## Missing Idempotency (Critical)

### Trigger Signals

Start this detection when the following code characteristics appear:
- Write operations in route handlers (POST/PUT/DELETE)
- Message queue consumers (`onMessage`, `subscribe`, `handle`)
- Write operations in RPC/internal service methods
- Functions containing business keywords such as payment, claim, vote, check-in, submit

### Judgment Process

1. **Locate entry points**: `find_references` tracks all callers of write operation functions (routes, consumers, RPC entry points), confirming whether they are externally repeatable-triggered entry points
2. **Check idempotency mechanisms**: `Read` checks whether any of the following protections exist before the operation:
   - Unique constraint query (`SELECT ... WHERE unique_key = ?`, skip or return if exists)
   - Distributed lock (`setnx`, `acquire`, `lock`)
   - Idempotency token validation (`idempotencyKey`, `requestId`, `dedupKey`)
3. **Check database fallback**: `find_definition` looks up the corresponding database table/model definition, confirming whether there is a unique index to prevent duplicate records
4. **Verify idempotency key design**: If idempotency check exists, `Read` confirms the key composition:
   - Uses business-unique identifiers (order number + operation type, user ID + activity ID)
   - Does not use unreliable identifiers (timestamp, random number, incrementing sequence)

### Evidence Construction

After confirming a defect, the output must include:
- Trigger entry point (route/consumer/RPC method, with file:line number)
- Write operation chain (call path from entry point to actual write operation)
- Missing protection point (where a check should exist but does not)
- Business impact (consequences of repeated triggering: double spending, duplicate consumption, over-issuance, duplicate operations)

### Exclusions

- Naturally idempotent operations (queries, GET requests)
- Database unique constraints already fully cover the fields
- Message consumption with deduplication mechanism (e.g., Kafka consumer group + offset)
