Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
Immediate notifications and safe retry
Source: architecture rev 3 p. 7; proposal p. 11.
flowchart LR R[Authorised business change] --> T[ONE transaction<br/>business state + outbox event] T --> W[Worker claims durable job] W --> A[Recheck access<br/>current recipient] A --> S[Send minimal email<br/>authenticated link] S --> D[Delivery record<br/>sent / failed / skipped] S -.transient failure.-> RT[Bounded retry / backoff] --> W D -.-> L[Link opened<br/>recheck access again]
- At-least-once processing with duplicate protection. A send timeout may be ambiguous: reconcile, never blindly resend, never promise exactly-once.
- Unique event-recipient-channel key; durable attempt history; idempotency at the provider where supported.
- Four immediate business events: new interest, assigned private question, accepted discussion, material revision. Account/security email is separate. Digests, quiet hours, overdue-email reminders and escalation are not in Balanced.
- Email is generic: no private message body or confidential terms; the link reauthorises.
- Recipient is the currently authorised responsible user; reassignment or revocation can suppress a queued send.
- Verify callback signatures and deduplicate provider events if callbacks are used.
- DG names the failed-delivery handler and agrees the immediate-alert policy before development (Q07).
- If email fails the in-app record stays available.