Duplicates, replays and why exactly once is a story
Retry is the first thing added to an interface and the first thing to cause real harm. A payment file transmitted twice, a goods receipt posted twice, a sales order created twice, all because the sender never received an acknowledgement and did the obvious thing. Nothing failed in any log. The receiving system did exactly what it was asked to do, correctly, on both occasions, and the problem is found by a supplier who has been paid the same invoice on consecutive days.
Design for at least once delivery with a receiver that can recognise a repeat. Every message carries a stable identity from the source system, and the receiver keeps a record of the identities it has already processed, so a duplicate is acknowledged politely and not posted again. Where the target has no natural key available, add a reference field, index it, and make the check part of the interface rather than a stored procedure somebody remembers to call.
Support work needs one more thing: a correlation reference that appears in the source record, the message log, the target document and the alert. Without it, diagnosing an incident becomes an exercise in matching timestamps across three systems whose clocks disagree. The limit here is honest and specific. Idempotency has to be designed per flow, against the semantics of that flow. No middleware setting provides it generically, whatever a product datasheet implies about guaranteed delivery.
- A stable source identity carried on every message and stored by the receiving system
- Duplicate detection built into the interface rather than relied upon downstream
- A correlation reference visible in source record, message log, target document and alert
- Idempotency designed per flow, since delivery guarantees alone do not prevent double posting
- Payment and posting flows treated as the highest risk for replay and reviewed first