A Bluesky starter pack is three records, and only the metadata edit is repeatable

The idempotency in this design sits in exactly one place. `putRecord` against a known rkey overwrites in place, so a rename or a feed swap leaves the same share URL standing ^[7]. Nothing on the create path behaves that way. Each `createRecord` mints a fresh rkey, and the protocol dedupes on no natural key such as a title, so a second run of a creation script yields a second pack, live and indexed, whose URL is not the one your script now reports ^[6]. None of this needs a privileged API: it is ordinary `com.atproto.repo` calls against your own PDS ^[8].

Count the writes. A twenty-person pack is one list record, twenty listitems and one starterpack record, so twenty-two writes before anything is shareable ^[1]. Filled to the documented cap of 150 people it is 152 sequential creates ^[2], and 150 of those carry the membership the artifact exists to express. The team behind the dev.to writeup says it slices to remaining capacity in its own code and has never pushed a list past the cap to see what the record layer does ^[12].

Retry safety therefore has to live in the read rather than the write. According to the writeup, the add-members path takes the existing list's AT-URI, fetches current members through `app.bsky.graph.getList` while paginating on the cursor, dedupes the incoming batch against that fetched set and against itself, slices to remaining capacity, and only then loops the listitem creates ^[10]. The cursor is the load-bearing detail. Dedupe against page one alone and every member past that boundary looks absent, so the retry that was supposed to be safe writes duplicates ^[10].

The error contract follows from the same mechanism. If member 14 of 24 fails, thirteen listitems are already committed in the repo, and raising an exception reports that nothing happened when something did; the pipeline instead returns the added-so-far result alongside the error and lets the next run's dedupe absorb the overlap ^[11].

One more consequence of the reference structure is worth naming, because it is where the public identity gets decided. The share URL is not returned by the API. It is derived: your handle plus the rkey tail of the starterpack record's AT-URI ^[5]. That means the name a pack is known by comes out of the one call in the pipeline that cannot be repeated. Everything downstream of it can be corrected with `putRecord`. The create cannot.