docs(email): record recovery evidence

docs/verification/mail-001-job-email-hub.md

@@ -69,9 +69,9 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-c
 - Focused delivery/provider/capability: 18/18; send ledger: 3/3; provider/correspondence controllers: 5/5; hub detail: 5/5.
 - Explicit-send controller/store/read focused tests: 12/12.
 - Confirmed composer focused tests: 7/7.
-- Full backend: 619/619; full frontend: 49/49 suites, 190/190 tests.
+- Full backend: 620/620; full frontend: 49/49 suites, 190/190 tests.
 - Production build/TypeScript and `git diff --check`: pass.
-- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`.
+- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`, `ee5ef7e`.
 
 ## Implemented editable composer increment
 
@@ -82,13 +82,20 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-c
 - A network/unknown server interruption is treated as uncertain on the client. Successful sends refresh the same correspondence domain; no second copy or autonomous AI/send path was added.
 - Draft state is in-memory for this increment. Navigation within the hub preserves it, but refresh persistence and compose-new-message flow remain separate work.
 
+## Implemented interrupted-send recovery increment
+
+- A safety worker starts only after database readiness and checks every five minutes. It has no email-provider, SMTP or message-content dependency.
+- Attempts still pending after 15 minutes are definitively failed as stopped before provider delivery. Attempts still sending after 15 minutes become uncertain; neither state is queued or retried.
+- Recovery uses conditional updates inside the local database transaction, so overlapping replicas can observe the same candidate but only one changes it and creates the notification.
+- Each affected owner receives one generic, content-free notification linked to Job email. The notification never contains provider, recipient, subject or body.
+- A real-SQLite two-owner clock/restart test proves stale/fresh separation, owner-visible notifications, repeat-run idempotency and no transition back to pending/sending.
+
 ## Remaining MAIL-001 work
 
 - Extend shared provider-neutral thread navigation and application embedding while preserving provider capability differences.
 - Surface provider identity, reauthorization, read/unread, pin/read-later/archive/spam/trash only where the provider supports it.
 - Share thread detail and link/unlink actions between hub and job workspace.
 - Add durable draft/refresh recovery and compose-new-message behavior if confirmed by the remaining workflow inventory; replies are implemented.
-- Reconcile abandoned `sending` attempts to an explicit uncertain/manual-review state after process failure; never auto-resend them.
 - Include non-sensitive send-attempt metadata in user export and verify account/job deletion coverage before production rollout.
 - Preserve minimal audit metadata without sensitive body logging; verify Free non-AI access and Pro-only AI assistance.
 - Complete link/unlink/dismiss/draft/send/failure/two-user/application-embed tests plus browser/production provider gates. No real email may be sent during repository verification.
@@ -99,4 +106,4 @@ The first focused Jest invocation exhibited the repository's open-handle delay.
 
 ## Rollback
 
-Disable the UI/admission path before rollback. Revert `123fc55` to remove the send route, then `e9937ac` for send consent/adapters and `653f011` (after migration downgrade) for the ledger, followed by earlier read/routing commits. Existing provider grants are not revoked by a code rollback; disconnect/reconnect is an explicit user action.
+Revert `ee5ef7e` to stop recovery and `449faeb` to remove the composer, then disable admission. Revert `123fc55` to remove the send route, `e9937ac` for send consent/adapters and `653f011` (after migration downgrade) for the ledger, followed by earlier read/routing commits. Existing provider grants are not revoked by a code rollback; disconnect/reconnect is an explicit user action.