fix(email-detail): make responsive evidence actions functional

CHANGELOG.md

@@ -1,4 +1,12 @@
 ## [Unreleased]
+### EmailDetail 반응형 실행 표면
+
+- 참여자와 첨부파일 증거를 모바일·데스크톱에서 동일하게 확인할 수 있도록 반응형 스크롤 레일과 명시적 접근성 이름을 추가했습니다.
+- 일정 충돌 패널의 `일정 조율` 버튼을 기존 calendar writeback intent에 연결하고, 서명된 서버 목록에서 사용자가 명시적으로 선택한 opaque `target_source_id`만 전송하며, source conflict 재확인·부분 실패·loading·disabled·live-status 상태를 검증합니다.
+- UI PR에 섞인 thread ID, SMTP allowlist, `.msg` import, tenant scope backend 변경은 정확한 `develop` 기준으로 제거했습니다.
+
+### 의미 단위 임베딩
+
 - 긴 이메일·첨부 본문을 의미 단위 청크로 임베딩한 뒤 기존 email/attachment 벡터 계약으로 평균화하고, 청크 요청·벡터 누적을 제한된 창으로 처리합니다. OpenAI `text-embedding-3-*`에는 저장 차원(`1536`)을 직접 요청하도록 보강했습니다. 합성 메일 fixture 5건(70청크)과 provider 요청 계약으로 1,536차원 벡터 경로를 검증했으며, 실행 시 선택한 임베딩 제공자에 본문·파싱된 첨부 텍스트를 전송할 수 있습니다. 회사 기밀 데이터는 fixture·commit·PR·log에 포함하지 않습니다.
 - EmailDetail 테스트가 지원하지 않는 스레드 병합/분리 버튼을 `textContent`뿐 아니라 `aria-label`과 `title` 접근 가능 이름으로도 검출하도록 바꿔, 아이콘 전용 버튼 회귀를 놓치지 않습니다.
 

docs/doctoring/email-detail-responsive-action-surface.md

@@ -0,0 +1,68 @@
+# EmailDetail responsive action surface doctoring
+
+## Decision
+
+The email detail view exposes participants and attachment names at every viewport
+size. Attachments use a horizontally scrollable, explicitly named region so a
+small viewport does not silently remove source evidence. The meeting-conflict
+panel reuses the existing calendar writeback-intent handler rather than rendering
+an inert call-to-action. The user must select an opaque source returned by the
+signed server registry before the action is enabled; every intent carries that
+exact `target_source_id`, and a source conflict clears the selection so the user
+must confirm the current source again. Mixed batch outcomes preserve successful
+intents, report the failed count, and never relabel a source identifier as a
+provider calendar-event identifier. Loading, disabled, and polite live-status
+states remain in the same product surface.
+
+Calendar-source state is keyed to the active email and actionable summary
+context. A navigation or summary-context change therefore derives an empty,
+non-confirmed loading or idle view immediately instead of reusing a source from a
+previous email. Registry success or failure publishes state only from the still
+mounted request for that exact context; stale requests cannot reactivate an old
+selection. This fail-closed lifecycle also avoids synchronous state resets inside
+the React effect while preserving explicit confirmation.
+
+Unrelated backend changes are excluded from this UI slice. Thread identifier,
+SMTP destination, import-format, and tenant-scope policy changes require their
+own security rationale and regression contracts rather than hitchhiking on a
+presentation PR.
+
+## Accessibility boundary
+
+The implementation preserves native button semantics and the repository's
+keyboard-visible focus system, gives the attachment evidence region an
+accessible name, and exposes asynchronous status through `role=status` and
+`aria-live=polite`. WCAG 2.2 is used as the current normative target. The focused
+regression proves discoverability and activation in the DOM, but this record does
+not claim full WCAG conformance without contrast, zoom, assistive-technology, and
+manual usability evidence.
+
+## Verification contract
+
+- The participant list renders without an unsafe type assertion.
+- The attachment rail is present and not hidden on small viewports.
+- The meeting action is disabled when no extracted action item exists, while the
+  request is pending, or until one current server-authorized source is confirmed.
+- Activating the meeting action sends the exact opaque `target_source_id` with
+  every writeback-intent request.
+- A `409` source conflict clears confirmation and requires explicit reselection.
+- Source state is never reused across email or actionable-summary context keys,
+  and an unmounted registry request cannot publish stale state.
+- Complete and partial batches produce distinct polite status evidence, and
+  analytics never treat `target_source_id` as a provider event identifier.
+- The three unrelated backend files are byte-identical to the exact PR base.
+- Frontend focused tests, full tests, lint, type checking, coverage collection,
+  and production build run before the verified commit is published.
+
+## References
+
+World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines
+(WCAG) 2.2*. https://www.w3.org/TR/WCAG22/
+
+World Wide Web Consortium. (n.d.). *Understanding success criterion 2.4.7:
+Focus visible*. Retrieved August 5, 2026, from
+https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html
+
+World Wide Web Consortium. (n.d.). *Understanding success criterion 4.1.3:
+Status messages*. Retrieved August 5, 2026, from
+https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html