WEB / WEB-22.03

From identity to persistence and jobs

Connect recognized context, object policy, business invariants, transactions, caches, and background effects in one note transition.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Commit and job

Owned update intent
Duru’s rename-note/tea intent has reached the application: Tea note is requested instead of Local draft/revision 1. Session lookup, owner policy and the transaction are still pending; this flow is not a new HTTP packet or cookie verification.
Application intent
Rename intent at application
Session/principal
No principal yet
Policy/business/cache
Policy/cache pending
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Session principal binding
Supplied alias lookup with active=true and logical10<20 yields Duru; real authentication cryptography does not run.
Application intent
Rename intent at application
Session/principal
Duru recognized; session predicate true
Policy/business/cache
Policy/cache pending
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Policy and business rule
Owner Duru and the rename action permit the intent; nonempty title and expected rev1 bound the authoritative transition.
Application intent
Rename intent at application
Session/principal
Duru recognized; session predicate true
Policy/business/cache
Authorized; old cache rev1 derived
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Pending transaction
The SQLite writer prepares note rev2 and outbox1; an independent reader sees rev1/outbox0 before COMMIT.
Application intent
Rename intent at application
Session/principal
Duru recognized; session predicate true
Policy/business/cache
Authorized; old cache rev1 derived
SQLite/outbox
Writer pending rev2/outbox1; reader rev1/0
Worker projection
No worker yet
Atomic commit visible
After the selected local COMMIT an independent read sees note rev2 and outbox1 together; there is no broker delivery yet.
Application intent
Rename intent at application
Session/principal
Duru recognized; session predicate true
Policy/business/cache
Authorized; old cache rev1 derived
SQLite/outbox
Committed rev2/outbox1
Worker projection
No worker yet
Derived cache invalidated
After commit the owned cache key is deleted; this local miss is neither database rollback nor distributed acknowledgement.
Application intent
Rename intent at application
Session/principal
Duru recognized; session predicate true
Policy/business/cache
Authorized; cache key miss
SQLite/outbox
Committed rev2/outbox1
Worker projection
No worker yet
Worker effect commit
The owned finite delivery projection commits local effect1 with event-id dedupe; acknowledgement remains separately pending.
Application intent
Rename intent at application
Session/principal
Duru recognized; session predicate true
Policy/business/cache
Authorized; cache key miss
SQLite/outbox
Committed rev2/outbox1
Worker projection
Event processed; effect1; ack pending
Worker acknowledgement
The selected adapter acknowledgement is observed; neither note commit nor client response delivery is derived from it.
Application intent
Rename intent at application
Session/principal
Duru recognized; session predicate true
Policy/business/cache
Authorized; cache key miss
SQLite/outbox
Committed rev2/outbox1
Worker projection
Effect1; ack observed; client not shown

Owner policy deny

Owner policy intent
The ordinary note context carries owner Ekin; only the selected policy outcome for actor Duru is examined.
Application intent
Rename intent at application
Session/principal
No principal yet
Policy/business/cache
Policy/cache pending
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Principal recognized
The valid supplied session yields Duru; session validity adds no right to the owner relationship.
Application intent
Rename intent at application
Session/principal
Duru recognized; session valid
Policy/business/cache
Policy/cache pending
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Owner relationship denies
The selected owner policy denies Duru!=Ekin; this is neither authentication failure nor an endpoint-bypass fixture.
Application intent
Rename intent at application
Session/principal
Duru recognized; session valid
Policy/business/cache
Owner policy denied; no mutation
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Persistence untouched
No mutation starts; an independent note read remains Local draft/rev1 with outbox0.
Application intent
Rename intent at application
Session/principal
Duru recognized; session valid
Policy/business/cache
Owner policy denied; no mutation
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet

