A client sends a request. The service performs the operation. The operation succeeds, but the response is lost before the client receives it.
The client now has two facts that do not agree: the service may have changed state, while the client has no confirmation that it did.
It retries. The important question is not whether the retry is easy to send. It is whether this operation can safely happen twice.
What are we assuming about ownership of the resulting state? What evidence would distinguish an operation that never happened from one whose response disappeared?
“Retries are safe, The client can know whether the operation completed”
- DocumentedDocumented: the client can observe a timeout. Assumed: the operation either completed or did not complete as one indivisible event. Unknown: whether the service completed the operation before the response was lost. Unknown: how duplicate requests are handled at the payment boundary.
What should happen next?
Do not make automatic retry the default until operation identity and duplicate behavior are explicit and tested.