docs(email): add local browser evidence

docs/audits/evidence/mail-001/README.md

@@ -3,7 +3,7 @@
 Updated: 2026-08-10
 
 - Progress report: `docs/verification/mail-001-job-email-hub.md`
-- Commands/results: `docs/audits/verification-log.md` V-126–V-136
+- Commands/results: `docs/audits/verification-log.md` V-126–V-140
 - Hub/legacy-route tests: `job-tracker-ui/src/correspondence-inbox-page.test.tsx`
 - Reused review decision tests: `job-tracker-ui/src/gmail-review-page.test.tsx`
 - Provider-neutral API tests: `JobTrackerApi.Tests/EmailControllerTests.cs`
@@ -13,5 +13,9 @@ Updated: 2026-08-10
 - Explicit-send/tenant/idempotency tests: `JobTrackerApi.Tests/EmailSendControllerTests.cs`
 - Confirmed composer tests: `job-tracker-ui/src/correspondence-inbox-page.test.tsx`
 - Restart-recovery/two-owner tests: `JobTrackerApi.Tests/EmailSendAttemptStoreTests.cs`
-- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`, `ee5ef7e`
+- Export/cascade tests: `JobTrackerApi.Tests/BackupControllerTests.cs`, `BackgroundWorkerTenantTests.cs`, `EmailSendAttemptStoreTests.cs`
+- `job-email-empty-connected-status-20260810.png`: authenticated disposable local user, empty linked-message view, explicit disconnected/read-only Gmail/Outlook/IMAP status at 1280×720.
+- `job-email-review-disconnected-20260810.png`: canonical review view after compatibility redirect, disconnected-provider handling at 1280×720.
+- Implementation commits: `6008b4a`, `536d403`, `a20775c`, `653f011`, `e9937ac`, `123fc55`, `449faeb`, `ee5ef7e`, `8fe3903`, `aff34cc`
 - Mocked provider data only; no real email, provider connection, private content, production service or external request was used.
+- Local browser used disposable `@example.test` data. Provider actions, mobile/tablet/1440 viewport controls and keyboard focus traversal remain unverified; the in-app browser could not resize or dispatch native Tab traversal in this run.

docs/audits/verification-log.md

@@ -171,3 +171,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-137 | `npm.cmd ls react-router-dom react-router js-yaml nanoid --all --depth=4`; `npm.cmd audit`; six focused router suites; full `npm.cmd test -- --runInBand`; `npm.cmd run build`; staged diff review | `job-tracker-ui` / repository root | Resolve the frontend advisory gate without an unreviewed forced update and verify the React Router v7 compatibility path | PASS — audit reports 0 vulnerabilities; focused 6/6 suites and 24/24 tests; full 49/49 suites and 190/190 tests; production build/TypeScript/static generation pass; `b55a592` pushed | CI/live deployment has not yet consumed the pushed commit; no deployment or production access occurred | Deployment verification pending |
 | V-138 | Focused `JobApplicationsFollowUpDraftTests|BackgroundWorkerTenantTests`; focused follow-up/trust-loop Jest; full backend/frontend; production build; `npm.cmd audit`; staged diff review | Repository root / `job-tracker-ui` | Verify legacy direct SMTP retirement while preserving draft generation, scheduled reminders and the provider-confirmed Job email boundary | PASS — focused backend 10/10 and UI 2/2; full backend 621/621 and frontend 49/49 suites, 190/190 tests; build and audit pass; legacy action returns 410 with no SMTP dependency; `8fe3903` pushed | JSDOM/fake services only; no provider/email/browser/production execution. Remote CI/live confirmation remains | External/deployment limitation |
 | V-139 | Focused `BackupControllerTests|BackgroundWorkerTenantTests|EmailSendAttemptStoreTests`; full backend; staged diff/secret/content-field review | Repository root | Verify owner-readable content-free send-attempt exports and hard-job-delete cascade isolation | PASS — focused 16/16; full backend 622/622; encrypted and daily exports include one owner attempt without payload hash; real SQLite deletes only the target job's attempt; `aff34cc` pushed | Complete account deletion/files/backups/retention remain SEC-009; no production export or deletion occurred | Deliberately bounded lifecycle increment |
+| V-140 | Running local API/frontend plus in-app browser at `/correspondence` and `/correspondence/review`; DOM/URL/layout/server-log inspection; screenshots | Local development environment | Verify authenticated empty Job email, disconnected capability states, view navigation and compatibility redirect in a real browser | PASS/PARTIAL — linked view and review view render; provider states are explicit; direct legacy route canonicalizes to `?view=review`; 1280×720 document width equals viewport; expected disconnected Gmail 409s are handled without 5xx; screenshots saved | Disposable local account/database only. No provider/send. Browser could not resize or dispatch native Tab traversal, so required widths/themes/keyboard and production remain blocked | Browser/tool/provider limitation |