Session expired

Expiry check intent
The supplied logical now20 and expiry20 boundary is selected; no real duration or session token is used.
Application intent
Rename intent at application
Session/principal
No principal yet
Policy/business/cache
Policy/cache pending
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Session no longer valid
The selected now<expiry predicate is false; no principal or verified policy caller is derived.
Application intent
Rename intent at application
Session/principal
Expired; no principal
Policy/business/cache
Policy/cache pending
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Policy evaluation stopped
A missing principal stops the mutation gate; no new claim about an unrelated owner relationship is produced.
Application intent
Rename intent at application
Session/principal
Expired; no principal
Policy/business/cache
No principal; no mutation
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet
Committed state unchanged
The owned note remains rev1/outbox0; session expiry is not portrayed as a database rollback operation.
Application intent
Rename intent at application
Session/principal
Expired; no principal
Policy/business/cache
No principal; no mutation
SQLite/outbox
Committed rev1; outbox0
Worker projection
No worker yet

Effect and ack

Committed event intent
Parent note and outbox are assumed committed; the finite worker branch examines only derived effect and acknowledgement.
Application intent
Rename intent at application
Session/principal
Duru verified predicate supplied
Policy/business/cache
Cache invalidated
SQLite/outbox
Committed rev2/outbox1
Worker projection
No worker yet
First delivery processed
The event-id marker and projection update create effect1 in one owned SQLite transaction.
Application intent
Rename intent at application
Session/principal
Duru verified predicate supplied
Policy/business/cache
Cache invalidated
SQLite/outbox
Committed rev2/outbox1
Worker projection
Delivery1; effect1 committed
Acknowledgement unobserved
Acknowledgement observed=false is supplied; the effect is already committed and parent note rev2 is not reverted.
Application intent
Rename intent at application
Session/principal
Duru verified predicate supplied
Policy/business/cache
Cache invalidated
SQLite/outbox
Committed rev2/outbox1
Worker projection
Effect1 committed; ack not observed
Same event redelivered
The owned finite second delivery carries the same event-id; no real broker redelivery or attack replay runs.
Application intent
Rename intent at application
Session/principal
Duru verified predicate supplied
Policy/business/cache
Cache invalidated
SQLite/outbox
Committed rev2/outbox1
Worker projection
Delivery2 same event-id; effect1
Dedupe scope preserved
The persistent marker prevents a second projection effect; the selected count remains1 without universal exactly-once.
Application intent
Rename intent at application
Session/principal
Duru verified predicate supplied
Policy/business/cache
Cache invalidated
SQLite/outbox
Committed rev2/outbox1
Worker projection
Delivery2 deduped; effect1
Second acknowledgement
The selected second acknowledgement is observed; unchanged parent-note revision and client delivery remain separate facts.
Application intent
Rename intent at application
Session/principal
Duru verified predicate supplied
Policy/business/cache
Cache invalidated
SQLite/outbox
Committed rev2/outbox1
Worker projection
Attempts2; effect1; ack observed

ACTORS · STATE · DATA FLOW

Knowing a principal differs from permitting an operation

We reached the application boundary behind the public read. Duru now renames an owned synthetic reading note from Local draft to Tea note. The request context is assumed to have already arrived. sid-demo is an inert session alias: a store lookup, declared active flag, and supplied logical expiry yield principal Duru. The native example runs no login, cookie parsing, or cryptographic session verification; its question is how a recognized context remains bounded by later decisions.

Authentication/session carries the principal again; authorization evaluates that principal against the selected object/action relationship. owner=Duru and action=rename-note belong to the selected business policy. Authentication grants no write permission over every note. For an ordinary Ekin-owned note context, Duru remains recognized but the owner policy denies the action. An expired session creates no principal. These are different outcomes, and neither starts a persistence mutation.

Business logic turns an allowed intent into a valid state transition. The title must be a nonempty string, the expected revision must match the authoritative revision, and the selected update must affect its exact target row. Those checks cannot be left to a visible form, client cache, or edge allow. Request validation and database constraints/transactions are separate layers: routing chooses the operation, the service protects its invariant, and the store owns the commit boundary.

Connect commit, cache invalidation, and job acknowledgement

A cached Local draft at revision1 does not prove the database still has that state. A cache is derived state with an explicit version and invalidation owner. The normal fixture runs a parameterized UPDATE and outbox INSERT in one SQLite transaction. An independent reader sees Local draft/rev1 and outbox0 before COMMIT, then Tea note/rev2 and event1 afterward. This orderly local observation proves a selected atomic boundary without testing every crash, storage, or replication condition.

