diff --git a/PLAN.md b/PLAN.md
index 05a58389..608d78fa 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -68,7 +68,7 @@ Landed so far:
 |---|---|---|
 | 0 | #69 | Nothing |
 | 1 | #71 | Nothing |
-| 2 | #73 | An attempt key on every operation; an uncertain external effect blocking reassignment; waiting on an outside event as a state; the record's remaining fields (`parent`, `scores`, `implements`, `reversibility`, `artifacts_touched`, `policy_context`) |
+| 2 | #73, and attempt keys for a claim and a completion in the pull request after #74 | An attempt key on the other operations; an uncertain external effect blocking reassignment; waiting on an outside event as a state; the record's remaining fields (`parent`, `scores`, `implements`, `reversibility`, `artifacts_touched`, `policy_context`) |
 | 3 | the pull request after #73 | A suite that gates a version of a definition; the data scope enforced; a definition required by default, once the system's own filings name one; tools offered a few at boot and the rest by search |
 
 What stays unbuilt after these, and stays on README's list: federation across domains, authentication of people, logprob-based drift, and accelerator time, which only a gateway can count. So do the items on that list that need another machine or an outside service more than they need code: the limits on re-enactment, harness settings and decomposition templates in the platform domain, bytes stored and resource limits on the sandbox, the authoring of agent definitions, the search tool against its live provider, a harness under Seatbelt on a Mac, and the Gofannon bridge against a live deployment, whose agents make model calls that the egress does not meter.
diff --git a/README.md b/README.md
index 2b102984..f704619b 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,8 @@ two weeks. It is also the reason that none of it is the production shape.
   - CPU or memory limits on the sandbox
 - **The task record, in part.** A claim has a generation, and the ledger refuses a
   holder that gives an earlier one. A task can be `blocked` on a task that it depends on.
-  These parts are not built: an attempt key for each operation, a block on a new claim
+  A claim and a completion can carry an attempt key. These parts are not built: an
+  attempt key for the other operations, a block on a new claim
   while an external effect is uncertain, and a `blocked` state for a task that waits on an
   outside event. The generation does not prove who the caller is.
 - **Task definitions, in part, and autonomy levels.** A task can name a task definition.
diff --git a/crates/ledger/src/lib.rs b/crates/ledger/src/lib.rs
index caf4410b..e5c635d9 100644
--- a/crates/ledger/src/lib.rs
+++ b/crates/ledger/src/lib.rs
@@ -83,6 +83,14 @@ pub enum Error {
         /// The generation of the claim in force.
         current: u64,
     },
+    /// The attempt key was used before, and that attempt is over or was for something
+    /// else: the same key does not claim or complete a second time. The refusal names
+    /// the key and nothing of what it was used for.
+    #[error("the attempt key {key} was used before, and that attempt is over")]
+    AttemptSpent {
+        /// The key.
+        key: String,
+    },
     /// Another connection holds the write-ahead log, so text just removed may still be
     /// in it. Run the operation again.
     #[error("ledger: another connection holds the log: {0}")]
@@ -290,6 +298,21 @@ pub struct Claim {
     pub generation: u64,
 }
 
