Transactions and messaging

An outbox relay publishes successfully and crashes before marking the row sent. What happens next?

It publishes the row again after recovery. The outbox prevents a committed change from silently losing its publication intent; consumers still need duplicate handling.

Where must a consumer store its processed-event marker when updating a SQL projection?

In the same transaction as the projection change, with a unique event identifier. A committed marker without the change loses work; a committed change without the marker permits repeated effects.

Why does a transactional inbox not by itself prevent charging a payment provider twice?

The provider call is outside the local SQL transaction. Use a stable provider-supported idempotency key, persist workflow state, and reconcile ambiguous outcomes before attempting a new charge.

Two customers submit the same idempotency key. What should determine whether they conflict?

Define a namespace, commonly tenant plus operation plus key. Enforce it atomically so unrelated tenants do not share responses or block each other.

A client reuses an idempotency key with a different amount. What should the server do?

Reject the conflicting reuse rather than returning an unrelated result or executing a second operation. Store a canonical request fingerprint with the key and compare it on retries.

Why is checking for an idempotency row and then inserting it unsafe under concurrency?

Both requests can observe absence. Use a unique constraint and transactional ownership of the operation; the losing request reads or waits for the existing result.

What correctness question must be answered before expiring deduplication records after one day?

Can a valid retry or replay arrive later than one day? After expiry it may repeat the effect. Align retention with the retry contract or retain a permanent business-level uniqueness constraint.

An idempotency record says processing, but its worker disappeared. What should a recovery worker establish?

Whether the external effect already happened, and whether it can safely take ownership. Use durable state, provider lookup, and fencing where supported; elapsed time alone does not prove no effect occurred.

A database connection drops while COMMIT is running. Is it safe to assume rollback?

No. The commit may have succeeded before the response was lost. Query by a stable operation identifier and resolve the outcome before reissuing a non-idempotent operation.

What failure window appears when a worker acknowledges a job before committing its business update?

A crash after the acknowledgement can permanently lose the update because the broker considers the job complete. Acknowledge after durable processing, with duplicate protection for the opposite crash window.

A worker commits its database update, then loses its broker connection before acknowledging. What must recovery tolerate?

Redelivery of an already-applied event. The business update and a deduplication marker should commit together, allowing the next worker to acknowledge without repeating the effect.

Does a RabbitMQ publisher confirm mean a consumer finished the business operation?

No. Publisher confirms concern broker acceptance; consumer acknowledgements are separate. End-to-end completion requires application-level status or a response event.

Why can acknowledging a RabbitMQ delivery on another channel close that channel?

Delivery tags are channel-scoped. Acknowledge through the receiving channel; a tag is not a globally portable message identifier.

How can excessive RabbitMQ prefetch hurt a pool of slow workers?

Many unacknowledged messages accumulate at particular consumers, increasing memory use and uneven work distribution. Tune prefetch against processing concurrency and latency.

A malformed message fails immediately and is requeued repeatedly. What should change?

Classify permanent failures, cap attempts, and quarantine the message with diagnostic context. Immediate requeue can consume capacity without making progress; transient failures need delayed retries.

Why can a RabbitMQ publisher need mandatory returns as well as confirms?

A confirm alone does not establish that the intended queue received a routable message. Handle returned unroutable publications and validate routing configuration.

A Kafka consumer processed offset 41 successfully. What committed offset normally represents its next position?

42, the next record to read. Commit only past work whose required effects are durable.

Kafka offsets 10 and 12 finish, but 11 is still running. Why is committing 13 dangerous?

Recovery starts at 13 and can skip 11. Track the contiguous completed prefix per partition rather than committing the highest finished offset.

What boundary can a Kafka consume-transform-produce transaction make atomic?

Output records and consumed offsets within Kafka. It does not automatically include an external SQL update or HTTP side effect.

Why must a Kafka downstream reader consider read_committed when consuming transactional output?

It excludes aborted transactional records. Without the appropriate isolation setting, a reader can observe output from work that did not commit.

Does an idempotent Kafka producer deduplicate two separate business requests containing identical payloads?

No. It handles producer retry duplicates within its protocol guarantees. Business duplicate requests still need application identities and constraints.

What ordering promise should an application make for events in a partitioned log?

Ordering is per partition, not a total order across the topic. Choose keys and consumer execution rules that preserve the required entity order.

Why can increasing a topic's partition count disrupt an application's per-key ordering assumption?

A partitioner may map new events for a key to a different partition while old events remain on the original one. Plan routing migration and processing barriers when strict order matters.

A consumer loses partition ownership while an HTTP request is still running. What can go wrong?

The old request may finish while the new owner retries the same event. Offset ownership alone cannot fence the external effect; use idempotency or an effect-level ownership check.

A projection receives customer version 8 before version 7. How should it decide what to apply?

For full replacement snapshots, keep the greatest version. For deltas, detect the gap and buffer or recover missing events; discarding a delta merely because a newer one arrived can corrupt state.

