Skip to main content
Imagine an application saves a model answer and then crashes before displaying it. After restart, the user tries again. The desired behavior is to find the original invocation and return the saved answer. Asking the model again would be new work, could cost more and might produce different content. This is an illustrative design journey. The source evidence includes a narrower local restart experiment, whose limits are explained below.

​
Keep identity before the first send

A durable caller records which invocation it is making before provider execution can occur. Gateway associates the authenticated request scope and stable key with that original logical call and a canonical fingerprint of the request. The key identifies the operation. The fingerprint checks that a replay has the same request meaning. Equal text alone cannot identify all business work: two genuinely separate turns may contain exactly the same words.

​
Ask about the original operation after restart

None of these branches authorizes an unnoticed replacement inference.

​
The evidence store is not an answer cache

Gateway’s protected execution record does not retain prompts or answer bytes. It can establish that an attempt completed and record the associated outcome without being able to reproduce the answer. An application that promises exact result replay must keep its own answer or artifact record. If it did not retain the bytes, the honest response is that the result cannot be replayed from the available record. Generating another answer and presenting it as the old one would break that promise.

​
A repeated key can mean different outcomes

With a matching fingerprint, an active original call remains in flight; the duplicate request does not start another provider attempt. A content-free final without exposed output can return its recorded typed disposition. When a final has output or completion evidence, the content-free Gateway boundary may report that the answer is not replayable. A separate caller-owned result store can return the saved answer if it has one. The same scoped key with a different fingerprint is a conflict. Gateway must not invent a fresh key on the caller’s behalf to bypass that conflict.

​
Crash recovery is not live retry

If the execution process itself died while an attempt’s provider outcome was unknown, recovery fences the old writer and reconciles the original history. The recovery sweeper does not resend the uncertain attempt. A legitimate task owner may decide to request new work under a new identity and its aggregate limits. That decision preserves the old uncertainty and possible incurred cost; it is not equal-key replay.

​
The local evidence and its limit

The recorded caller experiment used a fresh process to recover a saved result with no new provider send on replay. It did not establish safe uniqueness for separate equal-content turns, and it left a non-final-state mapping concern. The selected contract requires both properties; the local proof does not automatically provide them. See Implementation status. Continue with Attempts and retries or Execution evidence.