Cancellation emails sent to both customer and host within 60 seconds

A cancelled booking affects two parties: the customer loses their appointment and the host loses revenue. Notifying only the customer leaves the host scrambling — they may have already prepared, turned away other clients, or allocated staff. Notifying only the host violates the customer's reasonable expectation of a cancellation record. CWE-391 and ISO 25010 reliability.fault-tolerance apply to both sends: a retry-less single attempt means a provider outage at cancellation time silently strands one or both parties. Businesses handling volume bookings compound this into systematic host blindness whenever email infrastructure degrades.

Queue a single job that carries both recipient addresses, then fan out inside the worker. This ensures both sends share the same retry budget and the same transactional atomicity as the status change:

// src/lib/bookings.ts
async function cancelBooking(bookingId: string, cancelledBy: 'customer' | 'admin') {
  const booking = await db.bookings.update(bookingId, {
    status: 'cancelled',
    cancelled_by: cancelledBy,
    cancelled_at: new Date(),
  })
  await emailQueue.add(
    'send-cancellation',
    {
      bookingId,
      customerEmail: booking.customer_email,
      hostEmail: booking.host_email,
      cancelledBy,
    },
    { attempts: 5, backoff: { type: 'exponential', delay: 2000 } }
  )
}

Verify the worker sends to both customerEmail and hostEmail before marking the job complete.