From 98646df5eb83c85078d2783cc5d29e8bd55c869a Mon Sep 17 00:00:00 2001
From: Sander Striker <s.striker@striker.nl>
Date: Thu, 12 Nov 2026 08:53:27 +0100
Subject: [PATCH 1/2] feat: let a claim and a completion carry an attempt key

The paper gives each task operation an attempt key from the caller, so a retry
cannot claim two tasks or complete a task two times (Appendix A, Appendix C).
The ledger had no such key. A caller that did not get the answer to
`claim_next` and asked again got a second task.

- `claim_next_once` takes a key. The same key asked again gives the same claim,
  while that claim is in force for that holder. When the claim is over, the
  ledger refuses the key with `Error::AttemptSpent`.
- `complete_once` takes a key. The same key asked again gives the done task,
  and the ledger appends no second event. A key that was used for a different
  task or a different operation is refused.
- The key is in the event of the claim or the completion. The ledger finds it
  in the events, so a rebuild keeps it. The event of a claim now also has its
  generation.
- The memory tools `claim_next` and `complete` take `attempt`.
  `amem task claim-next` and `amem task complete` take `--attempt`.
- A completion asked again reaches the ledger after the session forgot the
  claim. A test of the tools found that the session refused it first.

Not in this change: an attempt key for the other operations.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
---
 PLAN.md                       |   2 +-
 README.md                     |   3 +-
 crates/ledger/src/lib.rs      | 237 +++++++++++++++++++++++++++++++++-
 crates/ledger/src/postgres.rs |  69 +++++++++-
 crates/ledger/src/sqlite.rs   |  52 ++++++--
 crates/memory/src/main.rs     |  19 ++-
 crates/server/src/lib.rs      |  66 ++++++++--
 crates/server/src/mcp.rs      |  80 +++++++++++-
 docs/terms.md                 |   1 +
 local/README.md               |  18 ++-
 10 files changed, 512 insertions(+), 35 deletions(-)

diff --git a/PLAN.md b/PLAN.md
index 05a58389..608d78fa 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -68,7 +68,7 @@ Landed so far:
 |---|---|---|
 | 0 | #69 | Nothing |
 | 1 | #71 | Nothing |
-| 2 | #73 | An attempt key on every operation; an uncertain external effect blocking reassignment; waiting on an outside event as a state; the record's remaining fields (`parent`, `scores`, `implements`, `reversibility`, `artifacts_touched`, `policy_context`) |
+| 2 | #73, and attempt keys for a claim and a completion in the pull request after #74 | An attempt key on the other operations; an uncertain external effect blocking reassignment; waiting on an outside event as a state; the record's remaining fields (`parent`, `scores`, `implements`, `reversibility`, `artifacts_touched`, `policy_context`) |
 | 3 | the pull request after #73 | A suite that gates a version of a definition; the data scope enforced; a definition required by default, once the system's own filings name one; tools offered a few at boot and the rest by search |
 
 What stays unbuilt after these, and stays on README's list: federation across domains, authentication of people, logprob-based drift, and accelerator time, which only a gateway can count. So do the items on that list that need another machine or an outside service more than they need code: the limits on re-enactment, harness settings and decomposition templates in the platform domain, bytes stored and resource limits on the sandbox, the authoring of agent definitions, the search tool against its live provider, a harness under Seatbelt on a Mac, and the Gofannon bridge against a live deployment, whose agents make model calls that the egress does not meter.
diff --git a/README.md b/README.md
index 2b102984..f704619b 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,8 @@ two weeks. It is also the reason that none of it is the production shape.
   - CPU or memory limits on the sandbox
 - **The task record, in part.** A claim has a generation, and the ledger refuses a
   holder that gives an earlier one. A task can be `blocked` on a task that it depends on.
-  These parts are not built: an attempt key for each operation, a block on a new claim
+  A claim and a completion can carry an attempt key. These parts are not built: an
+  attempt key for the other operations, a block on a new claim
   while an external effect is uncertain, and a `blocked` state for a task that waits on an
   outside event. The generation does not prove who the caller is.
 - **Task definitions, in part, and autonomy levels.** A task can name a task definition.
diff --git a/crates/ledger/src/lib.rs b/crates/ledger/src/lib.rs
index bcd3604e..981dab71 100644
--- a/crates/ledger/src/lib.rs
+++ b/crates/ledger/src/lib.rs
@@ -83,6 +83,15 @@ pub enum Error {
         /// The generation of the claim in force.
         current: u64,
     },
+    /// The attempt key was used before, for another operation or another task, or for
+    /// a claim that is over: the same key cannot claim or complete a second time.
+    #[error("the attempt key {key} was used for {id}, and that attempt is over")]
+    AttemptSpent {
+        /// The key.
+        key: String,
+        /// The task it was used for.
+        id: String,
+    },
     /// Another connection holds the write-ahead log, so text just removed may still be
     /// in it. Run the operation again.
     #[error("ledger: another connection holds the log: {0}")]
@@ -290,6 +299,14 @@ pub struct Claim {
     pub generation: u64,
 }
 
