A customer-support agent loop can retry tools, and a timeout can hide a successful feature flag change. Without idempotency, those retries can produce duplicate writes. That constraint changes the design.

TL;DR: send an explicit desired state instead of an invert command, reuse one operation ID across every retry, and observe attempts separately from committed mutations. Measure latency and model cost at the agent-loop boundary. Count a flag mutation only when state actually changes. This preserves failure evidence without turning retry noise into fake writes.

How should feature flag idempotency stop retries from producing duplicate writes?

The agent asks to enable a rollout cohort. Its backend commits the request, but the response misses the caller's deadline. A retry then arrives.…