What Mango is being built to do

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Mango’s mark, name and one newsletter description identify the installation.; The Lobby has only one action. Missing public-door journey: “Installation Lobby — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: The primary action opens the Run page; the run-site landing has no sign-in link.; The hero is the only top-level heading; the alternative sentence also ends the metadata description and names both replacement products.; The sections explain collection, writing, exact-letter approval, scheduling, delivery reporting and ownership, followed by a closing action.; The optional product credit appears only when the owner enables it; illustrative addresses, names, counts and dates are never records.; The static landing reads no operator, contact, campaign or session data and is written once by the site build.; Header Mango identity and links; Hero identity and exact alternative sentence; Hero actions and destinations; Footer deployment-owner name and description; Fixed page rather than a buyer page builder; No vendor pricing; No testimonials; No customer logos; No ratings; No metrics; No cross-store claims; No third-party brand logos; No optional commerce, SMS or AI advertising; No per-reader-send-time or provider-neutral-delivery advertising; Only specified link destinations; Fixed light palette in a dark-themed browser; Readable without scripts; Readable with reduced motion; Licensed self-hosted faces; Inline drawings without raster or embedded images; CSS-only once-only drawing motion; No motion for reduced preference; Motion never hides content. Missing public-door journey: “Newsletter landing — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Sole Sign in link; Shared footer, palette, faces and drawings; Every root, docs and top-level readme Markdown file is published or explicitly excluded with a reason; undeclared files, broken links or anchors, links to unpublished pages, raw HTML, forbidden images and absolute build-machine paths fail validation.; Published pages describe the default newsletter profile, expose no maintainer material and have no source-repository or edit link.; No documentation request reads workspace, session or database records.; Other-host behavior; Documentation is compiled before serving; Worker and browser outputs contain no Markdown or highlighter code, and individual page chunks are loaded lazily.. Missing public-door journey: “Public documentation — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Before role assignment, an operator can see and act on proposals, campaigns, flows, contacts and settings as Admin.; Valid identity already configured for the installation also completes setup.; Authenticated configuration APIs remain usable during setup, and completing setup does not claim provider readiness.. Missing public-door journey: “Operators and the default role — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Settings can invite an operator and remove an operator.; A session without fresh email proof cannot grant another operator access.; Settings can request a confirmation link bound to the current session; completing it permits an invitation retry.; Reading or inspecting the confirmation link has no effect; only its affirmative submission supplies proof.; Only the operator established at setup may remove that operator.. Missing public-door journey: “Management — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Every proposal remains attributed to the removed operator.. Missing public-door journey: “Removal does not rewrite history — complete acceptance”, covering the unasserted outcomes above.

Gap: BigCommerce (INT-003), Square (INT-005) and Stall (INT-006) remain unbuilt; Shopify's Owner Settings connection without a developer step remains unproved under INT-015.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Customer and refund replay update existing contents without duplicates. Missing public-door journey: “Source identity — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Case and whitespace canonicalization; Phone canonicalization; Phone identity uniqueness on capture and import. Missing public-door journey: “Contact identity — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Independent pending and SMS states; Cross-channel independence under store activity and consent. Missing public-door journey: “Channel status — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Recipient scope maintained; Missing evidence creates a non-subscribed contact, except for the incumbent-held evidence CONT-024 defines.; A reassigned phone or one no longer belonging to the recipient becomes non-subscribed until fresh evidence is captured.; Retained channel on capture and import; Retained brand or legal sender on capture and import; Retained SMS sender or program on capture and import; Retained message subject or category on capture and import; Retained frequency disclosure on capture and import; Retained destination jurisdiction on capture and import; Retained consent text on capture and import; Retained consent version on capture and import; Retained confirmation evidence on capture and import. Missing public-door journey: “Consent evidence — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Sync, store events, merge and operator edits retain the restriction; Parallel-run incumbent writeback. Missing public-door journey: “Opt-out precedence — complete acceptance”, covering the unasserted outcomes above.

Fresh-recipient consent and suppression resolution remain the required resubscription route. Unasserted in the cited evidence: confirmation later than the opt-out, refusal of an operator-only resubscription, and parallel-run subscribed-state writeback or its named fallback. Public-form and guarded-capture proof belongs to CONT-027 and CONT-028. Missing public-door journey: “Resubscription — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Soft-bounce recorded and visible; Consecutive soft-bounce policy suppresses; Confirmed delivery resets consecutive soft-bounce count; Incomplete provider webhook setup blocks approval; Refreshing local authentication/setup credentials preserves existing contact-hash restrictions, including restrictions without a remaining contact row.; Legacy local authority conversion preserves the original verified contact authority before credential rotation; unknown or missing authority refuses work rather than selecting an unused secret.. Soft-bounce progression and reset assertions are in outside the old Evidence set. Missing public-door journey: “Email suppression — complete acceptance”, covering the unasserted outcomes above.

acceptance not yet met: Signed SMS replies: STOP family opts out before acknowledgment, HELP and START never subscribe; proved on the Mobile Message adapter, Twilio pending (SMS-001).

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Every other event retains its source. Missing public-door journey: “Contact history — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Confirming request time read back; Pending channel cannot receive marketing; When confirmation is not required, recorded consent under CONT-003 subscribes the channel directly.; Reading and HEAD do not consume confirmation token; Suppression guard cannot be bypassed; Inactive identity cannot be confirmed; Operator-recorded SMS exact authenticated reply. Missing public-door journey: “Confirmation — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Public eligibility, profile changes, consent evidence, capture metadata, history and pending status commit together, or a currently barred destination gains none of the new consent records.; A surviving unsubscribe or erasure restriction may recreate an unsubscribed profile containing only new post-opt-out request evidence, without restoring history; confirmation mail stays within CONT-027’s shared allowance.; Surviving suppression blocks fresh capture eligibility; Confirmation preparation finishes before the authoritative handoff check; suppression, a later opt-out or an already committed confirmation prevents handoff when present at that check.; The adapter is invoked immediately after the authoritative check; a provider handoff already authorized and in progress cannot be recalled by a later transition.. Missing public-door journey: “Guarded consent capture — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Phone-only CSV validated; Each rejected row reason read back; Unnamed-file per-row rule; Full review capacity. Missing public-door journey: “Import — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Every channel preserves the restrictive order. Missing public-door journey: “Merge — complete acceptance”, covering the unasserted outcomes above.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Imported order and consent changes retain original times for dormancy. Missing public-door journey: “Dormancy without deletion — complete acceptance”, covering the unasserted outcomes above.

Asserted: every restricted identity, opted-out and suppressed aliases included, keeps its hash, channel, reason and occurrence time after erasure, with an owner's own words kept as the owner-block code, and each suppression stays a detached suppression (an owner's still the owner's); no table, read decoded, and no audience export holds the erased address, name or owner note, and the retained hash is one-way and installation-keyed; a subscribed identity leaves no mapping alias or tombstone; import, store sync and public capture keep a retained restriction, which reads unsubscribed; an erased unsubscriber returns only through their own confirmed public-form request, while an erased suppression, complaint, owner block or pre-fix erasure opt-out gets no confirmation. Not met: a pre-fix erasure opt-out restored from another installation's Mango export is dropped when it meets an erasure opt-out this installation's own erasure wrote for the same address, which can then confirm a public-form resubscribe, so acceptance 4 and 5 fail on that path.

Carried evidence asserts only the outcomes identified in DONE-AUDIT. Unasserted: Local-to-portable mapping retained specifically; Audience CSV exports carry surviving restrictions by their portable hash after erasure.; Documentation explains that a mapping or export holder can test guessed destinations or an address dictionary without the installation secret and can match stable hashes across installations and exports.; The retained mappings and exports are handled as sensitive personal data.. Missing public-door journey: “Portable surviving restrictions — complete acceptance”, covering the unasserted outcomes above.

Asserted: Triggering source events; Lookback window; Source-data as-of; Inclusion rule; Exclusion rule; Send-by instant and scheduled instant relationship; Proposed channels; Forecast method displayed. Unasserted: Confidence-label method. Missing public-door journey: “Evidence — complete acceptance”, covering the unasserted outcomes above.

Asserted: Candidate count; Excluded contact count; Eligible contact count; Per-channel recipient-step count. Unasserted: No recipients label before exclusions. Missing public-door journey: “Counts — complete acceptance”, covering the unasserted outcomes above.

Asserted: Editable campaign name; Editable email subject; Saved email preview; Saved SMS preview. Unasserted: Editable email body; Editable proposed SMS body; Editable sender identity; Editable destination links. Missing public-door journey: “Content — complete acceptance”, covering the unasserted outcomes above.

Asserted: Adoption retains draft state; Generation and adoption enqueue nothing. Unasserted: Held company policy binds the exact saved revision. Missing public-door journey: “Owner control — complete acceptance”, covering the unasserted outcomes above.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: Grounded source observations accepted; Own imported data and configured knowledge only; Fabricated or malformed claims rejected; Rejected proposal failed; No substituted composition. Missing public-door journey: “Grounded generation — complete acceptance”, covering the unasserted outcomes above.

Asserted: Provider error recorded; No substitute campaign. Unasserted: Invalid AI output fails proposal; 60-second timeout fails with provider error; Existing proposals preserved; Existing campaigns preserved. Missing public-door journey: “Generation failure — complete acceptance”, covering the unasserted outcomes above.

