- Copy discipline for notifications: the store, the queue, workers, and
API callers each own clones; no notification object is shared across
goroutines (races previously flagged by -race between workers mutating
Status/RetryCount and handlers JSON-encoding the same pointer).
- Retry progress derives from QueueMessage.Attempt so it survives
requeues; exponential backoff (1s base, 30s cap) honors the documented
queue.retry_backoff setting instead of hammering failing providers in a
tight loop; shutdown abandons pending backoff waits cleanly.
- Stop() cancels a service-lifetime context so idle workers blocked in
Dequeue exit immediately instead of waiting out their poll timeout.
- LocalQueue no longer holds its mutex while sending on the queue
channel (Enqueue/Nack) — with a full buffer this deadlocked the entire
worker pool, since draining requires the same mutex.
- Tenant scoping: notifications are stamped with the caller's ClientID;
non-admin clients can only read/cancel/retry their own (cross-tenant
access reports not-found to avoid leaking existence).
- Sentinel errors ErrNotificationNotFound/ErrNotificationAlreadySent.
- New race, backoff, and tenant-scoping test suites.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
igodwin
21990f2533