void-async-safety

Verify the HMAC signature first, then atomically claim an idempotency key such as the Stripe event ID before running business logic, and mark it completed afterward. Store claims in Redis or Postgres so process restarts do not lose dedup state, and reject events older than a five-minute replay window.

The outbox pattern writes the database change and the event to publish in the same transaction, then a background dispatcher publishes the event with retries. Use it whenever one operation must both update the database and notify an external system, so a failure cannot leave the two inconsistent.

Use exponential backoff with jitter, starting around one second and doubling per attempt, capped at three to five attempts. After exhaustion, move the job to a dead-letter queue and alert, since further failure is structural and needs human review.

No. In-memory dedup loses all claims on process restart, allowing redelivered events to be processed twice. Use a durable store such as Redis or Postgres with an atomic claim operation like INSERT ... ON CONFLICT DO NOTHING.

Acquire a lock keyed by the cron name, such as a Postgres advisory lock, and skip the run with a structured log entry if the previous execution is still in flight. Without overlap protection, jobs slower than the cron interval stack up and crash workers.

Decide up front: critical calls like payment authorization must surface the failure to the caller, while degradable calls like FX rates or recommendations should fall back to a cached or default value with a warning log. Always bound the call with a timeout such as AbortSignal.timeout.