Template reject: no silent fallback burn

A rejected template is a hard fail path, not a yellow chip that still ships. When review returns Rejected — or a Live ID flips mid-flight — prepaid must not silently burn SMS segments or session units “so the user still gets a code.” Silent fallback without a named policy is wallet melt with a green UI. This page is the fail-path contract — not channel shopping or “OTP rail when not Live.

Related: Template catalog before channel Live, Template review gate and unit class, Abuse spike: stop without fake success, Wallet stop-lines before production.

IOSOR is white-label prepaid. USD 20 funds a reject-path pilot on one template ID; soft review near USD 1,000/month prices silent fallback burn as recon debt. Clients see white-label reject macros only.

Rejected means stop, not invent another class

Rejected, Retired, and unknown IDs fail closed. Send does not proceed on the rejected ID and does not auto-rewrite into another message or unit class unless a named fallback policy says so — owner, trigger, Approved target ID, unit class, and debit tag written before volume language. Soft USD 1,000/month treats “fell back in code” as volume debt; USD 20 proves Rejected never debits without policy.

What silent fallback burn looks like

Abuse spikes already forbid fake success — Abuse spike: stop without fake success. Template reject inherits that honesty: no Delivered for a path that never left the prepaid gate under an Approved ID.

Policy-named fallback or none

Fallback is optional design, never an invisible default. If policy allows a secondary path, it names reject class, Approved target ID, unit class, debit tag, and whether wallet stop-lines still apply (Wallet stop-lines before production). Missing any field means no send. Open holds release or refund per Hold fail auto-refund and status truth. Idempotency reuses the first money result; a second silent attempt is a second burn.

Status truth product and finance share

One export row per intent: template ID + review state at decision, brand-safe reject class, fallback policy ID or “none,” hold/release/refund amounts, unit class if debit posted, correlation ID.

Buyer checklist for reject without silent burn

1. Rejected / Retired / unknown IDs blocked from production send?
2. Any fallback requires a named policy with Approved target + unit class?

Start with IOSOR

Open the console template gate to inspect how rejected or unmapped template IDs behave under live load. Confirm that any payload flagged as rejected or retired immediately triggers a fail-closed hold release rather than defaulting to a generic message class. If a secondary path is required, bind it directly to an explicit, policy-named fallback ID with pre-allocated debit tags.

IOSOR takeaway

Silent template fallbacks hide upstream rejections and create untracked unit debits that corrupt financial reconciliation. Disguising a rejected template as an unapproved alternate payload burns budget without proper audit trails or brand guarantees.

Do enforce strict, named fallback policies that explicitly declare approved target template IDs, unit classes, and debit tags prior to engine release. Don't allow implicit system defaults to rewrite rejected template IDs or bypass review states at dispatch.