At-most-once delivery means the network delivers a sent message zero or one time. It permits message loss but rules out network-level duplicate delivery. section 4.1
Delivery and processing are separate guarantees. A receiver may process a delivered message zero or one time, but at-most-once delivery alone does not guarantee that processing occurs. section 4.1
A useful request-response model makes the trade-off explicit:
- The sender sends a request; the network may delay, reorder, drop, or duplicate messages; the receiver may process a request and cause a side effect before responding. section 4.1
- If the sender gives up after receiving no response, it intends at-most-once delivery and processing: the request happens zero or one time. section 4.3
- If the sender retries, it intends at-least-once delivery and processing, but repeated loss can still prevent completion. section 4.3
Why TCP does not remove the risk
TCP acknowledges data before attempting to deliver it to the application. If a failure occurs after acknowledgment but before application delivery or processing, the message is lost, so a lower-layer reliable protocol can still expose at-most-once delivery at a higher layer. section 4.2.3
The exactly-once boundary
Tracking a request before processing can lose the side effect if the handler crashes afterward; processing before tracking can repeat the side effect if the handler crashes before recording it. These failures show why exactly-once processing cannot be guaranteed by either ordering alone. section 4.3
