One edge case worth covering is a timeout after the database commits but before the executor records success. If the queue retries the migration blindly, you can end up applying a non-idempotent operation twice or marking a completed change as failed. I'd persist an execution ID and reconcile the actual resource state before retrying, so recovery doesn't depend on guessing whether the previous attempt made it through.