+/// Who claims, and the attempt key it gave: a retry of the same claim carries the same
+/// key, so it is the same claim and not a second one.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Claimant<'a> {
+    pub(crate) holder: &'a str,
+    pub(crate) attempt: Option<&'a str>,
+}
+
+/// What a backend's `claim_next` did: claimed a task, or found the claim the caller's
+/// attempt key made before, with its generation.
+pub(crate) enum Taken {
+    New(String),
+    Again { id: String, generation: u64 },
+}
+
 /// A holder and the generation of the claim it acts under.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Held<'a> {
@@ -381,6 +404,12 @@ enum Event {
         holder: String,
         #[serde(with = "time::serde::rfc3339")]
         until: OffsetDateTime,
+        /// The generation this claim got. Absent from a claim of an older ledger.
+        #[serde(default)]
+        generation: u64,
+        /// The attempt key the caller gave, when it gave one.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        attempt: Option<String>,
     },
     /// A claim of a named task the ledger refused, and why. Changes nothing; it is the
     /// record that someone tried.
@@ -406,6 +435,9 @@ enum Event {
     },
     Completed {
         handoff: String,
+        /// The attempt key the caller gave, when it gave one.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        attempt: Option<String>,
     },
     Invalidated {
         reason: String,
@@ -498,8 +530,9 @@ fn redact_event(id: &str, payload: &str, redaction: &Redaction) -> Result<Option
         Event::HandoffLeft { handoff } if handoff != redaction.reason => Event::HandoffLeft {
             handoff: redaction.reason.clone(),
         },
-        Event::Completed { handoff } if handoff != redaction.reason => Event::Completed {
+        Event::Completed { handoff, attempt } if handoff != redaction.reason => Event::Completed {
             handoff: redaction.reason.clone(),
+            attempt,
         },
         Event::LateHandoff {
             holder,
@@ -977,14 +1010,84 @@ impl Ledger {
         manifest: &[String],
         handling: Label,
     ) -> Result<Option<Claim>, Error> {
+        let who = Claimant {
+            holder,
+            attempt: None,
+        };
+        self.claim_next_as(domain, who, lease, manifest, handling)
+            .await
+    }
+
+    /// [`Ledger::claim_next`] under an attempt key. A caller that did not hear the answer
+    /// asks again with the same key: while the claim that key made in this domain is in
+    /// force for this caller, it gets that claim back, and no second task. The key is
+    /// looked up in the transaction that claims, so two callers with one key make one
+    /// claim.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::AttemptSpent`] when the key's claim is over, or is not one this caller
+    /// could have made; a database error.
+    pub async fn claim_next_once(
+        &mut self,
+        domain: &str,
+        holder: &str,
+        lease: Duration,
+        (manifest, handling): (&[String], Label),
+        attempt: &str,
+    ) -> Result<Option<Claim>, Error> {
+        let who = Claimant {
+            holder,
+            attempt: Some(attempt),
+        };
+        self.claim_next_as(domain, who, lease, manifest, handling)
+            .await
+    }
+
+    /// The claim an attempt key made, if it is still in force and is one this caller
+    /// could hold: its holder, its generation and a live lease, within the caller's
+    /// handling and manifest. Anything else is a key that is spent.
+    async fn same_claim(
+        &self,
+        (id, generation): (&str, u64),
+        who: Claimant<'_>,
+        manifest: &[String],
+        handling: Label,
+    ) -> Result<Claim, Error> {
+        let task = self.get(id).await?;
         let now = self.now();
-        let until = now + lease;
-        let claimed = on_backend!(&mut self.backend, db => db.claim_next(domain, now, holder, until, manifest, handling))?;
-        if let Some(id) = &claimed {
-            self.trace("claimed", id).await;
+        let in_force = task.status == Status::Claimed
+            && task.generation == generation
+            && task.holder.as_deref() == Some(who.holder)
+            && task.lease_until.is_some_and(|t| t >= now)
+            && task.spec.classification <= handling
+            && task.spec.requirements.iter().all(|r| manifest.contains(r));
+        match (in_force, task.lease_until) {
+            (true, Some(lease_until)) => Ok(Claim {
+                generation: task.generation,
+                task,
+                lease_until,
+            }),
+            _ => Err(Error::AttemptSpent {
+                key: who.attempt.unwrap_or_default().to_string(),
+            }),
         }
-        match claimed {
-            Some(id) => {
+    }
+
+    async fn claim_next_as(
+        &mut self,
+        domain: &str,
+        who: Claimant<'_>,
+        lease: Duration,
+        manifest: &[String],
+        handling: Label,
+    ) -> Result<Option<Claim>, Error> {
+        let now = self.now();
+        let until = now + lease;
+        let taken = on_backend!(&mut self.backend, db => db.claim_next(domain, now, who, until, manifest, handling))?;
+        match taken {
+            Some(Taken::New(id)) => {
+                self.trace("claimed", &id).await;
                 let task = self.get(&id).await?;
                 Ok(Some(Claim {
                     generation: task.generation,
@@ -992,6 +1095,10 @@ impl Ledger {
                     lease_until: until,
                 }))
             }
+            Some(Taken::Again { id, generation }) => self
+                .same_claim((&id, generation), who, manifest, handling)
+                .await
+                .map(Some),
             None => Ok(None),
         }
     }
@@ -1013,7 +1120,12 @@ impl Ledger {
     ) -> Result<Claim, Error> {
         let now = self.now();
         let until = now + lease;
-        let claimed = on_backend!(&mut self.backend, db => db.claim(id, now, holder, until, manifest, handling));
+        let who = Claimant {
+            holder,
+            attempt: None,
+        };
+        let claimed =
+            on_backend!(&mut self.backend, db => db.claim(id, now, who, until, manifest, handling));
         if matches!(claimed, Err(Error::WrongState { .. })) {
             self.record_refusal(id, holder, now).await?;
         }
@@ -1099,6 +1211,16 @@ impl Ledger {
     ///
     /// [`Error::NotFound`], [`Error::NotHolder`], or [`Error::WrongState`].
     pub async fn complete(&mut self, id: &str, by: Held<'_>, handoff: &str) -> Result<Task, Error> {
+        self.complete_keyed(id, by, handoff, None).await
+    }
+
+    async fn complete_keyed(
+        &mut self,
+        id: &str,
+        by: Held<'_>,
+        handoff: &str,
+        attempt: Option<&str>,
+    ) -> Result<Task, Error> {
         let now = self.now();
         let task = self.get(id).await?;
         if task.status != Status::Claimed {
@@ -1110,12 +1232,38 @@ impl Ledger {
         }
         let completed = Event::Completed {
             handoff: handoff.to_string(),
+            attempt: attempt.map(str::to_string),
         };
         self.append_held(id, now, by, &completed).await?;
         self.unblock_dependents(id).await?;
         self.get(id).await
     }
 
+    /// [`Ledger::complete`] under an attempt key. A caller that did not hear the answer
+    /// asks again with the same key and the same handoff, and gets the completed task
+    /// back: the task is completed once.
+    ///
+    /// # Errors
+    ///
+    /// As [`Ledger::complete`]; [`Error::AttemptSpent`] when the key completed this task
+    /// with another handoff.
+    pub async fn complete_once(
+        &mut self,
+        id: &str,
+        by: Held<'_>,
+        handoff: &str,
+        attempt: &str,
+    ) -> Result<Task, Error> {
+        let before = on_backend!(&self.backend, db => db.completed_under(id, attempt))?;
+        match before {
+            Some(with) if with == handoff => self.get(id).await,
+            Some(_) => Err(Error::AttemptSpent {
+                key: attempt.to_string(),
+            }),
+            None => self.complete_keyed(id, by, handoff, Some(attempt)).await,
+        }
+    }
+
     /// Close a task its continuation finished: the continuation `by` resumed it and is
     /// complete with `handoff`, so the task is too, with the same handoff. Only a task
     /// nobody holds: one released when its run delegated, or whose lease ran out. A
@@ -1149,6 +1297,7 @@ impl Ledger {
             now,
             &Event::Completed {
                 handoff: handoff.to_string(),
+                attempt: None,
             },
         )
         .await?;
@@ -1782,6 +1931,10 @@ mod tests {
     }
 
     on_both! {
+        a_claim_asked_twice_under_one_key_is_one_claim,
+        a_key_gives_no_task_above_the_caller_s_handling,
+        two_connections_under_one_key_make_one_claim,
+        a_completion_asked_twice_under_one_key_is_one_completion,
         of_two_tasks_of_one_priority_the_one_filed_first_is_claimed_first,
         a_lease_that_ran_out_half_a_second_ago_is_lost_to_claim_next,
         a_dependent_in_another_domain_is_opened_and_retriaged_too,
@@ -2217,6 +2370,184 @@ mod tests {
         );
     }
 
