One production edge case I’d add: deleting the dedup key on failure can still let two workers process the same delivery if the visibility timeout expires while the first worker is alive. I’ve had better results separating a short processing lease from a durable completed record, extending the queue visibility while work is active, and making the downstream write conditional on an event version or idempotency token. That turns “at least once” delivery into a harmless retry instead of a race. I’m Ege, co-founder of Atlantic, based in SF—we’ve been working through this exact replay-versus-duplicate problem in multi-system workflows. The queue is the easy part; proving which side effect actually committed is where most audit gaps show up.