A transactional outbox stores event intent in the same database transaction to address the gap between a committed note and a separately failed job notification. An outbox row is neither broker delivery nor consumer completion. A publisher may later send the committed intent, and relay retries may duplicate deliveries. The finite queue projection here only lists two ordinary in-process deliveries; it runs no RabbitMQ, Kafka, or cloud queue.

The background worker processes a projection effect idempotently within an event-id scope. A processed marker and projection update share a selected local transaction; acknowledgement remains separate transport/adapter state. If the effect commits but acknowledgement is unobserved, redelivery meets the duplicate marker and creates no second effect. This is not universal exactly-once for external side effects. The cache entry is invalidated after commit; worker acknowledgement neither reverses the note commit nor synchronizes every cache.

Read every scenario without motion

Session and owner

Duru intent
The intent is rename-note for tea at expectedRevision 1. sid-demo is not a credential; active and logicalNow 10 below expiry 20 are supplied validity predicates.
Intent/state ledger
Duru / logical session active /rev1 intent
Authority and atomic boundary
Not yet evaluated
Persistence/job outcome
Not yet evaluated
Owner denial
The denied branch has principal Duru, owner Ekin and authenticated true. Authorization is false, so recognized session identity grants no write on this object.
Intent/state ledger
Duru / logical session active /rev1 intent
Authority and atomic boundary
Authenticated Duru / owner Ekin / denied
Persistence/job outcome
Not yet evaluated
No denied mutation
Denied has zero commits, Local draft and no outbox rows. Object denial differs from session expiry; an unchanged title does not merge the two gates.
Intent/state ledger
Duru / logical session active /rev1 intent
Authority and atomic boundary
Authenticated Duru / owner Ekin / denied
Persistence/job outcome
Owner deny / note and outbox unchanged
Expiry boundary
At logicalNow 20 equal to expiry 20, principal is null and authentication false. Browser alias presence is not validity; mutation does not start at equality.
Intent/state ledger
now20 = expiry20 / principal null
Authority and atomic boundary
Authenticated Duru / owner Ekin / denied
Persistence/job outcome
Owner deny / note and outbox unchanged
SQL-data boundary
The UPDATE is parameterized, binding Tea note, tea and revision 1 as data. Binding replaces neither identity nor owner policy; authorization precedes mutation.
Intent/state ledger
now20 = expiry20 / principal null
Authority and atomic boundary
Bound data / independent owner policy
Persistence/job outcome
Owner deny / note and outbox unchanged
Authn and authz outcomes
Expired and denied both yield zero commits/outbox, but for different reasons. This bounded owner policy proves neither all authorization models nor actual cookie cryptography.
Intent/state ledger
now20 = expiry20 / principal null
Authority and atomic boundary
Bound data / independent owner policy
Persistence/job outcome
Expiry ≠ owner denial / both no mutation

Commit and ack

Pending-writer view
The pending writer sees Tea note rev2 and one outbox row; the independent reader sees Local draft rev1 and no outbox. Local writer visibility is not committed shared state.
Intent/state ledger
Writerrev2 / independent readerrev1
Authority and atomic boundary
Not yet evaluated
Persistence/job outcome
Not yet evaluated
Atomic rollback outcome
Rollback retains Local draft, revision1 and outbox0 with eventPublished false. Note and event intent stop together; notification is not counted as precommit success.
Intent/state ledger
Writerrev2 / independent readerrev1
Authority and atomic boundary
Rollback note+outbox / no event publication
Persistence/job outcome
Not yet evaluated
Commit and cache distinction
Normal afterCommit is rev2/outbox1 with cacheAfter null. Orderly invalidation follows commit; neither crash durability nor global distributed-cache freshness is verified.
Intent/state ledger
Writerrev2 / independent readerrev1
Authority and atomic boundary
Rollback note+outbox / no event publication
Persistence/job outcome
Commitrev2 / derived cache invalidated
After lost acknowledgment
The first effect count is 1 with acknowledgment false. businessRolledBack is false; lost ack neither erases the effect nor requires a second note write.
Intent/state ledger
Effect1 / ack false / business not rolled back
Authority and atomic boundary
Rollback note+outbox / no event publication
Persistence/job outcome
Commitrev2 / derived cache invalidated
Effect-specific deduplication
The second attempt retains one effect for note-tea-rev2 and observes ack true. Deduplication scopes this consumer effect, not every external API or mail exactly once.
Intent/state ledger
Effect1 / ack false / business not rolled back
Authority and atomic boundary
Attempts2 / effect1 / ack true
Persistence/job outcome
Commitrev2 / derived cache invalidated
Separate success fields
Note commit, outbox intent, projection effect and acknowledgment are separate facts. clientResponseDelivered is false; worker success is not evidence of browser receipt.
Intent/state ledger
Effect1 / ack false / business not rolled back
Authority and atomic boundary
Attempts2 / effect1 / ack true
Persistence/job outcome
Commit/effect/ack known / client delivery separate

