Fence Mail provider and mailbox recovery effects

docs/MAIL_HANDBOOK.md

@@ -280,6 +280,20 @@ implemented.
 
 ### SMTP/IMAP incidents
 
+Current SMTP delivery and Sent-folder APPEND paths start a Mail-owned Core
+recovery operation before the network effect. Outbox attempts use the durable
+command and attempt number; Campaign jobs and single-message actions pass their
+own stable attempt identifiers through the versioned capability. A matching
+completed identifier is never sent or appended again merely to reconstruct
+caller state. Provider acceptance, definitive rejection, and outcome-unknown
+states are recorded independently of the consuming transaction.
+
+Mailbox folder/message indexing and configured bounce/calendar-reply scans are
+read-only provider operations. They acquire distributed per-profile/folder or
+per-source fences, commit bounded projection state, and verify that state in an
+independent session. A failed read is rolled back and can be repeated; it is not
+treated as an unknown provider mutation.
+
 1. Stop new consumer work if duplicate effects or credential compromise are
    possible.
 2. Preserve safe Mail, consumer-job, worker, and provider evidence.
@@ -291,6 +305,10 @@ implemented.
    merely to recreate a Sent copy.
 6. Record the incident/reconciliation reference in the consuming domain's audit
    trail without copying raw provider secrets or message content unnecessarily.
+7. For an outbox `outcome_unknown`, reconcile the Mail command with provider
+   evidence. Confirmed acceptance closes the provider operation as succeeded;
+   confirmed absence records verified recovery and permits only a new,
+   deliberate attempt identifier.
 
 ### Delivery-status and calendar-reply sources
 
@@ -408,9 +426,6 @@ Before claiming a Mail composition is production-ready:
 
 ## Explicitly planned, not yet claimed
 
-- Durable, idempotent Campaign report delivery with Mail-owned attempts,
-  unknown-outcome reconciliation, and partial-refusal evidence
-  ([`govoplan-mail#17`](https://git.add-ideas.de/GovOPlaN/govoplan-mail/issues/17)).
 - Canonical audit events for profile tests and the remaining profile/policy
   administration lifecycle, plus an operator-visible Redis-throttling
   degradation signal.
@@ -422,5 +437,7 @@ Before claiming a Mail composition is production-ready:
   is stable.
 - POP3 except for a future explicit legacy download/import requirement.
 - A full mail client with compose/reply/move/delete/read-state mutation.
+- Recovery-ledger adoption for future provider-side move, delete, and flag
+  mutations; no such production path exists in the current read-only mailbox.
 - Proof that process-local throttling coordinates multiple workers when Redis
   is unavailable; it deliberately does not.