Compensation Impossibility

A saga replaces a distributed transaction with a sequence of local transactions, each paired with a compensating action. The pattern is usually taught as though every step has one. Several categories do not.

• A notification cannot be unsent. The "compensation" is a second, contradicting message — a different thing, visible to the customer, and often worse than the original error.
• A physical action cannot be undone. A collected package, a dispatched rider, a delivered item. The compensation is a return journey with real cost.
• An external commitment past its window — a carrier booking past cancellation, a market order filled — can sometimes be reversed only at a price.

Why it matters

Writing a compensating action that pretends to undo something it cannot is worse than admitting the step is final, because downstream design then assumes reversibility that does not exist. The saga looks complete on a whiteboard and leaves goods, money or trust in an unrecoverable state in production.

Implementation patterns

• Order steps by reversibility: reversible first, irreversible last. Every step moved later is a compensation you may never have to run. Reserve stock → authorise payment → book carrier → capture → dispatch → notify.
• Put a confirmation gate before the first irreversible step, so everything uncertain is resolved while reversal is still cheap.
• Where a compensation has a cost — a cancellation fee, a return leg — make that cost explicit in the design and accepted by the business, rather than hidden inside an error handler.
• Give every path a terminal state, including "compensation failed." That state must page a human rather than retry forever: a stuck compensation is money or goods in an unknown position.
• Make compensations idempotent, because they are retried exactly as often as forward steps are.
• Reconcile against the external party's record, which is authoritative; your view of a carrier booking is a cache.

Industry example

A shipping aggregator such as Shiprocket coordinates carrier APIs, warehouse systems, payment and notification across a booking. The genuinely irreversible steps are the physical pickup and the customer notification, and they belong at the end for exactly that reason. The semi-reversible step — the carrier booking — has a cancellation window and a fee, so the design must decide in advance who absorbs that cost when a later step fails.

The same structure governs any workflow that reaches into the physical world: quick commerce, field services, logistics, and manufacturing.

Failure scenarios

• Notification early in the sequence, so customers are told about shipments that are then cancelled.
• A compensating action that does not compensate, giving false confidence to everything built on top.
• Compensation retried forever on a permanent failure, with no escalation.
• No reconciliation against the external system, so a carrier booking that succeeded after your timeout is never discovered.
• The saga's intermediate states not modelled in the product, so "payment taken, shipment not booked" appears to the customer as a broken screen rather than a status.

Trade-offs

Ordering irreversible steps last is not always possible — sometimes the external commitment must be obtained before the internal one is worth making, for instance when carrier capacity is the scarce resource. In that case the compensation cost is unavoidable, and the correct response is to price it and to reduce the probability of reaching it by validating aggressively beforehand.

Sagas in general trade atomicity for availability, and the currency of that trade is user-visible intermediate state. That has to be designed into the product rather than treated as an anomaly.

Interview question

"Your booking saga fails at the final step after the courier has already collected the package. What is the compensating action, who pays for it, and what should have been different about the ordering?"