ACK_UNKNOWN→TIME PASSES→CHECK RETENTION→REPLAY / RECONCILE

Four invariants.

I27

DEDUPE RETENTION WINDOW MUST COVER THE RECOVERY / REPLAY WINDOW IT PROTECTSA claim of replay protection needs an explicit time horizon.

I28

EXPIRED DEDUPE MEMORY ≠ EFFECT ABSENTExpiry changes the protection state, not the underlying effect state.

I29

AFTER IDEMPOTENCY EXPIRY, RECONCILE BEFORE CONSEQUENTIAL REPLAYAuthoritative effect state should replace expired dedupe memory.

I30

TIME + MEMORY + RECOVERY POLICY FORM ONE SAFETY BOUNDARYThe pieces must be evaluated together.

Reference recovery path.

REMOTE EFFECT→ACK_UNKNOWN→RECOVERY DELAY
RECORD ACTIVE?→YES: SAME-KEY DELIVERY UNDER CONTRACT
NO / UNKNOWN→AUTHORITATIVE RECONCILE→FRESH DECISION

Evidence required.

When replay safety depends on retention, the proof path should preserve the logical effect identity, idempotency key, record creation and expiry times, recovery/retry time, retention policy, transport outcome, authoritative remote status and final effect count.

Verified #017.

The benchmark fixed a 120-second delayed recovery window. A 60-second TTL expired first and the same key produced a second effect. A 300-second TTL still covered the delayed replay and the second POST was deduplicated. With the short TTL expired, authoritative reconciliation observed COMMITTED and avoided a second POST entirely.

#016 asks whether safety memory survived. #017 asks whether surviving safety memory is still valid when recovery needs it.

Scope.

The benchmark uses deterministic logical time across a real local HTTP boundary. Its numeric TTL values are test parameters, not production recommendations. This rule does not claim universal exactly-once delivery or provider-specific retention guarantees.

Inspect / reproduce

  1. Verified Report #017
  2. Canonical extension source
  3. Transactional Trust Protocol v1.0

Short form: DURABLE MEMORY ≠ MEMORY VALID FOR THIS DECISION TIME.