Partial Failure Mid-Posting: Atomic Rollback / Saga Compensation

all same-datastore steps of a money/display_id write run in ONE transaction (atomic commit or full rollback

when a failure occurs mid-operation (e.g., ledger emit times out after cash allocation

negative) when an event is emitted for a rolled-back write the system must suppress it via outbox pattern, else 500 with error code outbox_consistency_failure.

A multi-step operation - e.g., post an invoice, allocate cash, update the customer balance, emit a ledger event, push to an external system - fails partway (DB error, downstream timeout). For steps inside one datastore the whole unit commits or rolls back atomically (single transaction), so the books never show a half-posted document. For steps spanning systems that cannot share a transaction, a saga issues compensating actions to undo the already-completed steps, and the operation is retried idempotently. The user never sees a debit without its credit, or an invoice marked paid with no cash applied.

all same-datastore steps of a money/display_id write run in ONE transaction (atomic commit or full rollback);
cross-system steps use a saga with explicit compensating actions;
every step idempotent so retry is safe;
no partial state visible to readers (no orphan debit/credit, no paid-without-cash);
failed operations surface a clear, recoverable error, not a silent half-state;
compensations and retries are logged;
outbox/transactional-messaging pattern for emitted events so an event is never sent for a rolled-back write.

Given a multi-step posting operation spanning invoice creation, cash allocation, customer balance update, and ledger event emission;
when a failure occurs mid-operation (e.g., ledger emit times out after cash allocation);
then all same-datastore steps roll back atomically (no orphan debit/credit), cross-system saga compensations undo completed steps, the user sees a clear recoverable error, no partial state is visible to readers, and the operation is safely retried;
(negative) when an event is emitted for a rolled-back write the system must suppress it via outbox pattern, else 500 with error code outbox_consistency_failure.

posting_saga { id: string, steps: json, status: enum, compensations: json, external_id: string, created_at: timestamp };
outbox_event { id: string, saga_id: string, event_type: string, payload: json, status: enum, emitted_at: timestamp };
(reference, product may differ).

POST /v1/invoices/{id}/post -> 202 { saga_id } for async;
or 201 for sync same-datastore;
GET /v1/posting-sagas/{saga_id} -> { status, steps, compensations };
emits invoice.posted only after successful commit via outbox;
failed saga emits posting.failed event.

PENDING -> IN_PROGRESS -> COMMITTED;
terminal ROLLED_BACK or COMPENSATED;
guard: no partial visible state between steps;
outbox event only emitted post-commit;
compensation steps logged individually;
retry idempotent via external_id.