docs(email): record draft identity evidence

2026-08-10 10:12:01 +02:00
parent 80b5532c2f
commit 050b99ca36
6 changed files with 20 additions and 7 deletions
@@ -158,6 +158,8 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-c
 - Updates and deletes require the caller's current revision and execute atomically; stale writes return a reload conflict rather than silently overwriting newer content.
 - Real-SQLite tests cover foreign job creation, direct foreign IDs, foreign list/update/delete attempts, stale updates/deletes and preservation of the other tenant. Focused 4/4, backend 629/629 and build pass.
 - Saving a draft never calls a provider or send path. Delivery still requires the separate connected/send-capable, explicit-confirmed, idempotent API.
+- Every created draft now owns a canonical client-request UUID that survives edits and refresh and is included in the user export. This prevents a restored draft from silently obtaining a fresh ledger identity and bypassing duplicate-send protection.
+- The API can list all drafts for the authenticated owner to support refresh recovery; foreign drafts remain absent under both explicit owner predicates and the global filter.

 ## Remaining MAIL-001 work