Outbound webhooks
Webhook creation and delivery are separate. Domain changes record durable payloads, and the delivery worker claims rows with a lease before making an attempt. It signs the payload, applies bounded transport and SSRF checks, then settles delivery and endpoint health together under the current lease.
A webhook POST receives one attempt per round. Persistent policy decides when to retry. Respect Retry-After without making a request hold the whole cron tick indefinitely. Test a lost response and expired lease; a network timeout does not prove that the receiver rejected the event.
Push reminders
The notification outbox records reminder work. Expo push sending and receipt reads have different retry semantics: receipt GETs can use the idempotent read helper. Enrollment, foreground presentation and tap responses each validate current User/Organization scope.
Mobile suppresses unauthorized or stale presentation and navigates only to a fixed authorized destination. Cancelling a local listener cannot recall a notification already displayed by the operating system.
Extend
Add event contracts to the existing event definitions and enqueue work in the domain transaction. Keep secrets and private payloads out of logs. Test duplicate delivery, lease fencing, disabled configuration and identity transitions. Device and provider delivery need separate verification from the local transport suite.