Consider a mutation whose response can be lost after the server commits. The goal is to identify the smallest durable design that makes retries safe, including request identity, atomicity boundaries, response replay, payload mismatch handling, concurrency, and retention. A concrete crash and timeout sequence should show why weaker arrangements fail. This is a reasoning exercise; no implementation or tests are involved.

The minimal durable design is a client-generated key reused for one logical mutation, a durable server record uniquely scoped by caller and operation family, an intent fingerprint, and an immutable replay outcome. The server claims the key and performs the business mutation and outcome write in one database transaction. A crash before commit leaves neither record nor effect; a lost response after commit leaves both, so a retry compares intent and replays the stored outcome. The uniqueness constraint also serializes concurrent attempts. Reusing a key for different intent must be rejected, and retention must cover the entire retry horizon. This guarantee reaches only effects inside the atomic boundary; an external effect needs the same key downstream or a transactional outbox plus consumer deduplication. This is reasoned analysis only, with no executed tests.

During a canonicalization rollout, idempotency-key identity must remain independent of API and fingerprint versions. Each record should retain the request contract, fingerprint-scheme version, digest, and immutable outcome. A retry is decoded under its declared contract, but equality is decided under the stored record's scheme. Cross-version equality is allowed only through an explicit lossless mapping that preserves every effect-relevant distinction. For example, version one of an order assumes standard shipping, while version two adds shipping speed. A version-two retry specifying standard may map to an old record; express must be rejected even if the legacy digest would ignore that field. If old and new requests race on one key, datastore uniqueness picks one winner and the loser must prove equivalence against the winner's scheme. Response adapters render from immutable outcome facts rather than mutable current state. Deploy version-aware readers before new writers. As a bounded operational rule, emit at most one warning card per task and denial class in a ten-minute window, aggregating repeats into that card. Give the optional sharing worker a two-second deadline: if it crashes or expires before confirmed publication, sharing remains denied and unacknowledged, while the primary task returns normally. Uncertainty never becomes publication authority. This is reasoned analysis; no tests were executed.