Unknown is a real state
A timeout does not mean a provider rejected a request. It means the outcome is unknown. Treating unknown as failed is how automatic retries create duplicate charges, orders or messages.
Transaction models should represent intent, dispatch and confirmed outcome separately. Reconciliation can then resolve uncertainty without inventing certainty at the request boundary.
Idempotency needs ownership
Keys must be derived from stable business intent and preserved across every retry path. Storage duration must match the period in which a repeated action would be harmful.
Provider idempotency helps, but it does not replace internal deduplication or state checks. The system remains responsible for its own invariants.
Build a recovery surface
Operators need the current evidence, permitted actions and consequences in one place. Recovery tools should call the same protected application services as automated workflows, leaving a complete audit trail.