mail-address-semantics/workplans/MAS-WP-0012-single-outbound-path.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
MAS-WP-0012	workplan	One outbound path and one send cap	communication	mail-address-semantics	proposed	claude	coulomb-social	2026-10-19	2026-10-19	residual	MAS-WP-0010	be2db53f-9acc-5bf0-a6dc-fb99cbc8e46b

One outbound path and one send cap

Risk C in history/2026-10-19T090725Z-scope-vs-intent.md. With both roles in one deployment, the ticket service and mas_modes.mailer each keep their own outbox and cap. Total outbound can then reach about twice the configured cap. They also act differently over the cap: the ticket service keeps replies unsent, while the mailer refuses with send-cap-reached. Principle 10 says "caps how much it can send in total".

Route all mail through the mailer

id: MAS-WP-0012-T01
status: todo
priority: medium
state_hub_task_id: "5d9fefac-684d-5fe0-bead-f664952047e0"

Make mas_modes.mailer.Mailer the only outbound path. The ticket service then sends through a Mailer it is given, sharing the DB or an outbox service, instead of its own outbox table and cap. Settle one behavior over the cap, and record it in CONTRACT.md §6. Keep the ticket service's /outbox inspection working, and keep the deployment's --max-sent semantics.

Test the shared cap

id: MAS-WP-0012-T02
status: todo
priority: medium
state_hub_task_id: "431cc528-cf9f-5991-8044-7cbab2ac0021"

Add a test that a deployment with both roles stops at exactly N sends in total, and that the live entrypoint still passes MAS_MAX_SENT to the single cap.