Use POST for action that creates data,

duh.

Turbo cleverly pre-fetches GET requests to save loading time. But that resulted in dozens of unwanted clones.
Attack of the clones!!!

I checked: even though this route predates the new products screen, it wasn't being used anywhere else. The old products screen uses the API instead.

app/views/admin/products_v3/_product_row.html.haml

@@ -37,7 +37,7 @@
 %td.align-right
   = render(VerticalEllipsisMenu::Component.new) do
     = link_to t('admin.products_page.actions.edit'), edit_admin_product_path(product)
-    = link_to t('admin.products_page.actions.clone'), clone_admin_product_path(product)
+    = link_to t('admin.products_page.actions.clone'), clone_admin_product_path(product), method: :post
     %a{ "data-controller": "modal-link", "data-action": "click->modal-link#setModalDataSetOnConfirm click->modal-link#open",
         "data-modal-link-target-value": "product-delete-modal", "class": "delete",
         "data-modal-link-modal-dataset-value": {'data-current-id': product.id}.to_json }

config/routes/spree.rb

@@ -59,7 +59,7 @@ Spree::Core::Engine.routes.draw do
 
     resources :products, except: :index do
       member do
-        get :clone
+        post :clone
         get :group_buy_options
         get :seo
       end