Crash points x dedup outcome
Exactly-once effect: crash matrix + boundaries
same three crashes with and without the idempotency table; ledger must apply each message once
scenario
WITHOUT dedup table
WITH dedup table + commit-then-ACK
crash 1: before commit
RE-APPLIES, wasted work
APPLIES ONCE on redelivery
crash 2: commit, no ACK
APPLIES TWICE
DEDUP HIT, safe ACK
crash 3: ACK, no cleanup
APPLIES TWICE
KEY STILL LIVE, dedup hit
same key, new payload
APPLIES EVIL 9999
REJECT + alert, ledger safe
replay past horizon
RE-APPLIES
RE-APPLIES: promise ended
mail send + crash 2
SENT TWICE
SENT TWICE: at-least-once
LOCAL: ledger in txn
rolls back with it
TXN: key + effect atomic
UNIQUE on the key
EXTERNAL: mail outside
no rollback possible
HORIZON: keys expire 30d
ACK never deletes a key
6 applications for 3 messages without dedup (175 vs 350): luck is not safety
make external receivers idempotent too, or the boundary leaks exactly-once