An animated widget with a fixed-height desktop background. Clicking a notification reveals a vertical list of seven envelopes shown as plain large mail icons next to their sender and subject in light text. Opening one smoothly expands it into a realistic corporate email on the left (two-thirds width) and a solid accent-blue "Quick check" UI panel on the right (one-third width) with white pill-shaped answer buttons; selecting one fills its background with a color reflecting how correct the answer is, and a larger left-aligned white caption appears below explaining the result. The other six emails shrink into thin single-line bars so the widget height never changes and there is no scrollbar. Two emails are phishing attempts using ordinary underlined text links rather than buttons, with subtly misspelled domains; two are suspicious-looking but legitimate internal or vendor emails; three are normal safe emails from named colleagues with full job titles. Clicking a suspicious part of an email applies a soft blue-gray highlight and shows an explanation popup: red for genuine phishing danger, blue for neutral context notes on legitimate emails. That popup flips below the text if there is not enough room above, and clicking the same part again dismisses it. Switching to a different email automatically clears any lingering popup and highlight from the previous one. If the reader answers a phishing email incorrectly, the red-flag phrases briefly pulse with the same highlight a few times.