When a canonical message is published, the bus writes it to durable storage before any send port attempts delivery. If the destination is down, the send port retries; if the platform itself restarts mid-flight, delivery resumes from the persisted copy. Nothing depends on a message being held only in memory.

The guarantee is at-least-once, not exactly-once: a delivery that succeeds but whose acknowledgement is lost will be retried, so the same message can arrive twice. That is the deliberate trade — the bus would rather deliver again than lose your data.