ASSUMPTION · BOUNDARY · CONTROL

Do not derive unlimited write rights from a session

The normal behavior is a recognized principal transitioning an owned note. Its trust relationship joins principal, object owner, and operation policy. Omitting the owner check merely because session lookup succeeded risks an unauthorized mutation of another synthetic object. The model uses an ordinary denied context, with no real object selection, endpoint probing, or permission-bypass instructions. Its scope is the selected owner policy, not every authorization model.

The control evaluates an authoritative object/action relationship for every intent and starts no mutation for a missing principal or unknown policy. Supplied server-side logical time checks expiry; a browser retaining a cookie does not establish validity. Native checks prove alias lookup and selected expiry decisions without proving secure identifier generation, rotation, passwords, or cryptography. Diagnostic evidence uses reasons and operation scope rather than treating a raw session alias as safe credential data.

Delivery and derived caches are not business commit

A prepared write, COMMIT, outbox publication, and worker acknowledgement are different facts. A selected rollback must leave both title and outbox at their prior state; pretending a notification was still published creates incorrect downstream knowledge. The normal branch invalidates cache after commit. A process stopping between these steps may leave stale cache, requiring a separate recovery/version policy. The finite orderly fixture measures no crash and claims no permanent freshness.

When acknowledgement is lost, the business effect may already be committed. Redelivery does not require automatic rollback or a second update; the selected idempotent projection marker preserves effect scope for that event. Duplicate projection/notification is the possible effect; persistent deduplication with an atomic effect boundary blocks it in the selected store. External APIs or email lie outside that transaction and need different handling. A dedupe table alone does not guarantee exactly-once at every sink.

Read every scenario without motion

Version controls

Intent correlation
Operation rename-note, object tea, expected rev1 and owner Duru are associated. Session validity, ownership and data validation remain separate without raw credentials.
Version/event ledger
Operation/object/principal/revision bound
Independent-read review
Not yet evaluated
Decision evidence
Not yet evaluated
Independent-reader evidence
The independent reader sees rev1/outbox0 while pending and rev2/outbox1 after commit. Rechecking the writer does not substitute for independent committed visibility.
Version/event ledger
Operation/object/principal/revision bound
Independent-read review
Pending vs committed reader views distinct
Decision evidence
Not yet evaluated
Negative controls
Owner denial, expiry and rollback yield zero commit/outbox for different reasons. Rollback can be authorized; authority success is not persistence success.
Version/event ledger
Operation/object/principal/revision bound
Independent-read review
Pending vs committed reader views distinct
Decision evidence
Deny/expiry/rollback independently unchanged
Derived-cache evidence
cacheBefore is Local draft rev1 and cacheAfter null. Invalidating the selected key proves neither database rollback, broker delivery nor every cache instance acknowledging.
Version/event ledger
Selected key removed / broader caches unknown
Independent-read review
Pending vs committed reader views distinct
Decision evidence
Deny/expiry/rollback independently unchanged
Event versus delivery
note-tea-rev2 at revision2 binds to the note commit, but rowIsBrokerDelivery is false. Outbox is committed intent, attempts are relay facts, and processed markers are effect facts.
Version/event ledger
Selected key removed / broader caches unknown
Independent-read review
Intent / attempts / processed marker distinct
Decision evidence
Deny/expiry/rollback independently unchanged
Retry regression
Two attempts and one effect can be an ordinary retry. False/true acknowledgment is checked separately; finite-store results do not inherit broker or browser-return proof.
Version/event ledger
Selected key removed / broader caches unknown
Independent-read review
Intent / attempts / processed marker distinct
Decision evidence
Retry known / effect-specific bound / no broker claim

