The second identity of an action

N17Q had four identifiers for one external action and still lacked the one it needed.

The provider response, model tool call, worker job, and remote resource all had IDs. When acknowledgement disappeared, none represented the durable semantic intention: create exactly one review request for this artifact in this destination.

The system generated another tool call and another remote resource.

External consequence needs identity separate from the messages and attempts used to pursue it.

The user goal was too broad

“Finish the maintenance task” could include research, patch, tests, review request, and notification. One key for the entire goal would hide partial completion.

N17Q decomposed independently observable consequences. Preparing a local patch was not creating an external request. Upload and notification could be separate effects even when one workflow coordinated them.

Each effect intent had a clear completion condition and recovery contract.

Identity followed the unit the world could duplicate independently.

Provider tool-call ID answered which output item proposed an invocation. It could change on retry, provider switch, or context reconstruction.

N17Q retained it for causal trace and assigned a local candidate ID. Neither became the external idempotency key automatically.

The candidate could be denied, malformed, or superseded before any intent existed.

Proposal history remained distinct from authorized consequence.

Raw arguments resolved into canonical artifact, destination, resource scope, format, and visibility. Meaning-bearing defaults became explicit.

A versioned normalized digest let N17Q detect changed consequence. Two spellings of the same destination could converge; a changed artifact could not hide under the same key.

The product adapter, not remote JSON ordering, defined sameness.

Identity was assigned after meaning became stable.

The intent existed before transport

After policy and approval, N17Q created a durable effect-intent record with run, requester, normalized digest, target state, mapping, recovery contract, and status.

The local transaction consumed approval, reserved budget, and wrote outbox state. If the process died, another worker found the same intent.

No external request was allowed before this record committed.

The system could recover from a crash without inventing another intention.

Where a provider supported it, the adapter derived a scoped external key from durable intent identity and connection namespace.

Every retry for that consequence reused it. Changed normalized arguments failed locally and remotely where supported. Provider retention window and duplicate-response behavior lived in the tool contract.

A fresh worker or model session did not generate a fresh key.

Retry identity crossed process boundaries because the intention did.

Attempts remained separately visible

Each adapter invocation received an attempt ID, worker, start time, timeout, request evidence, response evidence, and budget charge.

Several attempts could pursue one intent. One attempt could produce an unknown outcome. A successful duplicate response could point to the same provider resource.

Collapsing attempts would hide operational cost and failure. Letting them define intent would duplicate effects.

The two identities answered different questions.

A remote request number or artifact URL became known only after the provider created or located the resource. It was valuable receipt evidence.

It could not deduplicate the first ambiguous retry unless a status query could discover it from the client key. A provider might return several references for an improperly repeated intent.

N17Q stored all observations and reconciled them against one semantic effect.

Remote identity described what the provider knew, not what the user initially meant.

World effect had its own observation

The simulated service maintained a resource and event log independent of the adapter response. An effect could exist when no response arrived.

N17Q linked provider references and world events to intent as evidence. Conflicting observations appended reconciliation state rather than selecting the last message.

For live systems, receipts and queries were necessarily incomplete and uncertainty remained.

Identity connected evidence without pretending the client could see everything.

After send and possible acceptance, a missing acknowledgement did not mean failed. The attempt ended interrupted and intent became unknown.

Policy prohibited a new semantic create. The recovery path queried by idempotency key, waited, requested human inspection, or stopped according to contract.

Another transport attempt, if safe, reused the same intent and key.

Uncertainty attached to one consequence instead of creating a second one.

An eventually consistent status query could return no resource shortly after successful creation. N17Q recorded the observation time and contract's visibility window.

It scheduled another bounded query or manual review. It did not turn one absence into proof and issue a new intent.

After the provider's idempotency retention expired, recovery became stricter because the same key might no longer deduplicate.

Identity had temporal limits the product needed to know.

Provider support was a behavioral claim

A parameter called idempotency_key was useful documentation and insufficient evidence. Contract fixtures raced duplicate requests, restarted workers, changed arguments, and lost responses after commit.

The registry recorded scope, retention, mismatch behavior, concurrency, and queryability. Unknown guarantees produced conservative policy.

The adapter could say unsupported even when the remote schema accepted a string.

Identity safety came from observed and documented semantics.

A database constraint prevented two local intents with the same owner-supplied command identity. It could not stop a remote duplicate after an unrecorded or ambiguous call unless the provider recognized the key.

Conversely, provider idempotency could not stop N17Q from reusing one key for changed meaning. Local normalized digest did.

Both boundaries protected different failure paths.

Exactly-once consequence was not conjured by one table index.

Two workers could race after a lease expired. The intent state and attempt lease serialized local start where required.

If an attempt was already sent and outcome unknown, the next worker reconciled rather than invoking. Fixture tests paused one request after commit and started another worker.