+    fn is_spent<T>(r: &Result<T, Error>) -> bool {
+        matches!(r, Err(Error::AttemptSpent { .. }))
+    }
+
+    async fn next_once(l: &mut Ledger, holder: &str, key: &str) -> Result<Option<Claim>, Error> {
+        l.claim_next_once("dom-a", holder, mins(30), (&[], Label::Restricted), key)
+            .await
+    }
+
+    /// A caller that did not hear the answer asks again with the same key.
+    async fn a_claim_asked_twice_under_one_key_is_one_claim(b: &Site) {
+        let (mut l, now) = b.ledger().await;
+        let first = admitted(&mut l, spec("First")).await;
+        // filed a second later, so the queue's order between the two is by time
+        *now.lock().unwrap() = T0 + Duration::seconds(1);
+        let second = admitted(&mut l, spec("Second")).await;
+        let c = next_once(&mut l, "s1", "key-1").await.unwrap().unwrap();
+        let again = next_once(&mut l, "s1", "key-1").await.unwrap().unwrap();
+        assert_eq!(
+            (again.task.id.as_str(), again.generation),
+            (c.task.id.as_str(), 1)
+        );
+        assert_eq!(c.task.id, first.id);
+        assert_eq!(
+            l.get(&second.id).await.unwrap().status,
+            Status::Open,
+            "no second task"
+        );
+        a_key_is_its_holder_s_and_its_domain_s(&mut l, &second).await;
+        a_key_whose_claim_is_over_claims_nothing(&mut l, &first, &now).await;
+    }
+
+    /// The key gives its claim back only to who could have made it, and the refusal says
+    /// nothing of the task.
+    async fn a_key_is_its_holder_s_and_its_domain_s(l: &mut Ledger, second: &Task) {
+        let other_holder = next_once(l, "s2", "key-1").await;
+        assert!(is_spent(&other_holder));
+        let said = other_holder
+            .err()
+            .map(|e| e.to_string())
+            .unwrap_or_default();
+        assert!(!said.contains("task-"), "{said}");
+        // a caller whose handling or manifest the task is beyond is no holder of it
+        let low = l
+            .claim_next_once("dom-a", "s1", mins(30), (&[], Label::Public), "key-1")
+            .await;
+        assert!(low.is_ok(), "the task is public: {low:?}");
+        // the same key in another domain is another key
+        let elsewhere = l
+            .claim_next_once("dom-b", "s1", mins(30), (&[], Label::Restricted), "key-1")
+            .await
+            .unwrap();
+        assert!(
+            elsewhere.is_none(),
+            "nothing to claim there, and no claim of dom-a"
+        );
+        // a new key is a new claim
+        let other = next_once(l, "s1", "key-2").await.unwrap().unwrap();
+        assert_eq!(other.task.id, second.id);
+    }
+
+    async fn a_key_whose_claim_is_over_claims_nothing(
+        l: &mut Ledger,
+        first: &Task,
+        now: &Mutex<OffsetDateTime>,
+    ) {
+        // the claim the key made is lost, and its holder claims the task again without
+        // the key: a live lease of the same name, at the next generation
+        *now.lock().unwrap() = T0 + mins(31);
+        // a lapsed lease alone ends the claim: the key gets nothing, and no new task
+        assert!(is_spent(&next_once(l, "s1", "key-1").await));
+        let reclaimed = claim(l, &first.id, "s1", mins(30)).await.unwrap();
+        assert_eq!(reclaimed.generation, 2);
+        assert!(is_spent(&next_once(l, "s1", "key-1").await));
+        // and a rebuild keeps what the key means
+        l.rebuild().await.unwrap();
+        assert!(is_spent(&next_once(l, "s1", "key-1").await));
+    }
+
+    /// A restricted task claimed under a key is not handed to a caller below it.
+    async fn a_key_gives_no_task_above_the_caller_s_handling(b: &Site) {
+        let (mut l, _) = b.ledger().await;
+        let mut secret = spec("Rotate the key");
+        secret.classification = Label::Restricted;
+        let secret = admitted(&mut l, secret).await;
+        let c = next_once(&mut l, "s1", "key-1").await.unwrap().unwrap();
+        assert_eq!(c.task.id, secret.id);
+        let capped = l
+            .claim_next_once("dom-a", "s1", mins(30), (&[], Label::Public), "key-1")
+            .await;
+        assert!(
+            is_spent(&capped),
+            "{:?}",
+            capped.map(|c| c.map(|c| c.task.id))
+        );
+        // nor to a caller that lacks what the task requires
+        let mut needs = spec("Train the model");
+        needs.requirements = vec!["gpu".into()];
+        let needs = admitted(&mut l, needs).await;
+        let gpu = ["gpu".to_string()];
+        let with = l
+            .claim_next_once("dom-a", "s1", mins(30), (&gpu, Label::Restricted), "key-2")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(with.task.id, needs.id);
+        assert!(is_spent(&next_once(&mut l, "s1", "key-2").await));
+    }
+
+    /// Two ledgers over the same tables, one caller asking both with one key at the same
+    /// time: one claim, and no second task.
+    async fn two_connections_under_one_key_make_one_claim(b: &Site) {
+        let (mut l1, _) = b.ledger().await;
+        let (mut l2, _) = b.ledger().await;
+        for round in 1..=15 {
+            admitted(&mut l1, spec("One")).await;
+            admitted(&mut l1, spec("Other")).await;
+            let key = format!("key-{round}");
+            let (c1, c2) = tokio::join!(
+                next_once(&mut l1, "s1", &key),
+                next_once(&mut l2, "s1", &key),
+            );
+            let (c1, c2) = (c1.unwrap().unwrap(), c2.unwrap().unwrap());
+            assert_eq!(c1.task.id, c2.task.id, "round {round}");
+            let held = l1.list("dom-a", Status::Claimed).await.unwrap();
+            assert_eq!(held.len(), round, "one claim a round");
+        }
+    }
+
+    async fn a_completion_asked_twice_under_one_key_is_one_completion(b: &Site) {
+        let (mut l, _) = b.ledger().await;
+        let t = admitted(&mut l, spec("Once")).await;
+        let other = admitted(&mut l, spec("Other")).await;
+        claim(&mut l, &t.id, "s1", mins(30)).await.unwrap();
+        claim(&mut l, &other.id, "s1", mins(30)).await.unwrap();
+        let before = l.event_count().await.unwrap();
+        let done = l
+            .complete_once(&t.id, held("s1", 1), "mem-a-h", "done-1")
+            .await
+            .unwrap();
+        let again = l
+            .complete_once(&t.id, held("s1", 1), "mem-a-h", "done-1")
+            .await
+            .unwrap();
+        assert_eq!(again, done);
+        assert_eq!(l.event_count().await.unwrap(), before + 1, "one event");
+        a_key_completes_once_and_with_one_handoff(&mut l, &t, &other).await;
+    }
+
+    async fn a_key_completes_once_and_with_one_handoff(l: &mut Ledger, t: &Task, other: &Task) {
+        // asked again with another handoff, it is not the same completion
+        let changed = l
+            .complete_once(&t.id, held("s1", 1), "mem-a-other", "done-1")
+            .await;
+        assert!(is_spent(&changed));
+        assert_eq!(
+            l.get(&t.id).await.unwrap().handoff.as_deref(),
+            Some("mem-a-h")
+        );
+        // a key is a task's: the same words complete another task as a first attempt
+        let elsewhere = l
+            .complete_once(&other.id, held("s1", 1), "mem-a-h", "done-1")
+            .await
+            .unwrap();
+        assert_eq!(elsewhere.status, Status::Done);
+        // a claim's key is no completion's
+        let claimed_under = admitted(l, spec("Third")).await;
+        let c = next_once(l, "s1", "both").await.unwrap().unwrap();
+        assert_eq!(c.task.id, claimed_under.id);
+        l.complete_once(&c.task.id, held("s1", 1), "mem-a-h", "both")
+            .await
+            .unwrap();
+        // without a key, a second completion is refused as it was
+        assert!(is_wrong_state(
+            &l.complete(&t.id, held("s1", 1), "mem-a-h").await
+        ));
+    }
+
     /// The lease ends on a whole second and the clock stands a half second after: the two
     /// times, as text, sort the other way.
     async fn a_lease_that_ran_out_half_a_second_ago_is_lost_to_claim_next(b: &Site) {
diff --git a/crates/ledger/src/postgres.rs b/crates/ledger/src/postgres.rs
index 7139c8c4..6d68de06 100644
--- a/crates/ledger/src/postgres.rs
+++ b/crates/ledger/src/postgres.rs
@@ -17,8 +17,9 @@
 //! connections cannot both win the same task.
 
