Tenacity Idempotency Policy

A POLICY LAYER FOR TENACITY that requires the caller to DECLARE IDEMPOTENCY and refuses to retry a non-idempotent operation unless an idempotency key is supplied.

For Tenacity -- not affiliated with or endorsed by its authors. Tenacity is a normal runtime dependency (tenacity>=9.1.0,<10.0.0 in pyproject.toml), never forked, vendored or redistributed. All credit for Tenacity's retry engine belongs to Julien Danjou and its contributors.

THE SILENT FAILURE. A retry decorator does not know what it is retrying. Wrapped around a charge, an email send or an insert, a retry after a timeout that actually SUCCEEDED server-side produces a second charge, a second email, a second row -- and the client only ever saw one failure. Nothing raises; the duplicate is invisible from the caller's side.

SO IDEMPOTENCY IS DECLARED, NOT ASSUMED. An operation must say which it is. A non-idempotent one without an idempotency key is REFUSED rather than retried, which turns a silent duplicate into a loud configuration error at the point where someone can still fix it.

IT ALSO CLASSIFIES EXCEPTIONS retryable / terminal / unknown, so a 400 is never retried into the budget -- retrying a request the server has already rejected as malformed spends the budget that the one recoverable failure needed. And it honours a server-supplied Retry-After over any locally computed backoff: a server that has told you when to come back has better information than your exponential curve.

VERIFIED: 92 tests, measured by running the suite.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.