Reminder Destinations and Delivery

[!IMPORTANT] Mandatory operational email is the authoritative EPS channel. Personal Telegram DM, Discord DM, and SMS are additive opt-ins. Disabling, unlinking, snoozing, or failing an optional channel never disables the email reminder.

Destination classes

Class	Channel and target	Who controls it	What it may do
Mandatory personal	Email to the assigned user’s account address	Platform policy	Sends every operational assignment, workflow, deadline, and overdue reminder. It cannot be disabled by personal notification preferences.
Optional personal	Telegram private bot chat	The signed-in user links the Telegram identity, starts the private bot chat, and enables Telegram DM for this EPS project	Sends a redacted copy of the same logical reminder. A username, group chat, topic, or forwarded message is not a personal binding.
Optional personal	Discord bot direct message	The signed-in user links the Discord identity, verifies that the platform bot can open a DM, and enables Discord DM for this EPS project	Sends a redacted copy of the same logical reminder. Guild membership, a role, channel, or webhook does not establish this destination.
Optional personal	SMS to a verified E.164 number	The signed-in user verifies the number, grants current EPS operational-message consent, and enables SMS for this EPS project	Queues a short redacted copy through an eligible partner-scoped online Android device and verified non-roaming SIM.
Administrator-managed	Discord bot channel, Discord webhook, Telegram chat/topic, or project email route	An authorized project operator	Sends project, department, meeting, or group notifications under routing rules. It never substitutes for a user’s personal destination.

Provider secrets remain in partners-api. The dashboard receives display names, masked numbers, readiness, health, and opaque delivery references only. Never paste bot tokens, OAuth tokens, webhook URLs, encryption keys, full phone numbers, or native device tokens into a label, message, note, screenshot, export, or support ticket.

One logical cadence

Every enabled channel derives from the mandatory email reminder. It does not create a second timer. The deadline sequence is exactly:

• 30, 28, 24, 21, 18, 14, 10, 7, and 3 days before the deadline;
• 36, 24, 12, 6, and 3 hours before the deadline;
• 1 hour before the deadline;
• 30, 15, and 5 minutes before the deadline;
• at the due time; and
• every 6 hours while overdue until the work is closed.

A requirement’s pending deadline reminders stop after a valid submission or terminal requirement state. A work item’s reminders stop after completion or another terminal state. Reassignment, deadline change, unlink, relink, consent withdrawal, and destination revocation cancel or supersede stale channel work. A later retry retains the same channel attempt identity instead of creating another business reminder.

Mandatory operational points are not digest items. Quiet hours and snooze may defer an optional delivery attempt under the current personal policy, but they do not change the canonical due instant or block email.

Personal setup runbook

1. Check the email baseline. Open Event Planning → Notifications → Personal preferences. Confirm that mandatory email is shown separately from optional channels. Stop and contact platform support if the signed-in account has no usable email; do not enable another channel as a substitute.
2. Link the provider account. Open Account Settings → Reminder delivery accounts. Complete the signed-in user’s Discord or Telegram linking flow. For Telegram, also open the configured bot and finish the private /start binding. For Discord, run the DM readiness test and follow the privacy/shared-context recovery guidance if the bot cannot open a DM.
3. Verify SMS deliberately. Enter the planner’s own phone number, complete the short-lived verification challenge, review the masked destination and country, and grant the displayed EPS operational-message consent version. Attendee SMS consent and attendee phone records do not authorize planner reminders.
4. Enable by project. Return to the project’s Personal preferences and select only ready channels. An unavailable choice explains the missing prerequisite and links back to Account Settings. Saving uses the displayed preference version; reload before retrying a stale-version conflict.
5. Send a bounded test. Use the channel’s test action. Confirm the event/project name, reason, due time and timezone, safe deep link, and redaction. Provider acceptance means the provider or gateway accepted the request; it does not prove the person read it.
6. Review independent receipts. Open Delivery history and filter by recipient, channel, state, and time. Confirm the email receipt remains visible beside each optional attempt.