 use crate::{
-    check_holder, claimable, parse_time, Error, Event, Held, PromotionRecord, PromotionSpec,
-    RawPromotion, RawTask, Redaction, Status, Task, TaskSpec, PROMOTION_COLUMNS, TASK_COLUMNS,
+    check_holder, claimable, parse_time, Claimant, Error, Event, Held, PromotionRecord,
+    PromotionSpec, RawPromotion, RawTask, Redaction, Status, Taken, Task, TaskSpec,
+    PROMOTION_COLUMNS, TASK_COLUMNS,
 };
 use dm_core::Label;
 use std::collections::HashMap;
@@ -428,6 +429,32 @@ impl Db {
         })
     }
 
+    /// The handoff a task was completed with under an attempt key, if it was.
+    pub(crate) async fn completed_under(
+        &self,
+        task: &str,
+        key: &str,
+    ) -> Result<Option<String>, Error> {
+        let s = self.schema_of_task(task).await?;
+        let row = self
+            .client
+            .query_opt(
+                &format!(
+                    "SELECT payload FROM {s}.events
+                     WHERE task_id = $1 AND kind = 'completed'
+                       AND payload::jsonb ->> 'attempt' = $2
+                     ORDER BY seq LIMIT 1"
+                ),
+                &[&task, &key],
+            )
+            .await?;
+        let payload: Option<String> = row.map(|r| r.try_get(0)).transpose()?;
+        Ok(match payload.map(|p| Event::parse(task, &p)).transpose()? {
+            Some(Event::Completed { handoff, .. }) => Some(handoff),
+            _ => None,
+        })
+    }
+
     /// The payloads of a task's events of one kind, oldest first.
     pub(crate) async fn payloads_of(&self, id: &str, kind: &str) -> Result<Vec<String>, Error> {
         let s = self.schema_of_task(id).await?;
@@ -596,11 +623,11 @@ impl Db {
         &mut self,
         domain: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
-    ) -> Result<Option<String>, Error> {
+    ) -> Result<Option<Taken>, Error> {
         let Some(s) = self.schema(domain).await? else {
             return Ok(None);
         };
@@ -609,6 +636,29 @@ impl Db {
         // after a later one with more
         let claimable_now = "status IN ('open', 'blocked', 'claimed')";
         let tx = self.client.transaction().await?;
+        // the claim this key made in this domain, looked for under the domain's lock, so
+        // two connections with one key make one claim
+        if let Some(key) = who.attempt {
+            lock_domain(&tx, domain).await?;
+            let before = tx
+                .query_opt(
+                    &format!(
+                        "SELECT task_id, payload FROM {s}.events
+                         WHERE kind = 'claimed' AND payload::jsonb ->> 'attempt' = $1
+                         ORDER BY seq LIMIT 1"
+                    ),
+                    &[&key],
+                )
+                .await?;
+            if let Some(row) = before {
+                let (id, payload): (String, String) = (row.try_get(0)?, row.try_get(1)?);
+                let generation = match Event::parse(&id, &payload)? {
+                    Event::Claimed { generation, .. } => generation,
+                    _ => 0,
+                };
+                return Ok(Some(Taken::Again { id, generation }));
+            }
+        }
         let rows = tx
             .query(
                 &format!("SELECT {TASK_COLUMNS} FROM {s}.tasks WHERE {claimable_now}"),
@@ -624,10 +674,9 @@ impl Db {
             if !claimable(&seen, now, manifest, handling) {
                 continue;
             }
-            let who = (holder, until);
-            if take(&tx, &s, &seen.id, now, who, manifest, handling).await? {
+            if take(&tx, &s, &seen.id, now, (who, until), manifest, handling).await? {
                 tx.commit().await?;
-                return Ok(Some(seen.id));
+                return Ok(Some(Taken::New(seen.id)));
             }
         }
         Ok(None)
@@ -641,6 +690,13 @@ impl Db {
         now: OffsetDateTime,
         who: (&str, OffsetDateTime),
     ) -> Result<bool, Error> {
+        let who = (
+            Claimant {
+                holder: who.0,
+                attempt: None,
+            },
+            who.1,
+        );
         let s = self.schema_of_task(id).await?;
         let tx = self.client.transaction().await?;
         let taken = take(&tx, &s, id, now, who, &[], Label::Restricted).await?;
@@ -652,7 +708,7 @@ impl Db {
         &mut self,
         id: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
@@ -678,8 +734,10 @@ impl Db {
             });
         }
         let claimed = Event::Claimed {
-            holder: holder.to_string(),
+            holder: who.holder.to_string(),
             until,
+            generation: task.generation + 1,
+            attempt: who.attempt.map(str::to_string),
         };
         apply(&tx, &s, id, now, &claimed).await?;
         tx.commit().await?;
@@ -867,7 +925,7 @@ async fn take<C: GenericClient>(
     s: &str,
     id: &str,
     now: OffsetDateTime,
-    who: (&str, OffsetDateTime),
+    who: (Claimant<'_>, OffsetDateTime),
     manifest: &[String],
     handling: Label,
 ) -> Result<bool, Error> {
@@ -888,8 +946,10 @@ async fn take<C: GenericClient>(
         return Ok(false);
     }
     let claimed = Event::Claimed {
-        holder: who.0.to_string(),
+        holder: who.0.holder.to_string(),
         until: who.1,
+        generation: task.generation + 1,
+        attempt: who.0.attempt.map(str::to_string),
     };
     apply(tx, s, &task.id, now, &claimed).await?;
     Ok(true)
@@ -1319,7 +1379,7 @@ async fn project<C: GenericClient>(
             vec![&id],
         ),
         Event::HandoffLeft { handoff } => ("SET handoff = $2 WHERE id = $1", vec![&id, handoff]),
-        Event::Completed { handoff } => (
+        Event::Completed { handoff, .. } => (
             "SET status = 'done', handoff = $2, lease_until = NULL WHERE id = $1",
             vec![&id, handoff],
         ),
diff --git a/crates/ledger/src/sqlite.rs b/crates/ledger/src/sqlite.rs
index 525af5f2..f0f9b1d5 100644
--- a/crates/ledger/src/sqlite.rs
+++ b/crates/ledger/src/sqlite.rs
@@ -4,8 +4,9 @@
 //! ledger under an async lock, so the mutex is never contended.
 
