At-Least-Once

PubSub is at-most-once: a message is handed to whoever is listening and then it is gone. If a subscriber is down, or crashes between receiving and finishing, the message is not redelivered — it was never owed in the first place. The stream tier makes the opposite promise. A delivered entry is a debt, recorded in the consumer's pending-entries list, and it is not settled until XACK. A consumer that dies between read and ack has not dropped the work; it has left it owed, and the group can collect.

That promise has a mechanism and a price. The mechanism is the pending list plus XAUTOCLAIM: entries that sit unacknowledged past an idle threshold are reassigned to a living consumer, which finishes them. The price is duplication — "at least once" can mean twice, because a consumer might crash after doing the work but before acking — so every consumer is written to be idempotent. At-least-once is not free delivery; it is a guarantee that the work is not lost, paid for with consumers that can safely repeat.

The pending list is what makes the guarantee real, but it is worth seeing exactly what the guarantee does and does not say. It says: no entry is lost because a consumer failed. It does not say: every entry is processed exactly once. Those are different claims, and the gap between them is the window where a consumer finishes the work and then dies before its XACK lands — from the group's view the entry is still owed, so XAUTOCLAIM will hand it to someone else, and it runs twice.

This is why at-least-once is a contract on the consumer, not only the broker. The tier promises delivery; the consumer promises idempotence — that repeating an entry is safe, whether by a natural key, a dedup set, or a conditional write. The reward for holding up that end is a system that degrades honestly: under failure it does too much, never too little, and "too much" is harmless when the work is idempotent. Retention (XTRIM) and replay by mint id round it out — the log keeps as much history as policy allows, and any window can be re-read, so recovery and audit read from the same stream the workers do.

The delivery rule — a delivered entry stays pending until acked, so a dropped consumer loses no work. XAUTOCLAIM rescues the pending work of the dead, XTRIM bounds the log, and any id replays — and the price of "at least once" is that a consumer must be idempotent, because at least can mean twice.