TL;DR
Shipped an email broadcast feature: audience filter → suppression gate → one queued job per recipient → per-recipient status ledger.
The whole design rests on one idea: the recipient row is the source of truth, so retries and double dispatches are harmless.
Delivery webhooks sync back onto that ledger with a rank guard so a late event never downgrades a status.
The shape of it






