Summary

Follow-up to #2633, which merged before this last Greptile finding was addressed.

That PR made an undelivered lapse claim reclaimable so a failed send could not silently consume the rep's only notice. Greptile correctly pointed out that this cost the claim its exclusivity: a broken Slack token fails every channel in the same drain tick, so simultaneous reports for one user are the normal shape of a break rather than a rare interleaving , and a predicate admitting any lapse not yet marked delivered admits every one of them. The rep gets one mail per failing channel.

The claim now readmits a lapse only once it is undelivered and older than the abandoned-claim window:

• Concurrent reports in one tick see a fresh undelivered claim and stay quiet → exactly one mail.
• A claim genuinely abandoned by a thrown send, a failed notified stamp, or a dead process is retried once the window passes → the rep still gets told.

The window only has to outlast an in-flight send, so it is set to 15 minutes.

The delivered-stamp is also scoped to the exact lapse the claim returned, rather than to "there is a lapse". Without that, a slow sender could mark a newer, still-undelivered lapse as notified , the one case where the rep is silently owed a mail that never arrives.

Test plan

Two new tests, both of which fail without the change:

• four channels reporting one break together mail once;
• a delayed send closes only the lapse it claimed, leaving a newer break still owed its retry.

The existing retry test now asserts the fuller shape: undelivered → not immediately reclaimable → reclaimable once the window passes.

Validated as part of the full gate before #2633 merged (pnpm run autofix:local: oxlint --deny-warnings, deps:check, 313 mail suites / 2,946 tests, 764 server files / 8,375 tests). The cherry-pick onto current staging is byte-identical to that validated version and is the only delta.

🤖 Generated with Claude Code

Greptile Summary

The PR restores exclusivity for Slack lapse-notification claims while keeping abandoned claims reclaimable after a 15-minute window.

• Prevents concurrent channel failures from each sending a notification for the same Slack outage.
• Restricts the delivered stamp to the exact lapse generation claimed by the sender.
• Adds database-backed coverage for concurrent claims, delayed retries, and replacement-lapse handling.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable correctness or security defects identified in the changed behavior.

The conditional update keeps fresh claims exclusive, stale undelivered claims reclaimable, and successful delivery scoped to the exact claimed lapse; the added real-SQL tests cover the principal concurrency and replacement-generation cases.

Important Files Changed

Sequence Diagram

_{Reviews (1): Last reviewed commit: ["fix(slack): keep the lapse claim exclusi..}