Idempotency keys need an order of checks

// order matters: identity of the request first, then its progress
const row = await keys.find(userId, key);
if (!row) return claimAndRun();
if (row.fingerprint !== hash(method, path, body)) return reply(422); // different request, same key
if (row.status === 'processing') return reply(409);                  // same request, still running
return replay(row.responseStatus, decrypt(row.responseBody));        // same request, done