Idempotency & dedup

At-least-once delivery means duplicates are not an edge case - they are a guarantee. The system's correctness rests entirely on the receiver treating the second copy of an event as a no-op.

Idempotency is the contract that makes this safe. Each event carries a stable key, the consumer records the keys it has already handled and any repeat is recognized and skipped. Without it, a retry that succeeds after a lost ack double-charges, double-provisions or double-fires a downstream action.