google play pub/sub rtdn at least once unordered delivery

At-least-once and unordered, always -- exactly-once delivery is pull-only

Cloud Pub/Sub push subscriptions -- what RTDN uses -- offer no ordering guarantee and no exactly-once delivery; both exist only on pull subscriptions (decision 3).

This is one of the things Play Billing Machinery already handles. Sell subscriptions in your Android app on the Billing Library version Google requires from 31 August 2026.

Buy for $1493 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

Code that assumes a notification arrives once, in order, breaks on Google's own documented behavior: Pub/Sub "might redeliver a message even after an acknowledgment request... returns successfully," and exactly-once delivery explicitly does not support push subscriptions -- which is what RTDN always uses. A redelivered or reordered notification that isn't handled as such corrupts entitlement state exactly when a retry or a burst of concurrent events happens.

Why this one is easy to get wrong

Delivery looks reliable and ordered in almost every manual test, because redelivery and reordering are probabilistic events tied to Google's infrastructure, not something a developer can trigger on demand. There's no error to notice locally -- the notification just quietly arrives twice, or out of order, sometime after the code shipped.

What you get instead

Three layers, all implemented: dedupe on messageId (Google's own recommendation, and it protects Play API quota); a second idempotency check on (purchaseToken, notificationType, eventTimeMillis) because publisher-side duplicates arrive with different messageIds; and re-reading state from the Play API on every notification so an out-of-order pair converges on whichever arrives last, guarded separately by the staleness check.

Source: ARCHITECTURE.md decision 3 — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 33 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

3 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $149 14-day refund if verify.sh fails →