A water utility writes idempotent scripts so re-running containment does not break payroll VMs. What script design property is that?

Designing idempotent remediation scripts so repeated civic containment runs stay safe for systems like payroll VMs is the script property a water utility needs under IR stress. Idempotence means re-running containment converges on the same safe end state without compounding damage—critical when operators re-execute during uncertainty or when automation retries. Payroll and other shared municipal VMs must survive containment repetition without disk corruption or cascading outages. Locking version-tagged remediation scripts so repeated civic containment runs stay safe for systems like payroll VMs fails by concept: locking to a version-tagged script is version control that ensures consistency, but it does not by itself make the script's actions actually idempotent or prevent unsafe compounding on repeated containment runs. Checking declarative desired-state drift so repeated civic containment runs stay safe for systems like payroll VMs fails by concept: the property being asked about is the script's own ability to be re-run safely, not monitoring drift; declarative checks do not define idempotent remediation script design. Adding centralized execution logging so repeated civic containment runs stay safe for systems like payroll VMs fails by concept: logs are detective controls that record execution, but they do not make the containment script idempotent or stop repeated runs from compounding damage. Exam caveat: idempotent does not mean harmless in every context—some containment actions are intentionally disruptive once; the design must still make repeated invocation safe or clearly no-op after success. Operational check: execute the containment script twice in a lab twin of the payroll VM and confirm the second run makes no additional destructive changes while leaving the intended containment state intact.