Outbox and inbox calibration

Producer failures before commit leave no new order or outbox row; a lost reply after commit leaves both. Retry the same identity and payload, not a fresh ID. A changed payload is a conflict, not an acceptable retry.

After publish-before-mark failure, a retry produces two broker entries. That is permitted by this relay contract. Marking sent before publication can suppress the only retry and lose the message. After-mark failure leaves one published event and a sent row. Eventual processing additionally requires successful delivery and retries.

Consumer precommit failures leave no marker or increment. Postcommit lost reply leaves both, and duplicate delivery adds nothing. Two IDs each worth 7 produce 14, while a repeated ID adds nothing. A zero-amount event still has an identity. Dropping an inbox marker removes protection against a late replay of that event.

A weak answer says “the outbox makes everything exactly once.” A passing answer identifies the two local atomic transactions and duplicate-prone transport between them. A strong answer demonstrates a retention or noncommutative-order counterexample and identifies an external effect that local SQL cannot roll back.

The reference has a single relay and serial consumers; tests inject exceptions and reopen files normally. No real broker, concurrent database workload or power failure was executed. Complete original isolation and recovery work and keep those conclusions distinct. Reattempt a new failure trace after 48 hours without reference answers.