The bus dies; the lane replays.

… (the self-check, the header, H1, and H2 open the record -- frozen on the module hub)
derive (memory): the applied table lives in the file, so it survives the table, the node, and the bus; after a full restart with an empty L1, a replayed old version must answer :remembered_stale from the journal alone -- no cache row consulted, none created -- while a genuinely newer version passes through and updates the memory
H3 memory ok -- the journal remembered v5 across a full stop of table and journal; the replayed old version answered :remembered_stale without touching the cache -- the table's verdict counters did not move and no row appeared -- and the genuinely newer v6 passed through and became the new last word
derive (loss): D-2 keeps the bus volatile, so a bus restart erases queued coherence jobs; 50 intents recorded and enqueued, 20 applied before the loss, the lane's queue keys flushed -- replay must re-enqueue exactly the 30 uncovered intents in seq order, and a consumer must drain them to a remembered count of 50
H4 loss ok -- the bus restart erased the queue and the journal replayed the lane back: exactly 30 uncovered intents re-enqueued in seq order under their recorded job ids, the consumer drained them, and the applied memory closed at 50 of 50 names holding their final versions
… (the compaction and the price close the record -- frozen on the module hub)

Each derive line states the expectation before the gate asserts it: the H3 derive demands :remembered_stale with no cache involvement at all, and the H4 derive computes the replay set's size from the staging itself — 50 recorded, 20 applied, so exactly 30 uncovered.

The applied table lives in the file, so it survives the table, the node, and the bus. Without this memory, an empty L1 makes every replayed message look fresh; with it, staleness is a fact about the lane, not about whichever rows happen to be resident. The drill stops the table and the journal, reopens the same file against an empty L1, and replays an old version — the gate's verbatim close: the table's verdict counters did not move and no row appeared -- and the genuinely newer v6 passed through and became the new last word.

The decision underneath: the memory check runs before the cache. apply_and_remember consults the journal first and answers :remembered_stale without an ETS lookup, because the journal's word outlives the cache's rows — the gate proves the counters do not move. This is newer-wins from B4.2 · Coherence by Mint Time given a durable floor: the comparison is the same, the version is still a name, and the only change is where the older side of the comparison survives.

D-2 keeps the bus volatile, so a bus restart erases queued coherence jobs. The rung stages exactly that — 50 intents recorded and enqueued, 20 applied before the loss, the lane's queue keys flushed — and replay selects by coverage: every intent whose name lacks an applied version at least as new. The twenty already-applied intents are not re-sent; the thirty lost ones are, in seq order, under their recorded job ids, with no acknowledgment bookkeeping anywhere on the hot path.

Recovery, after the bus came back empty, is one idempotent verb — and retention is its sibling, both safe to run on a schedule:

{:ok, %{replayed: n, deduplicated: m}} = Journal.replay(:limits_journal, conn)
{:ok, retired} = Journal.compact(:limits_journal)

Boundaries, stated honestly: the journal is per-group and per-node — it restores its own lane's obligations and claims nothing about cross-group ordering, which the lanes never promised anyway. Replay is at-least-once by construction and harmless by comparison — the same two facts, in the same order, as everywhere else in this part. The lease, the reaper, and the volatile substrate under this drill are B3.3 · The State Machine in Lua's machine; the recorded job ids the replay reuses ride B3.2 · Jobs Are Entities's admission dedup. Application on the consumer side is the engine of the sibling module — B4.3 · The Single Writer and the Ring — and the compaction predicate and the price close the module in the next dive.