A consumer's database commit, broker acknowledgement, and external calls do not form one automatic transaction. Draw each durable boundary and test every crash gap.
Moving a failed event to a delayed retry topic lets later events overtake it. Trace the sequence, then choose blocking, key-aware, or order-independent recovery deliberately.
A useful dead-letter queue preserves failure evidence and has an owned repair workflow. Design its envelope, redrive rules, and closure signal before messages fail.
A partition key defines both the ordering boundary and the load distribution. Use the smallest business entity that truly requires ordered events, then test its skew.
A deduplication TTL must cover every supported path by which an old message can return. Derive the window from retries, replays, outages, and redrives.