Require tenant-owned jobs, explicit confirmation, canonical request IDs, and rate limiting before provider delivery. Persist sent correspondence with a content-free idempotency ledger, and never retry uncertain outcomes automatically.
Tracks only idempotency and delivery metadata; recipient, subject, and body are excluded. No provider send path is enabled.
cesnimda