radar: pass 16 — W8 durable delivery (events on lib/flow exemplar; fed-sx/mod bespoke); notify.sx name collision noted

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/abstractions.md

@@ -12,6 +12,12 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
 
 ## Last scan
 
+- **Date:** 2026-06-07 (radar loop, pass 16)
+- **Pass 16:** events started Phase 3 — **durable notification delivery on `lib/flow`**
+  (new W8: at-least-once + idempotency exemplar; fed-sx/mod roll their own outbox). The two
+  `notify.sx` (feed vs events) are a name collision (read-side digest vs delivery), noted
+  in W8. Substrate-adoption story deepening: app domains now consume persist (content/
+  commerce/events), flow (events), commerce (events), acl-authZ (identity).
 - **Date:** 2026-06-07 (radar loop, pass 15)
 - **Pass 15:** added the **scanning-method note** above after `query.sx` again proved to
   be merged-lib copies (lib/prolog + lib/persist in every worktree). Corrected census
@@ -293,6 +299,23 @@ one merged file copied N times. Correct one-liner:
 
 ---
 
+### W8 · Durable outbound delivery (at-least-once + idempotency + retry)
+- **Live exemplar on `lib/flow`:** `events/lib/events/notify.sx` — reminders/digests are
+  durable `flow`s: a flow `request`s delivery (suspend point), the **host** performs the
+  send via an injected `dispatch` transport, then resumes with the outcome; flow's
+  deterministic replay means a completed delivery never re-runs on recovery. At-least-once
+  with an idempotency key per message. This is "reliable delivery" done right on the flow
+  substrate.
+- **Others roll their own:** `fed-sx` built its own outbox + `delivery_worker` + retry
+  bookkeeping (Steps 8a–d); `mod/fed.sx` has an in-memory outbox seam; `acl/federation`
+  propagates facts. Same *goal* (reliable outbound delivery, retry/idempotency) on
+  different machinery.
+- **Disposition:** durable delivery is exactly what `lib/flow` is *for* (events proves
+  it). Watch whether fed-sx / mod converge their outbox onto flow, or stay bespoke for
+  perf/substrate reasons. 1 clean flow-based consumer today → Watching, not a proposal.
+- **Name-collision caveat:** `notify.sx` means two unrelated things — `feed/notify.sx` is
+  a *read-side digest* (group inbox by verb+object), NOT delivery. Do not pair them.
+
 ### W7 · Snapshot/projection-checkpoint reimplemented vs `persist/snapshot` (delegate)
 - `persist/lib/persist/snapshot.sx` already provides a **generic** projection checkpoint:
   store `{:value :seq}` in the kv facet under a namespaced key; the headline property is