Deliver Limit-Order Fill Notifications under Consumer Backpressure

Design a notification delivery system for users whose limit orders have filled at a trading exchange. Focus on fanout, ordering guarantees, slow downstream consumers, and recovery when a component fails. ### Clarifying Questions Define which fill events trigger notifications, whether partial fills are separate, which user-visible channels exist, and the required ordering scope. No numeric throughput or latency target is supplied. Distinguish at-least-once processing from exactly-once user-visible delivery and identify the external provider contracts needed for either claim. ### What a Strong Answer Covers A durable event source, stable event identity, partitioning and fanout, bounded consumer work, retries, deduplication, ordering scope, and reconciliation after ambiguous delivery outcomes. ### Follow-up Questions - How would one slow channel avoid blocking every other user's notifications? - What happens if a provider accepts a notification and the worker crashes before recording success?