docs: lock dual-stream email decisions + verified institutional audience size

Measured against May 2026 NPPES endpoint_pfile (tightened HISP filter):
- 92,592 institutional NPIs across 38,873 practice domains (76% single-provider)
- 19,072 consumer-webmail NPIs (ride trucking discipline)
- 242,441 Direct/HISP rows parked until DirectTrust.
Decisions: single Postfix + class hc transport (:2526), 2nd Listmonk instance
(listmonk-hc, own cap + own listmonk_hc DB), 10k/day institutional ceiling.

docs/healthcare-email-stream-plan.md

@@ -19,6 +19,28 @@ constrained by the same ceiling:
   snowshoe heuristics** that torch the trucking IPs. Its deliverability is
   largely independent of the reputation we're protecting on `.94-.96`.
 
+### Verified audience size (May 2026 NPPES endpoint_pfile, measured)
+Classifying every email-formatted endpoint (deduped) with the tightened
+Direct/HISP filter (`direct`, `medicity.net`, `surescripts`, `updox`, `maxmd`, …)
+and the consumer-webmail set:
+
+| segment | rows | NPIs | routing |
+|---|---:|---:|---|
+| Direct / HISP | 242,441 | — | **parked** (DirectTrust-only routing, won't cold-deliver) |
+| Consumer webmail | 19,366 | ~19,072 | rides the **trucking** consumer-discipline stream |
+| **Institutional (practice domains)** | **94,348** | **~92,592** | **HEALTHCARE HOT stream** |
+
+Institutional spread: **38,873 distinct domains**, **76% of which have exactly 1
+provider** (small practices = our $399 PECOS-revalidation buyer). Top-100 domains
+are only 23% of volume → healthy long tail, no single MX gets hammered. (Excludes
+a handful of non-prospect giants — `va.gov`, `mail.mil`, `cvshealth.com`,
+`walgreens.com`, `wal-mart.com` — that we drop in the audience build.)
+
+This sizes the hot stream: at ~92k deliverable institutional addresses a 10k/day
+ceiling drains the list in ~2 weeks; stuck behind the 4k trucking cap it would
+take ~23 days AND poison the trucking IPs. Hence the split.
+
+
 So the goal is **stream isolation**: let healthcare-institutional mail run hot on
 its own IPs/cap while trucking keeps trickling on the warmed consumer-facing IPs,
 with neither able to damage the other.
@@ -172,14 +194,20 @@ dead practice mailboxes (`550 5.1.1` from a clinic MX still hurts the hc IPs).
 - **No regression:** trucking delivery mix unchanged after the split (same
   monitoring commands, same `.94-.96` volumes).
 
-## Open decisions for Justin
+## Decisions (locked)
-1. Real institutional-domain count: re-run the list builder on fresh NPPES data to
+1. **Postfix:** single instance + class-based hc transport (port `:2526` →
-   get the exact `npi_healthcare_institutional.csv` size before we size the hc cap.
+   hc rotation pool). No `postmulti`.
-2. Single Postfix instance (class transport) vs `postmulti` second instance.
+2. **Listmonk:** a **second instance** (`listmonk-hc`) with its own
-3. Listmonk: second instance (recommended, true cap isolation) vs single instance
+   sliding-window cap → true cap isolation.
-   with windowed sends.
+3. **Institutional ceiling:** **10k/day** (warm up to it).
-4. How aggressive on the institutional ceiling (10k/day proposed) — start
+4. **Contacts DB:** separate (`listmonk_hc` database) — cleaner per-stream
-   conservative and let data raise it.
+   bounce/complaint accounting, and the hc instance needs its own DB anyway.
-5. Whether hc uses a **separate Listmonk contacts DB** (cleaner per-stream
+5. **Audience count:** measured — ~92,592 institutional NPIs / 38,873 domains
-   complaint accounting) or shares the existing one.
+   (see table above).
+
+## Open / for-later
+- How aggressive on the institutional ceiling beyond 10k/day — raise only with
+  clean delivery data.
+- DirectTrust signup to unlock the 242k Direct/HISP segment (separate effort).
+
 ```