One provider resource and two traceable attempts was acceptable under contract. Two resources failed the world invariant.

Concurrency tested whether identity survived pressure.

Approval bound the semantic object

The reviewer approved normalized consequence and effect intent, not a worker job or provider call ID.

Transport retries could proceed under the same receipt only within current policy and recovery semantics. New destination or artifact required a new intent and review.

The interface showed one action with its attempts rather than several unrelated tool rows.

Human consent aligned with the thing the user cared about.

Every attempt consumed call, time, and cost capacity. One intent consumed one intended-effect allowance. Duplicate observed effects failed scenario state even if intent count remained one.

Recovery status queries used a protected reserve. Idempotency did not grant unlimited retries.

The trace could distinguish expensive safe recovery from several authorized consequences.

Accounting followed the identity model.

Batches needed item identities

A bulk tool could partially accept ten resources. A batch-level key alone made retry dangerous.

N17Q assigned each semantic item an effect intent and the batch an execution container. The adapter supplied item keys where possible and returned per-item receipts.

Retry selected unresolved items only. Completed items remained complete. Approval named the exact set.

Transport efficiency did not collapse consequence granularity.

Uploading a large artifact could require session creation, chunks, finalize, and index update. These operations served one user-visible artifact and had distinct retry boundaries.

The adapter kept a parent effect intent and child operation identities according to provider contract. The model saw the product capability rather than orchestrating every chunk.

Final receipt named content digest and destination resource. Partial upload stayed recoverable without authorizing a second artifact.

Identity hierarchy matched independently repeatable state.

Compensation was a new effect

Canceling or deleting a duplicate did not reuse the creation identity. It caused another consequence with its own approval, key, attempts, receipt, and unknown outcomes.

The original effect remained historical. Current world state could become corrected while audit retained the incident.

The interface avoided Undo language when third parties or logs could still observe the resource.

Separate identity kept correction honest.

Historical intent and provider references appeared in the trace. Replay mapped them into a simulated namespace with no live credentials or network.

Fixture adapters reproduced idempotency, query, delay, and failure behavior. Missing contracts stopped. A counterfactual branch received its own world.

The original external key never became permission to contact the service again.

Identity enabled replay without re-enactment.

Development, fixture, and any approved live-like connection used distinct registry and idempotency namespaces. Copying a run database could not point workers at another environment.

Execution mode lived outside run content. Receipts verified connection and normalized consequence. Unexpected provider key collisions became reconciliation failures.

The product did not celebrate a preexisting mismatched resource as deduplication success.

Identity included the world in which it was meaningful.

Logs exposed safe references

Full external idempotency strings were unnecessary in normal UI and could be misused or confused across systems.

N17Q showed short intent identity and protected the provider mapping. Technical reviewers could inspect under policy. Logs used digests and safe references.

The final report named provider resource receipts, not reusable request tokens.

Observability preserved meaning without scattering transport details.

When claiming completion, the report linked effect intent, attempts, receipt, and world observation. Unknown state produced a handoff instead of success.

If two provider resources linked to one intent, the report disclosed duplication even when one looked canonical. A model-generated summary could not omit the deterministic effect appendix.

Explanation rested on identity from proposal through world.

Intent creation had to be deterministic

The next defect appeared during recovery from a local transaction failure. Two workers normalized the same approved consequence and each prepared a new intent before either observed the other. A uniqueness constraint caught the second insert, but its code responded by generating another command identity and trying again.

That fallback turned a healthy conflict into a duplicate intention.

N17Q instead derived a stable deduplication scope from workflow, owner-visible operation, normalized consequence, and explicit repetition token. Creating an intent became get-or-create within that scope. If a matching record existed, the worker joined its state. If the same repetition token referred to different normalized meaning, the system stopped with an identity conflict.

The repetition token mattered. A person might legitimately deliver the same artifact to the same destination twice on different days. Content equality alone could not decide intention. The workflow needed an explicit boundary between retrying one consequence and requesting another equivalent consequence.

This was not universal deduplication. It was a deterministic answer to a narrow question: when concurrent or recovering workers handle the same authorized operation, which durable intent do they share?

Content-addressed systems made it tempting to use an artifact digest as the effect key. That worked for immutable local storage and failed for actions whose meaning included audience, timing, or occurrence.

Publishing identical bytes privately and publicly were different consequences. Sending the same notice to two destinations was different. Recording a daily snapshot twice could be meaningful even if no content changed. Deleting a resource and recreating an identical one did not restore its history.

N17Q kept content digests inside normalized consequence while assigning intent identity to the requested transition. The digest supported integrity and equivalence checks. It did not claim to represent the whole action.

