# Email workflows

Reviewed 2026-10-18. Catalog aggregate report: 2026-10-20T05:21:43.965Z; source sha256:dbc89422570b1cd32aa436ef5846c83491671936550e46c1e97665fbcb4bcb13.

Selected local assertions: 2026-10-20T16:28:11.733Z; source sha256:c6847798e117585d926c2a352da25818577705052a304dae43f30d337b3282d7; revision 483a474b3faae1e0ad273cdffa1107120881672c.

Workflow implementation states are an inspected inventory, not test passes or support assertions. Local test states belong to linked catalog contracts and can include broader tests. Pending and gap workflows never inherit a parent reference match. Provider accepted means a receipt, not delivery. No atomic percentage is claimed.

56 workflows: 29 implemented, 17 incomplete, 10 gaps. These are inspected implementation states, not passes.

## composition

### Compose subject and plain/HTML bodies

- ID: email.compose-text-html
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-001, VO-EMAILWF-003
- Selected local results: VO-EMAILDISPATCH-001: not-run; VO-EMAILWF-003: not-run
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed); transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Direct addresses; no MIME/final delivery claim. Subject headers reject CR/LF/NUL.
- Next acceptance: Compare empty subjects, Unicode byte boundaries and both body formats.

### Send to To, CC, BCC including CC-only/BCC-only

- ID: email.recipient-envelope
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILWF-001, VO-EMAILDISPATCH-001
- Selected local results: VO-EMAILWF-001: not-run; VO-EMAILDISPATCH-001: not-run
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed); transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: CC/BCC-only capture is local correction; the old reference receipt only covers direct To.
- Next acceptance: Selected rollback-only reference CC-only/BCC-only comparison.

### Reject empty/invalid recipients without an intent

- ID: email.recipient-validation
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILWF-001, VO-DIFF-1569
- Selected local results: VO-EMAILWF-001: not-run; VO-DIFF-1569: not-run
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed); transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Native Flow/control validation uses the mailbox policy. The recorded APEX6 direct-address observation belongs to the retired TypeScript producer and does not establish current Rust Messaging support.
- Next acceptance: Compare mixed valid/invalid recipient collections and field errors.

### Resolve Flow Contact, Lead or User recipient and related record

- ID: email.recipient-record-context
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: VO-FLOW-470
- Selected local results: VO-FLOW-470: not-run
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Lead plus related record rejects; recipient Email field read enforcement is not separately measured; no PersonAccount target admission.
- Next acceptance: Restricted-field/record/User recipient matrix; exact source errors.

### Use Apex target record and related context

- ID: email.apex-record-recipients
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed)
- Limitation: setTargetObjectId/whatId unsupported.
- Next acceptance: Fail-first selected target-ID setters and savepoint comparison.

### Send a mass recipient batch

- ID: email.mass-mail
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed)
- Limitation: MassEmailMessage is absent.
- Next acceptance: Define recipient/limits/transaction batch profile before implementation.

### Apply declared recipient opt-out policy

- ID: email.opt-out
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed)
- Limitation: No opt-out setter or enforcement. Direct address acceptance is not consent enforcement.
- Next acceptance: Pin opt-out options and record/address recipient semantics.

## senders

### Select current user sender

- ID: email.sender-current-user
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-004, VO-EMAIL-005
- Selected local results: VO-EMAIL-004: not-run; VO-EMAIL-005: not-run
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed); flows.send-email-core-action (support experimental; linked contract local tests not-run)
- Limitation: User email must match a configured sender; source-compatible org-wide object is absent.
- Next acceptance: Sender identity changes between enqueue and drain.

### Select configured org-wide sender

- ID: email.sender-org-wide
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-001
- Selected local results: VO-EMAILDISPATCH-001: not-run
- Contracts: permissions.email-sender-policy (support experimental; linked contract local tests not-run)
- Limitation: Original configured sender ID/address, no OrgWideEmailAddress mailbox verification service.
- Next acceptance: Compare named sender selection and configuration-state errors.

