One job.
How many receipts?
Operate a worker. Stop it at a bad moment. Find out what the database can—and cannot—undo.
Not completed
External mailbox
0 delivered0 requests to the provider
One committed order and one queued job.
Try this: send the receipt, then stop the worker before saving completion.
Why does this happen? ↗Your completed runs
Counts from your actions in this model. No performance measurements.
What happened in my run?
What this model assumes
The example handler sends one receipt, then records completion. The order and job are already committed. Claims survive; only the worker process stops. No database crash, rollback or standby failover is simulated.
“Recover for retry” compresses Awa’s rescue, backoff and due-job promotion into one action. It assumes healthy maintenance, sufficient retry budget and eventual worker availability. It does not predict recovery latency. Heartbeat staleness normally defaults to 90 seconds with a 30-second rescue scan; real recovery can take longer.
The provider-key option assumes an external provider atomically deduplicates a stable operation key across attempts. Awa does not provide that external guarantee. Job enqueue uniqueness is a different boundary.
Workers here really stop. The model omits live stale workers, attempt-fencing races, asynchronous claim loss, SQL errors, terminal failure, batching and other production interleavings. Database and job cards show logical state, not physical row movement.
How this maps to Awa
Grounded in hardbyte/awa @ b9341ae5, a development snapshot of the 0.7 queue-storage implementation. It is not a guarantee about every released version or the benchmark adapter pin.
No caller-owned handler completion API is assumed. The proposed
ADR-042 complete_in_tx API was not implemented in
this snapshot.
Why an interactive model?
Changing where a worker stops makes the external-effect boundary tangible. Try both provider assumptions and compare only runs you have actually completed.
Inspired by Marc Brooker’s systems animations. This original model uses no article assets or simulator code. It is not a captured Awa trace, a benchmark, or a proof of metastability.