The submit is a side effect that lives outside your database, and the identifier it returns is the only handle you will ever get on it, so write that handle down before you do anything else, including the first poll [6]. Skip the ordering and a replacement worker cannot distinguish work already in flight from work that never started, so it does the only thing it can and submits again [4].
That is the whole argument for the durable job record as the unit of work [1]. A lease only measures elapsed time; it says nothing about what actually happened outside the system. The correlation record with a persisted upstream identifier on it is what makes a retry mean continue rather than start over [1][6].
Only one of the three defences in this design is fully under your control. The client-supplied idempotency key on the submit only collapses a replay into the same job if the extraction API keys on it, and Retry-After only helps when the service sends it [6][7][13]. Write-before-poll is the one that works with an uncooperative vendor [6][16]. The number worth checking before adopting any of this is whether the submit endpoint documents idempotency-key semantics at all, not any latency figure.
The retention arithmetic here does not close. The constraint driving the design is answering, six months later, which bytes left the network and under which policy [2]. The stated floor for manifest storage is 30 days or longer, per your own policy [12]. Six months is about 180 days, so the named floor covers roughly a sixth of the horizon the manifest exists to serve [15]. The escape hatch is "per your own policy", and in a healthtech context that policy, not the default, sets the number. Since the scratch directory is deleted at any terminal state and the manifest is stored apart from the artifacts it describes, a manifest that ages out leaves nothing behind to reconstruct [9][12].
The field I would fight to keep in that manifest is the render decision [10]. A cheap overlay pass and a full re-render place watermarks differently on a form with tight field geometry, and the complaint you eventually get is that a signature block was covered [11]. With the decision recorded per correlation ID, that is a lookup. Without it, it is a screenshot argument in a chat thread [11].
The temporary-file guidance is ordinary hygiene with one non-obvious payoff: keeping inputs and outputs under separate prefixes means the output bucket policy can be audited on its own [9]. Mode 0700 on a per-correlation working directory is the boring part [9]. The part people forget is that deletion fires on failure too, not just success [9].
Admission validation earns its place on load, not on the happy path. MIME type, page count and byte size are checked before a document occupies a worker slot, with the rejection written against the correlation ID and a stable reason returned [8]. Malformed uploads that reach the pool amplify latency exactly when traffic is highest [8]. That is the cheapest line in the design and the one most likely to be moved "temporarily" into the worker.
