TFD Flows and Events Diagram

Domain event contract

• Events describe completed facts and use past-tense names
• Source state is durable before publication
• on_demand.video.available follows the stored AddPipe projection and carries the provider's original availableAt
• Notification source listeners are non-blocking; MVP delivery stays in process
• In-process delivery is best effort across termination; durable recovery requires a future outbox

Projection + disclosure

• Consumers are idempotent and recoverable
• VIP note facts contain identifiers and revision only
• Clinical note activity requires its explicit read grant

Durable async paths

• Per-staff inbox state is distinct from the provider-delivery outbox
• Role eligibility, mandatory rules, and per-staff overrides gate notification materialization; staff-access changes are always enabled
• Identity, Delivery, Engagement, Sales, Integrations, and scheduled due facts are projected asynchronously by Notifications; vip.renewal.weekly_digest.identified carries matched 90-day renewals and creates one subscribed financials-authorized inbox summary per staff/UTC week, with retry dedupe and no Slack output
• Disabled and ineligible targets are skipped independently; source writes remain committed and existing inbox items are unchanged
• notification.projection.committed is emitted only after create, refresh, read, read-all, or explicit expiration persists
• An asynchronous bridge turns committed inbox facts into local and Redis-backed notification.projection.changed signals
• Only staff:{staffUserId} receives inbox and unread-count invalidation events
• Zoom finalization and AddPipe storage use independent schema-versioned Redis Stream consumer groups
• AddPipe requests carry identifiers and an allowlisted HTTPS source; stored/failed results carry metadata and media bytes stay out of Redis
• Repeated invalid AddPipe results move to a bounded dead-letter stream; retryable work remains reclaimable and idempotent
• Failed work is retried without duplicating domain facts

Evidence precedes projection

• Cataloged P0 and P1 critical changes commit owner state and Audit together; Audit is not a VIP Activity listener
• Owner events publish after commit. Nested transaction failure rolls back state, evidence and deferred publication
• Protected reads await a sanitized access entry. Denials append through a separate non-recursive path
• Integrations MediaDeletionJob persists intent before an event; recovery scans pending and abandoned work, uses bounded retries and fenced completion, and exposes authorized repair. Final owner state and evidence commit together without an audit-only outbox (ADR 0068)
• P1 VIP and assignment histories publish only after commit; assignment capacity and replacement decisions serialize in Identity. Previously audited video decisions are not recorded a second time

Workflow diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export