- Shipped
- June 27, 2026 at 6:38 AM UTC
- Author
- Kamo
- Commit
- 8ab4668
The crash-safe per-recipient send queue + durable frequency-cap counter (co-transactional per §10.3). NotificationOutbox (partial-WORM, CommunicationArchive idiom MINUS @PreRemove — a prunable operational queue, not legal evidence): frozen identity/content + freeze-at- enqueue (messageKey + renderedBody) + forward-only OutboxStatus {PENDING,SENT,SUPPRESSED, FAILED} + write-once sentAt; messageKey UNIQUE dedup anchor. NotificationRateWindow (mutable durable counter, no WORM — §6.4 increments in-txn) + composite UNIQUE (org,party,eventKind, windowStart). DISTINCT from the mlos.event MlosOutboxEvent (event backbone). Faithful mirror of the reviewed CommunicationArchive partial-WORM — no review workflow. 12 tests.