[tdurieux]

Owners still received the same connection alert after access recovered or the original repository was removed. Production audit records confirmed repeated accepted sends to six addresses, including two attempts 27 seconds apart; recipient screenshots confirmed delivery.

Keep one email attempt per normalized address across resources and accounts, including recovery, deletion, expiration and account removal. Reject inactive-resource alerts, restore missing guards from durable provider history before serving traffic, and record redacted trigger IDs and failure categories. The independent v2 database migration marker also covers cold upgrades after containers were removed, and cancels queued but unsent v1 repeats before restoring suppression.

Resource lifecycle mutations and email dispatch now compete on the same owner document. Query and document-save hooks fence deletion, expiration and archival across all three resource types; separate reservations prevent concurrent mutations from releasing one another's blocks. Failed or ambiguous status writes retain the owner's alert block until offline reconciliation after all writers stop.

The recipient-v2 upgrade stops recipient-v1 writers before reconciliation, briefly pausing traffic. Six repeat recipients are temporarily held in production, and one older missing guard was restored from the saved deployment snapshot; all 73 baseline recipient keys remain present.

Validation:

• Full suite: 1,212 tests passed. Environment-dependent cases were tested separately where applicable.
• MongoDB 7: 98 alert tests and 54 GitHub App tests passed, including cold-start migration, fresh queued repeats, dispatch after the final resource check, concurrent deactivation, ownership changes and interrupted reservations.
• 74 notification/deployment unit tests passed; build, changed-file lint and shell syntax checks passed.
• Production containment: no further accepted sends to the seven held addresses observed; the earlier five-minute sample showed five healthy application containers, zero restarts, zero fatal errors and zero 5xx among 719 completed requests.

[tdurieux]

@codex review

Please review commit e6369f4 for permanent per-address suppression, migration from recipient-v1 to recipient-v2, restoration from completion history, and dispatch cancellation for inactive resources. The intended policy is one generic alert attempt per normalized address, even after recovery or resource/account removal. Known-unsent attempts remain reclaimable. Validation: 1,212 full-suite tests plus 87 MongoDB alert and 54 GitHub App tests passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T18:10:19.685685Z	37a70ad	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e6369f4cf4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tdurieux]

@codex review

Please review the updated head 37a70adbe6cc4282792a3ab5c474064f36d8cda5. Both findings from the first review are addressed and replied to: the independent v2 database migration marker handles cold starts and cancels queued known-unsent v1 repeats; lifecycle query/save hooks compete with dispatch on the owner revision and hold independent reservations through status changes. Failed or ambiguous mutations retain suppression until offline reconciliation with every writer stopped. Please check the migration and lifecycle concurrency behavior.

Validation: full suite 1,212 passing; final MongoDB alert suite 98 passing; GitHub App integration suite 54 passing; notification/deployment suite 74 passing; build and lint passed. The last commit only clarifies the requirement to stop all writers for offline reconciliation.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 37a70adbe6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tdurieux]

Merged after all CI checks passed and Codex reported no issues on the reviewed head.

Deployed squash commit 772e40debd045b94051defdf6a9f33cc9f2fe5a6 to production. The API and four streamers are healthy on the same recipient-v2 image, with no restarts or OOM events. Protected environment/key files and MongoDB/Redis/backup containers were preserved; a rollback image was saved before deployment.

The v2 migration completed before traffic resumed and restored seven missing delivery guards. All 101 historical recipient keys remain suppressed. The post-deployment audit shows zero historical resends, zero duplicate recipients and no active lifecycle reservations; the seven investigation holds remain intact.

Public browser checks passed for the homepage, health, sign-in and connections pages; unauthenticated API access returns 401 as expected. The final five-minute log sample contains 1118 completed requests, zero completed 5xx and zero fatal errors. Notification warnings are absent, memory is below each container limit, and sampled sockets have zero CLOSE_WAIT. No test emails were sent to real recipients.