Idempotency TTL / Replay After Expiry

Verified #016 showed that dedupe memory must survive a service restart. #017 asks the temporal version: what if the memory is durable but expires before the recovery path finishes?

The benchmark fixes the recovery window and changes retention.

The HTTP service uses persistent SQLite for both remote effects and idempotency records. Logical time is supplied deterministically over HTTP so the test can move across expiry boundaries without wall-clock waiting.

Unsafe · the effect survives longer than the dedupe guarantee.

At T0=1,000,000, the first POST committed one remote effect and created an idempotency record expiring at 1,000,060. The response was dropped, leaving the client at ACK_UNKNOWN.

The delayed worker then reused the same idempotency key. Because the 60-second record had expired, the service accepted it as a new application.

Final unsafe state: 2 POST requests, 2 remote effects, CONFLICT.

Safe · retention covers the recovery window.

The second case kept the same 120-second recovery delay but changed TTL to 300 seconds. At retry time the idempotency record was still active, so the real second HTTP POST returned deduplicated.

Safe alternative · reconcile after expiry.

The third path deliberately used the short 60-second TTL again. At recovery time the idempotency record was expired, but authoritative remote status still reported COMMITTED / effect_count=1. Recovery therefore made no second POST.

What #017 adds to TTP.

Durable does not mean valid forever.

#016 established durability across restart. #017 adds validity over time. A record can survive perfectly and still be unusable for a later decision because its contractual retention window has ended.

Evidence.

GitHub Actions run 31467526532 completed successfully. Artifact resonance-idempotency-ttl-replay-v1.0 has ID 9092068450 and digest sha256:9e3da946190c6ab6e3b9ab26d0b18d0f5856c740a3f532bae70b7ca0dbdbfc26.

Execution used PostgreSQL 17.6 and a separate python:3.12-slim HTTP container with persistent SQLite effect/idempotency state.

Interpretation boundary.

The network and persistence components are real local services, while time progression is deterministic logical benchmark time. The values 60, 120 and 300 seconds are test parameters — not recommended production defaults. This is not a universal provider-TTL, exactly-once, clock-synchronization or arbitrary-agent-safety certification.

Verdict: safety memory must not only survive failures; its validity window must still cover the moment recovery depends on it.