docs: preserve email hard-wait approval and tune parser limits

BUILD-LOG.md

@@ -5201,3 +5201,5 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 2026-10-21T21:45:20Z | Della mos-1223 / ludwig-0004 focused corrections | Before: b096a16cc left content-key location implicit and E05 core registration marked ready. After: merged plan 399 lines fixes external configDir secret key/lifecycle namespace outside dataRoot backup/restore, E01 schema and E03 missing/expired-key restore tests, and E05/E06 test-local registry readiness with core kinds.mjs registration gated on approved E01/Q4. Sixteen rows and eleven questions retained; originals unchanged. Focused static checks and queue guard apply, no product/live changes. Reviewer will check changed lines only.
 
 2026-10-22T16:09:56Z | Della mos-1303 / Vikunja 460 Q217/Q222 revision | Before: Q1/Q2 open and Q3-Q7 phrased as Jason questions. After: Jason-created InMotion/woltje.com ingress recorded; per-source mailboxScope defaults none with human-only CLI then Console writer and named default/change/agent-refusal tests. Q3-Q7 settings/defaults/owners documented; no new external decision required for default development, conditional provider/spend/exposure list retained. PRD/grant/data.delete/live gates preserved. Docs only, no product suite or live operation. Earlier uncommitted append-only PRD review session receipts are preserved in this docs commit. Ludwig reviews before Sage landing.
+
+2026-10-22T16:12:26Z | Della ludwig-0035 / mos-1303 / Vikunja 460 focused corrections | Verified REQ-WAIT-2/3 at db1e7732a: Jason approval is required to route mail.access out of hard waits. Restored explicit Jason-approved PRD gate; no Q211 waiver inferred. Named tunable parser/attachment settings, defaults and schema/test review ownership of resource bounds; E04 checks changed values and bound refusals. Clarified Q8 extraction stays Jason choice. Docs-only checks, no product/live action; focused review before Sage handoff.

docs/SESSIONS.md

@@ -1444,3 +1444,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T22:36:30Z | Della (GPT-6.1-Sol, ludwig-0026) | PRD 1.13 focused r2 review, Vikunja 463 | APPROVED exact pin bd1f7d0b125a64bb1c367656b507acb17fab77fe. Owner own-thread and collaborator write-grant cases now match design D4 A1/A2; unproven-count title fixed. Exact parent/two-file delta/85 ids/status/title limits/unchanged test pins/whitespace checks pass. No Node/product/live test. Sage lands Huey 2c843d190 design before/with PRD and runs both full requirements tests on final candidate. Direct exact-pin approval to Ludwig/Mos.
 2026-10-21T22:41:00Z | Della (GPT-6.1-Sol, ludwig-0030) | PRD 1.14 independent review, Vikunja 464 | APPROVED exact pin 9bd665976f866a9ee802ddd8470970b99e839eb9. Three playground levels, prefix-first scope, all mapping refusals/codes and null-book/draft lookup behavior checked against Gosalyn 51fdfb7e2 and Webby 7c00c8345. Static parent/three-file scope/85 ordered unique ids/status/title bounds/unchanged JSON titles and bus test/old LIB-2 quote/whitespace pass. No Node/product/live tests; Sage lands the cited ruling before/with PRD and runs both full requirements test files on the final candidate. Direct exact-pin verdict to Ludwig/Mos; candidate unchanged.
 2026-10-22T16:09:56Z | Della (GPT-6.1-Sol, mos-1303) | Vikunja 460 Q217/Q222 email-plan settings revision | Canonical queue next della: nothing. Q1/Q2 closed; per-source default-none human-only scope and acceptance tests; Q3-Q7 grouped as settings/review, conditional external decisions only. Docs/static verification; no implementation, live access, secret read or mailbox/account creation. Commit/push only della/email-plan, direct Ludwig/Mos review handoff.
+2026-10-22T16:12:26Z | Della (GPT-6.1-Sol, ludwig-0035) | Vikunja 460 email settings focused corrections | REQ-WAIT-2/3 checked at db1e7732a; Jason PRD approval gate restored. Parser/attachment settings/defaults and reviewed resource bounds explicit; Q8 retained as Jason choice. Static docs verification only; corrected pin pushed on della/email-plan for focused Ludwig/Mos review.

docs/plans/2026-10-21_email-plan.md

@@ -149,8 +149,9 @@ activation establishes a from-now baseline without actions on old mail. Historic
 approved time/count window, previewed before activation. Cap violations, disk-full and unavailable audit
 storage hold work without advancing past unstaged mail. Mail-owned limits/caps/scopes are settings with
 these defaults, not hardcoded policy; tuning cannot override the Q198 manager contract.
-Human-only audited CLI, then Console, changes may tune them within validated resource bounds; agents cannot
+Human-only audited CLI, then Console, changes tune settings within resource bounds set by implementers and
-change protective settings. Missing/invalid settings fail closed. Changes never bypass grants or hard waits.
+reviewers in the versioned schema, backed by resource-exhaustion tests in E01/E04; widening bounds needs a
+reviewed schema/test change. Agents cannot change protective settings; invalid settings fail closed. No gate bypass.
 
