Most ledger drift we are asked to fix has the same cause: the write path was not idempotent, and the retry logic was added later to compensate.
A retry policy decides when to try again. Idempotency decides whether trying again is safe. If the second one is missing, the first one is a machine for creating duplicates under exactly the conditions you least want them — a timeout during settlement.
The fix is unglamorous: a caller-supplied key, a uniqueness constraint, and a decision about what the second call returns.