Define durable receipt
Decide when the system can honestly acknowledge an event. Important work should have a persistent record before the sender is told it has been accepted.
Expect duplicates and delays
Use stable business identifiers and account for out-of-order events. Retrying transport should not automatically create a second order, message or financial action.
Distinguish failure from uncertainty
A timeout can occur after the remote system completed the action. Reconcile that outcome before retrying an operation that lacks duplicate protection.
Make recovery operational
Monitor stalled work and explain how an authorized person can inspect and replay it. Test recovery with original identifiers and a clear record of what has already happened.