### Add/edit/remove sender and eligible profiles

- ID: email.sender-admin
- Surface: native-authoring
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/setup-admin-config.ts, packages/runtime/src/org-settings.ts
- Cases: VO-EMAIL-001
- Selected local results: VO-EMAIL-001: not-run
- Contracts: permissions.email-sender-policy (support experimental; linked contract local tests not-run); permissions.email-deliverability (support experimental; linked contract local tests passed)
- Limitation: Native browser configuration exists. Verification is deployment attestation, not a self-grant.
- Next acceptance: Browser save/reopen and stale revision; sender-specific profile denial.

### Deny unpermitted sender or sending principal

- ID: email.sender-permission
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-006, VO-EMAILDISPATCH-007
- Selected local results: VO-EMAIL-006: not-run; VO-EMAILDISPATCH-007: not-run
- Contracts: permissions.email-sender-policy (support experimental; linked contract local tests not-run)
- Limitation: SendEmail or native ModifyAllData alternative; system mode does not bypass sender profile.
- Next acceptance: Cross-link general access task; compare exact source principal profiles.

### Refuse or suppress by deliverability category

- ID: email.deliverability
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-003, VO-EMAIL-005
- Selected local results: VO-EMAIL-003: not-run; VO-EMAIL-005: not-run
- Contracts: permissions.email-deliverability (support experimental; linked contract local tests passed)
- Limitation: Plain Flow NoAccess suppresses; templates/logged/Apex/control refuse. Defaults/categories are local choices unless compared.
- Next acceptance: Exact source plain/template/logged matrix and NoAccess attachment validation order.

### Enforce verification/transport configuration

- ID: email.sender-attestation
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-006
- Selected local results: VO-EMAILDISPATCH-006: not-run
- Contracts: permissions.email-sender-policy (support experimental; linked contract local tests not-run)
- Limitation: Attested synthetic configuration and offline binding; no mailbox/domain setup service.
- Next acceptance: Selected provider sender verification and failed/unknown setup states.

### Recheck sender and current policy at dispatch

- ID: email.sender-recheck
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-003, VO-EMAILDISPATCH-006, VO-EMAILDISPATCH-007
- Selected local results: VO-EMAIL-003: not-run; VO-EMAILDISPATCH-006: not-run; VO-EMAILDISPATCH-007: not-run
- Contracts: permissions.email-sender-policy (support experimental; linked contract local tests not-run); transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Address/permissions/attestation rechecked; changed display name/replyTo are frozen and not invalidated.
- Next acceptance: Define change/revocation policy for headers and record-linked files.

## templates

### Discover templates and folders in native setup

- ID: email.template-discovery
- Surface: native-authoring
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/setup-admin-builders.ts
- Cases: VO-EMAILWF-002
- Selected local results: VO-EMAILWF-002: not-run
- Contracts: metadata.folder-based-metadata (support partial; linked contract local tests not-run)
- Limitation: Native admin definitions, not source UI or folder-sharing parity.
- Next acceptance: Browser list/reload and current-authority denial.

### Create/edit/save text, HTML or custom UTF-8 template

- ID: email.template-create-edit
- Surface: native-authoring
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/setup-admin-builders.ts
- Cases: VO-EMAILWF-002, VO-EMAILWF-003
- Selected local results: VO-EMAILWF-002: not-run; VO-EMAILWF-003: not-run
- Contracts: metadata.folder-based-metadata (support partial; linked contract local tests not-run)
- Limitation: Stored source save does not prove mail rendering. HTML code editor; no rich visual designer.
- Next acceptance: Browser edit/reopen and malformed source/unknown fields.

### Preview inactive draft against a readable sample

- ID: email.template-preview
- Surface: native-authoring
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/setup-admin-builders.ts, packages/runtime/src/flow-email.ts
- Cases: VO-EMAILWF-002
- Selected local results: VO-EMAILWF-002: not-run
- Contracts: metadata.folder-based-metadata (support partial; linked contract local tests not-run)
- Limitation: Single sample Object.Field context; transient availability rolls back with review; no draft persistence.
- Next acceptance: Browser inactive preview, draft retention on error, saved bytes unchanged.

