idempotent-redundancy

关于将冗余路径设计为幂等以避免循环和数据损坏的规范。

在加冗余路径（fallback、重试、多条链路）时要保证操作是幂等的，意思是同一操作跑多次不会重复写入或引发循环，避免数据损坏和无限重试。适用于分布式系统、同步对账和降级逻辑设计，作为避免不一致和回环的规范。常见做法包括先检查再写、使用原子写入/重命名和让对账步骤可重复安全运行。

# Idempotent Redundancy

When adding redundant paths (fallbacks, belt-and-suspenders), make them idempotent.

## Pattern

Redundancy without idempotency causes loops, churn, or data corruption.

## DO
- Use `_is_merge: true` for Braintrust updates
- Check if value exists before writing (fallback only if missing)
- Use atomic write/rename for file operations
- Make reconciliation steps safe to run repeatedly

## DON'T
- Write unconditionally in fallback paths
- Allow multiple writers to overwrite each other
- Fire "repair" actions that can trigger more repairs

## Source Sessions
- a541f08a: "Redundancy is good only if idempotent"
- 1c21e6c8: "Belt-and-suspenders, but make it idempotent"
- 6a