PREWAVE-BE-093 — Resolve Claim Stakeholders for Claim Lifecycle Notifications #794

Problem context

src/notifications/services/claim-event-publisher.service.ts contains placeholder recipient resolvers: claim updates, resolutions, and archives currently return empty recipient lists, while claim creation notifies only the creator.

Technical scope

Resolve the authorized stakeholder set for claim-created, updated, resolved, and archived events from canonical claim ownership and participation records. Apply per-event recipient rules, deduplicate recipients, exclude the actor where policy requires, and respect notification preferences and opt-outs. Query using the supplied transaction manager so event publication remains transactionally consistent.

Required tests

• Creator, assigned verifier, participating verifier, commenter, and other policy-approved stakeholder fixtures.
• Empty/deleted/ineligible stakeholder cases.
• Duplicate recipient elimination and actor suppression.
• Preference/opt-out enforcement and transaction rollback behavior.
• Assert no unrelated user's identity or private claim data is exposed.

Security and architecture constraints

• Contracts and finalized canonical events remain authoritative for protocol state.
• The API remains a projection/read and notification-delivery layer; it must not invent protocol outcomes.
• Fail closed on missing, stale, ambiguous, unauthorized, or incomplete state.
• Do not expose secrets, device tokens, email verification tokens, private evidence, or unnecessary personal data.
• Preserve strict typing, idempotency, privacy, observability redaction, and existing CI/security gates.

Acceptance criteria

• The identified placeholder or unsafe behavior is replaced by a production-quality implementation.
• Provider/recipient/ownership behavior is explicit and documented.
• Every required failure mode is covered by automated tests.
• No synthetic success, cross-user data exposure, or secret leakage remains in the affected path.
• The pull request links exactly this issue and maps evidence to every acceptance criterion.
• Exact-head required CI passes and independent human review is recorded.

Dependencies

• API PREWAVE-BE-018 — Converge Duplicate Notification Module Implementations #613 — canonical notification module wiring.
• API PREWAVE-BE-025 — Validate Optional Notification Channel Configuration Fail Closed #621 — notification channel configuration and preference enforcement.

Non-goals

Changing claim lifecycle authority or adding new notification event types.

Complexity and points

• Medium — 150 points

Candidate only. Activation remains maintainer-controlled; do not apply Stellar Wave as part of implementation.