Asserted: Own campaign identifiers; Own event identifiers; Campaign count; Event count; Thin history has no range. Unasserted: Every recovery-rate and confidence figure identifies source history; Other-store benchmark rejected. Missing public-door journey: “Forecast provenance — complete acceptance”, covering the unasserted outcomes above.

Asserted: Approved state with linked campaign; Dismissed state; Dismissal reason read back; Expired state; Failed state; Dismissed or expired proposal refuses approval; Approved proposal refuses dismissal; Actor; Single transition under competing decisions. Unasserted: Proposed state; Time. Missing public-door journey: “Proposal states — complete acceptance”, covering the unasserted outcomes above.

Asserted: Candidate count; Eligible contact count; Every exclusion reason and count. Unasserted: Audience rule; Audience as-of time; Per-channel recipient-step count. Missing public-door journey: “Review snapshot — complete acceptance”, covering the unasserted outcomes above.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: Frequency-window exclusion; Recorded frequency-window reason; No silent deferral; 24-hour email window; 72-hour SMS window. Missing public-door journey: “Frequency protection — complete acceptance”, covering the unasserted outcomes above.

Asserted: Immediate hand-off eligibility recheck; Complaint after approval prevents hand-off; Merge after approval prevents hand-off; Merge skip reason is recorded. Unasserted: Dispatch-start eligibility recheck; Purchase after approval prevents hand-off; Purchase skip reason is recorded; Refund after approval prevents hand-off; Refund skip reason is recorded; Opt-out after approval prevents hand-off; Opt-out skip reason is recorded; Bounce after approval prevents hand-off; Bounce skip reason is recorded; Complaint skip reason is recorded; Consent change after approval prevents hand-off; Consent change skip reason is recorded; Frequency-window change after approval prevents hand-off; Frequency-window change skip reason is recorded; Source freshness holds at hand-off; Failed refresh pauses channel before more hand-offs; Stale source pauses channel before more hand-offs; Only successful refresh resumes. Missing public-door journey: “Dispatch recheck — complete acceptance”, covering the unasserted outcomes above.

Asserted: after the first send, changed inclusion, a custom exclusion and an opt-out are named skips at the second step, only the still-eligible control is sent, and a newly matching contact stays outside the frozen audience. Unasserted: a conversion after an earlier step prevents later steps; no journey records a purchase of the campaign's product between steps and shows the next step skipped (recent-product-purchase is asserted only at review).

Asserted: Frozen candidate set survives segment changes. Unasserted: Newly matching contacts not added; At most one recipient-step per contact per channel per step under overlapping matches. Missing public-door journey: “Frozen candidate set — complete acceptance”, covering the unasserted outcomes above.

Asserted: Scheduled state; Dispatching state; Completed state; Canceled state. Unasserted: Draft state; Paused state; Failed after missing first-step deadline; Actor or feature recorded for each transition; Time recorded for each transition; Invalid transition rejected. Missing public-door journey: “States — complete acceptance”, covering the unasserted outcomes above.

Asserted: Persisted Campaign name; Persisted Message content; Persisted Links; Persisted Schedule. Unasserted: Persisted Channels; Persisted Audience rule; Persisted Sender identity; Body within sent-size limit saves; Oversized body refused with measured size; Refusal names limit; Oversized body not truncated. Missing public-door journey: the composer derives the live summary, new saved revisions store it and ignore caller prose, and earlier revisions display it without changing immutable approvals; readiness validates structured rules and approval binds the exact saved rules. Missing public-door journey: “Draft editing — complete acceptance”, covering the unasserted outcomes above.

Related audience-rule implementation is present. Missing public-door journey: review, approval checks, scheduled pages, campaign lists and audience snapshots derive the complete summary, including every condition, comparison, value, lookback, editor label and all-or-any matching. Missing public-door journey: “Derived audience rule summaries — complete acceptance”, covering the unasserted outcomes above.

Asserted: Structured inclusion updates; Real source counts; Unavailable missing source counts; Unavailable stale counts; Late old request cannot replace new count. Unasserted: Structured exclusion updates. Missing public-door journey: “Live audience authoring counts — complete acceptance”, covering the unasserted outcomes above.

Asserted: Blank newsletter without AI or commerce; Real source starter; Same editable Review; Linked proposal reused; Concurrent adoption creates one campaign; Create has no authority; Select and save enqueue nothing; Incomplete draft saves; Approval names missing content; Rich text initial editor; Optional HTML mode preserves authored markup; Styled and image content stays in HTML mode; No image fetch while authoring. Unasserted: At most three clicks; Expired proposal not adopted. Missing public-door journey: “Start and adopt newsletters — complete acceptance”, covering the unasserted outcomes above.

Asserted: Desktop saved preview. Unasserted: Mobile saved preview; Plain-text saved preview; Resolved personalization examples; Compliance footer; SMS opt-out text; Validated styles in saved preview; Failing body unstyled with warning. Missing public-door journey: “Revision preview — complete acceptance”, covering the unasserted outcomes above.

Asserted: One managed unsubscribe footer; Derived text contains destination URL; Stored body resaves byte-identically; Editor body resaves byte-identically; First duplicate attribute kept; Ignored misplaced tags absent; Checker judges stored tree. Unasserted: One managed postal footer; HTML-body parse with scripting off; Kept attribute values preserved; Kept styles preserved; Comments preserved but refused; Personalization tokens preserved; Refused markup not repaired; Noncanonical syntax saves; Closing-tag attributes dropped; Leading newline stable; Plaintext stable without footer growth; Sixteen-round instability refusal; Older draft canonicalized on any-field save; Plain text comes from same parse. Missing public-door journey: “Canonical saved email bytes — complete acceptance”, covering the unasserted outcomes above.

Asserted: Refusal leaves campaign in draft; Every blocking check named; Missing subject named; Missing body named; Missing preheader named; Optional AI or commerce absence permits manual mail-only draft; Required source dependency blocks. Unasserted: Atomic audience validation; Atomic consent validation; Source freshness including parallel incumbent sync; Sender registration; Email authentication; Sending reputation; Compliance content; Personalization; All named link rules; Schedule; Provider configuration; Effective deduplication; Provider reconciliation; Missing sender named. Missing public-door journey: “Approval checks — complete acceptance”, covering the unasserted outcomes above.

Asserted: IANA zone retained; Resolved UTC retained; Ambiguous local time refused; Nonexistent local time refused; Store-zone default; Store zone independent of browser zone; Read-only resolved UTC; 23:59 local deadline; UI daylight-saving refusal; API non-hour DST refusal. Unasserted: Explicit instant compatibility; Local and UTC disagreement refused. Missing public-door journey: “Schedule — complete acceptance”, covering the unasserted outcomes above.

Asserted: Editing produces draft replacement; Only replacement schedule hands off; Prior pending recipients canceled; Replacement atomic with dispatch race; Post-dispatch edit creates another campaign. Unasserted: Original remains active before replacement approval; Original and later steps stay active until cancellation. Missing public-door journey: “Scheduled edits — complete acceptance”, covering the unasserted outcomes above.

Asserted: Test content is marked; No contact activity change; No reporting change. Unasserted: Configured operator email destination only; Configured operator phone destination only; Only admitted typed destinations; Campaign history identifies test; No attribution change; No frequency protection change. Missing public-door journey: “Test send — complete acceptance”, covering the unasserted outcomes above.

Asserted: Accepted hand-offs remain separate; In-flight uncertainty retained; Countdown to next dispatch. Unasserted: Scheduled cancellation stops within 30 seconds; Dispatching cancellation stops within 30 seconds; Paused cancellation stops within 30 seconds; Every unsent step stopped; Delivered mail is not recalled. Missing public-door journey: “Cancellation — complete acceptance”, covering the unasserted outcomes above.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: Step send-by instant; Default end of local scheduled day; Missed recipient deadline is skipped with named reason; No send when deadline predates dispatch. Missing public-door journey: “Step deadline — complete acceptance”, covering the unasserted outcomes above.

Asserted: Signed-in image upload; PNG accepted; Header type overrides declared type; Truncated upload refused; Byte limit; Pixel limit; Refusals store nothing; Store once by hash; Image bytes immutable; Exact image type; No-sniff; Immutable public cache; Unknown image not found; Per-image refusal; Other image unaffected. Unasserted: JPEG accepted; GIF accepted; WebP accepted; Erasure removes matching image bytes; Erased image answers gone; Erased image blocks approval; Not keyed by client address; No requester identification is recorded; Original bytes exported; Image fetch is not an open signal; Pending erasure image unavailable; Restore image unavailable; Cross-origin restore retains original absolute URLs; Sandboxed no-content-execution policy. Missing public-door journey: “Campaign images — complete acceptance”, covering the unasserted outcomes above.

Asserted: Insert image uploads and inserts header-derived dimensions; At most 600-pixel width; Public address in response; Stored-type extension serves same bytes; Wrong extension not found; Local own HTTP image saves; Styled local preview loads after opt-in; Local HTTP image approval refusal; HTTPS deployment unaffected. Unasserted: Description required; Other HTTP origins refused; Local HTTP image test refusal; Local HTTP image delivery refusal. Missing public-door journey: “Insert and preview campaign images — complete acceptance”, covering the unasserted outcomes above.

