A bounce-safe welcome path makes the outbox message ID the transport idempotency key

Deliver takes a Message and three interfaces. Suppressions.Contains looks up a recipient, and Renderer.Welcome turns a template version and a player ID into a subject and a body. Transport.Send takes an idempotency key, a recipient, a subject and a body ^[5]. Swapping an SMTP relay for an HTTP API rewrites one of those three implementations, because the eligibility check and the key are chosen by the caller ^[21].

Message carries ID, PlayerID, Recipient, Region and TemplateVersion ^[4]. One field addresses the mail. The other four exist to join the attempt back to a player, route it to a permitted endpoint, and record which content version went out ^[20].

The published listing stops mid-line inside the error branch of the suppression lookup ^[6]. Fail-open versus fail-closed is left to the reader. The code does define a distinct ErrSuppressed sentinel ^[19], so a blocked recipient and a broken suppression store return differently to the caller ^[23]. That ordering also makes the store a dependency of every send.

The second half of the author's deciding test is the harder one: classifying a terminal failure without scraping prose ^[3]. That constrains the provider. The post notes that an email API usually exposes a structured request and structured delivery events, while SMTP offers a widely understood submission boundary that can fit an existing relay, and says neither statement produces a universal winner ^[15]. The author is blunt about the standard: "a dashboard showing delivery activity is not a control plane" ^[8]. And on transports: "I would reject either route if its failure state cannot be joined back to the player and message without searching a dashboard by timestamp" ^[17].

Provider-rendered templates move that boundary and add a write per attempt. The application has to record the remote template identifier and version used for every attempt, or a replayed job can send different content from the original and incident reconstruction becomes guesswork ^[11]. The post calls that a valid trade when independent editing is required and poor default behavior when engineers own both copy and delivery ^[12].

Region gets the same rule. Keep one logical template version, pick the permitted regional endpoint at runtime, and store only the event fields needed to enforce delivery state ^[13]. An SMS fallback in the United States is a separate regulated channel; the post points to the A2P 10DLC documentation for registration requirements on application-to-person traffic over ten-digit long codes, and says not to turn an email bounce silently into an SMS send ^[14].

The post does not include deliverability numbers or a named provider ^[22]. The argument rests on the ordering in Deliver and on the question the author asks first: what page fired when a hard bounce arrived, and did any later welcome retry get stopped ^[9].