 Provider identity is scoped to business/source/account: Graph immutable ID, IMAP folder/UIDVALIDITY/UID or
 POP3 UIDL. RFC Message-ID, thread ID and content similarity are secondary correlation signals, never sole
@@ -162,8 +163,9 @@ expiry. Replay needs a new authorized intent, parent link and current grants. A
 executes preview work.
 
 **D5 Parsing and rules.** Preserve provenance for normalized sender, recipients, timestamp, subject, text,
-thread references and attachment descriptors. Bound MIME depth to 10, parts to 100 and normalized text to 256
+thread references and attachment descriptors. Human-tunable settings (D4) default to `parserInputBytes: 30 MiB`,
-KiB. Decode safely, flag malformed or truncated content and quarantine failures. Prefer text, sanitize HTML
+`mimeDepth: 10`, `mimeParts: 100`, `normalizedTextBytes: 256 KiB`. E04 tests changed values and bound refusals.
+Decode safely, flag malformed/truncated content and quarantine failures. Prefer text, sanitize HTML
 for display, disable remote images/URLs and never execute active content. Rules use finite allowlisted
 fields/operators, stable priority and first-match by default. Reject executable rules and unbounded regex.
 Record rule/version and routing reason. Unmatched mail is held for its authorized owner, not dropped or copied
@@ -185,7 +187,8 @@ intake working and model-dependent work held. Summaries/drafts run as ordinary g
 extra mail-service model client.
 
 **D6 Attachments.** Initially enumerate metadata only. An authorized explicit fetch quarantines bytes under an
-opaque ID, with a 10 MiB per-part and per-message total cap. Raw quarantine fetch needs no scanner. It never
+opaque ID; human-tunable `attachmentPartBytes` and `attachmentMessageBytes` each default to 10 MiB (D4 bounds).
+E04 tests changed caps and out-of-bounds refusal. Raw quarantine fetch needs no scanner. It never
 implies permission to expose extracted content. Read-only files are not execution prevention.
 Scanner/extraction is gated E16. Never trust filenames as paths, unpack archives, execute macros or follow
 embedded links. Content extraction requires isolated no-network processing, resource bounds, scanner success
@@ -234,7 +237,7 @@ every user's mail. Cross-business IDs return no data.
 New mediated access uses proposed `mail.access`, distinct from provider credential creation through
 `credential.mint`. The chief raises it to the authenticated human Approve path, with exact
 principal/target/rights/expiry bound once. Add its access grant schema and action routing only through a
-approved post-v1 PRD version and reviewed vocabulary/role changes. Until then new actions remain hard waits.
+Jason-approved post-v1 PRD version and reviewed vocabulary/role changes (REQ-WAIT-2/3). Until then hard waits apply.
 Grant creation stays human-only. Read/draft actions become routine only inside approved grants. Manual mode needs
 per-use approval. A hand-edited grant or approving email creates no authority.
 
@@ -350,40 +353,38 @@ expansion of this add-on.
 
 ## Decisions and settings (stable Q1-Q11 identifiers)
 
-Q217/Q222 settle Q1/Q2; mos-1303 separates settings from external decisions. Proposed schema names/defaults
+Q217/Q222 settle Q1/Q2; mos-1303 separates settings from external decisions. Schema names are proposals.
-are not implemented commands. Changes are validated, revisioned and audited with human identity; agent-origin
+Changes are validated/revisioned/audited with human identity; agent proxies cannot pose as human writers.
-calls/proxies cannot pose as human writers. Configuration never replaces grants, PRD or external authority.
+Configuration never replaces grants, PRD or external authority.
 
-1. **Q1 CLOSED, Q217:** one agent mailbox on woltje.com at InMotion; Jason creates it and places its
+1. **Q1 CLOSED, Q217:** Jason creates/names one agent mailbox on woltje.com at InMotion and fills its protected
-   credential in the protected slot named by the enrollment row. No agent account creation, catch-all or MX
+   slot. No agent account creation/catch-all/MX change; aliases after delivery proof. Verify protocol before pilot.
-   change. Jason names the address at provisioning; aliases follow proven delivery. Verify protocol before pilot.
+2. **Q2 CLOSED, Q222:** no personal mailbox now. Per-source `mailboxScope: []` defaults none; exact IDs are
-2. **Q2 CLOSED, Q222:** no personal mailbox for now. Per-source `mailboxScope: []` reads none by default;
+   human CLI/Console settings (D1/E02/E13). Later personal enrollment needs user consent/delegation and grants.
-   exact agent/user mailbox IDs are human configuration, CLI first and Console later (D1/E02/E13), never code
-   constants. Later personal enrollment requires that user's consent/delegation and existing grant checks.
 
