In a robust event-driven architecture, "durability" is the ability of a system to retain events so that a subscriber can retrieve them even after being offline. For an architect needing to minimize data loss over "every couple of days," the selection must focus on event types that support a high retention window.
Salesforce provides two modern event types specifically designed for high-scale, durable messaging:
* Change Data Capture (CDC): This automatically broadcasts changes to Salesforce records (Create, Update, Delete, Undelete). CDC events are highly durable and are retained in the event bus for 72 hours (3 days).
* High-Volume Platform Events: These are custom events defined by the architect. Like CDC, High- Volume Platform Events also provide a 72-hour retention window.
Earlier versions of the Streaming API, such as PushTopic Events and Generic Events (Option C and parts of A), typically offered a 24-hour retention window, which would not satisfy the requirement of a client re- connecting "every couple of days" (potentially 48-72 hours later).
By utilizing CDC and High-Volume Platform Events, the architect can leverage the Replay ID. When the client re-connects, it can send the Replay ID of the last event it successfully processed. Salesforce then
"replays" all events that occurred during the client's downtime from that specific point, up to the 72-hour limit. This mechanism ensures zero data loss for planned or unplanned outages lasting up to three days, making it the most resilient choice for the specified requirements.

When designing an event-driven architecture to track order processing stages (Created, Shipped, Paid), the Integration Architect must ensure the solution provides "durability"-the ability to recover messages that were sent while a subscriber was offline or during a system failure. In Salesforce, this is managed through the Event Bus and the ReplayID mechanism.
For High-Volume Platform Events and Change Data Capture, Salesforce provides a standard retention window of 72 hours (3 days). This means that events are stored in the bus for this duration, allowing clients to "replay" events that occurred in the past. To leverage this durability, the subscribing client must specify where in the event stream they wish to begin receiving messages.
There are two special values for the ReplayID:
* ReplayID = -1 (Tip of the Stream): The subscriber receives only new events that are published after the subscription is established. Any events published while the client was disconnected are missed. This does not meet the requirement of seeing processing stages that occurred within the retention window if the connection was interrupted.
* ReplayID = -2 (All Available Events): The subscriber receives all events that are currently stored in the event bus (up to 72 hours old) as well as all new events.
By recommending the use of ReplayID = -2, the architect ensures that even if the Salesforce frontend or the integration middleware experiences downtime, the system can "catch up" by retrieving all order status updates (Shipped, Paid, etc.) that were published during that window. This provides a robust and resilient user experience, ensuring that the Opportunity and Order records in Salesforce accurately reflect the state of the ERP system without data gaps. This configuration is essential for maintaining data synchronization in a distributed landscape where Salesforce acts as the engagement layer for a back-1end ERP master.

To satisfy the requirement of encrypting standard fields while maintaining their functionality within record- triggered flows, Shield Platform Encryption is the recommended architectural solution.1 Shield Platform Encryption is a modern security layer that allows for encryption at rest while 2preserving critical platform features. Unlike Classic Encryption (Option B)-which is limited to a specific "Encrypted Text" custom field type and often breaks platform features like search and automation-Shield is designed to work with standard fields such as Name, Email, and Phone.
Key architectural considerations for Shield include:
* Compatibility with Automation: Shield fields can be used in Flows, Apex triggers, and validation rules. This allows NTO to implement the required record-triggered business logic without needing to decrypt the data manually in code.
* Search and Filtering: By using Deterministic Encryption, Shield allows users to filter and search for records based on encrypted fields, which is often a requirement for "widely-used" standard fields.
* Compliance and Governance: Shield provides advanced key management (Bring Your Own Key - BYOK) and auditing, ensuring that NTO meets corporate security guidelines while data is being processed by the platform.
Data Masking (Option C) is primarily used for sandboxes to obfuscate PII during testing and is not a production encryption-at-rest solution. By recommending Shield, the architect provides a transparent security model that protects sensitive data without sacrificing the declarative power of Flow Builder.

In a contract-first integration approach using RAML, the specification acts as the single source of truth for request and response structures. Since Salesforce unit tests are prohibited from performing actual network callouts, the HttpCalloutMock interface must be used to simulate external API behavior.
To ensure unit tests truly confirm adherence to the RAML contract, the architect must mandate that the mock implementation specifically returns responses formatted per the RAML specification. This means the mock's JSON or XML body, headers, and HTTP status codes (e.g., 200 OK, 400 Bad Request) must exactly match the "interface contract" defined in the RAML file.
By strictly aligning the mock with the RAML spec, developers ensure that the Apex client's parsing logic (e.
g., JSON.deserialize()) is tested against the agreed-upon data model. If the external service later changes its schema in a way that deviates from the RAML, the unit tests-which are based on that contract-will help identify where the Apex code might fail. Options B and C are technically incorrect: the client does not "call" or "implement" the mock; rather, the test runtime provides the mock instance to the client via Test.setMock().

When a target system experiences prolonged outages (lasting "several days"), point-to-point integrations built directly within Salesforce are prone to failure because they lack the persistence required for long-term retries.
The architecturally sound recommendation is to utilize middleware queuing and buffering to "insulate" Salesforce from the target system's instability.
In this architecture, Salesforce sends the order to a middleware layer (such as an ESB or iPaaS). The middleware immediately acknowledges receipt of the message, freeing up Salesforce resources. If the manufacturing system is offline, the middleware stores the order in a persistent Message Queue. Unlike Salesforce Outbound Messaging (Option B), which only retries for up to 24 hours, enterprise middleware can be configured to hold messages for days or even weeks.
Middleware also provides sophisticated Quality of Service (QoS) features, such as "Dead Letter Queues" for manual intervention and customized retry schedules (e.g., retrying every hour instead of every few minutes).
This decoupling ensures that Salesforce users can continue to create and "send" orders without seeing technical errors, even while the backend manufacturing system is down. Once the manufacturing service is restored, the middleware "drains" the queue, delivering all buffered orders in the correct sequence. This strategy provides the highest level of reliability and resilience for mission-critical business processes.