feat(outbound): enforce sending policy at fire time (B6)

[jiashuoz]

What

Slice B6 of the sending abuse prevention plan (Task 6: primary outbound worker, hold deadlines, legacy resolver, composition root). Four commits, bottom-up.

• Worker order over the Gate (internal/outboundsend): Reserve → early hold snoozes without I/O → rate gate DeferAttempts → final suppression CancelAttempts → ConsumeAttempt → authorized submit. The worker-owned RampGate and agent.NewOutboundRampGate are removed; the ramp lives inside the gate (B4) and moves only through settlement. Deliverer now carries the token; production's deliverer is outbound.ProviderSubmitter (B5), which refuses to dial without one. A lost 250 (ErrProviderAcceptanceUnknown) retries as a new ordinal and is never settled.
• Enqueue prepares the operation in the accept transaction (PrepareExternalTx between message insert and River insert). A paused account is refused at the door: ErrSendingPaused → HTTP 403 sending_paused, transaction rolled back. Legacy jobs (no operation_ref in args — a pre-floor slot) resolve at fire time via Jobs.ResolveLegacyOperation, the same Prepare path.
• Durable hold deadlines: messages.local_hold_class / local_hold_anchor (migration 116) ride the claim; the deadline is always derived (72h for rate_ramp_or_provider and tenant_setup, 7d for policy_budget). First-hold anchor = max(accept, schedule, review, last resume); budget promotes any class keeping the anchor; policy_budget is sticky; tenant readiness inside the setup deadline moves to rate/ramp/provider once; a pause has no clock but a running deadline keeps running. Expiry reasons: submission.local_retries_exhausted, submission.sending_setup_expired, submission.policy_budget_expired (the last two are new catalog entries).
• Settlement-only reconciliation: an evidence-settled row also settles the attempt that dialed via the new Gate.SettleOperation (latest started attempt); Gate.LookupOperation recovers a reference for an existing operation (not a constructor).
• Composition root cmd/e2a/outbound_wiring.go + sending_policy_wiring_test.go, which proves the registered send path holds the concrete *sendingpolicy.Module and the ProviderSubmitter-backed deliverer. Test servers build the same composition with the disabled policy.

Gate for this slice (per plan)

Hosted policy stays disabled; the primary path uses the authorization seam without enforcing budgets. Prod behaviour with the disabled policy: every send still gets a durable operation + attempt and a redeemed token, and the ramp remains pass-through. This is the first slice whose code runs on every prod send, so it needs the staging soak the plan calls for before promotion.

Review round 1

Two parallel Opus reviews (correctness + adversarial). Everything below is fixed in the follow-up commits, each with a named test:

• Contract surfaces (blocker in both reviews): sending_paused registered in the error catalog, the ErrorBody.Code doc, docs/api.md, and both SDK error maps; the two lifecycle reasons added to the hand-maintained reason_code enum tag, the two closed-vocabulary tests, the regenerated spec, both generated SDK models (mirrored by hand — the generator needs Docker), the web lifecycle parser and timeline labels, docs/api.md, docs/events.md.
• Gate outage was an unbounded snooze: now a bounded rate/ramp/provider hold like every other wait.
• Pause semantics: a paused job evaluates no deadline (spec), but a persisted deadline is not extended — the first hold after resume applies it.
• Provider outage never emits the setup reason (spec).
• Worker's evidence-settle under a terminal write now settles the dialed attempt through SettleOperation, matching the reconciler; a failed post-acceptance settlement is retried before it is logged as critical; ErrProviderMessageIDConflict is surfaced as an invariant alarm, never a plain log line.
• SettleOperation attribution: prefers the oldest dialed attempt with no provider id yet, so evidence arriving in send order binds each attempt correctly when several dialed.
• The job's operation reference must name its message: a mismatch cancels before any ledger call. Enqueue refuses a zero reference rather than emitting a legacy-looking job.
• Paused account on every enqueue path: 403 sending_paused on the direct, platform-test, and HITL-approve paths; the TTL auto-approve sweep defers a paused account's expired review by an hour (DeferReviewExpiry) instead of re-picking it first every cycle and starving the batch.
• Wiring test now inspects the armed worker RegisterJobs registers (gate + legacy resolver) and the submitter's configuration set, not just the bundle field.
• HoldClassFor maps reasons by name with a table test; the eval-runner integration test admits the operation_ref args key.

Known and deferred, recorded in the ops project memory: SES tenant readiness has no production writer yet — tenant_header_mode must stay disabled until the provisioning slice lands, or every customer send holds and expires as setup; reservations stranded by a best-effort cancel failure are day-scoped by design; ramp units stay reserved for an ambiguous-then-failed send by design (a message that might have been delivered must not release capacity); a first hold on a message already past its anchor's horizon expires at once (the anchor rule, by design).

Review round 2

Mutation-tested re-review of the round-1 fixes: no blockers, six should-fixes, all addressed:

• SettleOperation without a token now resolves the attempt in this order: one already bound to the exact provider id (a replay stays on its own attempt), else the oldest dialed attempt with no id, else the latest dialed; test extended to the replay-with-a-later-unbound-attempt shape.
• A gate outage at final authorization threads the live reservation into the bounded hold, so an expiry gives the attempt back instead of stranding it.
• MarkFailed returns the evidence's provider id, and the worker's evidence settle under a terminal write carries it (the reconciler already did).
• The post-acceptance settlement retry logs at critical level when the context ends mid-retry.
• The wiring test now registers workers exactly as main does and inspects the worker River received, not a freshly constructed one.
• sending_paused is marked experimental alongside blocked_by_policy (stability extension, docs, and the description), since the pause control ships disabled and pre-GA.

Nits recorded, not changed: the reviewers' page and pending-message API show a paused account's review TTL sliding forward an hour per sweep (silent, no event); the CLI exits with the generic request code for sending_paused.

Not in this slice

• The AST closure guard and making raw relay methods package-private (Task 7).
• HITL / webhook-health / public-feedback paths on the seam (Task 7). Sender.SubmitOnce* remains for them.
• The -reconcile-legacy-sending-jobs operator command (inventory); the fire-time resolver covers correctness.
• The delivery-feedback consumer calling SettleOperation on SNS evidence (worker + reconciler do; the consumer is a follow-up).

Tests

Unit (fake gate): allowed path order; every hold reason → class and snooze without I/O; pause indefinite; pause under a running budget deadline expires; promotion and stickiness; expiry reason per class; terminal holds cancel; rate deferral defers the attempt; suppression cancels it; late-gate hold; gate outage snoozes without burning an attempt; evidence settles the operation; legacy resolution (accept / paused / orphan / unwired); tenant readiness transition (in time / too late); anchor rule; acceptance-unknown retried unsettled; hold constant matches the policy default.

DB-backed (real gate): enqueue writes operation_ref and the operation row; paused account refused and rolled back; legacy job authorizes through the gate; a gated job authorizes with a real token and a re-drive allocates nothing; the reconciler settles the dialed attempt from evidence and binds the provider id.

Full suites green for outboundsend, agent, cmd/e2a, testutil, sendingpolicy, sendramp, outbound, hitlworker, delivery, messagelifecycle; -race clean on outboundsend + sendingpolicy. Three engagement/outreach tests in agent/identity fail identically on clean origin/main locally (pre-existing, CI-green).

🤖 Generated with Claude Code

https://claude.ai/code/session_01AjfGxvXW6fNKWGFHuo68yX