Fence Campaign delivery effects in recovery ledger

2026-08-03 03:48:03 +02:00
parent dd09b06c47
commit 9da03090a7
7 changed files with 821 additions and 39 deletions
@@ -65,6 +65,17 @@ Before the first live send for a sender domain or mail-server profile:

 ## Outcome Handling

+Each real Campaign job delivery is represented by a Core recovery-ledger
+operation before the worker claims the job or invokes Mail, Postbox, or print.
+Synchronous batches use the same boundary after their batch-wide preflight.
+Explicit test/resend actions and post-acceptance IMAP appends use separate
+action-fenced operations. Operations store only opaque IDs, digests, channel
+policy, and bounded status evidence. A verified acceptance becomes
+`succeeded`, a definitive pre-effect or provider rejection becomes `rejected`,
+and uncertain or stranded effects remain `outcome_unknown` or
+`recovery_required` in Ops. Campaign jobs, message actions, and channel-attempt
+records remain the business source of truth.
+
 - `smtp_accepted`: Do not retry. If IMAP append is enabled and pending, run or
  enqueue the append action.
 - `failed_temporary`: Retry explicitly after checking the error and retry count.