+/// Who claims, and the attempt key it gave: a retry of the same claim carries the same
+/// key, so it is the same claim and not a second one.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Claimant<'a> {
+    pub(crate) holder: &'a str,
+    pub(crate) attempt: Option<&'a str>,
+}
+
 /// A holder and the generation of the claim it acts under.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Held<'a> {
@@ -381,6 +398,12 @@ enum Event {
         holder: String,
         #[serde(with = "time::serde::rfc3339")]
         until: OffsetDateTime,
+        /// The generation this claim got. Absent from a claim of an older ledger.
+        #[serde(default)]
+        generation: u64,
+        /// The attempt key the caller gave, when it gave one.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        attempt: Option<String>,
     },
     /// A claim of a named task the ledger refused, and why. Changes nothing; it is the
     /// record that someone tried.
@@ -406,6 +429,9 @@ enum Event {
     },
     Completed {
         handoff: String,
+        /// The attempt key the caller gave, when it gave one.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        attempt: Option<String>,
     },
     Invalidated {
         reason: String,
@@ -498,8 +524,9 @@ fn redact_event(id: &str, payload: &str, redaction: &Redaction) -> Result<Option
         Event::HandoffLeft { handoff } if handoff != redaction.reason => Event::HandoffLeft {
             handoff: redaction.reason.clone(),
         },
-        Event::Completed { handoff } if handoff != redaction.reason => Event::Completed {
+        Event::Completed { handoff, attempt } if handoff != redaction.reason => Event::Completed {
             handoff: redaction.reason.clone(),
+            attempt,
         },
         Event::LateHandoff {
             holder,
@@ -963,10 +990,89 @@ impl Ledger {
         lease: Duration,
         manifest: &[String],
         handling: Label,
+    ) -> Result<Option<Claim>, Error> {
+        let who = Claimant {
+            holder,
+            attempt: None,
+        };
+        self.claim_next_as(domain, who, lease, manifest, handling)
+            .await
+    }
+
+    /// [`Ledger::claim_next`] under an attempt key. A caller that did not hear the answer
+    /// asks again with the same key: while the claim that key made is in force, it gets
+    /// that claim back, and no second task.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::AttemptSpent`] when the key's claim is over, or the key was used for
+    /// something else; a database error.
+    pub async fn claim_next_once(
+        &mut self,
+        domain: &str,
+        holder: &str,
+        lease: Duration,
+        (manifest, handling): (&[String], Label),
+        attempt: &str,
+    ) -> Result<Option<Claim>, Error> {
+        let seen = on_backend!(&self.backend, db => db.attempt_in(domain, attempt))?;
+        if let Some((id, event)) = seen {
+            return self
+                .same_claim(&id, holder, attempt, &event)
+                .await
+                .map(Some);
+        }
+        let who = Claimant {
+            holder,
+            attempt: Some(attempt),
+        };
+        self.claim_next_as(domain, who, lease, manifest, handling)
+            .await
+    }
+
+    /// The claim an attempt key made, if it is still in force for this holder.
+    async fn same_claim(
+        &self,
+        id: &str,
+        holder: &str,
+        attempt: &str,
+        event: &Event,
+    ) -> Result<Claim, Error> {
+        let task = self.get(id).await?;
+        let now = self.now();
+        let in_force = match event {
+            Event::Claimed { generation, .. } => {
+                task.status == Status::Claimed
+                    && task.generation == *generation
+                    && task.holder.as_deref() == Some(holder)
+                    && task.lease_until.is_some_and(|t| t >= now)
+            }
+            _ => false,
+        };
+        match (in_force, task.lease_until) {
+            (true, Some(lease_until)) => Ok(Claim {
+                generation: task.generation,
+                task,
+                lease_until,
+            }),
+            _ => Err(Error::AttemptSpent {
+                key: attempt.to_string(),
+                id: id.to_string(),
+            }),
+        }
+    }
+
+    async fn claim_next_as(
+        &mut self,
+        domain: &str,
+        who: Claimant<'_>,
+        lease: Duration,
+        manifest: &[String],
+        handling: Label,
     ) -> Result<Option<Claim>, Error> {
         let now = self.now();
         let until = now + lease;
-        let claimed = on_backend!(&mut self.backend, db => db.claim_next(domain, now, holder, until, manifest, handling))?;
+        let claimed = on_backend!(&mut self.backend, db => db.claim_next(domain, now, who, until, manifest, handling))?;
         if let Some(id) = &claimed {
             self.trace("claimed", id).await;
         }
@@ -1000,7 +1106,12 @@ impl Ledger {
     ) -> Result<Claim, Error> {
         let now = self.now();
         let until = now + lease;
-        let claimed = on_backend!(&mut self.backend, db => db.claim(id, now, holder, until, manifest, handling));
+        let who = Claimant {
+            holder,
+            attempt: None,
+        };
+        let claimed =
+            on_backend!(&mut self.backend, db => db.claim(id, now, who, until, manifest, handling));
         if matches!(claimed, Err(Error::WrongState { .. })) {
             self.record_refusal(id, holder, now).await?;
         }
@@ -1086,6 +1197,16 @@ impl Ledger {
     ///
     /// [`Error::NotFound`], [`Error::NotHolder`], or [`Error::WrongState`].
     pub async fn complete(&mut self, id: &str, by: Held<'_>, handoff: &str) -> Result<Task, Error> {
+        self.complete_keyed(id, by, handoff, None).await
+    }
+
+    async fn complete_keyed(
+        &mut self,
+        id: &str,
+        by: Held<'_>,
+        handoff: &str,
+        attempt: Option<&str>,
+    ) -> Result<Task, Error> {
         let now = self.now();
         let task = self.get(id).await?;
         if task.status != Status::Claimed {
@@ -1097,12 +1218,43 @@ impl Ledger {
         }
         let completed = Event::Completed {
             handoff: handoff.to_string(),
+            attempt: attempt.map(str::to_string),
         };
         self.append_held(id, now, by, &completed).await?;
         self.unblock_dependents(id).await?;
         self.get(id).await
     }
 
+    /// [`Ledger::complete`] under an attempt key. A caller that did not hear the answer
+    /// asks again with the same key, and gets the completed task back: the task is
+    /// completed once.
+    ///
+    /// # Errors
+    ///
+    /// As [`Ledger::complete`]; [`Error::AttemptSpent`] when the key was used for
+    /// another task or another operation.
+    pub async fn complete_once(
+        &mut self,
+        id: &str,
+        by: Held<'_>,
+        handoff: &str,
+        attempt: &str,
+    ) -> Result<Task, Error> {
+        let seen = on_backend!(&self.backend, db => db.attempt_of(id, attempt))?;
+        if let Some((task, event)) = seen {
+            let same = task == id && matches!(event, Event::Completed { .. });
+            return if same {
+                self.get(id).await
+            } else {
+                Err(Error::AttemptSpent {
+                    key: attempt.to_string(),
+                    id: task,
+                })
+            };
+        }
+        self.complete_keyed(id, by, handoff, Some(attempt)).await
+    }
+
     /// Close a task its continuation finished: the continuation `by` resumed it and is
     /// complete with `handoff`, so the task is too, with the same handoff. Only a task
     /// nobody holds: one released when its run delegated, or whose lease ran out. A
@@ -1136,6 +1288,7 @@ impl Ledger {
             now,
             &Event::Completed {
                 handoff: handoff.to_string(),
+                attempt: None,
             },
         )
         .await?;
@@ -1769,6 +1922,8 @@ mod tests {
     }
 
     on_both! {
+        a_claim_asked_twice_under_one_key_is_one_claim,
+        a_completion_asked_twice_under_one_key_is_one_completion,
         a_dependent_in_another_domain_is_opened_and_retriaged_too,
         a_blocked_task_whose_dependencies_are_done_is_claimable_whatever_its_state_says,
         a_task_closed_by_its_continuation_opens_what_waited_on_it,
@@ -2202,6 +2357,82 @@ mod tests {
         );
     }
 