Why should wall-clock timestamps not be the sole ordering mechanism for account events?

Clocks can disagree and multiple events can share a timestamp. Use a per-account sequence or a storage-assigned ordering token tied to the mutation.

A request crosses four services that each retry three times. Why can an outage become much worse?

Nested retries multiply attempts, potentially reaching 81 deepest calls for one request. Assign retry ownership, cap a shared deadline, and limit total attempts.

What does jitter change in exponential retry backoff?

It spreads retry times so many clients do not hit the recovering dependency together. It does not make permanent failures retryable or replace a retry budget.

Why should a worker check a job's business deadline before retrying it?

A technically successful late action may be wrong, such as reserving inventory after checkout expired. Distinguish transport retries from business validity and record a terminal outcome.

What must be preserved when replaying a dead-letter queue into production?

Original event identity, causality, and any required ordering. Fix the failure cause first, control replay rate, and verify that duplicate handling and external effects remain safe.

Why is skipping a poison event an explicit business decision in an ordered account stream?

Later events may depend on the missing state transition. Quarantine the entity or repair the event when skipping would violate invariants, rather than advancing offsets silently.

Can several independent outbox workers preserve aggregate event order just by sorting each query?

No. Workers can publish and finish in different orders. Coordinate ownership per aggregate or use an ordered log plus aggregate sequence validation.

Which outbox metric reveals a stalled publisher when insertion rate is low?

Age of the oldest unpublished committed row. Queue length alone can look small even when one critical event has been stuck for hours.

Why should raw change-data-capture records not automatically become a public domain-event contract?

Table layouts and updates reflect storage decisions, and one business action can touch several rows. Define stable event meaning, identity, and schema independently when consumers need a durable contract.

How can a new required event field be rolled out without breaking old producers and consumers?

First deploy readers that accept the old shape and the new field, then writers, then tighten requirements after old traffic and retained replays are accounted for.

Why is renaming an event field insufficient when its meaning changes from gross amount to net amount?

Consumers may parse it successfully while computing the wrong result. Version the semantic contract or introduce an explicit new field with migration rules.

Why should rebuilding an analytics projection not resend all historical customer emails?

Projection replay and external side effects have different intents. Separate handlers or execution modes and enforce effect deduplication so recovery cannot repeat live actions.

Why is a saga compensation not equivalent to rolling back a database transaction?

Other services and users may already observe committed steps. Compensation is a new action, can fail, and may only approximate reversal, such as issuing a refund rather than erasing a charge.

What must a durable workflow record after each remote step?

The intended operation, its stable identity, known outcome, and next recoverable state. After a crash, the orchestrator must distinguish not attempted, completed, and outcome unknown.

Inventory release fails during checkout compensation. What should the workflow do?

Persist the unresolved compensation, retry with bounded policy, and surface overdue cases for reconciliation. Marking the workflow fully cancelled would hide a retained reservation.

Why can a prepared participant in two-phase commit retain locks after its coordinator fails?

It has promised to honor the final decision and cannot safely guess commit or abort. Recovery must obtain the durable decision; operationally track and resolve in-doubt transactions.

How can a reservation model avoid holding a database transaction open throughout payment authorization?

Commit a time-bounded inventory hold, authorize payment using an idempotent operation, then confirm or release the hold through durable state transitions. Handle expiry racing with authorization explicitly.

A reservation expires while a worker tries to confirm it. How should the final state be chosen?

Use an atomic conditional transition from held to confirmed or expired, checking the authoritative expiry policy. Only the winning transition may trigger its corresponding downstream effects.

How can a single SQL update prevent selling more units than remain for one stock row?

Update quantity = quantity - requested only where quantity >= requested, and check affected rows. Keep related order changes in the transaction; a prior unlocked availability read is insufficient.

What must be atomic when moving funds between two accounts in the same transactional database?

Debit, credit, and the transfer's identity or ledger entries must commit together. Enforce sufficient-funds rules under suitable locking or isolation and retry whole aborted transactions.

What does reconciliation catch that retrying failed jobs may miss?

Missing events, divergent balances, and unknown external outcomes that were incorrectly marked successful or never queued. Compare authoritative records using stable identifiers and repair with auditable operations.

When producer throughput exceeds consumer capacity indefinitely, what can a queue actually provide?

Temporary buffering, not unlimited capacity. Bound backlog or retention, apply admission control, scale the true bottleneck, and alert on age before user deadlines are missed.

Which injected crash points test an outbox consumer pipeline's core guarantees?

Before and after each database commit, publish, and acknowledgement. After recovery, assert no committed intent is lost and repeated delivery cannot duplicate the business effect.

Why can zero consumer lag coexist with an incorrect projection?

Offsets may have advanced before writes completed, records may have been skipped, or a handler may apply incorrect logic. Check business invariants and reconciliation in addition to transport lag.