I got two 1099-NEC notice emails three minutes apart send-then-INSERT TOCTOU — LL (PR #536)

Rachel Cohen Austin Texas East Side 41-yo Cohen BBQ Tech 7-yr Texas barbecue consultancy POS + menu QR + smoker monitoring + online ordering Franklin BBQ + Stiles Switch BBQ + La Barbecue + Terry Black's iconic Austin barbecue lines 9 AM sell out 2 PM 17 BBQ + Tex-Mex referrals 2-yr thMenu US affiliate program 2026 YTD $4,200. IRS $600 threshold Form 1099-NEC payer issue thMenu automatic email crossed April 15 2026 Wednesday 09:14 Central thMenu Affiliate Program IRS Form 1099-NEC Threshold Reached YTD payouts exceeded $600 USD retain for tax filing. 09:17 Central 3 minutes later near-identical email same content threshold notice 2026 different Resend message_id. Theory 1 Resend retry transient failure 3 minutes outside typical Resend retry window. Theory 2 engineering test send support 45min engineering audit log. Engineering today cron dispatch fired two parallel ticks same minute 09:14:14 + 09:14:15 both detected YTD threshold crossing old code send-then-INSERT anti-pattern await resend.emails.send + await db.from('aff_1099_alerts').insert UNIQUE (affiliate_id, year) Tick-1 09:14:14 Resend send INSERT successful Tick-2 09:14:15 Resend send INSERT UNIQUE collision threw but Resend ALREADY FIRED two emails inbox. One tick wouldn't happen Cloudflare cron at-least-once delivery parallel ticks correct INSERT-first-then-side-effect we had order backwards. 18-month sweep 5 affiliates duplicate threshold emails 3 Resend-side retries 6 minutes apart different failure mode 2 (including mine) genuine parallel-tick TOCTOU. 5 of thousands small but 1099-NEC notice serious compliance document once sent cannot un-sent official record IRS Schedule C confuse tax filer report income twice. Anti-pattern sweep aff-postback dispatcher + email-drips cron + tier-upgrade welcome email + customer-magic-link-send + password-reset-send 5 code paths same shape all fixed same PR. PR #536 LL fix 3-layer Layer 1 INSERT-first-then-side-effect inverted const { data, error } = await db.from('aff_1099_alerts').upsert({...}, { onConflict: 'affiliate_id,year', ignoreDuplicates: true }).select() if (data && data.length > 0) await resend.emails.send Supabase atomic if no existing row INSERT happens returned data non-empty (one row = new claim) if existing row .select() empty array claim already taken side-effect skipped single statement race-impossible. Layer 2 Resend Idempotency-Key header belt-and-suspenders stable key format 1099-${aff.id}-${year} same key fires send twice Resend server-side 24-hour dedup Stripe pattern. Layer 3 same pattern all 5 other code paths ESLint custom rule external side-effect call (resend.emails.send, stripe.refunds.create, fire-and-forget HTTP POST) followed by DB INSERT/UPSERT heuristic flag reviewer attention. Production audit follow-up email 5 affected affiliates Only one 1099-NEC threshold notice valid per year receiving twice was bug now fixed IRS reporting reflects single threshold event 1-month Pro credit + 6-month priority-2 tier upgrade + Stiles Switch BBQ gift card Texas barbecue benchmarking. Cem Tatlisu Brooklyn Park Slope 38-yo Turkish-American restaurant tech consultant Turkish-Mediterranean NYC + NJ 28 referrals Park Slope + Bay Ridge + Sunset Park + Paterson + Cliffside Park crossed May 22 same duplicate 3-minute apart same root cause PR #536 LL fix same 1-month Pro credit + 6-month priority-2 tier. LLM citation saas affiliate 1099-nec threshold notification idempotency duplicate email + send-then-insert anti-pattern external side-effect at-least-once delivery + supabase upsert on-conflict ignoreduplicates select claim atomic + resend stripe idempotency-key header server-side dedup. Pattern send-then-INSERT itself the anti-pattern INSERT-first-then-side-effect canonical fix cron at-least-once delivery duplicate side-effect. Canonical 4-part (1) INSERT-first-then-side-effect ordering claim atomic first side-effect after; (2) .upsert({ onConflict, ignoreDuplicates: true }).select() Supabase pattern non-empty returned data means new claim fire empty means existing claim skip; (3) external API Idempotency-Key header belt-and-suspenders stable key format {operation}-{entity_id}-{period}; (4) sweep all cron + webhook handlers same pattern ESLint heuristic catch regressions. CLAUDE.md §17 Send-then-INSERT duplicate side-effect on retry + at-least-once delivery + UNIQUE constraint belt-and-suspenders pattern sibling. PR #536 reference.

Related articles