As a developer we should retally only once for a service type if the events in order:

While monitoring Splunk, I noticed an org "11009103" for which we had been retallying constantly past three weeks. When I investigated the issue, I discovered that it was due to the fact that we fetch the service types from the product configuration using a List rather than a Set, which resulted in duplicate service types and caused the retally to happen for that one org. Will create a card for that bug but, doesn't require a hotfix since it was already existing.

Splunk query: index=rh_rhsm namespace="rhsm-prod" "We appear to be retallying" check for Sept month.
Will put Splunk logs in comments for Redhat users.

The issue is we read List of service types instead of Set.

Done:
Retally shouldn't happen for ordered events.
Test to make sure for the org it doesn't retally.