### Activate/deactivate sending availability

- ID: email.template-activation
- Surface: native-authoring
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/setup-admin-builders.ts, packages/runtime/src/flow-email.ts
- Cases: VO-EMAILWF-002
- Selected local results: VO-EMAILWF-002: not-run
- Contracts: metadata.folder-based-metadata (support partial; linked contract local tests not-run); flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Inactive saves and review tested. Runtime inactive refusal retained; full activation lifecycle not reference-compared.
- Next acceptance: Attempt send inactive, activate, send, deactivate queued-work policy.

### Delete template/folder with dependency checks

- ID: email.template-delete
- Surface: native-authoring
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/setup-admin-builders.ts
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: metadata.folder-based-metadata (support partial; linked contract local tests not-run)
- Limitation: Native delete path exists; in-use template/folder safeguards need dedicated current acceptance.
- Next acceptance: Create dependency, reject deletion, detach and delete via browser.

### Create folder and select access settings

- ID: email.template-folders
- Surface: interoperability
- Implementation inventory: partial
- Reference: recorded-subset
- Paths: packages/runtime/src/setup-admin-builders.ts
- Cases: VO-CLI-217
- Selected local results: VO-CLI-217: not-run
- Contracts: metadata.folder-based-metadata (support partial; linked contract local tests not-run)
- Limitation: Metadata folder/text lifecycle is recorded elsewhere; read-only/hidden labels do not establish recipient folder sharing.
- Next acceptance: Public/hidden folder principal read/send matrix.

### Render record merge fields and escape HTML

- ID: email.template-merge
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: VO-EMAILWF-003, VO-FLOW-498
- Selected local results: VO-EMAILWF-003: not-run; VO-FLOW-498: not-run
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Flat Object.Field fields only; no relationship expressions or full sender/User global context.
- Next acceptance: Unicode/null/escaping/FLS and recipient-vs-related precedence.

### Refuse unresolved fields, invalid encoding or renderer

- ID: email.template-invalid
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: VO-EMAILWF-002
- Selected local results: VO-EMAILWF-002: not-run
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Runtime rejects unavailable field/record, non-UTF8, inactive and unknown syntax; rejection branches need dedicated negative inventory.
- Next acceptance: One case per missing context/field/encoding/Visualforce renderer.

### Import/retrieve template source separately from sending

- ID: email.template-roundtrip
- Surface: interoperability
- Implementation inventory: partial
- Reference: recorded-subset
- Paths: packages/metadata/src/index.ts, packages/runtime/src/deploy.ts
- Cases: VO-CLI-217, VO-FLOW-497
- Selected local results: VO-CLI-217: not-run; VO-FLOW-497: passed
- Contracts: metadata.folder-based-metadata (support partial; linked contract local tests not-run); flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Text template metadata wire subset is recorded. Rich import/local rendering does not extend that match.
- Next acceptance: Compare rich template source CRUD/retrieve without conflating rendered mail.

## attachments

### Select Attachment, ContentVersion or Document by ID

- ID: email.attachment-select
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: VO-FLOW-470, VO-EMAILWF-003
- Selected local results: VO-FLOW-470: not-run; VO-EMAILWF-003: not-run
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Flow ID scalar/collection only; no dedicated email attachment picker/add/remove/reorder UI.
- Next acceptance: Each object type plus ordered collection, add/remove and duplicate IDs.

### Freeze attachment bytes, name and content type

- ID: email.attachment-freeze
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: VO-EMAILWF-003
- Selected local results: VO-EMAILWF-003: not-run
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Bytes frozen before enqueue. Later source edits do not change mail; no automatic authority recheck for ordinary file mail at dispatch.
- Next acceptance: Revocation between enqueue/dispatch with an explicitly chosen policy.

### Reject missing/revoked files before enqueue

- ID: email.attachment-refusal
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: VO-EMAILWF-003
- Selected local results: VO-EMAILWF-003: not-run
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Deleted Attachment refusal verified; file-sharing revocation and all source object types remain separate.
- Next acceptance: Restricted current record/file authority and revoked link matrix.