Asserted: Default-off when both inputs absent; No generation control; Unavailable run refusal names input; Configured owner key used. Unasserted: Partial configuration requires both; HTTPS origin without path; Local-only loopback HTTP exception; No provider construction or contact; Only explicitly started or chosen design work contacts service. Missing public-door journey: “Optional design module — complete acceptance”, covering the unasserted outcomes above.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: No 12ui request when absent; Only operator run requests; No startup request; No independent-schedule request; No unrelated request; Refusal fails only that run; Outage fails only that run; Design-authoring role authority; Provider wallet and allowance honored; Per-paid-step estimate; Request recorded; Subprocessors disclosure; Evaluation-corpus retention disclosure; Design-timing disclosure. Missing public-door journey: “Owner-selected design provider — complete acceptance”, covering the unasserted outcomes above.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: Local optional input reading; First-deploy supplied optional upload; Later-deploy supplied optional upload; Never required; Later deploy preserves secrets; Verification inputs absent keeps module off; Local consumer only design work; Other queue work left for retry. Missing public-door journey: “Optional design deployment credentials — complete acceptance”, covering the unasserted outcomes above.

Asserted: Subject in brief; Current text in brief; Brief editable; Candidate-drawing spend estimate; Draft-owned run survives reload; Candidates appear progressively; Later candidate appears. Unasserted: Draft name in brief; Preheader in brief; Sender name in brief; Two-to-four design choice; Layout spend estimate. Missing public-door journey: “Draft-only design generation — complete acceptance”, covering the unasserted outcomes above.

Asserted: Same key on rate retry; Notice stays until answer; Untimed refusal fails quota; Wallet refusal fails quota; Failed design reason; Read deadline settlement. Unasserted: Ordinary 30-second request bound; 60-second download bound; 150-second purchase bound; Retry-After honored; Relative retry time notice; Beyond-deadline wait fails quota; Network failure retries; Server failure retries; Request timeout retries; Three-pass bound; Five- and ten-second spacing; Unavailable final failure; Unauthorized reason; Rejected request reason; Unreadable reason; Forbidden redirect reason; Expired layout reason; Cron deadline settlement; Quiet work resumed after two minutes; Declared provider wait respected; New run refused while same draft waits; Offered design may prepare during wait. Missing public-door journey: “Design provider retries and deadlines — complete acceptance”, covering the unasserted outcomes above.

Asserted: Generated body canonical; No implicit save; No approval; No schedule; No delivery; Save uses ordinary draft path; Failed run safe reason; Timeout reason; Failure leaves draft unchanged; No semantic content substitute. Unasserted: All ordinary approval checks. Missing public-door journey: “Save generated design through ordinary authoring — complete acceptance”, covering the unasserted outcomes above.

Asserted: Choose beside candidate image; Chosen layout enters import; Untouched choice opens import; Unrelated typing prevents automatic opening; Focus remains in body; Ready notice offers explicit opening; Operator destination retained; Non-brief lines highlighted; Unsaved edit. Unasserted: Hosted photos; Managed footer; Replacement confirmation required. Missing public-door journey: “Apply a chosen design without stealing focus — complete acceptance”, covering the unasserted outcomes above.

Asserted: Discarding edit retains paid design; Reload retains candidates; Failed layout retains candidates; New run retains paid design; Save or discard ends offer; Prepared design reuse has no further purchase; Failed layout step shown; Wallet or allowance reason; New paid layout retry; Choose another design; Earlier designs reachable; Hold reason visible; Hold cleared only after answer. Unasserted: Next retry time visible. Missing public-door journey: “Keep paid design candidates — complete acceptance”, covering the unasserted outcomes above.

Asserted: Only layout description and brief; All personalization tokens removed; Only chosen candidate sent for layout; No contact or audience values; Each purchase has idempotency key; Retried purchase buys once; Candidate outcomes; Candidate SHA-256; Chosen candidate; Safe failure code; Cost fact for every paid request. Unasserted: Brief retained; Provider run identifier; Provider layout identifier; Candidate size; Operator; Times; Run never deleted; Candidate originals retained; Layout retained; Candidate and layout export. Missing public-door journey: “Design data and records — complete acceptance”, covering the unasserted outcomes above.

Asserted: Provider error text never shown; Separate old-run choice controls. Unasserted: 64 KB JSON stream cap; 40 MB candidate stream cap; 4,096-pixel bound; Declared oversize refused unread; Published layout digest verified; Version-2 layout parser; Same-origin read redirects only; Purchase redirects refused; Provider error text never stored; Safe Mango reason; Candidate requires session; Layout requires session; Only selected crops public; Full-size candidate link; Up to ten older offered runs; Queue contains only run identity; Only still-needed requests; Erasure write fence; Restore fence; Erasure redacts briefs. Missing public-door journey: “Design provider custody — complete acceptance”, covering the unasserted outcomes above.

Asserted: browser compile into the approval grammar, hosted photos, HTTPS button, managed footer and postal address, unsupported-layer listing and novel-line highlight, version and non-HTTPS refusals with the saved body unchanged, unsaved edit then ordinary exact-revision approval, measured per-part size refusal and no request to 12ui. Unasserted: an unrepresentable design (reserved braces, a layout the approval checker rejects, an image with no area) is refused visibly with the saved body unchanged.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: Centered 600-pixel layout; Header emblem and lettering; Full-width photos; Two-column vertical alignment; One button; Managed footer; Tightened email grammar; Only cells paint backgrounds; Images keep natural inline display; Button corners within padding; Escaped text; Long-word wrapping; Closed hex colors; At least 4.5:1; Georgia-or-Helvetica stacks; Mango sizes and spacing; Full-resolution crop; At most twice displayed width; JPEG uploaded; No server image codec; Compiler size check; Save size check; Approval size check; Test size check; Delivery size check; Oversize recipient skipped; No truncation; Phone columns side by side; Phone columns narrow with email. Missing public-door journey: “Compile the imported layout — complete acceptance”, covering the unasserted outcomes above.

Asserted: Hosted image thumbnail; Text novel-line highlighting; Unsaved state shown; Discard removes summary. Unasserted: Image description highlighting; Icons omitted and listed; Dividers omitted and listed; Shapes omitted and listed; Destinationless links omitted and listed; Extra buttons omitted and listed; Footer links omitted and listed; Digit-bearing footer lines omitted and listed; Edited-since state shown; Abandoned uploaded images remain; Approval does not verify model claims. Missing public-door journey: “Review imported design content — complete acceptance”, covering the unasserted outcomes above.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: 2 MB bound; 2,000-layer bound; 64-level nesting bound; Deep input named refusal without overflow; Unsupported input not guessed; PNG canvas shape matched; Personalization delimiter rejected; Editable draft-derived brief; Whole-line whole-word matching; Case/spacing/typographic-quote matching; Signed URLs never fetched; Every value stays within compiler; Lazy importer load. Missing public-door journey: “Bounded local design input — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Passing sender schedules. Unasserted: Scheduling is refused when the sending domain does not pass SPF.; Scheduling is refused when the sending domain does not pass DKIM.; Scheduling is refused when the sending domain does not pass DMARC.; Scheduling is refused when the visible From domain does not align with an authenticated domain.. Missing public-door journey: “Email authentication — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Visible link; One-click declaration; Opt-out ledger is changed before success; Context-free one-click body; Scanner and prefetch do not unsubscribe. Unasserted: Opaque HTTPS mail-client URL; DKIM covers both headers; No redirect; Visible confirmation action alone opts out; A token changes only its contact. Missing public-door journey: “Email unsubscribe — complete acceptance”, covering the unasserted outcomes above.

Assertions in are outside this clause's old Evidence set. Old evidence asserts no complete acceptance outcome at an asserting line. Unasserted: Configured program identity; STOP or jurisdiction equivalent; Frequency disclosure; URL never replaces reply opt-out; Compliance text; Segment count; Help contact. Missing public-door journey: “SMS opt-out — complete acceptance”, covering the unasserted outcomes above.

