Effect commit and compensation: recover without pretending the world rewinds

If an effect and its journal record live in one transactional database, an application can design them to commit together under that database's isolation and durability semantics. A remote API call cannot be included merely by placing it between begin and commit in local code. A transactional outbox can commit local intent and an event record together, then relay the event later. Debezium's outbox router is a concrete implementation component for such records; its configuration is not a global transaction across every consuming service.

An outbox relay can redeliver after uncertainty, so downstream consumers still need appropriate deduplication and effect handling. A provider may instead expose a prepare/commit or conditional-write protocol, but that must be an actual supported contract. Otherwise persist the effect identity and reconcile receipts around the external gap. Distinguish intended, dispatched, provider-committed, and locally-recorded states. A local commit failure after a remote success is an unresolved coordination problem, not proof that both systems rolled back.

A saga breaks a longer operation into steps with compensating actions for the chosen failure policy. Register recovery intent before or alongside the corresponding effect boundary so a crash does not lose the knowledge that remediation may be needed. A compensation should inspect the original receipt and current state, and be safe under retry according to its own idempotency identity. Reverse order is useful for some dependency chains, but compensation ordering follows the actual dependencies and business rules rather than a universal stack rule.

Conditional compensation protects intervening work. If a resource has changed since this run's effect, blindly restoring an old snapshot can overwrite another actor's update. Use expected version, ownership, or another supported precondition, then report a blocked remediation when it fails. A resource may be nonrefundable, externally observed, or irreversibly delivered. In those cases compensation is a new corrective action or explicit unresolved obligation, not a mathematical inverse. Test its authorization and budget independently from the forward action.

Track confirmed forward effects, attempted compensations, successful remediations, blocked preconditions, and unresolved outcomes. Include crashes before and after each remote commit and after each compensation receipt. If compensation itself times out, preserve its identity and reconcile it rather than compensating the compensation blindly. Distinguish a workflow that has stopped from one whose external obligations are settled. Report the remaining resources and required follow-up concretely so a terminal label does not hide a live reservation or pending write.

The function lab illustrates information loss in a simple mapping. Reset, set a=1 and x=1, predict y=1, then Play or Step. Separately Reset, set a=1 and x=−1, predict the same y=1, then Play or Step. The square alone cannot identify which original sign produced it. This is not a saga or external-effect simulator, but it shows why a reverse action needs retained context and a declared goal. The real compensation still needs receipts, ownership, and current-state checks rather than an assumed inverse.