01must proveProposed | Minute scheduling and post-commit nudges run oldest-first workspace dispatch under short claims; only pointers reach the queue; acknowledged rows are deleted, refused rows remain until claim expiry, concurrent claims stay exclusive and time exhaustion stops before the next workspace. no proof recorded yet | policy | service, database | test |
02must proveProposed | Request processing handles one item at a time and skips final messages on redelivery; Potentially in-flight submissions wait through the ambiguity interval before the separate resubmission recovery applies. no proof recorded yet | invariant | service, database | test |
03must proveProposed | Throttling stops the remaining sends for that receive and retains their draft state until backoff retry; On receive eight, refused sends fail as exhausted, untouched messages are attempted and the item is dead-lettered. no proof recorded yet | policy | service | test |
04must proveProposed | Operator redrive reoffers exhausted messages only; provider-accepted and permanently refused messages remain final. no proof recorded yet | lifecycle | service | test |
05must proveProposed | A final pre-send check expires overdue messages without an attempt and withholds newly suppressed or reserved-domain recipients with a reason. no proof recorded yet | validation | service | test |
06must proveProposed | An uncertain submission waits through the ambiguity interval before its unknown attempt closes and a new claim can submit again; Provider send feedback can complete it during the wait. no proof recorded yet | policy | service | test |
07must proveProposed | Message-update permission permits cancellation only while a message is draft; Withheld, cancelled and submitted messages cannot be cancelled. no proof recorded yet | lifecycle | api, service | test |
08must proveProposed | Purpose classification selects a distinct Marketing lane rather than trusting request input; Marketing traffic cannot enter the transactional queue or occupy its front positions. no proof recorded yet | policy | service | test |
09must proveProposed | Transactional traffic reserves forty percent of account rate and can borrow unused Marketing capacity; Marketing is capped at sixty percent without borrowing; a lane without a previously read rate remains unlimited. no proof recorded yet | calculation | service, database | test |
10must proveProposed | Rate-budget waits remain inside the invocation when time permits, otherwise returning work to its lane with a delay that does not spend a retry; Completed sends are skipped on return. no proof recorded yet | policy | service | test |
11must proveProposed | Marketing pauses at ninety percent of the twenty-four-hour account quota and resumes below that threshold; Transactional processing continues. no proof recorded yet | policy | service | test |
12must proveProposed | Marketing requests require subscription classification and unsubscribe targets; other requests prohibit them; Delivery adds List-Unsubscribe and enables one-click unsubscribe for HTTPS targets. no proof recorded yet | validation | service | test |
13Proposed | Current lane scheduling does not guarantee equal workspace shares. | policy | service | documented |
14Proposed | Provider submission includes the configuration set and correlation tags used to locate the message and workspace in feedback. | policy | service | test |