Outbound mail log

The vault keeps a record of every mail it sends — who it went to, what

kind of mail it was, when, and whether it arrived at the relay. The

record is metadata only: no subject, no body, and never a sign-in code,

so the log can answer "what did the vault send and did it bounce"

without becoming a second copy of anything the vault protects. "Sent"

means the customer's relay accepted the message; a recipient the relay

refuses on the spot is recorded as bounced with the SMTP reply code

alone, and a mail that could not even be attempted is not pretended

into the record at all. Resending an invitation issues a fresh

temporary password, so an invitation that already reached the relay is

not resendable from the page and the vault refuses it: re-inviting a

delivered address stays possible, but only as a deliberate act asked

for one message at a time, recorded as one.

Given a vault whose mail relay accepts messages
When the vault mails a sign-in code
Then the outbound log remembers exactly one send marked sent

A refused recipient is remembered as bounced, reply code only

Given a vault whose mail relay refuses the recipient
When the vault mails a sign-in code
Then the outbound log remembers the mail as bounced
And the log carries the refusal code but none of the relay's words

A vault that cannot attempt delivery records nothing

Given a vault with no mail relay configured at all
When the vault mails a sign-in code
Then the refusal is honest and the outbound log stays empty

A mistyped invitation is corrected and sent again

Given an invitation that bounced because the address was mistyped
When the administrator fixes the address and resends it
Then the same account is re-invited at the corrected address
And the new record points back at the message it retries

Given a sign-in code that bounced
When the administrator tries to resend it
Then the vault refuses and explains that sign-in codes are single-use

An invitation that already arrived is not resent by accident

Given an invitation the relay accepted and delivered
When the administrator selects it and resends
Then the vault refuses and the password that person already has still works

Re-inviting a delivered address is possible, but only on purpose

Given an invitation the relay accepted and delivered
When the administrator deliberately asks to re-invite that address
Then the person is re-invited and the record shows it was deliberate

A correction that is not an address changes nothing

Given an invitation that bounced because the address was mistyped
When the administrator fixes it to something that is not an address
Then the vault refuses and the account is left exactly as it was