EPIC-KEYS-001A T2 — counts-only preview of the custody-notice cohort

Report how many owners the custody notice would reach. Counts ONLY.

Every value in this response is an integer, a boolean, or the notice's content hash. No email address, user id, agent id, team id, or any value derived from credential material can appear here — that is the presence-only contract the T1 security review's D1 finding requires (an ungated bit that distinguished this exact cohort was treated as a credential-presence oracle; an admin JSON body listing them would be the same oracle behind a thinner wall).

retired_agent_count is the notice cohort: holds stored provider ciphertext AND had execution frozen by T1. credential_presence_agent_count is the superset that merely holds ciphertext — the difference is endpoint-rescued rows whose owner still has a credential to revoke but whose runs were never suspended. They are out of scope for this notice (the copy leads with "execution is suspended") and belong to the T5 inventory lane; the delta is reported so the operator sees the gap rather than assuming full coverage.

delivery_configured is the diagnostic that keeps the multi-hop env pipeline debuggable without SSH: flag on but no Resend key means the POST will 503, and the operator learns it here rather than from a failed send.

Authorization: - Anonymous → 401 (auth dep on require_admin). - Authenticated non-admin → 403 (require_admin). - Admin → 200.

Flag gates (rule #4): 404 when ADMIN_DASHBOARD_ENABLED is off, 404 when PROVIDER_CUSTODY_NOTICE_ENABLED is off.