The delivery pipeline: guarantees, priorities and preferences

One festive-sale campaign, six failures, and the pipeline that prevents them: an idempotency key from the business event, committed with the outbox; preferences checked at routing and again at the last mile; quiet hours in the user's clock; batching that turns 50 pushes into 2; three priority lanes with their own topics, workers and quota; the inbox written before any push; at-least-once with dedup at every hop instead of exactly-once; classified retries cut at expiry; per-zone waves; an escalation saga on durable timers; and why a 10M campaign takes about 22 minutes whatever you add.