Keep Duplicate Creates Visible Until Replay Protection Exists

Context

Ambiguous responses and transport retries can submit the same administrative create twice.

Decision

Document that repeated grants and corrections create additional audited records until create replay protection is implemented; repeated revocation refuses without another change.

Alternatives Considered

Add a dedicated local replay store: It introduces another mechanism beside the shared write-contract direction.

Adopt caller-assigned create identity: It is the recorded target but these routes do not implement it yet.

Consequences

Future screens need pending-submit protection, which alone does not make network retries safe. Staff must investigate and reverse duplicate grants or charges explicitly. Per-request validation ceilings do not bound cumulative repeated positive corrections.