[Sacho]

I agree with you generally that talking about 'safe' may be misleading. However, I don't think your example shows that idempotent operations can be 'unsafe' - I think it shows that the translation of user's intent to a system operation was lossy. The user's intent was to "buy a total of 90". Translating that to "Set my current order to 90", regardless of the idempotency of the operation, is not accurate, for precisely the reasons you stated. Neither is "reduce my order by 10", because the user may attempt to send the message "set my current order to 90/reduce my order by 10" multiple times(just to make sure it went through), and then they would get to buy less than 90 shares.

It would take different data structures and a different API to translate the user's intent correctly, and then the idempotence of the operation may be important. For example, if the order had a "total" and "current balance", you could be sending a message to set the total to 90(which would internally reduce the current balance), and since that message is idempotent, it's safe to send it multiple times.