Kafka Reliability Field Guide

G01 · documented-contract

Local producer enqueue is neither broker acknowledgement nor a durable application-intent ledger.

Limit: A separately durable outbox can establish a different application boundary.

Sources S02, S03, S23 · scenarios D01, P01

G02 · documented-contract

Acks 0 supplies no broker receipt proof, acks 1 supplies leader-local evidence, and stable-profile acks all waits on the current ISR.

Limit: This does not establish per-record media flush or every election outcome.

Sources S02, S05 · scenarios P02, P03, P04

G03 · source-observation

Min-ISR is not an acknowledgement count chosen from replication factor; under the pinned source it also constrains new HW progress.

Limit: The model bounds pending/maximal ISR and does not implement the full election algorithm.

Sources S05, S07 · scenarios P04, P05, P12

G04 · documented-contract

A negative, timed-out, or unobserved producer result can coexist with appended bytes.

Limit: The exact branch depends on action order and observed evidence.

Sources S03, S05 · scenarios P06, P07

G05 · documented-contract

Replication acknowledgement is not per-record fsync on every disk or proof against correlated failure.

Limit: A single-machine fixture cannot establish failure-domain durability.

Sources S06, S07 · scenarios P03, P04

G06 · source-observation

Producer retry identity is PID, epoch, partition, and record sequence—not payload or business identity.

Limit: The recent batch window is bounded and session-scoped.

Sources S02, S03, S04, S11 · scenarios P07, P08, P09, P13

G07 · documented-contract

Supported idempotent settings preserve their partition/session ordering scope; application resends, multiple writers, and routing changes need another contract.

Limit: No global business order is inferred.

Sources S02, S03, S26 · scenarios P10, P11, P14

G08 · documented-contract

Transactional initialization and fencing identify a writer incarnation, not a business operation.

Limit: Already-dispatched external effects remain outside the fence.

Sources S03, S11, S13 · scenarios T03, E08

G09 · source-observation

LSO is an exclusive unstable-transaction boundary bounded by HW, not an inclusive record count.

Limit: Marker stability and aborted ranges remain explicit.

Sources S08, S09 · scenarios T01, T02, T05

G10 · documented-contract

Control records, aborted ranges, compaction, and topology history can create valid offset gaps.

Limit: Visible record count cannot be reconstructed from an offset span alone.

Sources S09, S26 · scenarios T02, C04, P14

G11 · documented-contract

A commit-response timeout does not establish abort; terminal retry must preserve the chosen operation.

Limit: No universal KafkaException classifier is implied.

Sources S03 · scenarios T04, T10, R03

G12 · documented-contract

Kafka output and input progress can share one same-cluster transaction decision while participant visibility remains staggered.

Limit: This is not a cross-partition snapshot or wall-clock visibility barrier.

Sources S03, S11, S12, S13 · scenarios T06, T09, R03

G13 · documented-contract

Consumer fetched position does not rewind automatically after abort, and pending transactional progress is not a stable recovery checkpoint.

Limit: Recovery must use the selected client and group protocol correctly.

Sources S06, S09, S12 · scenarios T06, T07

G14 · documented-contract

Processing attempts may repeat even when committed Kafka output and progress meet the stated EOS contract.

Limit: External effects and physical invocation counts remain separate.

Sources S06, S18 · scenarios T06, T07

G15 · operator-judgment

Traditional consumers commit next-offset boundaries from completed owned work—not record count, fetched position, or the last out-of-order completion.

Limit: The contiguous frontier is application logic over a complete delivery ledger.

Sources S03, S09 · scenarios C01, C02, C03, C04, C10

G16 · source-observation

Java async commit callbacks follow invocation order; a newly invoked old snapshot is an application regression hazard.

Limit: Do not invent callback reordering that the Java API excludes.

Sources S09 · scenarios C11

G17 · documented-contract

Revocation, loss, and group fencing do not fence an external resource or cancel a dispatched effect.

Limit: The external system needs its own identity, authority, or fencing contract.

Sources S09, S14, S22 · scenarios C06, C07, C09, E04

G18 · documented-contract

Poll progress, heartbeats, static membership, and KIP-848 policy ownership are distinct versioned concerns.

Limit: The browser does not implement a complete coordinator or scheduler.

Sources S09, S10, S14 · scenarios C08, C09

G19 · documented-contract

An outbox closes a local DB intent gap but permits duplicate publication; event identity and routing remain explicit.

Limit: The CDC option is a declared contract, not a connector certification.

Sources S19, S20, S23 · scenarios E01, E02, E09

G20 · documented-contract

An atomic scoped inbox and DB mutation can protect one declared identity; an HTTP effect needs another contract.

Limit: Fingerprint mismatch and retention expiry remain explicit failures.

Sources S21, S22, S23 · scenarios E03, E04, E05, E06

G21 · operator-judgment

A retained source record can outlive deduplication protection, authority, or current schema meaning.

Limit: Retention clocks and restore points are independent.

Sources S05, S10, S22 · scenarios E07, E10, R07, R08, R09, R10

G22 · documented-contract

Nontransactional DLQ publication and source progress have loss/duplication windows; one same-Kafka transaction can join those Kafka participants.

Limit: Redrive effects still need their own identity and authority contract.

Sources S03, S19 · scenarios R01, R02, R03, R04

G23 · operator-judgment

Retry topics can change processing order, and a larger retry budget cannot resolve an unknown effect.

Limit: The attempt arithmetic is a bounded upper bound, not a probability model.

Sources S02, S09 · scenarios R05, R06

G24 · documented-contract

Offset lag, fetch lag, transaction visibility, and application completion deadlines answer different questions.

Limit: No universal lag-to-time or lag-to-record-count conversion is valid.

Sources S08, S09, S24 · scenarios C02, T05, R11

G25 · documented-contract

Streams, Connect, and MirrorMaker EOS modes each have narrower prerequisites than an end-to-end everything-once claim.

Limit: Connector, sink, topology, and failover contracts remain profile-specific.

Sources S18, S19, S25 · scenarios D03, D06, T08, R12

G26 · documented-contract

Share groups use record acquisition and acknowledgement state—not a traditional committed-prefix frontier.

Limit: Interactive claims require the pinned F08 runtime evidence gate.

Sources S01, S15, S16, S17 · scenarios SG01, SG02, SG03, SG04, SG05, SG06

G27 · documented-contract

Ordinary transaction timeout conclusions do not apply when the documented two-phase extension is enabled.

Limit: The extension remains a bounded reference, not an executed engine.

Sources S02, S13 · scenarios D06, T12

G28 · operator-judgment

Kafka-compatible and cross-cluster systems require independent behavior, identity, and authority evidence.

Limit: No parity badge or universal failover conclusion is produced.

Sources S25 · scenarios D06, R12