1 files changed, 28 insertions, 0 deletions
diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md
index 780cbf5..63ea52c 100644
--- a/docs/BACKLOG.md
+++ b/docs/BACKLOG.md
@@ -134,3 +134,31 @@ to name the field differently, the fix is one string and one test.
 a field an x-arf parser skips rather than acts on wrongly. Worth doing before
 the first real report is filed, so a desk running x-arf tooling gets what it
 expects.
+
+## 5. `report.build()` raises KeyError on an identity with no email
+
+**Observed.** `report.build(manifest, destination, identity)` reads
+`identity.get("name", "")` defensively but `identity["email"]` directly, so an
+identity carrying a name and no address raises `KeyError: 'email'` rather than
+saying what is missing. Reproduced through the public API against the real
+config reader: `config.load()` on a file whose `[reporter]` sets `name` and
+omits `email` returns `{"name": "A Reporter"}`, and that dict raises.
+
+**Cause.** Every key in `[reporter]` is independently optional, by the same
+skipped-answer-is-absent rule the rest of the config follows, but the report
+builder treats one of them as required without checking. Task 9 fixed the
+config half of this seam; the report half was not reachable from a config file
+until `init` grew the three prompts, and now it is: skipping the email
+question while answering the name produces exactly this shape.
+
+**Approach.** Refuse before building, not after: raise a named error saying no
+reply address is configured. Filling in an empty addr-spec instead would be
+worse, since a `From:` with no address produces a report that is sent and
+cannot be replied to, which defeats the reason the identity is disclosed at
+all. `init` now warns at the prompt when the address is skipped, so the
+remaining gap is a hand-edited config and the error message it deserves.
+
+**Constraints.** Belongs with the `report` subcommand rather than the builder
+alone, since where the check lives decides whether the user sees an exit code
+and a sentence or a traceback. Not a leak: the failure is loud and nothing is
+sent.