Reaches OUT, which is why it carries its own scope: in PROBE mode it
connects, negotiates TLS and authenticates without delivering anything; in
SEND mode it delivers exactly one message to the recipient the caller

names.

The verdict is recorded against the configuration the row holds NOW, and an edit invalidates it. A provider can only be enabled on a passing verdict measured against its current configuration.