Assertions in and are outside this clause's old Evidence set. Old evidence asserts Campaign approval. Unasserted: Malformed links named and blocked; Forbidden schemes named and blocked; Unlisted link and redirect hosts named and blocked; Image scheme and host named and blocked; Allow action only for host; Contact links need no allowance; Flow activation; Link inspection; Tracking; Own asset checked without DNS; Own asset checked without same-host request; Missing own asset blocks and is named. Missing public-door journey: “Links — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Blocking findings shown; Advisory findings shown; Acknowledgment survives reload; Replay produces one audit entry; Actor. Unasserted: Every channel. Missing public-door journey: “Content checks — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Bare token blocks checks; Approval refusal leaves no recipient steps; Saved fallback rendered; Eligible person counts exclude pending people and token occurrences; Approval preserves counts. Unasserted: Bare token when every eligible person resolves it; Scheduling refusal. Missing public-door journey: “Personalization — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Stored parser structure; Save stability. Unasserted: Decoded destination checks; Literal quote refusal; Literal angle-bracket refusal; No-break space refusal; Normalization does not repair hiding declarations; Multipart alternative; Equivalent offer in HTML and text; Equivalent links in HTML and text; Unsubscribe link in both parts; Saved preheader delivered; Saved HTML bytes delivered; Only token and tracking substitutions; Admitted tag set; Admitted attribute set; Admitted inline-style set; BUILD-012 size bar; Script refusal; Form refusal; Stylesheet refusal; Class refusal; CSS-function refusal; Responsive block generated only by builder; Responsive block regenerated on save; Check with responsive block; Check without responsive block; Same stored-parse checker for approval; Same stored-parse checker for test send; Same stored-parse checker for delivery; Preview uses shared parse; Preview styles only after checker success; Plain text derives from same parse. Missing public-door journey: “Email body — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Complete response below two seconds; Shared GET allowance excess; Shared POST allowance excess; Another token at the same client address actually opts out; Confirmation at both widths. Unasserted: Visible confirmation alone prevents approved delivery (the cited journey confirms only after its one-click opt-out). Missing public-door journey: “Unsubscribe availability — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts no complete acceptance outcome at an asserting line. Unasserted: At 1,000 or more marketing deliveries in the reporting window, a complaint rate at or above 0.3% blocks scheduling.; At that volume, a hard-bounce rate at or above 5% of attempted marketing hand-offs blocks scheduling.; Provider hold blocks approval; Each block names its numerator, denominator, reporting window and provider rule and cannot be acknowledged away.; Late facts recompute the block, which clears only when every applicable threshold is below its limit.. Missing public-door journey: “Sending reputation — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Parser tree controls approval; Low-contrast text blocked; Misparsed styled markup blocks. Unasserted: Test-send tree; Delivery tree; Hidden text refused; Clipped text refused; Faded text refused; Under-10px text refused; Moved text refused; Overlaid text refused; Reversed text refused; Reason named; Background outside painted cells/wrapper refused; Display changes refused; Constraining dimensions refused; Inline borders refused; Painted rounded corner over text refused; Direction outside cell refused; Overlapping styled cells refused; Unsubscribe presentation protected; Postal-address presentation protected; Painted-cell contrast; Outer-wrapper contrast; White-page contrast; Standards-rendering contrast; Quirks-rendering contrast. Missing public-door journey: “Hidden or deceptive presentation — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts no complete acceptance outcome at an asserting line. Unasserted: Legacy plain approval remains byte-identical; Legacy parser-stable styled approval remains byte-identical; No re-approval of valid legacy body; Malformed-close legacy refusal; Out-of-table attribute legacy refusal; Undersized nested-heading legacy refusal; Direction-override legacy refusal; Reason named; New approval needed; Literal-text legacy forms deliver unchanged; Tightened placement preserves plain approvals; Old prohibited style refused at test send; Old prohibited style refused at delivery; Earlier design re-imported; Older draft canonicalized on any save; Markup spelling does not refuse save. Missing public-door journey: “Legacy approved email and draft compatibility — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Email adapter hand-off; Reconciliation-window coverage; Resumed dispatch does not duplicate. Unasserted: SMS adapter hand-off; Campaign/revision/step/contact identity; Provider-effective deduplication; Deadline coverage; Durable fence precedes SendGrid request; Correlation key is not provider deduplication; Provider identifier stored before handed-off state; Definite nonacceptance may retry; Accepted hand-off never retried; Uncertain hand-off never retried; Timeout remains uncertain; Reset remains uncertain; Uncertain provider response remains uncertain; Missing message identifier remains uncertain; Eviction after fence remains uncertain; Operator review is named; Job retry does not duplicate; Queue replay does not duplicate. Missing public-door journey: “Provider hand-off — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Provider pacing; Estimated completion; Accepted count refresh within 30 seconds. Unasserted: Carrier pacing; Delivered count refresh; Skipped count refresh; Failed count refresh. Missing public-door journey: “Throttling and progress — complete acceptance”, covering the unasserted outcomes above. 2026-11-01: main fails the shared-budget accepted-count outcome in (accepted count 4 not 5; Verify 41170055220 and every candidate built on it); repair is owned by the fv landing ruling and sd.

Old evidence asserts Five retries then failure; Within original hour; Increasing delays; Exhaustion failed state; Error visible in detail. Unasserted: Uncertainty reconciled without retry; Permanent rejection terminal; Atomic suppression for hard rejection; Atomic suppression for complaint; Atomic provider suppression. Missing public-door journey: “Transport failure — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Signed event accepted; Replay and reorder preserve recipient disposition; Older fact does not downgrade delivery. Unasserted: Strongest adapter identity and immutable fact; Replay and reorder preserve every contact state; SMS reply identity. Missing public-door journey: “Provider-event identity — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Accepted and uncertain states; Independent complaint; Delivery retained after complaint. Unasserted: All remaining disposition states; Independent suppression; Skipped reason retained. Missing public-door journey: “Delivery truth — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Per-disposition visible counts; Late complaint updates campaign summary; Late complaint updates ledger. Unasserted: Uncertainty is not terminal; Every terminal disposition gates completion; All overlapping complaint/suppression totals separate; No combined success figure; Late suppression updates completed summary. Missing public-door journey: “Partial completion — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Restart resumes; No duplicate send; Provider lookup reconciles uncertainty; Missed provider facts imported; Activity unavailable retains uncertainty. Unasserted: Eviction resumes; Redeployment resumes; Queue redelivery preserves fence; No operator restart action; Other unresolved lookup; Signed SendGrid event correlation; Activity identity correlation; Expired SendGrid lookup retains uncertainty; No invented delivery; No invented failure; No automatic retry control; Receiver evidence available; Provider identifiers available; No delivery credit. Missing public-door journey: “Resumable dispatch and reconciliation — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Adapter unavailable pauses channel; No recipient hand-off while paused; Bounded non-recipient probe; Probe cadence survives restart; Automatic probe recovery. Unasserted: Five-minute continuous transient trigger; Audience recheck after recovery; Provider error visible. Missing public-door journey: “Provider outage — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts State and channel filters; Cancellation outcome; Delivery schedule/timeline; Per-channel disposition totals. Unasserted: The opened body is the approved revision; Full audience snapshot is inspectable. Missing public-door journey: “Campaign history — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Default off and explicit enablement; Privacy-sensitive estimate label; Other result fields unchanged after pixel fetch. Unasserted: Observed click labels; Observed conversion labels. Missing public-door journey: “Engagement — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts AI billable units; Provider units, currency and cost; Campaign totals; UTC day boundary; Day/currency/unknown-price groups. Unasserted: Model or channel on each fact; Timed-out purchase proven before counting; Layout unit once. Missing public-door journey: “Cost — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Opaque first-party redirect; Distinct recipient-step redirect; Original destination forwarding; No cookie; No loaded body. Unasserted: CONT-018 token not yet built; Scanner excluded from attribution. Missing public-door journey: “Link tracking — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Unique first-party pixels after opt-in; Pixel changes only estimate results; Disable revokes issued pixels; Reenable does not readmit old pixels; One estimate after repeated requests. Unasserted: Ordinary images remain untracked; No IP retained; No user agent retained. Missing public-door journey: “Open-estimate lifecycle — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts no complete acceptance outcome at an asserting line. Unasserted: Every recipient receives the same campaign-image URL.; No address retained; No user agent retained; No cookie retained; No recipient retained; No request time retained; Only current-minute image rate counter retained; Ordinary image not counted as open; Ordinary image not shown as open. Missing public-door journey: “Ordinary campaign images are untracked — complete acceptance”, covering the unasserted outcomes above.

Asserted: contacts, source records, consent, suppressions, surviving opt-outs, recipient-step outcomes and settings travel and restore, and campaigns, revisions, audience decisions, messages and audit entries travel inside the row-for-row restore round trip; uploaded assets restore as original files; credentials, sessions and connection secrets are excluded and the source session is refused on the destination. Unasserted: proposals and attribution events in an archive (no exported installation in a push journey holds a proposal or an attribution fact, so their inclusion is never shown); exclusion of a signed first-owner claim (no exported installation holds one).

Old evidence asserts Every older archive refused by current erasure floor; Nonempty legacy journal refused before staging; Current post-erasure export restores; Surviving opt-outs preserved. Unasserted: Empty maintenance destination; Explicit confirmation; Fresh destination native authentication; Contact keys match before record restore; Link keys match before object restore. Missing public-door journey: “Marketing restore custody — complete acceptance”, covering the unasserted outcomes above.

Old evidence asserts Owner editor present; Anonymous no widget; Logout removes widget. Unasserted: Short-lived grant; Configured management frame origin; Foreign frame/message rejected; Authorization loss removes widget; Grant expiry removes widget; Compiled edits after route hydration; Six product roles separate from Base roles; Last product Owner protected; Destination-owned restore authority; Owner/Admin CSV restriction. Missing public-door journey: “Native owner editor — complete acceptance”, covering the unasserted outcomes above.

Six persisted roles, Owner assignment and Analyst unmasking grant, next-request API/server-function enforcement, role-change audits, last-owner protection, Author draft/request/configured-test controls, Manager typed tests and approval, restricted contact views, Support opt-out/request recording and visible controls at 1440/390 are exercised. Gap: full flow activation, billing-bearing provider connect/replace/disconnect and installation-erasure journeys await their owning product implementations; masked CSV export is not implemented (exports remain Owner/Admin only). Authentication role grants stay destination-owned on restore.

Owners and Admins can read, filter, page and export Activity; Authors and signed-out callers are refused. Saved drafts, approval requests and approvals, campaign pause/resume/cancel, imports and exports, consent entries, opt-outs, anonymised erasures, signup settings, role changes and refusal summaries appear once with actor and time at desktop and phone widths. Flow and agent activity remain obligations of FLOW-008 and AGENT-010. Remaining: completed restore must appear with actor and time and be filterable and exportable.

The scoped API persists contact fields with contact identity and consent source. Typed property definitions, UI editing, date/money semantics, segments and personalization remain unimplemented.

Scoped subscriber sync stores deduplicated tags without granting consent, and maintains saved integration lists. Topic preference-center acceptance and general tag-driven segmentation remain unmet.

Identities, channel/topic evidence, properties, segment membership, original-time events and masked Analyst/Support views are exercised. Apply the recorded routing of enrollment/current-node display to FLOW-002 and predictions to SEG-004; independent topic withdrawal remains CONT-015/016. No unavailable panel establishes completion.

