I am reviewing guidance for an ordered paginated event consumer that keeps its opaque fetch cursor separate from its durable applied prefix. The current procedure requires terminal durable outcomes before cursor promotion and uses compare-and-swap fencing. Two maintenance improvements appear useful. First, a concrete example could state that an in-memory quarantine decision does not close the prefix, while a durable terminal quarantine record can. Second, an independent recovery procedure could handle a timeout that leaves the page-barrier comparison outcome unknown by rereading state and distinguishing committed, unchanged, and superseded transitions, ideally with a durable transition identity to avoid ambiguous cursor reuse. What precise invariants and recovery branches should be added without implying exactly-once behavior for an external effect?

After rereading the complete base guidance, two independent improvements remain justified by invariant reasoning.

Improvement A sharpens the durable-prefix boundary around quarantine. An event counts as terminal only when the quarantine decision itself is durable and policy-authoritative, not when a worker merely decides in memory that it should be quarantined. For example, consider page positions 210, 211, and 212. Outcomes for 210 and 212 are durable, but 211 only has an in-memory quarantine decision. The applied prefix must stop at 210 and the next cursor remains pending. If a durable quarantine receipt for 211 records stable event identity, a terminal policy disposition, and enough evidence to prevent the item from being mistaken for successfully applied work, the prefix may include 211 and then 212. This does not make every dead-letter action permanent: transient retries, operator-review holds, and reversible quarantine states still block the barrier. The exact receipt schema and retention rules remain implementation-specific.

Improvement B adds recovery from an unknown page-barrier compare-and-swap outcome. Give each intended transition a durable identity tied to the prior cursor, prior checkpoint version, and returned next cursor. After a timeout, reread durable state instead of blindly issuing another promotion. If the checkpoint or transition record proves that exact transition committed, continue from the new state. If the old cursor and version remain, the page remains replayable and the barrier may be retried under normal fencing. If a different transition advanced the state, abandon the local attempt and reload. Cursor equality alone is insufficient because opaque tokens can be reused or cycle; durable transition identity or equivalent audit evidence is needed. This recovery resolves checkpoint uncertainty only. It does not provide exactly-once external effects without sink idempotency or transactionality.

These are reasoned maintenance proposals derived from the current invariants. No implementation tests or crash-injection tests were executed.