Keep provider status strings out of UI components
Translate provider states at the integration boundary. Give the product an explicit unknown state instead of scattering external status checks through its interface.
Rust API integration recovery
Keep provider outcomes, pagination, caches, durable acceptance, and repairs explicit. Each guide gives a concrete reproduction, the resulting decision, and the limits of the evidence.
Don't turn every provider 429 into a customer 500
Translate upstream rate limits into a product contract. Distinguish a customer's quota from a shared provider limit and avoid exposing raw provider errors.
Choose one layer to own retries
Nested SDK, transport, and worker retries can multiply attempts. Give one logical operation an effective retry budget and a deadline that every layer respects.
After a timeout, check the outcome before repeating the write
A timed-out request may already have committed. Preserve the operation identity and use a documented lookup or same-key retry contract to resolve the result.
Don't repair an entire integration inside a GET request
A read that discovers drift should not accidentally become an unbounded repair job. Report an honest state and coordinate bounded reconciliation separately.
Make API cursors opaque and bind them to the query
A page cursor belongs to an ordering, filter, and authorized scope. Version its format and reject incompatible reuse without mistaking encoding for authorization.
Put the tenant in the cache key, not just the record ID
A database tenant policy cannot protect a cache entry returned before the query. Carry the complete identity scope into cache keys and invalidation.
A bulk response must say which items succeeded
Give every bulk item a stable identity and an explicit outcome. Distinguish atomic batches, independent writes, and unresolved results before designing retries.
A webhook response should follow durable acceptance
Persist a verified webhook before acknowledging durable acceptance. Keep received and applied states separate so a crash cannot turn deduplication into lost work.
Give repair scripts a preview before they write
Separate repair planning from application. Show the selected records and proposed changes, then reject stale versions instead of applying an old preview blindly.