+    fn is_spent<T>(r: &Result<T, Error>) -> bool {
+        matches!(r, Err(Error::AttemptSpent { .. }))
+    }
+
+    async fn next_once(l: &mut Ledger, holder: &str, key: &str) -> Result<Option<Claim>, Error> {
+        l.claim_next_once("dom-a", holder, mins(30), (&[], Label::Restricted), key)
+            .await
+    }
+
+    /// A caller that did not hear the answer asks again with the same key.
+    async fn a_claim_asked_twice_under_one_key_is_one_claim(b: &Site) {
+        let (mut l, now) = b.ledger().await;
+        let first = admitted(&mut l, spec("First")).await;
+        let second = admitted(&mut l, spec("Second")).await;
+        let c = next_once(&mut l, "s1", "key-1").await.unwrap().unwrap();
+        let again = next_once(&mut l, "s1", "key-1").await.unwrap().unwrap();
+        assert_eq!(
+            (again.task.id.as_str(), again.generation),
+            (c.task.id.as_str(), 1)
+        );
+        assert_eq!(c.task.id, first.id);
+        assert_eq!(
+            l.get(&second.id).await.unwrap().status,
+            Status::Open,
+            "no second task"
+        );
+        // the key is this holder's claim, and nobody else's way to it
+        assert!(is_spent(&next_once(&mut l, "s2", "key-1").await));
+        // a new key is a new claim
+        let other = next_once(&mut l, "s1", "key-2").await.unwrap().unwrap();
+        assert_eq!(other.task.id, second.id);
+        a_key_whose_claim_is_over_claims_nothing(&mut l, &now).await;
+    }
+
+    async fn a_key_whose_claim_is_over_claims_nothing(l: &mut Ledger, now: &Mutex<OffsetDateTime>) {
+        // once the claim the key made is over, the key claims nothing more
+        *now.lock().unwrap() = T0 + mins(31);
+        assert!(is_spent(&next_once(l, "s1", "key-1").await));
+        // and a rebuild keeps what the key means
+        l.rebuild().await.unwrap();
+        assert!(is_spent(&next_once(l, "s1", "key-1").await));
+    }
+
+    async fn a_key_completes_no_other_task(l: &mut Ledger, t: &Task, other: &Task) {
+        // the key completed that task: it completes no other
+        let reused = l
+            .complete_once(&other.id, held("s1", 1), "mem-a-h", "done-1")
+            .await;
+        assert!(is_spent(&reused));
+        assert_eq!(l.get(&other.id).await.unwrap().status, Status::Claimed);
+        // without a key, a second completion is refused as it was
+        assert!(is_wrong_state(
+            &l.complete(&t.id, held("s1", 1), "mem-a-h").await
+        ));
+    }
+
+    async fn a_completion_asked_twice_under_one_key_is_one_completion(b: &Site) {
+        let (mut l, _) = b.ledger().await;
+        let t = admitted(&mut l, spec("Once")).await;
+        let other = admitted(&mut l, spec("Other")).await;
+        claim(&mut l, &t.id, "s1", mins(30)).await.unwrap();
+        claim(&mut l, &other.id, "s1", mins(30)).await.unwrap();
+        let before = l.event_count().await.unwrap();
+        let done = l
+            .complete_once(&t.id, held("s1", 1), "mem-a-h", "done-1")
+            .await
+            .unwrap();
+        let again = l
+            .complete_once(&t.id, held("s1", 1), "mem-a-h", "done-1")
+            .await
+            .unwrap();
+        assert_eq!(again, done);
+        assert_eq!(l.event_count().await.unwrap(), before + 1, "one event");
+        a_key_completes_no_other_task(&mut l, &t, &other).await;
+    }
+
     fn is_fenced<T>(r: &Result<T, Error>, given: u64, current: u64) -> bool {
         matches!(r, Err(Error::Fenced { given: g, current: c, .. }) if *g == given && *c == current)
     }
diff --git a/crates/ledger/src/postgres.rs b/crates/ledger/src/postgres.rs
index 57ce8697..4581abc1 100644
--- a/crates/ledger/src/postgres.rs
+++ b/crates/ledger/src/postgres.rs
@@ -17,8 +17,9 @@
 //! connections cannot both win the same task.
 
 use crate::{
-    check_holder, claimable, parse_time, Error, Event, Held, PromotionRecord, PromotionSpec,
-    RawPromotion, RawTask, Redaction, Status, Task, TaskSpec, PROMOTION_COLUMNS, TASK_COLUMNS,
+    check_holder, claimable, parse_time, Claimant, Error, Event, Held, PromotionRecord,
+    PromotionSpec, RawPromotion, RawTask, Redaction, Status, Task, TaskSpec, PROMOTION_COLUMNS,
+    TASK_COLUMNS,
 };
 use dm_core::Label;
 use std::collections::HashMap;
@@ -428,6 +429,56 @@ impl Db {
         })
     }
 
