Complex systems fail at the seams.
The dangerous parts of a production system are often not the components. They are the handoffs between them.
A feature can be correct and the system still fail
Payment can succeed while the order state does not update. Inventory can reserve correctly while fulfilment never receives the event. Authentication can work while authorisation rules diverge across services. Every component can be locally “working” while the operation is globally broken.
Design the handoff, not just the endpoint
A production workflow needs explicit ownership of state, retries, idempotency, failure visibility and recovery. Those are not infrastructure details. They are part of the product behaviour.
Operational clarity is an architectural feature
When an exception happens, the business should know what happened, what is safe to retry and who owns the next action. If engineers have to reconstruct the truth from five logs and three dashboards, the system is already charging an operational tax.