### Enforce count/byte/name limits

- ID: email.attachment-limits
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: 10 IDs/1 MiB raw Flow files plus org payload byte ceiling; not source MIME limits. Filename CR/LF/NUL reject.
- Next acceptance: Exact boundary and boundary+1 count/raw/base64 bytes and unsafe names.

### Render inline images/Content-ID in rich mail

- ID: email.inline-images
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Only disposition attachment is supported.
- Next acceptance: Selected source inline/rich-template contract; explicit unsupported test.

## producers

### Trigger SingleEmailMessage from Apex

- ID: email.producer-apex
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: apex.messaging-sendemail (support partial; linked contract local tests passed)
- Limitation: The sole Rust engine rejects Messaging; the retired TypeScript direct-address producer and its dated receipts are historical. Native Flow/control notification producers remain separate.
- Next acceptance: Implement Rust Messaging with the same outbox and explicit native/Wasm profile.

### Trigger Flow Send Email

- ID: email.producer-flow
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-005, VO-EMAILWF-003
- Selected local results: VO-EMAIL-005: not-run; VO-EMAILWF-003: not-run
- Contracts: flows.send-email-core-action (support experimental; linked contract local tests not-run); flows.email-template-attachments (support experimental; linked contract local tests not-run)
- Limitation: Native emailSimple; general standard-action REST interoperability not established.
- Next acceptance: Actual browser action authoring plus explicit source REST envelope.

### Author and trigger workflow/Flow email alert

- ID: email.producer-alert
- Surface: native-authoring
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/setup-admin-builders.ts, packages/runtime/src/flow-alerts.ts
- Cases: VO-FLOW-497, VO-FLOW-498
- Selected local results: VO-FLOW-497: passed; VO-FLOW-498: not-run
- Contracts: flows.workflow-email-alerts (support experimental; linked contract local tests not-run)
- Limitation: Finite owner/creator/email/user/lookups/group recipients; no full workflow product claim.
- Next acceptance: Browser alert authoring; current principal/group changes.

### Send from record-triggered workflow

- ID: email.producer-record-trigger
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/workflows.ts, packages/runtime/src/flow-alerts.ts
- Cases: VO-FLOW-498
- Selected local results: VO-FLOW-498: not-run
- Contracts: flows.workflow-email-alerts (support experimental; linked contract local tests not-run)
- Limitation: Contact on-create path measured locally; broad before/after/recursive saves remain separate.
- Next acceptance: After-save email action rollback and update conditions.

### Run Case auto-response with template identity

- ID: email.producer-case-response
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/case-auto-response.ts
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: service-cloud.case-auto-response-authority (support experimental; linked contract local tests not-run); service-cloud.case-auto-response-source (support experimental; linked contract local tests not-run); service-cloud.case-auto-response-template-identity (support experimental; linked contract local tests not-run); service-cloud.case-auto-response-transactions (support experimental; linked contract local tests not-run)
- Limitation: Native server-owned response headers and transactions. Broad Case auto-response rules row remains not implemented.
- Next acceptance: Replay existing native cases; selected reference rule/template/sender comparison.

### Notify assigned orchestration work

- ID: email.producer-orchestration
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/flow-orchestration.ts
- Cases: VO-FLOW-503
- Selected local results: VO-FLOW-503: not-run
- Contracts: flows.orchestration-stage-protocol (support experimental; linked contract local tests not-run)
- Limitation: Operator-selected FLOW_ORCHESTRATION_NOTIFICATIONS and active user; local work-assignment mail.
- Next acceptance: Permission/NoAccess/current assignment and rollback assertions.

### Notify approval submission/decision

- ID: email.producer-approval
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: approval.approval-actions (support partial; linked contract local tests not-run)
- Limitation: Approval records/actions do not enqueue email; orchestration mail is independent.
- Next acceptance: Define classic-vs-Flow approval notification profile and recipients.