 ### Group (a): Q3-Q7 settings and ordinary technical review
 
 | Item | Setting and default | Who may change it; remaining boundary |
 | --- | --- | --- |
 | Q3 source mutation | `sourceMutations: []`; sources read-only, drafts/ack local | Human-only configuration within reviewed adapter capabilities. No mutation capability is implemented in this increment. Enabling provider writes needs a reviewed extension and exact provider authority; this setting cannot enable sending or override R21. |
-| Q4 service/access | `sourceEnabled: false`, `mailboxScope: []`, access grants empty, `accessMode: manual` | Authenticated human changes source settings; chief raises exact per-principal grants and human approves through existing approval boundary. `mail.access`, service principal, mail-source kind and closed decision schema still require approved PRD/vocabulary extensions before integration. That governance review is development work, not a fresh mailbox/provider choice for Jason. No self-grant or source credential shared with agents. |
+| Q4 service/access | `sourceEnabled: false`, `mailboxScope: []`, access grants empty, `accessMode: manual` | Authenticated human changes source settings; chief raises exact per-principal grants and human approves through existing approval boundary. `mail.access`, service principal, mail-source kind and closed decision schema still require approved PRD/vocabulary extensions before integration. Routing `mail.access` out of hard waits requires a PRD version Jason approves under REQ-WAIT-2/3: an existing gate, not a new Q number. Q211 is not assumed to waive it. No self-grant or source credential shared with agents. |
 | Q5 unattended wake | `unattendedWake: false`, `wakeSenderAllowlist: []`, route table empty | Human-only CLI/Console writer. When enabled, require allowlist AND trusted aligned DMARC, approved route/current grant, restricted profile and Q198 admission. Manual mode prevails; ambiguous/failing mail holds. No per-message Jason question inside this approved envelope. |
 | Q6 retention | `persistContent: false`, `bodyDraftDays: 30`, `attachmentDays: 7`, `metadataDays: 365`, `automaticPrune: false` | Human-only writer, respecting holds and approved retention authority. Metadata-only default; encrypted content only within approved authority. Settings never grant `data.delete`; exact deletion approval or explicitly approved retention authority, backup/key expiry and restore suppression remain required. |
 | Q7 dependencies | `sourceAdapter` unset until human enrollment; reviewed exact-pinned IMAP/MIME modules, initially imapflow/mailparser candidates | Humans select enrolled adapters via CLI/Console. Implementers/reviewers choose and pin maintained modules under repository license/security checks in E04/E06; not a Jason product question. Paid dependencies or external services go to group (b). |
 
 ### Group (b): real Jason decisions, only when needed
 
-**None is needed to build Q3-Q7 with these defaults.** Mos asks one at a time if a later increment requires:
+**No new external question is needed for default offline work.** Existing Q4 approval is still required;
+Mos asks one at a time if a later increment requires:
 
 - A new provider account/license, paid dependency/service, new spending, or outside-party permission beyond
   Q217's Jason-created mailbox. Recommend use the existing InMotion service and free reviewed dependencies.
-- New public exposure, listener/webhook, DNS/MX or additional addresses/accounts. Recommend none; outbound
+- New exposure/listener/webhook/DNS/MX/addresses/accounts: recommend none. Q217 creation is Jason’s existing task.
-  monitoring and internal alerts suffice. Q217's mailbox creation remains Jason's task, not a new question.
 
-Q4 PRD/grant and Q6 deletion/retention gates persist. This authorizes no live connection; offline work proceeds.
+Q4 Jason PRD approval/grants and Q6 deletion gates persist. No live access is authorized; offline work proceeds.
 
-8. **Q8 Attachments:** metadata first; explicit capped raw quarantine fetch. Optional E16 extraction needs
+8. **Q8 Attachments:** metadata first; capped raw quarantine fetch. Extraction remains Jason’s choice (E16),
-   isolation/scanning, no execution/archive expansion. Spend/exposure follows group (b).
+   with isolation/scanning, no execution/archive expansion. Group (b) is not the full list of Jason gates.
 9. **Q9 Exposure/spend:** none initially; later changes need their own authorization as group (b) describes.
 10. **Q10 Sending:** remains out of scope. Recommend no sending/forwarding/replying; R21 remains permanent
     for the specialist. Any future separate sender needs its own plan and exact-recipient human approval