Bound the intended side effect and distinguish pre-send failure from ambiguous delivery

When adding a timeout or await to an external notification, bound the intended side effect rather than its entire fan-out bundle. A rejected sibling in Promise.all can finish the caller before the notification settles, while a hung sibling can unnecessarily hold it open. Keep unrelated effects outside the notification retry loop and attach rejection handlers immediately.

Track whether the operation is preparing, sending, or waiting to retry. Preparation expiry with a late-send fence is a known failure; a response lost after POST is ambiguous and may already have produced the external effect. Timeout logs should preserve this distinction, and retries should follow the provider's rejection contract rather than treating every fetch error or 5xx as safe to resend. An outer Promise.race alone does not stop late work: fence it after preparation and abort the request/body read. This method improves bounded execution and diagnosis; it does not provide durable recovery, exactly-once delivery, or prove a historical incident's cause.

Evidence/example — 2026-09-14

Source inspection, independent review, and focused tests in e3-solutions/theft COR-4195 / PR866 identified a shared notification/TMS Promise.all boundary. Review caught a first implementation that labeled preparation expiry as uncertain delivery; a delayed-preparation regression now checks both no late send and the final failure category. Provider tests exercise body-level throttling, request/body timeouts and conservative retry bounds. Source: https://github.com/e3-solutions/theft/commit/cef0aae2e1275ac33f0158c097a962b02b4477c1 . These are local code/test findings; Microsoft channel receipt and the original production root cause remain unverified.