Commit gap

Writer-only view
The review sees only Tea note rev2 in the writer, without an independent reader or transaction result. A pending writer can show the same title and revision.
Version/event ledger
Writerrev2 known / commit receipt missing
Independent-read review
Not yet evaluated
Decision evidence
Not yet evaluated
Job marker is not sufficient
An outbox or acknowledgment without transaction/effect binding is not note-commit evidence. The expected normal event cannot replace missing receipts.
Version/event ledger
Writerrev2 known / commit receipt missing
Independent-read review
Job marker ≠ bound authoritative commit
Decision evidence
Not yet evaluated
Leave commit unknown
Commit, cache invalidation and projection effect remain UNKNOWN. Writer title is retained without adding client success or business-rollback cause.
Version/event ledger
Writerrev2 known / commit receipt missing
Independent-read review
Job marker ≠ bound authoritative commit
Decision evidence
Commit/cache/effect UNKNOWN
Required version binding
Transaction outcome, independent committed read, eventId/revision and consumer marker are needed. Comparison fields suffice without raw sessions or private note bodies.
Version/event ledger
Needed: transaction/reader/event/effect binding
Independent-read review
Job marker ≠ bound authoritative commit
Decision evidence
Commit/cache/effect UNKNOWN
Durability boundary
Reopening can show committed data without proving hardware crash durability. Ack belongs to queue context; external effect and browser delivery need separate observers.
Version/event ledger
Needed: transaction/reader/event/effect binding
Independent-read review
Committed read ≠ crash/client/broker proof
Decision evidence
Commit/cache/effect UNKNOWN
Bounded assessment outcome
New evidence must identify authoritative version and effect separately. This event reports only writer visibility without adding commit or exactly-once success.
Version/event ledger
Needed: transaction/reader/event/effect binding
Independent-read review
Committed read ≠ crash/client/broker proof
Decision evidence
Retain writer view / collect independent receipts

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Evidence from principal to authoritative version

An intent ledger joins operation, synthetic object id, principal decision, owner-policy result, and expected/actual revision. Expired authentication, denied authorization, failed business validation, and store rollback need separate reasons. Use safe synthetic fields rather than wholesale session tokens or user bodies. The ordinary baseline is owner Duru, existing rev1, and a Tea note title; no real credential or student data is present.

Separate the writer’s pending value from an independent reader’s committed view. A parameterized query binds the title as data rather than interpreter code; the artifact shows a selected SQL shape and its input fields. SQLite reopen observes the committed note without claiming hardware-crash durability. A miss for the invalidated cache key shows deletion of selected derived state; it is neither database rollback nor acknowledgement from every distributed cache.

Keep outbox and consumer outcomes distinct

Committed outbox intent, relay delivery attempts, a processed effect marker, and selected queue acknowledgement have different meanings. Two deliveries with one projection effect can be an ordinary retry rather than an automatic security incident. Relate parent-note and event versions, and identify the operation/consumer owning dedupe scope. Job delay does not invalidate a note commit; downstream freshness needs separate observation.

An XPath over own XML selects authorized=false together with committed=true. A denied intent matches zero, an inconsistent inert record one, and missing policy evidence proves no correct enforcement. The native fixture independently reads ordinary commit, selected rollback, denial/expiry, and repeated worker projection results. Durable control combines authorization before mutation, an atomic note/outbox transaction, versioned invalidation, and effect-specific retries. Broker runtime, cookie security, and browser delivery are not silently assumed.

NOW APPLY IT TO THE CASE

Are session, commit and acknowledgment the same success?

