What happens to failed or duplicate orders?

Nothing gets lost. Every outbound call uses an idempotency key, so if a message is delivered twice you still get exactly one record downstream. Transient failures (timeouts, 5xx, rate limits) are retried with exponential backoff. Anything that still fails after the retry budget lands in a dead-letter queue and fires an alert, so a human fixes it, the order is never silently dropped.