How this is guaranteed
- Decided against reconstructed state. Each decision is evaluated against the entity's state as KIFF reconstructed it from its event history at decision time, not a snapshot the caller supplied. A retry on an entity that is already settled is refused because KIFF holds the current state, not because the caller declared it.
- Authority is server-enforced. A caller cannot grant its own approval: KIFF's runtime refuses self-asserted authority and enforces the proposer/approver boundary server-side, for any client in any language. The open-source framework kernel proves this boundary at compile time as the upstream basis; on Cloud the guarantee is server-enforced, it does not depend on your own process.