Roles changed contract

Purpose/audience: The affected existing collaborator ($user->email).

Implementation: App\Mail\ChangeInvite. Baseline view: resources/views/emails/users/ChangeInvite.blade.php. Usage evidence: app/Http/Controllers/Settings/invitationsController.php:712. These are static references, not proof of current production delivery.

Suggested subject: Your roles have been changed. HTML title alone does not set the mail header.

Suggested preheader: The owner of {{business_name}} changed your roles on Built.

Portable placeholder contract

Token	Existing source / derivation	Requirement
{{logo_url}}	Existing Built app_name PNG	Optional deployment override; the concrete project HTTPS PNG is the default. Approved HTTPS or matching CID only.
{{preheader}}	Suggested text above, assembled only from already available values	Required escaped text; not a new backend record or processing guarantee.
{{business_name}}	$business->name	Required escaped business identity; do not substitute the recipient name.
{{first_name}}	$user->first_name	Required escaped name of the affected user.

Content, states and integration decisions

The source only says that the owner changed the affected user’s roles. It does not supply old/new roles, permission names, a review URL or a timestamp. Do not invent a comparison table or View details button.
The caller queues this Mailable. Preserve business From and business-email-or-owner Reply-To. The business name stays visible in the body rather than repeated as a separate decorative sign-off.
States: standard and long first/business names. This notice does not establish access revocation, account suspension or an action the recipient must take.

Portable HTML/text and safe handling

ready/roles-changed.html and ready/roles-changed.txt provide the portable extracts. Every populated state has matching .html and .txt files under previews/. All sample links are local design explanations; no real invitation, report or account action is executed. Placeholder {{names}} are not automatically Laravel Blade syntax. Convert each mapping explicitly using existing data and server-side URL generation; retain all required values and do not insert untrusted raw HTML.

Escape text and attribute values. Validate any application/CFO AI URL separately against approved HTTPS hosts before escaping it; preserve complete generated links and encrypted/signed parameters. Use the provided concrete public PNG or an approved HTTPS/CID override. There are no hidden optional content sections to populate here; required identities/counts should not be silently omitted. Unsupported data has not been invented.

All drafts use the approved compact transactional shell with 16px body text, a minimal Built footer and native light/dark CSS. Email-client rendering and blocked-image behavior remain separate tests. See integration-notes.html for shared provider/image limitations, and easy-wins-batch.md for the whole batch. No production template, sender, transport or application behavior is changed.