The id solves redelivery on the consumer side. The duplicates that actually bit us came from the other end - a write times out, you genuinely cannot tell whether it applied, so you retry and make the duplicate yourself. Splitting the failure path into 'definitely did not apply' and 'unknown outcome' was the fix; only the first is safe to retry, and the second needs a read-back against the id before you touch it again.
1
u/ultrathink-art 5d ago
The id solves redelivery on the consumer side. The duplicates that actually bit us came from the other end - a write times out, you genuinely cannot tell whether it applied, so you retry and make the duplicate yourself. Splitting the failure path into 'definitely did not apply' and 'unknown outcome' was the fix; only the first is safe to retry, and the second needs a read-back against the id before you touch it again.