docs(email): record composer evidence

docs/audits/evidence/mail-001/README.md

@@ -3,7 +3,7 @@
 Updated: 2026-08-10
 
 - Progress report: `docs/verification/mail-001-job-email-hub.md`
-- Commands/results: `docs/audits/verification-log.md` V-126–V-134
+- Commands/results: `docs/audits/verification-log.md` V-126–V-135
 - Hub/legacy-route tests: `job-tracker-ui/src/correspondence-inbox-page.test.tsx`
 - Reused review decision tests: `job-tracker-ui/src/gmail-review-page.test.tsx`
 - Provider-neutral API tests: `JobTrackerApi.Tests/EmailControllerTests.cs`
@@ -11,5 +11,6 @@ Updated: 2026-08-10
 - Send-ledger tests: `JobTrackerApi.Tests/EmailSendAttemptStoreTests.cs`
 - Delivery adapter tests: `JobTrackerApi.Tests/EmailProviderDeliveryTests.cs`
 - Explicit-send/tenant/idempotency tests: `JobTrackerApi.Tests/EmailSendControllerTests.cs`
-- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`
+- Confirmed composer tests: `job-tracker-ui/src/correspondence-inbox-page.test.tsx`
+- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`
 - Mocked provider data only; no real email, provider connection, private content, production service or external request was used.

docs/audits/verification-log.md

@@ -166,3 +166,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-132 | `EmailSendAttemptStoreTests`; backend build/full tests; `dotnet ef migrations has-pending-model-changes`; SQLite/MariaDB up/down scripts; disposable SQLite upgrade/insert/rollback; cleanup verification | Repository root | Verify inert tenant send ledger, idempotency/state safety, additive provider migration and rollback | PASS — focused 3/3; backend 608/608; model current; bounded provider SQL; SQLite unique index/FK/sample row/rollback pass; temp files removed | First MariaDB script exposed SQLite-scaffolded types and was rejected; explicit provider branch corrected it. One parallel test/build attempt contended on compiler output; serial test passed. MariaDB SQL generated only, not executed | Provider/runtime limitation and corrected verification setup |
 | V-133 | Focused delivery/provider/controller tests; full backend; focused inbox Jest; frontend production build; `git diff --check` | Repository root / `job-tracker-ui` | Verify explicit consent scopes, capability reporting, Gmail/Graph payloads, IMAP read-only, rejected/reauth/uncertain classification and regressions | PASS — focused backend 18/18; full backend 613/613; inbox 5/5; production build and patch check pass | Ephemeral encrypted tokens, synthetic recipients/content and mocked HTTP only. No OAuth/provider/email call or real account. Browser/production not run | External provider/production limitation |
 | V-134 | Focused `EmailSendControllerTests|EmailSendAttemptStoreTests|EmailControllerTests`; full backend; staged diff/secret-name/whitespace review | Repository root | Verify explicit confirmation, bounded input, owner isolation, canonical idempotency, rate-limited provider admission, correspondence/audit transaction and failed/uncertain behavior | PASS — focused 12/12; full backend 619/619; no whitespace errors or secret values. Provider called once across duplicate requests; cross-tenant/unconfirmed/malformed requests never reserve or deliver | SQLite and fake provider only. No real provider/email/network/browser/production execution. Crash-abandoned `sending` reconciliation remains | External provider/runtime limitation |
+| V-135 | Focused correspondence-inbox Jest; full frontend Jest; `npm.cmd run build`; `git diff --check` | `job-tracker-ui` / repository root | Verify editable provider-bound reply, visible review fields, confirmation/cancel, one UUID, sent/uncertain duplicate safety, responsive TypeScript/build and regression hygiene | PASS — focused 7/7; full 49/49 suites and 190/190 tests; production build; no whitespace errors | JSDOM and mocked API/provider data only; no running browser/provider/email. Full Jest took 75.632s and retained the existing force-exit/open-handle notice | Browser/provider/production limitation |

docs/verification/mail-001-job-email-hub.md

@@ -2,7 +2,7 @@
 
 Updated: 2026-08-10
 
-Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads and the explicit-confirmed send API are implemented and locally verified; the editable UI and remaining provider actions remain.
+Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-confirmed send API and editable reply UI are implemented and locally verified; recovery, legacy-send and remaining provider actions remain.
 