+    /// The first claim or completion in a domain made under an attempt key: its task and
+    /// its event.
+    pub(crate) async fn attempt_in(
+        &self,
+        domain: &str,
+        key: &str,
+    ) -> Result<Option<(String, Event)>, Error> {
+        let Some(s) = self.schema(domain).await? else {
+            return Ok(None);
+        };
+        let row = self
+            .client
+            .query_opt(
+                &format!(
+                    "SELECT task_id, payload FROM {s}.events
+                     WHERE kind IN ('claimed', 'completed')
+                       AND payload::jsonb ->> 'attempt' = $1
+                     ORDER BY seq LIMIT 1"
+                ),
+                &[&key],
+            )
+            .await?;
+        let Some(row) = row else {
+            return Ok(None);
+        };
+        let (id, payload): (String, String) = (row.try_get(0)?, row.try_get(1)?);
+        let event = Event::parse(&id, &payload)?;
+        Ok(Some((id, event)))
+    }
+
+    /// As [`Db::attempt_in`], for the domain of a task.
+    pub(crate) async fn attempt_of(
+        &self,
+        task: &str,
+        key: &str,
+    ) -> Result<Option<(String, Event)>, Error> {
+        let row = self
+            .client
+            .query_opt(
+                "SELECT domain FROM public.ledger_tasks WHERE id = $1",
+                &[&task],
+            )
+            .await?;
+        let Some(row) = row else {
+            return Err(Error::NotFound(task.to_string()));
+        };
+        let domain: String = row.try_get(0)?;
+        self.attempt_in(&domain, key).await
+    }
+
     /// The payloads of a task's events of one kind, oldest first.
     pub(crate) async fn payloads_of(&self, id: &str, kind: &str) -> Result<Vec<String>, Error> {
         let s = self.schema_of_task(id).await?;
@@ -596,7 +647,7 @@ impl Db {
         &mut self,
         domain: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
@@ -642,8 +693,10 @@ impl Db {
                 continue;
             }
             let claimed = Event::Claimed {
-                holder: holder.to_string(),
+                holder: who.holder.to_string(),
                 until,
+                generation: task.generation + 1,
+                attempt: who.attempt.map(str::to_string),
             };
             apply(&tx, &s, &task.id, now, &claimed).await?;
             tx.commit().await?;
@@ -656,7 +709,7 @@ impl Db {
         &mut self,
         id: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
@@ -682,8 +735,10 @@ impl Db {
             });
         }
         let claimed = Event::Claimed {
-            holder: holder.to_string(),
+            holder: who.holder.to_string(),
             until,
+            generation: task.generation + 1,
+            attempt: who.attempt.map(str::to_string),
         };
         apply(&tx, &s, id, now, &claimed).await?;
         tx.commit().await?;
@@ -1285,7 +1340,7 @@ async fn project<C: GenericClient>(
             vec![&id],
         ),
         Event::HandoffLeft { handoff } => ("SET handoff = $2 WHERE id = $1", vec![&id, handoff]),
-        Event::Completed { handoff } => (
+        Event::Completed { handoff, .. } => (
             "SET status = 'done', handoff = $2, lease_until = NULL WHERE id = $1",
             vec![&id, handoff],
         ),
diff --git a/crates/ledger/src/sqlite.rs b/crates/ledger/src/sqlite.rs
index a318b31d..7a207c29 100644
--- a/crates/ledger/src/sqlite.rs
+++ b/crates/ledger/src/sqlite.rs
@@ -4,8 +4,9 @@
 //! ledger under an async lock, so the mutex is never contended.
 
 use crate::{
-    check_holder, claimable, parse_time, Error, Event, Held, PromotionRecord, PromotionSpec,
-    RawPromotion, RawTask, Redaction, Status, Task, TaskSpec, PROMOTION_COLUMNS, TASK_COLUMNS,
+    check_holder, claimable, parse_time, Claimant, Error, Event, Held, PromotionRecord,
+    PromotionSpec, RawPromotion, RawTask, Redaction, Status, Task, TaskSpec, PROMOTION_COLUMNS,
+    TASK_COLUMNS,
 };
 use dm_core::Label;
 use rusqlite::{params, Connection, OptionalExtension, Row};
@@ -224,6 +225,37 @@ impl Db {
         })
     }
 
