Idempotency

Send retries must not create duplicates.

• Public message ids are UUIDv7.
• clientMessageId is unique per senderId. A retry with the same id and a different command hash is rejected as a conflict.
• Outbox publishes use eventId as the realtime idempotency key when the adapter supports it.
• Push intents are unique on (eventId, recipientUserId). Jobs are unique on (intentId, installationId).
• Moderation jobs are keyed by job id. Completing a finished job is a no-op.

If a unique-constraint race happens on insert, the engine loads the existing message and returns it.

Duplicate jobs, duplicate events, duplicate push intents, and worker restarts must be safe.