beta.3: complete mailbox delivery and compact email administration

[Proxicon]

What changes

• Activates mailbox ingestion deliberately from Email Settings, with hosted-worker status, bounded Sync now, receipt diagnostics, and selected historical import after an initial New only baseline.
• Resolves one effective mailbox per tenant for both incoming and outgoing ticket mail. Dedicated IMAP/POP3 mail uses its matching SMTP identity; Graph uses the selected Graph mailbox. Global routing applies only where no dedicated assignment exists. Outgoing configuration, verified TLS, protected credentials, and capability tests are separate from incoming settings.
• Persists outgoing requests and their sender binding before dispatch. Failed or uncertain delivery remains visible for review; configuration repair and route changes require explicit, audited retry. An outgoing outage does not roll back the incident or switch to an unrelated sender.
• Replaces the large Email Settings form with a responsive mailbox picker, identity/status summary, and Incoming, Outgoing, Processing, and Activity sections. Adds field-level outgoing validation and preserved drafts.
• Adds additive SQLite/PostgreSQL migrations and beta.2 upgrade guidance. Existing failed beta.2 mail is preserved, not replayed automatically.

Route and recovery contract

Ticket context	Incoming source	Outgoing sender	Change or outage
Tenant with dedicated IMAP/POP3	Assigned dedicated mailbox	SMTP for that mailbox	Incoming can commit during SMTP failure; no global fallback.
Tenant with dedicated Graph	Assigned Graph mailbox	Graph /users/{mailbox}/sendMail	Missing send permission holds outgoing work without disabling reads.
Tenant without dedicated assignment	Configured global mailbox	Global mailbox's configured SMTP/Graph sender	No implicit dedicated sender.
Instance or manual ticket notification	Effective mailbox for the ticket tenant	Same bound mailbox	Pending/failed delivery remains tied to ticket, tenant, mailbox, and revision.

Archive/revert can select a new global route for new work. Existing held deliveries require an administrator to review the original recipients and confirm a safe rebind. Accepted-recipient and uncertain SMTP outcomes cannot be blindly retried. A ticket/tenant mismatch blocks the old delivery identity.

Validation

• Published Release API/Web with production DI and hosted workers, PostgreSQL, and isolated TLS IMAP/POP3/SMTP: authenticated UI/API setup; worker fetch; visible tenant incidents and native receipts; dedicated and global SMTP identity; support notification; MIME attachments; threaded reply; historical selection; POP3 deduplication; pause/resume; deployment gate; two-replica takeover; SMTP authentication failure, independent mailbox progress, explicit repair and retry. The suite is in the PR validation workflow (tests/ux/mailbox-*-lifecycle.spec.ts). Earlier local focused published runs passed, including replica and outgoing-failure cases.
• Earlier full Release .NET suite: 1,328 passed, 6 skipped, 0 failed. Focused Graph SDK tests cover selected mailbox MIME read, denied send, and continued incoming access. Authenticated API tests cover outgoing redaction, retained/cleared credentials, destination changes, version conflict, and four null-field validation cases (42/42).
• Responsive browser checks cover light/dark/system themes and 1440/1280/1024/768/390 CSS pixel widths; first-viewport and full-page captures were inspected. Release API/Web builds, layout, public disclosure, and changed-file Slopwatch checks passed locally.
• Previously reviewed head d73ca8c hosted validation passed: PR validation, all 15 jobs, including .NET, UX, published mailbox lifecycle, Compose, images, release rehearsal, disclosure and layout; managed PostgreSQL first run passed. The earlier PR test-merge commit is c64dd72364431b0221d109a50e1007f1a4c0a986 (parents: 46f24fe base and d73ca8c head). Evidence: published lifecycle, browser screenshots and report, .NET test results, release rehearsal. GitHub verifies the final head SSH signature.

Final peer-review follow-up (#78)

Finding	Failing-before evidence on reviewed d73ca8c	Correction and passing-after evidence
F79-1: beta.2 baseline	Authenticated_historical_import_accepts_the_beta2_null_reason_capture_shape_only failed 1/1 with an empty preview when the reviewed endpoint predicate was replayed. The beta.2 producer wrote a null reason.	Classify only initialized, same-source, acknowledged zero-attempt empty-envelope receipts with a native source identity; exclude processed, missing, held, successful and ambiguous records. Faithful beta.2 SQLite/PostgreSQL upgrades passed 2/2; the authenticated test passed 1/1. The published lifecycle selected a retained IMAP message, created its incident and outgoing mail, and repeated sync without duplicate effects.
F79-2: incoming revision	Same_mailbox_incoming_revision_can_be_reviewed_without_recomposing_delivery failed 2/2 on SQLite/PostgreSQL because preview refused the unchanged mailbox ID.	Review and confirm mailbox ID, incoming/outgoing revisions, original recipients and outbox fence. The service checks immutable source identity, route, ticket/tenant, accepted-recipient and uncertain outcomes, then atomically adopts both revisions. The database regression passed 2/2; SMTP and Graph SDK sender tests passed 2/2; published failed-delivery and replica retries passed.
F79-3: forwarded tenant	The published two-inherited-tenants regression failed 1/1 before the fix because B's support notification did not arrive.	After forwarding authorization, one scoped operation binds both data and email-effect contexts to B before incident creation. The published case passed 1/1: B's captured support payload has B's organization, the global mailbox and correct revisions, no binding error, and one actual isolated SMTP delivery. The requester confirmation remains suppressed and denial controls pass.
P3: constrained tabs	The reviewed dark 1280 px capture clipped Activity with the drawer open.	At constrained widths, all four section buttons fit in the editor and open the actual Incoming, Outgoing, Processing and Activity panels. The 1280 px light/dark panel captures were inspected; the main browser suite had 28 first-attempt passes and one flaky eventual pass.

