A distributed system is least trustworthy in the moment between deciding to send a message and actually sending it. If the process dies there, the sender is no longer in a position to say whether the message arrived — and what it does with that gap is more revealing than how it recovers. Here the gap is opened deliberately: one actor sells something, records that it is telling another, and is killed before the message leaves.
After a crash, who is entitled to say whether a message arrived — and what should a system record while nothing can honestly be said yet?
The same purchase-and-reward runs three ways over the same two actors. Every style rewards the customer, so the outcome is not what differs. What differs is who ends up holding the fact that the purchase and the reward belong together.
| Owns the relationship | |
|---|---|
| Orchestrated saga | A coordinator |
| Event choreography | A bus log, outside every program |
| Told directly | The sender itself |
Read off the printed records of a run rather than from a diagram. In the first two styles the sender's own record holds its purchase and nothing about the reward. In the third it holds the purchase, the assertion that produced the reward, and the acknowledgement that closed the exchange — one history, in the order it happened.
The interesting failure is not a lost message. It is a message whose fate is unknown.
- The sender commits the purchase, and records that it is telling the reward engine.
- Before the transport ever sees the message, the process dies.the window in which nothing can be inferred from outside
- A new actor is reconstructed entirely from the persisted record.
- It finds one message whose fate is still unknown.
- Only then does it ask the transport what actually happened.
From there, the uncertainty can be resolved in three ways, and two of them are guesses: assume it worked, retry blindly, or reconstruct the story afterwards from records kept somewhere else. Here the record keeps the uncertainty instead — until a party genuinely able to resolve it can speak. Uncertainty becomes part of the history rather than something hidden by recovery.
The same crash and the same record, with three different answers from the transport. What gets written differs in each — including the case where nothing does.
| Fate | Transport's answer | What the record gets |
|---|---|---|
| It failed | Not delivered | tell 'ord-100' unacknowledged by RewardEngine; |
| It arrived | Delivered | An acknowledgement |
| Nobody knows yet | Still in flight | Nothing at all — the message stays pending |
The first outcome carries the strongest claim, and three things had to hold before that line could be written. The sender speaks only about the actor that failed to answer, never about the infrastructure it has no standing to speak for. It never invents an acknowledgement that did not happen. And recovery reconstructs the pending message without sending it again.
Three further properties measured on that same record, each of them about something that turns out not to be needed.
- A fresh actor reconstructs the in-flight message from the record alone — no transport, no receiver, no state handed to it from anywhere.
- Copying the record's bytes to another site carries the cross-actor chain with them, because the relation was written in the one place replication already moves.
- Asking why something happened is reading one record: the cause, the message it produced and the acknowledgement that closed it are all in the sender's history. No distributed tracing, no correlation identifiers, no log aggregation.
Three limits, and the last line is the one to keep.
- It holds per edge, not end to end. No single record holds a whole A→B→C chain; reconstructing one means composing the records of A and of B, linked by the message's identifier across them. The sender's-record property covers the hops that sender originates — which is the whole chain only when the chain is one hop.
- The verdict is only as good as what the transport can testify. A transport that cannot say leaves the message pending, which is the honest answer rather than a good one.
- Nothing here is a throughput or a latency result. The laboratory is deterministic and its evidence is records, which is what the paper says of itself.
The guarantee, in the paper's own words, is “honesty about the outcome, not omniscience.”