Stop unsafe side effects before broad restarts
Identify the failing boundary and pause only the unsafe side effect when possible. Preserve unaffected browsing, catalog or read-only functionality when it can remain correct.
Capture enough evidence before changing the system
Save timestamps, references, affected cohorts, provider response categories and the relevant release/configuration identifiers. Do not expose credentials in incident notes.
Use idempotent replay and explicit repair paths
Retry operations only when the handler is designed for replay. Otherwise use a controlled repair path with an audit trail rather than resending blindly.
Verify business truth after services recover
Compare internal state with payment, inventory, shipping or ERP sources of truth as appropriate. Record mismatches and resolve them deliberately.
Use these patterns to structure a Thonem project, then verify the exact routes, providers, secrets, queues and infrastructure of the deployed environment before changing production.