4. Incident: The Double Refund

Evidence

The refund succeeds, but its network response is lost. Kintsu Agent sees a timeout and retries. The customer receives two $49 refunds.

Root cause

Retry improved delivery but made an unsafe side effect repeat. At-least-once execution requires deduplication at the system that owns the side effect.

Make the retry safe

Send a stable idempotency key such as refund-order-123. On the first call, execute and store the result. On later calls with the same key, return that stored result without issuing another refund.

Lab

Implement idempotent issue_refund() in Kintsu Agent. Then deduplicate a webhook stream containing e1, e1, e2, e1. Persist the decision so multiple instances agree.

Verify

Simulate a lost response and concurrent duplicate calls. The outcome must contain one financial side effect and repeatable responses for every caller.