[goetchstone]

Asked after the report's first use: the lists were messy with many emails of one subject; "a clean way to know who actually got a message and needs to be warned", "if it bounced, they did not get it", and "a list that can be imported so we can send the email either way, even if we did warn already".

• IncidentReport.gotIt: across every email the attacker sent, each address once: a receipt here, or a send nothing in the logs read says failed. A bounce, a quarantine or a rejection didn't get through. Still to warn if not shown warned of any of them; warned if of all; first contact from here the earliest.
• Respond: Everyone it got to, above Who it reached: the counts, Copy Addresses (for a Bcc) and Export for Import… (CSV, Email first). Reads only: nothing is sent.
• Report: "Got an email of the attacker's" and "Got it, outside" replace the received/bounced/quarantined numbers; the emails list is a row each; the export adds who-got-it.csv and emails.csv, and keeps who-it-reached.csv (every address, bounces too) as the record.
• Who it reached's own to-warn rule (over-warning) is unchanged.
• Tests: IncidentReportTests.everyoneItGotToOnceEach and the report's numbers on the one-row-an-address lists. Suite green locally (902), app builds. Not checked against the live tenant.
• Accessibility: both buttons have hints; the result of a copy or export is announced and shown in words.
• Screenshots of Respond and Report follow in a docs PR from this one's CI run once it merges.

🤖 Generated with Claude Code