# The identity mix-up

Same key. Different request.

A changed request body is mistaken for a replay and receives the old receipt.

Authored synthetic exhibits for Retry Proof v1. These are not observed vendor bugs, outside contributions, concurrency tests, or a certification of an implementation.

Operation 3 keeps key A but changes its value from A to B. The reference refuses that conflict with 409. The body-blind model returns the old receipt, hiding the fact that this different request was not carried out.

Stripe documents comparing parameters when an idempotency key is reused, and AWS discusses reuse of a request identifier with different intent. Those are background examples of explicit API contracts; this exhibit does not reproduce either service.

An idempotency key identifies an intent. Reusing it with different content needs an explicit policy.

## Exact observations

Cells show status / receipt / cumulative committed writes.

| Step | Tick | Key | Value | Delivery | Reference | body-blind |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | 0 | B | B | received | 201 / 1 / 1 | 201 / 1 / 1 |
| 2 | 1 | A | A | received | 201 / 2 / 2 | 201 / 2 / 2 |
| 3 | 2 | A | B | received | 409 / none / 2 | 200 / 2 / 2 |
| 4 | 3 | A | A | received | 200 / 2 / 2 | 200 / 2 / 2 |

## Reuse this regression

Download [body-blind.test.mjs](https://boner.pics/bug-zoo/body-blind.test.mjs), inspect it, then use Node.js 24 or later:

```sh
node --test body-blind.test.mjs
```

This default only checks bundled models against hand-specified golden traces. It does not test your implementation or publish anything. The file is standalone and needs no package installation.

To test your implementation, set BUG_ZOO_ADAPTER to an explicitly selected trusted local module. See [adapter instructions](https://boner.pics/bug-zoo/README.md). The runner suppresses raw adapter logs/errors and terminates its Worker after a 3000 ms wall deadline; a Worker is not a security sandbox.

## Try a smaller counterexample

[Replay this exhibit](https://boner.pics/bug-zoo/body-blind/) or download [the candidate JSON](https://boner.pics/bug-zoo/body-blind.json). Keep the remaining operation fields, order and ticks unchanged. A local check is not a published receipt. [The contribution workbench](https://boner.pics/participate/?case=body-blind) requires your saved profile key and explicit consent before publication; the authored exhibit itself is not a receipt or a handoff parent.

## Background

- [Stripe API: Idempotent requests](https://docs.stripe.com/api/idempotent_requests)
- [AWS Builders’ Library: Making retries safe with idempotent APIs](https://aws.amazon.com/builders-library/making-retries-safe-with-idempotent-APIs/)

[MIT license](https://boner.pics/bug-zoo/LICENSE.txt). This license covers only the authored Bug Zoo dataset, its generated downloadable tests (including their embedded reference implementation), and their accompanying documentation in this directory. It does not license the rest of the site or repository, third-party references, or user contributions.