Webhook Delivery Service · View 11 of 20 · Runtime
Where the boundary falls
- Message 5 is the whole architecture: the product is acknowledged as soon as the event is durable, and nothing after it can make a product transaction slower or less available (ADR-01).
- Messages 11 to 13 run on every single attempt and are all node-local — health check, address re-resolution, signing. None of them is a call to a shared service, because at 45,000 attempts/s a per-attempt round trip is the bottleneck and the outage.
- Message 16 deletes the queue message only after a successful outcome. A worker that dies mid-attempt results in redelivery on the visibility timeout, not a lost event.
Budgets, all assumptions
- Intake acknowledgement ≤ 15 ms p99, independent of subscription count.
- First attempt dispatched within 250 ms p50 and 2 s p99 of acceptance, for healthy endpoints.
- Per-attempt timeouts 5 s connect, 10 s to first byte, 15 s total — long enough for a synchronous consumer handler, short enough that a stalled endpoint does not hold a worker.
What this view cannot show
- The failure branches. Every non-2xx path is view 12, deliberately, so this page stays readable as the happy path.
- Fan-out to N endpoints is one message here. The real fan-out is 1.8 deliveries per event at the mean and 40 at p99.
