Why Outbox Relay Leases Cannot Guarantee Exactly-Once Delivery Alone

In distributed systems using the outbox pattern, a relay lease limits concurrent ownership of a message row but cannot prevent duplicate broker deliveries when a lease expires mid-flight. If Relay A publishes a message but its lease expires before recording completion, Relay B can claim the same row and publish it again, resulting in a legitimate duplicate. A fencing token — incremented on every claim — ensures stale relays cannot falsely mark a newer lease as complete, though it does not retract already-published messages. The honest guarantee the pattern offers is at-least-once delivery, meaning consumers must be designed to handle duplicates safely. The correct approach is to tie each business effect to an idempotency check within the same transaction, using the unique event identity to ensure the effect commits at most once per consumer.