Consume-commit loop: the assembly that holds exactly-once together Diagram

The commit loop

Poll, fence-check, guarded apply, atomic commit, then repeat on the next batch
The checkpoint is written in the same transaction as the totals it describes
Replay is always ordered per partition, so the offset comparison stays sound

Abort, fence, alert

Rebalance aborts the open transaction before ownership moves
A stale owner keeps its epoch and its writes are rejected on commit
An offset jump past retention is an alert and a re-seed, never a silent skip

Known boundaries

Local state plus the transaction cover counting; external side effects need their own idempotency
A dedup horizon bounds the checkpoint memory; older replay must re-seed from scratch
A partition-count change migrates the dedup identity under a routing version, not in place