 use crate::{
-    check_holder, claimable, parse_time, Error, Event, Held, PromotionRecord, PromotionSpec,
-    RawPromotion, RawTask, Redaction, Status, Task, TaskSpec, PROMOTION_COLUMNS, TASK_COLUMNS,
+    check_holder, claimable, parse_time, Claimant, Error, Event, Held, PromotionRecord,
+    PromotionSpec, RawPromotion, RawTask, Redaction, Status, Taken, Task, TaskSpec,
+    PROMOTION_COLUMNS, TASK_COLUMNS,
 };
 use dm_core::Label;
 use rusqlite::{params, Connection, OptionalExtension, Row};
@@ -224,6 +225,25 @@ impl Db {
         })
     }
 
+    /// The handoff a task was completed with under an attempt key, if it was.
+    pub(crate) fn completed_under(&self, task: &str, key: &str) -> Result<Option<String>, Error> {
+        let payload: Option<String> = self
+            .conn()
+            .query_row(
+                "SELECT payload FROM events
+                 WHERE task_id = ?1 AND kind = 'completed'
+                   AND json_extract(payload, '$.attempt') = ?2
+                 ORDER BY seq LIMIT 1",
+                params![task, key],
+                |r| r.get(0),
+            )
+            .optional()?;
+        Ok(match payload.map(|p| Event::parse(task, &p)).transpose()? {
+            Some(Event::Completed { handoff, .. }) => Some(handoff),
+            _ => None,
+        })
+    }
+
     /// The payloads of a task's events of one kind, oldest first.
     pub(crate) fn payloads_of(&self, id: &str, kind: &str) -> Result<Vec<String>, Error> {
         let conn = self.conn();
@@ -369,13 +389,35 @@ impl Db {
         &mut self,
         domain: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
-    ) -> Result<Option<String>, Error> {
+    ) -> Result<Option<Taken>, Error> {
         let mut conn = self.conn();
         let tx = conn.transaction_with_behavior(rusqlite::TransactionBehavior::Immediate)?;
+        // the claim this key made in this domain, looked for in the transaction that
+        // would claim, so two callers with one key make one claim
+        if let Some(key) = who.attempt {
+            let before: Option<(String, String)> = tx
+                .query_row(
+                    "SELECT e.task_id, e.payload FROM events e
+                     JOIN tasks t ON t.id = e.task_id
+                     WHERE t.domain = ?1 AND e.kind = 'claimed'
+                       AND json_extract(e.payload, '$.attempt') = ?2
+                     ORDER BY e.seq LIMIT 1",
+                    params![domain, key],
+                    |r| Ok((r.get(0)?, r.get(1)?)),
+                )
+                .optional()?;
+            if let Some((id, payload)) = before {
+                let generation = match Event::parse(&id, &payload)? {
+                    Event::Claimed { generation, .. } => generation,
+                    _ => 0,
+                };
+                return Ok(Some(Taken::Again { id, generation }));
+            }
+        }
         let candidates: Vec<Task> = {
             let mut stmt = tx.prepare(&format!(
                 // every task that may be claimable. Whether a claimed one's lease has run
@@ -401,12 +443,14 @@ impl Db {
                 &task.id,
                 now,
                 &Event::Claimed {
-                    holder: holder.to_string(),
+                    holder: who.holder.to_string(),
                     until,
+                    generation: task.generation + 1,
+                    attempt: who.attempt.map(str::to_string),
                 },
             )?;
             tx.commit()?;
-            return Ok(Some(task.id));
+            return Ok(Some(Taken::New(task.id)));
         }
         Ok(None)
     }
@@ -415,7 +459,7 @@ impl Db {
         &mut self,
         id: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
@@ -438,8 +482,10 @@ impl Db {
             id,
             now,
             &Event::Claimed {
-                holder: holder.to_string(),
+                holder: who.holder.to_string(),
                 until,
+                generation: task.generation + 1,
+                attempt: who.attempt.map(str::to_string),
             },
         )?;
         tx.commit()?;
@@ -853,7 +899,7 @@ fn project(conn: &Connection, id: &str, at: OffsetDateTime, event: &Event) -> Re
         | Event::Retriaged { .. }
         | Event::ClaimRefused { .. }
         | Event::LateHandoff { .. } => project_waiting(conn, id, event)?,
-        Event::Claimed { holder, until } => {
+        Event::Claimed { holder, until, .. } => {
             conn.execute(
                 "UPDATE tasks SET status = 'claimed', holder = ?2, lease_until = ?3,
                     attempts = attempts + 1 WHERE id = ?1",
@@ -879,7 +925,7 @@ fn project(conn: &Connection, id: &str, at: OffsetDateTime, event: &Event) -> Re
                 params![id, handoff],
             )?;
         }
-        Event::Completed { handoff } => {
+        Event::Completed { handoff, .. } => {
             conn.execute(
                 "UPDATE tasks SET status = 'done', handoff = ?2, lease_until = NULL
                  WHERE id = ?1",
diff --git a/crates/server/src/lib.rs b/crates/server/src/lib.rs
index df4cba68..41ef88ef 100644
--- a/crates/server/src/lib.rs
+++ b/crates/server/src/lib.rs
@@ -1418,6 +1418,41 @@ impl Memory {
         Ok(promoted)
     }
 
