Reliability in IoT pipelines begins with idempotent contracts and explicit sequencing. Command channels should remain separate from telemetry, and replay should be designed before an incident requires it.
Acknowledge at the right boundary
Do not acknowledge durable receipt before the system can recover the message after a process failure. The exact boundary may be a broker or an append-oriented store, but its guarantee must be explicit.
Treat ordering as scoped
Global ordering is costly and often unnecessary. Preserve order for the device or asset where sequence affects interpretation, and make late events visible rather than rewriting history silently.
Observe lag and data quality
Request uptime alone says little about a telemetry system. Monitor consumer lag, rejected schemas, duplicate rate, device freshness and rule failures so degraded information is not presented as healthy.