Delivery guarantees
Destinations are built for durable, at-least-once export after ledger commit — not for synchronous RPC from inside the commit transaction.
What Causet guarantees
| Guarantee | Meaning |
|---|---|
| Commit before deliver | An event is only eligible for delivery after the intent is durably committed. |
| At-least-once | A successful consumer/handler may see the same event more than once (retries, lease reclaim, producer timeouts). |
| Per-destination isolation | Failure to deliver to destination A does not undo the ledger or block destination B. |
| Observable history | Delivery Log records attempts, status, and last error for operations. |
What Causet does not guarantee
| Non-guarantee | Implication |
|---|---|
| Exactly-once to your system | You must dedupe on event id. |
| Global ordering across entities | Only per-entity ordering is a reasonable expectation on Kafka with entity keys. |
| Delivery inside the commit TX | External latency never holds entity locks. |
| Unlimited retention of every attempt | Delivery Log retention follows product limits; treat your own store as source of truth for business state. |
Retries & leases
The data plane persists delivery jobs, leases workers, and retries with backoff on transient failures (network, 5xx, broker unavailable). Permanent failures (4xx that won’t succeed, invalid config) surface in the Delivery Log and may stop retrying after the policy max.
Pause a destination to stop dispatch without deleting config — useful during consumer outages.
Consumer contract (required)
- Treat every delivery as potentially duplicate.
- Dedupe on Kafka
causet-event-id/ webhookX-Causet-Event-Id/ bodyid(export_v1) before side effects. - Make handlers idempotent.
- For webhooks, return 2xx only after the event is durably accepted (or safely ignored as duplicate).