Durable

Use the caller-supplied stable clientId, persisted by the caller across restarts. Replaying the same requestId on a post-crash retry yields cross-crash exactly-once. A collision under a durable id is an operational error (two live writers sharing one id) and surfaces as a ClientIdCollisionException rather than a silent re-mint.