The intent/confirmation event pair is the piece most teams skip, and it's exactly the gap that turns a network blip into a duplicate charge or a double-published article. I think about it in similar terms to what I'd call an audit event in a delivery contract: if you can't answer what happened, based on what evidence, and how to undo it, from a single record, you don't have recovery, you have hope.

One question on the single-writer lease: what happens when a lease expires mid-effect, after the intent event fires but before confirmation lands? Does the next worker default to reconcile-first regardless of the action, or does that depend on the replay policy assigned to the step?