ClientSessionTable

The authoritative client-serial dedup table for a consumer's state machine (Raft §8).

Fold it into your apply loop: call shouldApply for each Committed.Entry.entry.dedupKey; apply the command only when it returns true. Serialize it into your snapshot via toBytes and restore with fromBytes on Committed.Install, so a follower that joins mid-stream inherits the high-water-marks and rejects stale retries.

Not thread-safe — drive it from the same single apply loop that consumes RaftNode.committed.

Bounding (v2 — supersession prune): the table is self-bounding without any clock, horizon, or heuristic. A NodeId is cluster-unique, so two incarnations of one node are never live at once — the arrival of a new auto-incarnation (auto:$nodeId-…) is proof that its prior siblings are dead. shouldApply therefore evicts every same-family auto sibling in the same apply step, so the table holds at most one entry per live auto family plus the durable ids. The prune is a pure function of the committed stream → every replica prunes identically, and a snapshot is always already-pruned, so the toBytes/fromBytes format is unchanged from v1. Durable/stable ids are not auto-shaped, so they are never pruned and keep their cross-crash exactly-once. The only residual is the at-least-once floor the auto path already documents: an in-flight straggler of an evicted incarnation may double-apply (never a silent drop) — and, being auto-shaped itself, may in turn supersede the live incarnation, briefly dropping it to at-least-once too. Both stay within the auto path's at-least-once guarantee; durable ids are unaffected. Consumers that observe a clean teardown may also call closeSession. Long-lived clients should reuse a stable ClientId so their entry updates in place.