Complete EMAIL-WP-0004 transactional invitation mail delivery.

Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy,
probes), provider failure classification and suppression, T04 unit and live
proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.

workplans/EMAIL-WP-0004-transactional-mail-delivery-service.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Provide transactional invitation mail delivery"
 domain: infotech
 repo: email-connect
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-08"
-updated: "2026-08-10"
+updated: "2026-08-12"
 depends_on:
   - NK-WP-0024
 state_hub_workstream_id: "a37e5e4d-090a-4a75-88d2-aacd0c0fd235"
@@ -20,6 +20,10 @@ Extend email-connect beyond mailbox evidence scanning with a narrow,
 provider-neutral transactional-send service for user-engine invitations and
 verification messages. Email evidence remains non-authoritative.
 
+Deferred (not in this workplan): daily send-quota privilege tiers
+(10 / 100 / 1e3 / 1e4 / 1e5 / 1e6 / unlimited) as anti-spam abuse control —
+see `DECISIONS.md` “Defer daily send-quota privilege tiers”.
+
 ## T01 - Define the send and evidence contract
 
 ```task
@@ -79,7 +83,7 @@ registration without accepting browser identity claims. All 24 tests pass.
 
 ```task
 id: EMAIL-WP-0004-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "13428364-29b1-4e0d-aaf5-c0b254c829b9"
 ```
@@ -93,11 +97,31 @@ user-engine ingress, SMTP-only egress, and rollback.
 Done when user-engine can call the cluster-local receiver without possessing
 SMTP credentials and unrelated workloads cannot send through it.
 
+Done 2026-08-12 after CCR-2026-0010 approval:
+
+* OpenBao path `platform/workloads/email-connect/transactional` provisioned
+  (ingest token new; SMTP username/password seeded from live forgejo IONOS
+  lane — sender ConfigMap uses `forgejo@coulomb.social`).
+* Policies applied; ESO child token Secret
+  `external-secrets/openbao-email-connect-eso-token`; ClusterSecretStore
+  `openbao-email-connect` Ready; ExternalSecret SecretSynced (3 keys).
+* Package applied on railiance01: Deployment Ready 1/1, PVC Bound, probes
+  green, image digest `sha256:bc7a01b4…`.
+* Network: email-connect default-deny + user-engine ingress + SMTP-587 egress;
+  user-engine-runtime egress allow to email-connect:8080 (net-kingdom
+  `sso-mfa/k8s/user-engine/runtime.yaml`).
+* Smoke: user-engine `/healthz`/`/readyz` 200; unauth `/v1/send` 401; bearer
+  `template_not_allowed` / `invalid_recipient` 400; default-ns probe
+  Connection refused. user-engine secret has no SMTP keys.
+* Catalog `email-connect-transactional` promoted active/resolvable.
+* Follow-up (not T03): mount same ingest token into user-engine for NK outbox
+  (NK-WP-0024); optional dedicated noreply@ mailbox; T04 failure proof.
+
 ## T04 - Prove invitation delivery failure behavior
 
 ```task
 id: EMAIL-WP-0004-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "34127b3e-f7c6-4ebe-a86c-743ba1b27640"
 ```
@@ -110,3 +134,18 @@ failure evidence back to NK-WP-0024.
 
 Done when deployed invitation and verification flows are observable,
 idempotent, retry-safe, and conservative about delivery evidence.
+
+Done 2026-08-12:
+
+* ProviderError classification: timeout/temporary/unavailable → 503
+  `retryable=true`; permanent_rejection → 422 `retryable=false`; no SMTP text
+  in responses. SQLite suppressions → `recipient_suppressed`. Accept body
+  carries `evidence_ceiling=provider_accepted`; verification consume/cancel set
+  `authorization=false`.
+* Unit matrix: 9 tests pass (`tests/test_transactional.py`).
+* Live matrix on railiance01 (image
+  `sha256:a9de1994…`): unauth 401, template/invalid/idempotency 400, accept
+  202 + duplicate 200, resend 202, bad domain 422 permanent_rejection,
+  suppression 400; redaction checked. Evidence note for NK-WP-0024:
+  `docs/EMAIL-WP-0004-T04-failure-evidence.md`.
+* Workplan finished when T01–T04 all done (this completes EMAIL-WP-0004).