Postmortem: June 29 mass-send was a crash, not a bounce storm

333,795 'failed' rows in newsletter_sends explained. All 9,800 'sent' rows carry SES message ids and went out in one 53-minute burst; none of the 333,795 'failed' rows have an SES id — so they never reached SES. Signature of a serverless timeout that drained ~9,800 then bulk-marked the rest failed, not undeliverable email. The 333k were never delivered and produced no bounces. The real exposure is the list: 344,789 vnoc_lead subscribers imported in one day with only 80 marked invalid (0.02%) — hygiene (lib/qualify.ts) never ran. A fixed send loop against this same list would deliver all 344k and then bounce at scale. The crash masked the risk; it didn't remove it. Gaps: newsletter_sends has no error column, the send loop isn't chunked/ resumable, and the import bypassed hygiene. Hard gates listed before any resend. Creating per-domain drafts stays safe (composes only).