Resumable Idempotent Actions

These examples and illustrative results are independently authored teaching materials, not measured model results.

Use case

A release request times out after possible acceptance. The teaching service has verified same-key/same-payload deduplication and key-based status queries; this intent uses r42. Resume one intent instead of creating multiple releases.

Mechanism

Persist operation identity, exact payload and state before submission. Mark timeout unknown and query that key. Retry only under receiver-enforced idempotency/concurrency and valid retention, using the same intent. Accepted is not healthy; observe health checks before that transition. Without safe retry semantics reconcile rather than invent another key.

Bad example

After r42 times out, repeatedly deploy with r43/r44 and mark any successful response healthy regardless of the original effect.

Good example

Under the verified teaching contract, record r42 and exact payload first. On timeout mark unknown and query r42; accepted work continues status checks without a new intent. Safe resubmission reuses r42/payload within verified lifetime/concurrency rules. Transition submitted to healthy only after actual health checks. Uncertain delivery or unsupported retries remain unknown pending reconciliation.

Why the change matters

Timeout establishes an uncertain response, not absence of an effect. Receiver-enforced identity maps retries to one intent, while explicit states distinguish acceptance, delivery and health.

Observable expectation

In the fixture, acceptance followed by response loss is found through r42; same-key/payload replay must not create another release. No health-check record means not healthy.

Inspect actual dedup/state evidence; accepting a key is not enforcement proof. No real release occurs here.

Limits

Operation keys differ from entity natural keys, which need tenant-scoped destination uniqueness/upsert. Missing receipts do not establish non-delivery. For user questions, wait if they may have appeared and retry only confirmed pre-display failures; defaults, silence and elapsed time are not consent.