Preventing Duplicate Password-Reset Notifications (Under SMS Timeout and Retry Pressure)
Treat an SMS timeout as an unknown outcome, not a failed send: accept each password-reset event once, persist its expiry and idempotency key before dispatch, and retry only through a worker that can reconcile the original attempt. For a short-lived e-commerce reset token, compliance evidence is the deciding constraint. The system must be able to show what it accepted, what it attempted, when it…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.
