A timeout can duplicate a refund, order or message. Two workers can each see the same remaining budget and overspend it. Reproduce both incidents locally, then inspect the API contract designed to stop them.
The simulation engines run locally and make zero provider calls; form values stay in this browser. The page records the minimal anonymous funnel events described below. Hosted purchase is shown as available only when backend, checkout, exact PAYG price, ledger qualification and isolated launch checks all agree. A separate status says whether any real paid fulfillment has been observed.
Choose the incident
Incident: a provider applies an action, its response is lost, and the agent retries with a new transport request.
Control: bind one logical action to one authority; ambiguous outcomes stop in unknown until readback attested by a registered server-side verifier.
Incident: parallel workers each approve themselves against the same stale balance.
Control: atomically reserve the maximum before work, then replace it with usage attested by a registered server-side verifier.
Run the free simulation