The commit log is the outbox.

The dual-write problem of Module 13.2 came from two systems — a store and a queue — that could disagree across a crash. The commit-log-as-outbox removes one of them. In EchoStore.Durability.Graft, the outbox is the Graft commit log: an enqueue intent is written as a page commit, but in a reserved high LSN range, @obx_base = 1 <<< 48, so it cannot collide with the ordinary page commits that live at normal LSNs. The two share one log and one writer, separated only by where they sit on the LSN axis. Because the intent is itself a commit, recording the work and making it durable are a single act — there is no window between “saved” and “enqueued” for a crash to open, so the divergence simply cannot occur. And that one commit is not a lesser write than any other: it goes through the same OCC base-LSN check, the same conditional-write fence that makes the commit atomic against a racing writer, and the same page-rollup replication to Tigris. So an enqueue is, in one stroke, strict and replicated — the corner the classical queue could not reach — and it costs only what a Graft commit costs, riding the engine’s batch for throughput. The engine earns this for free in the sense that matters: the Volume is already there for the page workloads of Chapter III, so the outbox adds a range, not an engine.

A durable intent is not yet running work; something must turn the committed log into jobs on the bus, and that is the Committer — “the commit-log-as-outbox drain.” It subscribes to the commit channel, and for each commit re-publishes that commit’s names to the work queue at-least-once, tracking how far it has projected with a persisted frontier. At-least-once is the right guarantee precisely because the handlers downstream are already idempotent on the branded id (Module 12.1), so a name published twice after a restart is harmless. Recovery is the mirror image of the write: EchoStore.Durability.Graft’s replay scans the reserved range above a watermark and re-projects any intent the frontier had not yet reached, and the engine’s own log-head recovery has already made those commits durably present after a crash. So the bus — volatile Valkey — can lose its in-flight projection without losing any work: the intents are durable, replicated commits, and the drain simply runs again from the frontier. This is exactly where the platform is heading in the large: ADR-A makes the commit-log-as-outbox the journal itself, atomic and durable in one act, off SQL entirely. The robustness that the bus presents to its callers is, underneath, just the Chapter III engine doing what it already does — commit, fence, replicate, recover — with a reserved range and a drain on top.