# Email and outbound message

**Test family:** `OUT`

- **OUT-001** Correct sender/from/reply-to/to/cc/bcc, subject, text/HTML bodies, encoding, links, attachments, and headers.
- **OUT-002** Empty/invalid/suppressed/unverified/unsubscribed recipients follow channel and consent policy.
- **OUT-003** Personalization variables and conditional blocks handle missing/hostile values without cross-recipient leakage.
- **OUT-004** Preview/test-send/scheduled/final send use the intended audience and content version.
- **OUT-005** Retry after timeout/provider error is idempotent or clearly at-least-once; duplicates are detected.
- **OUT-006** Bounce, complaint, block, unsubscribe, and provider suppression update future eligibility and audit.
- **OUT-007** Bulk send does not expose recipient list, exceed consent/schedule limits, or let one bad recipient fail all.
- **OUT-008** Tracking links/pixels, unsubscribe, privacy, and tenant domains follow policy.

## Comprehensive per-item coverage

- **OUT-009** Create absent, empty, ordinary, boundary-size, and over-limit content; distinguish missing data, empty content, and intentionally blank content.
- **OUT-010** Use ASCII emoticons such as `:)`, `:-)`, `;)`, `:D`, `:(`, and `<3`; preserve them exactly or reject them with a specific product rule.
- **OUT-011** Use kaomoji and complex emoji including skin tones, flags, keycaps, variation selectors, and ZWJ sequences; preserve complete graphemes.
- **OUT-012** Use accents, decomposed forms, CJK, Arabic, Hebrew, mixed direction, confusables, and invisible characters; keep rendering and identity unambiguous.
- **OUT-013** Use long words, many short lines, one long line, tabs, mixed line endings, trailing spaces, and control characters through every supported transport.
- **OUT-014** Use inert HTML/script, Markdown, template, SQL, command, path, CSV-formula, header, and log-forging canaries; never execute content as control.
- **OUT-015** Compare typing, paste, rich paste, upload, import, API, mobile, automation, and migration paths; apply the same content contract.
- **OUT-016** Save, preview, reopen, edit, copy, quote, reply, forward, notify, search, index, export, and delete; preserve intended content and access.
- **OUT-017** Verify content encoding, charset declaration, BOM, compression, chunking, multipart boundaries, and transcoding do not corrupt data.
- **OUT-018** Attempt access as owner, collaborator, removed member, external guest, anonymous viewer, and another tenant; reauthorize every delivery path.
- **OUT-019** Change access after a link, preview, notification, or cached representation exists; revoke stale copies where the contract promises it.
- **OUT-020** Edit concurrently, retry after timeout, and resubmit the same content; avoid silent overwrite, duplicates, and reordered versions.
- **OUT-021** Force storage, scanner, renderer, indexer, notification, export, and downstream integration failures; expose partial state and recovery.
- **OUT-022** Test keyboard, screen reader, zoom, reflow, high contrast, reduced motion, captions/alternatives, and focus for creating and consuming content.
- **OUT-023** Translate UI and content, switch locale and direction, and render unsupported glyphs; preserve data even when fonts or layout degrade.
- **OUT-024** Measure create, upload, render, search, download, and delete latency at normal and supported boundary sizes.
- **OUT-025** Inspect URLs, metadata, filenames, previews, logs, telemetry, caches, backups, notifications, and exports for sensitive-content leakage.
- **OUT-026** Apply malware, abuse, spam, moderation, and policy handling without exposing scanner details or destroying innocent content silently.
- **OUT-027** Delete, restore, expire, retain, place on hold, export, and purge content; make user-visible state match storage and legal policy.
- **OUT-028** Verify hashes, sizes, versions, ownership, timestamps, and audit events across replicas and transformations so corruption is detectable.

[Back to Files, content, import/export, and messaging index](../../files-content-messaging.md)