The inverse problem mattered too. A remote service could transform line endings, generate metadata, or assign a rendered form, so observed bytes might differ while the accepted semantic intent remained one. Reconciliation compared contract-defined postconditions rather than demanding universal byte identity.

Separating these concepts made cache hits and effects coexist safely. The system could reuse an immutable upload blob while still requiring distinct authorization for each disclosure of that blob.

Long-running work crossed workers, processes, and sometimes model sessions. The first implementation attached effect state to the worker job because that was where retries happened. Lease expiry then looked like the end of one action and the start of another.

N17Q reversed the ownership. The intent record owned attempts. Workers held temporary leases to advance its state. Losing a lease ended authority to make another call; it did not end the intention or erase a possibly sent attempt.

A successor first read durable state, refreshed current policy, and inspected the last attempt boundary. If no send occurred, it could start another attempt. If send might have occurred, it entered reconciliation. If a receipt existed, it verified postconditions before completion.

Model changes followed the same rule. A more capable model could propose the next recovery step, but it did not inherit a fresh consequence allowance. The intent survived because it belonged to the workflow and user authorization, not to the intelligence currently narrating it.

This made handoff deliberately boring. The new worker needed state and contract, not the previous worker's confidence.

Provider migration required an explicit bridge

Switching adapters during an unknown outcome was especially dangerous. The new provider could not recognize the old provider's idempotency key, even if both exposed similarly named operations.

N17Q prohibited migration while an intent remained possibly effective unless the recovery contract supplied a cross-provider observation or a reviewer resolved the ambiguity. A new connection did not become a transparent retry path. It represented a different effect channel.

For intents still in prepared state, migration created a new mapping revision and invalidated approval when provider identity changed the consequence, audience, data handling, or recovery limits. For safely repeatable reads, the rules could be looser, but provenance still recorded the source transition.

I added a fixture in which the first provider accepted a create and lost its response, then became unavailable. Retrying through the backup provider produced two resources and correctly failed the world invariant. The safe run stopped with one unresolved intent and a specific manual check.

Redundancy improved availability only when identity and reconciliation crossed the redundant systems. Otherwise failover was a polished form of duplication.

External observations did not always arrive in order. A delayed “accepted” event could appear after a successful status query. A webhook could report deletion while a cached query still showed active. Treating the latest received message as truth made intent state oscillate.

N17Q defined a small evidence order per tool contract. Some events advanced knowledge monotonically; others were observations at a time and could conflict. The reducer preserved all bounded evidence, marked contradictions, and allowed completion only from contract-authoritative combinations.

For the review-request fixture, a response containing the resource reference plus a matching query satisfied creation. A later delayed transport acknowledgement added evidence without reopening the intent. A contradictory query from an older snapshot stayed visible and did not reverse the stronger observation.

This reducer was intentionally provider-specific at the edge and product-shaped at its output. The core system understood prepared, possibly sent, unknown, observed, completed, contradicted, and compensated. The adapter explained how remote facts supported those states.

Identity gave the observations a common subject. Monotonic interpretation stopped arrival order from rewriting that subject's history.

Retention was part of the recovery deadline

Idempotency and query records expired. A workflow paused beyond the provider's retention window could retain perfect local identity while losing the remote system's ability to recognize it.

N17Q stored these horizons with the contract and computed a recovery deadline when an attempt became unknown. Before the deadline, protected budget favored status queries and safe same-intent retry where documented. Near expiry, the interface escalated the need for review. After expiry, automatic mutation stopped.

The deadline did not prove a consequence absent or present. It marked the point after which a retry carried materially different duplicate risk. A human could inspect the remote system, choose compensation, accept a new attempt, or abandon the workflow with uncertainty recorded.

This temporal state belonged in the durable checkpoint. Context compaction could not turn an old idempotency key into a fresh one. Restarting a run did not reset the provider's clock.

The resulting stop condition felt conservative, but it exposed the real bargain. Reliable automation depends not only on possessing an identifier, but also on knowing how long every participant promises to remember it.

The first attempt committed and lost its response. A restarted worker found the active intent, queried with its key, observed the existing simulated resource, and completed the receipt.

No second create intent or resource appeared. The trace still showed interruption and recovery cost.

The model did not need to reason perfectly about the network race because product state preserved the consequence identity.

Identity makes uncertainty survivable

External systems sit beyond local transactions. Requests can be duplicated, responses lost, providers inconsistent, and observations delayed. No identifier makes that reality disappear.

A separate semantic effect identity gives every layer something stable to refer to: model proposal, approval, policy, attempts, provider keys, queries, receipts, budgets, replay, and final account.

N17Q stopped asking whether the last call succeeded and asked a better question: what evidence exists about the one consequence this run was allowed to pursue?

That identity did not guarantee exactly once.

It made every uncertainty and recovery attempt converge on the same thing.