Subscriptions receive HTTPS POSTs from the dispatcher whenever a matching domain event fires. Every delivery carries an X-Neom-Signature: sha256=<hex> header computed from the subscription secret — receivers should verify it before trusting the payload. Failed deliveries retry with exponential backoff (2n minutes capped at 24h) up to 6 attempts before being parked in failed for operator replay.