{
  "schema_version": "1.3.0",
  "slug": "how-must-an-instance-preserve-reply-routing-identity-across-endpoint-redeploys",
  "title": "How must an instance preserve reply-routing identity across endpoint redeploys?",
  "date_of_record": "2026 November 2",
  "scope": "Applies to request-reply protocols where the responder routes replies to a return address that may change (endpoint URL, socket address, connection identity) between request and reply. Does not apply to protocols where the reply travels on the same connection the request arrived on.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-must-an-instance-preserve-reply-routing-identity-across-endpoint-redeploys.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-must-an-instance-preserve-reply-routing-identity-across-endpoint-redeploys.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-must-an-instance-preserve-reply-routing-identity-across-endpoint-redeploys.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 974,
    "python_slice_tokens": 122,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A return address is a routing decision made at request time and applied at reply time. Between the two, the requester's endpoint can redeploy, change IP, change port, or move to a different cluster. The reply is well-formed and correctly addressed to where the requester *was*, not where the requester *is*. **Invariant.** Reply routing is sound if and only if...",
    "what_was_observed": "**Signature.** Replies delivered to a service that did not send the request. The receiving service logs \"unknown request id\" or, if it does not correlate, processes the reply as unrelated input. The requester times out. **Trace.** Request sent from pod IP 10.0.1.5 at t=0. Pod redeploys at t=30s, new pod IP 10.0.1.9. Old IP is reassigned to a different service at t=45s. Reply sent at t=60s to 10.0.1.5. The different s...",
    "condition_of_validity": "The instance must ensure at least one holds before it relies on a reply-routing address: 1. **Must route by stable identity.** The return address is a stable identifier (service DNS name, logical ID) resolved at reply time, not a resolved address recorded at request time. 2. **Must bind reply to request identity.** The reply carries a request id and a sender...",
    "decision_boundary": "- Stable identity, resolved at reply time: sound. - Resolved address, connection persistent: sound as long as connection is not lost. - Resolved address, connection ephemeral: unsound; requester redeploy between request and reply misdirects. - Resolved address with no request-id correlation: misdirected replies are processed by the wrong party; unsound by co...",
    "operational_effect": "The invariant couples a return address captured at request time to an endpoint topology that changes. The instance's correct posture is to route by stable identity and to correlate replies. **Trap.** Increase the timeout to allow for redeploy. Longer timeouts increase the window in which redeploy can occur, so the failure rate rises with the timeout. The fix..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "df1803389f2001198da71dc03976c730bd9eb033e5eb478cbb176fca3081e9d5",
    "verified_classes": [
      "GhostReplyError",
      "ReplyRoutingGate"
    ],
    "verified_functions": [
      "dispatch_reply_routing_mode",
      "verify"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "GhostReplyError"
    ],
    "sample_fail_closed_invariants": [
      "resolved-address routing is unsound across redeploy; use stable identity",
      "resolved-address routing with no request identity: a redeployed requester misdirects replies to a new owner"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}