<p>dan wilkerson, simon goldsmith, et al. designed a thorough <a href="http://arxiv.org/abs/1106.3325" rel="noreferrer">global transaction system</a> on top of app engine's local (per entity group) transactions. at a high level, it uses techniques similar to the GUID one you describe. dan dealt with "submarine writes," ie the transactions you describe that report failure but later surface as succeeded, as well as many other theoretical and practical details of the datastore. erick armbrust implemented dan's design in <a href="http://code.google.com/p/tapioca-orm/" rel="noreferrer">tapioca-orm</a>.</p>

<p>i don't necessarily recommend that you implement his design or use tapioca-orm, but you'd definitely be interested in the research.</p>

<p>in response to your questions: plenty of people implement GAE apps that use the datastore without idempotency. it's only important when you need transactions with certain kinds of guarantees like the ones you describe. it's definitely important to understand when you do need them, but you often don't.</p>

<p>the datastore is implemented on top of megastore, which is described in depth <a href="http://research.google.com/pubs/pub36971.html" rel="noreferrer">in this paper</a>. in short, it uses <a href="http://en.wikipedia.org/wiki/Multiversion_concurrency_control" rel="noreferrer">multi-version concurrency control</a> within each entity group and <a href="http://en.wikipedia.org/wiki/Paxos_%28computer_science%29" rel="noreferrer">Paxos</a> for replication across datacenters, both of which can contribute to submarine writes. i don't know if there are public numbers on submarine write frequency in the datastore, but if there are, searches with these terms and on the datastore mailing lists should find them.</p>

<p>amazon's S3 isn't really a comparable system; it's more of a CDN than a distributed database. amazon's SimpleDB is comparable. it originally only provided <a href="http://aws.amazon.com/simpledb/#eventually-consistent" rel="noreferrer">eventual consistency</a>, and eventually added a very limited kind of transactions they call <a href="http://aws.amazon.com/simpledb/#consistent" rel="noreferrer">conditional writes</a>, but it doesn't have true transactions. other NoSQL databases (redis, mongo, couchdb, etc.) have different variations on transactions and consistency.</p>

<p>basically, there's always a tradeoff in distributed databases between scale, transaction breadth, and strength of consistency guarantees. this is best known by eric brewer's <a href="http://en.wikipedia.org/wiki/CAP_theorem" rel="noreferrer">CAP theorem</a>, which says the three axes of the tradeoff are consistency, availability, and partition tolerance.</p>
GAE transaction failure and idempotency
<p>The Google App Engine documentation contains this paragraph:</p>

<blockquote>
  <p>Note: If your application receives an exception when committing a
  transaction, it does not always mean that the transaction failed. You
  can receive DatastoreTimeoutException,
  ConcurrentModificationException, or DatastoreFailureException
  exceptions in cases where transactions have been committed and
  eventually will be applied successfully. Whenever possible, make your
  Datastore transactions idempotent so that if you repeat a transaction,
  the end result will be the same.</p>
</blockquote>

<p>Wait, what? It seems like there's a very important class of transactions that just simply cannot be made idempotent because they depend on current datastore state.  For example, a simple counter, as in a like button.  The transaction needs to read the current count, increment it, and write out the count again.  If the transaction appears to "fail" but doesn't REALLY fail, and there's no way for me to tell that on the client side, then I need to try again, which will result in one click generating two "likes." Surely there is some way to prevent this with GAE?</p>

<p>Edit:</p>

<p>it seems that this is problem inherent in distributed systems, as per non other than Guido van Rossum -- see this link:</p>

<p><a href="https://stackoverflow.com/questions/13740724/app-engine-datastore-transaction-exception">app engine datastore transaction exception</a></p>

<p>So it looks like designing idempotent transactions is pretty much a must if you want a high degree of reliability.</p>

<p>I was wondering if it was possible to implement a global system across a whole app for ensuring idempotency.  The key would be to maintain a transaction log in the datastore.  The client would generated a GUID, and then include that GUID with the request (the same GUID would be re-sent on retries for the same request).  On the server, at the start of each transaction, it would look in the datastore for a record in the Transactions entity group with that ID.  If it found it, then this is a repeated transaction, so it would return without doing anything.  </p>

<p>Of course this would require enabling cross-group transactions, or having a separate transaction log as a child of each entity group.  Also there would be a performance hit if failed entity key lookups are slow, because almost every transaction would include a failed lookup, because most GUIDs would be new.</p>

<p>In terms of the additional $ cost in terms of additional datastore interactions, this would probably still be less than if I had to make every transaction idempotent, since that would require a lot of checking what's in the datastore in each level.</p>