# Email Notification Delivery

In-app notifications are the canonical notification channel. They remain
available when no email implementation is installed.

Production email delivery is an optional integration with the
`mail.notificationDelivery` capability:

- Notifications owns recipient intent, notification preferences, content, and
  notification status.
- Mail owns server profiles, credentials, queue persistence, retry policy, and
  transport outcomes.
- An accepted handoff is recorded as `accepted`; it does not claim that the
  remote SMTP server has delivered the message.
- If Mail or a usable profile is unavailable, delivery is recorded as
  `paused`. The notification is retained and can be retried after the
  capability becomes available.
- Transport failures are recorded as `failed` with an attempt record and do
  not remove the in-app notification.
- File-based EML delivery is development-only and must not be used as a
  production fallback.

The capability contract deliberately passes references to recipient, tenant,
and profile context without exposing or duplicating Mail credentials.