# PHASE 11: EMAILS, WHATSAPP AND CUSTOMER COMMUNICATION

Read `docs/01-BUSINESS-REQUIREMENTS.md` and decision D-18.

## Scope

The five customer notifications, styled to the brand, plus WhatsApp links and the Track Order page.

## Build

1. `WC_Email` subclasses registered on `woocommerce_email_classes`, with actions on `woocommerce_email_actions`, for: Order received, Order confirmed, Order shipped, Order delivered, Order cancelled.
2. Email templates overriding the WooCommerce base, styled to the design tokens but kept table-based and email-client-safe. **No web fonts, no CSS grid, no flexbox** in email HTML.
3. Every email includes: order number, items with variation, totals in PKR formatted correctly with the Rs prefix, delivery address, the COD amount to keep ready (this cuts door refusals), the WhatsApp support link, and the courier and tracking number where set.
4. The confirmation email states the COD amount explicitly: "Please keep Rs 4,850 ready for the rider."
5. `BC_Notifier_Registry` with `BC_Notifier_Interface`, and `BC_Email_Notifier` as the first implementation. WhatsApp and SMS notifiers register later against the same interface without touching this code. **Do not build a WhatsApp API integration**, click-to-chat links only (decision D-21).
6. Admin notification on a new order, with the verification trigger named in the subject line when one fired.
7. The Track Order page: order number plus phone number, no login, showing status, courier, tracking number and a link to the courier's tracking page. Rate limited, five attempts per IP per fifteen minutes, and it must not leak whether an order number exists when the phone does not match.
8. WP Mail SMTP configured, documented in `deploy/deploy-notes.md` with the exact SPF, DKIM and DMARC records to add. **The SPF record must include the relay, not the web host**, because that is where the mail actually originates. With Brevo that is `v=spf1 include:spf.brevo.com ~all`; with SES, `include:amazonses.com`. Including only `spf.web-hosting.com` fails SPF on every order email, which is precisely the spam problem this exists to prevent. DKIM likewise signs at the relay, so publish Brevo's or SES's own CNAME records, not cPanel's key.

## Static content pages

Decision D-26. These are linked from the footer, the mobile drawer and the product page from phase 4 onward, and a dead link in the footer of a COD store is a trust failure.

9. `BC_Pages_Installer` fills the pages created as empty in phase 4: Size Guide, Delivery and Payment, Returns and Exchange, About, Contact, Privacy Policy, Terms.
10. **Size Guide** carries the real dimension table for Single, Double, Queen and King, in both inches and centimetres, from open question 17. It is read before purchase and it is the cheapest way to reduce wrong-size returns.
11. **Returns and Exchange** carries the policy from business requirements 4.6 verbatim, including the hygiene exclusions. Do not soften it and do not invent terms.
12. **Delivery and Payment** covers the delivery estimate by city tier, the flat fee, the free shipping threshold and how COD works at the door.
13. **Contact** is a simple form, a shortcode plus `wp_mail()` with a nonce and a honeypot, not a form plugin, plus the real phone, WhatsApp link and address.
14. Where the client copy has not arrived, ship a short honest placeholder and add a line to `docs/10-OPEN-QUESTIONS.md`. Never lorem ipsum, never a broken link, never invented policy terms.

## Acceptance criteria

- [ ] All five emails send at the right status transition and only once each
- [ ] Emails render correctly in Gmail web, Gmail Android, Outlook and Apple Mail
- [ ] PKR amounts format correctly in every email client
- [ ] The COD amount line appears in the confirmation email
- [ ] Test emails reach the inbox, not spam, in Gmail, Outlook and one Pakistani ISP address
- [ ] Tracking number appears in the shipped email and on the Track Order page
- [ ] Track Order returns nothing for a valid order number with a wrong phone, and does not reveal that the order exists
- [ ] Track Order rate limiting works
- [ ] All seven static pages exist, are published, and every footer and drawer link resolves
- [ ] The Returns page matches business requirements 4.6 word for word
- [ ] The contact form sends, is nonce protected, and has a honeypot
- [ ] The notifier interface is documented well enough that adding an SMS notifier touches no existing file

## Stop

No analytics, no schema. Next phase.