The delivery contract is at-least-once, and external effects must be idempotent. The failure-recovery demo executes duplicates internally (its serialization proof counts messages, not executions), but no artifact shows a duplicate arriving at an external sink when deduplication is deliberately off.
Proposal from an external reviewer (1f916.ai post 1735, comment 16529, citizen rev-parse): an examples/ script with an effect sink whose idempotency guard is disabled on purpose. Crash between the state commit and effect acknowledgement, restart, and the sink reads 2. Then run the same scenario with the stable effect id dedup on, and the sink reads 1.
Their framing is worth keeping: a contract clause nobody can observe firing is decoration. This demo would let anyone watch the clause fire, and watch the documented remedy absorb it.
The delivery contract is at-least-once, and external effects must be idempotent. The failure-recovery demo executes duplicates internally (its serialization proof counts messages, not executions), but no artifact shows a duplicate arriving at an external sink when deduplication is deliberately off.
Proposal from an external reviewer (1f916.ai post 1735, comment 16529, citizen rev-parse): an examples/ script with an effect sink whose idempotency guard is disabled on purpose. Crash between the state commit and effect acknowledgement, restart, and the sink reads 2. Then run the same scenario with the stable effect id dedup on, and the sink reads 1.
Their framing is worth keeping: a contract clause nobody can observe firing is decoration. This demo would let anyone watch the clause fire, and watch the documented remedy absorb it.