With the current implementation, the user can interfere with internals when using the stash. What is needed is to isolate the stash used by `Processor` internally from the stash used by the processor implementation class. 

One possibility to support that is to have 'named' stashes, for example: `stash("my-stash")` and `unstashAll("my-stash")` where the `Processor` internally uses a special named stash and the processor implementation class continues to use the 'default' stash using `stash()` and `unstashAll()` (where only the default stash is part of the public API). This would require an extension to the existing `Stash` (or another `NamedStash` trait, for example).

Potential duplicates of replayed and unstashed messages (during a restart) can easily be filtered `Processor` -internally using sequence numbers. Duplicates may arise if a processor implementation stashes a persistent message and then crashes/restarts.