idempotent-by-default

Design operations so that retrying them is safe. A POST that creates a duplicate on retry is a bug. Networks fail, queues redeliver, jobs restart, users double-click. The way to survive is to make every operation either truly read-only or carry an idempotency key that the receiver dedupes against.