Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.
GS13 · Outbox, retries and recoverable notifications
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software (new in the GGA baseline) |
| Source | Blueprint pp. 10, 11, 15, 16, 17 (GGA-Requirement-Register); client-supplied draft, not accepted |
| Gate | GA06, GA11 |
| Blueprint delivery stage | Stage 3 Complete the service loop (p. 19) |
| Build step | 07 (primary; tests first) |
| Replaces or carries | DG23, T11, T33, T34, T35, T36 |
| Decisions | GL07-staged |
Given
A business change queues an outbox row in the same transaction. A provider is made to fail transiently, permanently and ambiguously. Two workers poll at once.
When
Commit a change; kill the worker mid-send; return a transient error; return a permanent permission error; return an unknown outcome; change a recipient or sharing scope before delivery.
Then / oracle
State change, audit entry and outgoing event commit together or not at all. A database lock stops concurrent claims but exactly-once delivery is never promised. Transient failures retry after 1 minute, 5 minutes, 30 minutes and 2 hours, then land in an operations exception queue; permanent errors are not retried. Uncertain delivery is reconciled before resending. Recipient and scope are re-checked before delivery. A failed notification never bypasses consent, reactivates a listing or marks a contribution paid. Email carries a short authenticated link and no confidential profile or document.
Evidence required
Outbox rows with business key, attempts, next retry and last error; operations queue entry; email body inspection.
Decision dependency
- GL07-staged: Email and hosting providers are launch decisions; the scenario runs against a stub port, never a vendor
Where a decision is pending, the dependent assertion is Blocked by that decision and no oracle is invented. A proposed default is a configuration value, not a promise. This note is a specification: it is Passed only on a named integrated build and fixture.
Back to GGA-Scenario-Index · GGA-Traceability-Matrix · Scenario-Dispositions.