Notification pipeline

Notification-service does not own the business fact. It consumes streams and writes notification.notifications.

Consumers are split by domain so a poison feed event does not stop expense reminders: social, several feed consumers (comment, mention, photo, reaction milestone, streak, payment evidence), expense, daily debt, bulk settlement, direct message, group message, group actions, and locale sync from auth.

Push is a second stage. PushDispatchWorker reads notification.push-dispatch. Failures go to PUSH_RETRY and then PUSH_DEAD_LETTER. TokenHygieneJob drops dead device tokens. DeadLetterLagMonitor feeds the PushDeadLetterRateHigh alert.

Preferences can suppress push and still keep the inbox row. Badge counts are served from this service and from an internal endpoint other services call (RemoteTabBadgeAdapter is the outbound side).

Copy, deep links (splick://post/..., chat/..., user/..., tabs), and SF Symbol or Material badge mapping are specified in the meta-repo file docs/NOTIFICATIONS.md. Change the catalog and the server message together. Clients route the deep link; they should not re-invent the title.

APNs uses APNS_TEAM_ID, APNS_KEY_ID, APNS_BUNDLE_ID, and APNS_PRIVATE_KEY. FCM can be disabled (DisabledFcmPushGateway) until FCM_PROJECT_ID and the credential are set. Never paste the .p8 into a doc.