{ Systems thinking }
Design the failure path first.
The useful questions start where the expected workflow stops.
{ Working note }
Start with the interrupted handoff.
A workflow can look complete when every service is available and every field is present. The more useful design question is what happens when an input is missing, an API call fails, or no routing rule matches.
{ Working note }
Give an exception somewhere to go.
Define who owns the exception, what context they need, and how it becomes visible. An alert without a responsible person is another incomplete handoff.
{ Working note }
Make retries deliberate.
A retry should not create a second customer record or send the same message twice. Use stable event identifiers, record the steps already completed, and decide which actions can be repeated safely.