Reliability

Stamping treats source capture, fiscal issuance, artifact storage, and CargoWise delivery as separate durable boundaries. Recovery resumes the boundary that failed without repeating completed work.

​

Atomic capture

Lambda ingress stores the immutable CargoWise source, document identity, initial lifecycle evidence, and durable work request together. If that operation cannot complete, Lambda does not acknowledge a partially captured document. Accepted work therefore has source evidence that later mapping, audit, and recovery can reference.

​

Durable and idempotent work

After capture, durable work can be delivered more than once. Every processing boundary uses stable identities so a repeated delivery reaches the same logical document, attempt, artifact, or CargoWise handoff. This supports at-least-once work delivery without treating every repeated message as a new fiscal request.

​

Provider create outcomes

Lambda records the create outcome for each exact Facturapi attempt: Automatic recovery can resume an exact durable attempt using its stored request and idempotency identity. It can replay a request only when evidence proves the earlier create was not applied. An unknown outcome is never retried as a blind new stamp.

​

Dependency recovery

A payment or credit waiting for a healthy parent keeps a durable dependency. Parent arrival or successful parent stamping can continue the child without rebuilding an unrelated fiscal path.

​

File recovery

If issuance succeeds but storage is incomplete, Lambda can backfill XML or PDF from the exact issued evidence. The artifact identity, hash, and attempt provenance prevent a later backfill from replacing an unrelated historical file.

​

Outbound recovery

Lambda outbound has its own operation identity and retry state. CargoWise inbound failure does not reopen issuance. A completed XML delivery does not need to be repeated merely because PDF delivery remains pending.

​

Corrective protection

Corrective recovery first produces a preview of the immutable source, current projection, active failure, and eligible next action. The preview has a hash. Apply must use that exact fresh hash, so a stale review cannot act after the document or prerequisite changes. Corrective recovery does not replace a live stamp, retry an in-flight attempt, or remap source without a proven correction. See Recovery for automatic and corrective paths, and Edward for the optional bounded review lane.