Delivers
A defined and tested quota policy for emails Plunk intentionally suppresses before SES submission. Today BillingLimitService.getTotalUsage and getUsage count every email row regardless of status or failure reason.
sendWorkflowEmail already creates a FAILED row for an unsubscribed contact before its billing-limit check, and the queued-backlog unsubscribe patch extends that same intentional suppression to the enqueue/worker race, so a backlog of unsubscribes can consume quota despite no provider submission.
Done when
- The product policy distinguishes intentional pre-submit suppression from provider failures.
- Free-tier and per-category usage queries implement that policy without weakening real send limits.
- Focused tests cover enqueue-time and worker-time unsubscribe suppression.
- The fix is upstreamed.
Context
Kept outside the unsubscribe-suppression patch so that compliance change stays independently reviewable and retry-state semantics are owned separately. Part of #9.
Delivers
A defined and tested quota policy for emails Plunk intentionally suppresses before SES submission. Today
BillingLimitService.getTotalUsageandgetUsagecount every email row regardless of status or failure reason.sendWorkflowEmailalready creates aFAILEDrow for an unsubscribed contact before its billing-limit check, and the queued-backlog unsubscribe patch extends that same intentional suppression to the enqueue/worker race, so a backlog of unsubscribes can consume quota despite no provider submission.Done when
Context
Kept outside the unsubscribe-suppression patch so that compliance change stays independently reviewable and retry-state semantics are owned separately. Part of #9.