Durable record model
This model lets Lambda recover one incomplete boundary without rebuilding or repeating the others.
Atomic capture and work admission
Lambda captures the source, document identity, initial lifecycle record, and first work request as one durable admission decision. If that decision cannot complete, CargoWise does not receive a successful acceptance for partial work. Once work is accepted, the source remains available for mapping, audit, duplicate detection, and recovery. A later CargoWise push is compared with this saved source instead of replacing it.At-least-once work, idempotent results
Background work can be delivered more than once. Stable identities make a repeat reach the same document, attempt, artifact, or delivery operation. Repetition is therefore expected at the worker boundary, but it is not permission to create a second CFDI. Notifications, search updates, live UI updates, and workflow starts are dispatched after the owning database mutation commits. If dispatch is interrupted, the durable work record can be dispatched again. Handlers must remain safe when they receive the same request more than once.Provider outcome protection
An unknown result is never treated like a normal rejection. Automatic recovery can resume the exact
attempt with its stored request and idempotency identity. A new corrective attempt is allowed only
when the previous create is proven not to have applied.
Separate artifact and delivery recovery
- Missing XML or PDF is recovered from the exact issued evidence.
- A completed XML delivery is not reopened because PDF delivery is still pending.
- Cancellation files do not overwrite issuance files.
- CargoWise inbound failure does not reopen fiscal issuance.
- A REP whose provider stamp succeeded but whose installment ledger finalization failed is protected from another stamp. Support must restore the ledger evidence first.