Project: account email delivery

Build contract

• Crash before and after the assignment commit; prove one durable intent and no notice for rolled-back work.
• Simulate provider timeout after acceptance and duplicate worker delivery without creating a second intent.
• Open a recovery link with a mail scanner, then submit, replay, and expire the actual action token.
• Verify bounce suppression, current preference, message correlation, and sender authentication on received tests.

Implementation checkpoint

function sendIntentKey(caseId, revision) {
  return `assignment:${caseId}:${revision}`;
}
console.log(sendIntentKey(47, 6));
// Output: assignment:47:6

Cost and boundaries

One intent write is O(1) and each send consumes a provider request, queue slot, and status record. At scale, fan-out and provider limits govern latency, so worker concurrency needs a ceiling and backoff. A feedback event typically uses an indexed message lookup; storing every full body for diagnostics would grow with volume and expose private links. Authentication checks add small send-time work but require DNS and signing-key operations. Monitor intent age, uncertain attempts, accepted-versus-delivered gap, bounces, complaint rate, and optional sends after a preference change.

Failure drill

Send the assignment email before commit, then roll back; the recipient gets a false notice. Move intent creation into the transaction. Let the provider accept an attempt but drop its response; a worker restart must reconcile the same intent rather than invent a new one. Prefetch a recovery GET and prove no token is consumed. Deliver an old success event after a newer bounce and confirm status does not move backward. Suppress optional mail for a bounced address while retaining the defined account-security recovery path. Inspect logs for address, case note, HTML body, and token leakage.

Acceptance checks

• One committed assignment maps to one stable message intent.
• Email links cannot bypass account and case authorization.
• Feedback and suppression states survive duplicate or delayed events.
• Sender rollout uses received authentication evidence and restricted telemetry.

Common Mistakes

• Treating provider acceptance as user reading.
• Putting a reset mutation on GET.
• Retrying a permanent bounce without a stop rule.

Related lessons

Email Intent, Outbox, and Idempotent Send; Email Template Data and Account Link Boundaries; Email Provider Events, Bounces, and Suppression; Sender Identity, Reputation, and Message Observability.