From the durable-effect architecture study, 2026-07-24. The only path to true exactly-once, and it is irreducibly per-adapter.
What
Have each venue adapter honour a deterministic idempotency key on re-POST, deduping a repeat as the same order, or answer a status query for it. The key already exists: submission_key = {venue}:keccak256(body) (videre-sdk/src/keeper.rs:175).
Why
Exactly-once across an external HTTP call is impossible from the host alone: the call is not inside the redb transaction, so the reserve and the effect cannot be made one unit. Closing the residual crash window requires the venue to recognise a re-sent order as the same order, or to report its state, so the sweep reconcile can recover a stranded reservation without double-placing.
The CoW path is already effectively exactly-once only because the orderbook returns a duplicate error that the adapter maps AlreadyHeld -> Accepted (cow-venue/src/adapter.rs:391/:325/:172). That backstop is venue-specific and implicit. Generalize it into an explicit reconcile contract every adapter states.
Scope
Define the reconcile contract on the venue-adapter seam: given the idempotency key, an adapter either dedups a re-POST or answers a status query. Wire the CoW adapter's existing AlreadyHeld handling to it. Keep it additive and venue-agnostic at the generic layer.
Depends on
The sweep reconcile issue, which is the caller.
Acceptance criteria
The sweep can recover a stranded reservation by asking the adapter, and the CoW adapter's duplicate handling is expressed as the explicit contract rather than an implicit mapping.
What
Have each venue adapter honour a deterministic idempotency key on re-POST, deduping a repeat as the same order, or answer a status query for it. The key already exists:
submission_key = {venue}:keccak256(body)(videre-sdk/src/keeper.rs:175).Why
Exactly-once across an external HTTP call is impossible from the host alone: the call is not inside the redb transaction, so the reserve and the effect cannot be made one unit. Closing the residual crash window requires the venue to recognise a re-sent order as the same order, or to report its state, so the sweep reconcile can recover a stranded reservation without double-placing.
The CoW path is already effectively exactly-once only because the orderbook returns a duplicate error that the adapter maps
AlreadyHeld -> Accepted(cow-venue/src/adapter.rs:391/:325/:172). That backstop is venue-specific and implicit. Generalize it into an explicit reconcile contract every adapter states.Scope
Define the reconcile contract on the venue-adapter seam: given the idempotency key, an adapter either dedups a re-POST or answers a status query. Wire the CoW adapter's existing
AlreadyHeldhandling to it. Keep it additive and venue-agnostic at the generic layer.Depends on
The sweep reconcile issue, which is the caller.
Acceptance criteria
The sweep can recover a stranded reservation by asking the adapter, and the CoW adapter's duplicate handling is expressed as the explicit contract rather than an implicit mapping.