Delivery Guarantees

We choose when a consumer acknowledges a message: after it does the work, or as soon as it gets the message.

Acknowledging after the work

The payment service acknowledges the refund message once the refund is made. If the payment service crashes before it acknowledges, the broker gives the message out again, and the refund is handled again. So each message is handled at least once.

Acknowledging before the work

Sometimes we want the consumer to acknowledge a message as soon as it gets it, before the work is done.

Consider a ride-sharing app such as Uber or Lyft. While a driver is on a trip, the driver’s phone sends the car’s location every few seconds. I assume every 4 seconds. A consumer takes each location message and moves the car on the rider’s map.

Losing one location costs little, because the next one arrives within 4 seconds. Handling one late costs more. Suppose a consumer takes a location, crashes, and the broker gives the message out again after the time limit. By then, newer locations have already moved the car forward. The old location moves it back to where it was, and the rider sees the car jump backward.

So this consumer acknowledges each location as soon as it gets it. If it crashes, that location is lost, and the next one replaces it.

Two delivery guarantees

Acknowledging after the work is called at-least-once delivery. Each message is handled once or more. A message is handled more than once if the consumer crashes after the work but before it acknowledges, because the broker then gives the message out again.

Acknowledging before the work is called at-most-once delivery. Each message is handled once or not at all. A message is not handled at all if the consumer crashes after it acknowledges but before it does the work, because the broker has already removed the message.

At-most-once delivery fits a message where losing it costs little, or where handling it again does more harm than losing it.

Choosing for the cancellation

We decide by what it costs to lose a message, and what it costs to handle it twice.

If the refund message is lost, the shopper never gets the money back. If it comes twice, the shopper gets the money back twice. A lost refund is the worse problem, because nothing in Shopend would notice it. So I choose at-least-once delivery for the refund queue, and the payment service has to make sure that a second copy does not refund the order again (we will discuss how to handle this later).

If the message that stops a shipment is lost, a cancelled order ships. A second stop for the same shipment changes nothing. So I choose at-least-once delivery for the shipping queue too.

A lost cancellation email costs little, and so does a second one. Either guarantee works for the email queue. I choose at-least-once delivery, because I would rather the shopper get the email twice than not at all.