Mail one confirmation link for the caller's account.

The checks run in a fixed order: email:bind (403), the address shape (400), then under the users row lock the account's verified email (409), the account's 60-second window (429), and then, under the address lock, the address's two caps (429). A new link deletes the account's unconsumed email_bind rows, so one link at a time works. Every refusal precedes the write, so the closure can raise.

The scope gate sits here and not on the confirmation, because this is the route that chooses the address. A bound address is what a Google sign-in matches on, so it opens a console session carrying billing:write and console:session. The scope keeps that out of reach of every bearer that did not come from a key: POST /ssh-keys refuses to register the key that mints it for an address-less account unless the caller holds the scope already, the boundary design/AUTH.md states.