persist: exactly-once append under retries + 9 tests

idempotency.sx: persist/append-once appends at most once per (stream,
idempotency key), returning the same event on a repeat. The marker lives in the
kv facet, so idempotency holds across a restart (verified on durable).
persist/seen? check. 180/180.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/persist-on-sx.md

@@ -42,7 +42,7 @@ read models (feeds, indices, audit logs) update incrementally.
 
 ## Status (rolling)
 
-`bash lib/persist/conformance.sh` → **171/171** (Phases 1–4 complete + extensions)
+`bash lib/persist/conformance.sh` → **180/180** (Phases 1–4 complete + extensions)
 
 ## Ground rules
 
@@ -173,11 +173,19 @@ over an in-process disk (the mock-IO harness).
   `upcast-data` helper merges new `:data` fields. Addresses the schema-evolution
   trap without rewriting history.
 
+- [x] `idempotency.sx` — exactly-once append under retries: `persist/append-once`
+  keyed by a caller idempotency key (per stream), returning the same event on a
+  repeat. Marker lives in kv, so idempotency holds across restart. `seen?` check.
+
 ## Consumers (post-foundation, not in scope here)
 feed/-log, flow store, mod/audit, search index, acl grants, identity sessions all
 become `persist` log or kv. Track each migration in that subsystem's plan.
 
 ## Progress log
+- **Ext: exactly-once append (180/180).** `idempotency.sx` —
+  `persist/append-once` appends at most once per (stream, idempotency key),
+  returning the same event on a repeat; the marker lives in kv so it survives
+  restart (verified on durable). `persist/seen?` check. 9 tests.
 - **Ext: event schema evolution (171/171).** `upcast.sx` — per-type pure
   `(event -> event)` upcasters in an immutable registry; `read-upcast`/
   `project-upcast` lift legacy events to the current shape on read so