State, event and outbox row commit in one Cosmos transactional batch. This is the alternative to a dual write, and it is the difference between a platform that occasionally loses tasks and one that does not.
Write-then-send loses the task if the process dies between the two operations. Send-then-write invents a task that no state knows about. Neither failure is acceptable at 1.8M tasks per day, and neither can be fixed with a retry.
The change feed is the only dispatcher. It is checkpointed, ordered per partition and resumable, so an Outbox Relay crash delays dispatch rather than dropping it.
Cadence, stated everywhere
Submission is synchronous and answered in under 300 ms at p95. Dispatch is asynchronous and targeted at under 1 second at p95 from commit to queue.
Projections are near-real-time via the change feed; reporting is a 5-minute micro-batch; the warehouse extract is nightly. Three different cadences on one page, because conflating them is how capacity planning goes wrong.
Payloads move by reference above 64 KB in both directions — input at admission, output at completion — so message size is independent of workload shape.
Deliberate omissions
Failure and retry paths are omitted so cadence stays legible; views 19 and 20 carry them.
Per-tenant data segregation is not shown here; view 29 covers it at all four layers.
Encryption in transit and at rest applies to every arrow and store on this page and is documented once, on view 27.
