docs(email): record free access boundary

2026-08-10 09:49:30 +02:00
parent 7f41cb271c
commit ee8efd361d
6 changed files with 31 additions and 13 deletions
@@ -519,3 +519,13 @@
 - **Consequences:** users can distinguish connection state from send consent and know saved data remains available. Mailbox organization actions remain absent until a reviewed provider contract and re-consent path exist.
 - **User approval required:** No; this corrects local state communication and invokes no provider.
 - **Reversible:** Yes. Revert `f9e641c`; no API, schema, scope or stored state changes.
+
+## DEC-053 — Basic email stays Free; private drafts need a tenant-owned store
+
+- **Date:** 2026-08-10
+- **Decision:** Pin basic provider email to local authenticated access without a Pro policy. Do not persist private email content in browser storage or reuse recruiter-message/job draft fields for provider email recovery.
+- **Reason/evidence:** the current send route and hub have no entitlement gate, while all send safety checks remain. Repository inventory found no email-draft entity that owns provider/thread/recipient/subject/body/idempotency together; existing recruiter drafts are a different product domain.
+- **Alternatives considered:** add Pro to basic email; use localStorage/sessionStorage; overload `RecruiterMessageDraft`; claim in-memory replies are durable. These violate the product decision, expose content on shared browsers, conflate domains or overstate recovery.
+- **Consequences:** Free users retain non-AI email. Durable/new-message drafts require an owner-filtered database model, bounded API, export/deletion coverage and rollback migration as a separate cohesive increment. Future AI assistance remains Pro/privacy gated.
+- **User approval required:** No; this is repository-local verification and a safety boundary inside approved MAIL-001.
+- **Reversible:** The regression test can be reverted with `7f41cb2`; no runtime/schema state changed. Adding a Pro gate later would be an explicit product change.