CMD Change-Report Pipeline — Rollout & Operations

In-flight OLD-shape determination.requested envelopes (pre-#1504 bulk payloads without the kind tag) fail to parse on the new consumer → nack-requeue → DLQ after 5 attempts; an affected bulk case recovers via the worker’s redispatch-TTL republish (~30 min). Prefer deploying eligibility with no bulk run in previewing/enacting, or pause the run across the window.

determination_orders (eligibility DB) — the durable order ledger. States: pending → dispatched → succeeded | failed_retryable | failed_terminal. UNIQUE (origin_source, origin_ref) is the dedup identity.

Retry pacing lives in next_attempt_at (60s doubling, 1h cap, ±10% jitter); the attempt cap is 12 (ORDER_MAX_ATTEMPTS — a ~8h horizon, so a busy household’s 409 chain cannot terminalize a re-determination inside one working session); the always-on 1-minute order sweep re-publishes due orders and abandons claims older than 2× the self-call timeout. MQ never hot-loops an order. Settles are fenced on the claim’s own timestamp token, so a zombie executor can never settle a successor’s claim.

Terminal failures (failed_terminal) are the DLQ-equivalent: surfaced by tracing::error (determination order failed terminally) with the origin identity. Recovery after fixing the cause: reset the row — UPDATE determination_orders SET state='failed_retryable', attempt_count=0, next_attempt_at=now() WHERE id=… — and the next sweep re-runs it; the D4 deterministic dispatch key + the result-replay adoption query make the re-run duplicate-safe.

Crash recovery needs no operator action: redelivery converges on the order row; a completed-but-unsettled run is ADOPTED via the (origin_source, origin_ref) correlation on eligibility_requests, never re-executed.