Pace candidate funnel to send capacity

docs/configuration.md

@@ -35,7 +35,7 @@ Never document real values. `.env` is ignored and may contain production credent
 - `targetGenders`: allowed parsed values.
 - `filterSellers`, `sellerKeywords`, `sellerDomains`: seller policy inputs.
 - `prioritizeRecentPosts`, `recentWindowMinutes`: recency/fallback behavior.
-- `maxReadyCandidates`: maximum prepared backlog admitted before screening pauses; valid range 1–500.
+- `maxReadyCandidates`: hard ceiling for the active candidate target; valid range 1–500. Runtime lowers the actual target to what authenticated running accounts can send within `recentWindowMinutes` under current rolling-hour and message-spacing limits.
 
 Subreddit `type` is `image` or `chat`. Conversation policy contains `mode`, `maxAutomatedTurns`, and `rapportTurnsBeforeMediaAsk`; hybrid rapport turns must be lower than the maximum.
 

docs/data-flow.md

@@ -25,7 +25,7 @@ stateDiagram-v2
 
 The discovery loop rotates through enabled subreddits and authenticated runtimes. A runtime fetches Reddit `/new` data using the process-shared `RedditRequestCoordinator`. Intake deduplicates post IDs and authors, excludes processed/contacted history, stores the full post snapshot, source type, weight, and timestamps, and logs exact intake counts.
 
-The queue has a bounded active size. Screening also pauses at configured `reddit.maxReadyCandidates`, and due delivery retries are promoted only while that ready capacity exists. Reddit request pacing, not a tight application poll, is the primary limiter.
+The queue grows to a demand-based target rather than a fixed backlog. The target is the smaller of configured `reddit.maxReadyCandidates` and the work that authenticated running accounts can still send within the recent-post window, accounting for rolling hourly capacity and minimum message spacing. Intake admits only the current deficit, pauses at zero outbound capacity, and reports fetched posts left unevaluated because the funnel is full. Reddit request pacing, not a tight application poll, remains the primary request limiter.
 
 ### 2. Screening and preparation
 

docs/product-and-safety.md

@@ -16,6 +16,7 @@ The product has five connected goals:
 
 - Eligibility is completed before selecting a recipient: already-processed posts, recipient history, self-declared age/gender for chat posts, seller signals, content suitability, and AI safety all have explicit outcomes.
 - Existing replies take priority over new outreach. An account with actionable inbound messages is not available for a new candidate.
+- Candidate inventory follows near-term outbound capacity and the recent-post window; discovery pauses instead of accumulating an ever-older backlog when accounts cannot keep pace.
 - Discovery is global while authentication, rate limits, conversations, and content remain account-owned.
 - Recipient deduplication is case-insensitive, durable across restarts, and protected by a live reservation during sends.
 - Remote side effects are fail-closed: a send is recorded only after the chat service confirms it; interrupted reply claims reconcile against Matrix history before retrying.