Accepted work remains accountable
Make incomplete work visible, including work that automatic retries cannot finish.
Guide context
Cancellation, renewal, and uncertain delivery must not silently change an accepted outcome’s identity or authority.
If something is cancelled, renewed, or answers ambiguously, Kam keeps the original record and its permissions intact and shows the unfinished work. It never quietly reclassifies an uncertain result as a success or a failure.
On this page · 4 sections
Recovery follows evidence
Obligation
The work that still needs an outcome.
Attempt
A recorded dispatch and its known or unknown effect.
Authority
Revalidate current authority before resuming work.
Keep local processing and delivery separate#
Lifecycle fencing and bounded draining are implemented candidates. Delivery additionally owns one obligation per eligible generation. Local application does not prove remote submission, and remote submission does not prove retrieval.
Do not let an old job inherit new authority#
An outcome keeps its acceptance epoch. Cancellation closes new acceptance and may authorize a bounded local drain. Renewal advances authority again. Delivery stops new remote attempts when the lifecycle closes or its destination binding changes; an old obligation is not silently rebound.
Uncertain is not failed, cancelled, or complete#
An ambiguous response preserves the request identity and durable receipt. Recovery waits for the relevant lease or scheduled retry boundary. Exhausted publication or verification attempts require reconciliation; they are not counted as success. A failed read does not trigger a new create.
Implemented exit controls still need live qualification#
Bounded owner export, export-bound primary deletion, and a separately retained restore fence are implemented. Marketplace reconciliation is license-scoped. Live purchase, cancellation, downstream erasure, and restore drills remain separate gates. A restored table being available does not establish that it is safe to serve.