Sample repo showing how the default subscriber fails at making a best-effort exactly once delivery by ignoring the fact pulled messages have expired.
./gradlew run
You may need to set GOOGLE_APPLICATION_CREDENTIALS to pick up the credentials to run as. The program attempts to clean up after itself.