Idempotency-Key contract: claim → execute → complete/release with leased in-progress locks and SHA-256 request-hash validation. Concurrent identical requests collapse into a single execution; reused keys with different payloads return Conflict (not silent replay).