+    /// The key the ledger keeps for a caller's attempt key: the caller's own, which is a
+    /// short name, under this session. One session's key is thus no other session's,
+    /// whoever its author is. The ledger looks a key up among claims or among
+    /// completions, so one key serves both.
+    fn attempt_key(&self, key: &str) -> Result<String, Error> {
+        let plain = !key.is_empty()
+            && key.len() <= 64
+            && key
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-'));
+        if !plain {
+            return Err(Error::Denied(
+                "an attempt key is 1 to 64 ASCII letters, digits, dots, hyphens or underscores"
+                    .into(),
+            ));
+        }
+        Ok(format!("{}:{key}", self.session_id))
+    }
+
+    /// A refusal of an attempt key, in the caller's own words: the ledger's names the
+    /// key as it is kept, which the caller did not type.
+    fn in_own_words<T>(
+        answer: Result<T, dm_ledger::Error>,
+        attempt: Option<&str>,
+    ) -> Result<T, Error> {
+        answer.map_err(|e| match (e, attempt) {
+            (dm_ledger::Error::AttemptSpent { .. }, Some(key)) => {
+                Error::Ledger(dm_ledger::Error::AttemptSpent {
+                    key: key.to_string(),
+                })
+            }
+            (e, _) => Error::Ledger(e),
+        })
+    }
+
     /// This session as the holder under the claim of `generation`.
     fn under(&self, generation: u64) -> dm_ledger::Held<'_> {
         dm_ledger::Held {
@@ -2655,15 +2690,39 @@ impl Memory {
         &self,
         domain: Option<&str>,
         lease: Duration,
+    ) -> Result<Option<Claim>, Error> {
+        self.claim_next_once(domain, lease, None).await
+    }
+
+    /// [`Memory::claim_next`] under an attempt key: a caller that did not hear the answer
+    /// asks again with the same key and gets the same claim, not a second task.
+    ///
+    /// # Errors
+    ///
+    /// As [`Memory::claim_next`]; a ledger error when the key's claim is over.
+    pub async fn claim_next_once(
+        &self,
+        domain: Option<&str>,
+        lease: Duration,
+        attempt: Option<&str>,
     ) -> Result<Option<Claim>, Error> {
         let domain = self.resolve_domain(domain)?;
         let handling = self.handling()?;
-        let claim = self
-            .ledger
-            .lock()
-            .await
-            .claim_next(&domain, &self.author, lease, &self.capabilities(), handling)
-            .await?;
+        let can = self.capabilities();
+        let kept = attempt.map(|k| self.attempt_key(k)).transpose()?;
+        let mut l = self.ledger.lock().await;
+        let claim = match &kept {
+            Some(key) => Self::in_own_words(
+                l.claim_next_once(&domain, &self.author, lease, (&can, handling), key)
+                    .await,
+                attempt,
+            )?,
+            None => {
+                l.claim_next(&domain, &self.author, lease, &can, handling)
+                    .await?
+            }
+        };
+        drop(l);
         if let Some(c) = &claim {
             lock(&self.session).observe(c.task.spec.classification);
             lock(&self.claims).insert(c.task.id.clone(), c.generation);
@@ -2721,14 +2780,46 @@ impl Memory {
         generation: Option<u64>,
         handoff: &str,
     ) -> Result<Task, Error> {
-        let task = self.ledger.lock().await.get(id).await?;
+        self.complete_once(id, generation, handoff, None).await
+    }
+
+    /// [`Memory::complete`] under an attempt key: asked again with the same key, it
+    /// gives the completed task back, and the task is completed once.
+    ///
+    /// # Errors
+    ///
+    /// As [`Memory::complete`]; a ledger error when the key was used for another task.
+    pub async fn complete_once(
+        &self,
+        id: &str,
+        generation: Option<u64>,
+        handoff: &str,
+        attempt: Option<&str>,
+    ) -> Result<Task, Error> {
+        // the ledger stays locked from the read of the task to its completion: a second
+        // call under the same key then reads what the first one left
+        let mut l = self.ledger.lock().await;
+        let task = l.get(id).await?;
         self.check_task(&task)?;
         if self.store.get(&task.spec.domain, handoff).await?.is_none() {
             return Err(Error::NotFound(format!("handoff {handoff}")));
         }
-        let mut l = self.ledger.lock().await;
+        let kept = attempt.map(|k| self.attempt_key(k)).transpose()?;
+        // a completion asked again under its key comes after this session forgot the
+        // claim: the task's own generation then stands in, and the ledger answers by
+        // the key, or refuses a task that is done as it would anyone. Nothing more
+        // happens for it: the task, and what its completion closed, are as they were
+        if let (Some(key), dm_ledger::Status::Done) = (&kept, task.status) {
+            let by = self.under(task.generation);
+            let same = Self::in_own_words(l.complete_once(id, by, handoff, key).await, attempt)?;
+            self.observe_task(&same);
+            return Ok(same);
+        }
         let by = self.under(self.claim_of(id, generation)?);
-        let done = l.complete(id, by, handoff).await?;
+        let done = match &kept {
+            Some(key) => Self::in_own_words(l.complete_once(id, by, handoff, key).await, attempt)?,
+            None => l.complete(id, by, handoff).await?,
+        };
         lock(&self.claims).remove(id);
         // a continuation finishes the task it resumed, and that one the task it resumed in
         // turn: up the chain, while each is open and nobody holds it
@@ -6552,6 +6643,137 @@ mod tests {
         assert_eq!((done.status, done.generation), (Status::Done, 2));
     }
 
