Design a service for an online store that watches shopping-cart activity, decides when a cart has been abandoned, and triggers a recovery message (email or push) to win the shopper back.

Operating context. Storefront clients emit cart-mutation events (item added, quantity changed, item removed, checkout started, order placed) tagged with a cart or session identifier. A cart counts as abandoned when it holds at least one item and sees no activity for a merchant-configurable idle window (typically 30–60 minutes). Traffic is spiky: roughly 5000 events/sec at steady state, bursting to 50000/sec during seasonal sales. Recovery messages must not spam — at most one trigger per cart per window, and none once the shopper converts or opts out. Merchants also watch a dashboard of live abandonment rate and recoverable cart value.

Out of scope. The actual email/push rendering and delivery infrastructure, the checkout and payment flow, per-merchant creative templates, and machine-learned send-time optimization. Assume separate teams own those and expose simple enqueue APIs.

What to produce. A high-level architecture covering: the event ingestion path, how per-cart state and the idle timer are maintained at scale, how abandonment is detected within the window without polling every cart, how a trigger is de-duplicated and suppressed after conversion or opt-out, and how the merchant analytics rollups are computed off the hot path. Sketch the major components and the flow of a cart event from ingestion to a fired (or suppressed) recovery trigger.