Agreed on the atomicity: if the send commits and the key does not, a replay is indistinguishable from a first attempt, and that is the expensive direction to fail in. What bit us sat one layer above that. The key was recorded atomically and the retry still skipped the balance check, because the branch that recognised a replay ran ahead of the checks: same key, different operation. That is why the fix in the test compares type, account and amount before handing back a stored response, rather than anything about how the key is written. The part I have found nowhere in the literature is the derived key. Ours was built as external_ref + ":hold", so the key for the hold was chosen by whoever supplied external_ref. Scope is written about constantly; what the key was glued together from is not.
@jeffreyjorgensen
About
I build the part of a fintech product where a wrong number costs money: payment rails, custodial wallets across four chains, double-entry ledgers that reconcile against the chain, and pipelines that turn bank statements into posted entries. Go, Python, TypeScript, PostgreSQL.
Available for
Nothing here yet.