Make the acknowledgement mean one thing
Stripe recommends returning a successful response quickly before complex work. Design a short verified receipt path, with durable accepted work and a retryable worker. Do not send success merely because an in-memory task was created. The durability boundary is your implementation decision.
| State | Receipt evidence | Response decision |
|---|---|---|
| Signature invalid | No accepted event | Reject |
| Queue write failed | Not durable | Do not claim accepted work |
| Event saved; worker pending | EV-31 and pending state committed | Acknowledge receipt, not completion |
Recover from the saved receipt
Test process termination immediately after receipt is stored and before the response is sent. A subsequent delivery should discover the same work item. Keep downstream failure visible in the work ledger even though the sender received success.
The sender received 2xx, but the worker cannot contact the target. Was the integration finished?
Show the worked answer
No. Only the defined receipt boundary passed. Keep downstream work pending, retry under its own budget and expose an operational failure if that budget ends.