What a consumer is allowed to assume.

An agent pipeline that treats the log as an audit trail needs the order, the retry rule, and the loss window written down. Each claim below points at the test or the ADR that owns it.

Order is per partition

Records on one partition stay in commit order. Two producers that both write that partition interleave as their batches commit. A producer that sends one batch at a time keeps its own sequence inside that interleaving. Key by agent or session so one agent's events share a partition. concurrent_producers_keep_each_send_order is the test. Offsets themselves are ADR 0009.

Idempotent produce

Turn on enable.idempotence. A retry of a sequence the broker already accepted returns the original offset. A sequence that skips ahead is OUT_OF_ORDER_SEQUENCE_NUMBER (45) and is not appended. The checks live in idempotence.rs. idempotent_inflight_retries_keep_order retries five in-flight batches and reads them back in sequence order. A timeout can still commit, which produce_timeout.rs covers: the idempotent retry returns the first offset.

Consumers are at least once

A handler should treat a record it has already applied as a no-op, keyed by whatever identity you put in the record. The group cursor moves when the consumer commits, and a crash before that commit delivers the record again. groups.rs commits and resumes. OffsetCommit is in the compatibility matrix.

Transactions

read_committed hides a batch until EndTxn commits it. An abort stays hidden. Visibility is the committed and aborted ranges in metadata, not a control batch in the log. A produce after the transaction has ended is INVALID_TXN_STATE (48). The client tests are txn.rs. The span still costs a second metadata write; collapsing that is ADR 0015, which is proposed, so the second write is still there.

Which mode, and what a failure can drop

wal, the default, acknowledges after a majority of the shard has fsynced (ADR 0005). The upload follows on CAMUS_FLUSH_MS, default 250 ms. If the bucket is down, acknowledged data can sit unsealed up to CAMUS_WAL_DISK_LIMIT, default 8 GiB. Losing the whole shard majority then drops that unsealed tail (ADR 0008). Use wal when that window is acceptable and produce latency matters. The durability page is the short form.

r2 acknowledges only after the object is stored and metadata has committed the offsets. A restarted broker has no local tail to replay. Use r2 for an audit trail that must not contain an acknowledgement for a batch the bucket never stored. The produce waits for the bucket. The measured p99 on that path is on the benchmarks page.