States
The server owns lifecycle enforcement. A client must treat a successful API response and the returned state as authoritative rather than updating local state optimistically.
Typical flow
Event handling
Persist the contract ID, state, update timestamp, and last processed event ID. Notifications can be duplicated or arrive after a reconnect, so handlers must be idempotent and should re-fetch the contract before taking an irreversible action.Visibility
Visibility is not a substitute for parameter protection. Do not put secrets in a public contract.