I meant it as an example of retry protection the composer could adopt, not evidence that the composer already uses it. The docs explicitly say browser flows have not migrated to that API. Linking it without making that distinction was misleading; I haven't verified the composer's submission path.
#