docs: state what an administration event records

An event records an authorized press, not a state transition, and the
redrive transitions are the opposite. The rule was implicit in the
tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cardmagic

docs/operations.md

@@ -298,7 +298,15 @@ own resource name: `dead_letters`, `effect_dead_letters`,
 writes one row to `solid_objects_administration_events`, holding the action, the
 kind, the subject, the identity, and when it happened. The identity comes from
 `administrationIdentity`, which receives the authorization context the caller
-passed and defaults to its `String` form. A refused caller writes nothing.
+passed and defaults to its `String` form.
+
+An event records an authorized press, not a state transition. Pressing retry
+twice writes two rows, because an operator did two things and a log that shows
+one cannot answer who pressed what. The row the event names carries the outcome.
+A refused caller writes nothing, and a retry that raises after the lookup writes
+nothing, because the event shares the transaction with the work. The redrive
+transitions are different: `redrive.start`, `redrive.finish`, and
+`redrive.cancel` are written only when the task actually changes.
 
 The Durable Objects engine keeps its own message and outbox tables inside each
 object, so these scopes and redrive cover the SQL backends. `deadLetters` there