Durable outbox
A durable outbox persists delivery intent in the database before any external call, so a crash between the call and the write can't silently drop or duplicate work. Caisson's anchor-outbox package writes a pending row before every external-anchoring submission, then guards each state transition, so a lost response resolves to an operator reconciliation state instead of a blind duplicate retry.
In code
async enqueuePending(key: AnchorOutboxKey): Promise<AnchorOutboxRow> {
const k = parseStrict(anchorOutboxKeySchema, key);
return withTenant(this.#db, k.accountId, async (tx) => {
await tx.query(
`INSERT INTO anchor_outbox (id, account_id, target, anchor_length, anchor_digest, state)
VALUES ($1, $2, $3, $4, $5, 'pending')
ON CONFLICT (account_id, target, anchor_length, anchor_digest) DO NOTHING`,
[randomUUID(), k.accountId, k.target, k.anchorLength, k.anchorDigest],
);
const row = await selectRow(tx, k);
if (row === null) {
throw new InternalError("anchor_outbox row vanished after enqueue", {
accountId: k.accountId,
});
}
return toRow(row);
});
}How it holds
Intent persisted before egress
enqueuePending writes a pending row to Postgres before any network call is made, and markSubmitted writes submitted before the submit() call resolves, the crash window always closes on the side of a recorded intent, never a silent gap.
State transitions are DB-guarded, not app-trusted
Every transition is an UPDATE … WHERE state = ANY(from) RETURNING id; an empty result throws ConflictError instead of forcing the write. markSubmitted's only valid from is pending, so "no second submit" is structural, not a convention.
Response loss resolves to reconcile, never a blind retry
When a submitted row's receipt never lands, markNeedsReconcile moves it to a terminal needs_reconcile state for an operator to resolve, closing the ambiguity without risking a duplicate submission to an external, often append-only, target.
Tenant-scoped by default, admin-readable for sweeps
Every method runs under withTenant so a row can never be read or written outside its own account; the cross-tenant reconcile sweep the operator control plane needs rides a separate, explicitly granted admin_write policy on the same table.