1 · The matrix is the routing table, not a mirror of one. Each cell writes a row in the routing configuration that notification-router reads at dispatch time. Turning a channel off here suppresses delivery for that event for every recipient in that audience — it does not merely hide a preference.
2 · Consent outranks configuration. An SMS cell switched on still sends nothing to an exchanger without a verified TCPA prior-express-written-consent record. The Opt-In Ledger is the authority; the matrix is the intent. Suppression is shown in the dispatch log as a state, never as a silent drop.
3 · The ledger is append-only. A consent change writes a new entry with its own timestamp, channel, and capture method. Existing entries are never updated or deleted. Retained seven years for BSA/AML and IRS books-and-records; exportable for a CCPA/CPRA request.
4 · GLBA and TCPA are different regimes and are labelled as such. Transactional email under GLBA Reg P is opt-out; consumer SMS under TCPA is opt-in. QI staff and Platform Ops traffic is internal and exempt from both — the badge says which rule applies rather than leaving the reader to infer it.
5 · Channel credentials are write-only. Secrets render masked and are never returned by the API after save. A configuration change fires a test delivery before it goes live, and every change writes an audit entry with the actor.
6 · Failure is visible, not swallowed. Retry state, attempt count, and the next retry time are on the surface; the dead-letter queue is a Vectr concern, and the log names the workflow run so a failure is traceable end to end.
7 · Tokens only. Every colour reads from tokens.css — no page-local palette, no linked dark-only stylesheet. Channel identity uses the hub tokens; delivery status uses the good/warn/bad triad plus an icon and a word, so status never depends on colour alone. Light and dark are both designed. All names, numbers and endpoints are synthetic.