---
id: ADR-PFM-OPS-004
title: Requester notices favour at-least-once delivery over strict once-only
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Claim a notice before sending and record its result afterwards; allow pending and failed claims to be
  reused, with duplicate and missed delivery remaining possible.
constrains:
  - DOM-PFM-OPS-001
  - STATE-PFM-OPS-003
  - WF-PFM-OPS-004
  - SVC-PFM-OPS-jobs
origin: 'services-platform:docs/hq/rhythm-hq-plan.md#D11 and #E5 (approved K8)'
alternatives:
  - option: Hold a database lock throughout delivery
    why_not: Delivery crosses a network boundary and cannot complete atomically with the database transaction.
  - option: Keep pending claims permanently reserved
    why_not: A stopped sender would leave an unsent notice unavailable to another invocation.
consequences:
  - Competing claims or an interrupted outcome write can cause duplicate messages.
  - Delivery errors are contained within the notice function.
  - The stricter delivery intent remains an unresolved finding.
  - >-
    Eligible failed notices have no independent retry schedule, and outcome writes can overwrite competing
    results.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/jobs/services/persistence/job-notices.ts,
    services/notices/notify-job-requester.ts, db/job-notices.table.ts; docs/jobs.md "Telling the requester".
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# Requester notices favour at-least-once delivery over strict once-only

## Context

Several settlement paths can invoke delivery for the same job outcome.

## Decision

Use a job-and-outcome record to suppress new claims after delivered or suppressed results. Reclaim pending and failed records when delivery is invoked again. The outcome writer has no claim ownership check.

## Alternatives Considered

Keeping locks across delivery introduces network-dependent locking. Permanent reservation would lose notices when a sender stops.

## Consequences

The protocol reduces sequential duplication but establishes neither guaranteed delivery nor a single sender.