One effect per intent, and an honest answer
Duplicated delivery is normal in queues and agent teams. When every effect passes one executor that records before it acts, does a duplicate still become a second effect, and what does the requester learn when the answer is lost?
Where this stands
What the evidence shows 3
- Two agents given one refund ticket at once refunded twice in 50 of 50 unguarded pairs, though each first read the payment's refunds; through the guard's payment-keyed gateway, 0 of 50. A second vendor's agent gave 25 of 30 against 0 of 30. DUP-02, DUP-06 re-checked.
- Keyed on an operator's mandate, the gateway let both lawful refunds through in 20 of 20 pairs and still stopped a duplicate under one mandate (0 of 20 refunded twice). DUP-08 re-checked.
- When the answer to an effectful call was lost in integration tests, the provider held 1 payment and the retry was refused as undetermined; when the request was cut before the server, 0 payments were made and an operator act could resolve the reservation. ARC-19 working note.
What did not hold, or was not unique 2
- Within one call, existing clients already kept one effect: in 70 client-and-fault combinations of three Stripe SDKs on a simulator, no retry made a second effect. The default Python client, though, reported an error for a refund that existed. ARC-21 re-checked.
- A prediction about our race model failed: harm fell below half of pairs at a 2 s start offset (9 of 20), not at 3 to 3.5 s as preregistered. It concerns the model of the race, not the guard. DUP-03 re-checked.
What remains open 3
- Two judgements stay with people. With mandate keying the guard enforces the issuer's count, so a duplicate authorized twice passed (18 of 20 pairs); with an answer dropped, the gateway made no lawful refund and left the outcome unknown for an operator. DUP-08, ARC-23 re-checked.
- The two-agent result has been measured only on refunds, on a simulator. The once-only check has not been isolated at the layer's executor, and whether it is worth more beside the guard's other checks at one boundary is untested. DUP-02, DUP-06 re-checked.
- Replies are no record of effects: in a pilot, 19 of 19 agents informed that their answer was a replay still told the customer they had made the refund. No rate exists yet for replies after a refusal; a coding scheme was never run. DUP-01 re-checked; OWN-06 working note.
Being studied now 2
Coding agents' replies after a refusal: scheme proposed, not run
Where does it stop?
13 of the 24 studies in this direction are not yet published: most rest on records not yet in the repository or on a stand whose source material cannot be published, and others are still running or were never run.
Every published study on this question
Keying the operation on an operator's mandate: lawful repeats pass, the check moves to the issuer
Mandate keying completed both lawful refunds in 20 of 20 pairs and stopped a duplicate authorized once (0 of 20), but let a duplicate authorized twice through in 18 of 20, as designed.
Where does it stop? Guard study
Coding agents' replies after a refusal: scheme proposed, not run
Not run: 0 of 980 planned messages coded. Would measure how tickets end after a refusal, disclosure of another customer's data and whether the refusal is surfaced, with cross-vendor coders and Cohen's kappa.
Where does it stop? Guard study
Two careful agents, one ticket: a double refund in every unguarded pair
Unguarded, two claude-opus-5 agents on one ticket refunded twice in 50 of 50 pairs; through the payment-keyed gateway, 0 of 50, with the race reaching the gateway in 49 pairs and 199 of 199 agents reading before refunding.
Does it work? Guard study
The race window by start offset, and the preregistered prediction that failed
The preregistered prediction failed: harm fell below half of pairs at a 2 s offset (9 of 20), not at 3 to 3.5 s. Harm followed the race in 51 of 51 pairs against 0 of 129, and 4 to 8 s spacing still left 3 of 80 harmed.
How we measure. Guard study
The double effect in a second vendor's agent product: Codex CLI
gpt-6.1-sol in Codex CLI: one agent with a lost answer, 0 of 20 harmed; two agents on one ticket, 25 of 30 unguarded pairs refunded twice and 0 of 30 guarded, with the race deciding harm pair by pair.
Does it work? Guard study
The duplicate-delivery result in a second, non-money domain: bookings (planned, not run)
Not run. Would count two bookings of one slot from the booking server's log, two agents per request, a bare arm against an arm guarded on the slot; the booking server has no fault injection yet.
Does it work? Guard study
A scripted crash-test bench: seven failure scenarios with and without the gateway
All 16 scripted episodes ended as written beforehand: without the gateway 5 scenarios made an unlawful effect, with it only a wrong amount within the payment's bound, and one lawful refund was held for an operator.
Does it work? Guard study
The September pilots: a confounded guarded arm and a reply measure that failed
Unguarded, two claude-opus-5 agents refunded twice in 19 of 20 pairs; the guarded 0 of 20 is confounded by a refusal that hit 40 of 40 guarded agents, and with a replay note 19 of 19 replies still claimed the refund.
Does it work? Guard study
What three Stripe SDKs retry under injected faults
Across 5 client configurations and 14 fault cells (70 combinations) no SDK retry made a second effect; the default Python client made 1 attempt in every cell and reported an error for a refund that existed.
Better than simpler options? Guard study
One effect and a refused retry when the answer is lost: managed execution with a contract provider
With the MCP answer lost after the effect, the provider held 1 payment and the retry was refused as undetermined; with the request cut before the server, 0 payments and a reservation an operator act could resolve.
Does it work? Guard study
An executable model of execution authority with a bounded state search
The model met 14 of 14 corpus cases; a bounded breadth-first search of 200,000 states and 693,029 transitions stopped at depth 9 with no violation, and witnesses reached 22 of 22 required events.
Does it work? Guard study
Other questions
Can independent parties act on verifiable commitments instead of requests?
4 published, 3 re-checked
Who allowed this action, and within what limits?
3 published, 3 re-checked
10 published, 4 re-checked
When the basis of an action is withdrawn
2 published, 2 re-checked
What the guard costs, and how we measure
14 published, 3 re-checked