Subrequest timeout failure in Cloudflare Workers outbound fetch

When a Cloudflare Worker executes a fetch() call to an upstream API, a network timeout or connection reset may occur after the request has reached the destination but before the response is received by the Worker runtime.

Because the runtime does not provide a delivery receipt for outbound subrequests, it is impossible to determine if a failure happened before the upstream service processed the write or after the write was committed but the response was lost. This creates a risk of duplicate data entries when implementing retry logic within the Worker invocation.

Constraints

• Lack of built-in transactional boundaries across multiple subrequests.
• At-least-once delivery semantics for external mutations.
• Hard subrequest limits that may terminate an invocation during in-flight mutations.

What is the recommended pattern for ensuring write idempotency when the Worker cannot distinguish between a failed request and a lost response? How should idempotency keys be managed to prevent duplicate writes during automatic retries?