Shopify signed identified ingest and current privacy controls are exercised. The snippet and Stall carriers, expanded WooCommerce parity, shared switch/click identity and full four-carrier browser journeys remain unproved. INT-002’s separately approved plugin semantic remains distinct. The owner’s tracking default is already in force; no ct approval remains pending.

Shopify pixel controls exercise part of the privacy rule. The shared per-site Mango switch, full role/control/activity matrix, off/on identity reset and every-carrier journey remain unproved.

Shopify privacy consent/GPC controls are exercised. Snippet, Stall and expanded WooCommerce parity, every consent-tool failure/withdrawal branch and every-carrier refusal/deletion journey remain unproved.

Existing Shopify and separately approved INT-002 storage behavior are exercised. The unified cookie attributes, rotated identity, bounded payload/lifetimes and no-other-storage assertions across all carriers remain unproved.

Shopify pixel ingest and current privacy controls are exercised; the shared click-token redirect, host-bound exchange, one-use/expiry and address-bar journeys across carriers remain unbuilt and unproved.

Shopify signed identified ingest is exercised. Consent buffering, browser-only earlier browsing and absence of anonymous requests/records remain unbuilt and unproved across carriers.

Shopify signed ingest and present privacy controls exist. Cross-carrier 90-day retention, limited windows, erasure/session/token cleanup and disclosure proof remain unbuilt and unproved.

acceptance not yet met: A form with phone capture shows the disclosure, the submission stores every evidence field, the confirmation text is sent once through the provider edge, and only a signed confirming reply subscribes; a pre-checked or missing disclosure blocks the form from publishing.

acceptance not yet met: A Support operator records an access request and a do-not-share request; the export contains every record type for that contact and no other contact; the next ad-audience sync omits the contact.

acceptance not yet met: A search for a property value returns the matching contacts; a bulk tag of 5,000 contacts completes as a job with a receipt; a bulk "add to topic" refuses contacts without covering evidence and names them.

Mailchimp archive and named CSV/API source attestation and incumbent-held email evidence are exercised through the public preview, apply, campaign-review, native export/restore, revocation and erasure doors at 1440/390. Store connections (INT-001 to INT-006), five-year expiry and positive SMS evidence (A2P hold) remain unproved. A source without a row time requires an explicitly supplied export creation time. No real provider call or consent was used.

Mailchimp archive and named CSV/API attestation, native export/restore and erasure are exercised. Store-connection attestation and five-year retention/expiry remain unproved; no real provider consent was used.

Mailchimp archive and named CSV/API restrictive-state, revocation and campaign review journeys are exercised. Connected-store intake, full cross-incumbent fields and positive SMS evidence remain unproved; no real consent was used.

Archive and named CSV/API incumbent-held evidence, revocation and campaign-review counts are exercised. Complete source/privacy/report labeling and independent-evidence revocation behavior across store connections and every incumbent remain unproved.

Hosted, kiosk and manual email default/single capture, future-only Owner/Admin changes, activity and restoration are exercised. API mode editing, Shopify incumbent-held/Pending/Non-subscribed acceptance, popup/landing carriers, Zapier/Crank and SMS mode editing remain open. RL-101 settles manual-mode authority without changing status; no real provider consent was used.

Author entry, permission fields, properties, default confirmation, operator-recorded single mode, authenticated SMS reply and restricted-role views are exercised. Topic-specific permission awaits CONT-015; unauthenticated access follows BASE-ACCESS-002; legacy API evidence may omit new form-attestation fields. RL-102 adopts CONT-025’s Owner/Admin prospective authority; no real provider consent was used.

Owner-approved confirmed-only hosted/kiosk resubscription retains the opt-out until recipient POST, records request/handoff/confirmation history, silently caps destination confirmation reservations at three per UTC day and refuses hard-bounce, complaint and owner suppressions. Generic acknowledgments include destination-dependent intake refusals and uncertain/failed delivery without automatic retries. Local browser journeys cover 1440/390 and separate resubscribe growth. Remaining full-clause acceptance: popup/landing and incentive/topic/flow integration, erasure reason preservation and supersession, and expired recreated-contact cleanup; ambiguous legacy erasure-only restrictions remain blocked.

Owner-approved confirmed-only hosted/kiosk resubscription retains the opt-out until recipient POST, records request/handoff/confirmation history, silently caps destination confirmation reservations at three per UTC day and refuses hard-bounce, complaint and owner suppressions. Generic acknowledgments include destination-dependent intake refusals and uncertain/failed delivery without automatic retries. Local browser journeys cover 1440/390 and separate resubscribe growth. Remaining full-clause acceptance: popup/landing and incentive/topic/flow integration, erasure reason preservation and supersession, and expired recreated-contact cleanup; ambiguous legacy erasure-only restrictions remain blocked.

Owner-approved confirmed-only hosted/kiosk resubscription retains the opt-out until recipient POST, records request/handoff/confirmation history, silently caps destination confirmation reservations at three per UTC day and refuses hard-bounce, complaint and owner suppressions. Generic acknowledgments include destination-dependent intake refusals and uncertain/failed delivery without automatic retries. Local browser journeys cover 1440/390 and separate resubscribe growth. Remaining full-clause acceptance: popup/landing and incentive/topic/flow integration, erasure reason preservation and supersession, and expired recreated-contact cleanup; ambiguous legacy erasure-only restrictions remain blocked.

Hosted/kiosk confirmed resubscription is exercised. Erasure reason preservation, supersession and expired recreated-contact cleanup remain unbuilt/unproved; ambiguous legacy erasure-only restrictions remain refused.

Review shows dormant/open-only and included no-history counts. An approver can include open-only or disable dormancy for the campaign, with the restored count saved; Owner/Admin defaults under audience.exclusions.v1 copy into new drafts. The immutable approved policy, actor audit and dispatch recheck are exercised. Gap: unengaged (CONT-020), dormant precedence over unengaged, and flow-message inactivity controls remain owed. Existing fieldset, checkbox, numeric input and action patterns suffice; no new design pattern is introduced.

acceptance not yet met: Two campaigns to the same audience are approved four hours apart. With the default, the second excludes everyone the first emailed, with frequency-window. With the override recorded at the second's approval, it hands off to them, the override and its approver appear in the activity log, and a contact who unsubscribed between the two sends is still excluded. A contact emailed a campaign in the morning still receives that afternoon's abandoned-cart message from the library flow, a draft flow made from a Mailchimp journey fixture carries the same setting, and its activation shows the 30-day skip count from seeded sends.

No delivered flow-message frequency workflow is proved: cart/library and moved-in-flow counting, visible changeable settings and the 30-day activation impact comparison are wholly absent in the old gap.

The 1440 pause/resume journey asserts fencing of new hand-offs within 30 seconds, retained handed-off dispositions, resumption of remaining recipients with current consent and deadlines, once-only eligible steps, and pause/resume actor history. Missing public-door journey: “Pause and resume — complete acceptance at 390”, including the same pause/resume flow and retained outcomes in a phone browser. No 390 execution is recorded in the old evidence.

Asserted: Linked follow-up and selected delay; New subject; Non-opener estimate label; 48-hour non-clicker candidates; Current exclusions including frequency; Independent approval; Independent frequency check. Unasserted: Exact non-clicker recipient identities after current exclusions. Missing public-door journey: “Follow-up to non-engaged recipients — complete acceptance”, covering the unasserted outcomes above.

Asserted: related implementation or scenario coverage, with no complete assertion of the outcomes below. Unasserted: Duplication from every campaign state; Copy-of name; New independent draft; Copied channels; Copied audience rule; Copied content bytes; Copied sender; Copied preheader; Copied tracking choice; Copied step settings; No copied schedule; No copied approval; No copied snapshot; No copied test; No copied result; Current settings checked; Current consent checked; Current audience checked; Source revision unchanged; Source results unchanged. Assertions in are outside the old Evidence cell. Missing public-door journey: “Duplicate a campaign — complete acceptance”, covering the unasserted outcomes above.

Up to five typed email recipients receive marked saved-draft tests with opt-out/suppression refusal and destination/actor history. Remaining allowance and whole-request quota refusal are visible; configured and typed attempts share 100 attempted hand-offs per UTC day, including uncertain outcomes, with midnight reset. Authors see configured destinations only and cannot send typed tests; assigned Managers can send typed tests. Activity includes destinations, actor/time, action/object filters and CSV, with erased destinations redacted while receipts remain. Remaining: typed SMS consent and transport (SMS-001, CONT-019), and full role acceptance (OPER-004).

Configured and typed email tests share 100 attempted hand-offs per UTC day, including uncertain outcomes; remaining allowance, whole-request refusal and midnight reset are delivered. Typed destinations and their actor history appear in Activity and its filtered CSV, and erasure retains a redacted receipt. Remaining: typed SMS consent and transport (SMS-001, CONT-019), and full role acceptance (OPER-004).

Old evidence asserts Multiple addresses blocked; Disallowed parameters blocked; Email subject/body form saved; E.164 phone and SMS body saved; Invalid phone blocked. Unasserted: Ten-digit US and visual separators; Web kind; HTTPS-only image sources. Missing public-door journey: “Contact links (mailto:, tel:, sms:) — complete acceptance”, covering the unasserted outcomes above.

