Method publishPendingApproval

internal/agent/api.go:352–375

publishPendingApproval fires email.pending_review (direction=outbound) via the outbox (PublishTx — pre-side-effect: the pending row hasn't been sent to SES yet) AND the legacy goroutine. pendingMsgID seeds the deterministic event id so /send retries with the same idempotency key don't fire duplicate

(ctx context.Context, e webhookpub.Event, pendingMsgID string)

// deterministic event id so /send retries with the same idempotency
// key don't fire duplicate events.
func (a *API) publishPendingApproval(ctx context.Context, e webhookpub.Event, pendingMsgID string) {
	var outboxWrote bool
	if a.outbox != nil && pendingMsgID != "" {
		e.ID = webhookpub.DeterministicEventID(pendingMsgID, e.Type)
		err := a.store.WithTx(ctx, func(tx pgx.Tx) error {
			return a.outbox.PublishTx(ctx, tx, e)
		})
		if err != nil {
			log.Printf("[api] outbox tx for email.pending_review err: %v", err)
		} else {
			// err==nil means the tx committed AND PublishTx returned
			// nil — both are required for the row to be durably
			// recorded. (If the flag was off, PublishTx no-op'd and
			// returned nil; outbox.Enabled() guards that below in
			// shouldFireLegacy so we don't suppress legacy in that
			// case either.)
			outboxWrote = true
		}
	}
	a.emit().OutboxEventsPublished(e.Type)
	if a.shouldFireLegacy(outboxWrote) {
		a.publishAsync(e)
	}
}

// publishApproved fires email.review_approved via the outbox
// (PublishBestEffortTx — POST-side-effect: SES has already accepted