Reports #012 and #013 validated TTP inside a real PostgreSQL mutation boundary. Report #014 moves one step outward: business state can be committed while an external effect is executed separately and its acknowledgement is lost.
The unsafe boundary duplicated the external effect.
The business transition committed once at COMMITTED / version=101. The first external request then committed its effect, but a synthetic crash removed the acknowledgement. Recovery created a new request identity and sent again.
Unsafe control
Business commitOne PostgreSQL state transition reached version 101.
External effect #1Request key unsafe:attempt:1 was applied.
ACK lostRecovery could not prove whether the effect happened.
New identityunsafe:attempt:2 was treated as a new request and applied again.
Transactional outbox closes the database-side gap.
The safe adapter writes the business transition and the durable delivery intent in the same PostgreSQL transaction.
A synthetic crash before that commit rolled both pieces back: ABSENT / v100 / 0 outbox rows. A successful commit persisted both together, including the stable key op-1:external-effect:v1.
Stable identity makes redelivery safe.
The first worker delivery was applied by the synthetic external service, but its acknowledgement was lost, so the outbox remained pending.
The worker then delivered the same logical message again with the same idempotency key. The external boundary returned DEDUPLICATED. The final external effect count remained one and the outbox moved to DELIVERED.
Reconciliation can avoid even the duplicate call.
The stronger recovery path queried the external ledger after the acknowledgement disappeared. It found COMMITTED, marked the outbox delivered and made no second external call.
The cross-boundary TTP rule
Score · 10/10
Unsafe boundary duplicate · 2/2One DB transition produced two external effects when retry identity changed.
Atomic outbox intent · 2/2State and outbox rolled back or committed together.
Stable-key redelivery · 2/2Second delivery was deduplicated; one effect remained.
Reconcile before retry · 2/2External COMMITTED was discovered before any second external call.
Cross-boundary proof · 2/2Safe trajectories ended with one business transition and one external effect.
New invariants
Transactional outbox removes a lost-intent gap. Stable idempotency and reconciliation address ambiguous delivery. None of these mechanisms should be advertised as universal exactly-once delivery.
Interpretation boundary
The external service is a synthetic ledger reached through a separate PostgreSQL transaction. That creates a real transaction boundary but does not reproduce a production payment rail, broker, blockchain, SaaS API, network partition, failover topology or arbitrary distributed system.
Reproduce / inspect
- Transactional Trust Protocol v1.0
- Canonical GitHub Actions run
- Benchmark harness
- Machine-readable result
Evidence artifact digest: sha256:7732375332cfee2507eda5ec72df190cbe94c1ee18bd3f1bc86ec1a5884562e2.
Verdict: one committed business transition became two external effects when acknowledgement loss was followed by a new request identity. Transactional outbox, stable idempotency and external reconciliation preserved one effect in both safe recovery paths.