Duru changes a rev1 Local draft note to Tea note. While the writer holds rev2 and an outbox row pending, an independent reader still sees rev1; commit changes the reader view. Lost acknowledgment can lead to two attempts while effect-specific deduplication retains one projection effect.

Read accepted, delivery and committed-effect records at their respective owners. Do not rename unknown caller outcome as business rollback.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Note commit and job effect ledger

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "intent": {
    "operation": "rename-note",
    "objectId": "tea",
    "sessionAlias": "sid-demo",
    "newTitle": "Tea note",
    "expectedRevision": 1,
    "requestAlreadyAtApplication": true
  },
  "session": {
    "principal": "Duru",
    "active": true,
    "logicalNow": 10,
    "logicalExpiry": 20,
    "secureToken": false,
    "predicateNotAuthenticationRuntime": true
  },
  "policy": {
    "owner": "Duru",
    "action": "rename-note",
    "authorized": true,
    "titleRule": "nonempty string",
    "notUniversalAuthorizationModel": true
  },
  "normal": {
    "before": {
      "title": "Local draft",
      "revision": 1
    },
    "writerPending": {
      "title": "Tea note",
      "revision": 2,
      "outboxRows": 1
    },
    "independentReaderBeforeCommit": {
      "title": "Local draft",
      "revision": 1,
      "outboxRows": 0
    },
    "afterCommit": {
      "title": "Tea note",
      "revision": 2,
      "outboxRows": 1
    },
    "cacheBefore": {
      "title": "Local draft",
      "revision": 1
    },
    "cacheAfter": null,
    "processedEffects": 1,
    "ackObserved": true,
    "clientResponseDelivered": false
  },
  "query": {
    "shape": "UPDATE notes SET title=?, revision=revision+1 WHERE id=? AND revision=?",
    "parameters": [
      "Tea note",
      "tea",
      1
    ],
    "dataNotCode": true
  },
  "event": {
    "eventId": "note-tea-rev2",
    "kind": "note-renamed",
    "noteId": "tea",
    "revision": 2,
    "rowIsBrokerDelivery": false
  },
  "denied": {
    "principal": "Duru",
    "owner": "Ekin",
    "authenticated": true,
    "authorized": false,
    "commits": 0,
    "titleAfter": "Local draft",
    "outboxRows": 0,
    "reason": "owner-policy-denied"
  },
  "expired": {
    "logicalNow": 20,
    "logicalExpiry": 20,
    "principal": null,
    "authenticated": false,
    "authorized": false,
    "commits": 0,
    "outboxRows": 0,
    "reason": "session-expired"
  },
  "rollback": {
    "authorized": true,
    "commits": 0,
    "titleAfter": "Local draft",
    "revisionAfter": 1,
    "outboxRows": 0,
    "eventPublished": false
  },
  "redelivery": {
    "deliveryAttempts": 2,
    "afterFirstEffect": {
      "processedEffects": 1,
      "ackObserved": false
    },
    "afterSecondEffect": {
      "processedEffects": 1,
      "ackObserved": true
    },
    "noteRevision": 2,
    "businessRolledBack": false,
    "exactlyOnceUniversal": false
  },
  "limits": {
    "actualLoginCookieCrypto": false,
    "realDbService": false,
    "distributedCache": false,
    "realBroker": false,
    "externalSideEffect": false,
    "crashDurability": false,
    "httpBrowserDelivery": false,
    "realCredentials": false
  },
  "selector": {
    "language": "XPath",
    "xml": "<audit><intent authorized=\"false\" committed=\"false\"/></audit>",
    "xpath": "count(/audit/intent[@authorized='false' and @committed='true'])",
    "expected": 0,
    "positiveFixtureXml": "<audit><intent authorized=\"false\" committed=\"true\"/></audit>",
    "positiveExpected": 1,
    "scope": "Own inert decision observations, not real vendor logs.",
    "missingFieldBehavior": "Missing observation is insufficient evidence, not a proven healthy or authorized result."
  }
}

session / policy: Inert alias validity and selected object/action relationship are separate.
query: Prepared shape and ordinary bound title/id/revision data.
normal: Pending writer, independent committed view, and derived cache.
event / redelivery: Outbox intent, effect-specific dedupe, and separate acknowledgement.

