docs(email): record message detail evidence

docs/work-programmes/decisions.md

@@ -389,3 +389,13 @@
 - **Consequences:** the hub can truthfully identify connected Gmail/Outlook/IMAP accounts and a shared API exists for later UI composition. Provider-native state changes and send remain unavailable and must be introduced with capability flags, re-consent and delivery-state tests. Message detail returns plain text only.
 - **User approval required:** No; this is a local, fake-tested repository increment within MAIL-001 and invokes no provider or email service.
 - **Reversible:** Yes. Revert `536d403`; no schema, dependency, OAuth scope, provider token or persisted message changes.
+
+## DEC-040 — Message detail is plain text with an explicit saved-copy fallback
+
+- **Date:** 2026-08-09
+- **Decision:** Fetch live detail through the neutral provider endpoint when a row has a provider/message ID, but render only plain text. If provider access fails, warn and fetch the tenant-scoped persisted correspondence copy. Manual entries use the persisted path directly.
+- **Reason/evidence:** imported correspondence remains useful after token expiry or provider outage, while returning/rendering provider HTML would widen the untrusted-content surface. The existing correspondence row is already the local job record and needs no duplicate store.
+- **Alternatives considered:** render provider HTML; fail the whole view when reauthorization is required; silently fall back; include full message bodies in every inbox list response; add a message-cache table. These increase XSS/payload/state risk, hide stale provenance or duplicate existing data.
+- **Consequences:** users can distinguish live and saved content availability, malformed legacy metadata cannot break detail, and late responses cannot populate another selected row. The saved copy may be stale and is labeled as such when live access fails.
+- **User approval required:** No; this is local read-only behavior with synthetic/mocked tests and no provider invocation.
+- **Reversible:** Yes. Revert `a20775c`; no schema, dependency, provider scope or persisted data changes.

docs/work-programmes/master-progress.md

@@ -2,8 +2,8 @@
 
 Updated: 2026-08-09
 
-- **Overall programme status:** Active. Six packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with two pushed increments.
-- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); canonical routing and an owner-scoped provider-neutral read API/status are pushed. Shared detail consumption and a safe provider-send ledger remain.
+- **Overall programme status:** Active. Six packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with three pushed increments.
+- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); canonical routing, neutral read status/API and safe plain-text message detail with saved fallback are pushed. A safe provider-send ledger remains.
 - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
 - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001 and PROD-002 (`VERIFIED LOCALLY`).
 - **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002, QA-001, CAREER-001 and CAREER-002 (`IMPLEMENTED — NOT VERIFIED`). CAREER-002 now protects unsaved edits and provides tested structured custom-entry, profile-override and preview-error interactions; all automated/build gates pass.
@@ -12,7 +12,7 @@ Updated: 2026-08-09
 - **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.
 - **Next five work packages:** MAIL-001 consolidated email experience; JOBS-001 job-search/application redesign; HOME-001 homepage/Pro promotion; UX-003 authentication/profile polish; PRODUCT-001 homepage/Pro claims. SEC-006/007 resume after package-index permission.
 - **Status counts:** 6 `VERIFIED LOCALLY`; 19 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 8 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
-- **Test status:** backend 604/604; frontend 49/49 suites and 186/186 tests; MAIL-001 provider controller 3/3 and hub/review 5/5; CAREER-002 focused 17/17 and CAREER-001 16/16; production build and patch check pass. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130.
+- **Test status:** backend 605/605; frontend 49/49 suites and 188/188 tests; MAIL-001 provider/correspondence 5/5 and hub detail 5/5; CAREER-002 focused 17/17 and CAREER-001 16/16; production build and patch check pass. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131.
 - **Deployment status:** No deployment performed. No production migrations were run. AI operation worker remains disabled by default.
 - **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred.
 - **Known regressions:** None found by automated suites. Jest still needs `--forceExit` and reports its existing open-handle notice. Email-provider tests are fake/local only; no send capability is claimed. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap.

docs/work-programmes/master-work-plan.md

@@ -651,9 +651,9 @@ Ordering differences from the suggested list:
 - **Required production verification:** provider read/draft/send requires explicit authorized synthetic account; never real unsolicited email.
 - **Status:** `IN PROGRESS`.
 - **Blocker:** real provider verification external; mocked/local implementation not blocked after dependencies.
-- **Evidence:** `docs/verification/mail-001-job-email-hub.md`; V-126–V-130. Canonical hub/review passes 5/5 focused; provider-neutral controller 3/3; backend 604/604; frontend 49/49 suites and 186/186 tests plus build.
-- **Commit:** `6008b4a` (canonical hub) and `536d403` (provider-neutral owner-scoped read API/status).
-- **Remaining work:** consume shared thread/detail in hub/application views; reauth/capability actions; editable explicit/idempotent provider draft/send and audit; tenant/free/pro/application tests; browser/production. Existing provider scopes are read-only and legacy follow-up uses application SMTP; do not mislabel either. No real email; uncertain sends need manual reconciliation.
+- **Evidence:** `docs/verification/mail-001-job-email-hub.md`; V-126–V-131. Provider/correspondence focused 5/5; hub detail 5/5; backend 605/605; frontend 49/49 suites and 188/188 tests plus build.
+- **Commit:** `6008b4a` (canonical hub), `536d403` (neutral read API/status), `a20775c` (plain-text detail and saved fallback).
+- **Remaining work:** extend shared thread navigation/application embedding; reauth/capability actions; editable explicit/idempotent provider draft/send and audit; tenant/free/pro/application tests; browser/production. Existing provider scopes are read-only and legacy follow-up uses application SMTP; do not mislabel either. No real email; uncertain sends need manual reconciliation.
 
