The failure has a name, and it has had one since the 1970s. In transaction processing it is called the in-doubt transaction. A party that has done its part of an exchange and cannot learn the outcome is in doubt. The name is worth keeping, because it points at the right thing. Not the lost message. The uncertainty about a committed outcome.
It is not split-brain, and the difference decides the cure
Most engineers file this under split-brain, and reach for the wrong tools as a result.
Split-brain is symmetric divergence. A cluster partitions, two nodes each believe they are primary, both keep acting, and both can be wrong at the same time. The cures are about authority: quorum, fencing, leases, a witness. The question is who is allowed to act.
The in-doubt transaction is asymmetric. Only one party is uncertain. The other knows exactly what happened. The bank knew the money moved. The pump did not. So the cure is not authority, it is reconciliation: make the knowing party the durable source of truth, make the operation safe to repeat, and give the doubting party a bounded way to ask.
Your synchronous call does not save you
The most common escape hatch is this: that is an async problem, my call is synchronous. Two different things are wearing that one word.
Synchronous as a programming model is a blocking call that waits for its reply. It feels like a single instantaneous step. But it rides whatever medium it was given, and that medium can lose, delay, and reorder. The instant it drops while you are blocked, the call returns an error and you still do not know whether the other side committed. That hotel payment was synchronous. It went in doubt anyway. A blocking call over an unreliable medium is asynchrony wearing a blocking costume.
Synchronous as a medium means bounded time, no loss, guaranteed order. That is the only sense that actually removes the problem, which is why it genuinely vanishes inside a processor's clocked datapath and returns the instant a signal crosses into another clock domain.
So the scope is not "async systems." It is every boundary where the medium can lose, delay, or reorder. Which is every boundary you have.
The variable that decides everything: where the doubt falls
Two fuel stations, the same failure, opposite outcomes.
Pre-authorization · survivable
The card is authorized before fuel is released. Doubt arrives, and the irreversible act has not happened yet. You still hold a safe move: re-attempt, or refuse to release. The point of no return is still ahead of the doubt.
Post-pay · the trap
The customer fuels first. The fuel is gone. Now the payment goes in doubt, and no safe move exists, because you cannot un-dispense fuel. The point of no return is behind the doubt.
An in-doubt window is survivable in proportion to how much of the irreversible action still lies ahead of it. And post-pay is not a mistake you can design away. Unattended sites, pay-at-kiosk, fleet and account customers force it on you. A discipline that only handles the convenient ordering is not a discipline.
Why the attendant cannot win
The attendant asks for another card, and the customer pays twice. That is not carelessness. It is structural.
A disciplined system asked to settle the same transaction twice recognizes the second attempt as the same business event and does nothing. The attendant cannot. He has no stable transaction identity to check against, no record of what has already been done, no way to tell a retry from a new sale. He sees a decline and he acts on it.
The double charge is the predictable output of resolving uncertainty without the one thing that makes a retry safe. Which is precisely the first of the five ideas the nine fields all converged on.
The discipline
The mechanisms already exist, scattered across those nine fields. What has been missing is the assembly, stated once as design laws that hold whatever channel you are on. Three of the seven show the shape.
- A missing acknowledgement is not a failure.Silence is ambiguity, not a negative result. Acting irreversibly on silence is the single most common root cause in the class. It is the attendant asking for another card. It is a gateway auto-reversing a payment it already knows succeeded.
- Evidence is not truth.A transport receipt, a delivery confirmation, even an application acknowledgement, are evidence about an outcome. Truth is the committed state of the system of record. Most double charges live in that gap.
- Finalization is gated by reversibility.The strength of evidence you require scales with how irreversible the act is. A reversible action may finalize on weak evidence. Fuel may not.
The other four cover in-doubt as a first-class state, idempotency, querying before acting, and bounded resolution that always terminates.
What it cannot do
The proof holds. The discipline does not abolish the uncertain moment, and any protocol claiming otherwise has not understood the Two Generals result. At the instant of the break, neither side can distinguish a lost acknowledgement from a message that never arrived, and if fuel is already in the tank, it stands.
What the discipline buys is narrower and worth more: nothing irreversible ever happens on the strength of that uncertainty, the uncertainty is made explicit instead of papered over, and it is driven to a correct terminal outcome automatically wherever the evidence allows.
The paper states all seven laws, gives a reference model that requires no changes from the system on the other side, maps the discipline onto ISO 8583, message queues, document exchange and REST webhooks, turns the laws into a conformance checklist, and draws the boundary in full.