NOTE / SAMPLE /
Idempotency is cheaper than debugging duplicate side effects
Retry policy starts with knowing which operations can safely happen twice.
Delivery and effect are different
A timeout does not tell the caller whether the remote system performed the work. Blindly repeating a payment, notification, or provisioning call turns a transport failure into a business failure.
Give each intended effect a durable identity. Record what is known before retrying, and reconcile uncertainty explicitly.
The small design choice
Idempotency keys, state transitions, and reconciliation queues are not distributed-systems ornament. They are usually less code than the cleanup logic required after duplicate effects reach production.