feat(postbox): reconcile lifecycle notifications

docs/POSTBOX_CONCEPT.md

@@ -284,6 +284,9 @@ Optional consumers:
   source-postbox access.
 - Portal can show portal-facing postboxes without owning the postbox access model.
 - Mail can bridge external mailbox delivery into postboxes when configured, without making postboxes mailbox-bound.
+- Notifications can receive generic, metadata-only Postbox lifecycle commands
+  for current IDM holders. It owns user preferences, quiet periods, and future
+  email/push channel policy; Postbox remains correct when it is absent.
 
 ## Operational Rules
 
@@ -295,6 +298,20 @@ Optional consumers:
   distinguishable in access and action evidence.
 - Delegation start, expiry, withdrawal, key grant, and key-epoch rotation are
   separate auditable events.
+- The periodic Postbox worker batches IDM incumbency resolution and reconciles
+  assignment/delegation visibility, vacancy, and reassignment through a durable
+  cursor. First deployment establishes a quiet baseline; later changes and
+  failed notification handoffs are deduplicated and retryable.
+- Notification and platform-event payloads contain stable Postbox, message,
+  route, delivery, function, assignment, classification, and producer
+  provenance only. Subjects, bodies, participant addresses, attachment details,
+  ciphertext, and key material never enter lifecycle payloads.
+- Producers mark actionable deliveries through the typed `action_required`
+  delivery flag; Postbox emits a dedicated event and raises the generic in-app
+  priority without copying the producer's subject or body.
+- Notification links do not preserve authority. Assignment expiry, withdrawal,
+  classification policy, and generic Access permissions are rechecked when the
+  target is opened.
 - Administration of bindings should require explicit postbox administration permission plus access/RBAC authority for the target organization.
 - Sensitive access decisions and binding changes should emit audit events.
 - Retention rules should be postbox-owned but able to reference campaign, file, and portal provenance.