    body.fromOverride = name === undefined ? { address } : { name, address };
+  }
+  const replyTo = filled(row.reply_to);
+  if (replyTo !== undefined) body.replyTo = replyTo;
+  body.active = !(row.active === false || row.active === 0 || row.active === '0' || row.active === 'false');
+  const description = filled(row.description);
+  if (description !== undefined) body.description = description;
+  return body;
+}
@@ -290,6 +290,10 @@ export {
   positionDefinitionFromRow,
   type PositionRowForDefinition,
 } from './position-row-definition.js';
+export {
+  emailTemplateDefinitionFromRow,
+  type EmailTemplateRowForDefinition,
+} from './email-template-row-definition.js';
 
 // [commit f8eb73601] The measured read surface of the administrator derivation — the
 // single source `plugin-auth`'s break-glass standing-key lists correspond to.