The handler's first act is to claim the row. If another worker already owns it, the function returns and nothing is sent; if the claim succeeds, the worker posts the update and marks that exact event version delivered, and a crash before the mark simply produces another attempt [6]. The post is candid that this only holds under two assumptions its sample does not implement: that `claim` is atomic, and that the subscriber honours the `idempotencyKey` it is handed [10].
The uniqueness rule is where the design earns its keep. A process-local `Set` disappears on deploy, and two Node workers can both observe a missing key at the same moment [7]. The post's alternative is a unique constraint on `(shipment_id, subscriber_id, event_version)`, with the write and the enqueue decision made explicit [8]. That single line is what makes an overlapping tick boring rather than a second notification.
The cap arithmetic is duller than the cron discussion it replaces. Fifteen minutes is 900 seconds [1]. The enqueue path performs two durable operations per row, a queue send and a `markQueued` write, so a batch of `limit` rows costs roughly 2 x limit round trips per tick [17][2]. Divide, and each row gets 900/limit seconds of budget [3]. You pick `limit` from measured per-row latency, which is what the post means when it calls the 15-minute limit a batch-size signal instead of a deadline [9].
Whether the full record transfers depends on what a duplicate costs you. The framing here is healthtech, where a duplicate can confuse a patient or trigger a second downstream action [15], and where one `in_transit` status fans out to dozens of subscribers with different timeout and authentication policies [5]. The second named failure is the ambiguous timeout: a request that timed out may already have arrived, which is why the dedup key has to stay stable across attempts [13]. If your consumers treat repeats as no-ops, six columns plus lease renewal and a dead-letter path is cost carried for somebody else's risk profile [11].
The audit argument is the part I would defend hardest at review. The record is meant to say which event version was selected, which attempt owned the lease, when the request left your system, and whether the response was accepted, rejected, or unknown after a timeout [14]. The post reports teams that kept only a final `sent` boolean and then spent hours rebuilding a timeline from scattered logs [15]. Store a run identifier as well, so a tick delayed or duplicated during deployment rediscovers the same pending rows instead of minting new delivery records [12].
