External Dependencies
Every call leaving your process can be slow, wrong or absent. Timeouts, retries, backoff, circuit breakers, bulkheads and the rate limits you both enforce and obey.
Eight questions every outbound call has to answer, and the fact that a dependency's availability becomes yours the moment you await it.
Never assume an external dependency returns. A call with no timeout is a resource leak waiting for a bad day.
"Retryable" and "safe to retry" are different properties, and confusing them is how a transient error becomes a duplicate charge.
Waiting longer between attempts stops you hammering a struggling dependency; randomising the wait stops every client from hammering it in unison.
After a dependency has failed enough, stop calling it: fail fast, protect your own capacity, and probe carefully for recovery.
Give each dependency its own bounded slice of your resources, so one slow dependency cannot consume every worker you have.
Deciding which caller has had enough, along which dimension — and why the counter's atomicity is the part that makes it correct.
Fixed window, sliding window, token bucket and leaky bucket — what each one allows, what it refuses, and the burst each permits.
The integration everyone builds first and treats casually: an external provider, at-least-once delivery, and a side effect that cannot be taken back.