 ## Revalidated current boundaries
 
@@ -68,16 +68,26 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads and the exp
 
 - Focused delivery/provider/capability: 18/18; send ledger: 3/3; provider/correspondence controllers: 5/5; hub detail: 5/5.
 - Explicit-send controller/store/read focused tests: 12/12.
-- Full backend: 619/619; full frontend: 49/49 suites, 188/188 tests.
+- Confirmed composer focused tests: 7/7.
+- Full backend: 619/619; full frontend: 49/49 suites, 190/190 tests.
 - Production build/TypeScript and `git diff --check`: pass.
-- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`.
+- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`.
+
+## Implemented editable composer increment
+
+- Provider-backed message detail offers Reply only when that exact connected provider has send consent. Read-only connections show an explicit reconnect requirement; manual correspondence is not mislabeled as provider-send capable.
+- Recipient, subject, thread, provider/from account and body remain visible before sending. Recipient, subject and body remain editable; the provider and provider thread remain fixed to avoid cross-provider thread claims.
+- The app-owned confirmation dialog identifies provider/from address, recipient, subject and thread. Cancelling leaves the draft intact and invokes no API.
+- One UUID remains stable through pre-send edits. A failed attempt requires an explicit new attempt; an uncertain/pending/sending result disables retry and tells the user to inspect the provider Sent folder.
+- A network/unknown server interruption is treated as uncertain on the client. Successful sends refresh the same correspondence domain; no second copy or autonomous AI/send path was added.
+- Draft state is in-memory for this increment. Navigation within the hub preserves it, but refresh persistence and compose-new-message flow remain separate work.
 
 ## Remaining MAIL-001 work
 
 - Extend shared provider-neutral thread navigation and application embedding while preserving provider capability differences.
 - Surface provider identity, reauthorization, read/unread, pin/read-later/archive/spam/trash only where the provider supports it.
 - Share thread detail and link/unlink actions between hub and job workspace.
-- Add editable provider drafts with recipient/subject/thread/provider review and a final confirmation dialog; reuse one client UUID per reviewed draft and show uncertain results without blind retry.
+- Add durable draft/refresh recovery and compose-new-message behavior if confirmed by the remaining workflow inventory; replies are implemented.
 - Reconcile abandoned `sending` attempts to an explicit uncertain/manual-review state after process failure; never auto-resend them.
 - Include non-sensitive send-attempt metadata in user export and verify account/job deletion coverage before production rollout.
 - Preserve minimal audit metadata without sensitive body logging; verify Free non-AI access and Pro-only AI assistance.

docs/work-programmes/decisions.md

@@ -429,3 +429,13 @@
 - **Consequences:** a successful provider call with failed local persistence is intentionally uncertain and requires manual reconciliation. A process stop after admission can leave a `sending` row; a later repository increment must age it into an explicit uncertain/manual-review state without redelivery. Existing read-only connections cannot send until re-consented.
 - **User approval required:** No; MAIL-001 explicitly authorizes local implementation and fake verification. Real provider consent/send remains gated.
 - **Reversible:** Yes. Disable admission/UI, then revert `123fc55`. No schema rollback is needed for this route-only increment.
+
+## DEC-044 — Replies remain bound to their provider thread
+
+- **Date:** 2026-08-10
+- **Decision:** Offer an editable reply only for a message whose exact provider connection currently has send consent. Keep provider/from identity and thread read-only while allowing recipient, subject and body edits; require the shared app-owned confirmation before POST. Treat client/network ambiguity as uncertain and expose no retry action.
+- **Reason/evidence:** a Gmail thread ID has no valid Graph meaning, and silently switching providers would misrepresent reply semantics. Mocked UI tests prove cancel invokes no API, the visible reviewed fields match the request, the UUID is stable for the attempt, and uncertainty disables resend.
+- **Alternatives considered:** allow cross-provider thread switching; use browser `confirm`; hide recipient/thread; auto-retry network failures; enable manual correspondence through application SMTP; add a new draft framework before proving the flow. These weaken provenance, accessibility, consent or duplicate safety.
+- **Consequences:** read-only connections require explicit reconnect consent. This increment supports replies, not durable refresh recovery or a new-message composer; those remain tracked rather than being implied. Basic email remains ungated by Pro and no AI path can send.
+- **User approval required:** No; this is synthetic local MAIL-001 implementation. Real provider/email verification remains gated.
+- **Reversible:** Yes. Revert `449faeb`; API, ledger, scopes and saved correspondence remain unchanged.