 ### JOBS-001 — Job-search source and assessment redesign
 

docs/work-programmes/session-handoff.md

@@ -2,17 +2,17 @@
 
 Updated: 2026-08-09
 
-- **Exact current task:** MAIL-001 — consume the new neutral read API in shared thread/detail UI, then design the explicit provider-send/re-consent/idempotency/uncertain-delivery ledger without sending real email.
-- **Last completed step:** owner-scoped `/api/email` provider status/search/thread/plain-text detail and honest read-only hub status were committed/pushed as `536d403`; canonical hub routing remains `6008b4a`.
+- **Exact current task:** MAIL-001 — design the explicit provider-send/re-consent/idempotency/uncertain-delivery ledger without sending real email, then implement the smallest fake-tested contract slice.
+- **Last completed step:** plain-text live message detail, owner-scoped saved fallback, malformed-metadata tolerance and stale-request protection were committed/pushed as `a20775c`; neutral API/status is `536d403`, canonical routing `6008b4a`.
 - **Files currently modified:** MAIL-001 verification/log/master tracking documents only. Application code/tests are committed and pushed.
-- **Commands already run:** Phase 9/provider architecture and complete legacy send trace; provider/controller and hub focused tests; full backend/frontend; production build; diff/secret review; implementation commit/push. See V-126–V-130.
-- **Test results:** MAIL-001 provider controller 3/3; hub/review 5/5; backend 604/604; frontend 49/49 suites and 186/186 tests; production build/TypeScript and patch check pass. Full Jest required force exit and took 170.377s.
+- **Commands already run:** Phase 9/provider architecture and complete legacy send trace; provider/correspondence and hub-detail focused tests; full backend/frontend; production build; diff/secret review; three implementation commits/pushes. See V-126–V-131.
+- **Test results:** MAIL-001 provider/correspondence 5/5; hub detail 5/5; backend 605/605; frontend 49/49 suites and 188/188 tests; production build/TypeScript and patch check pass. Latest full Jest required force exit and took 81.434s.
 - **Services currently running:** none started intentionally. Exact task-owned hung Jest/build Node processes were stopped; Codex browser runtimes were not touched. Pre-existing Docker services were not changed.
 - **Temporary files or processes:** none. No provider account, private email, external model, paid service or production service was accessed.
 - **Production changes currently active:** none. No deployment, migration, provider connection/sync/send or production payload occurred.
-- **Rollback status:** revert `536d403` for neutral API/status and `6008b4a` for hub routing; no schema/config/dependency/data migration. CAREER rollback records remain current. Production is unchanged.
+- **Rollback status:** revert `a20775c` for message detail, `536d403` for neutral API/status and `6008b4a` for hub routing; no schema/config/dependency/data migration. CAREER rollback records remain current. Production is unchanged.
 - **Uncommitted changes:** MAIL-001 evidence/tracking documents only; commit/push before the next application increment.
-- **Known failures:** shared thread/detail UI, provider state actions and explicit idempotent send remain; Gmail is the only mature review UI; Gmail/Graph OAuth scopes and the IMAP contract are read-only; legacy follow-up uses application SMTP without explicit confirmation/idempotency and must not be called provider send. Real provider/SMTP/MariaDB/production unavailable; Jest open handles; SEC-006 needs internet/package-index permission; parser isolation remains SEC-007.
+- **Known failures:** full thread navigation, provider state actions and explicit idempotent send remain; Gmail is the only mature review UI; Gmail/Graph OAuth scopes and the IMAP contract are read-only; legacy follow-up uses application SMTP without explicit confirmation/idempotency and must not be called provider send. Real provider/SMTP/MariaDB/production unavailable; Jest open handles; SEC-006 needs internet/package-index permission; parser isolation remains SEC-007.
 - **Exact next action:** commit/push this evidence, then define the minimum provider-send contract and durable send-attempt states (confirmed, pending, sent, failed-before-delivery, uncertain) including OAuth scope/re-consent and duplicate-request behavior; implement only a fake-tested repository slice that cannot send real email.
 - **Work that can continue independently:** remaining MAIL-001 repository work and later UX packages. SEC-006/007 await package-index permission; PROD-001/003/004 await production access.
 - **Decisions still required from the user:** none for synthetic/code-inspected repository work. Any provider connection or send test, internet/package upgrades, private data, external/paid providers and production actions retain explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.