UNKNOWN & reconciliation

A lost response leaves two separate questions

UNKNOWN ≠ FAILED

The external system may apply a write even when its response never arrives. A timeout tells the caller that confirmation is missing; it does not prove that the change failed.

COMMAND TRUTH = UNKNOWN

UNKNOWN

The command did not receive a confirmation.

EXTERNAL RECONCILIATION VERDICT = MATCHED (derived)

MATCHED (derived)

A fresh, usable external observation agrees with the intended change.

Why blind retry is unsafe

If the first write already happened, repeating it can duplicate the side effect. The technical demo refuses a blind redispatch of an UNKNOWN command.

A conditional redispatch requires valid, active operator-confirmed configuration asserting both that the provider honors the same idempotency key and that repeating the operation is safe. The Framework records that operator assertion; it does not guarantee third-party behavior.

No universal exactly-once guarantee or guaranteed third-party idempotency is claimed. The demo's observed ledger count belongs to that controlled synthetic run.

Observe, check freshness, derive

Read authoritative external state
Use a governed observation of the external object instead of interpreting a timeout as failure.
Check that the observation is usable
Freshness matters. Stale or unusable evidence cannot be counted as a match.
Derive a separate verdict
In the technical demo, an observation without a usable freshness window gives UNOBSERVABLE; a fresh matching observation gives MATCHED (derived). Command truth remains UNKNOWN.
Keep the evidence inspectable
Retain observations and audit records. Approval-task evidence-chain verification is scoped to that task, not the complete audit database.

Other conceptual verdicts are UNOBSERVED and DIVERGED. The public technical demo exercises UNOBSERVABLE and MATCHED (derived), not every vocabulary entry.

Separately licensed Framework-backed technical demo

The refund scenario

A synthetic CNY 100 refund demonstrates approval, a write whose response is lost, refusal of blind retry and a fresh external-state match. Command truth remains UNKNOWN. No live business system is contacted; approval is a DEMO HUMAN APPROVAL SIMULATION.

This technical demo substitutes only the transport; governance and execution behavior above it belongs to the licensed Framework. Re-running requires the private, separately licensed Framework. The manufacturing public simulation does not share that execution-proof scope.

Captured refund terminal introduction showing S1 scenario, S2 governance and S3 admission using synthetic data — This captured introduction illustrates S1–S3: scenario, governance and admission. It does not itself prove UNKNOWN handling or durable execution. Synthetic data and simulated approval; a licensed Framework is required to re-run. “Safely” is a design goal under explicit operator-defined governance, approval, evidence, recovery and audit controls; it is not a security, legal, regulatory or compliance certification. View full-size screenshot.

Technical demo setup Full stage-by-stage expected flow

Read the public reconciliation document · See the manufacturing simulation snapshot