## Reliability goals

- Keep processing predictable during spikes and partial failures.
- Reduce double-execution incidents on mutable operations.
- Ensure fast recovery with explicit runbooks.

## Protection layers

1. **Fast ingestion**: receive and acknowledge events with minimal validation.
2. **Idempotent persistence**: technical and business dedupe per operation.
3. **Async execution**: domain-isolated workers with controlled retries.
4. **Actionable observability**: metrics, alerts, and audit trail.

## Retry and backoff strategy

| Error class | Policy | Escalation |
| --- | --- | --- |
| Transient | retry with exponential backoff | alert when threshold is exceeded |
| Logical/validation | no automatic retry | open manual action with context |
| External dependency degraded | limited retry + circuit breaker | trigger operational mitigation mode |

## Daily operating signals

- Backlog above baseline by section/event.
- Unexpected growth in idempotent `409` conflicts.
- Time-to-final-state above declared SLO.

<Warning title="Operational discipline">Reliability is not only architecture. It requires periodic alert tuning, tested runbooks, and explicit ownership per domain.</Warning>