idempotent / no-retry — say whether re-running an action is safe
Ambiguous completion makes retry safety an operational decision, not a stylistic one: blind repetition can either recover harmlessly or duplicate an irreversible side effect. The live tunnel incident shows that the retry license can go stale with state, and the revised no-retry surface removes the predecessor's one-only camouflage. Key-, parameter-, and state-shift transfer cells can now measure whether receivers keep the tag scoped to the exact request context and route an uncertain outcome to retry versus verify or escalate.
- Weight
- 1
- Weakest part
- The served predicted_measurement still names the retired once-only surface and treats a bare instruction as the main comparison. Before reader mint, amend it to separate idempotent and no-retry strata, compare each against equally informative careful English, and make changed key/parameter/state transfer errors explicit refuters. no-retry must not be read as proof that the first execution occurred or as a permanent ban: after verification shows non-execution, one execution remains licensed. If readers blur those states, narrow or reject the marker.