+    /// The first claim or completion made under an attempt key: its task and its event.
+    /// One file holds every domain, so the domain is not asked.
+    pub(crate) fn attempt_in(
+        &self,
+        _domain: &str,
+        key: &str,
+    ) -> Result<Option<(String, Event)>, Error> {
+        let row: Option<(String, String)> = self
+            .conn()
+            .query_row(
+                "SELECT task_id, payload FROM events
+                 WHERE kind IN ('claimed', 'completed')
+                   AND json_extract(payload, '$.attempt') = ?1
+                 ORDER BY seq LIMIT 1",
+                params![key],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .optional()?;
+        row.map(|(id, payload)| Ok((id.clone(), Event::parse(&id, &payload)?)))
+            .transpose()
+    }
+
+    /// As [`Db::attempt_in`], for the domain of a task.
+    pub(crate) fn attempt_of(
+        &self,
+        _task: &str,
+        key: &str,
+    ) -> Result<Option<(String, Event)>, Error> {
+        self.attempt_in("", key)
+    }
+
     /// The payloads of a task's events of one kind, oldest first.
     pub(crate) fn payloads_of(&self, id: &str, kind: &str) -> Result<Vec<String>, Error> {
         let conn = self.conn();
@@ -369,7 +401,7 @@ impl Db {
         &mut self,
         domain: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
@@ -399,8 +431,10 @@ impl Db {
                 &task.id,
                 now,
                 &Event::Claimed {
-                    holder: holder.to_string(),
+                    holder: who.holder.to_string(),
                     until,
+                    generation: task.generation + 1,
+                    attempt: who.attempt.map(str::to_string),
                 },
             )?;
             tx.commit()?;
@@ -413,7 +447,7 @@ impl Db {
         &mut self,
         id: &str,
         now: OffsetDateTime,
-        holder: &str,
+        who: Claimant<'_>,
         until: OffsetDateTime,
         manifest: &[String],
         handling: Label,
@@ -436,8 +470,10 @@ impl Db {
             id,
             now,
             &Event::Claimed {
-                holder: holder.to_string(),
+                holder: who.holder.to_string(),
                 until,
+                generation: task.generation + 1,
+                attempt: who.attempt.map(str::to_string),
             },
         )?;
         tx.commit()?;
@@ -851,7 +887,7 @@ fn project(conn: &Connection, id: &str, at: OffsetDateTime, event: &Event) -> Re
         | Event::Retriaged { .. }
         | Event::ClaimRefused { .. }
         | Event::LateHandoff { .. } => project_waiting(conn, id, event)?,
-        Event::Claimed { holder, until } => {
+        Event::Claimed { holder, until, .. } => {
             conn.execute(
                 "UPDATE tasks SET status = 'claimed', holder = ?2, lease_until = ?3,
                     attempts = attempts + 1 WHERE id = ?1",
@@ -877,7 +913,7 @@ fn project(conn: &Connection, id: &str, at: OffsetDateTime, event: &Event) -> Re
                 params![id, handoff],
             )?;
         }
-        Event::Completed { handoff } => {
+        Event::Completed { handoff, .. } => {
             conn.execute(
                 "UPDATE tasks SET status = 'done', handoff = ?2, lease_until = NULL
                  WHERE id = ?1",
diff --git a/crates/memory/src/main.rs b/crates/memory/src/main.rs
index 0653862e..d6857562 100644
--- a/crates/memory/src/main.rs
+++ b/crates/memory/src/main.rs
@@ -1140,6 +1140,9 @@ enum TaskOp {
         domain: Option<String>,
         #[arg(long, default_value_t = 1800)]
         lease_seconds: i64,
+        /// A key for this attempt: the same key asked again gives the same claim.
+        #[arg(long)]
+        attempt: Option<String>,
     },
     /// Renew a lease, under the claim of the generation that `claim-next` printed.
     Heartbeat {
@@ -1157,6 +1160,9 @@ enum TaskOp {
         /// The generation of the claim.
         #[arg(long)]
         generation: u64,
+        /// A key for this attempt: the same key asked again completes nothing twice.
+        #[arg(long)]
+        attempt: Option<String>,
     },
     /// Give a task back, optionally with a handoff for the next claimant.
     Release {
@@ -4884,7 +4890,11 @@ async fn held_task(m: &Memory, op: TaskOp) -> Fallible {
             id,
             handoff,
             generation,
-        } => json(&m.complete(&id, Some(generation), &handoff).await?),
+            attempt,
+        } => json(
+            &m.complete_once(&id, Some(generation), &handoff, attempt.as_deref())
+                .await?,
+        ),
         TaskOp::Release {
             id,
             generation,
@@ -4943,8 +4953,13 @@ async fn task(m: &Memory, op: TaskOp) -> Fallible {
         TaskOp::ClaimNext {
             domain,
             lease_seconds,
+            attempt,
         } => match m
-            .claim_next(domain.as_deref(), Duration::seconds(lease_seconds))
+            .claim_next_once(
+                domain.as_deref(),
+                Duration::seconds(lease_seconds),
+                attempt.as_deref(),
+            )
             .await?
         {
             Some(c) => json(&c.task),
diff --git a/crates/server/src/lib.rs b/crates/server/src/lib.rs
index c57970c7..9b15f957 100644
--- a/crates/server/src/lib.rs
+++ b/crates/server/src/lib.rs
@@ -2648,15 +2648,37 @@ impl Memory {
         &self,
         domain: Option<&str>,
         lease: Duration,
+    ) -> Result<Option<Claim>, Error> {
+        self.claim_next_once(domain, lease, None).await
+    }
+
+    /// [`Memory::claim_next`] under an attempt key: a caller that did not hear the answer
+    /// asks again with the same key and gets the same claim, not a second task.
+    ///
+    /// # Errors
+    ///
+    /// As [`Memory::claim_next`]; a ledger error when the key's claim is over.
+    pub async fn claim_next_once(
+        &self,
+        domain: Option<&str>,
+        lease: Duration,
+        attempt: Option<&str>,
     ) -> Result<Option<Claim>, Error> {
         let domain = self.resolve_domain(domain)?;
         let handling = self.handling()?;
-        let claim = self
-            .ledger
-            .lock()
-            .await
-            .claim_next(&domain, &self.author, lease, &self.capabilities(), handling)
-            .await?;
+        let can = self.capabilities();
+        let mut l = self.ledger.lock().await;
+        let claim = match attempt {
+            Some(key) => {
+                l.claim_next_once(&domain, &self.author, lease, (&can, handling), key)
+                    .await?
+            }
+            None => {
+                l.claim_next(&domain, &self.author, lease, &can, handling)
+                    .await?
+            }
+        };
+        drop(l);
         if let Some(c) = &claim {
             lock(&self.session).observe(c.task.spec.classification);
             lock(&self.claims).insert(c.task.id.clone(), c.generation);
@@ -2713,6 +2735,22 @@ impl Memory {
         id: &str,
         generation: Option<u64>,
         handoff: &str,
+    ) -> Result<Task, Error> {
+        self.complete_once(id, generation, handoff, None).await
+    }
+
+    /// [`Memory::complete`] under an attempt key: asked again with the same key, it
+    /// gives the completed task back, and the task is completed once.
+    ///
+    /// # Errors
+    ///
+    /// As [`Memory::complete`]; a ledger error when the key was used for another task.
+    pub async fn complete_once(
+        &self,
+        id: &str,
+        generation: Option<u64>,
+        handoff: &str,
+        attempt: Option<&str>,
     ) -> Result<Task, Error> {
         let task = self.ledger.lock().await.get(id).await?;
         self.check_task(&task)?;
@@ -2720,8 +2758,20 @@ impl Memory {
             return Err(Error::NotFound(format!("handoff {handoff}")));
         }
         let mut l = self.ledger.lock().await;
-        let by = self.under(self.claim_of(id, generation)?);
-        let done = l.complete(id, by, handoff).await?;
+        // a completion asked again under its key comes after this session forgot the
+        // claim: the task's own generation then stands in, and the ledger answers by
+        // the key, or refuses a task that is done as it would anyone
+        let again = attempt.is_some() && task.status == dm_ledger::Status::Done;
+        let generation = if again {
+            task.generation
+        } else {
+            self.claim_of(id, generation)?
+        };
+        let by = self.under(generation);
+        let done = match attempt {
+            Some(key) => l.complete_once(id, by, handoff, key).await?,
+            None => l.complete(id, by, handoff).await?,
+        };
         lock(&self.claims).remove(id);
         // a continuation finishes the task it resumed, and that one the task it resumed in
         // turn: up the chain, while each is open and nobody holds it
diff --git a/crates/server/src/mcp.rs b/crates/server/src/mcp.rs
index 651f5a63..68d06fb3 100644
--- a/crates/server/src/mcp.rs
+++ b/crates/server/src/mcp.rs
@@ -41,7 +41,9 @@ fn mcp_err(e: Error) -> McpError {
         Error::Ledger(
             dm_ledger::Error::NotFound(_)
             | dm_ledger::Error::WrongState { .. }
-            | dm_ledger::Error::NotHolder { .. },
+            | dm_ledger::Error::NotHolder { .. }
+            | dm_ledger::Error::Fenced { .. }
+            | dm_ledger::Error::AttemptSpent { .. },
         ) => McpError::invalid_params(e.to_string(), None),
         other => McpError::internal_error(other.to_string(), None),
     }
@@ -377,6 +379,10 @@ pub struct ClaimNextParams {
     /// Lease length in seconds, 10 to 86400. Default 1800. Heartbeat before it runs out.
     #[serde(default)]
     pub lease_seconds: Option<i64>,
+    /// A key of your own for this attempt. If you did not get the answer, call again
+    /// with the same key: you get the same claim, not a second task.
+    #[serde(default)]
+    pub attempt: Option<String>,
 }
 
