TL;DR

Shipped an email broadcast feature: audience filter → suppression gate → one queued job per recipient → per-recipient status ledger.

The whole design rests on one idea: the recipient row is the source of truth, so retries and double dispatches are harmless.

Delivery webhooks sync back onto that ledger with a rank guard so a late event never downgrades a status.

The shape of it