Retention, ordering and external effects
What this concept is
A duplicate-effect guarantee depends on which state is transactional, how long identities are retained and which delivery orders are valid. None of these assumptions should be hidden behind an “exactly once” label.
Why it matters here
The lab adds amounts, so order does not change the total. A state replacement, inventory reservation or shipment transition may not commute. Similarly, an external email or payment is outside the consumer database transaction.
Concrete example
After processing a:7, delete inbox a while retaining balance 7. Redelivering a adds another 7. A seven-day cleanup schedule therefore needs an independently justified replay horizon and coordinated retention policy; time alone does not prove an old event cannot return. The reference avoids this issue by retaining all IDs.
Common confusion / misconception
Sorting events by ID is deterministic but not business causality. A sent flag means the abstract publish step succeeded, not that the consumer committed. Nor does local rollback undo an already sent email. Compensation is another business operation that can itself fail.
How to use it
State ID namespace, payload immutability, retention horizon, retry policy, poison-event handling and ordering requirements. Keep unknown outcomes visible rather than silently discarding them. For external effects, use a downstream idempotency contract or reconcile outcomes; an inbox alone cannot atomically include another system. Reuse the original saga lab to model failed compensation and operator-visible stuck states.
Check yourself
What happens if the broker list is lost after sent=1? Which assumption fails? What additional design is needed for multiple relay workers or per-account ordered events?
Mini drill or application
Change additive credit to “set balance to amount.” Construct two deliveries whose reversal changes the outcome. Then sketch a cleanup policy and a replay older than its horizon. Explain what evidence would justify that horizon, rather than inventing a convenient duration.
Read this only if stuck
Use DDIA for distributed effects and PostgreSQL transaction isolation for the separate isolation lab. Do not infer PostgreSQL concurrency outcomes from this serial SQLite harness.