Exactly-once Semantics

Understand the boundary before using a shared queue for work that must happen once. Swytch can coordinate data operations; your application still controls what happens after it receives a result.

Envelope commits group transactional effects so participating nodes can resolve competing operations consistently. The architecture overview explains the commit model, and partition behavior describes its failure boundaries.

A coordinated destructive queue operation and successful execution of a business task are different events. A worker can remove an item, crash, and never perform the task. It can also perform the task and lose its connection before recording completion.

If a reply is lost, the client may not know whether the operation committed. Retrying a pop can consume another item. Retrying a payment can charge twice unless the payment operation is idempotent.

For recoverable work, use stable job identifiers, a pending-work workflow, and idempotent external actions. See queues and streams.

Jepsen testing describes the tested data histories. Those checks do not establish exactly-once execution of arbitrary external services.