 /// Parameters of `heartbeat`.
@@ -439,6 +445,10 @@ pub struct CompleteParams {
     pub generation: Option<u64>,
     /// The id of the handoff entry you wrote with `write` describing what happened.
     pub handoff: String,
+    /// A key of your own for this attempt. If you did not get the answer, call again
+    /// with the same key: the task is completed one time.
+    #[serde(default)]
+    pub attempt: Option<String>,
 }
 
 /// Parameters of `invalidate_task`.
@@ -903,7 +913,11 @@ impl McpServer {
         let p = p.0;
         let c = self
             .memory
-            .claim_next(p.domain.as_deref(), lease(p.lease_seconds))
+            .claim_next_once(
+                p.domain.as_deref(),
+                lease(p.lease_seconds),
+                p.attempt.as_deref(),
+            )
             .await
             .map_err(mcp_err)?;
         match c {
@@ -943,7 +957,7 @@ impl McpServer {
         let p = p.0;
         let t = self
             .memory
-            .complete(&p.id, p.generation, &p.handoff)
+            .complete_once(&p.id, p.generation, &p.handoff, p.attempt.as_deref())
             .await
             .map_err(mcp_err)?;
         ok(json!({ "task": t }))
@@ -1405,6 +1419,66 @@ mod tests {
         assert_eq!(filed["not_admitted_because"], "it names no task definition");
     }
 
+    /// The same call made twice under one key, as after an answer that did not arrive.
+    #[tokio::test]
+    async fn a_claim_and_a_completion_asked_twice_under_a_key_happen_once() {
+        let (_dir, s) = server().await;
+        for title in ["First", "Second"] {
+            let filed = payload(
+                &s.create_task(Parameters(CreateTaskParams {
+                    title: title.into(),
+                    body: "Do it.".into(),
+                    ..CreateTaskParams::default()
+                }))
+                .await
+                .unwrap(),
+            );
+            let id = filed["task"]["id"].as_str().unwrap();
+            s.memory.admit(id).await.unwrap();
+        }
+        let claim = || async {
+            payload(
+                &s.claim_next(Parameters(ClaimNextParams {
+                    attempt: Some("try-1".into()),
+                    ..ClaimNextParams::default()
+                }))
+                .await
+                .unwrap(),
+            )
+        };
+        let first = claim().await;
+        let again = claim().await;
+        assert_eq!(again["task"]["id"], first["task"]["id"]);
+        assert_eq!(again["generation"], 1);
+        let id = first["task"]["id"].as_str().unwrap().to_string();
+        let h = write_handoff(&s, "Done.").await;
+        let complete = |id: String, h: String| async {
+            s.complete(Parameters(CompleteParams {
+                id,
+                handoff: h,
+                attempt: Some("done-1".into()),
+                ..CompleteParams::default()
+            }))
+            .await
+        };
+        let done = payload(&complete(id.clone(), h.clone()).await.unwrap());
+        let done_again = payload(&complete(id.clone(), h.clone()).await.unwrap());
+        assert_eq!(done_again["task"], done["task"]);
+        assert_eq!(done["task"]["status"], "done");
+        // the key claimed that task, whose claim is over: it claims nothing more
+        let spent = s
+            .claim_next(Parameters(ClaimNextParams {
+                attempt: Some("try-1".into()),
+                ..ClaimNextParams::default()
+            }))
+            .await;
+        let why = spent
+            .err()
+            .map(|e| e.message.to_string())
+            .unwrap_or_default();
+        assert!(why.contains("try-1"), "{why}");
+    }
+
     #[test]
     fn write_refuses_a_parameter_it_does_not_have() {
         let old =
diff --git a/docs/terms.md b/docs/terms.md
index 2e4ad4e7..6e39dbd0 100644
--- a/docs/terms.md
+++ b/docs/terms.md
@@ -62,6 +62,7 @@ term here in the same commit as the first document that needs it.
 | task state | `proposed`, `open`, `blocked`, `claimed`, `done` or `invalidated`: where a task is on the ledger | admitted (for `open`), completed (for `done`), status (for a state in prose) |
 | generation | The number of a claim of a task. Each claim gets the next number. A heartbeat, a completion and a release carry it, and the ledger refuses an earlier one | attempt (for a generation), fencing token |
 | late handoff | A handoff that a holder leaves on a task after its claim is over | |
+| attempt key | A key that a caller makes for one claim or one completion. The same key asked again gives the same result, and the ledger does the operation one time | idempotency key, request id |
 | task definition | The record in the platform domain for one kind of work: its purpose, its tools, its acceptance checks and its outputs. A task names one as `<name>@<version>` | task type, task template |
 | quarantine | `state/quarantine`, where the policy holds a write that it refused, for the owner to release or drop | |
 | owner | The person who holds the root and its grants | user (for the owner), admin |
diff --git a/local/README.md b/local/README.md
index 3bd1a41c..17f259ce 100644
--- a/local/README.md
+++ b/local/README.md
@@ -607,8 +607,22 @@ The ledger does not admit a task that depends on an invalidated task. An erasure
 invalidates a task sends the tasks that it blocked back to `proposed`, as each
 invalidation does.
 
-Not built yet: an attempt key for each operation, a block on a new claim while an external
-effect is uncertain, and a `blocked` state for a task that waits on an outside event.
+A claim and a completion can carry an attempt key, which the caller makes. A caller that
+did not get the answer asks again with the same key:
+
+- `claim_next` with the same key gives the same claim, while that claim is in force. It
+  does not give a second task. When that claim is over, the ledger refuses the key.
+- `complete` with the same key gives the done task. The ledger completes the task one
+  time.
+- The ledger refuses a key that was used for a different task or a different operation.
+
+The memory tools `claim_next` and `complete` take `attempt`. `amem task claim-next` and
+`amem task complete` take `--attempt`. The key is in the event of the claim or the
+completion, so the ledger finds it again after a rebuild.
+
+Not built yet: an attempt key for the other operations, a block on a new claim while an
+external effect is uncertain, and a `blocked` state for a task that waits on an outside
+event.
 