Fresh installations list deployment, conservative social defaults and genuine configured connection hosts with sources. Exact and explicit wildcard matching stays shared; durable operator removals survive catalog sync, review allowances retain source/operator/campaign, and source changes are audited. Existing explicit policies remain explicit. Acceptance remains unmet: Shopify does not store primary/additional storefront or catalog image domains; product/social blocks (BUILD-001), brand kit (BUILD-003), Shopify disconnect and flow activation are absent. The existing store-owned editor help incorrectly describes implicit subdomain matching and is not changed in this writer. Social vocabulary approval is pending.

Assertions in are outside this clause's old Evidence set. Old evidence asserts no complete acceptance outcome at an asserting line. Unasserted: Campaign blocked-host list; Flow blocked-host list; Every affected link; Redirect host list; Manager exact-host allowance; Admin exact-host allowance; Owner exact-host allowance; Explicit subdomain allowance; Review source retained; Campaign/flow retained; Operator retained; Immediate recheck; Append-only activity; Operator field; Host field; Campaign/flow field; Activity view; Operator filter; Action filter; Object filter; Author sees blocked hosts; Author can request named approval; No Author allow control; Author allowance refused; Contact links need no allowance; Remaining safety inspections retained; All three imported outside hosts listed; Allow action for each imported outside host. Missing public-door journey: “Allow a blocked host from review — complete acceptance”, covering the unasserted outcomes above.

Campaign links show human totals, unique identified clickers, automated requests, a saved-revision click map, matching clicker CSV and exact saved ID cohorts. Gap: repeated positions with one destination share counts; legacy clicks without destination identity remain unassigned; erased click facts are removed rather than retained as anonymous link counts; campaign-wide unique rollups, flow reports and role masking are absent; very large saved cohorts require CSV.

Message-bound link, one-click and signed SMS reply methods are retained with their first recorded time, shown in the recipient list and CSV and preserved as anonymous counts after erasure. Historical methods remain unknown. Flow messages and role masking remain absent; very large saved cohorts require CSV.

acceptance not yet met: A generated installation of 250,000 contacts with a year of order and activity events passes the MOVE-012 move-in, an exact review count within 60 seconds, a complete hand-off to the provider edge at the declared rate with no duplicate (SEND-001), and a segment update within SEG-002's time, with wall time and peak memory recorded against → limits; the per-email size floor is proved under BUILD-012, and the intake floor under FORM-008.

The cited signup journey asserts pending consent, one confirmation, replay and expiry. It does not assert an embedded-origin refusal or absence of campaign/flow authority after submission; the old evidence set has no embed-origin journey. Missing public-door journey: “Hosted and embedded signup — complete acceptance”, covering the unasserted outcomes above.

The cited signup test asserts body/disclosure rejection, honeypot no-mail, duplicate mail and durable network refusal. It does not assert every sender-before-claim guard, network normalization/restart/counter ceiling, Turnstile action/hostname/reuse/failure mode or status-free acknowledgment for all protected address states; additional challenge tests exist outside the old Evidence cell. Missing public-door journey: “Abuse resistance — complete acceptance”, covering the unasserted outcomes above.

Hosted capacity, separate pools, shared network, bot isolation, duplicate claims and settings are exercised. Popup/flyout/full-page/landing carriers remain open; their absence does not waive the published sustained 1,000/hour floor. RL-103 adopts these capacity choices without promoting status.

Hosted/kiosk accepted-only claims, bot isolation, duplicate refunds and single-mode admission are exercised. Accounting across popup, flyout, full-page and landing carriers remains unproved; no local proof promotes this split of a partial clause.

Owner-only next-window raises, floor/ceiling validation, activity and Settings are exercised on hosted/kiosk capacity. This remains a carried partial part; capacity disclosure and delivery-ceiling behavior across every promised carrier remain unproved.

Hosted/kiosk challenge defaults, toggles, token replay and missing-key warning are exercised. Popup/flyout/full-page/landing carriers and their provisioning proof remain open; RL-103 preserves all those obligations.

The cited kiosk journey asserts blank fields/consent controls, 300 confirmations from one network, no cookies/storage, mandatory challenge/no contact, source report and attributed marking. It does not assert full-screen geometry or prove that kiosk facts cannot identify a later CONT-018 visitor; screenshots and empty browser storage alone do not prove the latter. Original FORM-008 provisioning and ordinary intake obligations stay there. Missing public-door journey: “Kiosk and event forms — complete acceptance”, covering the unasserted outcomes above.

Hosted/kiosk errors, retained entries, generic destination acknowledgment, Home and activity are exercised. FORM-005’s per-form report remains required and unbuilt under RL-104; Settings counts do not replace it. Other growth carriers remain open.

Nested property/tag/consent/geographic/order/catalog and human click selection, summaries, live estimate and per-contact exact review are asserted. Cited old evidence does not assert viewed product/collection/category selection, full named campaign/link/flow activity or prediction-based matching; their dependencies being unfinished does not remove them from this clause. RFM and unavailable-catalog cases are asserted; predictive evidence remains SEG-004. Missing public-door journey: “Segment builder — complete acceptance”, covering the unasserted outcomes above.

The old retention journey asserts the five-stage distribution, a customer’s order/recency/frequency/monetary scores and displayed method. It does not advance a daily boundary or assert daily recomputation; the fixed fixture also does not independently recalculate every quintile boundary. Missing public-door journey: “RFM and lifecycle stages — complete acceptance”, covering the unasserted outcomes above.

The editor offers text, image, button, 1–4 columns, spacer, divider, header, footer, product, a six-item manual product grid and a closed-list social links block, with existing per-block and mobile settings through the MSG-009/012 grammar. Gap: video thumbnail, cart items, coupon and restricted HTML blocks remain unbuilt; exhaustive public-door coverage of every block/settings combination and the complete builder acceptance remain unproved.

Starter and saved templates create independent unscheduled campaigns; updating a template preserves existing drafts and approvals. Mailchimp archive templates enter the library, held conversions stay held, and undo removes an untouched template while preserving edits and independent drafts. The first saved DESIGN-004 import or DESIGN-002 application files its own library template. Library proof at 1440/390 is in the archive journey. Gap: executable migrated flows (FLOW-002), full importer coverage and real-provider sandbox proof remain; MOVE-002/003/005 now have the partial import paths recorded in their own rows. FLOW-001 email nodes now retain independent subject, preheader, HTML and plain-text copies from the library; they remain draft only.

The cited journeys assert safe contact/fallback previews, each located advisory, size detail and largest blocks, contrast refusal, no recipient effect on refusal and oversized save rejection. Gap: after correcting and acknowledging findings, approval is called and returns success but the cited files do not assert the persisted approval state or saved approval record; rendering a preview region is not that assertion. Missing public-door journey: “Previews and pre-send checks — complete acceptance”, covering the unasserted outcomes above.

acceptance not yet met: A message with an emoji switches to UCS-2 and shows the new segment count and cost; the preview shows the short link and STOP text that will be sent.

Per-block mobile controls are available. Preview names the style-dependent hide, font-size, line-height, padding and alignment choices. Remaining: nested and horizontal orientation and the complete responsive editor acceptance are unbuilt or unproved.

Per-block responsive choices save and Preview names their style dependence. Remaining: nested and horizontal orientation and complete responsive generation through the editor are unbuilt or unproved.

Generated and authored presentation checks and style-dependent Preview are delivered for the existing block controls. Remaining: complete editor acceptance, including nested and horizontal orientation, is unbuilt or unproved.

Gap: WooCommerce catalog picking and hand-off are unimplemented. Imported and flow authoring doors remain unproved; native imported history and MOVE-011 conversion do not create catalog choices. Unavailable hand-off reads skip the recipient-step with catalog-unavailable, counted on campaign detail; stale values never send (ct ruling 25 October).

Today's draft/create, store-signal starter, template save/replace/start, duplication, replacement-schedule copy, follow-up, imported-history copy and proposal-adoption doors use measured sent-size refusals with the limit and largest available HTML sections, comparing fallback and expanded saved-name renderings. Browser edits, selected design files and saved source snapshots survive refusal at 1440 and 390. Oversized archive template conversions are held with their measured diagnostic and original archive custody; the import continues, reconciliation distinguishes held conversions from created library templates, and undo removes unchanged held copies. In-limit content saves, reopens, approves and reaches the provider edge within its bound; a later oversized hand-off skips with email-too-large. Saved rule and exclusion membership now bounds displayName through the shared audience evaluator; approval measures its frozen email candidates. Separate raw and escaped maxima stay in D1. Only displayName currently supplies recipient values; other valid keys render their authored fallback. An unresolved new follow-up cohort retains the conservative deployment-wide bound until its membership authority exists. Size advisories retain saved audience and analytics context and recheck the eligible email identities used by approval. Gap: configured dynamic product maxima (BUILD-006), flow messages (FLOW-008), and the Mailchimp blueprint acceptance through MOVE-011 remain unproved. Mailchimp blueprint is CC BY-SA 3.0; vendoring waits on an owner licence decision. Existing LayerDoc application shares the design-import compiler; no real design or proposal generation/provider acceptance is claimed.

