Three boundaries need separate proof.
One in-process chain does not exclude a second process.
Append can become durable before live memory records acknowledgement.
Sequence alone cannot prove a retry is the same operation.
The committed-region refusal is the final defense, not the root cause.
Choose the least destructive outcome.
Preserve the original and move reviewed context to a fresh Session.
Report the valid prefix and duplicate candidate without claiming resumability.
Stage a new artifact only after unique exact-duplicate proof and full replay.
Sequence, source references, replacements, tool lifecycle, and request evidence still describe the original history.
Primary evidence.
Repair identity, not just numbering.
The complete runbook includes evidence freezing, mismatch routing, exact-duplicate proof, recovery choices, a durable compare-and-append contract, regression matrix, and fifteen acceptance gates.
Read the complete runbook