---
id: ADR-PFM-LLM-010
title: Keep Duplicate Creates Visible Until Replay Protection Exists
product_area: platform
module: llm
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Document that repeated grants and corrections create additional audited records until create replay
  protection is implemented; repeated revocation refuses without another change.
constrains:
  - WF-PFM-LLM-008
  - WF-PFM-LLM-009
  - SVC-PFM-LLM-llm
origin: >-
  The observability record names the shared idempotency ledger as the route convention
  (services-platform:docs/proposals/llm-observability/11-decisions.md#11.1 Settled by inspection (reported));
  debt services-platform:docs/debt/llm-adjustment-idempotency.md; FND-PFM-LLM-005; Record Write Contracts W5
  (D-43).
alternatives:
  - option: Add a dedicated local replay store
    why_not: It introduces another mechanism beside the shared write-contract direction.
  - option: Adopt caller-assigned create identity
    why_not: It is the recorded target but these routes do not implement it yet.
consequences:
  - 'Future screens need pending-submit protection, which alone does not make network retries safe.'
  - Staff must investigate and reverse duplicate grants or charges explicitly.
  - Per-request validation ceilings do not bound cumulative repeated positive corrections.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: docs/llm.md (Overrides, Adjustments);
    docs/debt/llm-adjustment-idempotency.md; docs/standards/record-write-contracts.md (W5).
---

# Keep Duplicate Creates Visible Until Replay Protection Exists

## Context

Ambiguous responses and transport retries can submit the same administrative create twice.

## Decision

Document that repeated grants and corrections create additional audited records until create replay protection is implemented; repeated revocation refuses without another change.

## Alternatives Considered

Add a dedicated local replay store: It introduces another mechanism beside the shared write-contract direction.

Adopt caller-assigned create identity: It is the recorded target but these routes do not implement it yet.

## Consequences

Future screens need pending-submit protection, which alone does not make network retries safe. Staff must investigate and reverse duplicate grants or charges explicitly. Per-request validation ceilings do not bound cumulative repeated positive corrections.