The record of what an organisation sent, carrying none of it
mail/1 and the estate's mail control plane: a lane policy that refuses, a capture that demands a consent basis, a content-free event record, and a transport seam so the provider is a variable.
Eleven send helpers across seven repositories agreed about nothing, and not one recorded that a message existed — so a domain that had silently stopped delivering looked exactly like a week when nobody wrote to anyone. One send path, and a published record content-free enough that it can actually be published.
`mail/1` is a content-free, append-only record of what an organisation sent: a lane, a disposition, a counterparty domain and a time. No subject, no body, no address — which is what makes it publishable, and a log that cannot be published gets rebuilt privately by everyone who wants one.
Five lanes carry the consent rule onto the one channel nobody had gated. An agent may compose every word of a message to somebody who did not ask us for anything, and a named human sends it; `held` is a success rather than an error, because a draft waiting for its person is the product. `transactional` deliberately does not consult the suppression list — a person who left a digest has not asked to be locked out of their own account.
A delivery outcome is a transition rather than an edit: a bounce writes a NEW leaf naming what it supersedes, and the current disposition is derived. The published projection is an aggregate rather than a list, because order alone separates recipients inside one domain from each other, and a domain below the small-cell floor folds into `other` — with the floor and the folded count published, since an unstated suppression rule is indistinguishable from a domain nobody wrote to.
The projection refuses a document whose rows do not sum to its headline, so a breakdown built before its totals fails rather than publishing a quiet disagreement. The leaf shaper refuses a body carrying any of a named list of identifying fields, however it is spelled. The DNS check lives in the package and byte-identically in a dependency-free vendored copy, and a differential test runs both over nine synthetic zones and fails on any disagreement about the verdict — never by comparing constants, which is a test of how a rule is spelled rather than of what it decides.
Apache-2.0, read from the package’s own manifest. Embed it in anything, including closed software — that is what makes a spec adoptable and a verifier worth running. FlashyOS’s server side is AGPL-3.0-only instead, and a test in the monorepo asserts the direction between them: AGPL code may consume this, this may never consume AGPL code.