One event. Four boundaries. Every handoff owns a failure mode.
Authenticates the sender and records the receipt.
Commits before work is acknowledged.
Selects consumers from the immutable envelope.
Closes the loop with an observable outcome.
When delivery fails, the relay preserves the event, records the boundary that rejected it, and resumes from the last acknowledged handoff.