---
id: ADR-PFM-NOT-010
title: An Uncertain Hand-off Waits Out a Fifteen-Minute Window
product_area: platform
module: notifications
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Both pipelines protect a fifteen-minute ambiguity interval, but staff notifications fail uncertain
  sends while association mail may submit them again.
constrains:
- WF-PFM-NOT-005
- WF-PFM-NOT-007
- WF-PFM-NOT-011
- STATE-PFM-NOT-005
- STATE-PFM-NOT-011
origin: 'FND-PFM-NOT-030 and FND-PFM-NOT-041; services-platform:docs/communications/architecture.md#7.5
  The ambiguous case: SES accepted but we did not record it'
alternatives:
- option: One policy for both pipelines
  why_not: Immediate resubmission risks duplicating a provider-accepted message.
- option: Exactly-once delivery
  why_not: Waiting indefinitely leaves unresolved delivery without an operational end state.
consequences:
- Nightly notification repair records ambiguous failure without resending.
- Communication recovery can close an old attempt unknown and open a new one.
- Product authority for the different risk policies remains unresolved.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/notifications/services/persistence/deliveries.ts:settleAmbiguousDeliveries;
  modules/communications/services/persistence/messages.ts:claimMessageForSubmission.'
---
# An Uncertain Hand-off Waits Out a Fifteen-Minute Window

## Context

A provider can accept a message before Platform records the acknowledgement.

## Decision

Both pipelines protect a fifteen-minute ambiguity interval, but staff notifications fail uncertain sends while association mail may submit them again.

## Alternatives Considered

Immediate resubmission risks duplicating a provider-accepted message. Waiting indefinitely leaves unresolved delivery without an operational end state.

## Consequences

Nightly notification repair records ambiguous failure without resending. Communication recovery can close an old attempt unknown and open a new one. Product authority for the different risk policies remains unresolved.