Delivery states and evidence

State	Meaning	Operator response
Scheduled	The channel copy exists for a future canonical reminder.	No action unless the linked identity or due date is wrong.
Queued or claimed	A bounded worker or Android lease owns the attempt temporarily.	Wait for the lease window; do not create another reminder.
Submitted or sent	The provider/native device accepted the message.	Treat as transport evidence, not proof of delivery or reading.
Delivered	A provider or native delivery receipt was recorded where supported.	Keep the email and channel histories together for audit.
Sent unconfirmed	Android submitted the SMS but no final carrier delivery result is available.	Do not label it delivered; use the documented escalation channel if the work is urgent.
Retrying	A transient provider, rate-limit, gateway, or lease failure has a bounded next attempt.	Check the next-attempt time and provider/gateway health before manual recovery.
Suppressed or blocked	Current identity, consent, country, cost, content, device, SIM, or policy checks forbid the attempt.	Correct the named prerequisite. Never bypass consent, tenant scope, redaction, or cost limits.
Cancelled	Completion, submission, reschedule, unlink, opt-out, revocation, or replacement made the work stale.	No resend. Confirm the replacement reminder when one should exist.
Failed	Retries ended or the provider reported a terminal safe error.	Use the authorized retry/reconcile action only after fixing the cause; mandatory email remains the fallback.

History may show the logical reminder, masked target, channel, scheduled time, attempts, safe provider/native reference, next retry, suppression or failure category, and final time. It must not show raw provider identifiers, full phone numbers, message secrets, or confidential planning content.

SMS transport boundary

EPS operational SMS and Event Management SMS Blasts are separate products. EPS addresses one authenticated planning user from a planning reminder; SMS Blasts addresses event attendees from a campaign. They have separate consent, recipient records, queues, audit, limits, and cancellation behavior even when both use the same online Android transport.

The Android gateway must be in online mode, authenticated with a current device token, and using an active verified non-roaming SIM that matches partner and country policy. Scheduled draining is background-capable and must not depend on an operator keeping a dashboard page open. Local LAN/offline mode receives no EPS phone payloads and cannot lease EPS SMS jobs.

Segment count, encoding, allowed country, per-message/run/day cost limits, pacing, expiry, and current cancellation revision are checked before native submission. Commercial provider activation or paid test traffic requires separate owner approval; no provider is created merely by enabling the dashboard preference.

Recovery table

Symptom	Safe recovery	Stop point
Telegram says the bot chat is not ready	Open the named platform bot in a private chat and repeat the single-use binding.	Stop if the Telegram identity does not match the signed-in linked account.
Discord DM is blocked	Review Discord privacy settings, restore the required bot context, then repeat the DM test.	Stop if the API reports a different or ambiguous linked Discord identity.
Phone changed or verification expired	Unlink the old number, verify the new E.164 number, review consent again, then re-enable SMS per project.	Stop if the masked number or country is not the intended destination.
No healthy SMS device or SIM	Restore the authorized online wrapper, permissions, foreground/background service, verified SIM, home-country state, and heartbeat.	Stop if the device belongs to another partner, is in LAN mode, is roaming, or requires a cost exception.
Duplicate-looking message	Compare logical reminder, channel attempt, identity version, schedule, and provider/native reference.	Do not resend until support confirms whether this is a repeated display, retry, or separate logical reminder.
Linked account compromised	Unlink/revoke the personal destination, disable the optional project preference, rotate provider/platform credentials through service ownership, and review sanitized audit history.	Never paste the compromised secret or provider response into the dashboard or support evidence.

Administrator destination incident response

1. Contain. Revoke the provider token or webhook through the provider and pause or revoke the affected administrator-managed EPS destination.
2. Rotate. Replace write-only destination secrets and platform encryption material only through the documented API-owned secret process.
3. Reconcile. Review bounded outbox and attempt history for unexpected sends, stale leases, and terminal failures without replaying successful logical attempts.
4. Notify. Contact affected teams through an approved channel without repeating a secret, full phone number, or confidential payload.
5. Verify. Run one redacted destination test and record its environment, actor, time, result, and remaining exceptions.

Completion check

Mandatory email is visible and active; every enabled personal channel is linked, ready, explicitly opted in for this project, and tested; SMS shows only a masked verified consented destination; all pending attempts match the current identity version and deadline; and no browser response, log, export, or screenshot exposes a provider secret or full phone number.