Note that Mail still fails after the sender fix, with a different signature

Live logs post-redeploy show a bare Tomcat 400 (no Catalyst JSON error),
not a verification/scope error -- confirmed the SDK's own request-building
logic is correct by reading zcatalyst_sdk/email.py directly. Points to Mail
not being fully provisioned for the project, same shape as Cache, distinct
from Stratus/SmartBrowz's proper OAUTH_SCOPE_MISMATCH JSON response.

Author: SarmaHighOnCode

docs/CATALYST_TEAMMATE_ACTIONS.md

@@ -90,7 +90,9 @@ Live logs (2026-07-13 20:29) show both failing with **HTTP 401 `OAUTH_SCOPE_MISM
 **Steps:**
 1. Go to `https://api-console.zoho.in` (a different site from the Catalyst project console — this is Zoho's org-wide API/developer console).
 2. Sign in with the same account, find **Self Client** under your registered clients — it should be the one originally used to set up this project's `CATALYST_AUTH` (or similarly-named) credential/refresh token.
-3. Self Clients issue access via a **Generate Code** flow with a scope picklist. Generate a new grant token that includes every scope currently working (Mail, Data Store/ZCQL, Cache) **plus** the Stratus and SmartBrowz/Browser360 scopes (look for entries containing "Stratus" and "Browser360" or "SmartBrowz" in the scope list — pick the `.CREATE`/`.READ`/`.ALL` variant offered).
+3. Self Clients issue access via a **Generate Code** flow with a scope picklist. Generate a new grant token that includes every scope currently working (Data Store/ZCQL) **plus** the Stratus and SmartBrowz/Browser360 scopes (look for entries containing "Stratus" and "Browser360" or "SmartBrowz" in the scope list — pick the `.CREATE`/`.READ`/`.ALL` variant offered).
+
+Note: this is specifically a *scope* fix, evidenced by Stratus/SmartBrowz returning a proper Catalyst JSON error with `error_code: OAUTH_SCOPE_MISMATCH`. Mail (#9) and Cache (#7) fail differently — a bare servlet 400 HTML page with no Catalyst JSON at all, meaning those requests never reach Catalyst's API layer to even be scope-checked. That points to a *different* root cause (the service not being added/enabled for the project at all, not a token scope gap) — don't assume regenerating this token also fixes Mail/Cache.
 4. Exchange that grant code for a new access+refresh token (Zoho's standard OAuth token exchange — if unsure how, this is the same flow used whenever `CATALYST_AUTH` was first set up; whoever did that setup will recognize the steps).
 5. Update the refreshed credential into whichever AppSail environment variable holds it, then redeploy (see #1).
 
@@ -100,9 +102,19 @@ If Catalyst's *project* console instead has its own embedded "API Console" / "Cl
 
 ---
 
-## 9. Mail sender — DONE
+## 9. Mail — sender switched, but STILL broken (new failure signature, not code)
+
+`backend/app/routers/notify.py`'s `send_mail()` now uses the verified `team@strawhats.co.in` as `from_email`. That part is done and confirmed deployed (logs show the new address in the request body). But live logs (2026-07-14 10:31, post-redeploy) show it's still failing — now with a **bare Tomcat `HTTP Status 400 – Bad Request` HTML page**, not a Catalyst JSON error with a code. That's a different, more concerning signature than before: it means the request never reaches Catalyst's own validation/error layer at all.
+
+Read the actually-installed SDK (`zcatalyst_sdk/email.py`) directly to rule out a code bug: the multipart body `send_mail()` builds for a single recipient is well-formed and matches the SDK's own `_generate_data()` logic exactly. **This is not a malformed-request bug on our end.**
+
+Given the failure shape matches Cache's (confirmed not provisioned for this project) rather than a scope/auth error, the likely explanation is that **Mail itself may not be fully enabled/provisioned as a project component**, separate from adding a verified sender inside it.
+
+**To check:**
+1. Confirm the verification for `team@strawhats.co.in` actually completed — Catalyst typically emails a confirmation link to that inbox; if nobody clicked it, it may still show "pending."
+2. Check whether Mail shows as an added/enabled component for this project at all (Ctrl+K → "Mail" → look at the service's main/overview page, not just the Senders tab, for anything resembling an "Add Service"/"Enable" step).
 
-`team@strawhats.co.in` is verified in Catalyst Mail. `backend/app/routers/notify.py`'s `send_mail()` now uses it as `from_email` instead of the never-verified `kaval-noreply@kaval.ksp.gov.in`. Nothing further needed here — re-test via the Dashboard's "Email me today's brief" button after the next AppSail redeploy.
+If both are confirmed and it's still a bare 400, screenshot the Mail service's main page (not just Senders) for further diagnosis.
 
 ---