Draft revisions only. Trigger enrolment, including the INT-004 renewal reminder (FLOW-002), and activation (FLOW-008) remain unbuilt. All node kinds have plain explanations; unavailable transports/actions are identified. No flow is enrolled, activated or sent.

acceptance not yet met: The go-live journey with a Twilio edge sends an approved SMS step, ingests signed delivered and undelivered callbacks once each, and a replayed callback adds no fact, run on a connection made through SMS-008; done only once SMS-008 is done.

acceptance not yet met: A step scheduled at 19:30 Eastern hands off to New York recipients and defers Los Angeles recipients only if 19:30 Eastern is outside their window; a fourth same-subject text to a Florida number in 24 hours is skipped with state-frequency-limit. A phone-only subscriber with a 305 number and no address hands off at 10:00 Eastern with zone source area-code, and is deferred at 20:30 Eastern.

acceptance not yet met: An inbound signed reply appears in the inbox and contact timeline; the operator's answer hands off through Twilio once; an inbound STOP opts the number out before the webhook is acknowledged and shows in the thread.

acceptance not yet met: The go-live journey runs against each adapter's edge and shows the declared capability on the campaign page; an SMTP relay without events never shows a delivered count; run on a connection made through DELIV-008, and done only once DELIV-008 is done.

SendGrid domain setup, returned DNS records, public-DNS pass/fail, DMARC/BIMI guidance and HTTPS-gated branded links are delivered. Real branded-host TLS and rewritten-link acceptance remain unproved and need a disposable hosted deployment. The setup guide covers SendGrid; Resend retains its existing verification path.

Home renewal status and reminder/diagnostic preparation are delivered. Renewal failures are named by readiness checks. Remaining: lifecycle approval and hand-off enforcement, deadline skips and ordered resumption; the dispatch hooks are not installed. Live welcome-flow wait/resume history also requires FLOW-*.

Settings connections for SendGrid and Resend are exercised at the provider and mail edges; Settings labels the active configuration route and the developer route. Remaining: a fresh installation without deployment mail inputs, Free sign-in through the connection, replacement after an unknown hand-off, full developer-route authority coverage, read-only developer operation without a Settings connection, domain creation through this connection (DELIV-002), and provider sandbox proof.

Request-driven connection health detects revoked keys and missing owned webhooks, fences approval, shows Home alerts and notifies current Owners and Admins; unknown hand-offs are not replayed. Remaining: silent delivery-event detection, scheduled daily read-back, replacement after an unknown hand-off, full developer-route authority checks and provider sandbox proof. The related fresh-install, Free sign-in and domain-creation journeys remain open under DELIV-008 and DELIV-002.

SendGrid and Resend event connections are exercised at synthetic provider and mail edges. Remaining: silent delivery-event detection, scheduled daily connection read-back, replacement after an unknown hand-off, full developer-route authority coverage and provider sandbox proof. Fresh-install and Free sign-in journeys, read-only developer operation without a Settings connection and domain creation remain open under DELIV-008 and DELIV-002.

The overview separates forecasts from recorded results and shows campaign engagement, attribution, growth, provider facts and costs. Flow and holdout figures are visibly unavailable. Remaining: flow and holdout acceptance, including measured incremental revenue and top-flow comparisons.

Campaign revision/channel tables, sorting, topic/channel/UTC date filters, matched CSV, optional open-rate estimates, per-link detail and net attributed revenue by currency are exercised. Gap: flow and flow-message performance awaits the flow engine.

Campaign and SMS attribution, window/metric edits, refunds, cancellations and immutable source records are asserted. Flow attribution and flow revenue reporting are not asserted by the old evidence; FLOW-001/FLOW-002 remain missing. Missing public-door journey: “Attribution for campaigns, flows and SMS — complete acceptance”, covering the unasserted outcomes above.

Repeat-purchase rate, cohort retention, median order interval, value for one form and products bought together are asserted. Value grouped by acquisition source and the next-product-bought outcome have no assertion in the old evidence. Missing public-door journey: “Customer and retention analytics — complete acceptance”, covering the unasserted outcomes above.

Insights reconciles opening/net/closing subscribed membership by UTC day and separates captures/confirmations, opt-outs, suppression and removal, retaining source/version disclosures and anonymous counts after erasure. Real hosted and embedded form capture/confirmation journeys reconcile. Upgrade recovers retained pre-baseline consent captures/confirmations, explicitly labeled with zero inferred membership change; imported dates do not invent earlier local growth. Unavailable pre-baseline membership history is outside the amended history requirement; kiosk capture and confirmation are exercised by . Hosted/kiosk public resubscribe confirmation and separate growth counts are exercised by . Remaining: dedicated popup/landing-page attribution (FORM-002/004) and the full CONT-027 incentive/topic/flow and erasure-expiry acceptance.

Email scheduling covers saved provider cost/units and campaign click/conversion/USD attribution reports, plus built-in cost and engagement reports; sends and delivery refusals are durable and audited. Remaining: Slack delivery, every other report family and dimension, and Activity records for authorization/input refusals.

acceptance not yet met: Done only once INT-015 is done. (native sync, signed carts, signed pixel), run on a connection made through INT-015's install journey, plus a consent write-back journey: a Mango unsubscribe appears as unsubscribed in the Shopify edge's customer record; and the CONT-025 Shopify opt-in journey.

The cited edge and browser journeys assert owner connection, source synchronization, replay preservation, exact activated tag-and-exit flow, default-deny collection, explicit consent and GPC withdrawal, plus unchanged subscription evidence and confirmation. Gap: the cited evidence does not assert absence of cross-site observation throughout the plugin journey. No completion is carried for that unasserted privacy outcome. Missing public-door journey: “WooCommerce — complete acceptance”, covering the unasserted outcomes above.

Owner-only encrypted connection and signed once-only commerce event ingestion. Gap: required real-provider lifecycle proof cannot start as written: Stripe rejects metadata on a test clock (HTTP 400 parameter_unknown, metadata). No real lifecycle events or cleanup search proof claimed. FLOW-001/FLOW-002 inherit renewal-reminder enrolment without status changes.

Asserted: a scoped key identifies and updates a contact and keeps its properties; the shipped client's concurrent repeat stores one event and conflicting content is refused with the one stored event unchanged; the API and client return segment memberships; one key's exhausted allowance returns a named rate-limit refusal with retry guidance while another key stays usable; event and property writes keep their key attribution and the event write declares its scope. Unasserted: a subscription refused for missing consent evidence changes nothing; the journey checks only the 400 consent_evidence_required and never reads back that no contact, consent or confirmation followed for that address.

Scoped subscriber sync and a cursor-paged refusal feed support a sibling CRM client. The Coffer client is supplied as a patch in the integration round, not landed in Coffer here. Full CRM field mapping UI and flow-created CRM tasks remain unmet.

Static campaign defaults freeze into new drafts, preserve author values and managed/contact exclusions, and the scoped Vane conversion fixture is recorded. Gap: flow dimensions and INT-007’s general custom-event goal path remain unfinished; no real Vane or provider call is claimed.

Smile exposes customer profile and balance observations; earned-points and tier-transition observations are not inferred. Yotpo remains disabled pending a verified signing protocol. Remaining: live provider payload confirmation and review-request flow conversion/exit through FLOW-*.

The shared public-app connector and merchant-install route are not built. Existing developer-adapter sync and signed-event evidence do not prove merchant authorization, App Store start or provider scope admission.

Mandatory privacy intake, durable acknowledgment and delayed post-uninstall redaction remain unbuilt; RL-106 requires protected residual routing rather than deleting reachability with live credentials.

The connector disconnect, post-disconnect custody and reinstall journey are not built; retaining late mandatory routing is required by RL-106, not permission for live forwarding.

The merchant-installed bulk first sync, restart, progress, two-hour capacity bar and pre-completion audience gate are not proved by existing developer-adapter fixtures.

The connector wiring, merchant-facing step state and installed-connection flow/code/consent journey are not built; developer-adapter checks alone do not prove them.

acceptance not yet met: runs on synthetic exports, extended with checked-in Mailchimp-format fixtures for a saved segment with a campaign-activity condition, a classic automation, a granular_activity file, two overlapping audiences with conflicting statuses and a template with merge tags and a <style> block. Each fixture shows its expected lines in the reconciliation report (MOVE-007 to MOVE-011). The CONT-024 subscribed-file fixture and the MOVE-012 full-scale export run through the same journey. The same journey also runs on one real, owner-supplied Mailchimp export with its reconciliation report.

Owner/Admin one-time Klaviyo API read and CSV preset retain email source method/time, restrictive suppressions, properties, list/segment review snapshots, library templates and original-time order/engagement history. Unsupported conditions and abandoned-cart action steps are named in the report. preserves these records on native restore. Gap: executable flows (FLOW-002/008), parallel-run sync (MOVE-013) and real-provider sandbox proof. Positive incumbent SMS remains held under CONT-024/A2P; missing row time or collection point never grants SMS consent. Snapshot membership grants no additional category consent. The source outline is now also an inert saved FLOW-001 draft revision; source trigger/action execution is unavailable.

Owner/Admin one-time ActiveCampaign API read and CSV preset retain contacts, list membership as review topics, tags, custom fields, unsubscribes and bounces. The key is used only in bounded declared-host HTTPS reads and is not stored or logged. Automation names/statuses form a readable report outline; unavailable trigger/action definitions are named. Gap: executable automations (FLOW-002/008), parallel-run sync (MOVE-013) and real-provider sandbox proof. Review topics grant no additional category consent. The source outline is now also an inert saved FLOW-001 draft revision; source trigger/action execution is unavailable.

beehiiv, Omnisend and Customer.io documented CSV presets retain source status, tiers, attributes and tags; explicit source attestation carries incumbent-held email evidence and reconciliation counts evidence kinds. Unsubscribed, bounced and suppressed rows remain restricted. Gap: API pulls and parallel-run sync (MOVE-013); real-provider export proof pending. Missing or unfamiliar subscription states remain non-subscribed.

acceptance not yet met: After a move-in, the report's counts reconcile to the files and contact table, and no campaign or flow is scheduled or live. The report counts consent per evidence kind (CONT-024) and names the attestation each relies on. The cutover checklist shows the parallel-run sync (MOVE-013), or the re-import advice for an export-only move-in, and Mark cutover complete ends the sync. The checklist names any template or live message still loading images from an incumbent host (MOVE-014).

acceptance not yet met: After a move-in, the report's counts reconcile to the files and contact table, and no campaign or flow is scheduled or live. The report counts consent per evidence kind (CONT-024) and names the attestation each relies on. The cutover checklist shows the parallel-run sync (MOVE-013), or the re-import advice for an export-only move-in, and Mark cutover complete ends the sync. The checklist names any template or live message still loading images from an incumbent host (MOVE-014).

