Invalidate and restore bindings when eligibility changes
What It Does
Bindings follow the saved eligibility of the account and installation they select. Reassessment shares the transaction that changed that dependency, preserving a reason and new revision. Notifications follow commit and restoration requires no email.
The Flow
When Something Fails
A hook error aborts the initiating mutation. The cause and bindings preserve their former state. Rollback the causing transaction if reassessment fails. No invalidation commits independently of its cause. Abort the transaction on a recording error. Neither the changed binding nor incomplete history commits. Log failed mail requests. The new binding status remains visible even without mail.
Open Design Questions
Saved eligibility and mail receipt have separate consistency limits; a failed notice has no durable retry.