### Prepare per-recipient dashboard subscription email

- ID: email.producer-dashboard
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/dashboard-email.ts, packages/runtime/src/dashboard-email-recipients.ts
- Cases: ORG-DASH-100, ORG-DASH-120
- Selected local results: ORG-DASH-100: not-run; ORG-DASH-120: not-run
- Contracts: analytics.dashboard-data-apis (support partial; linked contract local tests not-run)
- Limitation: Original HTML/CSV/PDF and preferred-address/source-sender modes. Provider acceptance is not delivery.
- Next acceptance: Retain dashboard receipts; exact subscription email reference profile.

### Send report subscription email

- ID: email.producer-report
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: analytics.report-metadata (support partial; linked contract local tests not-run)
- Limitation: Report subscriptions currently deliver native inbox snapshots only.
- Next acceptance: Recipients, export formats and quota policy before connecting shared outbox.

### Send installation/login verification email

- ID: email.producer-auth
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: oauth.org-bound-access-tokens (support experimental; linked contract local tests not-run)
- Limitation: Private UI services have separate direct EMAIL calls/challenge storage; not the runtime notification outbox or Salesforce password-reset parity.
- Next acceptance: Offline sign-in expiry/replay/provider fault receipts and separate selected transport.

## dispatch

### Create durable outbox intent in the producer transaction

- ID: email.transaction-intent
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-002, VO-EMAILWF-003
- Selected local results: VO-EMAIL-002: not-run; VO-EMAILWF-003: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Store/RLS persistence; pending is unsent.
- Next acceptance: Cross-producer intent and restart persistence.

### Rollback intent and quota before dispatch

- ID: email.transaction-rollback
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-002, VO-EMAIL-004, VO-EMAILWF-003
- Selected local results: VO-EMAILDISPATCH-002: not-run; VO-EMAIL-004: not-run; VO-EMAILWF-003: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Flow/Apex/savepoint rollback; offline capture proves no dispatch call.
- Next acceptance: Kill-before-commit regression under selected native engine.

### Commit claim before provider call

- ID: email.post-commit-claim
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-001
- Selected local results: VO-EMAILDISPATCH-001: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Concurrent drains observe one durable claim; no exactly-once external delivery promise.
- Next acceptance: Current process crash at each before/after claim boundary.

### Drain to exact offline capture

- ID: email.dispatch-capture
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-002, VO-EMAILWF-003
- Selected local results: VO-EMAIL-002: not-run; VO-EMAILWF-003: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Captured means retained locally, providerMessageId null.
- Next acceptance: Restart and reread exact attachment bytes and recipients.

### Run due dashboard schedules and their email queues

- ID: email.dispatch-scheduler
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/dashboard-subscriptions.ts, packages/runtime/src/coordination/executor.ts
- Cases: ORG-DASH-110
- Selected local results: ORG-DASH-110: not-run
- Contracts: analytics.dashboard-data-apis (support partial; linked contract local tests not-run)
- Limitation: Coordinated orgs run due schedules through the org coordinator, one per scheduling turn; Developer edition runs them through explicit run-due with an optional clock.
- Next acceptance: Hosted cadence, authority and restart profile through coordinated dispatch.

### Retain definite rejection and explicit new-intent recovery

- ID: email.dispatch-failure
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-003, VO-EMAILWF-003
- Selected local results: VO-EMAILDISPATCH-003: not-run; VO-EMAILWF-003: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Failure is terminal. A new operator intent is separate, consumes quota; no hidden retry.
- Next acceptance: Sanitized diagnostics and policy correction with unique replacement intent.

### Recover expired claim or uncommitted receipt as unknown

- ID: email.dispatch-unknown
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-004, VO-EMAILDISPATCH-005, VO-EMAILDISPATCH-011
- Selected local results: VO-EMAILDISPATCH-004: not-run; VO-EMAILDISPATCH-005: not-run; VO-EMAILDISPATCH-011: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Never automatically resend ambiguous outcome; reconciliation unavailable.
- Next acceptance: Kill after provider receipt before commit; operator reconciliation gate.

### Deduplicate same creator/key and reject changed content

- ID: email.idempotency
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-002
- Selected local results: VO-EMAIL-002: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Enqueue identity only; no provider idempotency or network-delivery guarantee.
- Next acceptance: Current concurrent creator/key/changed payload and principal isolation.