docs/work-programmes/master-progress.md

@@ -2,8 +2,8 @@
 
 Updated: 2026-08-10
 
-- **Overall programme status:** Active. Six packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with six implementation increments.
-- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); routing/reads/detail, durable ledger, Gmail/Graph delivery/re-consent and the explicit-confirmed tenant-safe send API are committed. Editable hub send UI and abandoned-attempt reconciliation remain.
+- **Overall programme status:** Active. Six packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with seven implementation increments.
+- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); routing/reads/detail, ledger, Gmail/Graph delivery/re-consent, tenant-safe send API and confirmed editable reply UI are committed. Abandoned-attempt reconciliation, legacy-send retirement and remaining hub actions remain.
 - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
 - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001 and PROD-002 (`VERIFIED LOCALLY`).
 - **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002, QA-001, CAREER-001 and CAREER-002 (`IMPLEMENTED — NOT VERIFIED`). CAREER-002 now protects unsaved edits and provides tested structured custom-entry, profile-override and preview-error interactions; all automated/build gates pass.
@@ -12,7 +12,7 @@ Updated: 2026-08-10
 - **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.
 - **Next five work packages:** MAIL-001 consolidated email experience; JOBS-001 job-search/application redesign; HOME-001 homepage/Pro promotion; UX-003 authentication/profile polish; PRODUCT-001 homepage/Pro claims. SEC-006/007 resume after package-index permission.
 - **Status counts:** 6 `VERIFIED LOCALLY`; 19 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 8 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
-- **Test status:** backend 619/619; frontend 49/49 suites and 188/188 tests; MAIL-001 send/read/store focused 12/12, delivery/capability 18/18, provider/correspondence 5/5 and hub detail 5/5; migration rehearsal and production build pass. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131.
+- **Test status:** backend 619/619; frontend 49/49 suites and 190/190 tests; MAIL-001 composer 7/7, send/read/store focused 12/12, delivery/capability 18/18, provider/correspondence 5/5 and hub detail 5/5; migration rehearsal and production build pass. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131/V-135.
 - **Deployment status:** No deployment performed. No production migrations were run. AI operation worker remains disabled by default.
 - **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred.
 - **Known regressions:** None found by automated suites. Jest still needs `--forceExit` and reports its existing open-handle notice. Email-provider/send tests are fake/local only; real delivery is not claimed. A process stop after ledger admission can leave `sending` for later reconciliation, but duplicate delivery remains fail-closed. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap.

docs/work-programmes/master-work-plan.md

@@ -651,9 +651,9 @@ Ordering differences from the suggested list:
 - **Required production verification:** provider read/draft/send requires explicit authorized synthetic account; never real unsolicited email.
 - **Status:** `IN PROGRESS`.
 - **Blocker:** real provider verification external; mocked/local implementation not blocked after dependencies.
-- **Evidence:** `docs/verification/mail-001-job-email-hub.md`; V-126–V-134. Send/read/store focused 12/12; delivery/capability 18/18; provider/correspondence 5/5; hub detail 5/5; backend 619/619; frontend 49/49 suites and 188/188 tests plus build.
-- **Commit:** `6008b4a` (hub), `536d403` (neutral reads), `a20775c` (safe detail), `653f011` (ledger), `e9937ac` (Gmail/Graph delivery adapters and consent), `123fc55` (explicit-confirmed send API).
-- **Remaining work:** editable confirmed UI; abandoned-sending reconciliation; export/deletion coverage; shared thread/application actions; free/pro and browser/production verification. Existing connections need explicit re-consent; IMAP remains read-only. Legacy follow-up SMTP must be retired or routed through the same safety boundary before MAIL-001 completion. No real email; uncertain sends need manual reconciliation.
+- **Evidence:** `docs/verification/mail-001-job-email-hub.md`; V-126–V-135. Composer 7/7; send/read/store focused 12/12; delivery/capability 18/18; provider/correspondence 5/5; hub detail 5/5; backend 619/619; frontend 49/49 suites and 190/190 tests plus build.
+- **Commit:** `6008b4a` (hub), `536d403` (neutral reads), `a20775c` (safe detail), `653f011` (ledger), `e9937ac` (Gmail/Graph delivery adapters and consent), `123fc55` (explicit-confirmed send API), `449faeb` (confirmed reply composer).
+- **Remaining work:** abandoned-sending reconciliation; legacy follow-up SMTP retirement; export/deletion coverage; durable/new-message drafts; shared thread/application actions and category capabilities; free/pro and browser/production verification. Existing connections need explicit re-consent; IMAP remains read-only. No real email; uncertain sends need manual reconciliation.
 
