Coordination & Transactions

Choose a decision, deliver it, compensate business effects, and fence stale writers. Timeout is uncertainty, not rollback.

Votes and acknowledgements answer different questions

Deduplicate participant snapshots by last input record first. All surviving votes commit → commit, even if acknowledgements are missing. Retry every unacknowledged participant for either final decision.

Recovery must reuse a durable final decision, not recompute it from incomplete votes.

Saga: successful prefix, reverse eligible order

reserve/release-v1, charge/refund, reserve/release-v2, audit(noncompensable), ship(failed) → [release-v2,refund].

First non-ok stops the prefix. Latest eligible success per name wins. A plan does not execute or guarantee compensation.

Cache the first decision before rechecking fencing

op-a rejected before grant4 stays rejected on retry after grant4. op-b accepted at4 replays acceptance after grant5, without applying again. Fresh token4 write after grant5 is rejected.

Accepted replay reports the past; it is not a new effect.

Ownership is checked at the sink

Known token5 also rejects an ungranted token6. Older grants cannot lower the stored maximum. Operation IDs are global within this stream. Real effect application and token checks must be atomic together.

Independent reconstruction

Make the second reserve noncompensable and ship skipped. Predict compensation order. For a crash after commit but before acknowledgement, name the durable fact and the actor responsible for retry.