limit possible state transitions of emails

and some tests for that