 ### JOBS-001 — Job-search source and assessment redesign
 

docs/work-programmes/session-handoff.md

@@ -2,17 +2,17 @@
 
 Updated: 2026-08-10
 
-- **Exact current task:** MAIL-001 — add the editable Job email send UI over the explicit-confirmed API, without invoking a real provider, then address abandoned-attempt and legacy-send boundaries.
-- **Last completed step:** tenant-owned, UUID-idempotent, rate-limited explicit send admission and transactional correspondence/audit persistence were committed as `123fc55`; focused tests prove confirmation, validation, isolation, duplicate suppression and failed/uncertain handling.
+- **Exact current task:** MAIL-001 — reconcile crash-abandoned sending attempts without redelivery, then retire or route the legacy follow-up SMTP boundary through the safe provider-send path.
+- **Last completed step:** the provider-bound editable reply composer and app-owned confirmation flow were committed as `449faeb`; cancellation preserves the draft, one UUID is used per attempt, and uncertain results cannot retry.
 - **Files currently modified:** MAIL-001 verification/log/master tracking documents only. Application code/tests are committed.
-- **Commands already run:** complete provider/send trace; read/detail/ledger/delivery/send focused tests; full backend; TypeScript build; EF provider migration rehearsal; six implementation commits. See V-126–V-134.
-- **Test results:** MAIL-001 send/read/store 12/12, delivery/capability 18/18, provider/correspondence 5/5, hub detail 5/5; backend 619/619; frontend 49/49 suites and 188/188 tests; migration/model/build gates pass.
+- **Commands already run:** complete provider/send trace; read/detail/ledger/delivery/send/composer focused tests; full backend/frontend; TypeScript build; EF provider migration rehearsal; seven implementation commits. See V-126–V-135.
+- **Test results:** MAIL-001 composer 7/7, send/read/store 12/12, delivery/capability 18/18, provider/correspondence 5/5, hub detail 5/5; backend 619/619; frontend 49/49 suites and 190/190 tests; migration/model/build gates pass.
 - **Services currently running:** none started intentionally. Exact task-owned hung Jest/build Node processes were stopped; Codex browser runtimes were not touched. Pre-existing Docker services were not changed.
 - **Temporary files or processes:** none. No provider account, private email, external model, paid service or production service was accessed.
 - **Production changes currently active:** none. No deployment, migration, provider connection/sync/send or production payload occurred.
-- **Rollback status:** keep admission/UI disabled, revert `123fc55`, then `e9937ac`; downgrade `20260809195014_AddEmailSendAttempts` before reverting `653f011`. Earlier MAIL commits remain independently reversible. No production migration/deploy/provider grant occurred.
+- **Rollback status:** revert `449faeb` to remove the composer, keep admission disabled, then revert `123fc55` and `e9937ac`; downgrade `20260809195014_AddEmailSendAttempts` before reverting `653f011`. No production migration/deploy/provider grant occurred.
 - **Uncommitted changes:** MAIL-001 evidence/tracking documents only; commit/push before the next application increment.
-- **Known failures:** editable send UI, abandoned `sending` reconciliation, export coverage, full thread actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. Legacy follow-up SMTP bypasses the new boundary. Real provider/SMTP/MariaDB/production unavailable; Jest open handles; SEC-006 needs internet/package-index permission; parser isolation remains SEC-007.
-- **Exact next action:** commit/push this evidence, then add a minimal editable hub composer that displays provider/to/subject/thread/body, regenerates its UUID whenever reviewed content changes after an attempt, requires a final confirmation dialog, and never retries an uncertain result.
+- **Known failures:** abandoned `sending` reconciliation, durable/new-message drafts, export coverage, full thread/category actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. Legacy follow-up SMTP bypasses the new boundary. Browser/provider/MariaDB/production unavailable or unverified; Jest open handles; SEC-006 needs internet/package-index permission; parser isolation remains SEC-007.
+- **Exact next action:** commit/push this evidence, then add a bounded stale-attempt reconciliation path that marks old `sending` attempts uncertain without provider I/O or retry, with restart/tenant tests and operator-visible status.
 - **Work that can continue independently:** remaining MAIL-001 repository work and later UX packages. SEC-006/007 await package-index permission; PROD-001/003/004 await production access.
 - **Decisions still required from the user:** none for synthetic/code-inspected repository work. Any provider connection or send test, internet/package upgrades, private data, external/paid providers and production actions retain explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.