Deductive Verification of Temporal Collisions in Distributed Message Brokers

Asynchronous message brokers with at-least-once delivery semantics—Apache Kafka, RabbitMQ, and NATS JetStream—exhibit a fundamental temporal collision: a consumer may crash between storing a result and committing the offset, causing duplicate execution upon redelivery. We present a formal verification study across all three brokers under four delivery modes using 12 TLA+ models and TLC model checking (108 configurations), cross-validated with Docker and Toxiproxy fault injection. Pulse-coupled synchronization is shown not to eliminate the crash window