docs(email): record export lifecycle evidence

docs/verification/mail-001-job-email-hub.md

@@ -2,7 +2,7 @@
 
 Updated: 2026-08-10
 
-Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-confirmed send API, editable reply UI, interrupted-send recovery and legacy SMTP retirement are implemented and locally verified; remaining provider actions/export lifecycle remain.
+Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-confirmed send API, editable reply UI, interrupted-send recovery, legacy SMTP retirement and send-attempt export coverage are implemented and locally verified; remaining provider actions and full account-deletion lifecycle remain.
 
 ## Revalidated current boundaries
 
@@ -71,7 +71,7 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-c
 - Confirmed composer focused tests: 7/7.
 - Full backend: 620/620; full frontend: 49/49 suites, 190/190 tests.
 - Production build/TypeScript and `git diff --check`: pass.
-- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`, `ee5ef7e`, `8fe3903`.
+- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`, `ee5ef7e`, `8fe3903`, `aff34cc`.
 
 ## Implemented editable composer increment
 
@@ -98,13 +98,21 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-c
 - Scheduled reminder notification email remains on its separate worker path and was not removed or redirected.
 - Focused backend follow-up/worker tests pass 10/10; focused UI trust-loop tests pass 2/2. Full backend 621/621, frontend 190/190, build and audit gates pass across the combined working state.
 
+## Implemented send-attempt export/cascade increment
+
+- Encrypted on-demand backups and tenant-isolated daily JSON exports now include provider delivery history using one explicit content-free shape.
+- Exported attempt fields cover job/provider/request/status/provider-message/failure-category and timestamps. The internal payload hash is excluded; recipient, subject and body were never stored on the ledger.
+- Both queries stay inside the current owner filter and the owner's exported job IDs. Daily two-owner fixtures prove one isolated attempt per file and hashed filenames.
+- Real SQLite proves a hard delete of one owned job cascades only its send attempts and preserves another owner's job/attempt.
+- This does not implement complete account deletion. Identity-row deletion still lacks the cross-store/database/file lifecycle owned by SEC-009 and remains a release blocker.
+
 ## Remaining MAIL-001 work
 
 - Extend shared provider-neutral thread navigation and application embedding while preserving provider capability differences.
 - Surface provider identity, reauthorization, read/unread, pin/read-later/archive/spam/trash only where the provider supports it.
 - Share thread detail and link/unlink actions between hub and job workspace.
 - Add durable draft/refresh recovery and compose-new-message behavior if confirmed by the remaining workflow inventory; replies are implemented.
-- Include non-sensitive send-attempt metadata in user export and verify account/job deletion coverage before production rollout.
+- Complete account deletion coverage under SEC-009 before production rollout; job-level hard-delete cascade and export coverage are verified.
 - Preserve minimal audit metadata without sensitive body logging; verify Free non-AI access and Pro-only AI assistance.
 - Complete link/unlink/dismiss/draft/send/failure/two-user/application-embed tests plus browser/production provider gates. No real email may be sent during repository verification.