Partition mail retention by tenant

src/govoplan_mail/backend/delivery_outbox.py

@@ -874,15 +874,19 @@ def resend_delivery_command(
 def purge_expired(
     session: Session,
     *,
+    tenant_id: str | None = None,
     limit: int = 250,
 ) -> dict[str, object]:
     now = utcnow()
+    clauses = [
+        MailDeliveryCommand.expires_at <= now,
+        MailDeliveryCommand.payload_purged_at.is_(None),
+    ]
+    if tenant_id:
+        clauses.append(MailDeliveryCommand.tenant_id == tenant_id)
     commands = session.scalars(
         select(MailDeliveryCommand)
-        .where(
+        .where(*clauses)
-            MailDeliveryCommand.expires_at <= now,
-            MailDeliveryCommand.payload_purged_at.is_(None),
-        )
         .order_by(MailDeliveryCommand.expires_at)
         .limit(max(1, min(int(limit), 1000)))
     ).all()

src/govoplan_mail/backend/manifest.py

@@ -673,7 +673,7 @@ manifest = ModuleManifest(
             id="mail.reference.campaign-delivery-contract",
             title="Integrate Campaign through the Mail delivery contract",
             summary="Campaign freezes a Mail profile reference and opaque revision; Mail re-authorizes, revision-checks, resolves credentials, and performs the effect in one call.",
-            body="The mail.campaign_delivery 0.2 contract never returns decrypted credentials or resolved SMTP/IMAP configuration. Mail compares the expected random transport revision before decrypting protocol-specific credentials and returns only bounded sanitized outcomes. Campaign owns ordinary recipient jobs; report messages use Mail's encrypted idempotent delivery-command and attempt ledger. Every current SMTP and Sent-folder attempt passes a stable effect identifier into a Mail-owned Core recovery operation before provider contact. Effect-start evidence prevents blind redelivery, unknown outcomes require explicit reconciliation, and raw recipient refusals require Mail diagnostic authority.",
+            body="The mail.campaign_delivery 0.2 contract never returns decrypted credentials or resolved SMTP/IMAP configuration. Mail compares the expected random transport revision before decrypting protocol-specific credentials and returns only bounded sanitized outcomes. Campaign owns ordinary recipient jobs; report messages use Mail's encrypted idempotent delivery-command and attempt ledger. Every current SMTP and Sent-folder attempt passes a stable effect identifier into a Mail-owned Core recovery operation before provider contact. Effect-start evidence prevents blind redelivery, unknown outcomes require explicit reconciliation, and raw recipient refusals require Mail diagnostic authority. Mail outbox dispatch and retention scans are partitioned by tenant entitlement, so disabling Mail leaves accepted commands and evidence untouched for operator resolution.",
             layer="available",
             documentation_types=("admin", "user"),
             audience=("integrator", "campaign_manager", "campaign_sender", "release_reviewer"),