Short answer: If an AI agent sends a refund and then times out, do not assume the refund failed. Repeating the provider write blindly can refund the same logical transaction twice.
The duplicate-refund failure mode
The provider may commit the refund before the response reaches the agent. The caller sees a timeout and retries. Without stable logical identity or reconciliation, the second attempt can look like a brand-new refund.
Recovery sequence
- Reuse the same logical operation identity.
- Read durable operation state.
- Reconcile authoritative provider truth where supported.
- Replay stored results when already confirmed.
- Block another external execution if the outcome remains unsafe to determine.
Claim boundary: Once does not claim universal exactly-once execution. Safety depends on stable operation identity, durable Once state, the provider integration and sufficiently authoritative provider truth. When the outcome cannot be established safely, Once can preserve uncertainty rather than assume another external execution is safe.
Use Once for this failure mode
Once is the execution-safety layer between autonomous software and supported consequential real-world side effects.
npx -y @once-agent/mcpOfficial MCP Registry identity: io.github.stringsofthemind-oss/once