# Pinned event-mongodb bridge deduplication claim and publish failure boundaries > Source-anchored research for Pinned event-mongodb bridge deduplication claim and publish failure boundaries. Run status: COMPLETED. Parent: [Change Data Capture Patterns](https://llms-explorer.com/tree/change-data-capture-patterns/) · 4 facets · 10 facts · page: https://llms-explorer.com/tree/pinned-event-mongodb-bridge-deduplication-claim-and-publish-failure-boundaries/ ## How it works - `Dedup` panics for a nil coordinator or a TTL at or below zero, and uses `DefaultDedupKey` when the key function is nil. For a nonempty key it calls `coord.Claim(ctx, key, ttl)` before `next`; an empty key bypasses the claim and calls `next` directly. (low confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/dedup.go) - The coordinator contract requires atomic claims that expire after TTL and recommends retaining them through the source redelivery window. `MemoryCoordinator` is process-local: it returns false while an existing expiry is in the future, then permits reclaiming an expired key. It does not coordinate separate replicas. (low confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/coordinator.go) - The pinned `Dedup` comments state that exactly one replica per claim window publishes when the coordinator is healthy and the claim TTL exceeds the source redelivery window. The same comments explicitly warn that a crash after claim and before sink publish leaves the claim held until TTL expiry, suppressing redeliveries and losing the event at the sink. These are attributed documentation positions, not an unconditional crash-safe delivery guarantee. (low confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/dedup.go) ## Problems, failure modes and limitations - A coordinator error returns an error by default; the o.FailOpen option instead calls `next`. A false claim without an error invokes o.OnSkip when configured and returns nil without calling `next`. A successful claim calls `next`. (low confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/dedup.go) - The pump composes middleware around `publishTo`, whose terminal action is `sink.Publish`. It passes the pipeline error to `msg.Ack(err)`. Thus a duplicate suppressed with nil is acknowledged without a sink publish; a returned publish error reaches the source acknowledgment path, with redelivery dependent on source support. (medium confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/pump.go) · [also](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/middleware.go) · [also](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/dedup.go) - Inference from the pinned control flow: an ordinary downstream publish failure does not release a successful claim in `Dedup`. The pump can nack that failure, but a replay denied by the still-held claim returns nil and can then be acknowledged without retrying the sink publish. This is source analysis, not an executed crash or delivery result. For this pinned MongoDB transport, SupportsRedelivery returns false; a nack does not establish automatic replay. (medium confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/dedup.go) · [also](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/middleware.go) · [also](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/pump.go) · [also](https://raw.githubusercontent.com/rbaliyan/event-mongodb/ca444aedec31e7e959c0932a8f7577c15312f37e/mongodb.go) - `DLQFunc` handles a returned downstream error by publishing to its DLQ sink, returning nil on success and the original error if that write fails. Inference: this error path is not proof that DLQ recovers an abrupt process crash between claim and publish; the crash warning and DLQ code must be read separately. (medium confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/middleware.go) · [also](https://raw.githubusercontent.com/rbaliyan/event/b112463682d44b0e57d8545e3cdf5d51e112e914/transport/bridge/dedup.go) ## Comparisons and alternatives - In the pinned adapter, `DedupKeyFromChangeStream` returns `msg.ID()` and returns an empty string for a nil message. Its documentation identifies that ID with the resume token `_data` field, rather than a cluster-time/namespace/document-key tuple. (low confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event-mongodb/ca444aedec31e7e959c0932a8f7577c15312f37e/bridge.go) ## Facts and statements - The pinned transport assigns `doc.ID.Data` to `event.ID` and passes `event.ID` to `transport.NewMessageWithAck`. If the token ID is empty, `extractChangeEvent` instead calls `transport.NewID()`; inference: resume-token identity across replicas requires a present token ID. (medium confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event-mongodb/ca444aedec31e7e959c0932a8f7577c15312f37e/mongodb.go) · [also](https://raw.githubusercontent.com/rbaliyan/event-mongodb/ca444aedec31e7e959c0932a8f7577c15312f37e/bridge.go) - The pinned key fixture supplies two fake message IDs with matching second, namespace and document key, then checks that their extracted keys differ. It also checks empty IDs and nil messages. The fixture exercises the key function, with a no-op fake `Ack`; it provides no sink-delivery or crash-recovery execution receipt. (low confidence) — [source](https://raw.githubusercontent.com/rbaliyan/event-mongodb/ca444aedec31e7e959c0932a8f7577c15312f37e/bridge_test.go)