ADR-0038: Ordering Is Local and Explicit, Not Global Across Zones

Context

BSFG already commits to zone-local logs, receiver-driven pull, unary paged fetch, durable named consumers, and explicit cross-zone synchronization through BSFG peers. Those decisions imply a final ordering question:

• is there one authoritative total order across all zones?
• or is ordering only meaningful within a local retained stream and a specific consumer view?
• how should applications express sequencing when business causality matters?

This matters because replay, auditing, and downstream projection logic are all sensitive to what kind of order the boundary substrate claims to provide.

Options Considered

• simple sounding model
• easy story for some consumers

|

• not credible across autonomous zones
• forces distributed coordination into the substrate
• couples local autonomy to global sequencing

| | Arrival-time order only | Treat wall-clock arrival time as the authoritative sequence of truth. |

• easy to observe operationally
• simple dashboards

|

• network timing distorts causality
• retries and partitions reorder perception
• weak business meaning

| | Application-defined order only | Make the substrate agnostic to all ordering and force every consumer to invent its own ordering semantics. |

• maximum substrate neutrality
• minimal ordering claims

|

• too little shared discipline
• replay behavior becomes inconsistent
• operators lose a stable baseline model

| | Local stream order plus explicit lineage (Selected) | Ordering is authoritative only within a local retained stream and consumer view; cross-zone and business sequencing must be expressed through lineage and domain facts. |

• fits autonomous zone model
• preserves local replay determinism
• avoids false global-order promises
• pushes business causality into explicit facts and lineage

|

• applications cannot rely on one global timestamp/order
• causal reasoning requires proper use of correlation, causation, and subject-level facts

|

Decision

BSFG does not define one global total order across zones.

authoritative order = local retained stream order
global causality    = explicit lineage + domain facts
not = one universal cross-zone sequence

Therefore:

• ordering is meaningful within a zone-local retained stream
• consumer progress is meaningful within a durable named consumer view
• cross-zone sequencing is reconstructed from facts, correlation, causation, and subject-specific logic
• wall-clock time is helpful metadata, but not the sole authority for causal interpretation

When business sequencing matters, producers and downstream systems must express it explicitly, for example through:

• correlation_id
• causation_id
• subject-scoped predicates such as step_started, step_completed, state_is
• explicit sequence values inside object_json where the domain requires them

Consequences

Benefits:

• the architecture stays honest about autonomous zones and asynchronous transfer
• local replay remains deterministic without forcing global coordination
• business causality becomes explicit instead of being smuggled in through timestamps
• operators can distinguish transport order from domain order

Tradeoffs:

• some consumers must do more work to reconstruct cross-zone narratives
• teams cannot lean on one naive “latest message wins everywhere” model
• domain models that need strict sequencing must encode it deliberately