Alerts are emails from Sprwt's platform mailer to [email protected] (or the address Sprwt configures) plus any extra addresses in the Extra addresses alerted when AI access is detected setting. The subject is AI access blocked - - ref #N, prefixed with [LOCKED] when the admin was locked, and the body is an evidence pack (trigger, time, IP and network, user agent, account, pages, and any declaration). To keep alerts meaningful they are sent only when the admin surface is involved or a lock happens, and repeated requests from the same address, rule and surface within an hour are folded into one email. Honeypot hits alert only when a staff session was attached; storefront refusals and browser add-on findings are recorded in the log without email. The outcome of each alert (sent / failed) is stored on the attempt.