+    /// An attempt key is one session's: another session of the same author, with the
+    /// same words, makes its own claim and learns nothing of the first.
+    #[tokio::test]
+    async fn an_attempt_key_is_a_session_s_and_gives_nothing_above_its_handling() {
+        let dir = tempfile::tempdir().unwrap();
+        let first = mem(dir.path());
+        let mut secret = tspec("Rotate the signing key", 5, None, &[], &[]);
+        secret.classification = Label::Restricted;
+        let secret = filed(&first, secret).await;
+        let plain = filed(&first, tspec("Tidy the docs", 0, None, &[], &[])).await;
+        let lease = Duration::minutes(5);
+        let held = first
+            .claim_next_once(None, lease, Some("try-1"))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(held.task.id, secret.id);
+        let again = first
+            .claim_next_once(None, lease, Some("try-1"))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!((again.task.id, again.generation), (held.task.id, 1));
+        // a second session of the same author, capped below the task, with the same key
+        let capped = Memory::open(dir.path())
+            .unwrap()
+            .with_handling_cap(Label::Public);
+        let theirs = capped
+            .claim_next_once(None, lease, Some("try-1"))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            theirs.task.id, plain.id,
+            "its own claim, of what it may hold"
+        );
+        assert_eq!(capped.label(), Label::Public);
+        // a key is a short name, not text
+        for bad in ["", "two words", "a/b", "cl\u{e9}", &"k".repeat(65)] {
+            let refused = first.claim_next_once(None, lease, Some(bad)).await;
+            assert!(matches!(refused, Err(Error::Denied(_))), "{bad:?}");
+        }
+    }
+
+    /// A completion asked again is the same completion or none: it changes nothing, and
+    /// another session's same words are not that key.
+    #[tokio::test]
+    async fn a_completion_asked_again_under_its_key_changes_nothing() {
+        let dir = tempfile::tempdir().unwrap();
+        let m = mem(dir.path());
+        let t = filed(&m, tspec("Once", 0, None, &[], &[])).await;
+        let handoff = |text: &'static str| async {
+            let h = WriteRequest {
+                entry_type: EntryType::Handoff,
+                ..req(text)
+            };
+            m.write(h).await.unwrap().id
+        };
+        let h = handoff("Done.\n").await;
+        let other = handoff("Something else.\n").await;
+        m.claim(&t.id, Duration::minutes(5)).await.unwrap();
+        let done = m
+            .complete_once(&t.id, None, &h, Some("done-1"))
+            .await
+            .unwrap();
+        let again = m
+            .complete_once(&t.id, None, &h, Some("done-1"))
+            .await
+            .unwrap();
+        assert_eq!(again, done);
+        // the same key with another handoff is refused, and the record keeps the first
+        let changed = m.complete_once(&t.id, None, &other, Some("done-1")).await;
+        assert!(
+            matches!(
+                changed,
+                Err(Error::Ledger(dm_ledger::Error::AttemptSpent { .. }))
+            ),
+            "{:?}",
+            changed.map(|t| t.handoff)
+        );
+        // a session that never held the task has no such key: the task is done, to it
+        let onlooker = Memory::open(dir.path()).unwrap();
+        let replayed = onlooker
+            .complete_once(&t.id, None, &other, Some("done-1"))
+            .await;
+        assert!(
+            matches!(
+                replayed,
+                Err(Error::Ledger(dm_ledger::Error::WrongState { .. }))
+            ),
+            "{:?}",
+            replayed.map(|t| t.handoff)
+        );
+        assert_eq!(
+            m.get_task(&t.id).await.unwrap().handoff.as_deref(),
+            Some(h.as_str())
+        );
+    }
+
+    /// A completion asked again closes nothing that the first call left open.
+    #[tokio::test]
+    async fn a_completion_asked_again_closes_no_task_up_its_chain() {
+        let dir = tempfile::tempdir().unwrap();
+        let m = mem(dir.path());
+        let parent = filed(&m, tspec("Parent", 0, None, &[], &[])).await;
+        let h = WriteRequest {
+            entry_type: EntryType::Handoff,
+            ..req("Done.\n")
+        };
+        let h = m.write(h).await.unwrap().id;
+        let lease = Duration::minutes(5);
+        // the parent is held, so the continuation's completion does not close it
+        m.claim(&parent.id, lease).await.unwrap();
+        let origin = format!("continues:{}", parent.id);
+        let next = filed(&m, tspec("Continuation", 0, Some(&origin), &[], &[])).await;
+        m.claim(&next.id, lease).await.unwrap();
+        m.complete_once(&next.id, None, &h, Some("done-1"))
+            .await
+            .unwrap();
+        m.release(&parent.id, None, None).await.unwrap();
+        let again = m
+            .complete_once(&next.id, None, &h, Some("done-1"))
+            .await
+            .unwrap();
+        assert_eq!(again.status, dm_ledger::Status::Done);
+        assert_eq!(
+            m.get_task(&parent.id).await.unwrap().status,
+            dm_ledger::Status::Open
+        );
+    }
+
     async fn done(m: &Memory, s: TaskSpec) {
         let t = filed(m, s).await;
         let mut l = m.ledger.lock().await;
diff --git a/crates/server/src/mcp.rs b/crates/server/src/mcp.rs
index 651f5a63..9b11c191 100644
--- a/crates/server/src/mcp.rs
+++ b/crates/server/src/mcp.rs
@@ -41,7 +41,9 @@ fn mcp_err(e: Error) -> McpError {
         Error::Ledger(
             dm_ledger::Error::NotFound(_)
             | dm_ledger::Error::WrongState { .. }
-            | dm_ledger::Error::NotHolder { .. },
+            | dm_ledger::Error::NotHolder { .. }
+            | dm_ledger::Error::Fenced { .. }
+            | dm_ledger::Error::AttemptSpent { .. },
         ) => McpError::invalid_params(e.to_string(), None),
         other => McpError::internal_error(other.to_string(), None),
     }
@@ -377,6 +379,10 @@ pub struct ClaimNextParams {
     /// Lease length in seconds, 10 to 86400. Default 1800. Heartbeat before it runs out.
     #[serde(default)]
     pub lease_seconds: Option<i64>,
+    /// A key of your own for this attempt. If you did not get the answer, call again
+    /// with the same key: you get the same claim, not a second task.
+    #[serde(default)]
+    pub attempt: Option<String>,
 }
 
