Inbound boundary

A submission must reference an authorized order/product and pass MIME, size, rate and quota checks. Files enter protected quarantine and do not become Documents automatically.

Scanner gate

Approval fails closed until the configured scanner returns an accepted clean result. The scanner adapter is implemented, but broad production malware-scanning claims remain blocked until a named provider passes the qualification matrix.

Staff review and retention

Reviewers approve or reject submissions explicitly. Notifications are templates, not evidence that a mail provider delivered them. Schedule retention cleanup and verify WordPress privacy export/erasure behavior.