Pace candidate funnel to send capacity

docs/product-and-safety.md

@@ -16,6 +16,7 @@ The product has five connected goals:
 
 - Eligibility is completed before selecting a recipient: already-processed posts, recipient history, self-declared age/gender for chat posts, seller signals, content suitability, and AI safety all have explicit outcomes.
 - Existing replies take priority over new outreach. An account with actionable inbound messages is not available for a new candidate.
+- Candidate inventory follows near-term outbound capacity and the recent-post window; discovery pauses instead of accumulating an ever-older backlog when accounts cannot keep pace.
 - Discovery is global while authentication, rate limits, conversations, and content remain account-owned.
 - Recipient deduplication is case-insensitive, durable across restarts, and protected by a live reservation during sends.
 - Remote side effects are fail-closed: a send is recorded only after the chat service confirms it; interrupted reply claims reconcile against Matrix history before retrying.