Historical contact/time/campaign/link facts, imported/dropped reconciliation, dormancy distinctions and populated native result preservation are asserted. The cited evidence does not compare consent state and consent-evidence rows before and after the initial historical-event import; its after-import status snapshot cannot prove that import changes no consent. Missing public-door journey: “Incumbent engagement history — complete acceptance”, covering the unasserted outcomes above.

acceptance not yet met: A fixture has two audiences that share addresses: one address subscribed in A and unsubscribed in B, one cleaned in B, and one with a different first name in each. Each address becomes one contact. The first is subscribed to topic A and unsubscribed from topic B, the cleaned one is suppressed on email, and the first-name conflict is listed. The report counts each audience and their overlap.

Gap: Campaign bodies remain imported history copied into drafts rather than automatically becoming library templates. Only FNAME, Klaviyo first_name, UNSUB and LIST:ADDRESS/ADDRESSLINE map to existing rendering targets; LNAME, DATE, CURRENT_YEAR, ARCHIVE, UPDATE_PROFILE (CONT-016), arbitrary property mapping and unknown fields remain visible and block personalization approval. The conservative name fallback is there; per-owner fallback configuration is unproved. CSS supports simple element/class selectors and top-level 480px mobile font size, line height, padding and alignment; other selectors, media widths, nested rules and orientation/hiding mappings remain unproved. Source-body inherited styles, complete per-location dropped-block diagnostics, general same-hue nearest-shade correctness across all backgrounds, a dedicated per-recoloring builder undo control and complete ActiveCampaign/Kit template conversion remain unproved; Klaviyo coverage currently proves only its supported name tag. Oversized results retain measured size, limit and largest blocks in custody/reconciliation, but cannot yet open directly in the builder for trimming. Mailchimp-host images in converted templates are re-hosted through the MOVE-014 journey; the rest follows MOVE-014's Gap. Host use counts and campaign review actions are covered by the existing imported-host journey; one-step reconciliation allowance/audit and flow-message review remain unproved. Mailchimp blueprint is CC BY-SA 3.0; vendoring waits on an owner licence decision.

Gap: Campaign bodies remain imported history copied into drafts rather than automatically becoming library templates. Only FNAME, Klaviyo first_name, UNSUB and LIST:ADDRESS/ADDRESSLINE map to existing rendering targets; LNAME, DATE, CURRENT_YEAR, ARCHIVE, UPDATE_PROFILE (CONT-016), arbitrary property mapping and unknown fields remain visible and block personalization approval. The conservative name fallback is there; per-owner fallback configuration is unproved. CSS supports simple element/class selectors and top-level 480px mobile font size, line height, padding and alignment; other selectors, media widths, nested rules and orientation/hiding mappings remain unproved. Source-body inherited styles, complete per-location dropped-block diagnostics, general same-hue nearest-shade correctness across all backgrounds, a dedicated per-recoloring builder undo control and complete ActiveCampaign/Kit template conversion remain unproved; Klaviyo coverage currently proves only its supported name tag. Oversized results retain measured size, limit and largest blocks in custody/reconciliation, but cannot yet open directly in the builder for trimming. Mailchimp-host images in converted templates are re-hosted through the MOVE-014 journey; the rest follows MOVE-014's Gap. Host use counts and campaign review actions are covered by the existing imported-host journey; one-step reconciliation allowance/audit and flow-message review remain unproved. Mailchimp blueprint is CC BY-SA 3.0; vendoring waits on an owner licence decision.

Gap: Campaign bodies remain imported history copied into drafts rather than automatically becoming library templates. Only FNAME, Klaviyo first_name, UNSUB and LIST:ADDRESS/ADDRESSLINE map to existing rendering targets; LNAME, DATE, CURRENT_YEAR, ARCHIVE, UPDATE_PROFILE (CONT-016), arbitrary property mapping and unknown fields remain visible and block personalization approval. The conservative name fallback is there; per-owner fallback configuration is unproved. CSS supports simple element/class selectors and top-level 480px mobile font size, line height, padding and alignment; other selectors, media widths, nested rules and orientation/hiding mappings remain unproved. Source-body inherited styles, complete per-location dropped-block diagnostics, general same-hue nearest-shade correctness across all backgrounds, a dedicated per-recoloring builder undo control and complete ActiveCampaign/Kit template conversion remain unproved; Klaviyo coverage currently proves only its supported name tag. Oversized results retain measured size, limit and largest blocks in custody/reconciliation, but cannot yet open directly in the builder for trimming. Mailchimp-host images in converted templates are re-hosted through the MOVE-014 journey; the rest follows MOVE-014's Gap. Host use counts and campaign review actions are covered by the existing imported-host journey; one-step reconciliation allowance/audit and flow-message review remain unproved. Mailchimp blueprint is CC BY-SA 3.0; vendoring waits on an owner licence decision.

acceptance not yet met: A generated Mailchimp account export with 250,000 contacts across the subscribed, unsubscribed, non-subscribed and cleaned files and 52 weekly campaigns with granular_activity moves in through the journey. It is interrupted once by a forced worker restart during the activity import and resumes to completion with no re-upload. Its reconciliation report adds up per file, evidence kind and activity rows. A campaign to the whole subscribed audience then reaches review with an eligible count equal to an independent count over the generated files. The run records its wall time and peak memory. A generated API-pull fixture of the same size completes the same way.

acceptance not yet met: A generated Mailchimp account export with 250,000 contacts across the subscribed, unsubscribed, non-subscribed and cleaned files and 52 weekly campaigns with granular_activity moves in through the journey. It is interrupted once by a forced worker restart during the activity import and resumes to completion with no re-upload. Its reconciliation report adds up per file, evidence kind and activity rows. A campaign to the whole subscribed audience then reaches review with an eligible count equal to an independent count over the generated files. The run records its wall time and peak memory. A generated API-pull fixture of the same size completes the same way.

acceptance not yet met: A generated Mailchimp account export with 250,000 contacts across the subscribed, unsubscribed, non-subscribed and cleaned files and 52 weekly campaigns with granular_activity moves in through the journey. It is interrupted once by a forced worker restart during the activity import and resumes to completion with no re-upload. Its reconciliation report adds up per file, evidence kind and activity rows. A campaign to the whole subscribed audience then reaches review with an eligible count equal to an independent count over the generated files. The run records its wall time and peak memory. A generated API-pull fixture of the same size completes the same way.

Gap: The cutover checklist item and its block on Mark cutover complete (MOVE-006 checklist unbuilt; MOVE-013 owner-held), flow messages (FLOW-*), and every other incumbent's image hosts beyond the Mailchimp-host fixtures proved here remain unproved. Large galleries remain subject to the existing retained archive-data budget. Scheduled-campaign enumeration beyond the proved template and draft list remains unproved.

Stripe test-mode checkout through the Owner connection with a restricted test key remains unproved; the Nectar rail is not connected (INT-004). Payer signup and consent capture remain PUB-005’s separate obligation, with its own unfinished acceptance. A Stripe Tax source read is not provider proof.

Paid signup, provider return, recorded permission and one confirmation, own-confirmation paid-only delivery, opt-out/suppression and erasure are asserted. Unasserted: Only Owner-saved tier can be offered. Missing public-door journey: “Paid signup page and payer consent — complete acceptance”, covering the unasserted outcomes above.

Asserted in its paid-signup leg: paid-checkout evidence and one confirmation for a first-time payer, consent missing until confirmed; no paid-only send before and exactly the payer after the confirmation; an unsubscribed payer stays unsubscribed until their own POST; a suppressed payer gets no confirmation; payment never widens permission; erasure removes the address and evidence. Unasserted: no free newsletter reaches a pending payer before confirmation, and a suppressed payer receives no newsletter (none is reviewed or sent to either).

Binding-edge health cases are exercised. Real elapsed workerd cancellation, actual Queue latency, hosted isolate behavior and the deploy probe are not established by those cases.

The existing proposal forecast and service provide store-grounded observations. Scheduled retention findings for both a missing post-purchase flow and a lapsed cohort, their cited queries and counts, and the installation-history revenue estimate remain unproved.

Existing synchronization and provider-outage handling provide source recovery primitives. The six-hour agent diagnosis, affected-checkout listing, deduplicated relevant replay and company-policy decisions are not yet proved.

Existing proposal generation has grounding and rejection checks. Abandoned-cart and flow-message drafting across all listed content fields, brand and measured-history inputs, and the agent registry’s policy-based send and activation paths remain unproved.

Existing proposal-route checks constrain generation. The complete policy-driven routine job matrix, grant-valued Activity filter, disabling the next scheduled run and owner-set routine budget remain unproved.