An assistant calls a tool that writes. That call can arrive twice: the model retries it, the same confirmation gets decided twice, or the process restarts mid-flight. A second arrival must not write a
The earlier pieces were about stopping things: where the boundary sits, how risk gets tiered, how a write gets undone. This one steps back and looks at a single part. What the system actually holds af
Something happened recently that I want to start with. We fixed a defect: four different kinds of "nothing" were collapsed into a single switch, so the readings couldn't tell "by design" from "broken"
After the first few pieces went out, three questions came back. They don't look related: Is tool the right unit for an AI's actions? How do you monitor a path you didn't know existed? What about a slu
The first two pieces were about stopping things — put the boundary on the execution path, then give every tool an execution policy by risk. But some of it can't be stopped. The policy allowed it, the
The previous piece, "Runtime over Prompt", argued that the security boundary belongs on the execution path — immediately before a tool call can produce a side effect. This one goes a level deeper. Onc