Previous reviewed validation. Signed head e9dee058632ebd1a5499861b7c4a1ec751cdb92f (GitHub verified); base 46f24fe33e350900e5d3f747669a9c4b87d75257; validated test merge 5bbfee11a8b80466c9c33cb02e3bb641dfc77d59 with those two parents. Final PR validation passed all 15 jobs and managed PostgreSQL validation passed. The final TRX has 1,401 passed, 0 failed, 6 skipped (.NET artifact). All 8/8 published mailbox lifecycle invocations passed (protocol and worker evidence); browser setup 1/1 and AI Assistant 14/14 passed cleanly; main had 28 first-attempt passes and one flaky eventual pass (browser report and light/dark captures). Image builds, Compose startup/configuration, release rehearsal, archive runtimes, disclosure, layout and secret scanning are included in the green PR run. The previous reviewed rerun remains available.

Local diff whitespace, disclosure, layout, Slopwatch and clean committed-source Gitleaks checks passed; the source checkout is clean. A repository-wide dotnet format whitespace --verify-no-changes still reports existing formatting violations, including untouched files; the two new C# files pass a scoped format check. The published acceptance uses Release binaries, normal DI and hosted workers with isolated TLS services under the ASP.NET Development environment. It does not establish live Microsoft consent or Internet delivery. 0.1.1-beta.3 remains the intended release; no merge, deployment, tag, image publication or live mailbox action was performed.

F79-4: confirmed route adopts the target source identity

On reviewed head e9dee058632ebd1a5499861b7c4a1ec751cdb92f, a composed SQLite/PostgreSQL regression failed 2/2: mail queued through IEmailService retained dedicated mailbox D's non-null source key after confirmed rebinding to global mailbox G. The stored ID was G but the key was D. The changed-route operation now fences and re-resolves the authoritative target, validates its ID, incoming/outgoing revisions, readiness and source key, and atomically adopts the target ID, key, revisions and matching Reply-To. The audit records the original and adopted mailbox IDs and source identities without credentials. Ticket, tenant, delivery identity, content, attachments and To/CC/BCC recipients remain bound to the same logical delivery. Confirmation, fence, revision, tenant, accepted-recipient and uncertain-outcome controls remain in place.

After the correction, that regression passed 2/2 on SQLite/PostgreSQL. It also exercises a failed G authentication, explicit outgoing repair, and a benign incoming revision followed by confirmed same-mailbox recovery. A separate composed isolated SMTP case passed 1/1, with one accepted submission after route confirmation and repair. The full local Release suite passed 1,403, skipped 6, failed 0; the published outgoing failure and repair lifecycle passed 1/1.

The previous head's browser evidence was 28 first-attempt passes plus one flaky eventual pass, not 29 clean first attempts. Its first-failure capture showed a blank organization query with a stale option open. The test now waits for the initial autocomplete options and verifies the no-results query value before checking the no-results message; successful selection remains asserted. Three fresh isolated, retries-disabled invocations passed on their first attempt. A --repeat-each=3 run against one shared database produced one pass followed by two assignment-conflict failures because the first invocation left an archived tenant assignment; those stateful repeat failures are reported separately and do not establish an application autocomplete defect.

Final-head validation. GitHub verifies signed head 21af3b14e64054f7e69f2708ae88f70111933dbd. The tested merge commit is 50f48d9bd39a9c47bd70c7372fe33e6c9305dd3f (parents: base 46f24fe33e350900e5d3f747669a9c4b87d75257 and this head). PR validation passed 15/15 jobs; managed PostgreSQL validation passed. The uploaded TRX has 1,403 Passed, 6 NotExecuted, 0 Failed. All 8/8 published mailbox lifecycle reports record one expected pass and zero flaky, skipped or unexpected cases. The browser reports record setup 1/1, main 29/29, AI Assistant 14/14, all clean first attempts with no retries. Image builds, Compose checks, release rehearsal, archive runtimes, disclosure, layout and secret scanning passed. Local diff whitespace, Slopwatch, disclosure and layout checks passed; scoped whitespace verification passed for the production file. The older touched test files retain existing dotnet format whitespace violations outside this focused correction.

0.1.1-beta.3 is unchanged. No merge, auto-merge, deployment, image publication, release, tag or live mailbox action was performed. Ready for human review.

Operations and limits

Administrators upgrading from beta.2 should back up the database and shared Data Protection keys, stop older replicas before migration, configure and test outgoing transport, inspect the initial-import choice, then explicitly start processing. Previously skipped baseline messages can be selected for bounded historical import. Previously failed beta.2 outgoing records are retained; records without trusted sender binding cannot be rebound automatically. See mailbox administration and planned beta.3 notes.

The isolated protocol and Graph SDK fixtures establish application behavior. They do not establish live Microsoft consent, external SMTP delivery, or the cause of any previously reported live message. This PR is ready for human review. No merge, deployment, release, tag, image publication, or live mailbox action was performed.

Fixes #78. Context: #75, #76, #77.