Rules

A lookup-then-insert dedupe check with no atomic claim before the effect; concurrent duplicates both pass it.

A relative write (increment, x = x + n, $inc, push) runs with no dedupe guard.

A dedupe or idempotency key is derived from Date.now(), Math.random(), uuid(), or similar.

The event is marked processed before its work runs, outside one transaction and with no rollback.

A catch block swallows a failure of the handler's work and still acknowledges the event (2xx, or a completed job).

A non-idempotent effect (payment, email, plain insert, increment) runs with no dedupe guard on its path.

The response is sent before the work completes (or the work is not awaited), or slow work delays the response past the provider's timeout.

A dedupe key expires sooner than the provider's retry window.

An effect runs before the event is recorded, behind a check that is not an atomic claim.

A call whose SDK supports an idempotency key is made without one.

Several database writes on one path run outside a transaction, and at least one is not idempotent.

A permanent failure (invalid signature, malformed payload) is answered with 5xx, causing pointless retries.

An in-code retry (loop, p-retry, async-retry) wraps a non-idempotent call that has no stable idempotency key.

A dedupe key is derived from the object id inside the event (e.g. event.data.object.id) rather than the event id.

The handler sets state from several event types without checking a version or timestamp.

A job or message is enqueued without the queue's deduplication id (jobId, MessageDeduplicationId, event id).