Operators + developers / operational truth

Operations

Treat every status as a fact with a timestamp, owner, and next action. “Available” is not the same as “ready to send.”

Readiness layers

• Workspace: billing access, owner role, and current plan limits.
• Mailbox: provider connection, sender identity, authentication, and import freshness.
• Audience: source, deduplication, suppression, consent, and required fields.
• Campaign: preview, variables, claims, links, and explicit approval.

Limits and backoff

Read used, limit, remaining, and reset_at from the billing usage response before planning work. On 429, respect Retry-After; do not split a run or replay a mutation to bypass a limit.

Receipts and evidence

Keep the operation id, run id, idempotency key, final status, and event trail together. A provider-dependent or stale state must remain visible in the receipt; never replace it with a synthetic success.

Suppression

Suppression is a product safety boundary. A suppressed address remains suppressed across imports, drafts, and sends. Escalate a mismatch to the owner rather than deleting the record.