Start with the failure the fixture is built around. A worker claims the outbox row for order ORD-48271 while the old provider adapter is still active, and then a deployment routes new work to a different adapter [6]. The settled payment is one business event, and the post's rule is that it maps to one stable receipt rather than one message per adapter [6]. Something has to enforce that, and no provider account can, because each one only knows the sends it accepted.
So four facts move out of the provider and into your own data: the order reference, the approved template revision, the recipient eligibility decision, and the idempotency key [7]. The adapter still returns its own message identifier, which is useful for correlating delivery events afterwards, but the post is explicit that it cannot become the business key [7]. Read the eligibility item closely. If the only suppression list is the provider's, the decision not to send is made after submission, inside an account you will eventually leave.
The local render is the part a reviewer can actually inspect. The fixture pins ORD-48271 at USD 29.00 and asserts a fixed subject line, a body containing "USD 29.00", and the absence of the string "diagnosis", all before any network call [5][13]. That last assertion is a substring check, so it catches the token and nothing else; a field named reason_for_visit would pass it without complaint. The post's actual protection is a field allowlist rather than a blocklist: order reference, payment state, amount, support path [3].
The scoring contract that follows it has four criteria, and price is not one of them [1]. Two are about your operations rather than the vendor's: whether the custom domain can be authenticated under your DNS change process, and whether delivery events can be correlated back to the order reference without putting sensitive data in provider metadata [9]. For any of this to transfer you need an outbox with a worker that claims rows, a receipt whose fields your compliance owners have already approved, and a DNS change you can rehearse in a test [1][4][9].
This is one practitioner's post, and it concedes the hardest part: the privacy review depends on the data and the organization, the author doubts a generic provider checklist can settle it, and the fields and retention path go to security and compliance owners for approval [4]. On template ownership it declines to rank the options at all, and asks instead which category of work the team can operate under pressure [8]. In my context, where deploys are cheap and receipt copy changes twice a year, local ownership is the right trade. If the people rewriting the wording need a visual editor and an approval workflow, the post's advice inverts [12], and rehearsing rollback becomes the thing you own instead.
