Hi,
I'm delighted to hear you are finding the book useful. And I'm delighted that you asked this question, because it shows you understand the important details
Firstly, you are correct. We do assume that some type of local storage is always running. If the message bus is able to take a message from a queue, then the assumption is that it is in a healthy state to reliably process that message.
This assumption may not always hold true, though. And unfortunately, there's not a lot you can really do about it. You just have to trust that your messaging infrastructure will fail gracefully. When you use a robust, proven technology like NServiceBus, the chances are that it will.
Ultimately, though, there is always a tiny chance the customer will be charged twice. For example, if the server shuts down in-between the time the card is charged and the transaction completes (or acknowledgement is sent), the message will be retried again later.
What we've shown in the book is that by wrapping each non-idempotent action with a message, you reduce the chance that the customer will be charged twice as much as possible. This also relates to the local storage used by the messaging infrastructure; it probably could go down and cause the payment to be charged twice, but it is very unlikely.
I hope this helps. And please feel free to post more questions. If you want an in-depth chat on skype just let me know
Nick