Complete notification expiry and configurable durable delivery (#36)

backend/notifications/README.md

@@ -32,10 +32,16 @@ Use a private authenticated NATS endpoint; `tls://` URLs and credentials in the
 are supported by the shared driver. Mongo and messaging both use shared
 `DriverConfig` settings; email settings reject unknown keys.
 
-The service provisions `SXCHNGE_NOTIFICATIONS` (file storage, 48-hour retention,
-one replica), subject `sxchnge.notifications.email`, and durable consumer `email`.
-This initial setup is for a single-replica deployment. Configure production
-replication/provisioning policy in code before deploying to a clustered environment.
+The queue uses `SXCHNGE_NOTIFICATIONS`, subject `sxchnge.notifications.email`,
+and durable consumer `email`. Configure `queue.stream.replicas` as 1, 3 or 5 to
+match the NATS cluster, and `queue.stream.max_age_hours` for retention (48 hours
+minimum). File storage and the owned stream/subject names are enforced.
+`queue.provisioning.environment` accepts `production` or `non-production`;
+`mode: ops` validates existing resources without changing them, `mode: app`
+provisions missing resources, and `mode: hybrid` provisions only outside production.
+Production retention and consumer-setting drift fail startup instead of being
+silently accepted. Provisioning operations honor their startup context.
+The example defaults to one replica and app provisioning for local development.
 Multiple service workers can safely compete for jobs through atomic claims.
 
 ## Templates and parameters
@@ -54,6 +60,8 @@ remaining status and request fingerprints expire through a seven-day TTL.
 
 - Send persists before returning; it does not wait for NATS or the email provider.
 - Outbox scans every five seconds and republishes safely after a bus failure.
+  Pending notifications expire and have their rendered content cleared even when
+  the bus is unavailable or a retry is scheduled later.
 - Duplicate RPCs and duplicate broker deliveries do not create extra jobs/sends.
 - Provider HTTP 2xx becomes ACCEPTED. No receipt/webhook or read tracking is claimed.
 - Explicit rate limiting (429) retries with bounded exponential backoff and
@@ -80,7 +88,9 @@ Monitor pending age, UNKNOWN/FAILED states and repeated outbox/worker warnings.
 `make test` and `make lint-backend` generate interfaces and validate all modules.
 Notifications tests exercise real disposable MongoDB and NATS containers, concurrent
 idempotency and claims, lease recovery, retries, transport authentication, rendering
-and both provider payloads through local HTTP servers. No live emails are sent.
+and both provider payloads through local HTTP servers. An authenticated TLS gRPC
+Send/Get test covers the full shared-database → NATS → rendered-email driver path.
+No live emails are sent.
 `make package-notifications-interface` prepares source and Go-client archives.
 See [provenance](PROVENANCE.md) and [contract usage](interface/README.md).