### Reconcile delivered/bounced/unknown externally

- ID: email.delivery-reconciliation
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Accepted records only a provider receipt; no delivered event.
- Next acceptance: Selected provider signed events/replay/authority and unknown reconciliation.

## threading

### Create and resolve Case-owned threading token

- ID: email.thread-token
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/email-threading.ts
- Cases: VO-FLOW-498
- Selected local results: VO-FLOW-498: not-run
- Contracts: flows.email-threading (support experimental; linked contract local tests not-run)
- Limitation: Local durable token/Case authority and deleted token refusal; not source header algorithm.
- Next acceptance: Cross-principal/cross-org forgery and deleted/undeleted Case matrix.

### Append Case token to plain Flow subject/body

- ID: email.thread-add
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/flow-email.ts
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: flows.email-threading (support experimental; linked contract local tests not-run)
- Limitation: No-template branch only; no Message-ID/In-Reply-To/References generation.
- Next acceptance: Subject/body/rich newline/token flags and template precedence.

### Receive SMTP/MIME and associate Email-to-Case

- ID: email.inbound-case
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: service-cloud.email-to-case-ingestion (support not-implemented; linked contract local tests not-run)
- Limitation: Outbound helper and normalized intake are separate from a real inbound service.
- Next acceptance: Selected routing/MIME/attachments and durable reply association.

### Ingest authenticated normalized Case request

- ID: email.normalized-case
- Surface: runtime
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/case-ingestion.ts
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: service-cloud.normalized-case-ingestion (support experimental; linked contract local tests not-run); service-cloud.normalized-case-ingestion-authority-transactions (support experimental; linked contract local tests not-run)
- Limitation: Finite authenticated JSON intake; not email routing, MIME or thread parsing.
- Next acceptance: Reuse existing intake rollback/authority evidence; do not count as mail ingestion.

### Run Apex inbound email handler

- ID: email.inbound-handler
- Surface: runtime
- Implementation inventory: gap
- Reference: pending
- Paths: none
- Cases: No case mapped in this workflow register; inspect linked contract tests
- Selected local results: none
- Contracts: service-cloud.email-to-case-ingestion (support not-implemented; linked contract local tests not-run)
- Limitation: No InboundEmailHandler/service.
- Next acceptance: Define sanitized inbound envelope, governor and transaction boundary.

## administration

### Inspect own/admin notification history

- ID: email.history-access
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAIL-006
- Selected local results: VO-EMAIL-006: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Latest 100; ordinary users own bodies only; no delivery/bounce log.
- Next acceptance: Browser monitor plus current-authority redaction and pagination gap.

### Process/cancel pending email from Automation Monitor

- ID: email.history-monitor
- Surface: native-authoring
- Implementation inventory: partial
- Reference: pending
- Paths: packages/runtime/src/setup-admin-operations.ts
- Cases: VO-EMAIL-006
- Selected local results: VO-EMAIL-006: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Native monitor exists; general test covers API authority, not complete browser monitor behavior.
- Next acceptance: Actual browser pending/captured/error/cancel and denial.

### Reserve daily recipients and enforce per-message limits

- ID: email.quota-errors
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-008
- Selected local results: VO-EMAILDISPATCH-008: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Local UTC combined To/CC/BCC reservations and provider ceiling 50; not reference split quotas.
- Next acceptance: Boundary/admission/release counters across producer rollback.

### Restore history while cancelling unsent mail

- ID: email.restore-persistence
- Surface: runtime
- Implementation inventory: implemented
- Reference: pending
- Paths: packages/runtime/src/notifications.ts
- Cases: VO-EMAILDISPATCH-009
- Selected local results: VO-EMAILDISPATCH-009: not-run
- Contracts: transactions.email-notification-intents (support experimental; linked contract local tests not-run)
- Limitation: Restore selects capture and cancels pending; claimed becomes unknown. No provider reconciliation.
- Next acceptance: Actual process restart and restored attachment frozen bytes.