Kafka in ProductionHow Uber, PayPal, Agoda, and 30+ companies actually run Kafka — scale, failure, cost, and the judgment calls.Week 4: Semantics, contracts & where Kafka endsExactly-once is a layered defense, contracts beat repair on immutable topics, and the strongest senior signal is knowing Kafka's boundaries.

Figure 1 — exactly-once as a layered defense. By the end of this week you can read this as a boundary map: what each layer guarantees, and precisely where its guarantee ends

The PM asks a simple question: "Can you guarantee every order event is counted exactly once?" You check the boxes — acks=all, idempotent producer on, transactions enabled, sinks reading read_committed — and say yes. Two weeks later finance finds duplicated orders in the warehouse. Every config was right. Every component honored its contract. So what, exactly, did those configs promise — and where did the promise end?The final week is about boundaries: where exactly-once guarantees actually stop, how events get into Kafka atomically, why immutable topics make prevention beat repair — and where Kafka itself ends.After this week you canThe full week 4 brief is part of LeetData Pro.Case studies

Uber — Real-Time Exactly-Once Ad Event Processing with Apache Flink, Kafka, and Pinot

Debezium — Towards Debezium exactly-once delivery

Yotpo Engineering — Outbox with Debezium and Kafka — The hidden challenges

Wix — How Wix manages Schemas for Kafka (and gRPC) used by 2000 microservices

Confluent — Shift Left Bad Data in Event Streams

LinkedIn — Introducing Northguard and Xinfra: scalable log storage at LinkedIn

Gunnar Morling — “You Don’t Need Kafka, Just Use Postgres” Considered Harmful

Exercises

Duplicates Downstream

The Poison-Pill Message

Exactly-Once, Except When It Isn't

The Outbox That Stopped

Senior screening: Kafka internals