https://hugozhu.site/tags/semantic-failure/Recent content in Semantic-Failure on All about Raspberry PiHugoenSun, 06 Sep 2026 00:00:00 +0000https://hugozhu.site/post/2026/391-idempotency-keys-duplicate-vs-wrong-refund/Sun, 06 Sep 2026 00:00:00 +0000https://hugozhu.site/post/2026/391-idempotency-keys-duplicate-vs-wrong-refund/<p>TikTok 的 SRE Salman Munaf 最近有一场演讲，开场问题问得很漂亮：</p> <blockquote> <p>你的 AI Agent 调用退款接口，网络超时了。那退款到底成功没有？</p> </blockquote> <p>他的答案是：超时从来不意味着失败，而意味着「未知」。Agent 遇到失败的第一反应是重试，没有请求 ID、幂等键和状态查询，这个本能就会把一笔退款退成两笔。整场演讲的论点一句话概括：<strong>模型一旦开始调用外部服务，问题就从模型问题变成了分布式系统问题</strong>——几十年前命名过的故障模式全部回归，SRE 工具箱必须整体搬进 Agent 架构。</p> <p>我同意。但我想在他的问题后面再问一句：</p> <p><strong>就算退款成功了——那笔退款，退得对吗？</strong></p> <p>这两个问题之间的距离，就是这篇文章要讲的东西。</p> <p><a href="https://hugozhu.site/img/2026/idempotency-keys-duplicate-vs-wrong-refund.png"><img src="https://hugozhu.site/img/2026/idempotency-keys-duplicate-vs-wrong-refund-thumb.jpg" alt="Idempotency Keys Stop Duplicate Refunds, Not Wrong Ones — Where the Distributed Systems Analogy for AI Agents Breaks Down"></a></p>