docs(email): record new-message evidence

docs/work-programmes/decisions.md

@@ -589,3 +589,13 @@
 - **Consequences:** definitively failed drafts can be reviewed and retried under a new ledger identity; all ambiguous or successful attempts remain non-retryable. Unsaved local drafts retain the existing explicit local new-attempt behavior because no durable ledger relationship exists yet.
 - **User approval required:** No; this is approved safety work with fake/local evidence and no email/provider call.
 - **Reversible:** Revert `29de263`; saved failed drafts then have no durable retry rotation and the UI should not offer that action.
+
+## DEC-060 — Reuse the reviewed draft boundary for new messages
+
+- **Date:** 2026-08-10
+- **Decision:** Compose new email starts only after selecting an owned recent job and a connected send-capable provider. It creates a local blank, threadless draft and reuses explicit Save draft plus Review and send; read-only/disconnected providers are not choices.
+- **Reason/evidence:** new messages need the same ownership, persistence, confirmation, idempotency and failure semantics as replies. The existing owner-filtered job list and provider capability endpoint provide those selection inputs without a second send implementation.
+- **Alternatives considered:** free-text job IDs; allow disconnected/read-only providers; bypass persistence; a second composer/send route; infer a provider. These expose authorization errors, promise unavailable delivery or duplicate safety logic.
+- **Consequences:** empty-job and missing-send-consent states explain why compose is unavailable. The hub currently lists the 100 most recent owned jobs; older jobs remain accessible from their job workspace and broader searchable selection is follow-up UX, not a hidden authorization bypass.
+- **User approval required:** No; local UI work uses mocked APIs and sends no message.
+- **Reversible:** Revert `b735963`; reply drafting and all server draft/send boundaries remain.