01must proveProposed | Dispatch briefly claims workspace entries, publishes batches of ten outside a transaction and deletes only acknowledged entries; Rejected entries await another run; claimed entries are left alone; Scheduled dispatch visits all workspaces, while a nudge targets one. no proof recorded yet | policy | service, database | test |
02must proveProposed | A crash after publication but before deletion leaves the entry available for recovery; repeated processing avoids duplicate records. no proof recorded yet | invariant | service | test |
03must proveProposed | A redelivered item whose request already exists makes no further records and only nudges dispatch. no proof recorded yet | invariant | service, database | test |
04Proposed | The request consumer acknowledges recorded and unreadable items; future work receives visibility until due, or a new delayed copy when another receive would exhaust it; Item exceptions are reported independently so other batch items proceed. | policy | service | test |
05must proveProposed | Nightly reconciliation at 03:40 UTC runs per operational workspace; Sending deliveries ambiguous for fifteen minutes fail without resending; chat or text work lost for over an hour is requeued; unprocessed queue entries past expiry become expired requests. no proof recorded yet | lifecycle | service | test |
06must proveProposed | Retention removes requests, deliveries, events and notice keys older than thirteen calendar months in batches; Text challenges disappear one day after expiry; Notice partitions retain thirteen months and prepare two ahead; inserts without a partition fail. no proof recorded yet | lifecycle | service, database | test |
07must proveProposed | Workspace deletion purges notification data; reset clears notices and delivery work but preserves configuration, personal preferences and text-usage accounting. no proof recorded yet | lifecycle | service | test |
08must proveProposed | The approved restriction excludes message bodies, addresses and tokens from logs and metrics. no proof recorded yet | invariant | service | documented |
09must proveProposed | Workspace tables apply row-level security; Recorded exceptions cover the shared definition registry and reconciliation job root; steps and events inherit job ownership instead of separate workspace identifiers. no proof recorded yet | invariant | database | test |
10must proveProposed | Deployment defines an operations-paging alarm when the notification dispatcher records no run in a fifteen-minute interval, treating missing metric data as a breach. no proof recorded yet | policy | service | observed |
11must proveProposed | Deployment defines an operations-paging alarm when nightly notification reconciliation records no scheduled run for two consecutive days, treating missing metric data as a breach. no proof recorded yet | policy | service | observed |