Short answer: A lost booking response creates the same ambiguity as a financial write: the reservation may already exist even though the agent never received confirmation.
The booking failure mode
The provider accepts the reservation, but the response times out. The agent retries and can create another reservation for the same traveller, slot, room or resource.
Provider truth matters
Where the booking system exposes authoritative lookup or reconciliation, use it to determine whether the original reservation exists before permitting another creation call.
Claim boundary: Once does not claim universal exactly-once execution. Safety depends on stable operation identity, durable Once state, the provider integration and sufficiently authoritative provider truth. When the outcome cannot be established safely, Once can preserve uncertainty rather than assume another external execution is safe.
Use Once for this failure mode
Once is the execution-safety layer between autonomous software and supported consequential real-world side effects.
npx -y @once-agent/mcpOfficial MCP Registry identity: io.github.stringsofthemind-oss/once