 /// Parameters of `heartbeat`.
@@ -439,6 +445,10 @@ pub struct CompleteParams {
     pub generation: Option<u64>,
     /// The id of the handoff entry you wrote with `write` describing what happened.
     pub handoff: String,
+    /// A key of your own for this attempt. If you did not get the answer, call again
+    /// with the same key: the task is completed one time.
+    #[serde(default)]
+    pub attempt: Option<String>,
 }
 
 /// Parameters of `invalidate_task`.
@@ -903,7 +913,11 @@ impl McpServer {
         let p = p.0;
         let c = self
             .memory
-            .claim_next(p.domain.as_deref(), lease(p.lease_seconds))
+            .claim_next_once(
+                p.domain.as_deref(),
+                lease(p.lease_seconds),
+                p.attempt.as_deref(),
+            )
             .await
             .map_err(mcp_err)?;
         match c {
@@ -943,7 +957,7 @@ impl McpServer {
         let p = p.0;
         let t = self
             .memory
-            .complete(&p.id, p.generation, &p.handoff)
+            .complete_once(&p.id, p.generation, &p.handoff, p.attempt.as_deref())
             .await
             .map_err(mcp_err)?;
         ok(json!({ "task": t }))
@@ -1405,6 +1419,69 @@ mod tests {
         assert_eq!(filed["not_admitted_because"], "it names no task definition");
     }
 
+    /// The same call made twice under one key, as after an answer that did not arrive.
+    #[tokio::test]
+    async fn a_claim_and_a_completion_asked_twice_under_a_key_happen_once() {
+        let (_dir, s) = server().await;
+        for title in ["First", "Second"] {
+            let filed = payload(
+                &s.create_task(Parameters(CreateTaskParams {
+                    title: title.into(),
+                    body: "Do it.".into(),
+                    ..CreateTaskParams::default()
+                }))
+                .await
+                .unwrap(),
+            );
+            let id = filed["task"]["id"].as_str().unwrap();
+            s.memory.admit(id).await.unwrap();
+        }
+        let claim = || async {
+            payload(
+                &s.claim_next(Parameters(ClaimNextParams {
+                    attempt: Some("try-1".into()),
+                    ..ClaimNextParams::default()
+                }))
+                .await
+                .unwrap(),
+            )
+        };
+        let first = claim().await;
+        let again = claim().await;
+        assert_eq!(again["task"]["id"], first["task"]["id"]);
+        assert_eq!(again["generation"], 1);
+        let id = first["task"]["id"].as_str().unwrap().to_string();
+        let h = write_handoff(&s, "Done.").await;
+        let complete = |id: String, h: String| async {
+            s.complete(Parameters(CompleteParams {
+                id,
+                handoff: h,
+                attempt: Some("done-1".into()),
+                ..CompleteParams::default()
+            }))
+            .await
+        };
+        let done = payload(&complete(id.clone(), h.clone()).await.unwrap());
+        let done_again = payload(&complete(id.clone(), h.clone()).await.unwrap());
+        assert_eq!(done_again["task"], done["task"]);
+        assert_eq!(done["task"]["status"], "done");
+        // the key claimed that task, whose claim is over: it claims nothing more
+        let spent = s
+            .claim_next(Parameters(ClaimNextParams {
+                attempt: Some("try-1".into()),
+                ..ClaimNextParams::default()
+            }))
+            .await;
+        let why = spent
+            .err()
+            .map(|e| e.message.to_string())
+            .unwrap_or_default();
+        assert_eq!(
+            why,
+            "the attempt key try-1 was used before, and that attempt is over"
+        );
+    }
+
     #[test]
     fn write_refuses_a_parameter_it_does_not_have() {
         let old =
diff --git a/docs/terms.md b/docs/terms.md
index 2e4ad4e7..6e39dbd0 100644
--- a/docs/terms.md
+++ b/docs/terms.md
@@ -62,6 +62,7 @@ term here in the same commit as the first document that needs it.
 | task state | `proposed`, `open`, `blocked`, `claimed`, `done` or `invalidated`: where a task is on the ledger | admitted (for `open`), completed (for `done`), status (for a state in prose) |
 | generation | The number of a claim of a task. Each claim gets the next number. A heartbeat, a completion and a release carry it, and the ledger refuses an earlier one | attempt (for a generation), fencing token |
 | late handoff | A handoff that a holder leaves on a task after its claim is over | |
+| attempt key | A key that a caller makes for one claim or one completion. The same key asked again gives the same result, and the ledger does the operation one time | idempotency key, request id |
 | task definition | The record in the platform domain for one kind of work: its purpose, its tools, its acceptance checks and its outputs. A task names one as `<name>@<version>` | task type, task template |
 | quarantine | `state/quarantine`, where the policy holds a write that it refused, for the owner to release or drop | |
 | owner | The person who holds the root and its grants | user (for the owner), admin |
diff --git a/local/README.md b/local/README.md
index 3bd1a41c..985153f4 100644
--- a/local/README.md
+++ b/local/README.md
@@ -607,8 +607,26 @@ The ledger does not admit a task that depends on an invalidated task. An erasure
 invalidates a task sends the tasks that it blocked back to `proposed`, as each
 invalidation does.
 
-Not built yet: an attempt key for each operation, a block on a new claim while an external
-effect is uncertain, and a `blocked` state for a task that waits on an outside event.
+A claim and a completion can carry an attempt key, which the caller makes. A caller that
+did not get the answer asks again with the same key:
+
+- `claim_next` with the same key gives the same claim, while that claim is in force. It
+  does not give a second task. When that claim is over, the ledger refuses the key.
+- `complete` with the same key and the same handoff gives the done task. The ledger
+  completes the task one time, and nothing else occurs for the second call. With a
+  different handoff, the ledger refuses the key.
+
+The memory tools `claim_next` and `complete` take `attempt`. A key is 1 to 64 ASCII
+letters, digits, dots, hyphens or underscores. A key belongs to one session and one
+domain. A different session with the same key makes its own claim. The same key with a
+different `domain` also makes its own claim. One key can be used for a claim and for a
+completion. The ledger looks for the key in the transaction that makes
+the claim. The key is in the event of the claim or the completion, so the ledger finds it
+again after a rebuild. A command has no session, so `amem task` has no attempt key.
+
+Not built yet: an attempt key for the other operations, a block on a new claim while an
+external effect is uncertain, and a `blocked` state for a task that waits on an outside
+event.
 
 ## Task definitions: `platform task`