Currently replication slots are not dirtied when the client sends confirmation of replay. So when we checkpoint we don't bother writing out the updated slot state unless the restart_lsn has also changed as a result of the replay confirmation.
That's pretty fuss free for the walsender interface, but for the SQL interface it means that pg_logical_slot_get_changes() will repeat changes you've already seen after a restart. Even if you did a clean shutdown.
I think that's a bit ugly, and I propose a trivial change to dirty the replication slot from pg_logical_slot_get_changes_guts(...) if called in get mode not peek mode. That way it'll get written out next time we checkpoint the slot state.
The current behaviour isn't a data loss risk, and apps have to be prepared for this to happen anyway on unclean exit. So this is mostly convenience/cosmetic; I'll add it to the first 9.7 CF.