Fixed synthetic example; protocol edges are conceptual, and local execution evidence has a separate scope.

Two reality checks

A valid session lets me write this note.

Object/action policy is evaluated for each intent; a recognized principal is not automatically the owner.

A queue acknowledgement or outbox row proves the entire job completed.

Store commit, notification delivery, worker effect, and acknowledgement are separate boundaries; retries may duplicate delivery.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

The session is active with principal=Duru, but the note owner is Ekin. Is the rename transaction committed?

No. authorized=false, commits=0 and outboxRows=0.
Yes. An active session may change every owner’s records.

Read the explained answer

No. authorized=false, commits=0 and outboxRows=0. — The owner-policy-denied result preserves the old title and creates no event row. Authentication is not write permission.

The writer sees the new title and outbox row. Why does the independent reader still see Local draft before commit?

Selected lesson artifact fields; teaching example

normal.writerPending: {"title":"Tea note","revision":2,"outboxRows":1}
normal.independentReaderBeforeCommit: {"title":"Local draft","revision":1,"outboxRows":0}
normal.afterCommit: {"title":"Tea note","revision":2,"outboxRows":1}
normal.clientResponseDelivered: false

The writer’s state immediately reaches every reader and browser.
The pending write is not committed; the reader sees old revision=1.

Read the explained answer

The pending write is not committed; the reader sees old revision=1. — After commit, the title and outbox row become visible together. With clientResponseDelivered=false, that commit does not prove browser receipt.

After the first business effect no ACK was observed; after a second delivery the effect remains one and an ACK exists. Explain the relation between an outbox row, business commit and broker ACK.

Read the explained answer

The note update and outbox row commit together in the local transaction; the row alone is not broker delivery. A missing ACK does not undo the business effect. On the second delivery, dedupe recognizes the processed event and withholds a new effect. This bounded idempotency result is not universal exactly-once or an external-side-effect guarantee. Session and owner conditions are supplied policy inputs, not executed login/crypto.

□ I did not treat an outbox row as broker delivery.

□ I did not treat a missing ACK as business rollback, and stated the dedupe scope.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

OWASP — Session ManagementSession ID Properties · Session Expiration · Manual Session Expiration
OWASP — AuthorizationIntroduction · Deny by Default · Validate the Permissions on Every Request
SQLite — Transaction control2. Transactions · 2.1. Read transactions versus write transactions · 2.3. Implicit versus explicit transactions
SQLite — Atomic Commit3.12. Releasing The Lock · 4. Rollback
Redis — selected invalidation example, client-side cachingThe Redis implementation of client-side caching · What tracking tracks
AWS Prescriptive Guidance — Transactional outboxIntent · Issues and considerations · Implementation
RabbitMQ 4.3 — Consumer Acknowledgements and Publisher ConfirmsThe Basics · Are Publisher Confirms Related to Consumer Delivery Acknowledgements? · When Consumers Fail or Lose Connection: Automatic Requeueing
Python 3.14 — sqlite3 parameter bindingHow to use placeholders to bind values in SQL queries

YOUR NOTES / THIS BROWSER

From identity to persistence and jobs

1. Core · Mechanism

Commit and job

Owner policy deny

Session expired

Effect and ack

Knowing a principal differs from permitting an operation

Connect commit, cache invalidation, and job acknowledgement

2. Red · Trust & Impact

Session and owner

Commit and ack

Do not derive unlimited write rights from a session

Delivery and derived caches are not business commit

3. Blue · Secure development & defense

Version controls

Commit gap

Evidence from principal to authoritative version

Keep outbox and consumer outcomes distinct

Are session, commit and acknowledgment the same success?

Two reality checks

The session is active with principal=Duru, but the note owner is Ekin. Is the rename transaction committed?

The writer sees the new title and outbox row. Why does the independent reader still see Local draft before commit?

After the first business effect no ACK was observed; after a second delivery the effect remains one and an ACK exists. Explain the relation between an outbox row, business commit and broker ACK.

Sources and scope