When a canonical message is published, the bus writes it to durable storage before any send port attempts delivery. If the destination is down, the send port retries; if the platform itself restarts mid-flight, delivery resumes from the persisted copy. Nothing depends on a message being held only in memory.

The guarantee is at-least-once, not exactly-once: a delivery that succeeds but whose acknowledgement is lost will be retried, so the same message can arrive twice. That is the deliberate trade, the bus would rather deliver again than lose your data.