 ## Task definitions: `platform task`
 

From 09bfe149d629f314a65a54f994a5f6433d370311 Mon Sep 17 00:00:00 2001
From: Sander Striker <s.striker@striker.nl>
Date: Thu, 12 Nov 2026 13:25:39 +0100
Subject: [PATCH 2/2] test: hold the attempt key rules that the second pass
 found untested

The second adversarial pass found no defect in behaviour. It found rules
that no test held. Each new assertion failed against a mutation of the
code before this commit kept it.

- Two connections with one key make one claim. Without the domain lock
  in the PostgreSQL lookup, the new test fails.
- A lapsed lease ends the claim of a key. A caller without the
  requirements of the task does not get the claim back.
- A completion asked again closes no task up its chain.

Changes in behaviour:

- The kept key is the session and the caller's key. The operation prefix
  is gone, because the ledger looks among claims or among completions.
- A refusal names the key as the caller gave it.
- `complete` reads the task with the ledger locked, so a second call
  with the same key reads what the first call left.
- The message and the README say that a key is ASCII, and that a key
  belongs to one domain.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
---
 crates/ledger/src/lib.rs | 35 ++++++++++++++++
 crates/server/src/lib.rs | 91 +++++++++++++++++++++++++++++++---------
 crates/server/src/mcp.rs |  5 ++-
 local/README.md          |  9 ++--
 4 files changed, 115 insertions(+), 25 deletions(-)

diff --git a/crates/ledger/src/lib.rs b/crates/ledger/src/lib.rs
index 24d78e77..e5c635d9 100644
--- a/crates/ledger/src/lib.rs
+++ b/crates/ledger/src/lib.rs
@@ -1933,6 +1933,7 @@ mod tests {
     on_both! {
         a_claim_asked_twice_under_one_key_is_one_claim,
         a_key_gives_no_task_above_the_caller_s_handling,
+        two_connections_under_one_key_make_one_claim,
         a_completion_asked_twice_under_one_key_is_one_completion,
         of_two_tasks_of_one_priority_the_one_filed_first_is_claimed_first,
         a_lease_that_ran_out_half_a_second_ago_is_lost_to_claim_next,
@@ -2438,6 +2439,8 @@ mod tests {
         // the claim the key made is lost, and its holder claims the task again without
         // the key: a live lease of the same name, at the next generation
         *now.lock().unwrap() = T0 + mins(31);
+        // a lapsed lease alone ends the claim: the key gets nothing, and no new task
+        assert!(is_spent(&next_once(l, "s1", "key-1").await));
         let reclaimed = claim(l, &first.id, "s1", mins(30)).await.unwrap();
         assert_eq!(reclaimed.generation, 2);
         assert!(is_spent(&next_once(l, "s1", "key-1").await));
@@ -2462,6 +2465,38 @@ mod tests {
             "{:?}",
             capped.map(|c| c.map(|c| c.task.id))
         );
+        // nor to a caller that lacks what the task requires
+        let mut needs = spec("Train the model");
+        needs.requirements = vec!["gpu".into()];
+        let needs = admitted(&mut l, needs).await;
+        let gpu = ["gpu".to_string()];
+        let with = l
+            .claim_next_once("dom-a", "s1", mins(30), (&gpu, Label::Restricted), "key-2")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(with.task.id, needs.id);
+        assert!(is_spent(&next_once(&mut l, "s1", "key-2").await));
+    }
+
+    /// Two ledgers over the same tables, one caller asking both with one key at the same
+    /// time: one claim, and no second task.
+    async fn two_connections_under_one_key_make_one_claim(b: &Site) {
+        let (mut l1, _) = b.ledger().await;
+        let (mut l2, _) = b.ledger().await;
+        for round in 1..=15 {
+            admitted(&mut l1, spec("One")).await;
+            admitted(&mut l1, spec("Other")).await;
+            let key = format!("key-{round}");
+            let (c1, c2) = tokio::join!(
+                next_once(&mut l1, "s1", &key),
+                next_once(&mut l2, "s1", &key),
+            );
+            let (c1, c2) = (c1.unwrap().unwrap(), c2.unwrap().unwrap());
+            assert_eq!(c1.task.id, c2.task.id, "round {round}");
+            let held = l1.list("dom-a", Status::Claimed).await.unwrap();
+            assert_eq!(held.len(), round, "one claim a round");
+        }
     }
 
     async fn a_completion_asked_twice_under_one_key_is_one_completion(b: &Site) {
diff --git a/crates/server/src/lib.rs b/crates/server/src/lib.rs
index c7197d3d..41ef88ef 100644
--- a/crates/server/src/lib.rs
+++ b/crates/server/src/lib.rs
@@ -1419,9 +1419,10 @@ impl Memory {
     }
 
     /// The key the ledger keeps for a caller's attempt key: the caller's own, which is a
-    /// short name, under this session and the operation. One session's key is thus no
-    /// other session's, whoever its author is, and a claim's key is no completion's.
-    fn attempt_key(&self, op: &str, key: &str) -> Result<String, Error> {
+    /// short name, under this session. One session's key is thus no other session's,
+    /// whoever its author is. The ledger looks a key up among claims or among
+    /// completions, so one key serves both.
+    fn attempt_key(&self, key: &str) -> Result<String, Error> {
         let plain = !key.is_empty()
             && key.len() <= 64
             && key
@@ -1429,10 +1430,27 @@ impl Memory {
                 .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-'));
         if !plain {
             return Err(Error::Denied(
-                "an attempt key is 1 to 64 letters, digits, dots, hyphens or underscores".into(),
+                "an attempt key is 1 to 64 ASCII letters, digits, dots, hyphens or underscores"
+                    .into(),
             ));
         }
-        Ok(format!("{op}:{}:{key}", self.session_id))
+        Ok(format!("{}:{key}", self.session_id))
+    }
+
+    /// A refusal of an attempt key, in the caller's own words: the ledger's names the
+    /// key as it is kept, which the caller did not type.
+    fn in_own_words<T>(
+        answer: Result<T, dm_ledger::Error>,
+        attempt: Option<&str>,
+    ) -> Result<T, Error> {
+        answer.map_err(|e| match (e, attempt) {
+            (dm_ledger::Error::AttemptSpent { .. }, Some(key)) => {
+                Error::Ledger(dm_ledger::Error::AttemptSpent {
+                    key: key.to_string(),
+                })
+            }
+            (e, _) => Error::Ledger(e),
+        })
     }
 
