A durable worker must replace an execution owner, not add another sender

When moving outbound messaging to a durable worker, retain one domain decision owner and one delivery executor. Atomically persist intent with the business transition, carry stable operation identity, recheck cancellation and eligibility at execution, and reconcile uncertain provider acceptance without blind resends. Durable queue delivery alone cannot make a remote side effect exactly once or repair a failed local receipt. This applies when cron and a new worker can reach the same provider; it does not require a new worker for every small automation.

Evidence/example (2026-09-18): read-only comparison of Shield PR #932 (https://github.com/e3-solutions/theft/pull/932) with #876 and #945 found a shared worker handling existing initial/reminder SMS occurrences while support recovery retains a separate sender. The duplicate-reminder suppression in #945 illustrates the cost of overlapping owners. Proposed integration, not implemented or live-verified: a narrow recovery operation using the shared worker, with existing support policy retained and old direct dispatch removed at cutover. Keep delivery markers beyond queue retention so replay cannot recreate a completed effect.