Two layers instead of an outbox: when the dual-write gap is cheap enough to live with

The two directions of failure are not symmetric, and the first layer only closes one of them. Publishing from `afterCommit()` rules out the message that describes work which never happened: if the business transaction rolls back, nothing is ever published, so no consumer needs an unpublish path or compensating logic ^[13]. The outbox closes the opposite direction, the event that should exist and does not, by making the intent to publish atomic with the state change and handing delivery to a process that retries until the broker acks ^[7]. Filing both under "reliability" hides that they are different products.

The remaining hole has two halves and only one has an owner. Spring Kafka's producer retries a send when no acknowledgment comes back ^[16], which covers a stalled broker or network. The consumer-side layer absorbs the duplicates those retries create ^[15]. Neither emits a message that was never sent because the process died after the commit ^[18]. The design therefore rests on the assertion that this case is rare and cheap to detect after the fact ^[11], and detection is not recovery.

The author's own counterexample is the most useful thing in the piece. He ran an outbox on the Open Finance Brasil report service because audit correctness on consent events was not negotiable ^[8], and declined it here ^[12]. The property separating the two is whether the record left behind is enough to reconstruct what downstream never heard, and in this system the batch row and the order statuses are both written in the same transaction ^[14]. That is the concrete version of "cheap to detect": the evidence of a missed publish is already persisted.

One line in the cost accounting deserves pressure. The outbox is charged as a second scheduler plus a poller or CDC pipeline plus a relay, each with its own monitoring and failure handling ^[10]. But this system already runs a cold-path scheduler, because the endpoint was reduced to write-and-forget and all the window semantics moved there ^[1]. The genuinely new machinery is a poller job on a tier that already exists, plus the relay's error handling ^[20]. That does not make the trade wrong. It makes it smaller than argued, which cuts against the operational-surface case being the decisive one.

It is worth being clear about where the published text stops: it breaks off mid-sentence just after introducing producer retry, before the consumer deduplication mechanism is specified ^[19]. The idempotency key, and how long the consumer remembers it, is the part doing the real work, and it is the part not on the page. Anyone lifting this pattern is lifting an argument, not an implementation.

"Use an outbox" persists as the default ^[4] because it is safe counsel for a team that has priced neither side. This write-up prices one side honestly. The teams that can skip the outbox are the ones that can state the detection path before the incident, and that is exactly the section still missing.