     /// This session as the holder under the claim of `generation`.
@@ -2691,13 +2709,14 @@ impl Memory {
         let domain = self.resolve_domain(domain)?;
         let handling = self.handling()?;
         let can = self.capabilities();
-        let attempt = attempt.map(|k| self.attempt_key("claim", k)).transpose()?;
+        let kept = attempt.map(|k| self.attempt_key(k)).transpose()?;
         let mut l = self.ledger.lock().await;
-        let claim = match &attempt {
-            Some(key) => {
+        let claim = match &kept {
+            Some(key) => Self::in_own_words(
                 l.claim_next_once(&domain, &self.author, lease, (&can, handling), key)
-                    .await?
-            }
+                    .await,
+                attempt,
+            )?,
             None => {
                 l.claim_next(&domain, &self.author, lease, &can, handling)
                     .await?
@@ -2777,28 +2796,28 @@ impl Memory {
         handoff: &str,
         attempt: Option<&str>,
     ) -> Result<Task, Error> {
-        let task = self.ledger.lock().await.get(id).await?;
+        // the ledger stays locked from the read of the task to its completion: a second
+        // call under the same key then reads what the first one left
+        let mut l = self.ledger.lock().await;
+        let task = l.get(id).await?;
         self.check_task(&task)?;
         if self.store.get(&task.spec.domain, handoff).await?.is_none() {
             return Err(Error::NotFound(format!("handoff {handoff}")));
         }
-        let mut l = self.ledger.lock().await;
-        let attempt = attempt
-            .map(|k| self.attempt_key("complete", k))
-            .transpose()?;
+        let kept = attempt.map(|k| self.attempt_key(k)).transpose()?;
         // a completion asked again under its key comes after this session forgot the
         // claim: the task's own generation then stands in, and the ledger answers by
         // the key, or refuses a task that is done as it would anyone. Nothing more
         // happens for it: the task, and what its completion closed, are as they were
-        if let (Some(key), dm_ledger::Status::Done) = (&attempt, task.status) {
+        if let (Some(key), dm_ledger::Status::Done) = (&kept, task.status) {
             let by = self.under(task.generation);
-            let same = l.complete_once(id, by, handoff, key).await?;
+            let same = Self::in_own_words(l.complete_once(id, by, handoff, key).await, attempt)?;
             self.observe_task(&same);
             return Ok(same);
         }
         let by = self.under(self.claim_of(id, generation)?);
-        let done = match &attempt {
-            Some(key) => l.complete_once(id, by, handoff, key).await?,
+        let done = match &kept {
+            Some(key) => Self::in_own_words(l.complete_once(id, by, handoff, key).await, attempt)?,
             None => l.complete(id, by, handoff).await?,
         };
         lock(&self.claims).remove(id);
@@ -6662,7 +6681,7 @@ mod tests {
         );
         assert_eq!(capped.label(), Label::Public);
         // a key is a short name, not text
-        for bad in ["", "two words", "a/b", &"k".repeat(65)] {
+        for bad in ["", "two words", "a/b", "cl\u{e9}", &"k".repeat(65)] {
             let refused = first.claim_next_once(None, lease, Some(bad)).await;
             assert!(matches!(refused, Err(Error::Denied(_))), "{bad:?}");
         }
@@ -6723,6 +6742,38 @@ mod tests {
         );
     }
 
+    /// A completion asked again closes nothing that the first call left open.
+    #[tokio::test]
+    async fn a_completion_asked_again_closes_no_task_up_its_chain() {
+        let dir = tempfile::tempdir().unwrap();
+        let m = mem(dir.path());
+        let parent = filed(&m, tspec("Parent", 0, None, &[], &[])).await;
+        let h = WriteRequest {
+            entry_type: EntryType::Handoff,
+            ..req("Done.\n")
+        };
+        let h = m.write(h).await.unwrap().id;
+        let lease = Duration::minutes(5);
+        // the parent is held, so the continuation's completion does not close it
+        m.claim(&parent.id, lease).await.unwrap();
+        let origin = format!("continues:{}", parent.id);
+        let next = filed(&m, tspec("Continuation", 0, Some(&origin), &[], &[])).await;
+        m.claim(&next.id, lease).await.unwrap();
+        m.complete_once(&next.id, None, &h, Some("done-1"))
+            .await
+            .unwrap();
+        m.release(&parent.id, None, None).await.unwrap();
+        let again = m
+            .complete_once(&next.id, None, &h, Some("done-1"))
+            .await
+            .unwrap();
+        assert_eq!(again.status, dm_ledger::Status::Done);
+        assert_eq!(
+            m.get_task(&parent.id).await.unwrap().status,
+            dm_ledger::Status::Open
+        );
+    }
+
     async fn done(m: &Memory, s: TaskSpec) {
         let t = filed(m, s).await;
         let mut l = m.ledger.lock().await;
diff --git a/crates/server/src/mcp.rs b/crates/server/src/mcp.rs
index 68d06fb3..9b11c191 100644
--- a/crates/server/src/mcp.rs
+++ b/crates/server/src/mcp.rs
@@ -1476,7 +1476,10 @@ mod tests {
             .err()
             .map(|e| e.message.to_string())
             .unwrap_or_default();
-        assert!(why.contains("try-1"), "{why}");
+        assert_eq!(
+            why,
+            "the attempt key try-1 was used before, and that attempt is over"
+        );
     }
 
     #[test]
diff --git a/local/README.md b/local/README.md
index bdbb74ee..985153f4 100644
--- a/local/README.md
+++ b/local/README.md
@@ -616,10 +616,11 @@ did not get the answer asks again with the same key:
   completes the task one time, and nothing else occurs for the second call. With a
   different handoff, the ledger refuses the key.
 
-The memory tools `claim_next` and `complete` take `attempt`. A key is 1 to 64 letters,
-digits, dots, hyphens or underscores. A key belongs to one session and one operation:
-a different session with the same key makes its own claim, and one key can be used for a
-claim and for a completion. The ledger looks for the key in the transaction that makes
+The memory tools `claim_next` and `complete` take `attempt`. A key is 1 to 64 ASCII
+letters, digits, dots, hyphens or underscores. A key belongs to one session and one
+domain. A different session with the same key makes its own claim. The same key with a
+different `domain` also makes its own claim. One key can be used for a claim and for a
+completion. The ledger looks for the key in the transaction that makes
 the claim. The key is in the event of the claim or the completion, so the ledger finds it
 again after a rebuild. A command has no session, so `amem task` has no attempt key.