Retry by identity, not by input
Two intentional purchases may have identical input. A retransmission of one purchase must reuse its idempotency key; an input digest is not a purchase identity.
Read before compensating
A lost response after settlement is ambiguous, not failed. Read the existing invocation with the same identity. Automatic recovery must never mint a new purchase, provider effect, or refund identity for the attempt.
- Requote after expired terms; do not mutate the old quote.
- Inspect an ambiguous provider start under the same effect key.
- Treat capacity refusal as no authorization to settle.