The Effect Committed. The Response Disappeared.

Reports #012–#014 moved Transactional Trust Protocol from synthetic state into PostgreSQL and then across a database/external-effect boundary. Report #015 gives that external side its own HTTP process and network connection.

The ambiguity is now on the wire.

The benchmark external service records an effect and then deliberately closes the connection before returning an HTTP response. The client observes RemoteDisconnected and classifies the result as ACK_UNKNOWN.

An immediate authoritative status request nevertheless observed COMMITTED / effect_count=1. Transport failure therefore did not establish remote absence.

Unsafe · a new retry identity creates a second effect.

The business row and outbox intent committed once at COMMITTED / v101. The first remote call used http-unsafe:attempt:1, applied the effect and lost its response. Recovery generated http-unsafe:attempt:2; the remote service treated it as a new logical request and applied another effect.

Safe · a real second POST is deduplicated.

The safe redelivery path reused one durable identity: http-safe-redelivery-op:effect:v1. POST #1 committed remotely and lost its response. POST #2 really crossed HTTP again with the same key and returned 200 / deduplicated.

Safer · reconcile before a second POST.

The third path received the same RemoteDisconnected, then queried GET /status/http-safe-reconcile-op. The remote service reported COMMITTED / effect_count=1 / post_requests=1, so the worker made no second consequential POST and closed the outbox as delivered.

Real service boundary.

The external service ran in a separate Docker container. Its health evidence reported service resonance-external-http, container hostname 3f9f87866627 and PID 1. The worker reached it over http://127.0.0.1:18080.

HTTP image: python:3.12-slim at python@sha256:229a2c5bfa27522db7815ea81f9bed70af17ccb9de9fc7ad142b1877b5830d36.

TTP network law

If authoritative remote status says COMMITTED, complete without re-execution. If it says ABSENT, a fresh delivery may be allowed under current preconditions. If status remains UNKNOWN, preserve uncertainty rather than converting a transport error into retry permission.

New invariants

Network evidence — request identity, transport outcome, authoritative remote status and final effect count — belongs in the same proof trajectory as database and outbox evidence.

Interpretation boundary

The HTTP boundary and TCP failure are real, but the remote service is still a local benchmark container. This does not certify production payment APIs, arbitrary exactly-once delivery, internet-scale partitions, proxy/load-balancer behavior, remote durability after service restart, authentication, authorization or arbitrary agent safety.

Verdict: a real HTTP acknowledgement disappeared after the remote effect existed. New retry identity duplicated it; stable identity or authoritative remote reconciliation preserved one effect.