Every email Clozo sends, in one table

Three properties hold across every email Clozo dispatches:

1. Idempotency by design. Every send is wrapped in the _claim_email_field() pattern ([D-070]). Before the task assembles a message, it atomically flips a per-row timestamp from NULL to now(). If a Celery retry, a webhook replay, or a manual re-fire arrives after the field is already claimed, the second attempt exits silently — your client never receives a duplicate.

2. Attachments come from R2, not memory. PDFs are rendered once (when the underlying event fires) and uploaded to immutable Cloudflare R2 storage. The email task downloads the bytes from R2 at send time; if R2 is briefly unreachable, the task retries with exponential backoff up to three times. This separation means a slow Gotenberg render never holds up the email queue.

3. Locale resolves once, on the proposal. When a client first signs (or when you set the proposal language), the locale is pinned to the proposal record. Every subsequent email — reminder, refund, amendment — looks up the same value, so a client never receives an English deposit invoice followed by a German final-invoice reminder.