A queue worker can fail after an external transaction succeeds but before message acknowledgment. The team needs safe recovery and visibility of repeatedly failing messages. Which design is best?

1. Use a dead-letter queue as proof that successful transactions can never be duplicated.
2. Assume acknowledgment failure proves no external transaction occurred.
3. Use idempotent business processing and an appropriate retry and dead-letter recovery policy.
4. Delete every message before contacting the external service.