Thesis: The form mints one token when it opens and sends that token with the POST. The first call stores the answer. A retry with the same token returns that answer and does not open a second record.
What we tried first
Every successful POST minted a new confirmation. The browser showed two numbers after a double submit. Disabling the button stopped the impatient click. It did not stop a replay: the same body, sent again from the network log, created another record.
The working shape
The token is the boundary, not the button.
form opened → mint token
POST { ..., token }
first call → store the answer
same token → return the stored answerChecklist
- Mint the token when the form opens, not on each click.
- Send the token on the POST.
- On a known token, return the stored answer. Do not create a second record.
How we deliver: methodology.
Engineering commentary only — not audit, legal, or certification advice.