#312 — Move notification delivery onto a queue

The heart of the PR. A pg-boss subscriber that pulls notify.deliver jobs, resolves the user's channel preferences, and calls the right adapter. Retries are configured per-channel — email gets three attempts, Slack gets one because its API is already idempotent on our side.

boss.work('notify.deliver', { batchSize: 20 }, async (jobs) => {
  for (const job of jobs) {
    const { userId, event, channel } = job.data;
    const prefs = await getPrefs(userId);
    if (!prefs[channel]) return;          // user muted this channel

    try {
      await adapters[channel].send(userId, event);
    } catch (err) {
      if (job.retryCount >= MAX_RETRY[channel]) {
        await deadLetter(job, err);         // don't throw — ack & park
        return;
      }
      throw err;                            // pg-boss reschedules
    }
  }
});

Where the win shows up. The mutation used to call sendEmail, sendSlack, and createInApp directly. Now it inserts the comment, computes recipients, and enqueues. The try/catch soup is gone.

  const comment = await db.comments.insert(input);
  const recipients = await resolveWatchers(input.taskId, input.mentions);

  for (const r of recipients) {
    await sendEmail(r, comment);       // blocked the response
    await sendSlack(r, comment);
  }
  await boss.insert(recipients.flatMap((r) =>
    CHANNELS.map((ch) => ({
      name: 'notify.deliver',
      data: { userId: r.id, channel: ch, event: toEvent(comment) },
      singletonKey: `${comment.id}:${r.id}:${ch}`,  // idempotent
    }))));
  return comment;

Table for jobs that exhaust their retries. Deliberately not auto-pruned — we want to look at these weekly until we trust the new path. Has the full job payload and the last error string.

Mostly moves. Each adapter now implements a shared Adapter interface and throws a typed RetryableError or PermanentError so the worker knows whether to retry. The email adapter also drops its internal retry loop — the queue owns retries now, double-retrying was how we got duplicate emails in April.

Registers the new subscriber in the existing worker process and bumps its concurrency from 5 → 20. No new deploy unit.

Covers the retry boundary, the dead-letter path, channel muting, and the singleton key dedupe. Uses a real pg-boss against the test database — we got burned last quarter when mocked queue tests passed but prod ordering broke.